@teleporthq/teleport-plugin-next-workflows 0.43.1

package/dist/esm/secret-collector.js

@@ -0,0 +1,105 @@
+import { nodeRegistry } from './nodes';
+const KNOWN_SECRET_FIELDS = {
+    'ai-custom-prompt': ['token'],
+    'ai-sentiment-analysis': ['token'],
+    'ai-summarization': ['token'],
+    'ai-text-classifier': ['token'],
+    'ai-text-transform': ['token'],
+    'ai-detect-language': ['token'],
+    'ai-generate-text-embedding': ['token'],
+    'email-mailersend': ['apiKey'],
+    'email-mailgun': ['apiKey'],
+    'email-postmark': ['serverToken'],
+    'email-resend': ['apiKey'],
+    'email-sendgrid': ['apiKey'],
+    'sms-textmagic': ['apiKey'],
+    'sms-infobip': ['apiKey'],
+    'sms-twilio': ['accountSid', 'authToken'],
+    'sms-smsapi': ['accessToken'],
+    'general-http-request': [],
+    'payment-charge-user': ['secretKey', 'clientId', 'clientSecret'],
+    'payment-subscribe-to-plan': ['secretKey'],
+    'payment-cancel-plan': ['secretKey'],
+    'payment-create-customer': ['secretKey', 'clientId', 'clientSecret'],
+    'payment-create-product': ['secretKey'],
+    'payment-create-subscription': ['secretKey'],
+    'payment-get-customer': ['secretKey'],
+    'payment-get-product': ['secretKey'],
+    'payment-list-customers': ['secretKey'],
+    'payment-list-plans': ['secretKey'],
+    'payment-list-products': ['secretKey'],
+    'payment-list-subscriptions': ['secretKey'],
+    'payment-update-customer': ['secretKey'],
+};
+export const collectSecrets = (workflows) => {
+    const secrets = [];
+    const seenEnvVars = new Set();
+    const processNode = (node) => {
+        const secretFields = getSecretFieldsForNode(node.type);
+        for (const field of secretFields) {
+            const value = node.config[field];
+            if (value && typeof value === 'string' && !isWorkflowContextValue(value)) {
+                const envVarName = generateEnvVarName(node.type, field, node.id);
+                if (!seenEnvVars.has(envVarName)) {
+                    seenEnvVars.add(envVarName);
+                    secrets.push({
+                        envVarName,
+                        value: value,
+                        nodeId: node.id,
+                        fieldName: field,
+                    });
+                }
+            }
+        }
+    };
+    const allWorkflows = workflows.workflows;
+    Object.values(allWorkflows).forEach((wf) => {
+        wf.nodes.forEach(processNode);
+    });
+    if (workflows.customNodes) {
+        Object.values(workflows.customNodes).forEach((cn) => {
+            cn.nodes.forEach(processNode);
+        });
+    }
+    return secrets;
+};
+const getSecretFieldsForNode = (nodeType) => {
+    if (KNOWN_SECRET_FIELDS[nodeType]) {
+        return KNOWN_SECRET_FIELDS[nodeType];
+    }
+    if (nodeType.startsWith('integration-')) {
+        const generator = nodeRegistry[nodeType];
+        if (generator && 'secretFields' in generator) {
+            return generator.secretFields || [];
+        }
+        return ['token', 'apiKey', 'accessToken', 'secretKey'];
+    }
+    return [];
+};
+const generateEnvVarName = (nodeType, fieldName, nodeId) => {
+    const prefix = 'WORKFLOW_SECRET';
+    const typePart = nodeType.replace(/-/g, '_').toUpperCase();
+    const fieldPart = fieldName.replace(/([A-Z])/g, '_$1').toUpperCase();
+    const idPart = nodeId
+        .replace(/[^a-zA-Z0-9]/g, '_')
+        .substring(0, 8)
+        .toUpperCase();
+    return `${prefix}_${typePart}_${fieldPart}_${idPart}`;
+};
+const isWorkflowContextValue = (value) => {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.type === 'workflowContext');
+};
+export const replaceSecretsInConfig = (config, nodeType, nodeId, secrets) => {
+    const result = Object.assign({}, config);
+    const secretFields = getSecretFieldsForNode(nodeType);
+    for (const field of secretFields) {
+        const secret = secrets.find((s) => s.nodeId === nodeId && s.fieldName === field);
+        if (secret) {
+            result[field] = secret.envVarName;
+        }
+    }
+    return result;
+};
+//# sourceMappingURL=secret-collector.js.map

package/dist/esm/secret-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-collector.js","sourceRoot":"","sources":["../../src/secret-collector.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEtC,MAAM,mBAAmB,GAA6B;IACpD,kBAAkB,EAAE,CAAC,OAAO,CAAC;IAC7B,uBAAuB,EAAE,CAAC,OAAO,CAAC;IAClC,kBAAkB,EAAE,CAAC,OAAO,CAAC;IAC7B,oBAAoB,EAAE,CAAC,OAAO,CAAC;IAC/B,mBAAmB,EAAE,CAAC,OAAO,CAAC;IAC9B,oBAAoB,EAAE,CAAC,OAAO,CAAC;IAC/B,4BAA4B,EAAE,CAAC,OAAO,CAAC;IACvC,kBAAkB,EAAE,CAAC,QAAQ,CAAC;IAC9B,eAAe,EAAE,CAAC,QAAQ,CAAC;IAC3B,gBAAgB,EAAE,CAAC,aAAa,CAAC;IACjC,cAAc,EAAE,CAAC,QAAQ,CAAC;IAC1B,gBAAgB,EAAE,CAAC,QAAQ,CAAC;IAC5B,eAAe,EAAE,CAAC,QAAQ,CAAC;IAC3B,aAAa,EAAE,CAAC,QAAQ,CAAC;IACzB,YAAY,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;IACzC,YAAY,EAAE,CAAC,aAAa,CAAC;IAC7B,sBAAsB,EAAE,EAAE;IAC1B,qBAAqB,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;IAChE,2BAA2B,EAAE,CAAC,WAAW,CAAC;IAC1C,qBAAqB,EAAE,CAAC,WAAW,CAAC;IACpC,yBAAyB,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;IACpE,wBAAwB,EAAE,CAAC,WAAW,CAAC;IACvC,6BAA6B,EAAE,CAAC,WAAW,CAAC;IAC5C,sBAAsB,EAAE,CAAC,WAAW,CAAC;IACrC,qBAAqB,EAAE,CAAC,WAAW,CAAC;IACpC,wBAAwB,EAAE,CAAC,WAAW,CAAC;IACvC,oBAAoB,EAAE,CAAC,WAAW,CAAC;IACnC,uBAAuB,EAAE,CAAC,WAAW,CAAC;IACtC,4BAA4B,EAAE,CAAC,WAAW,CAAC;IAC3C,yBAAyB,EAAE,CAAC,WAAW,CAAC;CACzC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAwB,EAAiB,EAAE;IACxE,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,MAAM,WAAW,GAAG,CAAC,IAAsB,EAAE,EAAE;QAC7C,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAChC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE;gBACxE,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;oBAChC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;oBAC3B,OAAO,CAAC,IAAI,CAAC;wBACX,UAAU;wBACV,KAAK,EAAE,KAAe;wBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAA;iBACH;aACF;SACF;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,SAA0D,CAAA;IACzF,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACzC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,IAAI,SAAS,CAAC,WAAW,EAAE;QACzB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,EAA0B,EAAE,EAAE;YAC1E,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;KACH;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,CAAC,QAAgB,EAAY,EAAE;IAC5D,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE;QACjC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAA;KACrC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE;QACvC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,SAAS,IAAI,cAAc,IAAI,SAAS,EAAE;YAC5C,OAAQ,SAAiB,CAAC,YAAY,IAAI,EAAE,CAAA;SAC7C;QACD,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;KACvD;IAED,OAAO,EAAE,CAAA;AACX,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc,EAAU,EAAE;IACzF,MAAM,MAAM,GAAG,iBAAiB,CAAA;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1D,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACpE,MAAM,MAAM,GAAG,MAAM;SAClB,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;SACf,WAAW,EAAE,CAAA;IAChB,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAW,EAAE;IACzD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,IAAI,KAAK,iBAAiB,CAC9D,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,MAA+B,EAC/B,QAAgB,EAChB,MAAc,EACd,OAAsB,EACG,EAAE;IAC3B,MAAM,MAAM,qBAAQ,MAAM,CAAE,CAAA;IAC5B,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAErD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAA;QAChF,IAAI,MAAM,EAAE;YACV,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;SAClC;KACF;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA"}

package/dist/esm/security-scanner.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Codegen-time security gate. Run from `NextWorkflowProjectPlugin.runBefore`
+ * over every `general-custom-js` node's `config.code`. Refuses to generate
+ * code containing obvious protected-env-var access or sandbox-escape
+ * primitives so the codegen pipeline can't be coerced into shipping
+ * dangerous workflow code even if the GUI and services-worker layers were
+ * bypassed.
+ *
+ * Intentionally narrow + regex-based: the GUI runs the full AST scan
+ * (workflow-schema/src/security/scan-custom-js.ts) before the project
+ * reaches codegen, and the services-worker re-runs it on the publish
+ * payload. This file is the cheap third checkpoint — it catches the
+ * obvious naïve patterns and is cheap enough to run inside the codegen
+ * pipeline without pulling @babel/parser into this package.
+ *
+ * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
+ *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ */
+export declare const PROTECTED_ENV_NAMES: readonly ["TELEPORT_DB_CONNECTION_STRING", "RUNTIME_STORAGE_API_KEY", "RUNTIME_STORAGE_PROJECT_ID", "TELEPORT_PROJECT_TOKEN", "REALTIME_SERVER_API_KEY", "REALTIME_SERVER_URL", "PDF_SERVICE_URL", "PDF_SERVICE_API_KEY"];
+export interface CodegenSecurityViolation {
+    workflowId: string;
+    workflowName?: string;
+    nodeId: string;
+    rule: string;
+    message: string;
+}
+export declare class CodegenSecurityError extends Error {
+    readonly violations: CodegenSecurityViolation[];
+    constructor(violations: CodegenSecurityViolation[]);
+}
+interface WorkflowNodeLike {
+    id?: string;
+    config?: {
+        code?: string;
+    };
+}
+interface WorkflowLike {
+    id?: string;
+    name?: string;
+    nodes?: WorkflowNodeLike[];
+}
+interface WorkflowsContainer {
+    workflows?: Record<string, WorkflowLike>;
+}
+/**
+ * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
+ * any `general-custom-js` body trips the scanner.
+ *
+ * Per `general-custom-js` the only place a user can write JS is the `code`
+ * config field, so we look only there. Other node types use structured
+ * configs we don't touch.
+ */
+export declare function assertWorkflowsAreSecure(workflowsContainer: WorkflowsContainer | undefined): void;
+export {};
+//# sourceMappingURL=security-scanner.d.ts.map

package/dist/esm/security-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner.d.ts","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,eAAO,MAAM,mBAAmB,2NAStB,CAAA;AAEV,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aACjB,UAAU,EAAE,wBAAwB,EAAE;gBAAtC,UAAU,EAAE,wBAAwB,EAAE;CAWnE;AAED,UAAU,gBAAgB;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3B;AAED,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC3B;AAED,UAAU,kBAAkB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CA2BjG"}

package/dist/esm/security-scanner.js

@@ -0,0 +1,156 @@
+/**
+ * Codegen-time security gate. Run from `NextWorkflowProjectPlugin.runBefore`
+ * over every `general-custom-js` node's `config.code`. Refuses to generate
+ * code containing obvious protected-env-var access or sandbox-escape
+ * primitives so the codegen pipeline can't be coerced into shipping
+ * dangerous workflow code even if the GUI and services-worker layers were
+ * bypassed.
+ *
+ * Intentionally narrow + regex-based: the GUI runs the full AST scan
+ * (workflow-schema/src/security/scan-custom-js.ts) before the project
+ * reaches codegen, and the services-worker re-runs it on the publish
+ * payload. This file is the cheap third checkpoint — it catches the
+ * obvious naïve patterns and is cheap enough to run inside the codegen
+ * pipeline without pulling @babel/parser into this package.
+ *
+ * SINGLE SOURCE OF TRUTH for the protected names — keep in sync with:
+ *   - teleport-gui/packages/workflow-schema/src/security/protected-env-names.ts
+ *   - teleport-services-worker/src/modules/vercel/security/protected-env-names.ts
+ */
+export const PROTECTED_ENV_NAMES = [
+    'TELEPORT_DB_CONNECTION_STRING',
+    'RUNTIME_STORAGE_API_KEY',
+    'RUNTIME_STORAGE_PROJECT_ID',
+    'TELEPORT_PROJECT_TOKEN',
+    'REALTIME_SERVER_API_KEY',
+    'REALTIME_SERVER_URL',
+    'PDF_SERVICE_URL',
+    'PDF_SERVICE_API_KEY',
+];
+export class CodegenSecurityError extends Error {
+    constructor(violations) {
+        super(`Codegen blocked by ${violations.length} security violation${violations.length === 1 ? '' : 's'}`);
+        this.violations = violations;
+        this.name = 'CodegenSecurityError';
+        // ES5 target breaks the prototype chain when extending built-ins like
+        // Error — restore it so `instanceof CodegenSecurityError` works.
+        Object.setPrototypeOf(this, CodegenSecurityError.prototype);
+    }
+}
+/**
+ * Walks the UIDL workflow definitions and throws `CodegenSecurityError` if
+ * any `general-custom-js` body trips the scanner.
+ *
+ * Per `general-custom-js` the only place a user can write JS is the `code`
+ * config field, so we look only there. Other node types use structured
+ * configs we don't touch.
+ */
+export function assertWorkflowsAreSecure(workflowsContainer) {
+    var _a, _b;
+    if (!(workflowsContainer === null || workflowsContainer === void 0 ? void 0 : workflowsContainer.workflows))
+        return;
+    const violations = [];
+    for (const [wfId, wf] of Object.entries(workflowsContainer.workflows)) {
+        if (!wf || !Array.isArray(wf.nodes))
+            continue;
+        for (const node of wf.nodes) {
+            const nodeAsUnknown = node;
+            if ((nodeAsUnknown === null || nodeAsUnknown === void 0 ? void 0 : nodeAsUnknown.type) !== 'general-custom-js')
+                continue;
+            const code = (_a = nodeAsUnknown.config) === null || _a === void 0 ? void 0 : _a.code;
+            if (typeof code !== 'string' || !code.trim())
+                continue;
+            const findings = scanForObviousViolations(code);
+            for (const finding of findings) {
+                violations.push({
+                    workflowId: wfId,
+                    workflowName: wf.name,
+                    nodeId: (_b = nodeAsUnknown.id) !== null && _b !== void 0 ? _b : '?',
+                    rule: finding.rule,
+                    message: finding.message,
+                });
+            }
+        }
+    }
+    if (violations.length > 0)
+        throw new CodegenSecurityError(violations);
+}
+/**
+ * Regex-based scan. Sufficient at the codegen layer because:
+ *   - the GUI's AST scanner has already vetted the code.
+ *   - the services-worker re-runs the full AST scan on the publish payload.
+ *   - the runtime `process` Proxy preamble denies even successful escapes.
+ */
+function scanForObviousViolations(rawCode) {
+    const out = [];
+    const code = stripCommentsAndDecodeEscapes(rawCode);
+    for (const name of PROTECTED_ENV_NAMES) {
+        if (new RegExp(`\\b${name}\\b`).test(code)) {
+            out.push({
+                rule: 'protected-env-access',
+                message: `references protected platform secret "${name}"`,
+            });
+        }
+    }
+    if (/\beval\s*\(/.test(code)) {
+        out.push({ rule: 'sandbox-escape-eval', message: 'calls eval(...)' });
+    }
+    if (/\b(?:new\s+)?Function\s*\(/.test(code)) {
+        out.push({
+            rule: 'sandbox-escape-function',
+            message: 'uses Function(...) or new Function(...)',
+        });
+    }
+    if (/\bwith\s*\(/.test(code)) {
+        out.push({ rule: 'sandbox-escape-with', message: 'uses a with statement' });
+    }
+    if (/\brequire\s*\(\s*["'`](?:fs(?:\/promises)?|child_process|cluster|worker_threads|process|vm|inspector|dgram|v8|node:[^"'`]+)["'`]/.test(code)) {
+        out.push({
+            rule: 'forbidden-require',
+            message: 'requires a forbidden Node.js module',
+        });
+    }
+    if (/\bimport\s*\(\s*["'`](?:fs(?:\/promises)?|child_process|cluster|worker_threads|process|vm|inspector|dgram|v8|node:[^"'`]+)["'`]/.test(code)) {
+        out.push({
+            rule: 'forbidden-dynamic-import',
+            message: 'dynamically imports a forbidden Node.js module',
+        });
+    }
+    if (/\b(?:globalThis|global)\s*[\.\[]\s*["'`]?process\b/.test(code)) {
+        out.push({
+            rule: 'indirect-process-access',
+            message: 'reaches process via globalThis / global',
+        });
+    }
+    // Mass enumeration of process.env
+    if (/\bObject\.(?:keys|values|entries|assign|fromEntries|getOwnProperty(?:Names|Symbols|Descriptors))\s*\(\s*(?:[^)]*,\s*)?process\.env\b/.test(code) ||
+        /\bJSON\.stringify\s*\(\s*process\.env\b/.test(code) ||
+        /\bReflect\.ownKeys\s*\(\s*process\.env\b/.test(code) ||
+        /\{\s*\.\.\.process\.env\b/.test(code) ||
+        /\bfor\s*\(\s*(?:var|let|const)?\s*\w+\s+(?:in|of)\s+process\.env\b/.test(code)) {
+        out.push({
+            rule: 'mass-env-enumeration',
+            message: 'enumerates or copies the entire process.env',
+        });
+    }
+    return out;
+}
+function stripCommentsAndDecodeEscapes(input) {
+    let stripped = input.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+    stripped = stripped
+        .replace(/\\u\{([0-9a-fA-F]+)\}/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+        .replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)))
+        .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => safeFromCodePoint(parseInt(hex, 16)));
+    return stripped;
+}
+function safeFromCodePoint(code) {
+    if (!Number.isFinite(code) || code < 0 || code > 0x10ffff)
+        return '';
+    try {
+        return String.fromCodePoint(code);
+    }
+    catch (_a) {
+        return '';
+    }
+}
+//# sourceMappingURL=security-scanner.js.map

package/dist/esm/security-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scanner.js","sourceRoot":"","sources":["../../src/security-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,yBAAyB;IACzB,4BAA4B;IAC5B,wBAAwB;IACxB,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;CACb,CAAA;AAUV,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAA4B,UAAsC;QAChE,KAAK,CACH,sBAAsB,UAAU,CAAC,MAAM,sBACrC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACjC,EAAE,CACH,CAAA;QALyB,eAAU,GAAV,UAAU,CAA4B;QAMhE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC7D,CAAC;CACF;AAiBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,kBAAkD;;IACzF,IAAI,CAAC,CAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,SAAS,CAAA;QAAE,OAAM;IAC1C,MAAM,UAAU,GAA+B,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE;QACrE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE;YAC3B,MAAM,aAAa,GAAG,IAIrB,CAAA;YACD,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,IAAI,MAAK,mBAAmB;gBAAE,SAAQ;YACzD,MAAM,IAAI,GAAG,MAAA,aAAa,CAAC,MAAM,0CAAE,IAAI,CAAA;YACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAQ;YACtD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,UAAU,CAAC,IAAI,CAAC;oBACd,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,EAAE,CAAC,IAAI;oBACrB,MAAM,EAAE,MAAA,aAAa,CAAC,EAAE,mCAAI,GAAG;oBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAA;aACH;SACF;KACF;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAA;AACvE,CAAC;AAOD;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAA;IAEnD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE;QACtC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,yCAAyC,IAAI,GAAG;aAC1D,CAAC,CAAA;SACH;KACF;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAA;KACtE;IACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAA;KAC5E;IACD,IACE,kIAAkI,CAAC,IAAI,CACrI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAA;KACH;IACD,IACE,iIAAiI,CAAC,IAAI,CACpI,IAAI,CACL,EACD;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAA;KACH;IACD,IAAI,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnE,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAA;KACH;IACD,kCAAkC;IAClC,IACE,sIAAsI,CAAC,IAAI,CACzI,IAAI,CACL;QACD,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QACrD,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,oEAAoE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC/E;QACA,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAA;KACH;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAChF,QAAQ,GAAG,QAAQ;SAChB,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACnF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SACjF,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACpF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,QAAQ;QAAE,OAAO,EAAE,CAAA;IACpE,IAAI;QACF,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;KAClC;IAAC,WAAM;QACN,OAAO,EAAE,CAAA;KACV;AACH,CAAC"}

package/dist/esm/segment-splitter.d.ts

@@ -0,0 +1,6 @@
+import { UIDLWorkflow } from '@teleporthq/teleport-types';
+import { WorkflowSegment } from './types';
+export declare const splitIntoSegments: (workflow: UIDLWorkflow) => WorkflowSegment[];
+export declare const getServerSegments: (segments: WorkflowSegment[]) => WorkflowSegment[];
+export declare const getClientSegments: (segments: WorkflowSegment[]) => WorkflowSegment[];
+//# sourceMappingURL=segment-splitter.d.ts.map

package/dist/esm/segment-splitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-splitter.d.ts","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAsC,MAAM,4BAA4B,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAwB,MAAM,SAAS,CAAA;AAuG/D,eAAO,MAAM,iBAAiB,aAAc,YAAY,KAAG,eAAe,EAgGzE,CAAA;AAiFD,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA;AAED,eAAO,MAAM,iBAAiB,aAAc,eAAe,EAAE,KAAG,eAAe,EAE9E,CAAA"}

package/dist/esm/segment-splitter.js

@@ -0,0 +1,230 @@
+import { getLoopBodyNodes, getNodeById, getTopologicalOrder } from './graph-utils';
+import { nodeRegistry } from './nodes';
+const CLIENT_ONLY_NODE_TYPES = new Set([
+    'account-login',
+    'account-signup',
+    'account-logout',
+    'account-social-login',
+]);
+const resolveExecutionEnv = (node, prevEnv) => {
+    var _a, _b, _c;
+    if (CLIENT_ONLY_NODE_TYPES.has(node.type)) {
+        return 'client';
+    }
+    // general-custom-node returns an opaque marker from its handler and relies on
+    // the client runtime to recognise it and invoke the nested custom node
+    // function (which has its own client/server segments). The server handler is
+    // a stub — if this node is placed in a server segment the nested workflow
+    // never runs and downstream references to its output resolve to the marker.
+    if (node.type === 'general-custom-node') {
+        return 'client';
+    }
+    const registered = nodeRegistry[node.type];
+    if ((registered === null || registered === void 0 ? void 0 : registered.executionEnv) === 'client') {
+        return 'client';
+    }
+    if (node.executionEnv === 'client') {
+        return 'client';
+    }
+    if (node.executionEnv === 'server') {
+        return 'server';
+    }
+    if ((registered === null || registered === void 0 ? void 0 : registered.executionEnv) === 'server') {
+        return 'server';
+    }
+    if (node.type === 'general-custom-js') {
+        const ctx = (_a = node.config) === null || _a === void 0 ? void 0 : _a.context;
+        if (ctx === 'server') {
+            return 'server';
+        }
+        return 'client';
+    }
+    if (node.type === 'transform-geolocation') {
+        const op = (_b = node.config) === null || _b === void 0 ? void 0 : _b.operation;
+        if (op === 'geocode' || op === 'reverse-geocode' || op === 'get-timezone') {
+            return 'server';
+        }
+        if (op === 'current-location') {
+            return 'client';
+        }
+    }
+    if (node.type === 'transform-image' || node.type === 'transform-color') {
+        const op = (_c = node.config) === null || _c === void 0 ? void 0 : _c.operation;
+        if (node.type === 'transform-image') {
+            return 'server';
+        }
+        if (op === 'extract-from-image') {
+            return 'server';
+        }
+    }
+    return prevEnv || 'client';
+};
+const collectErrorBranchNodeIds = (errorHandlerNodeId, nodes, edges) => {
+    const ids = new Set();
+    const queue = [];
+    for (const e of edges) {
+        if (e.source === errorHandlerNodeId) {
+            queue.push(e.target);
+        }
+    }
+    const nodeIdSet = new Set(nodes.map((n) => n.id));
+    while (queue.length > 0) {
+        const cur = queue.shift();
+        if (ids.has(cur) || !nodeIdSet.has(cur)) {
+            continue;
+        }
+        ids.add(cur);
+        for (const e of edges) {
+            if (e.source === cur) {
+                queue.push(e.target);
+            }
+        }
+    }
+    return ids;
+};
+export const splitIntoSegments = (workflow) => {
+    if (workflow.nodes.length === 0) {
+        return [];
+    }
+    // Collect every node that belongs to an error-handler branch. Prefer the
+    // explicit `workflow.errorHandler` pointer, but also scan for nodes that
+    // declare themselves as error handlers (`event-workflow-error` nodes or any
+    // node with `config.isErrorHandler === true`) so custom-node workflows —
+    // whose pseudo-workflow has no errorHandler pointer wired — still have their
+    // error branches excluded from normal execution.
+    const errorBranchIds = new Set();
+    if (workflow.errorHandler) {
+        for (const id of collectErrorBranchNodeIds(workflow.errorHandler.nodeId, workflow.nodes, workflow.edges)) {
+            errorBranchIds.add(id);
+        }
+    }
+    for (const n of workflow.nodes) {
+        const cfg = (n.config || {});
+        if (n.type === 'event-workflow-error' || cfg.isErrorHandler === true) {
+            errorBranchIds.add(n.id);
+            for (const id of collectErrorBranchNodeIds(n.id, workflow.nodes, workflow.edges)) {
+                errorBranchIds.add(id);
+            }
+        }
+    }
+    const mainNodes = errorBranchIds.size > 0
+        ? workflow.nodes.filter((n) => !errorBranchIds.has(n.id))
+        : workflow.nodes;
+    const mainEdges = errorBranchIds.size > 0
+        ? workflow.edges.filter((e) => !errorBranchIds.has(e.source) && !errorBranchIds.has(e.target))
+        : workflow.edges;
+    const order = getTopologicalOrder(mainNodes, mainEdges);
+    // Loop bodies must execute as a single unit at runtime. The split-by-env
+    // walk below would otherwise drop AI/server steps in one segment and the
+    // client-only post-processing into another, leaving the loop's body half-
+    // executed for every iteration. We reorder the topo so all body nodes sit
+    // immediately after their owning loop, and we record a single forced env
+    // (server if any body or the loop itself needs server, else client) so the
+    // forthcoming env walk emits one segment for the loop + body.
+    const { reorderedOrder, forcedEnvByNodeId } = enforceLoopBodyIntegrity(order, mainNodes, mainEdges);
+    const segments = [];
+    let currentEnv = null;
+    let currentNodeIds = [];
+    let segClientCount = 0;
+    let segServerCount = 0;
+    const flushSegment = () => {
+        if (currentNodeIds.length === 0 || currentEnv === null) {
+            return;
+        }
+        const id = currentEnv === 'client' ? `client-${++segClientCount}` : `server-${++segServerCount}`;
+        const nodes = currentNodeIds
+            .map((nid) => getNodeById(workflow.nodes, nid))
+            .filter(Boolean);
+        const nodeIdSet = new Set(currentNodeIds);
+        const edges = workflow.edges.filter((e) => nodeIdSet.has(e.source) && nodeIdSet.has(e.target));
+        segments.push({ id, env: currentEnv, nodeIds: [...currentNodeIds], nodes, edges });
+        currentNodeIds = [];
+    };
+    for (const nodeId of reorderedOrder) {
+        const node = getNodeById(workflow.nodes, nodeId);
+        if (!node) {
+            continue;
+        }
+        const forced = forcedEnvByNodeId.get(nodeId);
+        const nodeEnv = forced !== null && forced !== void 0 ? forced : resolveExecutionEnv(node, currentEnv);
+        if (currentEnv !== null && nodeEnv !== currentEnv) {
+            flushSegment();
+        }
+        currentEnv = nodeEnv;
+        currentNodeIds.push(nodeId);
+    }
+    flushSegment();
+    return segments;
+};
+/**
+ * Re-arrange the topological node order so every loop's body nodes sit
+ * directly after the loop, and pick a single execution env for the
+ * (loop + body) cluster. Nested loops are processed inner-first so the outer
+ * loop's body window already contains the inner body in the right order.
+ *
+ * Why an explicit env override is needed: a body that mixes universal /
+ * server / client nodes (e.g. fetch → AI prompt → custom-js with
+ * `context: 'client'`) would naturally split into multiple segments. The
+ * server-side runtime then sees only the body nodes that landed in the same
+ * segment as the loop and silently produces an empty `loop.results`.
+ *
+ * Server is preferred when any cluster member is server-classified because
+ * server segments can host universal nodes and `general-custom-js` (which
+ * runs the same string of JS regardless of where it executes); the inverse
+ * is not true for AI / HTTP-with-secret nodes. When no member is server, we
+ * keep the cluster on the client so DOM- or window-bound bodies still work.
+ */
+const enforceLoopBodyIntegrity = (order, mainNodes, mainEdges) => {
+    const forcedEnvByNodeId = new Map();
+    const loopNodes = mainNodes.filter((n) => n.type === 'general-loop');
+    if (loopNodes.length === 0) {
+        return { reorderedOrder: order, forcedEnvByNodeId };
+    }
+    // Process inner loops before outer ones: an inner loop's body is a subset
+    // of its enclosing loop's body, and we want the outer pass to see the
+    // already-clustered inner body as a contiguous block.
+    const loopOrder = order.filter((id) => loopNodes.some((n) => n.id === id));
+    let working = order.slice();
+    for (let li = loopOrder.length - 1; li >= 0; li--) {
+        const loopId = loopOrder[li];
+        const bodyIds = getLoopBodyNodes(loopId, mainEdges);
+        if (bodyIds.length === 0) {
+            continue;
+        }
+        const clusterIds = new Set([loopId, ...bodyIds]);
+        const clusterMembers = Array.from(clusterIds)
+            .map((id) => getNodeById(mainNodes, id))
+            .filter((n) => Boolean(n));
+        let clusterEnv = 'client';
+        for (const member of clusterMembers) {
+            if (resolveExecutionEnv(member, null) === 'server') {
+                clusterEnv = 'server';
+                break;
+            }
+        }
+        for (const member of clusterMembers) {
+            forcedEnvByNodeId.set(member.id, clusterEnv);
+        }
+        // Hoist body nodes (preserving their existing relative order) immediately
+        // after the loop. Other nodes keep their relative position.
+        const bodyInOrder = working.filter((id) => id !== loopId && clusterIds.has(id));
+        const withoutBody = working.filter((id) => id === loopId || !clusterIds.has(id));
+        const loopIdxAfterRemoval = withoutBody.indexOf(loopId);
+        if (loopIdxAfterRemoval < 0) {
+            continue;
+        }
+        working = [
+            ...withoutBody.slice(0, loopIdxAfterRemoval + 1),
+            ...bodyInOrder,
+            ...withoutBody.slice(loopIdxAfterRemoval + 1),
+        ];
+    }
+    return { reorderedOrder: working, forcedEnvByNodeId };
+};
+export const getServerSegments = (segments) => {
+    return segments.filter((s) => s.env === 'server');
+};
+export const getClientSegments = (segments) => {
+    return segments.filter((s) => s.env === 'client');
+};
+//# sourceMappingURL=segment-splitter.js.map

package/dist/esm/segment-splitter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-splitter.js","sourceRoot":"","sources":["../../src/segment-splitter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEtC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG,CAC1B,IAAsB,EACtB,OAAoC,EACd,EAAE;;IACxB,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE;QACvC,OAAO,QAAQ,CAAA;KAChB;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,MAAK,QAAQ,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE;QAClC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,MAAK,QAAQ,EAAE;QACzC,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE;QACrC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,OAA6B,CAAA;QACtD,IAAI,GAAG,KAAK,QAAQ,EAAE;YACpB,OAAO,QAAQ,CAAA;SAChB;QACD,OAAO,QAAQ,CAAA;KAChB;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,EAAE;QACzC,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,SAA+B,CAAA;QACvD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,iBAAiB,IAAI,EAAE,KAAK,cAAc,EAAE;YACzE,OAAO,QAAQ,CAAA;SAChB;QACD,IAAI,EAAE,KAAK,kBAAkB,EAAE;YAC7B,OAAO,QAAQ,CAAA;SAChB;KACF;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE;QACtE,MAAM,EAAE,GAAG,MAAA,IAAI,CAAC,MAAM,0CAAE,SAA+B,CAAA;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE;YACnC,OAAO,QAAQ,CAAA;SAChB;QACD,IAAI,EAAE,KAAK,oBAAoB,EAAE;YAC/B,OAAO,QAAQ,CAAA;SAChB;KACF;IAED,OAAO,OAAO,IAAI,QAAQ,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,CAChC,kBAA0B,EAC1B,KAAyB,EACzB,KAAyB,EACZ,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,EAAE;YACnC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;SACrB;KACF;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAC1B,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACvC,SAAQ;SACT;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE;gBACpB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;aACrB;SACF;KACF;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAsB,EAAqB,EAAE;IAC7E,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC/B,OAAO,EAAE,CAAA;KACV;IAED,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IACxC,IAAI,QAAQ,CAAC,YAAY,EAAE;QACzB,KAAK,MAAM,EAAE,IAAI,yBAAyB,CACxC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAC5B,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,KAAK,CACf,EAAE;YACD,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;SACvB;KACF;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAA;QACvD,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,EAAE;YACpE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACxB,KAAK,MAAM,EAAE,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;gBAChF,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;aACvB;SACF;KACF;IAED,MAAM,SAAS,GACb,cAAc,CAAC,IAAI,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpB,MAAM,SAAS,GACb,cAAc,CAAC,IAAI,GAAG,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9F,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;IAEpB,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACvD,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,wBAAwB,CACpE,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAA;IACD,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,IAAI,UAAU,GAAgC,IAAI,CAAA;IAClD,IAAI,cAAc,GAAa,EAAE,CAAA;IACjC,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,cAAc,GAAG,CAAC,CAAA;IAEtB,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI,EAAE;YACtD,OAAM;SACP;QACD,MAAM,EAAE,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,CAAA;QAEhG,MAAM,KAAK,GAAG,cAAc;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC9C,MAAM,CAAC,OAAO,CAAuB,CAAA;QAExC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CACjC,CAAC,CAAmB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAC5E,CAAA;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAClF,cAAc,GAAG,EAAE,CAAA;IACrB,CAAC,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,EAAE;YACT,SAAQ;SACT;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAE/D,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,KAAK,UAAU,EAAE;YACjD,YAAY,EAAE,CAAA;SACf;QACD,UAAU,GAAG,OAAO,CAAA;QACpB,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;KAC5B;IAED,YAAY,EAAE,CAAA;IACd,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,wBAAwB,GAAG,CAC/B,KAAe,EACf,SAA6B,EAC7B,SAA6B,EAI7B,EAAE;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAA;IACjE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE;QAC1B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;KACpD;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAE1E,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,KAAK,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;YACxB,SAAQ;SACT;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;QAEnD,IAAI,UAAU,GAAyB,QAAQ,CAAA;QAC/C,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;YACnC,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,QAAQ,EAAE;gBAClD,UAAU,GAAG,QAAQ,CAAA;gBACrB,MAAK;aACN;SACF;QACD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE;YACnC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;SAC7C;QAED,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,mBAAmB,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACvD,IAAI,mBAAmB,GAAG,CAAC,EAAE;YAC3B,SAAQ;SACT;QACD,OAAO,GAAG;YACR,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,GAAG,CAAC,CAAC;YAChD,GAAG,WAAW;YACd,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;SAC9C,CAAA;KACF;IAED,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IAClF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAA;AACnD,CAAC,CAAA"}