@teleporthq/teleport-plugin-next-workflows 0.43.45 → 0.43.46

package/__tests__/_helpers/run-generated-middleware.ts

@@ -0,0 +1,130 @@
+import { UIDLAuthentication } from '@teleporthq/teleport-types'
+import { generateMiddlewareFile } from '../../src/auth-generator'
+
+/**
+ * Loads the middleware `generateMiddlewareFile` emits and runs it against a
+ * synthetic request, so tests can assert on BEHAVIOUR ("does a guest reach
+ * /orders/ORD-42?") instead of grepping the generated source.
+ *
+ * The emitted file is an ES module that imports `next/server` and
+ * `next-auth/jwt`; neither is installed in this package, so the loader strips
+ * the module boundary and injects the pieces the middleware actually uses.
+ * `getToken` always resolves to `null` — the generated code then falls back to
+ * cookie presence plus `/api/auth/session`, which the fetch stub answers, so
+ * both the authenticated and the anonymous path stay exercisable.
+ */
+
+export interface MiddlewareResult {
+  kind: 'next' | 'redirect'
+  /** Only set for `kind: 'redirect'`. */
+  location?: string
+}
+
+export interface MiddlewareSessionUser {
+  id?: string
+  role?: string
+}
+
+export interface MiddlewareRequestOptions {
+  /** Session user the stubbed `/api/auth/session` returns; omit for a guest. */
+  sessionUser?: MiddlewareSessionUser | null
+  origin?: string
+}
+
+interface RawMiddlewareResult {
+  __kind: 'next' | 'redirect'
+  __location?: string
+}
+
+type MiddlewareFn = (request: unknown) => Promise<RawMiddlewareResult>
+
+type MiddlewareFactory = (
+  nextResponse: unknown,
+  getToken: unknown,
+  fetchImpl: unknown
+) => MiddlewareFn
+
+const stripModuleSyntax = (code: string): string =>
+  code
+    .replace("import { NextResponse } from 'next/server';", '')
+    .replace("import { getToken } from 'next-auth/jwt';", '')
+    .replace('export default middleware;', '')
+    .replace('export const config = {', 'const config = {')
+
+/**
+ * The route table the generated middleware gates on. Parsed out of the emitted
+ * source so assertions can target the actual map instead of substring-matching
+ * a file that also contains comments and the self-guarded route list.
+ */
+export const extractProtectedRoutes = (
+  code: string
+): Record<string, { requiresAuth: boolean; allowedRoles: string[] }> => {
+  // Non-greedy up to the first `};`. `JSON.stringify(…, null, 2)` never emits
+  // that sequence inside the object, so the first hit is the real terminator —
+  // and the empty-map case (`= {};`) is covered by the same pattern.
+  const match = code.match(/const protectedRoutes = (\{[\s\S]*?\});/)
+  if (!match) {
+    throw new Error('generated middleware has no protectedRoutes declaration')
+  }
+  return JSON.parse(match[1])
+}
+
+/** Route patterns whose page-load SQL is the access control. */
+export const extractSelfGuardedRoutes = (code: string): string[] => {
+  const match = code.match(/const selfGuardedRoutes = (\[[\s\S]*?\]);/)
+  if (!match) {
+    throw new Error('generated middleware has no selfGuardedRoutes declaration')
+  }
+  return JSON.parse(match[1])
+}
+
+const NEXT_RESPONSE_STUB = {
+  next: (): RawMiddlewareResult => ({ __kind: 'next' }),
+  redirect: (url: URL): RawMiddlewareResult => ({
+    __kind: 'redirect',
+    __location: String(url),
+  }),
+}
+
+/**
+ * Compiles the middleware once for an auth config. Reuse the returned function
+ * across requests in a test to avoid re-generating the file per assertion.
+ */
+export const compileGeneratedMiddleware = (auth: UIDLAuthentication) => {
+  const factory = new Function(
+    'NextResponse',
+    'getToken',
+    'fetch',
+    `${stripModuleSyntax(generateMiddlewareFile(auth))}; return middleware;`
+  ) as unknown as MiddlewareFactory
+
+  return async (
+    pathname: string,
+    options: MiddlewareRequestOptions = {}
+  ): Promise<MiddlewareResult> => {
+    const origin = options.origin || 'https://shop.test'
+    const sessionUser = options.sessionUser ?? null
+    const cookieHeader = sessionUser ? 'next-auth.session-token=stub' : ''
+
+    const fetchImpl = async () => ({
+      ok: true,
+      json: async () => ({ user: sessionUser }),
+    })
+
+    const getTokenStub = async (): Promise<null> => null
+    const middleware = factory(NEXT_RESPONSE_STUB, getTokenStub, fetchImpl)
+    const result = await middleware({
+      nextUrl: { pathname },
+      url: `${origin}${pathname}`,
+      cookies: {
+        get: (name: string) =>
+          sessionUser && name === 'next-auth.session-token' ? { name, value: 'stub' } : undefined,
+      },
+      headers: { get: (name: string) => (name === 'cookie' ? cookieHeader : '') },
+    })
+
+    return result.__kind === 'redirect'
+      ? { kind: 'redirect', location: result.__location }
+      : { kind: 'next' }
+  }
+}

package/__tests__/form-submitted-trigger-context.test.ts

@@ -0,0 +1,100 @@
+/**
+ * The form-submitted trigger must expose its fields where generated validators
+ * actually look for them.
+ *
+ * THE DEFECT (run 4b049fe6, reported: "when I update a guild and click Save
+ * changes I get 'Guild Name is required' even though the name is added"):
+ *
+ *   Edit Guild Submit → validate-form:
+ *     const form = params[0] || {}
+ *     if (!form["name"]) return { isValid: false, error: "Guild Name is required" }
+ *
+ * `params[0]` is the trigger — the executor writes `context[triggerNodeId]`
+ * first — and the trigger carried the fields one level down under `formData`.
+ * `params[0].name` was `undefined`, so every save reported the filled-in name as
+ * missing. `general-extract-form-data` has always returned its fields flat for
+ * exactly this reason; the trigger now matches it.
+ *
+ * These tests EXECUTE the generated handler source rather than asserting on
+ * strings, so they fail if the emitted expression ever stops behaving.
+ */
+
+/** Evaluate the `triggerContext = …` expression the generator emits. */
+function evaluateTriggerContext(
+  source: string,
+  formData: Record<string, unknown>
+): Record<string, unknown> {
+  const match = /const triggerContext = ([\s\S]*?);\n/.exec(source)
+  if (!match) {
+    throw new Error('no triggerContext assignment found in generated source')
+  }
+  const expression = match[1]
+    // The generated code reads `event.target`; substitute a stand-in.
+    .replace(/event\.target/g, '__el')
+  const fn = new Function(
+    'formData',
+    '__el',
+    `const Date = { now: () => 1234 }; return (${expression});`
+  )
+  return fn(formData, { tagName: 'FORM' }) as Record<string, unknown>
+}
+
+describe('event-form-submitted trigger context', () => {
+  const SOURCE = [
+    'async function(event) {',
+    '    event.preventDefault();',
+    '    const formData = {};',
+    '    const fd = new FormData(event.target);',
+    '    fd.forEach(function(v, k) { formData[k] = v; });',
+    "    const triggerContext = Object.assign({}, formData, { fields: formData, formData: formData, formId: 'edit-guild-form', triggerElement: event.target, element: event.target, timestamp: Date.now() });",
+    '',
+  ].join('\n')
+
+  it('exposes each submitted field at the top level', () => {
+    const ctx = evaluateTriggerContext(SOURCE, { name: 'Order of the Light', server: 'Area 52' })
+    expect(ctx.name).toBe('Order of the Light')
+    expect(ctx.server).toBe('Area 52')
+  })
+
+  it('still exposes them under formData and fields', () => {
+    const ctx = evaluateTriggerContext(SOURCE, { name: 'Order of the Light' })
+    expect((ctx.formData as Record<string, unknown>).name).toBe('Order of the Light')
+    expect((ctx.fields as Record<string, unknown>).name).toBe('Order of the Light')
+  })
+
+  it('keeps the reserved keys even when a field is named after one', () => {
+    // The spread comes FIRST, so a field literally called `formId` or `element`
+    // cannot shadow the runtime's own keys.
+    const ctx = evaluateTriggerContext(SOURCE, {
+      formId: 'attacker',
+      element: 'attacker',
+      timestamp: 'attacker',
+      formData: 'attacker',
+    })
+    expect(ctx.formId).toBe('edit-guild-form')
+    expect(ctx.element).toEqual({ tagName: 'FORM' })
+    expect(ctx.timestamp).toBe(1234)
+    expect(typeof ctx.formData).toBe('object')
+  })
+
+  it('reproduces the exact Edit Guild validator, which now passes', () => {
+    const ctx = evaluateTriggerContext(SOURCE, {
+      name: 'Order of the Light',
+      server: 'Area 52',
+      leader_account: 'Thrall',
+      visibility: 'Public',
+    })
+    const validate = (params: unknown[]) => {
+      const form = (params[0] || {}) as Record<string, string>
+      const required = ['name', 'server', 'leader_account', 'visibility']
+      for (const key of required) {
+        const value = form[key]
+        if (!value || (typeof value === 'string' && value.trim() === '')) {
+          return { isValid: false, error: `${key} is required` }
+        }
+      }
+      return { isValid: true, error: '' }
+    }
+    expect(validate([ctx])).toEqual({ isValid: true, error: '' })
+  })
+})

package/__tests__/middleware-guest-order-details.test.ts

@@ -0,0 +1,258 @@
+import { compileGeneratedMiddleware } from './_helpers/run-generated-middleware'
+
+/**
+ * Guest checkout regression, end to end through the GENERATED middleware.
+ *
+ * The e-commerce list/details pair deliberately shares a static base — the
+ * order history is served from `/orders` and a single order from
+ * `/orders/[order_number]` — so a reader can drop the last path segment to get
+ * back to the listing. The listing legitimately requires auth (a guest has no
+ * order history), the details page does not: its page-load SQL matches
+ * `user_id = <session user>` OR `user_id = <anonymous localStorage UUID>`, and
+ * a guest order is stamped with the latter.
+ *
+ * `generateMiddlewareFile` already skipped row-owned self-guarded pages from
+ * `protectedRoutes`, but that was not enough: the middleware matches a request
+ * against every protected route as a PREFIX, so `/orders/ORD-42` matched the
+ * listing's `/orders` entry and every guest was redirected to
+ * `/sign-in?callbackUrl=/orders/ORD-42` — right after paying, and right after
+ * the COD "order placed" toast. Buyers with a stale session cookie never saw
+ * it, which is why it looked intermittent.
+ *
+ * The fix emits the self-guarded page's full route pattern and waives ONLY
+ * inherited, role-free protection for paths that pattern matches.
+ */
+
+const baseAuth: any = {
+  enabled: true,
+  dataSourceId: 'ds-1',
+  dataSourceType: 'postgres',
+  passwordAuthEnabled: true,
+  providers: [],
+  roles: ['admin'],
+  tables: {},
+  folderProtection: {},
+  authPages: {
+    signIn: { pageId: 'sign-in', pageName: 'sign-in', route: '/sign-in' },
+    signUp: { pageId: 'sign-up', pageName: 'sign-up', route: '/sign-up' },
+  },
+  callbackBaseUrl: '',
+  envKeys: {},
+  customUserProperties: [],
+}
+
+const ordersListProtection = {
+  requiresAuth: true,
+  allowedRoles: [] as string[],
+  pageName: 'orders-list',
+  route: '/orders',
+}
+
+const orderDetailsProtection = {
+  requiresAuth: true,
+  allowedRoles: [] as string[],
+  pageName: 'order-details',
+  route: '/orders',
+  routePattern: '/orders/[order_number]',
+  rowOwnerColumn: 'user_id',
+  rowOwnerTable: 'teleport_orders',
+  rowOwnerDifferentiator: 'order_number',
+}
+
+const storeAuth = (overrides: Record<string, unknown> = {}) =>
+  ({
+    ...baseAuth,
+    pageProtection: {
+      OL: ordersListProtection,
+      OD: orderDetailsProtection,
+      ADMIN: {
+        requiresAuth: true,
+        allowedRoles: ['admin'],
+        pageName: 'admin',
+        route: '/admin',
+      },
+    },
+    ...overrides,
+  } as any)
+
+describe('generated middleware: guest access to a row-owned order-details route', () => {
+  const run = compileGeneratedMiddleware(storeAuth())
+
+  it('lets an anonymous buyer reach the order they just placed', async () => {
+    // The single path both checkout branches land on: the COD branch navigates
+    // here directly, and Stripe/PayPal return to `<this>?payment=success`
+    // (`nextUrl.pathname` excludes the query, so the decision is made here).
+    expect(await run('/orders/ORD-42')).toEqual({ kind: 'next' })
+  })
+
+  it('matches the same order route with a trailing slash', async () => {
+    // Next.js serves both forms; matching the raw pathname would make the
+    // slashed variant miss the self-guarded pattern and inherit the listing's
+    // protection.
+    expect(await run('/orders/ORD-42/')).toEqual({ kind: 'next' })
+  })
+
+  it('URL-encoded order numbers still resolve to the details route', async () => {
+    expect(await run('/orders/ORD%2F42')).toEqual({ kind: 'next' })
+  })
+
+  it('still forces sign-in on the orders LISTING itself', async () => {
+    const result = await run('/orders')
+    expect(result.kind).toBe('redirect')
+    expect(result.location).toContain('/sign-in')
+  })
+
+  it('does not waive protection for a deeper path the details page never serves', async () => {
+    // `/orders/[order_number]` compiles to a single-segment matcher, so a
+    // crafted `/orders/ORD-42/anything` keeps the listing's protection.
+    const result = await run('/orders/ORD-42/edit')
+    expect(result.kind).toBe('redirect')
+    expect(result.location).toContain('/sign-in')
+  })
+
+  it('keeps the admin subtree gated', async () => {
+    expect((await run('/admin')).kind).toBe('redirect')
+    expect((await run('/admin/orders')).kind).toBe('redirect')
+  })
+
+  it('lets a signed-in buyer reach their order history', async () => {
+    expect(await run('/orders', { sessionUser: { id: 'u-1', role: 'user' } })).toEqual({
+      kind: 'next',
+    })
+  })
+
+  it('still bounces a non-admin off the admin subtree', async () => {
+    const result = await run('/admin/orders', { sessionUser: { id: 'u-1', role: 'user' } })
+    expect(result.kind).toBe('redirect')
+  })
+})
+
+describe('generated middleware: self-guard waiver stays narrow', () => {
+  it('does not waive protection when the ancestor route demands a role', async () => {
+    // A staff-only subtree is an absolute gate the row-level WHERE clause
+    // cannot reproduce, so the guest must NOT slip through it.
+    const run = compileGeneratedMiddleware(
+      storeAuth({
+        pageProtection: {
+          STAFF_LIST: {
+            requiresAuth: true,
+            allowedRoles: ['staff'],
+            pageName: 'staff-orders',
+            route: '/staff-orders',
+          },
+          STAFF_DETAILS: {
+            requiresAuth: true,
+            allowedRoles: [],
+            pageName: 'staff-order-details',
+            route: '/staff-orders',
+            routePattern: '/staff-orders/[order_number]',
+            rowOwnerColumn: 'user_id',
+            rowOwnerDifferentiator: 'order_number',
+          },
+        },
+      })
+    )
+
+    const result = await run('/staff-orders/ORD-42')
+    expect(result.kind).toBe('redirect')
+    expect(result.location).toContain('/sign-in')
+  })
+
+  it("does not waive a page's OWN exact protection", async () => {
+    // Contrived but load-bearing: if some other protected page is published at
+    // exactly the path a self-guarded pattern matches, that page's own entry
+    // wins. Only INHERITED protection is waivable.
+    const run = compileGeneratedMiddleware(
+      storeAuth({
+        pageProtection: {
+          OL: ordersListProtection,
+          OD: orderDetailsProtection,
+          CLASH: {
+            requiresAuth: true,
+            allowedRoles: [],
+            pageName: 'orders-archive',
+            route: '/orders/archive',
+          },
+        },
+      })
+    )
+
+    const result = await run('/orders/archive')
+    expect(result.kind).toBe('redirect')
+    expect(result.location).toContain('/sign-in')
+  })
+
+  it('reconstructs the pattern for UIDLs emitted before `routePattern` existed', async () => {
+    // Older projects carry only `route` + `rowOwnerDifferentiator`. As long as
+    // the route is the real static base, the pattern is derivable.
+    const run = compileGeneratedMiddleware(
+      storeAuth({
+        pageProtection: {
+          OL: ordersListProtection,
+          OD: {
+            requiresAuth: true,
+            allowedRoles: [],
+            pageName: 'order-details',
+            route: '/orders',
+            rowOwnerColumn: 'user_id',
+            rowOwnerDifferentiator: 'order_number',
+          },
+        },
+      })
+    )
+
+    expect(await run('/orders/ORD-42')).toEqual({ kind: 'next' })
+    expect((await run('/orders')).kind).toBe('redirect')
+  })
+
+  it('leaves projects without any self-guarded page completely unchanged', async () => {
+    const run = compileGeneratedMiddleware({
+      ...baseAuth,
+      pageProtection: {
+        ACCOUNT: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'account',
+          route: '/account',
+        },
+      },
+    } as any)
+
+    expect((await run('/account')).kind).toBe('redirect')
+    expect((await run('/account/settings')).kind).toBe('redirect')
+    expect(await run('/about')).toEqual({ kind: 'next' })
+  })
+})
+
+describe('generated middleware: two pages claiming one route key', () => {
+  it('merges their rules instead of letting document order pick a winner', async () => {
+    // A list/details pair shares its static base by design, and a user can also
+    // point two pages at the same custom URL. One prefix key gates the whole
+    // subtree, so the stricter rule has to survive — otherwise whichever page
+    // the document happened to list last silently decided the access rules.
+    const run = compileGeneratedMiddleware({
+      ...baseAuth,
+      pageProtection: {
+        PUBLIC_ISH: {
+          requiresAuth: true,
+          allowedRoles: [],
+          pageName: 'reports',
+          route: '/reports',
+        },
+        ADMIN_ONLY: {
+          requiresAuth: true,
+          allowedRoles: ['admin'],
+          pageName: 'reports-admin',
+          route: '/reports',
+        },
+      },
+    } as any)
+
+    expect((await run('/reports', { sessionUser: { id: 'u-1', role: 'user' } })).kind).toBe(
+      'redirect'
+    )
+    expect(await run('/reports', { sessionUser: { id: 'u-2', role: 'admin' } })).toEqual({
+      kind: 'next',
+    })
+  })
+})

package/__tests__/middleware-row-owned-pages.test.ts

@@ -1,4 +1,8 @@
 import { generateMiddlewareFile } from '../src/auth-generator'
+import {
+  extractProtectedRoutes,
+  extractSelfGuardedRoutes,
+} from './_helpers/run-generated-middleware'
 
 // Guarding the regression where a guest checkout buyer lands on
 // `/order-details/<order_number>` after Stripe redirect and the
@@ -51,8 +55,11 @@ describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
 
     // /order-details must NOT appear in protectedRoutes — the
     // page-load SQL `user_id = userId OR user_id = anonymousUserId`
-    // is the source of truth for ownership.
-    expect(code).not.toContain('"/order-details"')
+    // is the source of truth for ownership. It DOES appear in
+    // selfGuardedRoutes, which is how the middleware recognises the
+    // requests it must let through when an ancestor route is protected.
+    expect(extractProtectedRoutes(code)).toEqual({})
+    expect(extractSelfGuardedRoutes(code)).toEqual(['/order-details/[order_number]'])
   })
 
   it('still protects a row-owned page that requires a specific role', () => {
@@ -74,8 +81,11 @@ describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
       },
     } as any)
 
-    expect(code).toContain('"/admin/orders/[id]"')
-    expect(code).toContain('"admin"')
+    expect(extractProtectedRoutes(code)['/admin/orders/[id]']).toEqual({
+      requiresAuth: true,
+      allowedRoles: ['admin'],
+    })
+    expect(extractSelfGuardedRoutes(code)).toEqual([])
   })
 
   it('keeps non-row-owned pages protected as before', () => {
@@ -94,7 +104,11 @@ describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
       },
     } as any)
 
-    expect(code).toContain('"/orders-list"')
+    expect(extractProtectedRoutes(code)['/orders-list']).toEqual({
+      requiresAuth: true,
+      allowedRoles: [],
+    })
+    expect(extractSelfGuardedRoutes(code)).toEqual([])
   })
 
   it('honours folder-level role gating even when a child page is row-owned', () => {
@@ -124,8 +138,12 @@ describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
       },
     } as any)
 
-    expect(code).toContain('"/tickets/[id]"')
-    expect(code).toContain('"staff"')
+    expect(extractProtectedRoutes(code)['/tickets/[id]']).toEqual({
+      requiresAuth: true,
+      allowedRoles: ['staff'],
+    })
+    // The folder's role gate is absolute, so the page loses its waiver.
+    expect(extractSelfGuardedRoutes(code)).toEqual([])
   })
 
   it('skips a row-owned page even when wrapped in a role-less folder', () => {
@@ -156,7 +174,8 @@ describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
       },
     } as any)
 
-    expect(code).not.toContain('"/order-details"')
+    expect(extractProtectedRoutes(code)).toEqual({})
+    expect(extractSelfGuardedRoutes(code)).toEqual(['/order-details'])
   })
 
   it('treats `rowOwnerColumn` as the sole signal — pages without it stay protected', () => {
@@ -176,6 +195,10 @@ describe('generateMiddlewareFile: row-owned self-guarded pages', () => {
       },
     } as any)
 
-    expect(code).toContain('"/something"')
+    expect(extractProtectedRoutes(code)['/something']).toEqual({
+      requiresAuth: true,
+      allowedRoles: [],
+    })
+    expect(extractSelfGuardedRoutes(code)).toEqual([])
   })
 })

package/dist/cjs/auth-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-generator.d.ts","sourceRoot":"","sources":["../../src/auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,cAAc,EACf,MAAM,4BAA4B,CAAA;AAkBnC,eAAO,MAAM,6BAA6B,mBACxB,cAAc,GAAG,IAAI,KACpC,OAAO,MAAM,EAAE,MAAM,CA0BvB,CAAA;AAmhBD,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,qBACL,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAChD,MAsFF,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAO,MA4B3C,CAAA;AAED,eAAO,MAAM,yBAAyB,QAAO,MAgC5C,CAAA;AAMD,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,YACf,mBAAmB,KAC3B,MA4IF,CAAA;AAsBD,eAAO,MAAM,sBAAsB,SAAU,kBAAkB,KAAG,MAiPjE,CAAA;AAED,eAAO,MAAM,8BAA8B,QAAO,MAqCjD,CAAA"}
+{"version":3,"file":"auth-generator.d.ts","sourceRoot":"","sources":["../../src/auth-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,cAAc,EACf,MAAM,4BAA4B,CAAA;AAkBnC,eAAO,MAAM,6BAA6B,mBACxB,cAAc,GAAG,IAAI,KACpC,OAAO,MAAM,EAAE,MAAM,CA0BvB,CAAA;AAmhBD,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,qBACL,OAAO,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAChD,MAsFF,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAO,MA4B3C,CAAA;AAED,eAAO,MAAM,yBAAyB,QAAO,MAgC5C,CAAA;AAMD,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,uBAAuB,SAC5B,kBAAkB,YACf,mBAAmB,KAC3B,MA4IF,CAAA;AAgDD,eAAO,MAAM,sBAAsB,SAAU,kBAAkB,KAAG,MA6UjE,CAAA;AAED,eAAO,MAAM,8BAA8B,QAAO,MAqCjD,CAAA"}