@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/dist/esm/nodes/email/outbound-message-guard.js

@@ -0,0 +1,452 @@
+import { handlerToString } from '../types';
+import { generateSecurityRuntimeVar, isOutboundMessageNodeType, serverHandlerPrefix, VISITOR_KEY_CODE, } from '../general/visitor-request';
+import { collectMessageTrust, stepNameOf } from './message-trust';
+import { escapeHtmlValueJs } from './html-escape-code';
+import { assertHandlerHasNoModuleRefs } from '../analytics/commerce-tracking';
+/**
+ * Email and SMS nodes on a route a visitor can call.
+ *
+ * - Header fields (addresses, subject) never carry a line break.
+ * - A recipient the request can choose — anything but an author literal, the
+ *   signed-in user's own value read from the session, or a read of the owner's
+ *   settings (see message-trust) — is allowed (an auto-reply, a guest
+ *   confirmation), but every such send is counted per visitor, per recipient
+ *   and per site. A send over a limit is skipped and logged; the visitor's
+ *   action goes on.
+ * - Such a send's body must be the author's template: a body that is only
+ *   values (one value, or markup around values with no author text; an SMS:
+ *   its whole message) is refused at generation time, with the reason in the
+ *   build log. So is a sender (address, name, SMS sender) the request can
+ *   choose. A refused step never sends.
+ * - Every value is escaped where the template is filled (`applyTemplateParams`
+ *   and the rich-text placeholders in the runtime utils, `fillTemplate` for the
+ *   account routes); a whole-value body is escaped by the guard. Only the
+ *   platform's own HTML builders' output is sent as HTML.
+ */
+/** Sends to visitor-supplied recipients each visitor may make in an hour. */
+export const VISITOR_SENDS_PER_IP_PER_HOUR = 5;
+/** Sends one visitor-supplied recipient may receive in an hour. */
+export const VISITOR_SENDS_PER_RECIPIENT_PER_HOUR = 3;
+/** Sends to visitor-supplied recipients the whole site may make in a day, per channel. */
+export const VISITOR_SENDS_PER_SITE_PER_DAY = 500;
+/** What a skipped or refused send answers. */
+export const TOO_MANY_MESSAGES_MESSAGE = 'Too many messages were sent. Try again later.';
+export const MESSAGE_NOT_SENT_MESSAGE = 'The message could not be sent.';
+/** Baked into a node's config at generation time; read and removed by the guard. */
+export const VISITOR_RECIPIENT_FIELDS_KEY = '__visitorRecipientFields';
+export const ESCAPE_BODY_KEY = '__escapeBody';
+/** Baked when the send must never go out; the value is the reason, logged by the guard. */
+export const REFUSE_SEND_KEY = '__refuseSend';
+/** Baked on a public webhook's sends: its caller is an integration, so no per-visitor count. */
+export const NO_IP_CAP_KEY = '__noIpCap';
+/** Set on this deployment's own call to a custom node made for a public webhook. */
+export const PUBLIC_CALLER_HEADER = 'x-teleport-public-caller';
+const RECIPIENT_FIELDS = {
+    email: ['to', 'cc', 'bcc'],
+    sms: ['to'],
+};
+const SENDER_FIELDS = {
+    email: ['from', 'fromName'],
+    sms: ['from'],
+};
+const channelOf = (nodeType) => nodeType.startsWith('sms-') ? 'sms' : 'email';
+const isRecord = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+const isSecretRef = (value) => value.type === 'dynamic' &&
+    isRecord(value.content) &&
+    value.content.referenceType === 'secret';
+/** A whole `{{Current User.<field>}}` / `{{currentUser.<field>}}` token. */
+const SESSION_USER_TOKEN = /^\s*\{\{\s*(?:Current User|currentUser)\.[A-Za-z_$][A-Za-z0-9_$]*\s*\}\}\s*$/;
+const WHOLE_TOKEN = /^\s*\{\{\s*([^{}]+?)\s*\}\}\s*$/;
+/**
+ * A recipient or sender value the request cannot choose: an author literal,
+ * a project secret, the signed-in user's own value (a current-user token or
+ * reader, where the route binds the session), or an owner read.
+ */
+const isOwnerValue = (value, sources) => {
+    if (value === undefined || value === null || value === '' || typeof value !== 'object') {
+        if (typeof value !== 'string') {
+            return true;
+        }
+        if (sources.sessionBound && SESSION_USER_TOKEN.test(value)) {
+            return true;
+        }
+        return value.indexOf('{{') === -1 && value.indexOf('context-value-inline') === -1;
+    }
+    if (Array.isArray(value)) {
+        return value.every((item) => isOwnerValue(item, sources));
+    }
+    const record = value;
+    if (record.type === 'workflowContext') {
+        const id = typeof record.nodeId === 'string' ? record.nodeId : '';
+        return sources.owner.has(id) || (sources.sessionBound && sources.identityNodeIds.has(id));
+    }
+    if (record.type === 'ctx') {
+        return false;
+    }
+    if (isSecretRef(record)) {
+        return true;
+    }
+    return Object.keys(record).every((key) => isOwnerValue(record[key], sources));
+};
+/** A body that is one value (a reference or a whole `{{…}}` token). */
+const isValueBody = (body) => (isRecord(body) && (body.type === 'workflowContext' || body.type === 'ctx')) ||
+    (typeof body === 'string' && WHOLE_TOKEN.test(body));
+/** A whole `{{key}}` token naming one of the node's `templateParams` is that param's value. */
+const valueSourceOf = (value, config) => {
+    const token = typeof value === 'string' ? WHOLE_TOKEN.exec(value) : null;
+    const params = Array.isArray(config.templateParams) ? config.templateParams : [];
+    const param = token
+        ? params.find((p) => isRecord(p) && p.key === token[1])
+        : undefined;
+    return param ? param.value : value;
+};
+/** The node a rich-text placeholder's opening tag names. */
+const chipRefOf = (openTag) => {
+    const id = /data-ctx-node-id=["']([^"']*)["']/.exec(openTag);
+    return { type: 'workflowContext', nodeId: id ? id[1] : '' };
+};
+/**
+ * The values a body is made of when it has no author text — one value, a
+ * whole token, or markup around placeholders / `{{tokens}}` only (an SMS:
+ * parts that are all values) — or null when the author wrote text.
+ */
+const valueSourcesOfBody = (body, config) => {
+    if (isValueBody(body)) {
+        return [valueSourceOf(body, config)];
+    }
+    if (Array.isArray(body)) {
+        return body.length > 0 && body.every(isValueBody)
+            ? body.map((part) => valueSourceOf(part, config))
+            : null;
+    }
+    if (typeof body !== 'string') {
+        return null;
+    }
+    const sources = [];
+    let text = '';
+    let i = 0;
+    while (i < body.length) {
+        const start = body.indexOf('<span', i);
+        const openEnd = start === -1 ? -1 : body.indexOf('>', start);
+        if (start === -1 || openEnd === -1) {
+            text += body.slice(i);
+            break;
+        }
+        const openTag = body.slice(start, openEnd + 1);
+        if (openTag.indexOf('context-value-inline') === -1) {
+            text += body.slice(i, openEnd + 1);
+            i = openEnd + 1;
+            continue;
+        }
+        text += body.slice(i, start);
+        sources.push(chipRefOf(openTag));
+        let depth = 1;
+        let j = openEnd + 1;
+        while (j < body.length && depth > 0) {
+            const nextOpen = body.indexOf('<span', j);
+            const nextClose = body.indexOf('</span>', j);
+            if (nextClose === -1) {
+                j = body.length;
+                break;
+            }
+            if (nextOpen !== -1 && nextOpen < nextClose) {
+                const innerEnd = body.indexOf('>', nextOpen);
+                j = innerEnd === -1 ? body.length : innerEnd + 1;
+                depth++;
+            }
+            else {
+                j = nextClose + '</span>'.length;
+                depth--;
+            }
+        }
+        i = j;
+    }
+    text = text.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, (token) => {
+        sources.push(valueSourceOf(token, config));
+        return '';
+    });
+    const authorText = text
+        .replace(/<[^>]*>/g, '')
+        .replace(/&nbsp;|&#160;|&#xa0;/gi, '')
+        .replace(/\s+/g, '');
+    return sources.length > 0 && authorText === '' ? sources : null;
+};
+const isTrustedHtmlSource = (source, sources) => isRecord(source) &&
+    source.type === 'workflowContext' &&
+    typeof source.nodeId === 'string' &&
+    sources.html.has(source.nodeId);
+/**
+ * Callers that are not visitors: this deployment's own server code
+ * (`serverOnly`), or a signed-in role a visitor cannot give itself.
+ *
+ * INVARIANT: this holds only while no visitor can obtain a role other than
+ * `user` by themselves — signup always grants `user` (auth-generator,
+ * account-signup). A feature that lets a visitor acquire another role (a
+ * purchase that grants one) must make this check name the self-service roles.
+ */
+const isPrivilegedRoute = (protection) => {
+    if (!protection) {
+        return false;
+    }
+    if (protection.serverOnly) {
+        return true;
+    }
+    const roles = Array.isArray(protection.allowedRoles) ? protection.allowedRoles : [];
+    return protection.requiresAuth === true && roles.length > 0 && roles.indexOf('user') === -1;
+};
+/**
+ * A refused send in the owner's words: the build log's line, and what the
+ * editor shows before a publish (`collectWorkflowPublishRefusals`).
+ */
+export const describeRefusedSend = (workflowName, stepName, refusal) => `Workflow "${workflowName}": the step "${stepName}" ${refusal}, so it will never send. Write the ` +
+    "message in the step (place the visitor's values in it), use a fixed sender, and " +
+    "put the visitor's address in Reply-To.";
+/**
+ * The segment with every email/SMS node whose recipient the request can
+ * choose marked for the guard, every whole-value body marked to be escaped,
+ * and every send that must never go out marked refused (with the reason in
+ * the build log). Nodes that need no mark — and a segment without such nodes
+ * — are returned as they are, so their routes stay byte for byte the same.
+ *
+ * `trust.messageTrust` (from segment-trust, over the whole graph) names the
+ * results the guard may trust; without it only this segment's own owner reads
+ * and builders count.
+ */
+export const markVisitorBoundMessageNodes = (segment, trust, protection, workflowName, options = {}) => {
+    if (!segment.nodes.some((node) => isOutboundMessageNodeType(node.type))) {
+        return segment;
+    }
+    if (isPrivilegedRoute(protection)) {
+        return segment;
+    }
+    const session = trust && trust.session;
+    const messageTrust = (trust && trust.messageTrust) ||
+        collectMessageTrust({
+            nodes: segment.nodes,
+            edges: segment.edges,
+            serverNodeIds: new Set(segment.nodes.map((node) => node.id)),
+        });
+    const sources = {
+        owner: new Set(messageTrust.ownerRecipientNodeIds),
+        html: new Set(messageTrust.trustedHtmlNodeIds),
+        sessionBound: !!session,
+        identityNodeIds: new Set(session ? Object.keys(session.identityNodes || {}) : []),
+    };
+    let changed = false;
+    const nodes = segment.nodes.map((node) => {
+        if (!isOutboundMessageNodeType(node.type) || !isRecord(node.config)) {
+            return node;
+        }
+        const config = node.config;
+        const channel = channelOf(node.type);
+        const visitorFields = RECIPIENT_FIELDS[channel].filter((field) => !isOwnerValue(config[field], sources));
+        const bodyKey = channel === 'email' ? 'body' : 'message';
+        const bodySources = valueSourcesOfBody(config[bodyKey], config);
+        const htmlBody = bodySources !== null && bodySources.every((source) => isTrustedHtmlSource(source, sources));
+        const visitorSender = SENDER_FIELDS[channel].find((field) => !isOwnerValue(config[field], sources));
+        let refusal = '';
+        if (visitorFields.length > 0 && bodySources !== null && !htmlBody) {
+            refusal =
+                "sends a message that is only the visitor's input to an address the visitor supplies";
+        }
+        else if (visitorSender) {
+            refusal = `takes its sender (${visitorSender}) from the visitor`;
+        }
+        const escapeBody = channel === 'email' && isValueBody(config.body) && !htmlBody && !refusal;
+        if (visitorFields.length === 0 && !escapeBody && !refusal) {
+            return node;
+        }
+        if (refusal && !options.silent) {
+            // The build log is where a generation refusal reaches the owner.
+            // tslint:disable-next-line:no-console
+            console.warn(`[teleport-plugin-next-workflows] ${describeRefusedSend(workflowName || segment.id, stepNameOf(node), refusal)}`);
+        }
+        changed = true;
+        return Object.assign(Object.assign({}, node), { config: Object.assign(Object.assign(Object.assign(Object.assign({}, config), (visitorFields.length > 0 ? { [VISITOR_RECIPIENT_FIELDS_KEY]: visitorFields } : {})), (escapeBody ? { [ESCAPE_BODY_KEY]: true } : {})), (refusal ? { [REFUSE_SEND_KEY]: refusal } : {})) });
+    });
+    return changed ? Object.assign(Object.assign({}, segment), { nodes }) : segment;
+};
+/**
+ * A webhook route whose payload no provider signature vouches for is as
+ * public as a page's route: its email/SMS nodes are marked the same way, with
+ * the webhook's payload (the trigger) as visitor input. Its caller is an
+ * integration, not a visitor, so its sends are counted per recipient and per
+ * site only. A verified webhook (a payment provider's, or any verified
+ * signature scheme) keeps its nodes as they are. `marked` says whether a send
+ * counts visitor-supplied recipients.
+ */
+export const markWebhookMessageNodes = (workflow, serverNodes, serverEdges, verified, options = {}) => {
+    if (verified || !serverNodes.some((node) => isOutboundMessageNodeType(node.type))) {
+        return { nodes: serverNodes, marked: false };
+    }
+    const segment = {
+        id: workflow.id,
+        env: 'server',
+        nodeIds: serverNodes.map((node) => node.id),
+        nodes: serverNodes,
+        edges: serverEdges,
+    };
+    const trust = {
+        messageTrust: collectMessageTrust({
+            nodes: workflow.nodes,
+            edges: workflow.edges,
+            serverNodeIds: new Set(serverNodes.map((node) => node.id)),
+        }),
+    };
+    const result = markVisitorBoundMessageNodes(segment, trust, undefined, workflow.name || workflow.id, options);
+    let marked = false;
+    const nodes = result.nodes.map((node) => {
+        if (!isRecord(node.config) || !Array.isArray(node.config[VISITOR_RECIPIENT_FIELDS_KEY])) {
+            return node;
+        }
+        marked = true;
+        return Object.assign(Object.assign({}, node), { config: Object.assign(Object.assign({}, node.config), { [NO_IP_CAP_KEY]: true }) });
+    });
+    return { nodes, marked };
+};
+/**
+ * The statement an unsigned webhook route adds when it calls a custom node:
+ * the custom node's route then counts that call's visitor-supplied sends (per
+ * recipient and per site) instead of exempting it as this deployment's own.
+ * The header is read only on a call that carries the internal-call token.
+ */
+export const PUBLIC_CALLER_INJECTION = `\n    context.__internalHeaders['${PUBLIC_CALLER_HEADER}'] = '1';`;
+/**
+ * Emitted before every email/SMS handler: `__outboundMessageGuard(channel,
+ * config, context)` resolves `null` when the send may go on, after it has
+ * cleaned `config` in place (so the sent-email ledger records what was sent);
+ * `{ skipped }` when a limit was reached (the node answers a skipped, non-fatal
+ * result: the visitor's action goes on); `{ error }` when the send is refused
+ * (refused at generation, or no security runtime: a fatal result). It never
+ * throws.
+ *
+ * Without the security runtime (no `relativePrefix`) a visitor-bound send is
+ * refused; every other send only gets its headers cleaned.
+ */
+export const generateOutboundMessageGuardCode = (relativePrefix) => `${generateSecurityRuntimeVar('__outboundSecurity', relativePrefix)}
+${VISITOR_KEY_CODE}
+var __outboundMessageGuard = typeof __outboundMessageGuard !== 'undefined' ? __outboundMessageGuard : async function __outboundMessageGuard(channel, config, context) {
+  var TOO_MANY = ${JSON.stringify(TOO_MANY_MESSAGES_MESSAGE)};
+  var NOT_SENT = ${JSON.stringify(MESSAGE_NOT_SENT_MESSAGE)};
+  function withoutLineBreaks(value) {
+    if (typeof value === 'string') return value.replace(/[\\r\\n]+/g, ' ');
+    if (Array.isArray(value)) return value.map(withoutLineBreaks);
+    if (value && typeof value === 'object') {
+      var copy = {};
+      Object.keys(value).forEach(function (key) { copy[key] = withoutLineBreaks(value[key]); });
+      return copy;
+    }
+    return value;
+  }
+  function escapeHtml(text) {
+    return ${escapeHtmlValueJs('text')};
+  }
+  // One parameter on purpose: a two-parameter declaration ahead of the node's
+  // own entry would be taken for it (see resolveHandlerEntryName).
+  var recipients = [];
+  function collectRecipients(value) {
+    if (Array.isArray(value)) { value.forEach(collectRecipients); return; }
+    if (value && typeof value === 'object') { collectRecipients(value.email !== undefined ? value.email : value.to); return; }
+    if (value === undefined || value === null) return;
+    String(value).split(/[,;]/).forEach(function (part) {
+      var address = part.trim();
+      if (channel === 'sms') {
+        // E.164: one number however it is written (+1 555…, 1555…, 001555…).
+        var phone = address.replace(/[^0-9+]/g, '');
+        var international = phone.charAt(0) === '+';
+        phone = phone.replace(/[+]/g, '');
+        if (!international && phone.indexOf('00') === 0) phone = phone.slice(2);
+        address = phone ? '+' + phone : '';
+      } else {
+        // Lower-cased, without a +tag: one mailbox however it is written.
+        var bracketed = /<([^<>]+)>/.exec(address);
+        address = (bracketed ? bracketed[1] : address).trim().toLowerCase();
+        var at = address.lastIndexOf('@');
+        var tag = at > 0 ? address.slice(0, at).indexOf('+') : -1;
+        if (tag > 0) address = address.slice(0, tag) + address.slice(at);
+        // Gmail ignores dots in the mailbox name.
+        at = address.lastIndexOf('@');
+        var domain = at > 0 ? address.slice(at + 1) : '';
+        if (domain === 'gmail.com' || domain === 'googlemail.com') {
+          address = address.slice(0, at).replace(/[.]/g, '') + '@gmail.com';
+        }
+      }
+      if (address && recipients.indexOf(address) === -1) recipients.push(address);
+    });
+  }
+  try {
+    if (!config || typeof config !== 'object') return null;
+    var headerFields = channel === 'sms' ? ['from', 'to'] : ['from', 'fromName', 'to', 'cc', 'bcc', 'replyTo', 'subject'];
+    headerFields.forEach(function (field) {
+      if (config[field] !== undefined) config[field] = withoutLineBreaks(config[field]);
+    });
+    var refusal = typeof config.${REFUSE_SEND_KEY} === 'string' ? config.${REFUSE_SEND_KEY} : '';
+    var escapeBody = config.${ESCAPE_BODY_KEY} === true;
+    var fields = Array.isArray(config.${VISITOR_RECIPIENT_FIELDS_KEY}) ? config.${VISITOR_RECIPIENT_FIELDS_KEY} : [];
+    var noIpCap = config.${NO_IP_CAP_KEY} === true;
+    delete config.${REFUSE_SEND_KEY};
+    delete config.${ESCAPE_BODY_KEY};
+    delete config.${VISITOR_RECIPIENT_FIELDS_KEY};
+    delete config.${NO_IP_CAP_KEY};
+    // Refused when the site was generated (the build log names the step).
+    if (refusal) {
+      console.error('[' + channel + '] send refused: the step ' + refusal);
+      return { error: NOT_SENT };
+    }
+    if (escapeBody && config.body !== undefined && config.body !== null) {
+      config.body = escapeHtml(String(config.body));
+    }
+    if (fields.length === 0) return null;
+    var request = context && context.__request;
+    // This deployment's own server code (a webhook or cron running a custom
+    // node) is not a visitor — unless it calls for a public webhook, whose
+    // sends count per recipient and per site (the header is honoured only on
+    // a call that carries the internal-call token).
+    if (request && request.internal === true) {
+      var headers = request.headers && typeof request.headers === 'object' ? request.headers : {};
+      if (headers['${PUBLIC_CALLER_HEADER}'] !== '1') return null;
+      noIpCap = true;
+    }
+    fields.forEach(function (field) { collectRecipients(config[field]); });
+    if (recipients.length === 0) return null;
+    var security = __outboundSecurity;
+    if (!security || typeof security.rateLimit !== 'function' || typeof security.clientIp !== 'function') {
+      console.error('[' + channel + '] send refused: the security runtime is not available');
+      return { error: NOT_SENT };
+    }
+    var scope = channel + '-visitor-recipient';
+    var visitor = __visitorKeyOf(security, request);
+    for (var i = 0; i < recipients.length; i++) {
+      var checks = [
+        { key: JSON.stringify([scope, 'recipient', recipients[i]]), limit: ${VISITOR_SENDS_PER_RECIPIENT_PER_HOUR}, windowSeconds: 3600 },
+        { key: 'site:' + scope, limit: ${VISITOR_SENDS_PER_SITE_PER_DAY}, windowSeconds: 86400 }
+      ];
+      if (!noIpCap) {
+        checks.unshift({ key: JSON.stringify([scope, 'ip', visitor]), limit: ${VISITOR_SENDS_PER_IP_PER_HOUR}, windowSeconds: 3600 });
+      }
+      for (var c = 0; c < checks.length; c++) {
+        var verdict = await security.rateLimit(checks[c]);
+        if (!verdict || !verdict.allowed) {
+          console.warn('[' + channel + '] send skipped: a limit on visitor-supplied recipients was reached');
+          return { skipped: TOO_MANY };
+        }
+      }
+    }
+    return null;
+  } catch (err) {
+    console.error('[' + channel + '] send refused:', err && err.message ? err.message : err);
+    return { error: NOT_SENT };
+  }
+};`;
+export const outboundMessageHandlerSources = (handler, options = {}) => {
+    const extra = options.extraSource ? '\n' + options.extraSource : '';
+    const finish = (source) => options.nodeType ? assertHandlerHasNoModuleRefs(source, options.nodeType) : source;
+    return {
+        generateHandler: () => finish(generateOutboundMessageGuardCode() + '\n\n' + handlerToString(handler) + extra),
+        generateServerHandler: (serverOptions) => finish(generateOutboundMessageGuardCode(serverHandlerPrefix(serverOptions)) +
+            '\n\n' +
+            handlerToString(handler) +
+            extra),
+    };
+};
+//# sourceMappingURL=outbound-message-guard.js.map

package/dist/esm/nodes/email/outbound-message-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-message-guard.js","sourceRoot":"","sources":["../../../../src/nodes/email/outbound-message-guard.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAyD,MAAM,UAAU,CAAA;AACjG,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,mBAAmB,EAAgB,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAA;AAC9C,mEAAmE;AACnE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAA;AACrD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAA;AAEjD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,yBAAyB,GAAG,+CAA+C,CAAA;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAA;AAExE,oFAAoF;AACpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAA;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAA;AAC7C,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAA;AAC7C,gGAAgG;AAChG,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAA;AACxC,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAA;AAE9D,MAAM,gBAAgB,GAAsC;IAC1D,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;IAC1B,GAAG,EAAE,CAAC,IAAI,CAAC;CACZ,CAAA;AAED,MAAM,aAAa,GAAsC;IACvD,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC3B,GAAG,EAAE,CAAC,MAAM,CAAC;CACd,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAmB,EAAE,CACtD,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAA;AAE/C,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAE/D,MAAM,WAAW,GAAG,CAAC,KAA8B,EAAW,EAAE,CAC9D,KAAK,CAAC,IAAI,KAAK,SAAS;IACxB,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;IACtB,KAAK,CAAC,OAAmC,CAAC,aAAa,KAAK,QAAQ,CAAA;AAEvE,4EAA4E;AAC5E,MAAM,kBAAkB,GACtB,8EAA8E,CAAA;AAEhF,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAcrD;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,OAAuB,EAAW,EAAE;IACxE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;QACtF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YAC7B,OAAO,IAAI,CAAA;SACZ;QACD,IAAI,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC1D,OAAO,IAAI,CAAA;SACZ;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;KAClF;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;KAC1D;IACD,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE;QACrC,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QACjE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;KAC1F;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE;QACzB,OAAO,KAAK,CAAA;KACb;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE;QACvB,OAAO,IAAI,CAAA;KACZ;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AAC/E,CAAC,CAAA;AAED,uEAAuE;AACvE,MAAM,WAAW,GAAG,CAAC,IAAa,EAAW,EAAE,CAC7C,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC5E,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAEtD,+FAA+F;AAC/F,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,MAA+B,EAAW,EAAE;IACjF,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,KAAK,GAAG,KAAK;QACjB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAK,CAA6B,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,SAAS,CAAA;IACb,OAAO,KAAK,CAAC,CAAC,CAAE,KAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AACjE,CAAC,CAAA;AAED,4DAA4D;AAC5D,MAAM,SAAS,GAAG,CAAC,OAAe,EAA+C,EAAE;IACjF,MAAM,EAAE,GAAG,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5D,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC7D,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,IAAa,EAAE,MAA+B,EAAoB,EAAE;IAC9F,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE;QACrB,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;KACrC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAA;KACT;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QAC5B,OAAO,IAAI,CAAA;KACZ;IACD,MAAM,OAAO,GAAc,EAAE,CAAA;IAC7B,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5D,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE;YAClC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACrB,MAAK;SACN;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAA;QAC9C,IAAI,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE;YAClD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAA;YAClC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAA;YACf,SAAQ;SACT;QACD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAChC,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,CAAC,GAAG,OAAO,GAAG,CAAC,CAAA;QACnB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;YAC5C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE;gBACpB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;gBACf,MAAK;aACN;YACD,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,SAAS,EAAE;gBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;gBAC5C,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAA;gBAChD,KAAK,EAAE,CAAA;aACR;iBAAM;gBACL,CAAC,GAAG,SAAS,GAAG,SAAS,CAAC,MAAM,CAAA;gBAChC,KAAK,EAAE,CAAA;aACR;SACF;QACD,CAAC,GAAG,CAAC,CAAA;KACN;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE;QACxD,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1C,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,IAAI;SACpB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;SACrC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACtB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAE,OAAuB,EAAW,EAAE,CAChF,QAAQ,CAAC,MAAM,CAAC;IAChB,MAAM,CAAC,IAAI,KAAK,iBAAiB;IACjC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;IACjC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG,CAAC,UAA8C,EAAW,EAAE;IACpF,IAAI,CAAC,UAAU,EAAE;QACf,OAAO,KAAK,CAAA;KACb;IACD,IAAI,UAAU,CAAC,UAAU,EAAE;QACzB,OAAO,IAAI,CAAA;KACZ;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAA;IACnF,OAAO,UAAU,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAOD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,YAAoB,EACpB,QAAgB,EAChB,OAAe,EACP,EAAE,CACV,aAAa,YAAY,gBAAgB,QAAQ,KAAK,OAAO,qCAAqC;IAClG,kFAAkF;IAClF,wCAAwC,CAAA;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,OAAwB,EACxB,KAA+B,EAC/B,UAA8C,EAC9C,YAAqB,EACrB,UAA8B,EAAE,EACf,EAAE;IACnB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QACvE,OAAO,OAAO,CAAA;KACf;IACD,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE;QACjC,OAAO,OAAO,CAAA;KACf;IACD,MAAM,OAAO,GAAG,KAAK,IAAI,KAAK,CAAC,OAAO,CAAA;IACtC,MAAM,YAAY,GAChB,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC;QAC7B,mBAAmB,CAAC;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC7D,CAAC,CAAA;IACJ,MAAM,OAAO,GAAmB;QAC9B,KAAK,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,qBAAqB,CAAC;QAClD,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC;QAC9C,YAAY,EAAE,CAAC,CAAC,OAAO;QACvB,eAAe,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAA;IACD,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAoB,EAAE;QACzD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACnE,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAiC,CAAA;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CACjD,CAAA;QACD,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;QAC/D,MAAM,QAAQ,GACZ,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAC7F,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CACjD,CAAA;QACD,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE;YACjE,OAAO;gBACL,qFAAqF,CAAA;SACxF;aAAM,IAAI,aAAa,EAAE;YACxB,OAAO,GAAG,qBAAqB,aAAa,oBAAoB,CAAA;SACjE;QACD,MAAM,UAAU,GAAG,OAAO,KAAK,OAAO,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAA;QAC3F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE;YACzD,OAAO,IAAI,CAAA;SACZ;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAC9B,iEAAiE;YACjE,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,oCAAoC,mBAAmB,CACrD,YAAY,IAAI,OAAO,CAAC,EAAE,EAC1B,UAAU,CAAC,IAAI,CAAC,EAChB,OAAO,CACR,EAAE,CACJ,CAAA;SACF;QACD,OAAO,GAAG,IAAI,CAAA;QACd,OAAO,gCACF,IAAI,KACP,MAAM,8DACD,MAAM,GACN,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACnF,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC/C,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAEjC,CAAA;IACvB,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,CAAC,iCAAM,OAAO,KAAE,KAAK,IAAG,CAAC,CAAC,OAAO,CAAA;AAClD,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAA6F,EAC7F,WAA+B,EAC/B,WAA+B,EAC/B,QAAiB,EACjB,UAA8B,EAAE,EACgB,EAAE;IAClD,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QACjF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;KAC7C;IACD,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,GAAG,EAAE,QAAQ;QACb,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,WAAW;KACA,CAAA;IACpB,MAAM,KAAK,GAAG;QACZ,YAAY,EAAE,mBAAmB,CAAC;YAChC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,aAAa,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC3D,CAAC;KACa,CAAA;IACjB,MAAM,MAAM,GAAG,4BAA4B,CACzC,OAAO,EACP,KAAK,EACL,SAAS,EACT,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAC5B,OAAO,CACR,CAAA;IACD,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,EAAE;YACvF,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,GAAG,IAAI,CAAA;QACb,OAAO,gCAAK,IAAI,KAAE,MAAM,kCAAO,IAAI,CAAC,MAAM,KAAE,CAAC,aAAa,CAAC,EAAE,IAAI,MAAwB,CAAA;IAC3F,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAAoC,oBAAoB,WAAW,CAAA;AAE1G;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,cAAuB,EACf,EAAE,CAAC,GAAG,0BAA0B,CAAC,oBAAoB,EAAE,cAAc,CAAC;EAC9E,gBAAgB;;mBAEC,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC;mBACzC,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC;;;;;;;;;;;;aAY9C,iBAAiB,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAyCJ,eAAe,0BAA0B,eAAe;8BAC5D,eAAe;wCACL,4BAA4B,cAAc,4BAA4B;2BACnF,aAAa;oBACpB,eAAe;oBACf,eAAe;oBACf,4BAA4B;oBAC5B,aAAa;;;;;;;;;;;;;;;;;qBAiBZ,oBAAoB;;;;;;;;;;;;;;6EAcoC,oCAAoC;yCACxE,8BAA8B;;;+EAGQ,6BAA6B;;;;;;;;;;;;;;;GAezG,CAAA;AAaH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,OAAkB,EAClB,UAAwC,EAAE,EAC+B,EAAE;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CACxC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACpF,OAAO;QACL,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,gCAAgC,EAAE,GAAG,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACxF,qBAAqB,EAAE,CAAC,aAAoC,EAAE,EAAE,CAC9D,MAAM,CACJ,gCAAgC,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;YAClE,MAAM;YACN,eAAe,CAAC,OAAO,CAAC;YACxB,KAAK,CACR;KACJ,CAAA;AACH,CAAC,CAAA"}

package/dist/esm/nodes/email/trusted-html-code.d.ts

@@ -0,0 +1,22 @@
+/**
+ * HTML the generated code builds itself, for an email template to show as
+ * HTML — emitted into the runtime utils next to `applyTemplateParams`.
+ *
+ * Every value an email template is filled with is escaped, so only the
+ * author's template is markup. The one kind of value the platform's own
+ * templates show as markup is the products list (`{{productsList}}`, a `<ul>`
+ * of the lines in the withdrawal, withdrawal-owner and abandoned-cart emails;
+ * the low-stock alert fills its own). Its builders hand the email node the
+ * structured lines too (`products`), so the list is built HERE, at send time,
+ * from those lines, with every field of a line (name, options, quantity)
+ * escaped — never taken from the `productsList` value the node was handed,
+ * which a browser may have computed.
+ *
+ * What this code builds is marked trusted (`trustedHtml`, a registry a
+ * request cannot reach: a value that arrived as JSON is never in it), and the
+ * template fill inserts only marked values unescaped.
+ */
+export declare const PRODUCTS_LIST_PARAM = "productsList";
+export declare const PRODUCTS_ROWS_PARAM = "products";
+export declare const TRUSTED_HTML_RUNTIME_CODE: string;
+//# sourceMappingURL=trusted-html-code.d.ts.map

package/dist/esm/nodes/email/trusted-html-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-html-code.d.ts","sourceRoot":"","sources":["../../../../src/nodes/email/trusted-html-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,iBAAiB,CAAA;AACjD,eAAO,MAAM,mBAAmB,aAAa,CAAA;AAE7C,eAAO,MAAM,yBAAyB,QA2BrC,CAAA"}

package/dist/esm/nodes/email/trusted-html-code.js

@@ -0,0 +1,49 @@
+/**
+ * HTML the generated code builds itself, for an email template to show as
+ * HTML — emitted into the runtime utils next to `applyTemplateParams`.
+ *
+ * Every value an email template is filled with is escaped, so only the
+ * author's template is markup. The one kind of value the platform's own
+ * templates show as markup is the products list (`{{productsList}}`, a `<ul>`
+ * of the lines in the withdrawal, withdrawal-owner and abandoned-cart emails;
+ * the low-stock alert fills its own). Its builders hand the email node the
+ * structured lines too (`products`), so the list is built HERE, at send time,
+ * from those lines, with every field of a line (name, options, quantity)
+ * escaped — never taken from the `productsList` value the node was handed,
+ * which a browser may have computed.
+ *
+ * What this code builds is marked trusted (`trustedHtml`, a registry a
+ * request cannot reach: a value that arrived as JSON is never in it), and the
+ * template fill inserts only marked values unescaped.
+ */
+export const PRODUCTS_LIST_PARAM = 'productsList';
+export const PRODUCTS_ROWS_PARAM = 'products';
+export const TRUSTED_HTML_RUNTIME_CODE = `// HTML this runtime built itself (see trusted-html-code in the generator).
+var __trustedHtmlValues = typeof WeakSet === 'function' ? new WeakSet() : null;
+
+function trustedHtml(html) {
+  var value = new String(html == null ? '' : html);
+  if (__trustedHtmlValues) __trustedHtmlValues.add(value);
+  return value;
+}
+
+function isTrustedHtml(value) {
+  return !!__trustedHtmlValues && value !== null && typeof value === 'object' && __trustedHtmlValues.has(value);
+}
+
+// The products list of a platform email ({{${PRODUCTS_LIST_PARAM}}}), from its lines.
+function renderProductsListHtml(rows) {
+  var html = '<ul style="margin:0;padding-left:18px;">';
+  for (var i = 0; i < rows.length; i++) {
+    var row = rows[i] && typeof rows[i] === 'object' ? rows[i] : {};
+    var name = row.product_name != null ? row.product_name : row.name != null ? row.name : 'Product';
+    var quantity = parseInt(row.quantity, 10);
+    if (isNaN(quantity) || quantity <= 0) quantity = 1;
+    var label = row.configuration_label != null ? String(row.configuration_label) : '';
+    html += '<li>' + quantity + '× <strong>' + escapeHtmlText(String(name)) + '</strong>' +
+      (label ? ' — ' + escapeHtmlText(label) : '') + '</li>';
+  }
+  return trustedHtml(html + '</ul>');
+}
+`;
+//# sourceMappingURL=trusted-html-code.js.map

package/dist/esm/nodes/email/trusted-html-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-html-code.js","sourceRoot":"","sources":["../../../../src/nodes/email/trusted-html-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAA;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAA;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;8CAaK,mBAAmB;;;;;;;;;;;;;;CAchE,CAAA"}

package/dist/esm/nodes/general/general-custom-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"general-custom-js.d.ts","sourceRoot":"","sources":["../../../../src/nodes/general/general-custom-js.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAmB,MAAM,UAAU,CAAA;AAyehE,eAAO,MAAM,eAAe,EAAE,oBAM7B,CAAA"}
+{"version":3,"file":"general-custom-js.d.ts","sourceRoot":"","sources":["../../../../src/nodes/general/general-custom-js.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAmB,MAAM,UAAU,CAAA;AAghBhE,eAAO,MAAM,eAAe,EAAE,oBAM7B,CAAA"}