@teleporthq/teleport-plugin-next-workflows 0.44.7 → 0.44.9

package/dist/esm/server-runtime-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime-code.d.ts","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,yBAAyB,QAAO,MAyQ5C,CAAA"}
+{"version":3,"file":"server-runtime-code.d.ts","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,eAAO,MAAM,yBAAyB,QAAO,MA+X5C,CAAA"}

package/dist/esm/server-runtime-code.js

@@ -1,3 +1,4 @@
+import { generateVercelFunctionsLoaderCode } from './vercel-functions';
 /**
  * `utils/workflows/server-runtime.js`: what every server route loads. It is the
  * shared runtime utilities plus the parts only a server may run — the signed
@@ -27,6 +28,14 @@
  * that needs a trustworthy figure (a price, an owner) reads it from the
  * database itself.
  *
+ * A result that is a credential (a password hash, see credential-results.ts)
+ * makes the same trip SEALED: `segmentReply` replies it encrypted with a key
+ * derived from NEXTAUTH_SECRET (AES-256-GCM) and signs the sealed form, and
+ * `claimSegmentContext` opens every sealed value a request hands it (a
+ * relayed result once its signature holds). The browser relays it without
+ * ever reading it, and a later segment's reply hands back the sealed form,
+ * never the opened one.
+ *
  * The facts about the graph each route needs are baked into its
  * SEGMENT_CONFIG at generation time (see segment-trust.ts).
  */
@@ -34,6 +43,8 @@ export const generateServerRuntimeCode = () => `'use strict';
 var crypto = require('crypto');
 var utils = require('./runtime-utils');
 
+${generateVercelFunctionsLoaderCode()}
+
 var __stepKeyCache = { secret: null, key: null };
 
 function stepKey() {
@@ -51,6 +62,59 @@ function mac(text) {
   return crypto.createHmac('sha256', stepKey()).update(text).digest('hex');
 }
 
+var __sealKeyCache = { secret: null, key: null };
+
+function sealKey() {
+  var secret = process.env.NEXTAUTH_SECRET || '';
+  if (__sealKeyCache.secret !== secret) {
+    __sealKeyCache = {
+      secret: secret,
+      key: crypto.createHmac('sha256', secret).update('teleport-workflow-seal:v1').digest()
+    };
+  }
+  return __sealKeyCache.key;
+}
+
+var SEAL_IV_BYTES = 12;
+var SEAL_TAG_BYTES = 16;
+
+var SEAL_AAD = Buffer.from('teleport-workflow-sealed-result:v1', 'utf8');
+
+// The sealed form of a credential result; undefined (the result is then not
+// replied at all) without an app secret, whose key anyone could derive.
+function sealResult(value) {
+  if (!process.env.NEXTAUTH_SECRET) return undefined;
+  var serialized;
+  try { serialized = JSON.stringify(value); } catch (e) { return undefined; }
+  if (serialized === undefined) return undefined;
+  var iv = crypto.randomBytes(SEAL_IV_BYTES);
+  var cipher = crypto.createCipheriv('aes-256-gcm', sealKey(), iv);
+  cipher.setAAD(SEAL_AAD);
+  var data = Buffer.concat([cipher.update(serialized, 'utf8'), cipher.final()]);
+  return { __sealed: Buffer.concat([iv, cipher.getAuthTag(), data]).toString('base64') };
+}
+
+function isSealedResult(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value) &&
+    typeof value.__sealed === 'string' && Object.keys(value).length === 1;
+}
+
+// { value } when the sealed form opens under this app's key, else null.
+function openSealedResult(sealed) {
+  if (!process.env.NEXTAUTH_SECRET) return null;
+  try {
+    var raw = Buffer.from(sealed.__sealed, 'base64');
+    if (raw.length <= SEAL_IV_BYTES + SEAL_TAG_BYTES) return null;
+    var decipher = crypto.createDecipheriv('aes-256-gcm', sealKey(), raw.subarray(0, SEAL_IV_BYTES));
+    decipher.setAAD(SEAL_AAD);
+    decipher.setAuthTag(raw.subarray(SEAL_IV_BYTES, SEAL_IV_BYTES + SEAL_TAG_BYTES));
+    var data = Buffer.concat([decipher.update(raw.subarray(SEAL_IV_BYTES + SEAL_TAG_BYTES)), decipher.final()]);
+    return { value: JSON.parse(data.toString('utf8')) };
+  } catch (e) {
+    return null;
+  }
+}
+
 // Without an app secret every key here would derive from '' — a value anyone
 // can compute — so nothing verifies: relayed server results are dropped and no
 // request passes as an internal call. (The generator gives every app with
@@ -206,10 +270,48 @@ function resetPreviousResult(segmentConfig, context) {
 // merge will.
 var __incomingOrders = new WeakMap();
 
+// The sealed results this segment opened, so its reply hands the caller back
+// the sealed form it relayed (see resealRelayedResults).
+var __openedResults = new WeakMap();
+
+// Opens every sealed value the request hands this segment, so its nodes read
+// the credential itself: a relayed server result (whose signature
+// dropUnsignedResults checked first), or a value the browser holds from one
+// (a custom node's output, the previous result). Only this app's server
+// seals, so what opens is what it sealed.
+function openSealedResults(context) {
+  var opened = [];
+  Object.keys(context).forEach(function(key) {
+    if (isControlKey(key) && key !== '__previousNodeResult') return;
+    if (!isSealedResult(context[key])) return;
+    var result = openSealedResult(context[key]);
+    if (!result) return;
+    opened.push({ sealed: context[key], value: result.value });
+    context[key] = result.value;
+  });
+  __openedResults.set(context, opened);
+}
+
+// Every reply entry that is an opened value (the value itself, or the previous
+// result taken from it) goes back sealed.
+function resealRelayedResults(context, reply) {
+  var opened = __openedResults.get(context) || [];
+  if (opened.length === 0) return;
+  Object.keys(reply).forEach(function(key) {
+    for (var i = 0; i < opened.length; i++) {
+      if (reply[key] === opened[i].value) {
+        reply[key] = opened[i].sealed;
+        return;
+      }
+    }
+  });
+}
+
 function claimSegmentContext(segmentConfig, context) {
   var orderKeys = readSignedOrder(context);
   if (orderKeys) restoreOrder(context, orderKeys);
   dropUnsignedResults(segmentConfig, context, orderKeys);
+  openSealedResults(context);
   stripForeignControlKeys(segmentConfig, context);
   __incomingOrders.set(context, Object.keys(context).filter(function(k) { return !isControlKey(k); }));
   utils.claimSegmentContext(segmentConfig, context);
@@ -219,6 +321,13 @@ function claimSegmentContext(segmentConfig, context) {
 
 function segmentReply(segmentConfig, context, snapshot) {
   var reply = utils.segmentReply(segmentConfig, context, snapshot);
+  resealRelayedResults(context, reply);
+  var credentialIds = utils.credentialResultNodeIds(segmentConfig);
+  Object.keys(credentialIds).forEach(function(id) {
+    if (context[id] === undefined) return;
+    var sealed = sealResult(context[id]);
+    if (sealed) reply[id] = sealed;
+  });
   var sigs = {};
   var incoming = context.__sig && typeof context.__sig === 'object' && !Array.isArray(context.__sig) ? context.__sig : {};
   Object.keys(incoming).forEach(function(id) {
@@ -288,7 +397,25 @@ function trustedBaseUrl(req) {
   return origin;
 }
 
+// The work a segment's not-awaited steps left running (an invoice being
+// rendered and mailed) must still finish, but the visitor need not wait for
+// it: on Vercel it is handed to waitUntil, which keeps the function running
+// after the reply. Anywhere else the route awaits it before replying, since a
+// function frozen after its reply would drop it.
+function handOffPendingNodePromises(context) {
+  var queue = context && context.__pendingNodePromises;
+  if (!queue || queue.length === 0) return Promise.resolve();
+  // Drained through the queue itself: the route deletes it from the context
+  // before replying, and a parallel branch still running pushes onto it.
+  var drained = utils.settlePendingNodePromises({ __pendingNodePromises: queue });
+  var waitUntil = __vercelWaitUntil();
+  if (!waitUntil) return drained;
+  waitUntil(drained);
+  return Promise.resolve();
+}
+
 module.exports = Object.assign({}, utils, {
+  handOffPendingNodePromises: handOffPendingNodePromises,
   claimSegmentContext: claimSegmentContext,
   segmentReply: segmentReply,
   internalRequestHeaders: internalRequestHeaders,

package/dist/esm/server-runtime-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime-code.js","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAW,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyQtD,CAAA"}
+{"version":3,"file":"server-runtime-code.js","sourceRoot":"","sources":["../../src/server-runtime-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAA;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAW,EAAE,CAAC;;;;EAIrD,iCAAiC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2XpC,CAAA"}

package/dist/esm/transactional-email-code.d.ts

@@ -17,6 +17,13 @@ export interface TransactionalEmailLedger {
     source: string;
     sourceRef: string;
     relativePrefix: string;
+    /**
+     * Records the send without the recipient's details: `msg.recordedTo` in
+     * place of the address, and neither the body nor the values it was filled
+     * with. For an email to someone whose details the route is removing (the
+     * farewell after an account deletion).
+     */
+    withoutRecipientDetails?: boolean;
 }
 export declare const generateProviderSendFunction: (provider?: string | null, ledger?: TransactionalEmailLedger) => string;
 export declare const generateFillTemplateFn: () => string;

package/dist/esm/transactional-email-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transactional-email-code.d.ts","sourceRoot":"","sources":["../../src/transactional-email-code.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAKxE,eAAO,MAAM,yBAAyB,aAMpC,CAAA;AAIF,eAAO,MAAM,8BAA8B,cAC9B,MAAM,GAAG,IAAI,KACvB,OAAO,MAAM,EAAE,MAAM,CAKvB,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB;AASD,eAAO,MAAM,4BAA4B,cAC5B,MAAM,GAAG,IAAI,WACf,wBAAwB,KAChC,MA0CF,CAAA;AA6DD,eAAO,MAAM,sBAAsB,QAAO,MASxC,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,UAAW,OAAO,KAAG,2BAgB5D,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,mBAAoB,MAAM,KAAG,MAGlC,CAAA;AAElC;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,WAAY;IACnD,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB,KAAG,MAMF,CAAA;AAKF,eAAO,MAAM,yBAAyB,UAarC,CAAA"}
+{"version":3,"file":"transactional-email-code.d.ts","sourceRoot":"","sources":["../../src/transactional-email-code.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAKxE,eAAO,MAAM,yBAAyB,aAMpC,CAAA;AAIF,eAAO,MAAM,8BAA8B,cAC9B,MAAM,GAAG,IAAI,KACvB,OAAO,MAAM,EAAE,MAAM,CAKvB,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAClC;AASD,eAAO,MAAM,4BAA4B,cAC5B,MAAM,GAAG,IAAI,WACf,wBAAwB,KAChC,MA0CF,CAAA;AA6DD,eAAO,MAAM,sBAAsB,QAAO,MASxC,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,UAAW,OAAO,KAAG,2BAgB5D,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,mBAAoB,MAAM,KAAG,MAGlC,CAAA;AAElC;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,WAAY;IACnD,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB,KAAG,MAMF,CAAA;AAKF,eAAO,MAAM,yBAAyB,UAarC,CAAA"}

package/dist/esm/transactional-email-code.js

@@ -16,8 +16,8 @@ export const transactionalEmailDependencies = (provider) => {
     }
     return getEmailProviderDependencies(provider);
 };
-// Provider-specific `__sendProviderEmail({ from, fromName?, to, subject, html,
-// apiKey, tokenValues?, userId? })`, preceded by the `__emailSender` helper that
+// Provider-specific `__sendProviderEmail({ from, fromName?, to, recordedTo?,
+// subject, html, apiKey, tokenValues?, userId? })`, preceded by the `__emailSender` helper that
 // names the sender. No attachment (unlike the invoice sender). When no provider
 // is configured the function is a no-op so the route stays self-contained and
 // never throws. With `ledger`, the provider function is emitted as
@@ -50,12 +50,12 @@ async function __sendProviderEmail(msg) {
   __sentEmailLog.recordSentEmail({
     emailType: ${JSON.stringify(ledger.emailType)},
     audience: 'customer',
-    to: msg.to,
+    to: ${ledger.withoutRecipientDetails ? 'msg.recordedTo' : 'msg.to'},
     from: sender.email,
     fromName: sender.name,
     subject: msg.subject,
-    html: msg.html,
-    payload: msg.tokenValues,
+    html: ${ledger.withoutRecipientDetails ? "''" : 'msg.html'},
+    payload: ${ledger.withoutRecipientDetails ? 'null' : 'msg.tokenValues'},
     provider: ${JSON.stringify(provider)},
     status: failure ? 'failed' : 'sent',
     error: failure ? (failure.message || String(failure)) : null,

package/dist/esm/transactional-email-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"transactional-email-code.js","sourceRoot":"","sources":["../../src/transactional-email-code.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAE7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IAC/C,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,YAAY;CACb,CAAC,CAAA;AAEF,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAwB,EACA,EAAE;IAC1B,IAAI,CAAC,QAAQ,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACzD,OAAO,EAAE,CAAA;KACV;IACD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,CAAA;AAC/C,CAAC,CAAA;AAcD,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,mEAAmE;AACnE,2EAA2E;AAC3E,oDAAoD;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAwB,EACxB,MAAiC,EACzB,EAAE;IACV,MAAM,GAAG,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACzD,OAAO,GAAG,CAAA;KACX;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAA;IAChE,IAAI,CAAC,MAAM,EAAE;QACX,OAAO,GAAG,YAAY;EACxB,GAAG,EAAE,CAAA;KACJ;IACD,OAAO,GAAG,YAAY;EACtB,GAAG,CAAC,OAAO,CAAC,qCAAqC,EAAE,wCAAwC,CAAC;;gCAE9D,MAAM,CAAC,cAAc;;;;;;;;;;;;iBAYpC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;;;;;;;;gBAQjC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;cAG1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;iBAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;;;;EAI/C,CAAA;AACF,CAAC,CAAA;AAED,MAAM,+BAA+B,GAAG,CAAC,QAAwB,EAAU,EAAE;IAC3E,QAAQ,QAAQ,EAAE;QAChB,KAAK,QAAQ;YACX,OAAO;;;;;;EAMX,CAAA;QACE,KAAK,UAAU;YACb,2EAA2E;YAC3E,2CAA2C;YAC3C,OAAO;;;;;;EAMX,CAAA;QACE,KAAK,UAAU;YACb,OAAO;;;;;EAKX,CAAA;QACE,KAAK,SAAS;YACZ,OAAO;;;;;;;;;EASX,CAAA;QACE,KAAK,YAAY;YACf,OAAO;;;;;;;;;;EAUX,CAAA;QACE;YACE,OAAO;;EAEX,CAAA;KACC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAW,EAAE,CAAC;;;;;;;;;EASlD,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAc,EAA+B,EAAE;IACzF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC/D,OAAO,EAAE,CAAA;KACV;IACD,MAAM,MAAM,GAAgC,EAAE,CAAA;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE;QAC7E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YACrC,SAAQ;SACT;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAA6C,CAAA;QACvE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE;YACrC,SAAQ;SACT;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;KACvF;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,cAAsB,EAAU,EAAE,CAC3E,gCAAgC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CACtE,GAAG,CACJ,IAAI,sBAAsB,KAAK,CAAA;AAElC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAK5C,EAAU,EAAE,CAAC,YAAY,MAAM,CAAC,MAAM;;iBAEtB,MAAM,CAAC,YAAY,WAAW,MAAM,CAAC,SAAS;MACzD,MAAM,CAAC,cAAc;;;EAGzB,CAAA;AAEF,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe;IACf,MAAM;IACN,UAAU;IACV,QAAQ;IACR,aAAa;IACb,SAAS;IACT,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;CACrB,CAAA"}
+{"version":3,"file":"transactional-email-code.js","sourceRoot":"","sources":["../../src/transactional-email-code.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAE7F,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IAC/C,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,YAAY;CACb,CAAC,CAAA;AAEF,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAwB,EACA,EAAE;IAC1B,IAAI,CAAC,QAAQ,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACzD,OAAO,EAAE,CAAA;KACV;IACD,OAAO,4BAA4B,CAAC,QAAQ,CAAC,CAAA;AAC/C,CAAC,CAAA;AAqBD,6EAA6E;AAC7E,gGAAgG;AAChG,gFAAgF;AAChF,8EAA8E;AAC9E,mEAAmE;AACnE,2EAA2E;AAC3E,oDAAoD;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAwB,EACxB,MAAiC,EACzB,EAAE;IACV,MAAM,GAAG,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,CAAC,QAAQ,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACzD,OAAO,GAAG,CAAA;KACX;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,6BAA6B,EAAE,CAAA;IAChE,IAAI,CAAC,MAAM,EAAE;QACX,OAAO,GAAG,YAAY;EACxB,GAAG,EAAE,CAAA;KACJ;IACD,OAAO,GAAG,YAAY;EACtB,GAAG,CAAC,OAAO,CAAC,qCAAqC,EAAE,wCAAwC,CAAC;;gCAE9D,MAAM,CAAC,cAAc;;;;;;;;;;;;iBAYpC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;;UAEvC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ;;;;YAI1D,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;eAC/C,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;gBAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;cAG1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;iBAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;;;;EAI/C,CAAA;AACF,CAAC,CAAA;AAED,MAAM,+BAA+B,GAAG,CAAC,QAAwB,EAAU,EAAE;IAC3E,QAAQ,QAAQ,EAAE;QAChB,KAAK,QAAQ;YACX,OAAO;;;;;;EAMX,CAAA;QACE,KAAK,UAAU;YACb,2EAA2E;YAC3E,2CAA2C;YAC3C,OAAO;;;;;;EAMX,CAAA;QACE,KAAK,UAAU;YACb,OAAO;;;;;EAKX,CAAA;QACE,KAAK,SAAS;YACZ,OAAO;;;;;;;;;EASX,CAAA;QACE,KAAK,YAAY;YACf,OAAO;;;;;;;;;;EAUX,CAAA;QACE;YACE,OAAO;;EAEX,CAAA;KACC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAW,EAAE,CAAC;;;;;;;;;EASlD,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAc,EAA+B,EAAE;IACzF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC/D,OAAO,EAAE,CAAA;KACV;IACD,MAAM,MAAM,GAAgC,EAAE,CAAA;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE;QAC7E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;YACrC,SAAQ;SACT;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAA6C,CAAA;QACvE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE;YACrC,SAAQ;SACT;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;KACvF;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,cAAsB,EAAU,EAAE,CAC3E,gCAAgC,cAAc,IAAI,iBAAiB,CAAC,IAAI,CACtE,GAAG,CACJ,IAAI,sBAAsB,KAAK,CAAA;AAElC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAK5C,EAAU,EAAE,CAAC,YAAY,MAAM,CAAC,MAAM;;iBAEtB,MAAM,CAAC,YAAY,WAAW,MAAM,CAAC,SAAS;MACzD,MAAM,CAAC,cAAc;;;EAGzB,CAAA;AAEF,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe;IACf,MAAM;IACN,UAAU;IACV,QAAQ;IACR,aAAa;IACb,SAAS;IACT,MAAM;IACN,YAAY;IACZ,iBAAiB;IACjB,qBAAqB;IACrB,gBAAgB;IAChB,oBAAoB;CACrB,CAAA"}