@tinyviber/a2h 0.1.0

package/dist/security/boundary.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isWithin = isWithin;
+exports.resolveRelPath = resolveRelPath;
+exports.resolveRealPath = resolveRealPath;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const path_1 = require("../util/path");
+// Path containment primitives. These are pure predicates over the filesystem —
+// they read metadata only, never content.
+//
+// They live outside `server/` because containment is not an HTTP concern: a
+// workspace-relative path can arrive from a URL, from a manifest, or from a
+// block, and every one of those routes has to answer the same question.
+function isWithin(root, target) {
+    const r = (0, node_path_1.resolve)(root);
+    const t = (0, node_path_1.resolve)(target);
+    return t === r || t.startsWith(r + node_path_1.sep);
+}
+/**
+ * Resolves a workspace-relative POSIX path to an absolute path strictly
+ * inside the workspace root. Returns null on traversal attempts.
+ *
+ * This is a lexical check: it refuses `..`, but says nothing about symlinks.
+ * Use `resolveRealPath` when the answer must survive a link in the tree.
+ */
+function resolveRelPath(root, rel) {
+    const normalized = (0, path_1.normalizeRel)(rel);
+    if (normalized === null)
+        return null;
+    const abs = (0, node_path_1.resolve)(root, normalized);
+    if (!isWithin(root, abs))
+        return null;
+    return abs;
+}
+/**
+ * Like resolveRelPath, but also resolves symlinks and verifies the *real* path
+ * stays inside the workspace. This is the check that catches an intermediate
+ * directory which is a link out of the tree — `leak -> /etc` makes
+ * `leak/passwd` lexical, but never contained.
+ *
+ * Returns the lexical absolute path (stable, knows no symlinks) on success.
+ */
+function resolveRealPath(root, rel) {
+    const abs = resolveRelPath(root, rel);
+    if (abs === null)
+        return null;
+    try {
+        const realRoot = (0, node_fs_1.realpathSync)(root);
+        const real = (0, node_fs_1.realpathSync)(abs);
+        if (!isWithin(realRoot, real))
+            return null;
+        return abs;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=boundary.js.map

package/dist/security/boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../../src/security/boundary.ts"],"names":[],"mappings":";;AAWA,4BAIC;AASD,wCAMC;AAUD,0CAWC;AAnDD,qCAAuC;AACvC,yCAAyC;AACzC,uCAA4C;AAE5C,+EAA+E;AAC/E,0CAA0C;AAC1C,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AAExE,SAAgB,QAAQ,CAAC,IAAY,EAAE,MAAc;IACnD,MAAM,CAAC,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,eAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,MAAM,UAAU,GAAG,IAAA,mBAAY,EAAC,GAAG,CAAC,CAAC;IACrC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,GAAW;IACvD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/security/urlPolicy.d.ts

@@ -0,0 +1,4 @@
+export declare function isSafeLinkHref(href: unknown): href is string;
+/** True when the value is a workspace-relative path (no scheme, no `//`). */
+export declare function isWorkspaceRelative(value: string): boolean;
+//# sourceMappingURL=urlPolicy.d.ts.map

package/dist/security/urlPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"urlPolicy.d.ts","sourceRoot":"","sources":["../../src/security/urlPolicy.ts"],"names":[],"mappings":"AAgCA,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAQ5D;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI1D"}

package/dist/security/urlPolicy.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeLinkHref = isSafeLinkHref;
+exports.isWorkspaceRelative = isWorkspaceRelative;
+/**
+ * One answer to "may this href be rendered as a link?", for every layer that
+ * writes one.
+ *
+ * Producer-authored JSON reaches the page as a link target in more than one
+ * place (list items today, and whatever block kind is added next), and the
+ * renderer is not the only consumer: a link that survives server-side
+ * normalisation is also what any future consumer will see. So the policy is a
+ * small shared allowlist rather than a check inside the one renderer we
+ * happened to write today.
+ *
+ * Allowed:
+ *   - `http:` / `https:` / `mailto:`   — the same three the markdown renderer
+ *     validates links against, so a workspace has one URL policy, not two
+ *   - `#...`                           — an in-page anchor
+ *   - a workspace-relative path        — routed as an artifact
+ *
+ * Everything else is refused. `javascript:` and `vbscript:` are script
+ * execution; `data:` and `blob:` are document injection; `file:` reaches the
+ * local disk. That the page's CSP would also stop some of them is not a reason
+ * to pass them through — a second line of defence is not a first one.
+ *
+ * Protocol-relative (`//host/path`) is refused as well: it is an off-site
+ * navigation wearing a path's clothes.
+ */
+const SAFE_LINK_SCHEMES = /^(?:https?|mailto):/i;
+const HAS_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+function hasScheme(value) {
+    return HAS_SCHEME.test(value);
+}
+function isSafeLinkHref(href) {
+    if (typeof href !== 'string')
+        return false;
+    const value = href.trim();
+    if (value === '')
+        return false;
+    if (value.startsWith('#'))
+        return true;
+    if (value.startsWith('//'))
+        return false;
+    if (hasScheme(value))
+        return SAFE_LINK_SCHEMES.test(value);
+    return true;
+}
+/** True when the value is a workspace-relative path (no scheme, no `//`). */
+function isWorkspaceRelative(value) {
+    const trimmed = value.trim();
+    if (trimmed === '' || trimmed.startsWith('//'))
+        return false;
+    return !hasScheme(trimmed);
+}
+//# sourceMappingURL=urlPolicy.js.map

package/dist/security/urlPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"urlPolicy.js","sourceRoot":"","sources":["../../src/security/urlPolicy.ts"],"names":[],"mappings":";;AAgCA,wCAQC;AAGD,kDAIC;AA/CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AACjD,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}

package/dist/security/workspaceRead.d.ts

@@ -0,0 +1,25 @@
+import type { FileEntry } from '../types';
+/** Default cap for one producer-authored text read. */
+export declare const DEFAULT_MAX_TEXT_BYTES: number;
+/** Hard ceiling. A caller may ask for less, never for more. */
+export declare const MAX_TEXT_BYTES_CEILING: number;
+export interface WorkspaceReaderOptions {
+    rootDir: string;
+    /** The scanner's index. Its contents are the allowlist. */
+    files: readonly FileEntry[];
+}
+export interface WorkspaceReader {
+    /** True when `rel` names a file the scanner indexed. */
+    has(rel: string): boolean;
+    /** True when `rel` is a scanned file that may be read as text. */
+    canReadText(rel: string): boolean;
+    /**
+     * Reads a workspace-relative text file. Returns undefined unless the path
+     * passed every check above. An empty file reads as an empty string.
+     */
+    readText(rel: string, maxBytes?: number): string | undefined;
+    /** True when `rel` is a scanned image that may be served to the browser. */
+    canReadImage(rel: string): boolean;
+}
+export declare function createWorkspaceReader(options: WorkspaceReaderOptions): WorkspaceReader;
+//# sourceMappingURL=workspaceRead.d.ts.map

package/dist/security/workspaceRead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceRead.d.ts","sourceRoot":"","sources":["../../src/security/workspaceRead.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAmC1C,uDAAuD;AACvD,eAAO,MAAM,sBAAsB,QAAa,CAAC;AAEjD,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,QAAkB,CAAC;AAEtD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7D,4EAA4E;IAC5E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAsDtF"}

package/dist/security/workspaceRead.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TEXT_BYTES_CEILING = exports.DEFAULT_MAX_TEXT_BYTES = void 0;
+exports.createWorkspaceReader = createWorkspaceReader;
+const classify_1 = require("../scanner/classify");
+const path_1 = require("../util/path");
+const safeRead_1 = require("../util/safeRead");
+const boundary_1 = require("./boundary");
+// ---------------------------------------------------------------------------
+// The workspace read capability.
+//
+// Producer-authored content can name any path it likes: a markdown block, an
+// image reference, a relation target, a future protocol extension. This module
+// is the one place such a name is turned into bytes.
+//
+// The point is not that these five checks are individually clever — it is that
+// they live here rather than at each call site. A caller cannot forget them,
+// and a new protocol feature gets them for free by asking for a reader instead
+// of for a path.
+//
+//   1. the path must name a file the scanner indexed (the allowlist — a path
+//      the scanner skipped was skipped for a reason);
+//   2. it must not be sensitive (a secret is a secret regardless of who is
+//      asking nicely);
+//   3. it must not be a symlink (the scanner already refuses to descend into
+//      one, and a link whose name looks like markdown must never become a read
+//      primitive);
+//   4. its *real* path must still be inside the workspace — this is the check
+//      that catches an intermediate directory that is a link out of the tree,
+//      which lexical normalization cannot see;
+//   5. the read is bounded, with a ceiling the caller cannot raise.
+//
+// Checks 1–3 are properties of the scanner's entry. 4 and 5 are re-derived
+// here, per call, because a capability that trusts its caller's earlier
+// checking is not a boundary.
+// ---------------------------------------------------------------------------
+/** Default cap for one producer-authored text read. */
+exports.DEFAULT_MAX_TEXT_BYTES = 512 * 1024;
+/** Hard ceiling. A caller may ask for less, never for more. */
+exports.MAX_TEXT_BYTES_CEILING = 4 * 1024 * 1024;
+function createWorkspaceReader(options) {
+    const { rootDir } = options;
+    const byPath = new Map();
+    for (const file of options.files)
+        byPath.set(file.path, file);
+    function entryFor(rel) {
+        const normalized = (0, path_1.normalizeRel)(rel);
+        if (normalized === null || normalized === '')
+            return undefined;
+        return byPath.get(normalized);
+    }
+    /**
+     * The shared gate. `resolveRealPath` runs on every call rather than once at
+     * scan time: a directory in the tree can be replaced with a link after the
+     * scan, and the containment answer has to be current when the bytes move.
+     *
+     * Sensitivity is re-derived from the name rather than read off the index's
+     * flag alone. The flag is the scanner's answer, and the scanner is good at
+     * this — but "the index says it is fine" is precisely the kind of claim a
+     * boundary should not have to take on faith.
+     */
+    function allows(entry, want) {
+        if (!entry)
+            return false;
+        if (entry.sensitive)
+            return false;
+        if ((0, classify_1.classifyFile)(basename(entry.path)).sensitive)
+            return false;
+        if (entry.isSymlink)
+            return false;
+        if (want === 'image' && (0, classify_1.contentKindOf)(entry.kind) !== 'image')
+            return false;
+        return (0, boundary_1.resolveRealPath)(rootDir, entry.path) !== null;
+    }
+    return {
+        has(rel) {
+            return entryFor(rel) !== undefined;
+        },
+        canReadText(rel) {
+            return allows(entryFor(rel), 'text');
+        },
+        readText(rel, maxBytes = exports.DEFAULT_MAX_TEXT_BYTES) {
+            const entry = entryFor(rel);
+            if (!allows(entry, 'text'))
+                return undefined;
+            const abs = (0, boundary_1.resolveRealPath)(rootDir, entry.path);
+            if (abs === null)
+                return undefined;
+            const cap = Math.min(Math.max(0, maxBytes), exports.MAX_TEXT_BYTES_CEILING);
+            const read = (0, safeRead_1.readFileNoFollow)(abs, cap);
+            return read?.text;
+        },
+        canReadImage(rel) {
+            return allows(entryFor(rel), 'image');
+        },
+    };
+}
+/** The last segment of a workspace-relative path. */
+function basename(rel) {
+    const slash = rel.lastIndexOf('/');
+    return slash === -1 ? rel : rel.slice(slash + 1);
+}
+//# sourceMappingURL=workspaceRead.js.map

package/dist/security/workspaceRead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceRead.js","sourceRoot":"","sources":["../../src/security/workspaceRead.ts"],"names":[],"mappings":";;;AA6DA,sDAsDC;AAlHD,kDAAkE;AAClE,uCAA4C;AAC5C,+CAAoD;AACpD,yCAA6C;AAE7C,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,qDAAqD;AACrD,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,iBAAiB;AACjB,EAAE;AACF,6EAA6E;AAC7E,sDAAsD;AACtD,2EAA2E;AAC3E,uBAAuB;AACvB,6EAA6E;AAC7E,+EAA+E;AAC/E,mBAAmB;AACnB,8EAA8E;AAC9E,8EAA8E;AAC9E,+CAA+C;AAC/C,oEAAoE;AACpE,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAC9B,8EAA8E;AAE9E,uDAAuD;AAC1C,QAAA,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEjD,+DAA+D;AAClD,QAAA,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAsBtD,SAAgB,qBAAqB,CAAC,OAA+B;IAAsB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACrH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAE9D,SAAS,QAAQ,CAAC,GAAW;QAC3B,MAAM,UAAU,GAAG,IAAA,mBAAY,EAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAC/D,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,MAAM,CAAC,KAA4B,EAAE,IAAsB;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,IAAA,uBAAY,EAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,KAAK,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAA,wBAAa,EAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,IAAA,0BAAe,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACvD,CAAC;IAED,OAAO;QACL,GAAG,CAAC,GAAG;YACL,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QACrC,CAAC;QAED,WAAW,CAAC,GAAG;YACb,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,8BAAsB;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAE7C,MAAM,GAAG,GAAG,IAAA,0BAAe,EAAC,OAAO,EAAE,KAAM,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,8BAAsB,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO,IAAI,EAAE,IAAI,CAAC;QACpB,CAAC;QAED,YAAY,CAAC,GAAG;YACd,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/semantics/load.d.ts

@@ -0,0 +1,11 @@
+import type { FrontmatterSemantics, LoadedSemantics } from './types';
+export declare const MANIFEST_DIR = ".a2h";
+export interface LoadOptions {
+    /** Workspace-relative paths of markdown files worth inspecting. */
+    markdownPaths?: string[];
+}
+export declare function loadSemantics(rootDir: string, options?: LoadOptions): LoadedSemantics;
+export declare function hasExplicitSemantics(loaded: LoadedSemantics): boolean;
+/** Recognised frontmatter keys, all prefixed to avoid clashing with prose. */
+export declare function readFrontmatterSemantics(absPath: string): FrontmatterSemantics | undefined;
+//# sourceMappingURL=load.d.ts.map

package/dist/semantics/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/semantics/load.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAEV,oBAAoB,EAGpB,eAAe,EAIhB,MAAM,SAAS,CAAC;AAsBjB,eAAO,MAAM,YAAY,SAAS,CAAC;AAUnC,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,eAAe,CAiDzF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAErE;AAuID,8EAA8E;AAC9E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAwC1F"}