@vyuhlabs/dxkit 2.5.2 → 2.6.0

package/dist/allowlist/diff.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * Allowlist delta — what changed between two repo states.
+ *
+ * The guardrail check posts a PR comment whenever new allowlist
+ * entries appear on the PR branch. Reviewers see the suppressions
+ * being introduced and can sanity-check the typed category / reason
+ * / expiry without manually grepping for `dxkit-allow:` lines.
+ *
+ * # Two-state comparison
+ *
+ * `computeAllowlistDelta` compares the current on-disk allowlist
+ * (loaded via the canonical `loadAllowlist`) against the allowlist
+ * at the baseline's commit SHA (read via `git show <sha>:.dxkit/...`).
+ * Each entry's identity is its `fingerprint`; the delta is the
+ * symmetric difference of the two fingerprint sets, hydrated back
+ * to the full entries on each side.
+ *
+ *   added   — entries present in current but not at the baseline SHA
+ *   removed — entries present at the baseline SHA but not in current
+ *
+ * # Graceful degradation
+ *
+ * When the baseline SHA isn't reachable (shallow clone, force-push
+ * orphaned base), the delta reports `baselineAccessible: false` and
+ * an empty `added` / `removed`. Callers (the renderer) treat that
+ * as "delta unavailable" rather than "no changes" — surfacing the
+ * incident so the customer can either deepen the clone or accept
+ * the missing review signal.
+ *
+ * Architectural posture:
+ *   - All IO goes through `loadAllowlist` (CLAUDE.md arch rule 1).
+ *   - `git show` is the only direct git interaction; failure modes
+ *     return null without throwing.
+ *   - Pure function over both inputs (current allowlist + git-resolved
+ *     baseline allowlist) — testable independently of git state.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeAllowlistDelta = computeAllowlistDelta;
+exports.diffEntries = diffEntries;
+const child_process_1 = require("child_process");
+const file_1 = require("./file");
+/**
+ * Compute the delta between the current on-disk allowlist and the
+ * allowlist at the baseline's commit SHA. Returns a structurally
+ * empty delta with `baselineAccessible: false` when the baseline
+ * SHA can't be read.
+ *
+ * `baselineCommitSha` must be a non-empty hex SHA; an empty string
+ * (the canonical "no commit" value baseline-create uses outside a
+ * git repo) yields `baselineAccessible: false` immediately.
+ */
+function computeAllowlistDelta(cwd, baselineCommitSha) {
+    const current = (0, file_1.loadAllowlist)(cwd);
+    const empty = { added: [], removed: [], baselineAccessible: false };
+    if (!baselineCommitSha)
+        return empty;
+    const baselineFile = readAllowlistAtSha(cwd, baselineCommitSha);
+    if (baselineFile === null) {
+        // git unreachable OR file genuinely didn't exist at the
+        // baseline SHA. We can still produce a useful delta in the
+        // "file didn't exist" case — every current entry is "added"
+        // (the customer adopted the allowlist after baseline-create).
+        // Distinguish the two cases by checking whether the SHA is at
+        // least resolvable.
+        if (!shaReachable(cwd, baselineCommitSha))
+            return empty;
+        // SHA reachable but file absent → current entries are all new.
+        return {
+            added: current?.entries ?? [],
+            removed: [],
+            baselineAccessible: true,
+        };
+    }
+    const currentEntries = current?.entries ?? [];
+    return diffEntries(baselineFile.entries, currentEntries);
+}
+/**
+ * Pure delta over two entry arrays. Exposed for testability —
+ * callers without git state can synthesize before/after fixtures
+ * directly. Uses fingerprint equality (the canonical identity
+ * predicate) for set diff.
+ */
+function diffEntries(prior, current) {
+    const priorByFp = new Map();
+    for (const e of prior)
+        priorByFp.set(e.fingerprint, e);
+    const currentByFp = new Map();
+    for (const e of current)
+        currentByFp.set(e.fingerprint, e);
+    const added = [];
+    for (const [fp, e] of currentByFp) {
+        if (!priorByFp.has(fp))
+            added.push(e);
+    }
+    const removed = [];
+    for (const [fp, e] of priorByFp) {
+        if (!currentByFp.has(fp))
+            removed.push(e);
+    }
+    return { added, removed, baselineAccessible: true };
+}
+// ─── Internals ────────────────────────────────────────────────────────────
+function readAllowlistAtSha(cwd, sha) {
+    const gitPath = `${file_1.ALLOWLIST_DIR}/${file_1.ALLOWLIST_FILENAME}`;
+    let raw;
+    try {
+        raw = (0, child_process_1.execFileSync)('git', ['show', `${sha}:${gitPath}`], {
+            cwd,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            encoding: 'utf8',
+        });
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // File existed at the SHA but isn't valid JSON. Treat the same
+        // as "absent" — no useful delta computable.
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    const obj = parsed;
+    if (obj.schemaVersion !== file_1.ALLOWLIST_SCHEMA_VERSION)
+        return null;
+    if (!Array.isArray(obj.entries))
+        return null;
+    return parsed;
+}
+function shaReachable(cwd, sha) {
+    try {
+        (0, child_process_1.execFileSync)('git', ['cat-file', '-e', sha], {
+            cwd,
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=diff.js.map

package/dist/allowlist/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/allowlist/diff.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;AAkCH,sDAyBC;AAQD,kCAkBC;AAnFD,iDAA6C;AAC7C,iCAOgB;AAchB;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,GAAW,EAAE,iBAAyB;IAC1E,MAAM,OAAO,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;IAEpF,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,wDAAwD;QACxD,2DAA2D;QAC3D,4DAA4D;QAC5D,8DAA8D;QAC9D,8DAA8D;QAC9D,oBAAoB;QACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,iBAAiB,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,+DAA+D;QAC/D,OAAO;YACL,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;YAC7B,OAAO,EAAE,EAAE;YACX,kBAAkB,EAAE,IAAI;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;IAC9C,OAAO,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CACzB,KAAoC,EACpC,OAAsC;IAEtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,6EAA6E;AAE7E,SAAS,kBAAkB,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,GAAG,oBAAa,IAAI,yBAAkB,EAAE,CAAC;IACzD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC,EAAE;YACvD,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,4CAA4C;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,GAAG,GAAG,MAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,aAAa,KAAK,+BAAwB;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,GAAW;IAC5C,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE;YAC3C,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/allowlist/file.d.ts

@@ -0,0 +1,249 @@
+/**
+ * On-disk allowlist file — `.dxkit/allowlist.json` + optional sidecar
+ * `.dxkit/allowlist-reasons.local.json`.
+ *
+ * The allowlist file is the durable contract for per-finding
+ * suppressions: customer has reviewed this fingerprint, categorized
+ * the reason, and accepts that the guardrail should let the finding
+ * pass on future runs.
+ *
+ * Identity is the 16-char hex fingerprint from
+ * `src/analyzers/tools/fingerprint.ts` (CLAUDE.md Rule 9). An entry
+ * matches a finding when their fingerprint strings are byte-equal.
+ *
+ * # Two modes, one schema
+ *
+ * The mode is recorded in `.dxkit/policy.json` (out of scope for this
+ * module — consumers pass it in via `AllowlistMode`). Both modes use
+ * the same `AllowlistFile` shape on disk; sanitized mode just drops
+ * the human-readable fields and pushes them to a sidecar:
+ *
+ *   `'full'` — every field present on the entry. Default for
+ *   private repos. The committed file carries the full audit trail.
+ *
+ *   `'sanitized'` — entries carry `fingerprint + kind + category +
+ *   addedAt + expiresAt + acknowledgedSeverity` only. The
+ *   `reason` + `addedBy` fields live in the gitignored sidecar
+ *   `.dxkit/allowlist-reasons.local.json`, keyed by fingerprint.
+ *   Default for public repos. Loaders merge the sidecar back when
+ *   present; readers tolerate its absence (no reason field, but
+ *   the suppression still applies because matching is by
+ *   fingerprint).
+ *
+ * # Validation surface
+ *
+ * `validateAllowlistFile` enforces every Sprint-0-locked rule:
+ *   - `reason` is required (full mode) / required in sidecar
+ *     (sanitized mode)
+ *   - `category` is one of the five canonical values
+ *   - `category` is valid for the entry's `kind`
+ *   - `requiresExpiry(category)` ⇒ `expiresAt` is present + parseable
+ *   - `acknowledgedSeverity` is required when `category` is
+ *     `accepted-risk` AND `severity` is `high`/`critical`
+ */
+import type { IdentityKind } from '../baseline/producers';
+import type { FindingSeverity } from '../baseline/types';
+import { type AllowlistCategory } from './categories';
+export declare const ALLOWLIST_SCHEMA_VERSION: "dxkit-allowlist/v1";
+export type AllowlistSchemaVersion = typeof ALLOWLIST_SCHEMA_VERSION;
+export declare const ALLOWLIST_REASONS_SCHEMA_VERSION: "dxkit-allowlist-reasons/v1";
+export type AllowlistReasonsSchemaVersion = typeof ALLOWLIST_REASONS_SCHEMA_VERSION;
+export declare const ALLOWLIST_DIR = ".dxkit";
+export declare const ALLOWLIST_FILENAME = "allowlist.json";
+export declare const ALLOWLIST_REASONS_FILENAME = "allowlist-reasons.local.json";
+/**
+ * Single source of truth for mode values. The `AllowlistMode` union
+ * is derived from this array via `(typeof ...)[number]`, so adding
+ * a new mode means appending one string here — the runtime checks
+ * below pick it up via `ALL_MODES.includes(...)` without any
+ * literal-value drift between type and runtime.
+ */
+export declare const ALL_MODES: readonly ["full", "sanitized"];
+export type AllowlistMode = (typeof ALL_MODES)[number];
+/**
+ * One allowlist entry. Two-shape contract:
+ *   - Full mode: every optional field may be present on disk.
+ *   - Sanitized mode on disk: `reason` + `addedBy` are absent; the
+ *     loader merges them in from the sidecar when present.
+ *
+ * The TypeScript type allows the union so a single in-memory shape
+ * serves both modes; the validator enforces shape invariants.
+ */
+export interface AllowlistEntry {
+    /** SHA-1[0:16] canonical fingerprint matching the target finding. */
+    readonly fingerprint: string;
+    /** Identity kind of the target finding (matches CLAUDE.md Rule 9
+     *  canonical kinds). */
+    readonly kind: IdentityKind;
+    /** Suppression category — one of the five Sprint-0-locked enum
+     *  values. */
+    readonly category: AllowlistCategory;
+    /** Human-readable rationale. Required in full mode; lives in
+     *  sidecar in sanitized mode. */
+    readonly reason?: string;
+    /** Who added the entry. Required in full mode; lives in sidecar
+     *  in sanitized mode. Free-form (typically email, git user, or
+     *  Slack handle). */
+    readonly addedBy?: string;
+    /** ISO `YYYY-MM-DD` of when the entry was added. */
+    readonly addedAt: string;
+    /** ISO `YYYY-MM-DD` after which the entry stops suppressing the
+     *  finding. Required for `accepted-risk` + `deferred` categories;
+     *  optional otherwise. */
+    readonly expiresAt?: string;
+    /** Severity at which the suppression was acknowledged. Required
+     *  when `category` is `accepted-risk` and the finding's severity
+     *  is `high` or `critical` — see `validateAllowlistEntry`. */
+    readonly acknowledgedSeverity?: FindingSeverity;
+}
+export interface AllowlistFile {
+    readonly schemaVersion: AllowlistSchemaVersion;
+    readonly mode: AllowlistMode;
+    readonly entries: ReadonlyArray<AllowlistEntry>;
+}
+/**
+ * The gitignored sidecar that carries the human-readable fields in
+ * sanitized mode. Sparse — only the fields that need to live
+ * outside the committed file appear. Loaders are lenient when the
+ * sidecar is absent (no entry merges; suppression still works by
+ * fingerprint).
+ */
+export interface AllowlistReasonsSidecar {
+    readonly schemaVersion: AllowlistReasonsSchemaVersion;
+    readonly reasons: Readonly<Record<string, {
+        readonly reason: string;
+        readonly addedBy: string;
+    }>>;
+}
+export interface ValidationError {
+    readonly fingerprint?: string;
+    readonly field: string;
+    readonly message: string;
+}
+export declare function pathForAllowlist(cwd: string): string;
+export declare function pathForAllowlistReasons(cwd: string): string;
+/**
+ * Create an empty allowlist file in the requested mode. Useful for
+ * the `vyuh-dxkit allowlist add` CLI path when no file exists yet.
+ */
+export declare function emptyAllowlistFile(mode?: AllowlistMode): AllowlistFile;
+/**
+ * Read the on-disk allowlist + (when present) merge the sidecar
+ * reasons. Returns `null` when the main file doesn't exist —
+ * callers treat that as "no allowlist configured."
+ *
+ * Throws on:
+ *   - Malformed JSON in either file
+ *   - Unrecognized `schemaVersion`
+ *   - Root is not an object
+ *
+ * The sidecar's absence is NOT an error: customers in sanitized
+ * mode may have a committed allowlist on disk without the sidecar
+ * cloned (CI checkout, fresh teammate clone). The fingerprint-only
+ * file is still functional as a suppression list.
+ */
+export declare function loadAllowlist(cwd: string): AllowlistFile | null;
+/**
+ * Load the gitignored reasons sidecar. Returns `null` when missing.
+ * Throws on malformed JSON or wrong schemaVersion.
+ */
+export declare function loadAllowlistReasons(cwd: string): AllowlistReasonsSidecar | null;
+/**
+ * Persist the allowlist to disk. Writes the sidecar separately in
+ * sanitized mode: the committed file gets the structural fields;
+ * the sidecar gets `reason` + `addedBy`.
+ *
+ * Validation runs before writing — invalid input throws and the
+ * file isn't touched. Use `validateAllowlistFile` directly when
+ * you want non-throwing error reporting.
+ */
+export declare function saveAllowlist(cwd: string, file: AllowlistFile): void;
+/** Find an entry by fingerprint. */
+export declare function findEntry(file: AllowlistFile, fingerprint: string): AllowlistEntry | undefined;
+/**
+ * Add an entry. Returns a NEW `AllowlistFile` (immutable update).
+ * Throws if `entry.fingerprint` already exists.
+ */
+export declare function addEntry(file: AllowlistFile, entry: AllowlistEntry): AllowlistFile;
+/**
+ * Remove an entry by fingerprint. Returns a NEW `AllowlistFile`.
+ * Silently no-ops when the fingerprint isn't present (CLI surfaces
+ * the "not found" case through a separate read step).
+ */
+export declare function removeEntry(file: AllowlistFile, fingerprint: string): AllowlistFile;
+/**
+ * Whether the allowlist suppresses a given finding. Pure
+ * fingerprint match. Expiry handling is layered on top by
+ * `isEntryActive` (kept separate so the guardrail can distinguish
+ * "matched but expired" from "no match").
+ */
+export declare function matchesFinding(file: AllowlistFile, fingerprint: string): boolean;
+/**
+ * Whether an entry is currently active (within its expiry window).
+ * Entries without `expiresAt` are always active. Entries past their
+ * expiry are inactive — guardrail treats the underlying finding as
+ * un-allowlisted and the next run flags the suppression as stale.
+ */
+export declare function isEntryActive(entry: AllowlistEntry, now?: Date): boolean;
+/**
+ * Days remaining until an entry expires, or `null` when it has no
+ * expiry. Negative values mean already expired by that many days.
+ */
+export declare function daysUntilExpiry(entry: AllowlistEntry, now?: Date): number | null;
+/** One entry in a soon-to-expire audit bucket, with the days
+ *  remaining so callers can render time-to-expiry context. */
+export interface SoonToExpire {
+    readonly entry: AllowlistEntry;
+    readonly daysRemaining: number;
+}
+/**
+ * Audit report partitioning the file's entries into the three
+ * actionable categories the `vyuh-dxkit allowlist audit` subcommand
+ * surfaces. Pure function — no I/O, no side effects.
+ *
+ * - `expired` — entries past their `expiresAt`. Prune candidates.
+ *   The underlying suppression no longer applies on the next
+ *   guardrail run.
+ * - `soonToExpire` — entries whose `expiresAt` is within
+ *   `soonToExpireDays` (default 14). Customer should review whether
+ *   the deferred work is still in plan and either fix the finding,
+ *   extend the expiry, or remove the entry.
+ * - `missingRationale` — entries with empty / whitespace-only
+ *   reason. In full mode this should never happen (validator
+ *   rejects); in sanitized mode it may occur when the sidecar is
+ *   missing or stale.
+ */
+export interface AuditReport {
+    readonly expired: ReadonlyArray<AllowlistEntry>;
+    readonly soonToExpire: ReadonlyArray<SoonToExpire>;
+    readonly missingRationale: ReadonlyArray<AllowlistEntry>;
+}
+export interface AuditOptions {
+    readonly now?: Date;
+    /** Window in days within which `expiresAt` is considered "soon."
+     *  Default 14 — chosen to match a typical sprint cadence. */
+    readonly soonToExpireDays?: number;
+}
+export declare function auditAllowlist(file: AllowlistFile, options?: AuditOptions): AuditReport;
+/**
+ * Remove expired entries from the file. Returns a new file (immutable)
+ * plus the list of removed entries so the CLI can render what changed.
+ * Pure function — no I/O.
+ */
+export declare function pruneExpired(file: AllowlistFile, now?: Date): {
+    kept: AllowlistFile;
+    removed: ReadonlyArray<AllowlistEntry>;
+};
+/**
+ * Validate every entry in the file against the canonical taxonomy
+ * + Sprint-0-locked rules. Pure function; returns an array of
+ * `ValidationError` rather than throwing so callers can render
+ * structured error messages.
+ */
+export declare function validateAllowlistFile(file: AllowlistFile): ReadonlyArray<ValidationError>;
+/**
+ * Validate a single entry. Exposed independently so the CLI's
+ * `allowlist add` can pre-flight before mutating the file.
+ */
+export declare function validateAllowlistEntry(entry: AllowlistEntry, mode: AllowlistMode): ReadonlyArray<ValidationError>;
+//# sourceMappingURL=file.d.ts.map

package/dist/allowlist/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/allowlist/file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAAG,OAAO,wBAAwB,CAAC;AAErE,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,MAAM,MAAM,6BAA6B,GAAG,OAAO,gCAAgC,CAAC;AAEpF,eAAO,MAAM,aAAa,WAAW,CAAC;AACtC,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,gCAAiC,CAAC;AACxD,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;4BACwB;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;kBACc;IACd,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;qCACiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;yBAEqB;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;8BAE0B;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;kEAE8D;IAC9D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,eAAe,CAAC;CACjD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CACxB,MAAM,CACc,MAAM,EACxB;QACE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CACF,CACF,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,aAAsB,GAAG,aAAa,CAE9E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAuC/D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CA2BhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAkCpE;AAED,oCAAoC;AACpC,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE9F;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,GAAG,aAAa,CAQlF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAEnF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAEhF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAIpF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,GAAG,IAAI,CAM5F;AAED;8DAC8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB;iEAC6D;IAC7D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,GAAE,YAAiB,GAAG,WAAW,CAuB3F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,aAAa,EACnB,GAAG,GAAE,IAAiB,GACrB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CAAE,CAWjE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAAC,eAAe,CAAC,CA4BzF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,aAAa,GAClB,aAAa,CAAC,eAAe,CAAC,CA6EhC"}