@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts

@@ -1,8 +1,8 @@
 /**
  * How an APPLICATION supplies a frontend provider's public configuration — the
  * keys a picker needs that only the application can know (a Drive `appId`, a
- * OneDrive `clientId`) — and the two guards that keep that channel from
- * carrying anything else.
+ * OneDrive `clientId`) — and the gates that keep that channel from carrying
+ * anything else.
  *
  * ## The gap this closes
  *
@@ -17,29 +17,63 @@
  * `providerConfigurations[providerRef][frontend_sdk]`. One authority for
  * "what an application configured for this provider", read by both sides.
  *
- * ## Two guards, because `publicConfig` is served to every browser
+ * ## The gates, because `publicConfig` is served to every browser
  *
  * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads
  *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which
- *    is what makes those keys READABLE without running the schema). A key the
- *    module never declared is refused with the provider and key named, at the
- *    two places the overlay runs: `wildo config sync` and the backend's
- *    fallback projection. A misspelled `apiId` therefore fails where it was
- *    typed, instead of silently contributing nothing and leaving a picker that
- *    reports "no appId" at the moment a user opens it.
- *
- * 2. **A secret never crosses.** A frontend provider owns no secrets by
- *    construction (`secretsContractShape: []`), so the only way one reaches a
- *    browser is an author typing the BACKEND module's secret into the frontend
- *    bag. The overlay refuses any key whose name matches a slug or an
- *    environment-variable name from the same vendor's backend secrets
- *    contract — `GOOGLE_OAUTH2_CLIENT_SECRET` cannot be typed into the bag that
- *    every visitor downloads.
- *
- * Both guards are decisions about NAMES, so they run wherever the names are
- * known and need no schema execution. Value VALIDATION (is `appId` a string?)
- * is the schema's job and runs where the schema is: at hydration (FE-8) and, on
- * the backend fallback, before serving.
+ *    is what makes those keys READABLE without running the schema), and a
+ *    module with no readable list is refused outright. Every key an entry would
+ *    serve — authored by the module, mapped onto its contribution, or supplied
+ *    by the application — is held to that list wherever an entry is PRODUCED
+ *    (`wildo config sync`, the backend's fallback projection) and again wherever
+ *    a ready-made one is READ and served (the backend's `/application-config`,
+ *    the website and documentation build loader). A misspelled `apiId` therefore
+ *    fails where it was typed, instead of silently contributing nothing and
+ *    leaving a picker that reports "no appId" at the moment a user opens it.
+ *
+ * 2. **A secret VALUE never crosses.** Every served string is compared against
+ *    the producer's secret values — the environment's whole `secrets.json` at
+ *    sync, the registered providers' confidential slots on the backend — and a
+ *    match refuses, whatever the key is called (#1705).
+ *
+ * 3. **A secret NAME is refused early.** A key spelled like a slug or an
+ *    environment-variable name from the same vendor's backend secrets contract
+ *    (`GOOGLE_OAUTH2_CLIENT_SECRET`) is refused with that explanation before the
+ *    key-list check would call it merely undeclared. It is the clearer message,
+ *    not the gate: a browser-only vendor has no backend names to match.
+ *
+ * Value VALIDATION (is `appId` a string?) is the schema's job and runs where the
+ * schema is: at hydration (FE-8) and, on the backend fallback, before serving.
+ *
+ * ## Why names were never enough, and what closes it (#1705)
+ *
+ * The name gate draws its forbidden names from the same vendor's BACKEND contract, so a
+ * browser-only vendor (reCAPTCHA, Algolia) had an EMPTY forbidden set: its secret
+ * key under `siteKey`, or an Algolia admin key under `apiKey`, passed every name
+ * check. And the declared-key gate switched itself off for a module with no introspectable
+ * schema — 8 of the 13 engine modules — admitting any key at all. A guard that
+ * matches how a key is SPELLED looks like a control and decides almost nothing.
+ *
+ * Three changes turn it into one:
+ *
+ * - **A schema is mandatory.** `declaredKeys: undefined` is now a refusal
+ *   (`SCHEMA_NOT_INTROSPECTABLE`) rather than "cannot enforce here", and the key check
+ *   runs over the WHOLE served bag — the module's authored keys and any key an
+ *   application mapped onto its contribution — not only over what
+ *   `providerConfigurations` supplied.
+ * - **Values are compared, not shapes.** {@link assertNoSecretValueInFrontendProviders}
+ *   compares every string in every served `publicConfig` against the secret
+ *   VALUES the producer holds: `wildo config sync` against the environment's
+ *   `secrets.json`, the backend against its providers' confidential slots. It
+ *   asks "is this one of OUR secrets", which no name or shape rule can answer,
+ *   and it names the key and the slot, never the value. Gitleaks answers the
+ *   other question ("does this look like a secret") on committed files; the two
+ *   do not overlap.
+ * - **What is secret comes from a declaration.** A provider secret slot is
+ *   confidential unless its contract marks it `holdsBrowserPublicValue` (a
+ *   vendor key designed to ship to browsers, such as PostHog's project key) or
+ *   `holdsDeploymentHost`; framework-managed material is confidential by its
+ *   registry's `secretKeys`. Nothing is inferred from a key's name.
  *
  * ## Why the overlay is a pure function in this package
  *
@@ -67,6 +101,7 @@
  * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.
  */
 export declare const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string;
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
 /** Why an application-supplied public-config bag was refused. */
 export declare enum FrontendProviderPublicConfigRefusal {
     /** A key the provider module does not declare — almost always a misspelling. */
@@ -74,8 +109,20 @@ export declare enum FrontendProviderPublicConfigRefusal {
     /** A key naming a secret from the same vendor's backend contract. Never negotiable. */
     SECRET_KEY = "SECRET_KEY",
     /** The supplied bag is not a plain object — a string, an array, `null`. */
-    NOT_AN_OBJECT = "NOT_AN_OBJECT"
+    NOT_AN_OBJECT = "NOT_AN_OBJECT",
+    /**
+     * The module declares no `publicConfigSchema` whose keys can be read without running it
+     * (#1705). Nothing can then say which keys it takes, so nothing it is handed can be held to a
+     * list — and "admit everything" is the answer that reaches a browser.
+     */
+    SCHEMA_NOT_INTROSPECTABLE = "SCHEMA_NOT_INTROSPECTABLE",
+    /**
+     * A served value equals, or contains, one of the producer's SECRET VALUES (#1705) — whatever the
+     * key is called and whichever vendor the secret belongs to. Never negotiable.
+     */
+    SECRET_VALUE = "SECRET_VALUE"
 }
+/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */
 export declare class FrontendProviderPublicConfigError extends Error {
     readonly providerRef: string;
     readonly refusal: FrontendProviderPublicConfigRefusal;
@@ -84,15 +131,16 @@ export declare class FrontendProviderPublicConfigError extends Error {
 }
 export interface OverlayFrontendProviderPublicConfigInput {
     readonly providerRef: string;
-    /** What the provider module authored — its own defaults, e.g. `{ authProviderRef: 'google' }`. */
+    /** What the provider module authored — its own defaults, e.g. `{ integrationKind: 'captcha' }`. */
     readonly authored: Readonly<Record<string, unknown>> | undefined;
     /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */
     readonly supplied: unknown;
     /**
      * The keys the provider module declares it reads. `undefined` means the
-     * module declared no introspectable schema, so guard 1 cannot run HERE and
-     * hydration's validation is the gate; an empty array means the module
-     * declares it reads NOTHING, so every supplied key is refused.
+     * module declared no introspectable schema, and is REFUSED
+     * (`SCHEMA_NOT_INTROSPECTABLE`, #1705): it used to mean "cannot enforce here",
+     * which admitted any key for 8 of the 13 engine modules. An empty array means
+     * the module declares it reads NOTHING, so every key is refused.
      */
     readonly declaredKeys: readonly string[] | undefined;
     /** Slugs and environment-variable names of the same vendor's backend secrets. */
@@ -100,14 +148,106 @@ export interface OverlayFrontendProviderPublicConfigInput {
 }
 /**
  * Merges what the application supplied over what the module authored, refusing
- * the two classes of key that must never reach a browser.
+ * the classes of key that must never reach a browser.
  *
  * Supplied values WIN over authored ones for the same key: the module's value is
  * a default, and an application that names a key means it. Absent `supplied`
- * returns the authored bag untouched — an application that configured nothing
- * is the ordinary case, not a refusal.
+ * returns the authored bag unchanged — an application that configured nothing
+ * is the ordinary case, not a refusal — but it is still HELD to the declared
+ * keys: `authored` is what the served entry carries, which includes any key an
+ * application mapped onto the contribution in its own `provider-contributions`.
+ *
+ * Call it for EVERY entry a producer serves, supplied or not; a producer that
+ * skips it when nothing was supplied skips the schema and key checks too.
  */
 export declare function overlayFrontendProviderPublicConfig(input: OverlayFrontendProviderPublicConfigInput): Readonly<Record<string, unknown>> | undefined;
+/**
+ * One secret value a producer holds, with WHERE it lives.
+ *
+ * `slot` is what a refusal names — `secrets.json → providerEnv.STRIPE_SECRET_KEY`, or the
+ * provider slot on the backend — so an operator can find it. The value itself is never printed.
+ */
+export interface FrontendPublicConfigSecretValue {
+    readonly slot: string;
+    readonly value: string;
+}
+/** One served public value found to be (or to contain) a secret. Names, never the value. */
+export interface FrontendPublicConfigSecretMatch {
+    readonly providerRef: string;
+    /** Path inside that provider's `publicConfig`, e.g. `apiKey` or `origins[1]`. */
+    readonly key: string;
+    readonly slot: string;
+}
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
+/**
+ * The shortest secret a served value is searched INSIDE, not only compared to.
+ *
+ * Containment catches a secret embedded in a larger public value — a URL carrying
+ * `?key=<secret>`, a `https://user:<secret>@host` endpoint — which exact equality would miss.
+ * Below this length a secret (a six-character default password, a short database name held in a
+ * credential slot) could occur by coincidence inside an ordinary public value such as a host name,
+ * and refusing a correct configuration on that coincidence would teach operators to route around
+ * the check. Shorter secrets are still compared EXACTLY.
+ */
+export declare const FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH = 16;
+/**
+ * Every place a served `publicConfig` carries one of the producer's secret values (#1705).
+ *
+ * Pure, and total over the strings it is given: every string leaf of every provider's bag —
+ * nested objects and arrays included — against every non-blank secret. A match is EXACT equality
+ * (after trimming both sides), or CONTAINMENT for a secret at least
+ * {@link FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH} long.
+ *
+ * Deliberately blind to key names and to which vendor a secret belongs: the defect it closes is a
+ * secret under an innocent key, or one vendor's secret served under another vendor's ref.
+ *
+ * What it does NOT see: an ENCODED secret (URL- or base64-encoded, split across keys, hashed). It
+ * asks "is this one of our values", verbatim; recognising transformed forms would need a guess at
+ * every encoding an author might apply, and each guess would be a new false-positive source. The
+ * committed-file scanner (gitleaks) and review are the backstops for that.
+ */
+export declare function findSecretValuesInFrontendProviders(providers: Readonly<Record<string, {
+    readonly publicConfig?: Readonly<Record<string, unknown>>;
+}>>, secrets: readonly FrontendPublicConfigSecretValue[]): FrontendPublicConfigSecretMatch[];
+/**
+ * Refuses to serve a set of frontend providers when any served value is one of the producer's
+ * secrets (#1705). Called by BOTH producers of a served bootstrap — `wildo config sync` before it
+ * writes any artifact, and the backend before it answers `/application-config` — so the two cannot
+ * disagree about what may reach a browser.
+ *
+ * `producer` names who is refusing and where its secrets came from, for the message.
+ */
+export declare function assertNoSecretValueInFrontendProviders(input: {
+    readonly producer: string;
+    readonly providers: Readonly<Record<string, {
+        readonly publicConfig?: Readonly<Record<string, unknown>>;
+    }>>;
+    readonly secrets: readonly FrontendPublicConfigSecretValue[];
+}): void;
+/**
+ * Refuses a READY-MADE block of frontend providers whose entries do not carry their key list, or
+ * serve a key outside it (#1705).
+ *
+ * The overlay holds an entry to its declared keys at the moment it is PRODUCED. A block that is only
+ * READ — the generated bootstrap the backend serves on `/application-config`, the frontend-services
+ * artifact the website and documentation builds bake into their pages — was produced earlier, by
+ * whichever `wildo config sync` wrote it. One written before a schema was mandatory carries entries
+ * with no `publicConfigKeys` and was never held to any list, and nothing downstream would notice: the
+ * reader parses the entry (the field stays optional on the wire precisely so it CAN be read and
+ * refused with a message) and serves it. So every site that serves a ready-made block asks the same
+ * question the producer asked, through the same function, and a stale artifact is refused with the
+ * remedy — regenerate it — instead of being served.
+ *
+ * `producer` names who is refusing and what it read, for the message.
+ */
+export declare function assertFrontendProvidersServeOnlyDeclaredKeys(input: {
+    readonly producer: string;
+    readonly providers: Readonly<Record<string, {
+        readonly publicConfig?: Readonly<Record<string, unknown>>;
+        readonly publicConfigKeys?: readonly string[];
+    }>>;
+}): void;
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
 /**
  * The value kinds a public-config key may declare. Scalars only, on purpose: a
  * public key is an identifier or a flag, and a structured value here is a
@@ -126,6 +266,7 @@ export interface FrontendPublicConfigKeySpec {
     /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */
     readonly description?: string;
 }
+/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */
 /** A Standard Schema v1 validator that ALSO says which keys it declares. */
 export interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {
     readonly '~standard': {
@@ -176,9 +317,10 @@ export declare function defineFrontendPublicConfigSchema(keys: Readonly<Record<s
  * Two shapes are recognised, and the order matters: a schema built by
  * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object
  * exposes them as `shape`. Anything else — a hand-written Standard Schema, a
- * library without introspection — yields `undefined`, which the overlay reads
- * as "cannot enforce here" rather than as "declares nothing". That distinction
- * is load-bearing: an empty list refuses EVERY supplied key.
+ * library without introspection — yields `undefined`, which every gate REFUSES
+ * (`SCHEMA_NOT_INTROSPECTABLE`, #1705) rather than reading as "declares nothing".
+ * That distinction is load-bearing: an empty list is a readable answer and
+ * refuses EVERY key, while `undefined` means no key list exists at all.
  */
 export declare function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined;
 //# sourceMappingURL=frontend-provider-public-config.shared.d.ts.map

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mCAAmC,EAAE,MAAuB,CAAC;AAE1E,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;CAChC;AAED,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAiD/C;AAED;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}
+{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mCAAmC,EAAE,MAAuB,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,YAAY,iBAAiB;CAC9B;AACD,kFAAkF;AAElF,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAqE/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,4FAA4F;AAC5F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gIAAgI;AAChI;;;;;;;;;GASG;AACH,eAAO,MAAM,oDAAoD,KAAK,CAAC;AAiCvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,EAClG,OAAO,EAAE,SAAS,+BAA+B,EAAE,GAClD,+BAA+B,EAAE,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5G,QAAQ,CAAC,OAAO,EAAE,SAAS,+BAA+B,EAAE,CAAC;CAC9D,GAAG,IAAI,CAcP;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/C,CAAC,CAAC,CAAC;CACL,GAAG,IAAI,CAsBP;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AACD,kFAAkF;AAElF,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}