emdash 0.40.1 → 0.42.0

package/src/transfer/analyze/values.ts

@@ -4,6 +4,7 @@
  * values (column types, NOT NULL, Postgres int4 / float4).
  */
 
+import { isSafeUrlFieldWriteValue } from "../../utils/url.js";
 import { isTransferError } from "../errors.js";
 import { measureJsonDepth } from "../format/canonical.js";
 import { encodeColumn } from "../format/column-codec.js";
@@ -19,6 +20,21 @@ export type TargetDialect = "sqlite" | "postgres";
 export interface FieldInfo {
 	columnType: FieldColumnType;
 	required: boolean;
+	/** Values live as content references; the target has no column for them. */
+	storageless?: boolean;
+	type?: "url" | "repeater" | "blocks";
+	urlSubFields?: string[];
+}
+
+export interface BlockTypeInfo {
+	id: string;
+	currentVersion: number;
+}
+
+export interface UrlValueField {
+	slug: string;
+	type: "url" | "repeater";
+	urlSubFields?: string[];
 }
 
 const PROVIDER_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
@@ -164,6 +180,90 @@ function mismatch(field: string, message: string): ValueIssue {
 	return { code: "value_constraint_violation", message, property: "fields", field };
 }
 
+function urlMismatch(property: string, field: string): ValueIssue {
+	return {
+		code: "value_constraint_violation",
+		message: "URL field value is not safe to store",
+		property,
+		field,
+	};
+}
+
+function arrayValue(value: unknown): unknown[] | undefined {
+	if (Array.isArray(value)) return value;
+	if (typeof value !== "string") return undefined;
+	const parsed = parseEmbeddedJson(value);
+	return Array.isArray(parsed) ? parsed : undefined;
+}
+
+function unsafeUrlFields(value: unknown, fields: readonly UrlValueField[], path: string): string[] {
+	const issues: string[] = [];
+	if (!isPlainObject(value)) return issues;
+	for (const field of fields) {
+		const fieldPath = `${path}.${field.slug}`;
+		const fieldValue = value[field.slug];
+		if (field.type === "url") {
+			if (typeof fieldValue === "string" && !isSafeUrlFieldWriteValue(fieldValue)) {
+				issues.push(fieldPath);
+			}
+			continue;
+		}
+		for (const [index, row] of (arrayValue(fieldValue) ?? []).entries()) {
+			if (!isPlainObject(row)) continue;
+			for (const slug of field.urlSubFields ?? []) {
+				const nested = row[slug];
+				if (typeof nested === "string" && !isSafeUrlFieldWriteValue(nested)) {
+					issues.push(`${fieldPath}.${index}.${slug}`);
+				}
+			}
+		}
+	}
+	return issues;
+}
+
+export function checkContentUrlFields(
+	values: Record<string, unknown>,
+	fields: ReadonlyMap<string, FieldInfo>,
+	blockTypes: ReadonlyMap<string, BlockTypeInfo>,
+	blockVersions: ReadonlyMap<string, readonly UrlValueField[]>,
+	property: "fields" | "data",
+): ValueIssue[] {
+	const issues: ValueIssue[] = [];
+	for (const [slug, info] of fields) {
+		const value = values[slug];
+		if (info.type === "url") {
+			if (typeof value === "string" && !isSafeUrlFieldWriteValue(value)) {
+				issues.push(urlMismatch(property, slug));
+			}
+			continue;
+		}
+		if (info.type === "repeater") {
+			const descriptors: UrlValueField[] = [
+				{ slug, type: "repeater", urlSubFields: info.urlSubFields },
+			];
+			for (const path of unsafeUrlFields(values, descriptors, property)) {
+				issues.push(urlMismatch(property, path.slice(property.length + 1)));
+			}
+			continue;
+		}
+		if (info.type !== "blocks") continue;
+		for (const [index, block] of (arrayValue(value) ?? []).entries()) {
+			if (!isPlainObject(block) || typeof block._type !== "string") continue;
+			const type = blockTypes.get(block._type);
+			if (!type) continue;
+			const version =
+				typeof block._version === "number" && Number.isInteger(block._version)
+					? block._version
+					: type.currentVersion;
+			const descriptors = blockVersions.get(`${type.id}:${version}`) ?? [];
+			for (const path of unsafeUrlFields(block, descriptors, `${slug}.${index}`)) {
+				issues.push(urlMismatch(property, path));
+			}
+		}
+	}
+	return issues;
+}
+
 /**
  * Entry field values against the target column each field is stored in,
  * through the shared column codec: a value the codec cannot encode for the
@@ -176,14 +276,23 @@ export function checkEntryFields(
 	entry: EntryRecord,
 	fields: ReadonlyMap<string, FieldInfo>,
 	dialect: TargetDialect,
+	blockTypes: ReadonlyMap<string, BlockTypeInfo> = new Map(),
+	blockVersions: ReadonlyMap<string, readonly UrlValueField[]> = new Map(),
 ): ValueCheckResult {
-	const result: ValueCheckResult = { issues: [], float4Rounded: 0 };
+	const result: ValueCheckResult = {
+		issues: checkContentUrlFields(entry.fields, fields, blockTypes, blockVersions, "fields"),
+		float4Rounded: 0,
+	};
 	for (const [slug, value] of Object.entries(entry.fields)) {
 		const info = fields.get(slug);
 		if (!info) {
 			result.issues.push(mismatch(slug, "Entry has a value for a field its collection lacks"));
 			continue;
 		}
+		if (info.storageless) {
+			result.issues.push(mismatch(slug, "Entry has a value for a field that stores no column"));
+			continue;
+		}
 		try {
 			encodeColumn(dialect, codecForColumnType(info.columnType), value);
 		} catch (error) {
@@ -204,7 +313,12 @@ export function checkEntryFields(
 		}
 	}
 	for (const [slug, info] of fields) {
-		if (info.required && info.columnType !== "JSON" && !Object.hasOwn(entry.fields, slug)) {
+		if (
+			info.required &&
+			!info.storageless &&
+			info.columnType !== "JSON" &&
+			!Object.hasOwn(entry.fields, slug)
+		) {
 			result.issues.push(mismatch(slug, "Required field has no value"));
 		}
 	}

package/src/transfer/analyze/write-rules.ts

@@ -9,6 +9,7 @@ import { safeHref } from "../../api/schemas/menus.js";
 import { createRedirectBody } from "../../api/schemas/redirects.js";
 import { coerceFieldValue } from "../../database/repositories/byline.js";
 import { EmDashValidationError } from "../../database/repositories/types.js";
+import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isPattern, validateDestinationParams, validatePattern } from "../../redirects/patterns.js";
 import { isTerminalStatus } from "../../redirects/status.js";
 import { validateBlockFields } from "../../schema/block-type-contract.js";
@@ -60,6 +61,13 @@ function redirectIssues(record: RedirectRecord): ValueIssue[] {
 			if (properties.has(property)) issues.push(rejected(property, message));
 		}
 	}
+	if (
+		!isTerminalStatus(record.type) &&
+		!isSiteRelativeDestination(record.destination) &&
+		!issues.some((issue) => issue.property === "destination")
+	) {
+		issues.push(rejected("destination", REDIRECT_BODY_MESSAGES.destination));
+	}
 	const pattern = isPattern(record.source);
 	if (record.isPattern !== pattern) {
 		issues.push(rejected("isPattern", "Redirect pattern flag does not match its source"));

package/src/transfer/export/readers.ts

@@ -769,10 +769,7 @@ function configFor(kind: RecordKind): TableReaderConfig {
 					const references = "_emdash_content_references";
 					return sql<boolean>`EXISTS (
 						SELECT 1 FROM _emdash_relations AS __relation
-						WHERE (
-							__relation.translation_group = ${col(references, "relation_group")}
-							OR (__relation.translation_group IS NULL AND __relation.id = ${col(references, "relation_group")})
-						)
+						WHERE __relation.id = ${col(references, "relation_id")}
 						AND ${entryGroupExists(context, sql`__relation.parent_collection`, col(references, "parent_group"))}
 						AND ${entryGroupExists(context, sql`__relation.child_collection`, col(references, "child_group"))}
 					)`;
@@ -818,7 +815,7 @@ interface ContentCollection {
 	columns: Readonly<Record<string, ColumnSpec>>;
 }
 
-type FieldColumns = ReadonlyArray<{ slug: string; column_type: string }>;
+type FieldColumns = Parameters<typeof contentColumnSpecs>[0];
 
 class EntryReader implements KindReader<"entry"> {
 	readonly kind = "entry";
@@ -839,14 +836,21 @@ class EntryReader implements KindReader<"entry"> {
 				"_emdash_collections.slug as collection",
 				"_emdash_fields.slug as slug",
 				"_emdash_fields.column_type as column_type",
+				"_emdash_fields.type as type",
+				"_emdash_fields.validation as validation",
 			])
 			.execute()
 			.then((rows) => {
-				const fields = new Map<string, Array<{ slug: string; column_type: string }>>();
+				const fields = new Map<string, Array<FieldColumns[number]>>();
 				for (const row of rows) {
 					const list = fields.get(row.collection) ?? [];
-					if (row.slug !== null && row.column_type !== null) {
-						list.push({ slug: row.slug, column_type: row.column_type });
+					if (row.slug !== null && row.column_type !== null && row.type !== null) {
+						list.push({
+							slug: row.slug,
+							column_type: row.column_type,
+							type: row.type,
+							validation: row.validation,
+						});
 					}
 					fields.set(row.collection, list);
 				}

package/src/transfer/format/columns.ts

@@ -24,6 +24,7 @@ import type { Kysely } from "kysely";
 import { listTableColumns, type TableColumnInfo } from "../../database/dialect-helpers.js";
 import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
+import { isStoragelessFieldRow } from "../../schema/types.js";
 import { TransferError } from "../errors.js";
 import type { RecordKind } from "./kinds.js";
 
@@ -175,13 +176,15 @@ const PORTABLE_TABLE_LIST: PortableTableSpec[] = [
 		kind: "relation",
 		columns: {
 			id: f("id"),
-			name: f("name"),
+			slug: f("slug"),
 			parent_collection: f("parentCollection"),
 			child_collection: f("childCollection"),
 			parent_label: f("parentLabel"),
 			child_label: f("childLabel"),
-			locale: f("locale"),
-			translation_group: f("translationGroup"),
+			parent_label_singular: f("parentLabelSingular"),
+			child_label_singular: f("childLabelSingular"),
+			max_children_per_parent: f("maxChildrenPerParent", "integer"),
+			max_parents_per_child: f("maxParentsPerChild", "integer"),
 			created_at: f("createdAt"),
 			updated_at: f("updatedAt"),
 		},
@@ -335,7 +338,7 @@ const PORTABLE_TABLE_LIST: PortableTableSpec[] = [
 		kind: "content_reference",
 		columns: {
 			id: f("id"),
-			relation_group: f("relationGroup"),
+			relation_id: f("relationId"),
 			parent_group: f("parentGroup"),
 			child_group: f("childGroup"),
 			sort_order: f("sortOrder", "integer"),
@@ -623,7 +626,12 @@ export async function getColumnSpecs(
 	const fields = await db
 		.selectFrom("_emdash_fields")
 		.innerJoin("_emdash_collections", "_emdash_collections.id", "_emdash_fields.collection_id")
-		.select(["_emdash_fields.slug as slug", "_emdash_fields.column_type as column_type"])
+		.select([
+			"_emdash_fields.slug as slug",
+			"_emdash_fields.column_type as column_type",
+			"_emdash_fields.type as type",
+			"_emdash_fields.validation as validation",
+		])
 		.where("_emdash_collections.slug", "=", slug)
 		.execute();
 	return contentColumnSpecs(fields, await listTableColumns(db, table));
@@ -632,15 +640,27 @@ export async function getColumnSpecs(
 /**
  * Column classification of an `ec_*` table from its collection's registered
  * fields and the table's declared columns (see {@link getColumnSpecs}).
+ *
+ * A storage-less field's values are content references, not a column. A
+ * column left under its slug from before the field was bound is excluded.
  */
 export function contentColumnSpecs(
-	fields: ReadonlyArray<{ slug: string; column_type: string }>,
+	fields: ReadonlyArray<{
+		slug: string;
+		column_type: string;
+		type: string;
+		validation: string | null;
+	}>,
 	tableColumns: readonly TableColumnInfo[],
 ): Readonly<Record<string, ColumnSpec>> {
 	const declared = new Map(tableColumns.map((column) => [column.name, column.type.toLowerCase()]));
 	const columns: Record<string, ColumnSpec> = { ...CONTENT_TABLE_COLUMNS };
 	for (const field of fields) {
 		if (Object.hasOwn(columns, field.slug)) continue;
+		if (isStoragelessFieldRow(field)) {
+			columns[field.slug] = EXCLUDED;
+			continue;
+		}
 		let codec = codecForColumnType(field.column_type);
 		if (codec === "nativeJson" && !JSON_COLUMN_TYPES.has(declared.get(field.slug) ?? "")) {
 			codec = "json";

package/src/transfer/format/kinds.ts

@@ -234,13 +234,15 @@ export const taxonomyDefRecordSchema = z.strictObject({
 export const relationRecordSchema = z.strictObject({
 	kind: z.literal("relation"),
 	id: portableIdSchema,
-	name: shortString.min(1),
+	slug: shortString.min(1),
 	parentCollection: identifierSchema,
 	childCollection: identifierSchema,
 	parentLabel: shortString,
 	childLabel: shortString,
-	locale: localeSchema,
-	translationGroup: portableIdSchema,
+	parentLabelSingular: shortString.optional(),
+	childLabelSingular: shortString.optional(),
+	maxChildrenPerParent: integer.optional(),
+	maxParentsPerChild: integer.optional(),
 	createdAt: timestamp.optional(),
 	updatedAt: timestamp.optional(),
 });
@@ -394,7 +396,7 @@ export const contentBylineRecordSchema = z.strictObject({
 export const contentReferenceRecordSchema = z.strictObject({
 	kind: z.literal("content_reference"),
 	id: portableIdSchema,
-	relationGroup: portableIdSchema,
+	relationId: portableIdSchema,
 	parentGroup: portableIdSchema,
 	childGroup: portableIdSchema,
 	sortOrder: integer,
@@ -715,7 +717,7 @@ export const KIND_REFERENCES: Readonly<Record<RecordKind, readonly KindReference
 			{ property: "bylineGroup", targets: ["byline"], by: "group" },
 		],
 		content_reference: [
-			{ property: "relationGroup", targets: ["relation"], by: "group", soft: true },
+			{ property: "relationId", targets: ["relation"], by: "id", soft: true },
 			{ property: "parentGroup", targets: ["entry"], by: "group", soft: true },
 			{ property: "childGroup", targets: ["entry"], by: "group", soft: true },
 		],
@@ -763,6 +765,20 @@ export function blocksFieldTypeSlugs(record: FieldRecord): string[] {
 	return [...slugs];
 }
 
+/**
+ * The relation slug a bound `reference` field names in `validation.relation`.
+ * An unbound reference field keeps a column and names no relation.
+ */
+export function referenceFieldRelationSlugs(record: FieldRecord): string[] {
+	const validation = record.validation;
+	if (record.type !== "reference" || typeof validation !== "object" || validation === null) {
+		return [];
+	}
+	if (Array.isArray(validation)) return [];
+	const relation = validation.relation;
+	return typeof relation === "string" && relation.length > 0 ? [relation] : [];
+}
+
 /**
  * Key of a block type's version: a `block_type`'s `currentVersion` must name
  * the `block_type_version` record with the same key.

package/src/transfer/import/context.ts

@@ -6,6 +6,7 @@ import type { Kysely } from "kysely";
 
 import { isPostgres } from "../../database/dialect-helpers.js";
 import type { Database } from "../../database/types.js";
+import { isStoragelessFieldRow } from "../../schema/types.js";
 import type { Storage } from "../../storage/types.js";
 import { TransferError } from "../errors.js";
 import {
@@ -90,7 +91,10 @@ export class ImportContext {
 		return records;
 	}
 
-	/** Target column type of each field of a collection, from the imported schema. */
+	/**
+	 * Target column type of each field of a collection that has a column, from
+	 * the imported schema.
+	 */
 	async fieldColumns(collection: string): Promise<ReadonlyMap<string, FieldColumnType>> {
 		return (await this.fields(collection)).columns;
 	}
@@ -110,9 +114,12 @@ export class ImportContext {
 					"_emdash_fields.slug as slug",
 					"_emdash_fields.column_type as column_type",
 					"_emdash_fields.required as required",
+					"_emdash_fields.type as type",
+					"_emdash_fields.validation as validation",
 				])
 				.where("_emdash_collections.slug", "=", collection)
 				.execute()
+				.then((all) => all.filter((row) => !isStoragelessFieldRow(row)))
 				.then((rows) => ({
 					columns: new Map(
 						rows.map((row) => [row.slug, toFieldColumnType(row.column_type)] as const),

package/src/transfer/ops/package-index.ts

@@ -6,7 +6,7 @@
  * Conventions for what analysis stores:
  * - `group_id`: the record's `translationGroup`, or its `id` when it has none
  *   (what `by: "group"` references resolve against);
- * - `name_key`: the collection or block type `slug`, the menu `name`, or the
+ * - `name_key`: the collection, block type or relation `slug`, the menu `name`, or the
  *   block type version's `blockTypeVersionKey` (what `by: "slug"` and
  *   `by: "name"` references resolve against);
  * - `parent_id` and `depth` for topological kinds.

package/src/utils/url.ts

@@ -16,7 +16,26 @@
  * - Protocol-relative URLs are NOT allowed (starting with //) as they can
  *   redirect to attacker-controlled hosts.
  */
-const SAFE_URL_SCHEME_RE = /^(https?:|mailto:|tel:|\/(?!\/)|#)/i;
+const SAFE_ABSOLUTE_URL_RE = /^(https?:|mailto:|tel:)/i;
+const SITE_RELATIVE_HREF_RE = /^(\/(?![/\\])|#)/;
+const URL_SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
+const URL_BASE = new URL("https://emdash.invalid/");
+
+function containsHrefControl(value: string): boolean {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0);
+		if (codePoint !== undefined && (codePoint <= 0x1f || codePoint === 0x7f)) return true;
+	}
+	return false;
+}
+
+function resolvesOnSite(value: string): boolean {
+	try {
+		return new URL(value, URL_BASE).origin === URL_BASE.origin;
+	} catch {
+		return false;
+	}
+}
 
 /**
  * Returns the URL unchanged if it uses a safe scheme, otherwise returns "#".
@@ -37,12 +56,48 @@ const SAFE_URL_SCHEME_RE = /^(https?:|mailto:|tel:|\/(?!\/)|#)/i;
  */
 export function sanitizeHref(url: string | undefined | null): string {
 	if (!url) return "#";
-	return SAFE_URL_SCHEME_RE.test(url) ? url : "#";
+	return isSafeHref(url) ? url : "#";
 }
 
 /**
  * Returns true if the URL uses a safe scheme for rendering in href attributes.
  */
 export function isSafeHref(url: string): boolean {
-	return SAFE_URL_SCHEME_RE.test(url);
+	if (containsHrefControl(url)) return false;
+	if (SAFE_ABSOLUTE_URL_RE.test(url)) return URL.canParse(url);
+	return SITE_RELATIVE_HREF_RE.test(url) && resolvesOnSite(url);
+}
+
+const ALLOWED_URL_SCHEMES = new Set(["http", "https", "mailto", "tel"]);
+
+/**
+ * Returns true if the value names a URL scheme other than http, https,
+ * mailto, or tel, as a browser would resolve it in an href.
+ */
+export function hasUnsafeUrlScheme(value: string): boolean {
+	const stripped = value.replace(/[\t\n\r]/g, "").trimStart();
+	const scheme = URL_SCHEME_RE.exec(stripped)?.[1];
+	return scheme !== undefined && !ALLOWED_URL_SCHEMES.has(scheme.toLowerCase());
+}
+
+/**
+ * Returns true when a repository write may keep the value. Repository callers
+ * preserve legacy scheme-less values, but reject anything a browser resolves
+ * off-site or to a script-capable scheme.
+ */
+export function isSafeUrlFieldWriteValue(value: string): boolean {
+	if (containsHrefControl(value) || hasUnsafeUrlScheme(value)) return false;
+	const candidate = value.trimStart();
+	const scheme = URL_SCHEME_RE.exec(candidate)?.[1];
+	if (scheme !== undefined) return ALLOWED_URL_SCHEMES.has(scheme.toLowerCase());
+	return resolvesOnSite(candidate);
+}
+
+/**
+ * Returns true if the value may be stored in a `url` content field: a safe
+ * href per {@link isSafeHref} that is either site-relative or a parseable
+ * absolute URL.
+ */
+export function isSafeUrlFieldValue(value: string): boolean {
+	return isSafeHref(value);
 }

package/src/virtual-modules.d.ts

@@ -22,6 +22,9 @@ declare module "virtual:emdash/config" {
 		authProviders?: AuthProviderDescriptor[];
 		i18n?: I18nConfig | null;
 		toolbar?: "server" | "client" | false;
+		/** Whether an object-cache adapter was configured at build time. */
+		objectCacheEnabled?: boolean;
+		updateCheck?: boolean | { minimumReleaseAge?: string | number };
 		/** Public origin from astro.config.mjs, origin-normalized at startup. */
 		siteUrl?: string;
 		astroCspEnabled?: boolean;

package/dist/action-token-DYwe4Pk0.mjs

@@ -1,26 +0,0 @@
-import { r as verifyPreviewToken, t as generatePreviewToken } from "./tokens-u78jETkX.mjs";
-
-//#region src/visual-editing/action-token.ts
-const VISUAL_ACTION_SECRET_DOMAIN = "emdash:visual-editing-action:v1:";
-const VISUAL_ACTION_TOKEN_INVALID = "VISUAL_ACTION_TOKEN_INVALID";
-function visualActionSecret(previewSecret) {
-	return `${VISUAL_ACTION_SECRET_DOMAIN}${previewSecret}`;
-}
-function generateVisualEditingActionToken(previewSecret, userId) {
-	return generatePreviewToken({
-		contentId: `visual-editing:${userId}`,
-		expiresIn: "5m",
-		secret: visualActionSecret(previewSecret)
-	});
-}
-async function verifyVisualEditingActionToken(token, previewSecret, userId) {
-	const verification = await verifyPreviewToken({
-		token,
-		secret: visualActionSecret(previewSecret)
-	});
-	return verification.valid && verification.payload.cid === `visual-editing:${userId}`;
-}
-
-//#endregion
-export { generateVisualEditingActionToken as n, verifyVisualEditingActionToken as r, VISUAL_ACTION_TOKEN_INVALID as t };
-//# sourceMappingURL=action-token-DYwe4Pk0.mjs.map

package/dist/action-token-DYwe4Pk0.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"action-token-DYwe4Pk0.mjs","names":[],"sources":["../src/visual-editing/action-token.ts"],"sourcesContent":["import { generatePreviewToken, verifyPreviewToken } from \"../preview/tokens.js\";\n\nconst VISUAL_ACTION_SECRET_DOMAIN = \"emdash:visual-editing-action:v1:\";\nexport const VISUAL_ACTION_TOKEN_INVALID = \"VISUAL_ACTION_TOKEN_INVALID\";\n\nfunction visualActionSecret(previewSecret: string): string {\n\treturn `${VISUAL_ACTION_SECRET_DOMAIN}${previewSecret}`;\n}\n\nexport function generateVisualEditingActionToken(\n\tpreviewSecret: string,\n\tuserId: string,\n): Promise<string> {\n\treturn generatePreviewToken({\n\t\tcontentId: `visual-editing:${userId}`,\n\t\texpiresIn: \"5m\",\n\t\tsecret: visualActionSecret(previewSecret),\n\t});\n}\n\nexport async function verifyVisualEditingActionToken(\n\ttoken: string,\n\tpreviewSecret: string,\n\tuserId: string,\n): Promise<boolean> {\n\tconst verification = await verifyPreviewToken({\n\t\ttoken,\n\t\tsecret: visualActionSecret(previewSecret),\n\t});\n\treturn verification.valid && verification.payload.cid === `visual-editing:${userId}`;\n}\n"],"mappings":";;;AAEA,MAAM,8BAA8B;AACpC,MAAa,8BAA8B;AAE3C,SAAS,mBAAmB,eAA+B;AAC1D,QAAO,GAAG,8BAA8B;;AAGzC,SAAgB,iCACf,eACA,QACkB;AAClB,QAAO,qBAAqB;EAC3B,WAAW,kBAAkB;EAC7B,WAAW;EACX,QAAQ,mBAAmB,cAAc;EACzC,CAAC;;AAGH,eAAsB,+BACrB,OACA,eACA,QACmB;CACnB,MAAM,eAAe,MAAM,mBAAmB;EAC7C;EACA,QAAQ,mBAAmB,cAAc;EACzC,CAAC;AACF,QAAO,aAAa,SAAS,aAAa,QAAQ,QAAQ,kBAAkB"}