primitive-admin 1.1.0-alpha.4 → 1.1.0-alpha.41

package/dist/src/lib/workflow-toml-validator.js

@@ -0,0 +1,323 @@
+/**
+ * Push-time validator for workflow TOML files (issue #685, #998).
+ *
+ * Detects the common footgun where a user writes `[steps.<id>.<field>]` under
+ * an open `[[steps]]` array. TOML parses that as a sub-table on the
+ * most-recent step keyed by the step's id (e.g. `steps[0]["refresh-each"]`),
+ * not as the intended `steps[0].request`. The result is a step with an
+ * unrecognized top-level field — the runtime silently ignores it, and the
+ * step then runs with an empty `request` block.
+ *
+ * The validator walks every step in `tomlData.steps[]`. For a step whose
+ * `kind` the CLI KNOWS about, it reports any top-level field not in the
+ * generated allowlist. For an UNKNOWN kind (an old CLI run against a newer
+ * server that registered a step kind the CLI doesn't have), it SKIPS the
+ * per-field allowlist check — but still runs the kind-agnostic
+ * misnested-header footgun detector. This is the #998 fix: the recurring
+ * "newer server kind → false-reject of valid fields" failure (#685/#802/#971
+ * were all false rejections) becomes "unvalidated, not rejected."
+ *
+ * ── Source of truth (#998) ───────────────────────────────────────────────
+ * The allowlist field union and the known-kind set are GENERATED from the
+ * server step runners (`src/workflows/steps/*.ts`) and the universal
+ * `BaseStepDefinition` shape into the committed
+ * `cli/src/lib/generated-allowlist.ts` artifact (the CLI does NOT import
+ * server `src/` at runtime — only the build-time generator does). The union is
+ * derived from what each runner READS, not what the `*StepDefinition` TYPE
+ * declares — types over-declare and would weaken the footgun detector. A CI
+ * freshness guard (`gen-allowlist.mjs --check`, also asserted by the #985
+ * drift-guard test) keeps the committed artifact in sync with the runners, so
+ * the hand-edit drift class (#685/#802/#971) cannot recur for the same-version
+ * case. Regenerate with `node cli/scripts/gen-allowlist.mjs`.
+ */
+import { GENERATED_ALLOWLISTED_FIELDS, GENERATED_KNOWN_KINDS, } from "./generated-allowlist.js";
+/**
+ * Universal-and-consumed allowlist of top-level fields permitted on a step
+ * (known kinds). Generated from the runners; see header.
+ */
+const ALLOWLISTED_FIELDS = new Set(GENERATED_ALLOWLISTED_FIELDS);
+/**
+ * The set of step kinds the CLI knows about (the server's registered kinds at
+ * generation time). A step whose `kind` is NOT in this set has its per-field
+ * allowlist check skipped — the kind-agnostic footgun detector still runs.
+ */
+const KNOWN_KINDS = new Set(GENERATED_KNOWN_KINDS);
+/**
+ * Read-only view of `ALLOWLISTED_FIELDS` for the drift-guard test (#985).
+ *
+ * Exported so `cli/tests/unit/workflow-toml-validator-drift-guard.test.ts` can
+ * assert this set stays a superset of every top-level field the step runners
+ * in `src/workflows/steps/*.ts` actually read — checking the *live* set the
+ * validator enforces rather than a copy that could itself drift. Not part of
+ * the public validator API; consumed only by the guard.
+ */
+export const ALLOWLISTED_FIELDS_FOR_DRIFT_GUARD = ALLOWLISTED_FIELDS;
+/**
+ * Read-only view of `KNOWN_KINDS` for the drift-guard test (#998). Lets the
+ * guard assert the generated known-kind set matches a fresh scan.
+ */
+export const KNOWN_KINDS_FOR_DRIFT_GUARD = KNOWN_KINDS;
+/**
+ * Walk a parsed workflow TOML document and return all unknown-field errors.
+ *
+ * @param tomlData The output of `TOML.parse()` for a workflow TOML file.
+ * @returns An array of error objects, one per offending field. Empty if no
+ *   errors were found.
+ */
+export function validateWorkflowToml(tomlData) {
+    const errors = [];
+    if (tomlData === null || tomlData === undefined) {
+        return errors;
+    }
+    const steps = tomlData.steps;
+    // No steps section at all → nothing to validate. This is fine for
+    // partial TOML files (some commands accept a metadata-only file).
+    if (steps === undefined || steps === null) {
+        return errors;
+    }
+    // `steps` is a table instead of an array. This typically means the user
+    // wrote `[steps.foo]` with no preceding `[[steps]]` array marker, so
+    // TOML resolved `steps` to a table. The runtime expects an array — flag
+    // it with a clear shape diagnostic.
+    if (!Array.isArray(steps)) {
+        if (typeof steps === "object") {
+            errors.push({
+                stepIndex: -1,
+                stepId: null,
+                field: "__steps_shape__",
+                hint: 'The `steps` section is a table, not an array. Workflow TOML expects `[[steps]]` array markers — add `[[steps]]` before any `[steps.<field>]` blocks.',
+            });
+        }
+        else {
+            errors.push({
+                stepIndex: -1,
+                stepId: null,
+                field: "__steps_shape__",
+                hint: `The \`steps\` section must be an array of step tables (received: ${typeof steps}).`,
+            });
+        }
+        return errors;
+    }
+    for (let i = 0; i < steps.length; i++) {
+        const step = steps[i];
+        // Defensive: array entry isn't an object. Should be near-impossible with
+        // valid `[[steps]]` syntax, but possible if the user writes `steps =
+        // ["a", "b"]`. Surface it so the user gets a diagnostic instead of a
+        // silent skip.
+        if (step === null || typeof step !== "object" || Array.isArray(step)) {
+            errors.push({
+                stepIndex: i,
+                stepId: null,
+                field: "__step_shape__",
+                hint: `Each entry in \`steps[]\` must be a table. Got: ${step === null ? "null" : Array.isArray(step) ? "array" : typeof step}.`,
+            });
+            continue;
+        }
+        validateStepObject(step, i, /* parentStepId */ null, errors);
+        // Codex finding 2 (PR #762, 2026-05-15): a `collect` step's nested
+        // `step` field is itself a step definition that the collect runner
+        // executes. The outer-step allowlist accepts `step` as a top-level
+        // field, but that's a structural pass-through — we need to recurse
+        // into the inner step's keys to catch the same misnested-header
+        // footgun (e.g. `[steps.step.call.request]` parses as `step.step =
+        // { call: { request: {...} } }`, with `call` as an unknown inner
+        // field; without the recursion this slips through). We only recurse
+        // for `kind === "collect"` — other kinds with a `step`-named field
+        // (none today) would need their own audit.
+        if (step.kind === "collect" &&
+            step.step !== null &&
+            typeof step.step === "object" &&
+            !Array.isArray(step.step)) {
+            const outerStepId = typeof step.id === "string" ? step.id : null;
+            validateStepObject(step.step, i, outerStepId, errors);
+        }
+    }
+    return errors;
+}
+/**
+ * Validate a single step object's top-level keys against the allowlist and
+ * push any errors found onto `errors`. Used for both the top-level
+ * `steps[]` walk and the recursive `collect.step` walk.
+ *
+ * When `parentStepId` is set, the step being validated is the inner step
+ * of a `collect`. Errors carry the outer-step context so the rendered
+ * diagnostic can point operators at the right slot in the TOML.
+ */
+function validateStepObject(step, stepIndex, parentStepId, errors) {
+    const stepId = typeof step.id === "string" ? step.id : null;
+    // #998: kind-membership branch. The CLI ships independently and may run
+    // against a NEWER server that registered a step kind the CLI's generated
+    // known-kind set doesn't have. For such an UNKNOWN kind we skip the
+    // per-field allowlist check (so a valid new-kind field is never falsely
+    // rejected — the recurring #685/#802/#971 failure) while STILL running the
+    // kind-agnostic misnested-header footgun detector below. For a KNOWN kind
+    // the full allowlist check applies as before. A missing/non-string `kind`
+    // is treated as known so the legacy strict check still catches obviously
+    // malformed steps (the runtime would reject a kindless step anyway).
+    const kind = typeof step.kind === "string" ? step.kind : null;
+    const isKnownKind = kind === null || KNOWN_KINDS.has(kind);
+    for (const key of Object.keys(step)) {
+        const value = step[key];
+        // Codex finding 1 (PR #762, 2026-05-15): self-id misnesting must be
+        // checked BEFORE the allowlist skip. When the step's `id` happens to
+        // match an allowlisted field name (e.g. `id = "query"`,
+        // `id = "request"`, `id = "input"`, `id = "output"`), TOML's
+        // `[steps.<id>.<sub-field>]` misnest produces a sub-table on the step
+        // keyed by the id — the same shape the validator was meant to catch.
+        // The allowlist would otherwise skip it as "expected per-kind field".
+        // Heuristic: when `step[step.id]` is a non-array table, this is
+        // (effectively always) the misnest pattern. Scalars are fine (the
+        // user really did mean to set the scalar field).
+        //
+        // Codex finding (PR #819, 2026-05-21): the heuristic over-fires for the
+        // `switch` step kind. A switch legitimately named `id = "default"` has a
+        // real `[steps.default]` fallback that parses as a non-array table at
+        // `step.default` — structurally identical to the misnest shape, but it's
+        // the field's *valid* form. (Likewise `id = "cases"`.) For these ids the
+        // footgun and the legitimate declaration are indistinguishable, so the
+        // heuristic must defer to the allowlist. Carve-out scope is narrow on
+        // purpose: only `kind === "switch"` with key `cases`/`default`. Every
+        // other (kind, id) collision — e.g. `id = "query"` on a database step —
+        // is still treated as the footgun, preserving finding 1's safety net.
+        const isSwitchFallbackField = step.kind === "switch" && (key === "cases" || key === "default");
+        const isSelfIdMisnest = stepId !== null &&
+            key === stepId &&
+            value !== null &&
+            typeof value === "object" &&
+            !Array.isArray(value) &&
+            !isSwitchFallbackField;
+        // Known kind → full allowlist check (an allowlisted field passes).
+        // Unknown kind → skip the per-field allowlist check entirely: only the
+        // structural footgun (self-id misnest) below can flag a field. The
+        // footgun check is kind-agnostic, so it fires on every step regardless.
+        if (!isSelfIdMisnest && (!isKnownKind || ALLOWLISTED_FIELDS.has(key)))
+            continue;
+        // Two failure modes are common enough to call out specifically in
+        // the hint:
+        //
+        // 1) `[steps.<id>.<field>]` under `[[steps]]` — TOML places the
+        //    sub-table under `steps[N][<id>]`. We detect this when the
+        //    unknown field name equals the step's own id (including the
+        //    self-id-allowlist-collision case above). We use the first
+        //    sub-key of the offending value (e.g. `request`) to build a
+        //    concrete corrected-form example so the user sees exactly what
+        //    to rewrite, not just an abstract `<field>`.
+        //
+        // 2) Any other unknown top-level field — covered by the generic hint.
+        let hint;
+        if (stepId !== null && key === stepId) {
+            const subKey = value && typeof value === "object" && !Array.isArray(value)
+                ? Object.keys(value)[0]
+                : null;
+            const exampleSub = subKey ?? "request";
+            hint =
+                `This is usually caused by writing [steps.${stepId}.${exampleSub}] instead of [steps.${exampleSub}]. ` +
+                    `TOML can't address an array element by id — use [steps.${exampleSub}] (refers to the most recent step).`;
+        }
+        else {
+            hint =
+                `\`${key}\` is not a recognized step field. ` +
+                    `If you meant to write a nested config block on this step, use [steps.${key}] (which refers to the most recent step) instead of [steps.<id>.${key}].`;
+        }
+        errors.push({
+            stepIndex,
+            stepId,
+            field: key,
+            hint,
+            parentStepId,
+        });
+    }
+    // #1252 — form-urlencoded body conflict. `[steps.request.form]` encodes an
+    // `application/x-www-form-urlencoded` body; it cannot coexist with a
+    // `request.body` or a raw/multipart `bodyMode`. The runtime rejects the same
+    // combination, but catching it at push time gives a clearer, earlier
+    // diagnostic. (`request.form` itself needs no allowlist entry — the validator
+    // only checks top-level step fields, and `request` is already allowlisted.)
+    if (step.kind === "integration.call" &&
+        step.request !== null &&
+        typeof step.request === "object" &&
+        !Array.isArray(step.request)) {
+        const req = step.request;
+        const hasForm = req.form !== undefined && req.form !== null;
+        if (hasForm) {
+            if (req.body !== undefined && req.body !== null) {
+                errors.push({
+                    stepIndex,
+                    stepId,
+                    field: "request.form",
+                    hint: "`request.form` (application/x-www-form-urlencoded) cannot be combined with `request.body`. " +
+                        "Use one request body — either the JSON `body` or the `form` table.",
+                    parentStepId,
+                });
+            }
+            const mode = step.bodyMode;
+            if (mode === "raw" || mode === "multipart") {
+                errors.push({
+                    stepIndex,
+                    stepId,
+                    field: "request.form",
+                    hint: `\`request.form\` (application/x-www-form-urlencoded) cannot be combined with bodyMode "${mode}". ` +
+                        "Remove `form` or the `bodyMode`.",
+                    parentStepId,
+                });
+            }
+        }
+    }
+}
+/**
+ * Render a multi-line diagnostic for a list of errors. Designed for the
+ * shape called out in the issue:
+ *
+ *   Error in workflows/refresh.toml:
+ *     steps[0] (id="refresh-each") has unknown field "refresh-each".
+ *     This is usually caused by writing [steps.refresh-each.request] instead of [steps.request].
+ *     TOML can't address an array element by id — use [steps.request] (refers to the most recent step).
+ *
+ * @param filePath The TOML file path (or display name) to include in the
+ *   header.
+ * @param errors The error list from `validateWorkflowToml`.
+ * @returns A multi-line string ready to print to stderr.
+ */
+export function formatWorkflowTomlErrors(filePath, errors) {
+    if (errors.length === 0)
+        return "";
+    const lines = [`Error in ${filePath}:`];
+    for (const err of errors) {
+        if (err.field === "__steps_shape__") {
+            lines.push(`  ${err.hint}`);
+            continue;
+        }
+        if (err.field === "__step_shape__") {
+            lines.push(`  steps[${err.stepIndex}] is malformed: ${err.hint}`);
+            continue;
+        }
+        // For errors inside a `collect` step's nested inner step (codex review,
+        // 2026-05-15), use a `steps[N].step` slot prefix so operators see that
+        // the offending field is on the inner step, not the outer collect.
+        // The outer step's id (if any) is also included in the prefix so the
+        // diagnostic can be cross-referenced against the parent's TOML header.
+        //
+        // #971: top-level errors carry `parentStepId: null` (set explicitly at the
+        // top-level `validateStepObject` call); only genuine collect-inner errors
+        // carry a real id (or `undefined` if a future caller omits it). Use a
+        // non-null check so BOTH `null` and `undefined` top-level errors render as
+        // a bare `steps[N]` without the `(inside collect step)` suffix. The prior
+        // `!== undefined` check treated `null` as inner (`null !== undefined` is
+        // `true`), mislabeling every top-level error as inside a collect step (a
+        // regression from PR #762).
+        const isInnerStep = err.parentStepId != null;
+        const slot = isInnerStep
+            ? `steps[${err.stepIndex}].step`
+            : `steps[${err.stepIndex}]`;
+        const idPart = err.stepId ? ` (id="${err.stepId}")` : "";
+        const parentPart = isInnerStep && err.parentStepId
+            ? ` (inside collect step id="${err.parentStepId}")`
+            : isInnerStep
+                ? ` (inside collect step)`
+                : "";
+        lines.push(`  ${slot}${idPart}${parentPart} has unknown field "${err.field}".`);
+        lines.push(`  ${err.hint}`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=workflow-toml-validator.js.map

package/dist/src/lib/workflow-toml-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-toml-validator.js","sourceRoot":"","sources":["../../../src/lib/workflow-toml-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,4BAA4B,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAAkB,CAAC;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAwB,WAAW,CAAC;AA4B5E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAa;IAChD,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE7B,kEAAkE;IAClE,kEAAkE;IAClE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,oCAAoC;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EACF,sJAAsJ;aACzJ,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC,CAAC;gBACb,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,oEAAoE,OAAO,KAAK,IAAI;aAC3F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEtB,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,eAAe;QACf,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,mDACJ,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAClE,GAAG;aACJ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE7D,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,oEAAoE;QACpE,mEAAmE;QACnE,2CAA2C;QAC3C,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,IAAI,KAAK,IAAI;YAClB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EACzB,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,IAAS,EACT,SAAiB,EACjB,YAA2B,EAC3B,MAA2B;IAE3B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE3D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAExB,oEAAoE;QACpE,qEAAqE;QACrE,wDAAwD;QACxD,6DAA6D;QAC7D,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,qBAAqB,GACzB,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC;QACnE,MAAM,eAAe,GACnB,MAAM,KAAK,IAAI;YACf,GAAG,KAAK,MAAM;YACd,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,CAAC,qBAAqB,CAAC;QAEzB,mEAAmE;QACnE,uEAAuE;QACvE,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,WAAW,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,SAAS;QAEX,kEAAkE;QAClE,YAAY;QACZ,EAAE;QACF,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,mEAAmE;QACnE,iDAAiD;QACjD,EAAE;QACF,sEAAsE;QACtE,IAAI,IAAY,CAAC;QACjB,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,MAAM,GACV,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,IAAI,SAAS,CAAC;YACvC,IAAI;gBACF,4CAA4C,MAAM,IAAI,UAAU,uBAAuB,UAAU,KAAK;oBACtG,0DAA0D,UAAU,qCAAqC,CAAC;QAC9G,CAAC;aAAM,CAAC;YACN,IAAI;gBACF,KAAK,GAAG,qCAAqC;oBAC7C,wEAAwE,GAAG,mEAAmE,GAAG,IAAI,CAAC;QAC1J,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,SAAS;YACT,MAAM;YACN,KAAK,EAAE,GAAG;YACV,IAAI;YACJ,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,6EAA6E;IAC7E,qEAAqE;IACrE,8EAA8E;IAC9E,4EAA4E;IAC5E,IACE,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAChC,IAAI,CAAC,OAAO,KAAK,IAAI;QACrB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAC5B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAkC,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5D,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS;oBACT,MAAM;oBACN,KAAK,EAAE,cAAc;oBACrB,IAAI,EACF,6FAA6F;wBAC7F,oEAAoE;oBACtE,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC3B,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS;oBACT,MAAM;oBACN,KAAK,EAAE,cAAc;oBACrB,IAAI,EACF,0FAA0F,IAAI,KAAK;wBACnG,kCAAkC;oBACpC,YAAY;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,MAA2B;IAE3B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,KAAK,GAAa,CAAC,YAAY,QAAQ,GAAG,CAAC,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,SAAS,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,qEAAqE;QACrE,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,4BAA4B;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,WAAW;YACtB,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,QAAQ;YAChC,CAAC,CAAC,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,GACd,WAAW,IAAI,GAAG,CAAC,YAAY;YAC7B,CAAC,CAAC,6BAA6B,GAAG,CAAC,YAAY,IAAI;YACnD,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,GAAG,MAAM,GAAG,UAAU,uBAAuB,GAAG,CAAC,KAAK,IAAI,CACpE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}