primitive-admin 1.1.0-alpha.87 → 1.1.0

package/dist/src/lib/google-client-secret-status.d.ts

@@ -1,35 +0,0 @@
-/**
- * The operator-facing warning for an app whose stored `googleClientSecret` is
- * not a `{{secrets.KEY}}` reference (#2256, #2307).
- *
- * The server never sends such a value back: `GET /settings` omits the key and
- * reports `googleClientSecretStatus` in its place, so the only way an operator
- * learns the field is still unmigrated is a command that reads the status and
- * says so. Two do — `apps get` and `config pull` — and
- * each has two statuses to describe, so the wording lives here once and the
- * call sites supply only what genuinely differs: how the field is named in that
- * context, where the value is missing from, and what the un-migrated value
- * blocks.
- *
- * Modelled on `signingSecretStatusWarning` (the same problem for
- * `webhook.signingSecret`), deliberately kept as a separate function: the
- * remediation names a different TOML key, and a `legacy-literal` blocks
- * different things on the two fields.
- *
- * Returns `null` for a status that needs no warning (`reference`, `unset`, or
- * anything a newer server adds), so a call site is one `if` rather than two.
- */
-export declare function googleClientSecretStatusWarning(status: string | null | undefined, context: {
-    /** How to name the field, e.g. `"googleClientSecret"`. Starts the sentence. */
-    subject: string;
-    /** Where the value is missing from, e.g. `"this output"`. */
-    withheldFrom: string;
-    /**
-     * What an un-migrated value blocks, e.g. `"the next settings write will be
-     * rejected"`. Every settings write on such an app fails unless it carries a
-     * `googleClientSecret` that migrates the field
-     * (`validateGoogleClientSecretMigration`), and a pulled `app.toml` never
-     * carries one — so for the pull paths this is the concrete consequence.
-     */
-    blocks: string;
-}): string | null;

package/dist/src/lib/google-client-secret-status.js

@@ -1,56 +0,0 @@
-/**
- * The operator-facing warning for an app whose stored `googleClientSecret` is
- * not a `{{secrets.KEY}}` reference (#2256, #2307).
- *
- * The server never sends such a value back: `GET /settings` omits the key and
- * reports `googleClientSecretStatus` in its place, so the only way an operator
- * learns the field is still unmigrated is a command that reads the status and
- * says so. Two do — `apps get` and `config pull` — and
- * each has two statuses to describe, so the wording lives here once and the
- * call sites supply only what genuinely differs: how the field is named in that
- * context, where the value is missing from, and what the un-migrated value
- * blocks.
- *
- * Modelled on `signingSecretStatusWarning` (the same problem for
- * `webhook.signingSecret`), deliberately kept as a separate function: the
- * remediation names a different TOML key, and a `legacy-literal` blocks
- * different things on the two fields.
- *
- * Returns `null` for a status that needs no warning (`reference`, `unset`, or
- * anything a newer server adds), so a call site is one `if` rather than two.
- */
-export function googleClientSecretStatusWarning(status, context) {
-    const remediation = "Store the value with `primitive secrets set KEY --value <value>` and set " +
-        'googleClientSecret = "{{secrets.KEY}}".';
-    if (status === "legacy-literal") {
-        return (`${context.subject} still holds a raw value rather than a {{secrets.KEY}} reference, ` +
-            `so it is withheld from ${context.withheldFrom}. Google sign-in keeps working, but the ` +
-            `value is deprecated and ${context.blocks} until it is migrated. ${remediation}`);
-    }
-    // Not a working legacy literal: the stored value carries reference syntax
-    // that resolves to nothing, so Google sign-in is already failing (#2332).
-    //
-    // Two deliberate differences from the branch above, both to keep the
-    // rendered settings output byte-identical to what PR #2293 shipped:
-    //
-    //   - `context.blocks` is unused. A push of the pulled file is rejected for
-    //     this status too (`validateGoogleClientSecretMigration` gates on
-    //     `isWithheldSecretStatus`, which covers both), but the sign-in outage is
-    //     the louder problem and the remediation below already fixes both. The
-    //     sibling `signingSecretStatusWarning` drops `blocks` in its malformed
-    //     branch the same way.
-    //   - The remediation sentence is written out rather than interpolating the
-    //     `remediation` constant above: this one says "the real client secret",
-    //     which the shared sentence does not.
-    //
-    // Both are worth revisiting together if `apps get`'s wording is ever
-    // allowed to change.
-    if (status === "malformed-reference") {
-        return (`${context.subject} is neither a {{secrets.KEY}} reference nor a plain stored value — it ` +
-            `carries reference syntax that does not resolve, so it is withheld from ${context.withheldFrom} ` +
-            "and Google sign-in is already FAILING. Store the real client secret with " +
-            '`primitive secrets set KEY --value <value>` and set googleClientSecret = "{{secrets.KEY}}".');
-    }
-    return null;
-}
-//# sourceMappingURL=google-client-secret-status.js.map

package/dist/src/lib/google-client-secret-status.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"google-client-secret-status.js","sourceRoot":"","sources":["../../../src/lib/google-client-secret-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAAiC,EACjC,OAaC;IAED,MAAM,WAAW,GACf,2EAA2E;QAC3E,yCAAyC,CAAC;IAC5C,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,oEAAoE;YACtF,0BAA0B,OAAO,CAAC,YAAY,0CAA0C;YACxF,2BAA2B,OAAO,CAAC,MAAM,0BAA0B,WAAW,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,EAAE;IACF,qEAAqE;IACrE,oEAAoE;IACpE,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,2BAA2B;IAC3B,4EAA4E;IAC5E,4EAA4E;IAC5E,0CAA0C;IAC1C,EAAE;IACF,qEAAqE;IACrE,qBAAqB;IACrB,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO,CACL,GAAG,OAAO,CAAC,OAAO,wEAAwE;YAC1F,0EAA0E,OAAO,CAAC,YAAY,GAAG;YACjG,2EAA2E;YAC3E,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/lib/workflow-field-descriptor.d.ts

@@ -1,91 +0,0 @@
-/**
- * Classification of the `WorkflowDefinition` field surface (issue #2326,
- * Phase 1 of #1976).
- *
- * Purpose: give the CLI a mechanical trip-wire for the drift that keeps
- * happening — the server grows a `[workflow]`-level config field (`syncCallable`
- * #807, `accessRule` #571, `runAs` #1081, `capabilities` #1172, `lock` #1518)
- * and the CLI silently drops it on `sync push` / `sync pull`. Every field of the
- * `WorkflowDefinition` model must appear in exactly one of the three groups
- * below. The generated artifact `generated-workflow-model-fields.ts` carries the
- * model's real field list (parsed from `models.yaml` at build time), and
- * `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts` asserts
- *
- *     synced ∪ structural ∪ internal  ===  the model's fields
- *
- * so a new field hard-fails the guard until someone classifies it.
- *
- * ── Scope: declarative classification and coverage ONLY ──────────────────
- * Decision of record (#1976, 2026-07-23): this table records WHICH fields
- * exist, whether each is synced / structural / internal, and its `[workflow]`
- * TOML key. Anything with real BEHAVIOR gets an explicit per-field handler or
- * stays outside the table. In particular this file deliberately does NOT encode
- * as boolean knobs:
- *   - the schema fields' native-TOML-table-vs-JSON-string parsing
- *     (`buildWorkflowPayloadFromToml` / `safeJsonParse` own that),
- *   - `syncCallable`'s deferred second PATCH on update (#807 — `applyWorkflowBody`
- *     owns that),
- *   - the `metadataManifest` (#1304) and `expr.cel` (#1614) structural side
- *     channels, which are attached alongside the steps write and are not
- *     `[workflow]`-table keys at all.
- * `cli/src/lib/app-settings-descriptor.ts` is the shape being matched:
- * deliberately narrow.
- *
- * ── What Phase 1 does and does not do ───────────────────────────────────
- * Phase 1 (this file) is the guard only. Making the push builder
- * (`workflow-payload.ts`) and the pull serializer (`serializeWorkflow` in
- * `commands/sync.ts`) *consume* this table is Phase 2 (#2327).
- * `synced` therefore means "belongs in the `[workflow]` TOML table", NOT
- * "already round-trips" — see `SYNCED_NOT_YET_WIRED` below.
- */
-/** Value shape of a synced `[workflow]` key. Descriptive; behavior lives in the handlers. */
-export type WorkflowFieldType = "string" | "number" | "boolean" | "string[]" | "json";
-export interface WorkflowFieldDescriptor {
-    /** `WorkflowDefinition` model field name === the server payload key. */
-    field: string;
-    /** Key under the `[workflow]` table in workflow TOML (usually === `field`). */
-    tomlKey: string;
-    /** Value shape, for the Phase 2 handlers and for documentation. */
-    type: WorkflowFieldType;
-}
-/**
- * The author-facing `[workflow]`-table config fields — the ones a workflow
- * author manages as code and the CLI must round-trip.
- */
-export declare const WORKFLOW_FIELD_DESCRIPTOR: readonly WorkflowFieldDescriptor[];
-/**
- * Fields that ARE author-controlled but do not live in the `[workflow]` table —
- * they travel through their own structural channel. Kept distinct from
- * `WORKFLOW_FIELDS_INTERNAL` so "internal" keeps meaning "not author-facing".
- */
-export declare const WORKFLOW_FIELDS_STRUCTURAL: ReadonlySet<string>;
-/**
- * Fields the server owns: identity, ownership, timestamps, computed pointers,
- * and the deprecated draft/revision slot. None of these are ever sent by the
- * CLI, and none belong in workflow TOML.
- */
-export declare const WORKFLOW_FIELDS_INTERNAL: ReadonlySet<string>;
-/**
- * Synced fields the CLI does NOT round-trip yet — Phase 2 (#2327) wires them.
- * Recorded explicitly so "classified" is never mistaken for "implemented".
- * `lock` was wired by #1972; `templateMissingMarker` was removed from the
- * platform by #2643, so the set is now empty.
- */
-export declare const SYNCED_NOT_YET_WIRED: ReadonlySet<string>;
-/** Descriptor `field` names, for coverage/parity checks. */
-export declare const WORKFLOW_SYNCED_FIELDS: ReadonlySet<string>;
-/** Look up a synced field's descriptor by model field name. */
-export declare function getWorkflowFieldDescriptor(field: string): WorkflowFieldDescriptor | undefined;
-/**
- * Model fields that are classified in NONE of synced / structural / internal —
- * i.e. a field someone added to `models.yaml` without deciding how the CLI
- * treats it. Non-empty is a hard failure in the drift guard.
- */
-export declare function findUnclassifiedWorkflowFields(modelFields: readonly string[]): string[];
-/**
- * Classifications that no longer correspond to a model field — i.e. a field
- * removed from `models.yaml` while the CLI still classifies it. Also a hard
- * failure: a stale classification must not silently pass, or the coverage
- * claim quietly stops meaning anything.
- */
-export declare function findStaleWorkflowClassifications(modelFields: readonly string[]): string[];

package/dist/src/lib/workflow-field-descriptor.js

@@ -1,153 +0,0 @@
-/**
- * Classification of the `WorkflowDefinition` field surface (issue #2326,
- * Phase 1 of #1976).
- *
- * Purpose: give the CLI a mechanical trip-wire for the drift that keeps
- * happening — the server grows a `[workflow]`-level config field (`syncCallable`
- * #807, `accessRule` #571, `runAs` #1081, `capabilities` #1172, `lock` #1518)
- * and the CLI silently drops it on `sync push` / `sync pull`. Every field of the
- * `WorkflowDefinition` model must appear in exactly one of the three groups
- * below. The generated artifact `generated-workflow-model-fields.ts` carries the
- * model's real field list (parsed from `models.yaml` at build time), and
- * `cli/tests/unit/workflow-field-descriptor-drift-guard.test.ts` asserts
- *
- *     synced ∪ structural ∪ internal  ===  the model's fields
- *
- * so a new field hard-fails the guard until someone classifies it.
- *
- * ── Scope: declarative classification and coverage ONLY ──────────────────
- * Decision of record (#1976, 2026-07-23): this table records WHICH fields
- * exist, whether each is synced / structural / internal, and its `[workflow]`
- * TOML key. Anything with real BEHAVIOR gets an explicit per-field handler or
- * stays outside the table. In particular this file deliberately does NOT encode
- * as boolean knobs:
- *   - the schema fields' native-TOML-table-vs-JSON-string parsing
- *     (`buildWorkflowPayloadFromToml` / `safeJsonParse` own that),
- *   - `syncCallable`'s deferred second PATCH on update (#807 — `applyWorkflowBody`
- *     owns that),
- *   - the `metadataManifest` (#1304) and `expr.cel` (#1614) structural side
- *     channels, which are attached alongside the steps write and are not
- *     `[workflow]`-table keys at all.
- * `cli/src/lib/app-settings-descriptor.ts` is the shape being matched:
- * deliberately narrow.
- *
- * ── What Phase 1 does and does not do ───────────────────────────────────
- * Phase 1 (this file) is the guard only. Making the push builder
- * (`workflow-payload.ts`) and the pull serializer (`serializeWorkflow` in
- * `commands/sync.ts`) *consume* this table is Phase 2 (#2327).
- * `synced` therefore means "belongs in the `[workflow]` TOML table", NOT
- * "already round-trips" — see `SYNCED_NOT_YET_WIRED` below.
- */
-/**
- * The author-facing `[workflow]`-table config fields — the ones a workflow
- * author manages as code and the CLI must round-trip.
- */
-export const WORKFLOW_FIELD_DESCRIPTOR = [
-    { field: "name", tomlKey: "name", type: "string" },
-    { field: "status", tomlKey: "status", type: "string" },
-    { field: "description", tomlKey: "description", type: "string" },
-    // JSON Schema objects. TOML may present them as an inline table OR as a
-    // JSON string; the push builder owns that parse (not a knob here).
-    { field: "inputSchema", tomlKey: "inputSchema", type: "json" },
-    { field: "outputSchema", tomlKey: "outputSchema", type: "json" },
-    { field: "perUserMaxRunning", tomlKey: "perUserMaxRunning", type: "number" },
-    { field: "perUserMaxQueued", tomlKey: "perUserMaxQueued", type: "number" },
-    { field: "perAppMaxRunning", tomlKey: "perAppMaxRunning", type: "number" },
-    { field: "perAppMaxQueued", tomlKey: "perAppMaxQueued", type: "number" },
-    { field: "queueTtlSeconds", tomlKey: "queueTtlSeconds", type: "number" },
-    { field: "dequeueOrder", tomlKey: "dequeueOrder", type: "string" },
-    {
-        field: "requiresClientApply",
-        tomlKey: "requiresClientApply",
-        type: "boolean",
-    },
-    // Create-only on the wire (#807: update sends it as a deferred second PATCH
-    // once the new steps are live). That sequencing is the payload builder's job.
-    { field: "syncCallable", tomlKey: "syncCallable", type: "boolean" },
-    { field: "accessRule", tomlKey: "accessRule", type: "string" },
-    { field: "runAs", tomlKey: "runAs", type: "string" },
-    // #1518/#1972 — declarative run-scoped lock. `[workflow.lock]` inline table
-    // on the TOML side, JSON on the wire; validated server-side by
-    // `parseWorkflowLock` (decision of record #6: no client-side mirror validator).
-    { field: "lock", tomlKey: "lock", type: "json" },
-    // #1078 Tier 1b — StringSetField on the model, string array in TOML/JSON.
-    { field: "capabilities", tomlKey: "capabilities", type: "string[]" },
-];
-/**
- * Fields that ARE author-controlled but do not live in the `[workflow]` table —
- * they travel through their own structural channel. Kept distinct from
- * `WORKFLOW_FIELDS_INTERNAL` so "internal" keeps meaning "not author-facing".
- */
-export const WORKFLOW_FIELDS_STRUCTURAL = new Set([
-    // The workflow's identity. Comes from the TOML file name / `--key`, and is
-    // attached by the caller rather than spread from the `[workflow]` table.
-    "workflowKey",
-    // #1304 — JSON declared-access manifest, derived from the workflow's CEL
-    // fields and attached alongside the steps write, not typed by the author.
-    "metadataManifest",
-]);
-/**
- * Fields the server owns: identity, ownership, timestamps, computed pointers,
- * and the deprecated draft/revision slot. None of these are ever sent by the
- * CLI, and none belong in workflow TOML.
- */
-export const WORKFLOW_FIELDS_INTERNAL = new Set([
-    // Identity / ownership / timestamps — assigned by the server.
-    "workflowId",
-    "appId",
-    "createdBy",
-    "createdAt",
-    "modifiedAt",
-    // Pointer to the active WorkflowConfiguration — server-computed on publish.
-    "activeConfigId",
-    // DEPRECATED in models.yaml: the legacy revision + draft slot, kept for
-    // migration/backward compatibility. Server-managed; never author-authored.
-    "latestRevision",
-    "stepsR2Key",
-    "draftStepsR2Key",
-    "draftInputSchema",
-    "draftOutputSchema",
-    "draftModifiedAt",
-]);
-/**
- * Synced fields the CLI does NOT round-trip yet — Phase 2 (#2327) wires them.
- * Recorded explicitly so "classified" is never mistaken for "implemented".
- * `lock` was wired by #1972; `templateMissingMarker` was removed from the
- * platform by #2643, so the set is now empty.
- */
-export const SYNCED_NOT_YET_WIRED = new Set([]);
-/** Descriptor `field` names, for coverage/parity checks. */
-export const WORKFLOW_SYNCED_FIELDS = new Set(WORKFLOW_FIELD_DESCRIPTOR.map((d) => d.field));
-/** Look up a synced field's descriptor by model field name. */
-export function getWorkflowFieldDescriptor(field) {
-    return WORKFLOW_FIELD_DESCRIPTOR.find((d) => d.field === field);
-}
-/**
- * Model fields that are classified in NONE of synced / structural / internal —
- * i.e. a field someone added to `models.yaml` without deciding how the CLI
- * treats it. Non-empty is a hard failure in the drift guard.
- */
-export function findUnclassifiedWorkflowFields(modelFields) {
-    return modelFields
-        .filter((f) => !WORKFLOW_SYNCED_FIELDS.has(f) &&
-        !WORKFLOW_FIELDS_STRUCTURAL.has(f) &&
-        !WORKFLOW_FIELDS_INTERNAL.has(f))
-        .sort();
-}
-/**
- * Classifications that no longer correspond to a model field — i.e. a field
- * removed from `models.yaml` while the CLI still classifies it. Also a hard
- * failure: a stale classification must not silently pass, or the coverage
- * claim quietly stops meaning anything.
- */
-export function findStaleWorkflowClassifications(modelFields) {
-    const known = new Set(modelFields);
-    return [
-        ...WORKFLOW_SYNCED_FIELDS,
-        ...WORKFLOW_FIELDS_STRUCTURAL,
-        ...WORKFLOW_FIELDS_INTERNAL,
-    ]
-        .filter((f) => !known.has(f))
-        .sort();
-}
-//# sourceMappingURL=workflow-field-descriptor.js.map

package/dist/src/lib/workflow-field-descriptor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow-field-descriptor.js","sourceRoot":"","sources":["../../../src/lib/workflow-field-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAmBH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAuC;IAC3E,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClD,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtD,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChE,wEAAwE;IACxE,mEAAmE;IACnE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9D,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;IAChE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5E,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxE,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClE;QACE,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,SAAS;KAChB;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;IACnE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9D,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpD,4EAA4E;IAC5E,+DAA+D;IAC/D,gFAAgF;IAChF,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAChD,0EAA0E;IAC1E,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;CAC5D,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IACrE,2EAA2E;IAC3E,yEAAyE;IACzE,aAAa;IACb,yEAAyE;IACzE,0EAA0E;IAC1E,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,8DAA8D;IAC9D,YAAY;IACZ,OAAO;IACP,WAAW;IACX,WAAW;IACX,YAAY;IACZ,4EAA4E;IAC5E,gBAAgB;IAChB,wEAAwE;IACxE,2EAA2E;IAC3E,gBAAgB;IAChB,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS,EAAE,CAAC,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAChE,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAC9C,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,0BAA0B,CACxC,KAAa;IAEb,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAA8B;IAE9B,OAAO,WAAW;SACf,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,WAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,sBAAsB;QACzB,GAAG,0BAA0B;QAC7B,GAAG,wBAAwB;KAC5B;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC5B,IAAI,EAAE,CAAC;AACZ,CAAC"}