studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/core/secrets/registry.js

@@ -0,0 +1,616 @@
+/**
+ * Key Registry — single source of truth for every configurable key.
+ *
+ * Every consumer (resolver, importer, validator, redactor, audit logger,
+ * exporter, test suite) reads from this module. If a `process.env.<KEY>`
+ * appears in `src/`, it MUST be either listed under some entry's
+ * `envAliases` or covered by `SYSTEM_ALLOWLIST` / `OPERATIONAL_ALLOWLIST`.
+ * The registry-completeness test enforces this — orphans fail CI with
+ * their names printed.
+ *
+ * Adding a new env var? Two-step: pick the right classification, add the
+ * KeyDef here. The completeness test will keep you honest.
+ */
+import { z } from 'zod';
+import { probeAnthropic } from './probes/anthropic.js';
+import { probeR2 } from './probes/r2.js';
+import { probeBrave } from './probes/brave.js';
+import { probeTavily } from './probes/tavily.js';
+import { probeVoyage } from './probes/voyage.js';
+/**
+ * System-level env vars provided by the OS or container runtime. Not
+ * registry-managed — they do not represent product configuration; we just
+ * read them when they happen to be set.
+ */
+export const SYSTEM_ALLOWLIST = new Set([
+    'HOME',
+    'PATH',
+    'EDITOR',
+    'CI',
+    'VISUAL',
+    'USERPROFILE',
+    'PORT',
+    'HOST',
+]);
+/**
+ * Operational env vars that toggle runtime behaviour but aren't
+ * configurable settings (no UI surface, no persistence, no precedence
+ * chain). Not registry-managed.
+ */
+export const OPERATIONAL_ALLOWLIST = new Set([
+    'RAILWAY_ENVIRONMENT',
+    'STUDIOGRAPH_LOG',
+    'STUDIOGRAPH_VERBOSE',
+    'STUDIOGRAPH_NO_OPEN',
+    'STUDIOGRAPH_NO_SPINNER',
+    // Historical Phase 1 feature flag. Removed once Phase 6 stabilized in
+    // production; the encrypted store is now unconditional. Kept on the
+    // allowlist so legacy Railway services that still set it don't trip
+    // the "unknown env" warning. Setting it has no effect.
+    'STUDIOGRAPH_NEW_STORE',
+    // Phase 11 log-redaction controls.
+    'STUDIOGRAPH_LOG_RAW',
+    'NODE_ENV',
+    // Phase 9c schema-enforcement toggle. `1` (default when unset) makes the
+    // workspace.json + connector validators throw on any violation; `0`
+    // drops back to warn-mode for hotfix. Operators flip without restart —
+    // the env is read at validation time, not cached at boot.
+    'STUDIOGRAPH_SCHEMA_STRICT',
+    // Phase 1 of the Y.Doc-routed write plan. Kill switch on the broadcast
+    // observer (default `1` / ON). When `0`, server-side writes refuse to
+    // mutate live docs via `BROADCAST_DISABLED_LIVE_CLIENTS` instead of
+    // silently diverging from connected editors. Read once at YjsManager
+    // construction — restart required to flip.
+    'STUDIOGRAPH_YJS_BROADCAST',
+    // Operator opt-in to accept degraded-mode data loss when broadcast is
+    // off AND clients are active. Default off. Required override to bypass
+    // the fail-closed `assertWritable` guard.
+    'STUDIOGRAPH_ALLOW_DEGRADED_WRITES',
+    // Deploy-time-only: lets `studiograph deploy railway` receive the model
+    // API key non-interactively (alternative to the --api-key flag). Read
+    // once during deploy, never by the running server — not a stored secret.
+    'STUDIOGRAPH_DEPLOY_API_KEY',
+    // OAuth authorization-server issuer pinning. The canonical public base URL
+    // used to build OAuth discovery-metadata + token `aud` (never the inbound
+    // Host header). Operational config, not a stored secret — read at request
+    // time. RAILWAY_PUBLIC_DOMAIN is the platform-provided fallback.
+    'STUDIOGRAPH_PUBLIC_URL',
+    'RAILWAY_PUBLIC_DOMAIN',
+    // Managed-cloud auth handoff (src/server/routes/auth-api.ts). Operational
+    // config for the Studiograph Cloud login bridge — workspace/org identifiers
+    // + the cloud base URL + the HMAC verify token. Read at request time, not
+    // through the secret store. (These were previously read without being
+    // registered, tripping the orphan-env guard — registered here.)
+    'STUDIOGRAPH_MANAGED_AUTH',
+    'STUDIOGRAPH_CLOUD_URL',
+    'STUDIOGRAPH_CLOUD_ORG_ID',
+    'STUDIOGRAPH_CLOUD_WORKSPACE_ID',
+    'STUDIOGRAPH_CLOUD_TOKEN',
+]);
+/**
+ * The canonical registry. Order is informative (matches plan §2 grouping)
+ * but every consumer should look up by name.
+ */
+export const REGISTRY = [
+    // ── Bootstrap (env-only, no store, no export) ────────────────────────────
+    {
+        name: 'jwt.secret',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_JWT_SECRET'],
+        validate: z.string().min(16),
+        redact: 'always',
+        exportable: false,
+        rotationHint: 'Set STUDIOGRAPH_JWT_SECRET on the host and restart. All extant tokens invalidate together.',
+    },
+    {
+        name: 'master.key',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_MASTER_KEY'],
+        validate: z.string().regex(/^[A-Za-z0-9+/=_-]{40,}$/, 'expected base64-encoded 32+ bytes'),
+        redact: 'always',
+        exportable: false,
+        rotationHint: 'Use `studiograph secrets rotate-master --new-key <new-base64>`; old key remains in STUDIOGRAPH_MASTER_KEY_PREVIOUS for the transition.',
+    },
+    {
+        name: 'master.key.previous',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_MASTER_KEY_PREVIOUS'],
+        validate: z.string().optional(),
+        redact: 'always',
+        exportable: false,
+    },
+    {
+        name: 'railway.token',
+        classification: 'bootstrap',
+        envAliases: ['RAILWAY_TOKEN'],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+    },
+    // ── Bootstrap — CLI auth credentials ─────────────────────────────────────
+    // Pre-approved decision: these are bootstrap because they exist solely to
+    // let CLI/agent traffic authenticate without an interactive prompt.
+    {
+        name: 'cli.email',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_EMAIL'],
+        validate: z.string().email(),
+        redact: 'value-only',
+        exportable: false,
+    },
+    {
+        name: 'cli.password',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_PASSWORD'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+    },
+    {
+        name: 'cli.token',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_TOKEN'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+    },
+    {
+        name: 'mcp.token',
+        classification: 'bootstrap',
+        envAliases: ['STUDIOGRAPH_MCP_TOKEN'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+    },
+    // ── Workspace — model & providers ────────────────────────────────────────
+    {
+        name: 'model.provider',
+        classification: 'workspace-setting',
+        envAliases: ['MODEL_PROVIDER'],
+        validate: z.enum(['anthropic', 'openai', 'google', 'xai', 'groq', 'openrouter']),
+        redact: 'never',
+        exportable: true,
+    },
+    {
+        name: 'model.id',
+        classification: 'workspace-setting',
+        envAliases: ['MODEL_ID'],
+        validate: z.string(),
+        redact: 'never',
+        exportable: true,
+    },
+    // Per-provider model API keys. Splitting the legacy `model.api_key`
+    // (decommissioned 2026-05-12, Phase 12c) means switching providers no
+    // longer silently re-uses an Anthropic key against OpenAI (or vice
+    // versa) — each provider's key survives the switch and the panel
+    // renders only the active one. `MODEL_API_KEY` is no longer an alias
+    // here; each provider's SDK reads its own env var below.
+    {
+        name: 'model.anthropic.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['ANTHROPIC_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://console.anthropic.com/settings/keys',
+        testConnection: probeAnthropic,
+    },
+    {
+        name: 'model.openai.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['OPENAI_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://platform.openai.com/api-keys',
+    },
+    {
+        name: 'model.google.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['GOOGLE_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://aistudio.google.com/apikey',
+    },
+    {
+        name: 'model.xai.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['XAI_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://console.x.ai',
+    },
+    {
+        name: 'model.groq.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['GROQ_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://console.groq.com/keys',
+    },
+    {
+        name: 'model.openrouter.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['OPENROUTER_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://openrouter.ai/keys',
+    },
+    // ── Workspace — semantic search (embeddings) ─────────────────────────────
+    // Optional Tier-2 hybrid search. Without this key, vector-service falls
+    // back to Tier-1 FTS-only. With it, voyage-3 embeddings are generated
+    // on index + query for better recall. The first-run importer migrates
+    // existing `user.json:voyage_api_key` values into the store on cold
+    // boot — no manual action needed for installs that had it configured
+    // before this entry landed.
+    {
+        name: 'voyage.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['VOYAGE_API_KEY'],
+        validate: z.string().min(1),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://dashboard.voyageai.com/api-keys',
+        testConnection: probeVoyage,
+    },
+    // ── Workspace — storage (R2 / S3-compatible) ─────────────────────────────
+    // Structural fields (account_id, bucket, public_url) live in the store
+    // post-2026-05-12 alongside the credentials. The one-shot migration in
+    // r2-structural-migration.ts mirrors any pre-existing values from
+    // `workspace.json:r2_config.*` on first boot so operators who
+    // configured R2 via `studiograph r2 setup` see no behavior change.
+    // Subsequent writes route through Settings UI or the same CLI (whose
+    // workspace.writeConfig path is dual-write-wired in dual-write.ts).
+    //
+    // We deliberately do NOT register `r2.endpoint`. The S3 client derives
+    // its endpoint from account_id (`https://<account>.r2.cloudflarestorage.com`)
+    // and no consumer reads an override today. If a future change adds
+    // support for non-Cloudflare S3-compatible storage (MinIO, B2,
+    // Backblaze, local-dev MinIO, etc.), add the entry then alongside the
+    // R2AssetService change that consumes it.
+    {
+        name: 'r2.account_id',
+        classification: 'workspace-setting',
+        envAliases: ['R2_ACCOUNT_ID'],
+        validate: z.string(),
+        redact: 'never',
+        exportable: true,
+    },
+    {
+        name: 'r2.bucket',
+        classification: 'workspace-setting',
+        envAliases: ['R2_BUCKET'],
+        validate: z.string(),
+        redact: 'never',
+        exportable: true,
+    },
+    {
+        name: 'r2.public_url',
+        classification: 'workspace-setting',
+        envAliases: ['R2_PUBLIC_URL'],
+        validate: z.string().url(),
+        redact: 'never',
+        exportable: true,
+    },
+    {
+        name: 'r2.access_key_id',
+        classification: 'workspace-secret',
+        envAliases: ['R2_ACCESS_KEY_ID'],
+        validate: z.string(),
+        redact: 'value-only',
+        exportable: false,
+        consoleUrl: 'https://dash.cloudflare.com/?to=/:account/r2/api-tokens',
+        testConnection: probeR2,
+    },
+    {
+        name: 'r2.secret_access_key',
+        classification: 'workspace-secret',
+        envAliases: ['R2_SECRET_ACCESS_KEY'],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://dash.cloudflare.com/?to=/:account/r2/api-tokens',
+    },
+    // ── Workspace — search ───────────────────────────────────────────────────
+    // search.provider is the explicit picker — when set, the resolver uses
+    // ONLY this provider's key (no cascade). When unset, the resolver falls
+    // back to the legacy first-key-wins cascade for back-compat.
+    {
+        name: 'search.provider',
+        classification: 'workspace-setting',
+        envAliases: ['SEARCH_PROVIDER'],
+        validate: z.enum(['brave', 'tavily', 'google']),
+        redact: 'never',
+        exportable: true,
+    },
+    {
+        name: 'search.brave.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['BRAVE_SEARCH_API_KEY'],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://api.search.brave.com/app/keys',
+        testConnection: probeBrave,
+    },
+    {
+        name: 'search.tavily.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['TAVILY_API_KEY'],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://app.tavily.com',
+        testConnection: probeTavily,
+    },
+    {
+        name: 'search.google.api_key',
+        classification: 'workspace-secret',
+        envAliases: ['GOOGLE_SEARCH_API_KEY'],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+        consoleUrl: 'https://console.cloud.google.com/apis/credentials',
+    },
+    {
+        name: 'search.google.cx',
+        classification: 'workspace-setting',
+        envAliases: ['GOOGLE_SEARCH_CX'],
+        validate: z.string(),
+        redact: 'value-only',
+        exportable: true,
+    },
+    // ── Workspace — server config ────────────────────────────────────────────
+    {
+        name: 'cors.origins',
+        classification: 'workspace-setting',
+        envAliases: ['STUDIOGRAPH_CORS_ORIGINS'],
+        validate: z.string(),
+        redact: 'never',
+        exportable: true,
+    },
+    // ── Workspace — connector secret slots (pattern entries) ────────────────
+    // These are TEMPLATE entries — the `<name>` segment is substituted with
+    // the connector name at write time (e.g. `connector.linear.auth`).
+    // `resolveConnectorKeyDef()` does the pattern match for callers that
+    // hand it a concrete key.
+    {
+        name: 'connector.<name>.auth',
+        classification: 'workspace-secret',
+        envAliases: [],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+    },
+    {
+        name: 'connector.<name>.oauth_secret',
+        classification: 'workspace-secret',
+        envAliases: [],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+    },
+    // ── User-scope (lives in auth.db, encrypted in Phase 8) ──────────────────
+    {
+        name: 'user.deepgram.api_key',
+        classification: 'user-secret',
+        envAliases: [],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+    },
+    {
+        name: 'user.mcp.oauth_token',
+        classification: 'user-secret',
+        envAliases: [],
+        validate: z.string(),
+        redact: 'always',
+        exportable: false,
+    },
+    // ── Workspace — indexing ────────────────────────────────────────────────
+    // Auto-reindex on `studiograph serve` boot. Defaults true. Owners with
+    // very large workspaces (millions of entities) where boot latency matters
+    // can flip this off and rely on the explicit `studiograph index` command
+    // instead. Replaces the auto-index that used to live in `studiograph
+    // start`; see cli-owner-audit.md §3 (A1).
+    {
+        name: 'index.auto_on_boot',
+        classification: 'workspace-setting',
+        envAliases: ['STUDIOGRAPH_INDEX_AUTO_ON_BOOT'],
+        default: true,
+        validate: z.boolean(),
+        redact: 'never',
+        exportable: true,
+    },
+];
+/**
+ * Look up a registry entry by canonical name.
+ *
+ * Handles two cases:
+ *   1. Exact match on `name` — the common path.
+ *   2. Connector pattern match — concrete keys like
+ *      `connector.linear.auth` resolve to the template entry
+ *      `connector.<name>.auth`. The template's classification + redaction
+ *      flags apply to the concrete key.
+ *
+ * Returns undefined for genuinely unknown keys; callers (importer, store
+ * setters) treat this as "not in the registry, reject the write."
+ */
+export function getKeyDef(name) {
+    const direct = REGISTRY.find((k) => k.name === name);
+    if (direct)
+        return direct;
+    return resolveConnectorKeyDef(name);
+}
+/**
+ * Match a concrete connector key (`connector.<name>.<slot>`) against the
+ * template entries in the registry. Returns a synthetic KeyDef carrying
+ * the template's classification/redaction/exportable flags but with the
+ * concrete `name` so audit and store rows record the actual slot, not
+ * the placeholder.
+ */
+export function resolveConnectorKeyDef(name) {
+    const m = /^connector\.([a-z0-9][a-z0-9_-]*)\.(.+)$/.exec(name);
+    if (!m)
+        return undefined;
+    const slot = m[2];
+    // Find the template entry whose slot suffix matches.
+    const template = REGISTRY.find((k) => k.name === `connector.<name>.${slot}`);
+    if (!template)
+        return undefined;
+    return { ...template, name };
+}
+/**
+ * Reverse lookup: given an env-var spelling, return the registry entry that
+ * claims it as an alias. Returns `undefined` for unregistered names — the
+ * caller should fall back to the allowlists.
+ */
+export function getKeyDefByEnvAlias(envName) {
+    return REGISTRY.find((k) => k.envAliases.includes(envName));
+}
+/**
+ * Set of every env-var spelling claimed by the registry. Used by tests and
+ * by the resolver to decide whether an env-var is "ours" vs ambient.
+ */
+export function allRegisteredEnvAliases() {
+    return new Set(REGISTRY.flatMap((k) => k.envAliases));
+}
+/**
+ * Per-provider recommended model IDs.
+ *
+ * Surfaced via the `/api/settings/schema` response on the `model.id`
+ * entry so the ProvidersPanel combobox can render a non-blocking
+ * "Recommended" group. The list is intentionally short (3–4 per
+ * provider) — power users can always type a preview-tagged value
+ * directly; the combobox never blocks freeform input.
+ *
+ * Provider keys must align 1:1 with the `model.provider` enum values
+ * — there's a registry-completeness test that guards this. Seed
+ * values below are best-effort and SHOULD BE USER-VERIFIED; the IDs
+ * shift fast and stale entries here just degrade the dropdown UX
+ * without breaking anything (free typing still works).
+ */
+// Verified 2026-05-11 against each provider's docs. Re-verify periodically —
+// these IDs drift as providers ship new versions and retire old ones. The
+// Test Connection probe's `model_in_list` stage is the runtime canary for
+// any list that goes stale.
+export const RECOMMENDED_MODELS = {
+    anthropic: ['claude-opus-4-7', 'claude-sonnet-4-6', 'claude-haiku-4-5'],
+    openai: ['gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'o3', 'o4-mini'],
+    google: ['gemini-2.5-pro', 'gemini-2.5-flash'],
+    // xAI retired grok-3 + grok-3-mini on 2026-05-15. grok-4 superseded by
+    // grok-4.3 as the current reasoning/code workhorse.
+    xai: ['grok-4.3', 'grok-4.20-non-reasoning'],
+    groq: ['llama-3.3-70b-versatile', 'llama-3.1-8b-instant'],
+    openrouter: ['anthropic/claude-opus-4-7', 'openai/gpt-5.5', 'google/gemini-2.5-pro'],
+};
+/**
+ * Introspect a registered key's zod validator to recover what kind of
+ * value it accepts. Walks ZodOptional/ZodNullable/ZodDefault wrappers to
+ * the inner type. Returns `undefined` for unknown keys and for plain
+ * string-ish schemas — the UI treats absence-of-constraint as "render a
+ * text input."
+ *
+ * Implementation note: zod doesn't expose a stable type-introspection
+ * API across versions. We peek into `_def` and check `typeName` /
+ * `entries`. Wrap in try/catch and degrade to undefined if the shape
+ * changes upstream — losing a dropdown is preferable to crashing the
+ * settings panel.
+ */
+export function getKeyConstraint(name) {
+    const def = getKeyDef(name);
+    if (!def)
+        return undefined;
+    try {
+        return introspectSchema(def.validate);
+    }
+    catch {
+        return undefined;
+    }
+}
+function introspectSchema(schema) {
+    const s = schema;
+    const inner = s._def;
+    if (!inner)
+        return undefined;
+    // zod v4 uses `_def.type`; zod v3 used `_def.typeName`. Check both so
+    // the introspection survives a minor zod version bump.
+    const tag = (inner.type ?? inner.typeName ?? '').toLowerCase();
+    // Unwrap modifier wrappers — z.string().optional() etc.
+    if (tag === 'optional' || tag === 'nullable' || tag === 'default' ||
+        tag === 'zodoptional' || tag === 'zodnullable' || tag === 'zoddefault') {
+        return introspectSchema(inner.innerType);
+    }
+    if (tag === 'enum' || tag === 'zodenum') {
+        // zod v4: public `.options` getter returns the values array.
+        if (Array.isArray(s.options)) {
+            return { type: 'enum', values: s.options };
+        }
+        // zod v4 internal: `_def.entries` is a Record of key→value.
+        if (inner.entries && typeof inner.entries === 'object') {
+            return { type: 'enum', values: Object.keys(inner.entries) };
+        }
+        // zod v3 internal: `_def.values` is an array.
+        if (Array.isArray(inner.values)) {
+            return { type: 'enum', values: inner.values };
+        }
+    }
+    if (tag === 'boolean' || tag === 'zodboolean') {
+        return { type: 'boolean' };
+    }
+    return undefined;
+}
+/**
+ * Enumerate every registered workspace-setting (non-secret) entry for
+ * the settings panels. Workspace-secrets are excluded — they go through
+ * `GET /api/secrets`, which never returns plaintext values.
+ *
+ * Connector template entries (`connector.<name>.*`) are excluded too —
+ * they're matched dynamically at resolution time, not enumerated in the
+ * UI as fixed slots.
+ */
+export function listWorkspaceSettingsSchema() {
+    return REGISTRY
+        .filter((k) => k.classification === 'workspace-setting')
+        .filter((k) => !k.name.includes('<'))
+        .map((k) => {
+        const entry = {
+            key: k.name,
+            classification: k.classification,
+            redact: k.redact,
+            env_aliases: k.envAliases,
+            default: k.default,
+            constraint: getKeyConstraint(k.name),
+        };
+        // Only `model.id` carries recommendations today. We attach the
+        // full RECOMMENDED_MODELS map (not just the current provider's
+        // slice) because the panel needs to swap the visible group as
+        // the provider dropdown changes without a second roundtrip.
+        if (k.name === 'model.id') {
+            entry.recommendations = { byProvider: { ...RECOMMENDED_MODELS } };
+        }
+        return entry;
+    });
+}
+/**
+ * Flat map of canonical key → console URL for every registered key that
+ * carries one. The settings UI uses this to render a "Get an API key →"
+ * link below credential fields. The map covers BOTH workspace-secret
+ * entries (API keys, R2 credentials) and any workspace-setting that
+ * happens to grow a consoleUrl later — same lookup, single roundtrip.
+ *
+ * Keys without a registered consoleUrl are simply absent from the map.
+ */
+export function getAllConsoleUrls() {
+    const out = {};
+    for (const k of REGISTRY) {
+        if (k.consoleUrl)
+            out[k.name] = k.consoleUrl;
+    }
+    return out;
+}
+//# sourceMappingURL=registry.js.map

package/dist/core/secrets/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/core/secrets/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,cAAc,EAAmB,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA2CjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,aAAa;IACb,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,qBAAqB;IACrB,wBAAwB;IACxB,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,uDAAuD;IACvD,uBAAuB;IACvB,mCAAmC;IACnC,qBAAqB;IACrB,UAAU;IACV,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,0DAA0D;IAC1D,2BAA2B;IAC3B,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,2CAA2C;IAC3C,2BAA2B;IAC3B,sEAAsE;IACtE,uEAAuE;IACvE,0CAA0C;IAC1C,mCAAmC;IACnC,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,4BAA4B;IAC5B,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,iEAAiE;IACjE,wBAAwB;IACxB,uBAAuB;IACvB,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,gEAAgE;IAChE,0BAA0B;IAC1B,uBAAuB;IACvB,0BAA0B;IAC1B,gCAAgC;IAChC,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAA0B;IAC7C,4EAA4E;IAC5E;QACE,IAAI,EAAE,YAAY;QAClB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,wBAAwB,CAAC;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,4FAA4F;KAC3G;IACD;QACE,IAAI,EAAE,YAAY;QAClB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,wBAAwB,CAAC;QACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,EAAE,mCAAmC,CAAC;QAC1F,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,wIAAwI;KACvJ;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,iCAAiC,CAAC;QAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAiC;QAC9D,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,eAAe,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,oEAAoE;IACpE;QACE,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,sBAAsB,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,CAAC,uBAAuB,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IAED,4EAA4E;IAC5E;QACE,IAAI,EAAE,gBAAgB;QACtB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QAChF,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,UAAU,CAAC;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IACD,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IACnE,iEAAiE;IACjE,qEAAqE;IACrE,yDAAyD;IACzD;QACE,IAAI,EAAE,yBAAyB;QAC/B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,6CAA6C;QACzD,cAAc,EAAE,cAAyD;KAC1E;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,sCAAsC;KACnD;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,oCAAoC;KACjD;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,sBAAsB;KACnC;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,+BAA+B;KAC5C;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,oBAAoB,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,4BAA4B;KACzC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,4BAA4B;IAC5B;QACE,IAAI,EAAE,gBAAgB;QACtB,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,yCAAyC;QACrD,cAAc,EAAE,WAAsD;KACvE;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,8DAA8D;IAC9D,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,EAAE;IACF,uEAAuE;IACvE,8EAA8E;IAC9E,mEAAmE;IACnE,+DAA+D;IAC/D,sEAAsE;IACtE,0CAA0C;IAC1C;QACE,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,eAAe,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,eAAe,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC1B,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,yDAAyD;QACrE,cAAc,EAAE,OAAkD;KACnE;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,sBAAsB,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,yDAAyD;KACtE;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D;QACE,IAAI,EAAE,iBAAiB;QACvB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,sBAAsB,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,uCAAuC;QACnD,cAAc,EAAE,UAAqD;KACtE;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,WAAsD;KACvE;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,CAAC,uBAAuB,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,mDAAmD;KAChE;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,IAAI;KACjB;IAED,4EAA4E;IAC5E;QACE,IAAI,EAAE,cAAc;QACpB,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,0BAA0B,CAAC;QACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,0BAA0B;IAC1B;QACE,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,cAAc,EAAE,kBAAkB;QAClC,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IAED,4EAA4E;IAC5E;QACE,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;KAClB;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,0CAA0C;IAC1C;QACE,IAAI,EAAE,oBAAoB;QAC1B,cAAc,EAAE,mBAAmB;QACnC,UAAU,EAAE,CAAC,gCAAgC,CAAC;QAC9C,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,CAAC,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,qDAAqD;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,SAAS,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;IACvE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC;IAC/D,MAAM,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC9C,uEAAuE;IACvE,oDAAoD;IACpD,GAAG,EAAE,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAC5C,IAAI,EAAE,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;IACzD,UAAU,EAAE,CAAC,2BAA2B,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;CACrF,CAAC;AAeF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAmB,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe;IACvC,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,wDAAwD;IACxD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS;QAC7D,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAC3E,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACxC,6DAA6D;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAmB,EAAE,CAAC;QACzD,CAAC;QACD,4DAA4D;QAC5D,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,CAAC;QACD,8CAA8C;QAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAkB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAsCD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,mBAAmB,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,KAAK,GAAuB;YAChC,GAAG,EAAE,CAAC,CAAC,IAAI;YACX,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,UAAU;YACzB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;SACrC,CAAC;QACF,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,4DAA4D;QAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1B,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,UAAU;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}