@endora-commerce/platform 0.100.0

package/dist/kernel/scope.js

@@ -0,0 +1,172 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { asFunction } from 'awilix';
+import { runWithTenantContext } from '../tenancy/tenant-context.js';
+import { systemTenantContext } from '../tenancy/resolve-tenant-context.js';
+import { recordEscapeHatchAudit } from '../tenancy/escape-hatch.js';
+import { getRootContainer } from './container.js';
+/**
+ * The ambient scope of the current execution.
+ *
+ * A second `AsyncLocalStorage`, deliberately: the awilix child container is not
+ * reachable from a Fastify request, and the one value that has to be readable
+ * from arbitrary depth — the resolved sales channel — is read at 49 call sites
+ * that receive neither the cradle nor the scope. Tenancy still travels in its
+ * own store (`tenancy/tenant-context.ts`) and is never mirrored here, because a
+ * second copy of the tenant context is a second source of truth.
+ */
+const scopeStorage = new AsyncLocalStorage();
+/** The scope of the current execution, or `undefined` outside one. */
+export function getCurrentPlatformScope() {
+    return scopeStorage.getStore();
+}
+let openScopes = 0;
+/**
+ * How many scopes are currently open. Diagnostics only — the leak test asserts
+ * it returns to its pre-request value after success, error and client abort
+ * (FR-015).
+ */
+export function openPlatformScopeCount() {
+    return openScopes;
+}
+/**
+ * Build the scope object.
+ *
+ * A separate function so its closures capture **only** these parameters. In one
+ * lexical scope V8 gives every closure the same context object, so a `dispose`
+ * defined next to the caller's `run` retains `run` — and through it the Fastify
+ * `request` and `reply` of that request. Since the scope is what lives in the
+ * `AsyncLocalStorage` store, and a store is retained for as long as any async
+ * resource created inside it is alive, that turned one pooled connection into a
+ * pinned request. Measured over `test/integration/catalog`: 1598 MB of post-GC
+ * live set with the shared context, 1000 MB with it split out, against 881 MB
+ * for the pre-kernel hook.
+ */
+function createPlatformScope(root, tenant, opts) {
+    let channel = opts.channel ?? null;
+    const requestMeta = opts.requestMeta ?? null;
+    /**
+     * The awilix child, created on **first resolution** rather than on entry.
+     *
+     * Same reasoning as above, one step further: a request that resolves nothing
+     * from the cradle — which is every request until the modules are converted in
+     * Phase 4 — should not pin a container, its registration closures and its
+     * cradle proxy for as long as the store lives. Awilix itself is not the cost:
+     * 100 000 create → register → dispose cycles in isolation hold flat at 5 MB.
+     */
+    /**
+     * The root, held in a variable rather than used through the parameter so
+     * `dispose` can **drop it**.
+     *
+     * Not a micro-optimisation — it is the difference between the suite finishing
+     * and dying. Once modules register into the root (feature 072 Phase 4), the
+     * root reaches an entire composition: the ORM and its metadata, the Redis
+     * client, every module service and cache. A scope is what lives in the
+     * `AsyncLocalStorage` store, and a store stays reachable for as long as any
+     * async resource created inside it does — so a single retained store pinned a
+     * whole composed application. Measured: with the root captured for the life of
+     * the scope, the full suite died with `JavaScript heap out of memory` at file
+     * **78** of 928; with it released on disposal it runs to completion. Before
+     * Phase 4 the same retention was free, because the process root was empty.
+     */
+    let rootRef = root;
+    let child;
+    const resolutionScope = () => {
+        if (child)
+            return child;
+        if (!rootRef) {
+            // A resolution after disposal would create a child nothing will ever
+            // dispose. It means work outlived its scope — fail loudly rather than
+            // hand back a container that leaks.
+            throw new Error('This platform scope is disposed; it can no longer resolve.');
+        }
+        child = rootRef.createScope();
+        // Per-scope values. `salesChannel` is the registration that lets the 49
+        // `getResolvedChannel(request)` call sites stop threading `request`.
+        //
+        // `asFunction(...).scoped()` rather than `asValue(...)` deliberately: awilix
+        // marks an `asValue` registration `isLeakSafe`, so a **singleton** could
+        // capture the first request's channel and hold it for the life of the
+        // process — a Constitution XII violation with no test to catch it. A scoped
+        // resolver is not leak-safe, so strict mode refuses that capture at the
+        // resolution that makes it.
+        //
+        // The resolver reads `scope.channel` rather than closing over the value, so
+        // a registration resolved before the channel hook ran does not pin `null` —
+        // awilix caches the resolution, not the slot.
+        child.register({
+            salesChannel: asFunction(() => scope.channel).scoped(),
+            requestMeta: asFunction(() => requestMeta).scoped(),
+            platformScope: asFunction(() => scope).scoped(),
+        });
+        return child;
+    };
+    let disposed = false;
+    openScopes += 1;
+    const scope = {
+        get cradle() {
+            return resolutionScope().cradle;
+        },
+        tenant,
+        entryPoint: opts.entryPoint ?? 'http',
+        get channel() {
+            return channel;
+        },
+        requestMeta,
+        setChannel(resolved) {
+            channel = resolved;
+        },
+        async dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            openScopes -= 1;
+            const resolved = child;
+            // Drop both references before awaiting, so a store that outlives this
+            // scope holds neither the child nor the composed root (see `rootRef`).
+            child = undefined;
+            rootRef = undefined;
+            if (resolved)
+                await resolved.dispose();
+        },
+    };
+    return scope;
+}
+/**
+ * Run `run` inside a fresh resolution scope with `tenant` as the ambient tenant
+ * context. The scope is disposed when `run` settles — on success, on error and
+ * on abort.
+ */
+export async function enterPlatformScope(tenant, run, opts = {}) {
+    const scope = createPlatformScope(opts.container ?? getRootContainer(), tenant, opts);
+    // The ALS run is the OUTERMOST wrapper of the work — see rule 2 above. The
+    // scope store nests inside the tenant store and is entered synchronously, so
+    // both reach the handler through the same continuation chain.
+    return runWithTenantContext(tenant, async () => scopeStorage.run(scope, async () => {
+        try {
+            return await run(scope);
+        }
+        finally {
+            await scope.dispose();
+        }
+    }));
+}
+/**
+ * Open a scope that crosses every organisation, for an execution that has no
+ * caller to derive tenancy from: a worker job, a CLI script, a boot reconciler
+ * or an interval sweep.
+ *
+ * The difference from `withSystemScope` is which question it answers.
+ * `withSystemScope` **widens an execution that already has a context** (a
+ * request handler that must read across organisations); this **starts** one, and
+ * is therefore also where the resolution scope is created. Both emit the same
+ * escape-hatch audit record, so `reason` stays mandatory and the cross-org
+ * access stays observable.
+ */
+export function enterSystemScope(reason, run, opts = {}) {
+    recordEscapeHatchAudit({ scope: 'system', reason });
+    return enterPlatformScope(systemTenantContext(reason), run, {
+        entryPoint: 'worker',
+        ...opts,
+    });
+}
+//# sourceMappingURL=scope.js.map

package/dist/kernel/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/kernel/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAsB,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,gBAAgB,EAA2C,MAAM,gBAAgB,CAAC;AA8H3F;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAiB,CAAC;AAE5D,sEAAsE;AACtE,MAAM,UAAU,uBAAuB;IACrC,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,IAAI,UAAU,GAAG,CAAC,CAAC;AAEnB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,MAAqB,EACrB,IAA+B;IAE/B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAE7C;;;;;;;;OAQG;IACH;;;;;;;;;;;;;;OAcG;IACH,IAAI,OAAO,GAAgC,IAAI,CAAC;IAEhD,IAAI,KAAkC,CAAC;IACvC,MAAM,eAAe,GAAG,GAAoB,EAAE;QAC5C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,qEAAqE;YACrE,sEAAsE;YACtE,oCAAoC;YACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,GAAG,OAAO,CAAC,WAAW,EAAgB,CAAC;QAC5C,wEAAwE;QACxE,qEAAqE;QACrE,EAAE;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,wEAAwE;QACxE,4BAA4B;QAC5B,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,8CAA8C;QAC9C,KAAK,CAAC,QAAQ,CAAC;YACb,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE;YACtD,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE;YACnD,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE;SAChD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,UAAU,IAAI,CAAC,CAAC;IAChB,MAAM,KAAK,GAAkB;QAC3B,IAAI,MAAM;YACR,OAAO,eAAe,EAAE,CAAC,MAAM,CAAC;QAClC,CAAC;QACD,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,MAAM;QACrC,IAAI,OAAO;YACT,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,WAAW;QACX,UAAU,CAAC,QAAyB;YAClC,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,OAAO;YACX,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,KAAK,CAAC;YACvB,sEAAsE;YACtE,uEAAuE;YACvE,KAAK,GAAG,SAAS,CAAC;YAClB,OAAO,GAAG,SAAS,CAAC;YACpB,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAqB,EACrB,GAA6C,EAC7C,OAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAEtF,2EAA2E;IAC3E,6EAA6E;IAC7E,8DAA8D;IAC9D,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAC7C,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,GAA6C,EAC7C,OAAmD,EAAE;IAErD,sBAAsB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,OAAO,kBAAkB,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE;QAC1D,UAAU,EAAE,QAAQ;QACpB,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/kernel/settings/compose.d.ts

@@ -0,0 +1,49 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { Redis } from 'ioredis';
+import { SettingsCache } from './settings-cache.js';
+import { SettingsService } from './settings.service.js';
+/**
+ * The universal settings *reader*, composed as kernel infrastructure rather
+ * than as part of the `settings` module (feature 072, T118).
+ *
+ * The split is the one T110 drew for sales channels, for the same reason: a
+ * `SettingsService.get` call backs behaviour in almost every module on the
+ * platform, so it cannot be gated on whether an operator wants the settings
+ * *administration* screens. What the module owns is the admin write surface,
+ * the cache-admin action, the storefront resolvers and its routes.
+ *
+ * `redis` is required here where the module treated it as optional. Both
+ * compositions have always passed one, and the no-cache fallback meant a
+ * settings read hit PostgreSQL on every request — a shape nothing ran and
+ * nothing measured.
+ */
+export interface SettingsKernelOptions {
+    readonly emFactory: () => EntityManager;
+    readonly redis: Redis;
+    /**
+     * Base64 32-byte key for the `secret` value type (feature 043, FR-021), from
+     * `SETTINGS_SECRET_ENCRYPTION_KEY`. Genuinely optional: without it a secret
+     * *write* is refused with `SETTING_SECRET_KEY_MISSING` and legacy plaintext
+     * reads keep working — absence refuses rather than permits, which is why it
+     * survives where the other options did not.
+     */
+    readonly secretEncryptionKey?: string;
+}
+export interface SettingsKernel {
+    readonly settingsService: SettingsService;
+    /**
+     * Handed to the `settings` module as `settingsCache`: it owns the one write
+     * seam, and since issue #45 the seam drops the cache itself rather than
+     * announcing the write and hoping a subscriber gets there first.
+     */
+    readonly cache: SettingsCache;
+    /**
+     * Withdraws this process's cache from the operator-facing clear. Released
+     * for tests; in production it lives until process exit.
+     */
+    readonly cacheRegistration: {
+        readonly dispose: () => void;
+    };
+}
+export declare function composeSettingsKernel(options: SettingsKernelOptions): SettingsKernel;
+//# sourceMappingURL=compose.d.ts.map

package/dist/kernel/settings/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../src/kernel/settings/compose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,aAAa,EAA4B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;CAC9D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAsBpF"}

package/dist/kernel/settings/compose.js

@@ -0,0 +1,21 @@
+import { inProcessCaches } from '../cache/in-process-cache-registry.js';
+import { SettingsCache, SETTINGS_CACHE_NAMESPACE } from './settings-cache.js';
+import { SettingsService } from './settings.service.js';
+export function composeSettingsKernel(options) {
+    const cache = new SettingsCache(options.redis);
+    const settingsService = new SettingsService(options.emFactory, cache, options.secretEncryptionKey);
+    /**
+     * The one thing composing the cache still has to *do*: announce it to the
+     * operator-facing "clear cache" action (issue #33). The clear runs in this
+     * process and has to reach the object that owns both layers, or it drops the
+     * Redis keys while every warm process keeps serving — and re-pinning — the
+     * value it had already resolved.
+     *
+     * It used to ride on `attachSettingsCacheInvalidator`, which also subscribed
+     * to `settings.value_changed`. The subscription is gone (issue #45); the
+     * registration is not, because it never had anything to do with the bus.
+     */
+    const unregister = inProcessCaches.register(SETTINGS_CACHE_NAMESPACE, cache);
+    return { settingsService, cache, cacheRegistration: { dispose: unregister } };
+}
+//# sourceMappingURL=compose.js.map

package/dist/kernel/settings/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../src/kernel/settings/compose.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA6CxD,MAAM,UAAU,qBAAqB,CAAC,OAA8B;IAClE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,IAAI,eAAe,CACzC,OAAO,CAAC,SAAS,EACjB,KAAK,EACL,OAAO,CAAC,mBAAmB,CAC5B,CAAC;IAEF;;;;;;;;;;OAUG;IACH,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IAE7E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC;AAChF,CAAC"}

package/dist/kernel/settings/manifest-reconciler.d.ts

@@ -0,0 +1,78 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type ModuleSettingsManifest } from '@endora-commerce/contracts';
+/**
+ * Manifest reconciler — feature 004 / US1 (T023).
+ *
+ * Walks a list of {@link ModuleSettingsManifest}s and ensures the database
+ * contains every declared group and setting. Idempotent: re-running adds only
+ * missing rows; never overwrites administrator-chosen `setting_values`. Boot
+ * sync NEVER deletes — only `modules:uninstall` removes entries (R-1).
+ *
+ * Errors:
+ *   - {@link ManifestSchemaInvalid} — Zod parse failed.
+ *   - {@link SettingCodeConflict} / {@link GroupCodeConflict} — code owned by
+ *     a different module.
+ *   - {@link BreakingChangeRejected} — `valueType` or `defaultValue` changed
+ *     for an existing code (without `--force`).
+ */
+export declare class ManifestSchemaInvalid extends Error {
+    readonly issues: unknown;
+    readonly name = "ManifestSchemaInvalid";
+    constructor(issues: unknown);
+}
+export declare class SettingCodeConflict extends Error {
+    readonly code: string;
+    readonly existingOwnerModule: string;
+    readonly attemptedOwnerModule: string;
+    readonly name = "SettingCodeConflict";
+    constructor(code: string, existingOwnerModule: string, attemptedOwnerModule: string);
+}
+export declare class GroupCodeConflict extends Error {
+    readonly code: string;
+    readonly existingOwnerModule: string;
+    readonly attemptedOwnerModule: string;
+    readonly name = "GroupCodeConflict";
+    constructor(code: string, existingOwnerModule: string, attemptedOwnerModule: string);
+}
+export declare class BreakingChangeRejected extends Error {
+    readonly settingCode: string;
+    readonly field: 'valueType' | 'defaultValue';
+    readonly previous: unknown;
+    readonly attempted: unknown;
+    readonly name = "BreakingChangeRejected";
+    constructor(settingCode: string, field: 'valueType' | 'defaultValue', previous: unknown, attempted: unknown);
+}
+export interface ReconciliationOptions {
+    /** Bypass {@link BreakingChangeRejected}; existing setting_values are NOT touched even with --force. */
+    force?: boolean;
+    /** Validate manifests and compute the diff but do not write. */
+    dryRun?: boolean;
+}
+export interface ModuleReconciliationResult {
+    moduleCode: string;
+    addedGroups: number;
+    updatedGroups: number;
+    addedSettings: number;
+    updatedSettings: number;
+    orphanGroups: string[];
+    orphanSettings: string[];
+}
+export interface ReconciliationResult {
+    perModule: ModuleReconciliationResult[];
+    totalAddedGroups: number;
+    totalAddedSettings: number;
+}
+export declare class ManifestReconciler {
+    private readonly em;
+    constructor(em: EntityManager);
+    /**
+     * Apply the supplied manifests to the database.
+     *
+     * Within one apply() the manifests are processed in order; later manifests
+     * see earlier ones' groups, but ownership conflicts ALWAYS abort the whole
+     * batch — partial commits are rolled back via the surrounding transaction.
+     */
+    apply(manifests: ModuleSettingsManifest[], options?: ReconciliationOptions): Promise<ReconciliationResult>;
+    private applyOne;
+}
+//# sourceMappingURL=manifest-reconciler.d.ts.map

package/dist/kernel/settings/manifest-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-reconciler.d.ts","sourceRoot":"","sources":["../../../src/kernel/settings/manifest-reconciler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAGL,KAAK,sBAAsB,EAE5B,MAAM,4BAA4B,CAAC;AAKpC;;;;;;;;;;;;;;GAcG;AAEH,qBAAa,qBAAsB,SAAQ,KAAK;aAElB,MAAM,EAAE,OAAO;IAD3C,SAAkB,IAAI,2BAA2B;gBACrB,MAAM,EAAE,OAAO;CAG5C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAG1B,IAAI,EAAE,MAAM;aACZ,mBAAmB,EAAE,MAAM;aAC3B,oBAAoB,EAAE,MAAM;IAJ9C,SAAkB,IAAI,yBAAyB;gBAE7B,IAAI,EAAE,MAAM,EACZ,mBAAmB,EAAE,MAAM,EAC3B,oBAAoB,EAAE,MAAM;CAO/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;aACZ,mBAAmB,EAAE,MAAM;aAC3B,oBAAoB,EAAE,MAAM;IAJ9C,SAAkB,IAAI,uBAAuB;gBAE3B,IAAI,EAAE,MAAM,EACZ,mBAAmB,EAAE,MAAM,EAC3B,oBAAoB,EAAE,MAAM;CAO/C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,WAAW,EAAE,MAAM;aACnB,KAAK,EAAE,WAAW,GAAG,cAAc;aACnC,QAAQ,EAAE,OAAO;aACjB,SAAS,EAAE,OAAO;IALpC,SAAkB,IAAI,4BAA4B;gBAEhC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,WAAW,GAAG,cAAc,EACnC,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO;CAQrC;AAED,MAAM,WAAW,qBAAqB;IACpC,wGAAwG;IACxG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAiBD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;;;;OAMG;IACG,KAAK,CACT,SAAS,EAAE,sBAAsB,EAAE,EACnC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC;YA8ClB,QAAQ;CA4OvB"}