@namzu/sandbox 15.0.0 → 17.0.0

package/dist/backends/kubernetes/egress-policy.d.ts

@@ -134,12 +134,16 @@ export type KubernetesEgressPolicy = EgressPolicy | KubernetesOnlyEgressPolicy;
  *
  *  - `'union'` (the default) reads the NAMED object exactly as before AND
  *    enumerates every `NetworkPolicy` — and, under `engine: 'cilium'`, every
- *    `CiliumNetworkPolicy` — in the namespace, refusing when any policy that
- *    selects the pod allows egress the configured translation does not. That
- *    is not belt-and-braces: the API server UNIONS every policy selecting a
- *    pod, so a second policy widens egress however exactly the named one
- *    matches, and a `SandboxTemplate`'s own `networkPolicy` block becomes
- *    exactly such a policy.
+ *    `CiliumNetworkPolicy` — in the namespace, refusing when any OTHER policy
+ *    that selects the pod allows egress the configured translation does not.
+ *    The named object is left to the exact comparison, which is stronger than
+ *    anything this rule could conclude about it — see
+ *    {@link EgressPolicyDocument.namedObject} — and still counts as the policy
+ *    that default-denies, so it is the enumeration's subject rather than an
+ *    exception to it. That is not belt-and-braces: the API server UNIONS every
+ *    policy selecting a pod, so a second policy widens egress however exactly
+ *    the named one matches, and a `SandboxTemplate`'s own `networkPolicy`
+ *    block becomes exactly such a policy.
  *  - `'named-object-only'` is the documented opt-out, and restores the
  *    previous behaviour exactly: one GET of the named object, memoized for
  *    the backend's lifetime, and no enumeration. For a deployment whose
@@ -808,24 +812,33 @@ export declare class KubernetesEgressNarrowingUnsupportedError extends Error {
  * `CiliumNetworkPolicy` carrying one is an object the API server rejects on
  * apply — or, worse, accepts as a name that resolves to nothing, which reads
  * from the outside exactly like a policy that is working.
- *
- * `stateHostnameGrammar` is the one part of the message a caller can turn
- * off, because NOT every refusal can make that claim. It is false for the
- * config-level refusal of a leading-dot entry under `tlsServerNames`, whose
- * body has just said that the entry reaches the object as a literal
- * `matchName` admitting nothing with the option on or off: closing that
- * message with "'.example.com' for that domain and its subdomains" would
- * re-assert, as implemented, the very grammar whose absence is why the entry
- * is refused. Every other refusal keeps the sentence, the expanding branch of
- * the same one included.
  */
 export declare class KubernetesNetworkPolicyHostError extends Error {
     readonly host: string;
     readonly name = "KubernetesNetworkPolicyHostError";
-    constructor(host: string, reason: string, options?: {
-        readonly stateHostnameGrammar?: boolean;
-    });
+    constructor(host: string, reason: string);
 }
+/**
+ * The one grammar an `allowedHosts` entry has to satisfy, on EVERY path that
+ * emits one.
+ *
+ * It lives here, beside the class it throws, rather than in the per-sandbox
+ * module that first needed it: it is called from {@link
+ * buildCiliumEgressManifest} — the single builder both translations go
+ * through — so the config-level allowlist and a `setNetworkPolicy` list are
+ * refused the SAME entries, by name, with nothing emitted. That is the
+ * contract {@link KubernetesNetworkPolicyHostError} already states — it
+ * names entries rather than a config field, for exactly this reason — and a
+ * grammar only ONE of the two translations enforces is not one the other has:
+ * that is how the config-level translation came to pass `'.com'`, `'.'`,
+ * `'..example.com'`, `'*'` and an IP literal straight into the emitted
+ * `toFQDNs`, where the per-sandbox path refused every one of them.
+ *
+ * The per-sandbox writer still calls it too — {@link normalizeHost}, which
+ * lowercases and then calls this — because there it also CANONICALISES the
+ * bytes, before the fence is read and before anything is queued.
+ */
+export declare function assertUsableHost(entry: string): void;
 /**
  * Every entry in `narrowing.ports`, `narrowing.hostPorts` and
  * `narrowing.tlsPorts` is a port the API server will actually accept, none of
@@ -858,17 +871,23 @@ export declare function assertCiliumNarrowingIsUsable(narrowing: KubernetesCiliu
  */
 export declare function assertEgressPolicyIsEnforceable(policy: KubernetesEgressPolicy, engine: KubernetesEgressEngine, narrowing?: KubernetesCiliumEgressNarrowing): void;
 /**
- * Which translation a host refusal is being spelled for, as ONE value.
- *
- * The refusal has two halves that have to agree — the sentence, which follows
- * from whether the translation expands a leading-dot entry, and the field
- * path, which follows from which field the caller set — and both are facts
- * about the SAME thing: the translation the caller is on. Passed as two
- * arguments they are decided from two inputs, and an expanding caller was
- * told to repair `config.egress.ciliumNarrowing` with the remedy that belongs
- * to `config.egress.perSandbox.narrowing` — a message sending a reader to a
- * field the entry never came from. Neither half means anything without the
- * other, so they travel together.
+ * Which field a host refusal sends the reader to — the ONE thing about a
+ * refusal that is still a fact about the caller rather than about the entry.
+ *
+ * It was two facts while the two translations differed in what they emitted:
+ * the sentence, which followed from whether the translation expanded a
+ * leading-dot entry, and the field path, which followed from which field the
+ * caller set. The config-level translation used to expand nothing, so it was
+ * both a different sentence and a different field; it now expands exactly as
+ * the per-sandbox one does, one entry no longer means two things, and the
+ * sentence is the same one on every path — so the field path is all that is
+ * left to get right, which is why it is the only field here.
+ *
+ * It still travels as one value rather than as a loose string argument,
+ * because there are exactly two legal ones and both are named below: a refusal
+ * is raised from the translation AND, earlier still, from the per-sandbox
+ * writer before it reads the fence, and the two have to name the same field
+ * for one entry however the earlier check is reached or skipped.
  */
 export interface HostsFitNarrowingContext {
     /**
@@ -876,18 +895,10 @@ export interface HostsFitNarrowingContext {
      * — the full path, as every other refusal in this module spells one.
      */
     readonly fieldPath: string;
-    /**
-     * Whether this translation turns a leading-dot entry into a `matchName`
-     * plus a `matchPattern` — {@link ciliumFqdnEntries}. `true` for the
-     * per-sandbox translation, `false` for the config-level one, whose emitted
-     * bytes are pinned. Decides the refusal's sentence and its closing grammar
-     * as well as the bytes, and all three are the same fact about one entry.
-     */
-    readonly expandsDottedEntries: boolean;
 }
 /**
- * The refusal context of the PER-SANDBOX translation — the one that expands,
- * and so the one `expandDomains: true` builds.
+ * The refusal context of the PER-SANDBOX translation — `egress.perSandbox`,
+ * whose allowlist comes from a host's own `setNetworkPolicy` call.
  *
  * Shared deliberately: the per-sandbox writer refuses a host by this context
  * before it reads the fence, and {@link buildCiliumEgressManifest} refuses the
@@ -898,7 +909,7 @@ export interface HostsFitNarrowingContext {
 export declare const PER_SANDBOX_NARROWING_REFUSAL: HostsFitNarrowingContext;
 /**
  * The refusal context of the config-level translation — `config.egress.policy`
- * and its `config.egress.ciliumNarrowing`, which expands nothing.
+ * and its `config.egress.ciliumNarrowing`.
  */
 export declare const CONFIG_LEVEL_NARROWING_REFUSAL: HostsFitNarrowingContext;
 /**
@@ -907,72 +918,69 @@ export declare const CONFIG_LEVEL_NARROWING_REFUSAL: HostsFitNarrowingContext;
  * `tlsServerNames` puts the entry on the rule as a TLS server name — one
  * exact SNI value a handshake presents — and a `.domain` entry is a set of
  * names no single SNI value means. Either way the emitted object would be
- * admitted by the shipped fence, read back deep-equal to what was sent, and
- * deny what the caller asked to allow — the failure every other refusal in
- * this module exists to prevent. Refused rather than translated another way,
+ * applied without complaint — nothing refuses an operator's apply: the
+ * shipped admission fence's `matchConditions` scope it to the sandbox host's
+ * ServiceAccount, so the config-level object is not matched by it — read back
+ * deep-equal to what was sent, and deny what the caller asked to allow — the
+ * failure every other refusal in this module exists to prevent. Refused
+ * rather than translated another way,
  * because both other ways are guesses: dropping the subdomains silently
  * narrows what the caller asked for, and a wildcard SNI value is not
  * something the Cilium versions these manifests are written against are
  * known here to match — an SNI that matches nothing denies just as
  * completely, and more quietly.
  *
- * The entry is refused for a DIFFERENT reason on each of the two paths, and
- * the message says which one the caller is on, because the same sentence
- * cannot be true of both:
- *
- *  - `expandDomains` — the per-sandbox writer's translation, which turns
- *    `.domain` into `matchName: domain` PLUS `matchPattern: '*.domain'`. No
- *    single SNI value means that pair: `domain` alone denies every subdomain
- *    the pattern admits, and the entry as written is not a name any handshake
- *    presents at all.
- *  - unexpanded — the config-level translation, which expands nothing. There
- *    the entry reaches the object as the literal `matchName: '.domain'`,
- *    which no DNS answer carries, so it already admits nothing; `serverNames`
- *    on top of it is a second, independent denial. Telling this caller to
- *    "leave tlsServerNames off for a domain list" would name a repair that is
- *    not one — the config-level `.domain` entry denies the domain and every
- *    subdomain with or without the option (a pre-existing defect of this
- *    translation, deferred to its own change) — so it is not offered here.
- *
- * `context` is WHICH translation the refusal is being spelled for, as one
- * value — see {@link HostsFitNarrowingContext}. A reader has to be sent to
- * the field they actually set, and the sentence they are sent by has to be
- * true of the translation they are on, and both follow from that one fact:
- * passed separately, an expanding caller gets the per-sandbox remedy attached
- * to the config-level field name, a message whose only repair is a field the
- * entry never came from. Called from BOTH — the translation itself, so every
- * caller is covered, and the per-sandbox writer, which refuses earlier still,
- * before it reads the fence.
+ * One sentence, because one entry now means one thing: both translations turn
+ * `.domain` into `matchName: domain` PLUS `matchPattern: '*.domain'` — see
+ * {@link ciliumFqdnEntries} — and no single SNI value means that pair.
+ * `domain` alone denies every subdomain the pattern admits, and the entry as
+ * written is not a name any handshake presents at all.
+ *
+ * `context` is the field the refusal sends the reader to — see
+ * {@link HostsFitNarrowingContext}. A reader has to be sent to the field they
+ * actually set: passed as a loose string, an expanding caller was told to
+ * repair `config.egress.ciliumNarrowing` with the remedy that belongs to
+ * `config.egress.perSandbox.narrowing`, a message whose only repair is a field
+ * the entry never came from. Called from BOTH — the translation itself, so
+ * every caller is covered, and the per-sandbox writer, which refuses earlier
+ * still, before it reads the fence.
  */
 export declare function assertHostsFitNarrowing(allowedHosts: readonly string[], narrowing: KubernetesCiliumEgressNarrowing | undefined, context: HostsFitNarrowingContext): void;
 /**
  * One allowlist entry, expanded to the `toFQDNs` entries it means.
  *
- * `SandboxNetworkPolicy.allowedHosts`'s own grammar, which the SDK states and
- * the docker backend implements: `api.example.com` is that host, and
- * `.example.com` is the domain AND its subdomains. Cilium's `matchName` is an
- * exact name and does not match across a `.`, so the domain form needs the
- * name plus a `matchPattern` — `*.example.com` alone would admit
- * `a.example.com` and not `example.com` itself.
- *
- * Used by the PER-SANDBOX policy only. The config-level translation
- * (`config.egress.policy`) deliberately does not expand anything: what it
- * emits for a given config is pinned byte-for-byte, because verification of
- * the named object is an exact match and a changed translation fails every
- * `create()` on every deployment that already applied a policy.
+ * `SandboxNetworkPolicy.allowedHosts`'s own grammar, which the SDK states —
+ * `packages/sdk/src/types/sandbox/index.ts`'s `allowedHosts` — and which
+ * `src/egress/allowlist.ts` implements for the docker backend: `api.example.com`
+ * is that host, and `.example.com` is the domain AND its subdomains. Cilium's
+ * `matchName` is an exact name and does not match across a `.`, so the domain
+ * form needs the name plus a `matchPattern` — `*.example.com` alone would
+ * admit `a.example.com` and not `example.com` itself.
+ *
+ * Used by BOTH translations. The config-level one used to emit a leading-dot
+ * entry verbatim instead, which no DNS answer carries and so denied the
+ * domain and every subdomain it was asked to allow, after a create that
+ * reported success — but "the config-level bytes are pinned" was never a
+ * contract the pinned bytes honoured, and one entry has to mean one thing on
+ * every backend.
  */
 export declare function ciliumFqdnEntries(entry: string): readonly Readonly<Record<string, string>>[];
 /**
  * Everything a `CiliumNetworkPolicy` for a hostname allowlist is built from.
  *
  * ONE builder, two callers: the config-level translation below, whose
- * selector is the template (and profile) label and whose emitted bytes are
- * pinned, and the per-sandbox policy in `per-sandbox-policy.ts`, whose
- * selector is one per-sandbox label and which additionally carries an
- * `ownerReferences` entry so the cluster garbage-collects it. A second
- * builder would be a second answer to what a namzu egress policy looks like,
- * and the read-back comparator would then be verifying one of them against
- * the other's shape.
+ * selector is the template (and profile) label, and the per-sandbox policy in
+ * `per-sandbox-policy.ts`, whose selector is one per-sandbox label and which
+ * additionally carries an `ownerReferences` entry so the cluster
+ * garbage-collects it. A second builder would be a second answer to what a
+ * namzu egress policy looks like, and the read-back comparator would then be
+ * verifying one of them against the other's shape.
+ *
+ * The two callers now differ in nothing this interface cannot spell out: the
+ * same entries become the same bytes and a refusal uses the same sentence on
+ * both, so what is left of "which caller this is" is
+ * {@link CiliumEgressManifestOptions.refusalContext} — the field a refusal
+ * names.
  */
 export interface CiliumEgressManifestOptions {
     readonly namespace: string;
@@ -986,17 +994,17 @@ export interface CiliumEgressManifestOptions {
     /** `metadata.ownerReferences`. Absent ⇒ the metadata is what it always was. */
     readonly ownerReferences?: readonly KubernetesOwnerReference[];
     /**
-     * Expand a leading-dot entry into `matchName` plus `matchPattern` — see
-     * {@link ciliumFqdnEntries}. Off by default, because the config-level
-     * translation's emitted bytes are pinned.
+     * The field a refusal for one of these hosts sends its reader to — see
+     * {@link HostsFitNarrowingContext}. REQUIRED, not defaulted: there is no
+     * way to tell from inside this function which config the caller's hosts
+     * came from, and a refusal that names a field the caller never set is a
+     * remedy that does not exist for them.
      *
-     * This option IS the translation, not a formatting flag on it: it selects
-     * the emitted bytes, the sentence a refusal carries and the field that
-     * refusal names, all from one value — see
-     * {@link HostsFitNarrowingContext}. There is no way to ask for one without
-     * the others, and none should be added.
+     * The bytes are not this option's business any more, and neither is the
+     * sentence a refusal uses: there is one translation of an allowlist entry,
+     * so both are the same for every caller whatever this says.
      */
-    readonly expandDomains?: boolean;
+    readonly refusalContext: HostsFitNarrowingContext;
 }
 export declare function buildCiliumEgressManifest(options: CiliumEgressManifestOptions): KubernetesTranslatedEgressPolicy;
 /**
@@ -1045,8 +1053,16 @@ export declare class KubernetesEgressPolicyMismatchError extends Error {
  * `../docker/index.ts`'s `assertNetworkCarriesThePolicy`, which inspects the
  * daemon's own `{{.Internal}}` flag instead of trusting a network's name.
  *
- * Checks exactly three things, each named separately in a mismatch so an
- * operator sees which one to fix:
+ * Checks four things, each named separately in a mismatch so an operator sees
+ * which one to fix:
+ *  - the object carries NO `specs` list. A `CiliumNetworkPolicy` carries
+ *    EITHER one `spec` or a `specs` list and a rule in either one enforces,
+ *    while every check below reads `spec` alone — so an object carrying both
+ *    would be compared on half of what it enforces. This is refused and not
+ *    read, because a comparison that accepts rules it never looked at is the
+ *    one answer this function must not give; the shipped admission fence
+ *    refuses a `specs` list for the same reason. The translation never emits
+ *    one, so its presence is drift and not an alternative spelling;
  *  - the selector (`podSelector` for `NetworkPolicy`, `endpointSelector` for
  *    `CiliumNetworkPolicy`) carries the expected template label:
  *  - `NetworkPolicy` additionally declares `policyTypes` including
@@ -1151,6 +1167,23 @@ export interface EgressAllowance {
     readonly permitsNothing: boolean;
     /** The configured kind, for the refusal message. */
     readonly policyKind: KubernetesEgressPolicy['kind'];
+    /**
+     * The object this allowance is the allowance OF — `translated.kind` and
+     * `translated.name`, the object `config.egress` translates to and an
+     * operator applies.
+     *
+     * The union rule reads every OTHER policy in the namespace against this
+     * allowance, and this pair is what says which of the listed objects is the
+     * named one, so {@link decideEgressUnion} can leave that object's `spec`
+     * document to {@link verifyEgressPolicyApplied} instead of judging it here.
+     * See {@link EgressPolicyDocument.namedObject} for what that comparison
+     * reads, which documents it covers, and why the exemption is not an
+     * optimisation.
+     */
+    readonly namedObject: {
+        readonly kind: 'NetworkPolicy' | 'CiliumNetworkPolicy';
+        readonly name: string;
+    };
 }
 /**
  * The allowance a translated policy expresses. See {@link EgressAllowance}.
@@ -1230,6 +1263,50 @@ export interface EgressPolicyDocument {
     readonly rules: readonly EgressRuleVerdict[];
     /** Set when the OBJECT could not be read. It decides alone. */
     readonly unreadable?: string;
+    /**
+     * This document is the one {@link verifyEgressPolicyApplied} compared to
+     * the translation on this same create path, before this check runs: the
+     * document built from the named object's `spec`, and nothing else.
+     *
+     * Marked so {@link decideEgressUnion} does not judge its RULES, because
+     * the translation's own allowance cannot express one of them.
+     * `egressAllowance` records a `toFQDNs` entry by its `matchName`, while a
+     * `.domain` entry the translation emits is a `matchName` PLUS a
+     * `matchPattern` — so the pattern half read as widening and the check
+     * refused the very object it had just told the operator to apply,
+     * permanently and on every `create()`.
+     *
+     * What the exempting comparison actually reads, because this marking is
+     * only as sound as it is: `spec.podSelector`/`spec.endpointSelector`,
+     * `spec.policyTypes` (core), `spec.egress`, and any `metadata.ownerReferences`
+     * the translation carries. It is NOT a comparison of the whole object, so
+     * the marking is scoped to what it covers:
+     *
+     *  - Only the document built from `item.spec` is marked. A document built
+     *    from an `item.specs` entry is judged by {@link decideEgressUnion} like
+     *    any other object's — a rule in either spelling enforces, so a `specs`
+     *    entry that allows more than the translation is refused by name.
+     *  - {@link verifyEgressPolicyApplied} REFUSES a live object carrying a
+     *    `specs` list at all, which is what makes the first point airtight
+     *    rather than merely narrower: the translation never emits one, and half
+     *    of what such an object enforces would be rules that comparison never
+     *    read.
+     *
+     * What is NOT redundant, and the reason the document stays in the
+     * enumeration at all, is whether it puts this pod in egress default-deny:
+     * dropping it would report a deployment whose only applied policy is the
+     * named one as having no boundary at all, which is a deployment that
+     * verifies today.
+     *
+     * The cost is stated rather than hidden: the named check is memoized on
+     * success for the boundary's lifetime, so a named object that drifts WIDER
+     * after its own check has passed is no longer caught by this one — it is
+     * caught by the named comparison at the next construction. Before this
+     * exemption there was a second net under a five-minute cache; the
+     * alternative is a check that refuses the object it has just told an
+     * operator to apply.
+     */
+    readonly namedObject?: boolean;
 }
 /** Every core `NetworkPolicy` in the list, reduced to {@link EgressPolicyDocument}. */
 export declare function readCoreEgressPolicies(items: readonly unknown[], target: EgressVerificationTarget, allowance: EgressAllowance): EgressPolicyDocument[];
@@ -1252,6 +1329,15 @@ export interface EgressUnionDecision {
  * translation is the finding however many narrower ones sit beside it, and a
  * pod no policy default-denies has no egress boundary at all whatever the
  * named object says.
+ *
+ * The named object's `spec` is the one document whose rules are not judged
+ * here — see {@link EgressPolicyDocument.namedObject} — and it was compared to
+ * the translation by {@link verifyEgressPolicyApplied} on the same create path
+ * just before. Its SELECTOR and its egress-scoping still decide, which is what
+ * keeps "nothing bounds this pod" answerable for a deployment whose only
+ * policy is that one; and a document built from a `specs` entry is judged here
+ * like any other object's, because the exempting comparison refuses an object
+ * carrying a `specs` list rather than reading one.
  */
 export declare function decideEgressUnion(documents: readonly EgressPolicyDocument[], allowance: EgressAllowance): EgressUnionDecision;
 /**
@@ -1283,7 +1369,12 @@ export declare class KubernetesEgressPolicyUnionError extends Error {
  * Verify-not-trust, widened from one object to the union: list the
  * namespace's policies, evaluate every one that selects this pod against the
  * configured translation, and refuse unless nothing lets out more than
- * `config.egress` says.
+ * `config.egress` says. The named object's `spec` document is the one
+ * exception, and it was compared to the translation by
+ * {@link verifyEgressPolicyApplied} on this same create path just before this
+ * one — see {@link EgressPolicyDocument.namedObject}: a Cilium object that
+ * carries a `specs` list is refused there outright, so a `specs` entry is
+ * judged HERE, like any other object's rules.
  *
  * Runs beside the ingress check on every create path — before the POST for a
  * directly created Sandbox, where the labels are known and a refusal leaves

package/dist/backends/kubernetes/egress-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"egress-policy.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAKlD,OAAO,EACN,KAAK,aAAa,EAElB,KAAK,kBAAkB,EAWvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAc5D;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,0BAA0B,CAAA;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,mBAAmB,CAAA;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,4BAA4B;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,4BAA4B,CAAA;IAC1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,+BAA+B,CAAA;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gCAAgC,CAAA;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,gCAAgC;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;CACpD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,oCAAoC,CAAA;AAEjF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAwBD;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,iBAAiB;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,wCAAuC;gBAGnD,KAAK,EAAE,SAAS,GAAG,iBAAiB,EACpC,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,kBAAkB,GAAG,SAAS,CAmBhC;AA+CD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,wCAAwC,CAAA;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,UAAU;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,2CAA0C;gBAGtD,KAAK,EAAE,QAAQ,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,UAAU,EACnF,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CA2BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAyC/F;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,8CAA+C,SAAQ,KAAK;IACxE,SAAkB,IAAI,oDAAmD;;CAOzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CACvD,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,IAAI,CAGN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACtC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAalC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,2EAA2E;IAC3E,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB;IAZtC,SAAkB,IAAI,sCAAqC;;IAG1D,2EAA2E;IAClE,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACpD,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IAC9D,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IACjD,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IAC5D,OAAO,CAAC,EAAE,kBAAkB,YAAA;CAMtC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,kBAAkB;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAN1D,SAAkB,IAAI,wCAAuC;;IAG5D,uEAAuE;IAC9D,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAM1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,OAAO,CAET;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,kBAAkB,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACpD;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAW7F;AAED;;;;;;GAMG;AACH,qBAAa,wCAAyC,SAAQ,KAAK;IAGtD,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU;IAFtD,SAAkB,IAAI,8CAA6C;gBAE9C,UAAU,EAAE,QAAQ,GAAG,UAAU;CAKtD;AAED;;;;;;;GAOG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAI1D,QAAQ,CAAC,KAAK,EAAE,MAAM;IAHvB,SAAkB,IAAI,uCAAsC;gBAGlD,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CASf;AAED;;;;;;;GAOG;AACH,qBAAa,yCAA0C,SAAQ,KAAK;IAIlE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAJxC,SAAkB,IAAI,+CAA8C;gBAG1D,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,MAAM,EAAE,sBAAsB;CAMxC;AAUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHtB,SAAkB,IAAI,sCAAqC;gBAGjD,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QAAE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAO;CAO1D;AAED;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC5C,SAAS,EAAE,+BAA+B,EAC1C,SAAS,SAAoB,GAC3B,IAAI,CAkDN;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC9C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,+BAA+B,GACzC,IAAI,CAoBN;AAyMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,EAAE,wBAG3C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,wBAG5C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,uBAAuB,CACtC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,+BAA+B,GAAG,SAAS,EACtD,OAAO,EAAE,wBAAwB,GAC/B,IAAI,CAkBN;AA8DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAI5F;AAyDD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;IACpD,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC9D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,2BAA2B,GAClC,gCAAgC,CAmElC;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,+BAA+B,GAC/C,OAAO,CAAC,gCAAgC,CAAC,CAqC3C;AAED;;;;;;GAMG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJtB,SAAkB,IAAI,2CAA0C;gBAGtD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM;CAMtB;AAED,gFAAgF;AAChF,qBAAa,mCAAoC,SAAQ,KAAK;IAI5D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALxB,SAAkB,IAAI,yCAAwC;gBAGpD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAMxB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAwEf;AAWD,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAuDD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAgB/D;AAyBD,mFAAmF;AACnF,UAAU,SAAS;IAClB,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAKD,gEAAgE;AAChE,KAAK,UAAU,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,CAAA;AAEJ,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAED,kFAAkF;AAClF,UAAU,WAAW;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAkBD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAA;IACtC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,CAAA;IACjD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;CACnD;AAsED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,gCAAgC,GAAG,eAAe,CA6F7F;AAqID,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AA2WD,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB;AAC9B,qEAAqE;AACnE,QAAQ;AACV,kEAAkE;GAChE,eAAe;AACjB,oDAAoD;GAClD,iBAAiB;AACnB,iFAAiF;GAC/E,mBAAmB;AACrB,mDAAmD;GACjD,eAAe,CAAA;AAElB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAElG;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC5B;AAiBD,uFAAuF;AACvF,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CA4CxB;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CA2CxB;AA8CD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAA;IAClD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KACxB,CAAA;CACD;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,SAAS,oBAAoB,EAAE,EAC1C,SAAS,EAAE,eAAe,GACxB,mBAAmB,CAkGrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE;IAElD,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE;IAV/C,SAAkB,IAAI,sCAAqC;gBAGjD,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EAClD,OAAO,EAAE,MAAM;IACf,iEAAiE;IACxD,MAAM,GAAE,SAAS,kBAAkB,EAAO;CAMpD;AAuCD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAqDf"}
+{"version":3,"file":"egress-policy.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAKlD,OAAO,EACN,KAAK,aAAa,EAElB,KAAK,kBAAkB,EAWvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAA8B,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAc5D;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,QAAQ,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,YAAY,GAAG,0BAA0B,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,mBAAmB,CAAA;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,4BAA4B;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,4BAA4B,CAAA;IAC1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,+BAA+B,CAAA;IAC1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gCAAgC,CAAA;CACtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,gCAAgC;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;CACpD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,oCAAoC,CAAA;AAEjF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAwBD;;;;;;;;;;GAUG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,iBAAiB;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,wCAAuC;gBAGnD,KAAK,EAAE,SAAS,GAAG,iBAAiB,EACpC,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,kBAAkB,GAAG,SAAS,CAmBhC;AA+CD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAE5F;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oCAAoC,wCAAwC,CAAA;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,UAAU;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJvB,SAAkB,IAAI,2CAA0C;gBAGtD,KAAK,EAAE,QAAQ,GAAG,qBAAqB,GAAG,4BAA4B,GAAG,UAAU,EACnF,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CAMf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CA2BpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAyC/F;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,8CAA+C,SAAQ,KAAK;IACxE,SAAkB,IAAI,oDAAmD;;CAOzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CACvD,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,IAAI,CAGN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACtC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAalC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,2EAA2E;IAC3E,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB;IAZtC,SAAkB,IAAI,sCAAqC;;IAG1D,2EAA2E;IAClE,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACpD,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;IAC1B,uEAAuE;IAC9D,gBAAgB,EAAE,MAAM;IACjC,0DAA0D;IACjD,iBAAiB,EAAE,MAAM;IAClC,qEAAqE;IAC5D,OAAO,CAAC,EAAE,kBAAkB,YAAA;CAMtC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,kCAAmC,SAAQ,KAAK;IAI3D,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,kBAAkB;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAN1D,SAAkB,IAAI,wCAAuC;;IAG5D,uEAAuE;IAC9D,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAM1D;AAED,8EAA8E;AAC9E,wBAAgB,8BAA8B,CAC7C,MAAM,EAAE,sBAAsB,GAAG,SAAS,GACxC,OAAO,CAET;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,kBAAkB,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKlC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACpD;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAW7F;AAED;;;;;;GAMG;AACH,qBAAa,wCAAyC,SAAQ,KAAK;IAGtD,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU;IAFtD,SAAkB,IAAI,8CAA6C;gBAE9C,UAAU,EAAE,QAAQ,GAAG,UAAU;CAKtD;AAED;;;;;;;GAOG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAI1D,QAAQ,CAAC,KAAK,EAAE,MAAM;IAHvB,SAAkB,IAAI,uCAAsC;gBAGlD,KAAK,EAAE,MAAM,EACtB,MAAM,EAAE,MAAM;CASf;AAED;;;;;;;GAOG;AACH,qBAAa,yCAA0C,SAAQ,KAAK;IAIlE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAJxC,SAAkB,IAAI,+CAA8C;gBAG1D,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,MAAM,EAAE,sBAAsB;CAMxC;AAUD;;;;;;;;;;;;GAYG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHtB,SAAkB,IAAI,sCAAqC;gBAGjD,IAAI,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM;CAMf;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAyDpD;AAqBD;;;;;;;;GAQG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC5C,SAAS,EAAE,+BAA+B,EAC1C,SAAS,SAAoB,GAC3B,IAAI,CAkDN;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC9C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,SAAS,CAAC,EAAE,+BAA+B,GACzC,IAAI,CAoBN;AAyMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,wBAAwB;IACxC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,EAAE,wBAE3C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,wBAE5C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,uBAAuB,CACtC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,+BAA+B,GAAG,SAAS,EACtD,OAAO,EAAE,wBAAwB,GAC/B,IAAI,CASN;AAqED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAI5F;AA2DD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAA;IACpD,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAC9D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAA;CACjD;AAED,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,2BAA2B,GAClC,gCAAgC,CAwElC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CAC1C,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,kBAAkB,EAC1B,eAAe,CAAC,EAAE,+BAA+B,GAC/C,OAAO,CAAC,gCAAgC,CAAC,CAqC3C;AAED;;;;;;GAMG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAI9D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJtB,SAAkB,IAAI,2CAA0C;gBAGtD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM;CAMtB;AAED,gFAAgF;AAChF,qBAAa,mCAAoC,SAAQ,KAAK;IAI5D,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALxB,SAAkB,IAAI,yCAAwC;gBAGpD,YAAY,EAAE,eAAe,GAAG,qBAAqB,EACrD,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAMxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAoGf;AAWD,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAuDD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAgB/D;AAyBD,mFAAmF;AACnF,UAAU,SAAS;IAClB,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAKD,gEAAgE;AAChE,KAAK,UAAU,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACpB,CAAA;AAEJ,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAED,kFAAkF;AAClF,UAAU,WAAW;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,SAAS,EAAE,CAAA;CAC5C;AAkBD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAA;IACtC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,EAAE,KAAK,GAAG,SAAS,MAAM,EAAE,CAAA;IACjD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAA;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;QACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KACrB,CAAA;CACD;AAsED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,gCAAgC,GAAG,eAAe,CA+F7F;AAqID,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AA2WD,wCAAwC;AACxC,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB;AAC9B,qEAAqE;AACnE,QAAQ;AACV,kEAAkE;GAChE,eAAe;AACjB,oDAAoD;GAClD,iBAAiB;AACnB,iFAAiF;GAC/E,mBAAmB;AACrB,mDAAmD;GACjD,eAAe,CAAA;AAElB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAElG;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CAAA;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC9B;AA+CD,uFAAuF;AACvF,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CA6CxB;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CACvC,KAAK,EAAE,SAAS,OAAO,EAAE,EACzB,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,eAAe,GACxB,oBAAoB,EAAE,CAqDxB;AAwDD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAA;IAClD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KACxB,CAAA;CACD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,SAAS,oBAAoB,EAAE,EAC1C,SAAS,EAAE,eAAe,GACxB,mBAAmB,CA8GrB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,OAAO,EAAE,mBAAmB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE;IAElD,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE;IAV/C,SAAkB,IAAI,sCAAqC;gBAGjD,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,UAAU,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAC1C,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EAClD,OAAO,EAAE,MAAM;IACf,iEAAiE;IACxD,MAAM,GAAE,SAAS,kBAAkB,EAAO;CAMpD;AAuCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,gCAAgC,EAC5C,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAqDf"}