@oneuptime/common 12.0.33 → 12.0.34

package/build/dist/Server/Utils/SessionReplay/SessionReplayGateCache.js

@@ -9,18 +9,31 @@ import SessionReplayConsentMode from "../../../Types/Rum/SessionReplayConsentMod
 import { parseSessionReplayMaskingMode, } from "../../../Types/Rum/SessionReplayMaskingMode";
 import { DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS, SESSION_REPLAY_ALLOWED_RETENTION_DAYS, } from "../../../Types/Rum/SessionReplay";
 import SessionIdentity from "../../../Utils/Rum/SessionIdentity";
+import OriginAllowList from "../../../Utils/Telemetry/OriginAllowList";
+/*
+ * RumApplication.sessionReplaySamplePercentage's column default. Declared
+ * here rather than read off the model because this file compiles against
+ * checkouts whose model predates the column (see buildSelect).
+ */
+const DEFAULT_SESSION_REPLAY_SAMPLE_PERCENTAGE = 100;
 /*
  * Resolves the session-replay policy for one (project, appIdentifier) pair,
  * which is what all three ingest-time gates need: the org-wide allow flag,
  * the per-application enable flag, and the origin allowlist.
  *
- * Every default in here is the REFUSING one. An application that has never
- * been configured, a project that has never opted in, a row whose policy
- * columns have not been migrated yet, and a lookup that fails outright all
- * resolve to "do not accept recordings". That is the opposite posture from
- * the log and trace scrub loaders, which continue with empty rules on
- * failure, and it is deliberate: a span recorded by mistake is a span, a
- * session recorded by mistake is a video of a real person.
+ * The two SWITCHES default to refusing. An application that has never been
+ * configured, a project that has never opted in, a row whose enable columns
+ * have not been migrated yet, and a lookup that fails outright all resolve
+ * to "do not accept recordings". That is the opposite posture from the log
+ * and trace scrub loaders, which continue with empty rules on failure, and
+ * it is deliberate: a span recorded by mistake is a span, a session
+ * recorded by mistake is a video of a real person.
+ *
+ * Once both switches say yes, the remaining policy columns default to what
+ * the MODEL defaults to (consent NotRequired, trigger Always, sample 100),
+ * because those are instructions to a recorder the customer has already
+ * switched on, and a silent downgrade to "record nothing" is the failure
+ * the Dashboard cannot explain. See loadPolicy.
  *
  * Cache shape follows the house convention for hot-path policy (a
  * process-local Map with a 60s TTL, as in LogScrubRuleService), with one
@@ -70,6 +83,40 @@ const RUM_APPLICATION_POLICY_COLUMNS = [
 const PROJECT_POLICY_COLUMNS = [
     "isSessionReplayAllowed",
 ];
+/*
+ * WHY a policy lookup came back empty.
+ *
+ * getPolicy() folds every refusing state into null, which is the right
+ * shape for the gate (it must refuse, and the recorder is told "stop"), but
+ * the config endpoint, the /validate probe and the health counters all owe
+ * the customer a NAME: a project that was switched off, an application that
+ * was switched off, an identifier that matches no application, and a
+ * project killed by the operator's kill key are four different settings
+ * pages. Answering "not enabled for application" for all four sends the
+ * customer to the wrong one.
+ *
+ * A closed vocabulary that carries no project data; it is only ever
+ * answered to a request already holding a valid ingestion key for the
+ * project.
+ */
+export var SessionReplayPolicyRefusal;
+(function (SessionReplayPolicyRefusal) {
+    /* Project.isSessionReplayAllowed is false: the org-wide switch. */
+    SessionReplayPolicyRefusal["ProjectNotAllowed"] = "project-not-allowed";
+    /* RumApplication.isSessionReplayEnabled is false for this application. */
+    SessionReplayPolicyRefusal["ApplicationNotEnabled"] = "application-not-enabled";
+    /*
+     * No application by that identifier could be found or created. With a
+     * project that allows replay the application is created on first sight,
+     * so this is either a project that does not allow it or a creation that
+     * failed.
+     */
+    SessionReplayPolicyRefusal["ApplicationUnknown"] = "application-unknown";
+    /* The gate cache's Redis kill key is set for the project. */
+    SessionReplayPolicyRefusal["ProjectKilled"] = "project-killed";
+    /* No identifier was supplied at all. */
+    SessionReplayPolicyRefusal["IdentifierMissing"] = "app-identifier-missing";
+})(SessionReplayPolicyRefusal || (SessionReplayPolicyRefusal = {}));
 export default class SessionReplayGateCache {
     /*
      * Resolve the policy for one application.
@@ -81,36 +128,63 @@ export default class SessionReplayGateCache {
      * produce different HTTP answers - a terminal 204 that stops the
      * recorder, versus a retryable 503 that does not silently discard a
      * recording during a database blip.
+     *
+     * Callers that need to say WHY the answer was null use resolvePolicy.
      */
     static async getPolicy(data) {
+        const resolution = await this.resolvePolicy(data);
+        return resolution.policy;
+    }
+    /*
+     * getPolicy with the refusal reason attached. Same caching, same kill-key
+     * check, same throw-on-lookup-failure contract.
+     */
+    static async resolvePolicy(data) {
         const appIdentifier = data.appIdentifier.trim();
         if (!appIdentifier) {
-            return null;
+            return {
+                policy: null,
+                refusal: SessionReplayPolicyRefusal.IdentifierMissing,
+            };
         }
         const cacheKey = `${data.projectId.toString()}:${appIdentifier.toLowerCase()}`;
         const cached = SessionReplayGateCacheStore.getPolicyEntry(cacheKey);
-        if (cached && Date.now() - cached.loadedAt < POLICY_CACHE_TTL_MS) {
+        if (cached &&
+            cached.policy &&
+            Date.now() - cached.loadedAt < POLICY_CACHE_TTL_MS) {
             /*
              * The kill key is consulted even on a cache hit - that is the whole
              * point of it. A cached "enabled" policy is only honoured while the
              * project has not been switched off in the last few seconds.
              */
-            if (cached.policy &&
+            if (cached.policy.policy &&
                 (await SessionReplayGateCacheStore.isProjectKilled(data.projectId))) {
-                return null;
+                return {
+                    policy: null,
+                    refusal: SessionReplayPolicyRefusal.ProjectKilled,
+                };
             }
-            return cached.policy;
+            return {
+                policy: cached.policy.policy,
+                refusal: cached.policy.refusal,
+            };
         }
-        const policy = await this.loadPolicy({
+        const loaded = await this.loadPolicy({
             projectId: data.projectId,
             appIdentifier: appIdentifier,
         });
-        SessionReplayGateCacheStore.setPolicyEntry(cacheKey, policy);
-        if (policy &&
+        SessionReplayGateCacheStore.setPolicyEntry(cacheKey, {
+            policy: loaded.policy,
+            refusal: loaded.refusal,
+        });
+        if (loaded.policy &&
             (await SessionReplayGateCacheStore.isProjectKilled(data.projectId))) {
-            return null;
+            return {
+                policy: null,
+                refusal: SessionReplayPolicyRefusal.ProjectKilled,
+            };
         }
-        return policy;
+        return loaded;
     }
     static async loadPolicy(data) {
         const project = await ProjectService.findOneBy({
@@ -123,7 +197,14 @@ export default class SessionReplayGateCache {
             },
         });
         if (!project) {
-            return null;
+            /*
+             * The key authenticated a project that no longer exists (deleted
+             * between the key check and here). Nothing about it is allowed.
+             */
+            return {
+                policy: null,
+                refusal: SessionReplayPolicyRefusal.ProjectNotAllowed,
+            };
         }
         const projectView = project;
         const isProjectAllowed = projectView["isSessionReplayAllowed"] === true;
@@ -153,7 +234,10 @@ export default class SessionReplayGateCache {
          */
         if (!app) {
             if (!isProjectAllowed) {
-                return null;
+                return {
+                    policy: null,
+                    refusal: SessionReplayPolicyRefusal.ProjectNotAllowed,
+                };
             }
             await RumApplicationService.findOrCreateByAppIdentifier({
                 projectId: data.projectId,
@@ -171,58 +255,89 @@ export default class SessionReplayGateCache {
             });
         }
         if (!app || !app.id) {
-            return null;
+            return {
+                policy: null,
+                refusal: SessionReplayPolicyRefusal.ApplicationUnknown,
+            };
         }
         const appView = app;
         const isAppEnabled = appView["isSessionReplayEnabled"] === true;
         /*
          * Both flags are required. Returning null rather than a disabled policy
          * keeps every caller from having to remember to check them: if this
-         * function hands back an object at all, recording is permitted.
+         * function hands back an object at all, recording is permitted. The
+         * project switch is reported ahead of the application switch because
+         * flipping the application on does nothing while the project is off.
          */
-        if (!isProjectAllowed || !isAppEnabled) {
-            return null;
+        if (!isProjectAllowed) {
+            return {
+                policy: null,
+                refusal: SessionReplayPolicyRefusal.ProjectNotAllowed,
+            };
+        }
+        if (!isAppEnabled) {
+            return {
+                policy: null,
+                refusal: SessionReplayPolicyRefusal.ApplicationNotEnabled,
+            };
         }
         const requestedRetentionDays = this.readNumber(appView["sessionReplayRetentionInDays"], DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS);
+        /*
+         * Null-column fallbacks are the MODEL defaults (RumApplication.ts:
+         * consent NotRequired, trigger Always, sample 100), not the refusing
+         * ones. This gate refuses through the two boolean switches above; once
+         * those say yes, a policy column that is null - an explicit null via the
+         * CRUD API, a partially applied migration, a checkout behind on
+         * migrations - must read as "the default the settings page shows", or
+         * the row silently reverts to "capture only on error, sample 0%" while
+         * the ingest-status page reports the row's own (null) values and cannot
+         * explain the silence. The recorder honours these three as instructions,
+         * so they must match what the Dashboard says the application does.
+         */
         return {
-            projectId: data.projectId,
-            rumApplicationId: app.id,
-            isProjectAllowed: true,
-            isAppEnabled: true,
-            allowedOrigins: this.readStringArray(appView["sessionReplayAllowedOrigins"]),
-            maskingMode: parseSessionReplayMaskingMode(appView["sessionReplayMaskingMode"]),
-            consentMode: appView["sessionReplayConsentMode"] ===
-                SessionReplayConsentMode.NotRequired
-                ? SessionReplayConsentMode.NotRequired
-                : SessionReplayConsentMode.RequireExplicit,
-            captureTrigger: appView["sessionReplayCaptureTrigger"] ===
-                SessionReplayCaptureTrigger.Always
-                ? SessionReplayCaptureTrigger.Always
-                : SessionReplayCaptureTrigger.OnErrorOrFrustration,
-            samplePercentage: this.readNumber(appView["sessionReplaySamplePercentage"], 0),
-            maskSelectors: this.readStringArray(appView["sessionReplayMaskSelectors"]),
-            blockSelectors: this.readStringArray(appView["sessionReplayBlockSelectors"]),
-            recordCanvas: appView["sessionReplayRecordCanvas"] === true,
-            captureUserIdentity: appView["sessionReplayCaptureUserIdentity"] === true,
-            captureGeo: appView["sessionReplayCaptureGeo"] === true,
-            retentionInDays: SessionIdentity.clampRetentionDays(requestedRetentionDays, SESSION_REPLAY_ALLOWED_RETENTION_DAYS, DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS),
-            monthlyBudgetInGB: this.readNullableNumber(appView["sessionReplayMonthlyBudgetInGB"]),
-            ignoreErrorPatterns: this.readStringArray(appView["sessionReplayIgnoreErrorPatterns"]),
-            tracePropagationOrigins: this.readStringArray(appView["sessionReplayTracePropagationOrigins"]),
-            lcpBudgetMs: this.readNumber(appView["sessionReplayLcpBudgetMs"], 0),
-            longTaskBudgetMs: this.readNumber(appView["sessionReplayLongTaskBudgetMs"], 0),
-            slowRequestBudgetMs: this.readNumber(appView["sessionReplaySlowRequestBudgetMs"], 0),
-            configEpoch: this.getConfigEpoch(app),
+            policy: {
+                projectId: data.projectId,
+                rumApplicationId: app.id,
+                isProjectAllowed: true,
+                isAppEnabled: true,
+                allowedOrigins: this.readStringArray(appView["sessionReplayAllowedOrigins"]),
+                maskingMode: parseSessionReplayMaskingMode(appView["sessionReplayMaskingMode"]),
+                consentMode: appView["sessionReplayConsentMode"] ===
+                    SessionReplayConsentMode.RequireExplicit
+                    ? SessionReplayConsentMode.RequireExplicit
+                    : SessionReplayConsentMode.NotRequired,
+                captureTrigger: appView["sessionReplayCaptureTrigger"] ===
+                    SessionReplayCaptureTrigger.OnErrorOrFrustration
+                    ? SessionReplayCaptureTrigger.OnErrorOrFrustration
+                    : SessionReplayCaptureTrigger.Always,
+                samplePercentage: this.readNumber(appView["sessionReplaySamplePercentage"], DEFAULT_SESSION_REPLAY_SAMPLE_PERCENTAGE),
+                maskSelectors: this.readStringArray(appView["sessionReplayMaskSelectors"]),
+                blockSelectors: this.readStringArray(appView["sessionReplayBlockSelectors"]),
+                recordCanvas: appView["sessionReplayRecordCanvas"] === true,
+                captureUserIdentity: appView["sessionReplayCaptureUserIdentity"] === true,
+                captureGeo: appView["sessionReplayCaptureGeo"] === true,
+                retentionInDays: SessionIdentity.clampRetentionDays(requestedRetentionDays, SESSION_REPLAY_ALLOWED_RETENTION_DAYS, DEFAULT_SESSION_REPLAY_RETENTION_IN_DAYS),
+                monthlyBudgetInGB: this.readNullableNumber(appView["sessionReplayMonthlyBudgetInGB"]),
+                ignoreErrorPatterns: this.readStringArray(appView["sessionReplayIgnoreErrorPatterns"]),
+                tracePropagationOrigins: this.readStringArray(appView["sessionReplayTracePropagationOrigins"]),
+                lcpBudgetMs: this.readNumber(appView["sessionReplayLcpBudgetMs"], 0),
+                longTaskBudgetMs: this.readNumber(appView["sessionReplayLongTaskBudgetMs"], 0),
+                slowRequestBudgetMs: this.readNumber(appView["sessionReplaySlowRequestBudgetMs"], 0),
+                configEpoch: this.getConfigEpoch(app),
+            },
+            refusal: null,
         };
     }
     /*
      * Is `origin` covered by the application's allowlist?
      *
-     * Exact origin match, case-insensitive, plus a single leading "*." host
-     * wildcard so a customer with per-tenant subdomains does not have to
-     * enumerate thousands of them. Deliberately no scheme wildcard and no
-     * path matching: an allowlist entry is an origin, and anything looser
-     * would defeat the point of having one.
+     * The matching itself lives in Common/Utils/Telemetry/OriginAllowList so
+     * that this gate and the Browser telemetry-ingestion-key gate cannot drift
+     * apart - two allowlists with subtly different wildcard rules would be a
+     * confusing and exploitable split. What stays HERE is the empty-list
+     * policy, which is the one thing the two callers disagree about: session
+     * replay reads empty as "any origin", a Browser ingestion key reads it as
+     * "nothing". See the class comment in OriginAllowList.
      */
     static isOriginAllowed(policy, origin) {
         /*
@@ -245,40 +360,10 @@ export default class SessionReplayGateCache {
         /*
          * A configured allowlist is still enforced strictly: once the customer has
          * named their origins, a request without an Origin header is refused
-         * rather than waved through.
+         * rather than waved through. OriginAllowList.matches answers false for a
+         * missing or blank origin, so that rule is carried by the delegate.
          */
-        if (!origin) {
-            return false;
-        }
-        const normalizedOrigin = origin.trim().toLowerCase();
-        if (!normalizedOrigin) {
-            return false;
-        }
-        for (const allowed of policy.allowedOrigins) {
-            const normalizedAllowed = allowed.trim().toLowerCase();
-            if (!normalizedAllowed) {
-                continue;
-            }
-            if (normalizedAllowed === normalizedOrigin) {
-                return true;
-            }
-            const wildcardIndex = normalizedAllowed.indexOf("://*.");
-            if (wildcardIndex === -1) {
-                continue;
-            }
-            const scheme = normalizedAllowed.substring(0, wildcardIndex + 3);
-            const suffix = normalizedAllowed.substring(wildcardIndex + 4);
-            /*
-             * suffix keeps its leading dot, so "https://*.example.com" matches
-             * "https://a.example.com" but NOT "https://evilexample.com".
-             */
-            if (normalizedOrigin.startsWith(scheme) &&
-                normalizedOrigin.endsWith(suffix) &&
-                normalizedOrigin.length > scheme.length + suffix.length) {
-                return true;
-            }
-        }
-        return false;
+        return OriginAllowList.matches(origin, policy.allowedOrigins);
     }
     /*
      * Invalidation. Delegated to the leaf store so the services that own the

package/build/dist/Server/Utils/SessionReplay/SessionReplayGateCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionReplayGateCache.js","sourceRoot":"","sources":["../../../../../Server/Utils/SessionReplay/SessionReplayGateCache.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AACzE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,2BAA2B,EAAE,EAClC,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,OAAO,MAAM,wCAAwC,CAAC;AAC7D,OAAO,cAAc,MAAM,+CAA+C,CAAC;AAG3E,OAAO,2BAA2B,MAAM,gDAAgD,CAAC;AACzF,OAAO,wBAAwB,MAAM,6CAA6C,CAAC;AACnF,OAAiC,EAC/B,6BAA6B,GAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,wCAAwC,EACxC,qCAAqC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,eAAe,MAAM,oCAAoC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,8BAA8B,GAA0B;IAC5D,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,6BAA6B;IAC7B,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,sCAAsC;IACtC,0BAA0B;IAC1B,+BAA+B;IAC/B,kCAAkC;CACnC,CAAC;AAEF,MAAM,sBAAsB,GAA0B;IACpD,wBAAwB;CACzB,CAAC;AA+EF,MAAM,CAAC,OAAO,OAAO,sBAAsB;IACzC;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAG7B;QACC,MAAM,aAAa,GAAW,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QAEvF,MAAM,MAAM,GACV,2BAA2B,CAAC,cAAc,CACxC,QAAQ,CACT,CAAC;QAEJ,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,mBAAmB,EAAE,CAAC;YACjE;;;;eAIG;YACH,IACE,MAAM,CAAC,MAAM;gBACb,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAmC,MAAM,IAAI,CAAC,UAAU,CAAC;YACnE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QAEH,2BAA2B,CAAC,cAAc,CACxC,QAAQ,EACR,MAAM,CACP,CAAC;QAEF,IACE,MAAM;YACN,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAG/B;QACC,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;aAC/B;YACD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,EAAE,sBAAsB,CAAC;YAC/D,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GACf,OAA8C,CAAC;QAEjD,MAAM,gBAAgB,GACpB,WAAW,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QAEjD,IAAI,GAAG,GAA0B,MAAM,qBAAqB,CAAC,SAAS,CAAC;YACrE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;aAChE;YACD,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,cAAc,EAAE,EACpB,8BAA8B,CAC/B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH;;;;;;;;;;;;;WAaG;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,qBAAqB,CAAC,2BAA2B,CAAC;gBACtD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YAEH,GAAG,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,aAAa,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;iBAChE;gBACD,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,cAAc,EAAE,EACpB,8BAA8B,CAC/B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GACX,GAA0C,CAAC;QAE7C,MAAM,YAAY,GAAY,OAAO,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QAEzE;;;;WAIG;QACH,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,sBAAsB,GAAW,IAAI,CAAC,UAAU,CACpD,OAAO,CAAC,8BAA8B,CAAC,EACvC,wCAAwC,CACzC,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,GAAG,CAAC,EAAE;YACxB,gBAAgB,EAAE,IAAI;YACtB,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI,CAAC,eAAe,CAClC,OAAO,CAAC,6BAA6B,CAAC,CACvC;YACD,WAAW,EAAE,6BAA6B,CACxC,OAAO,CAAC,0BAA0B,CAAC,CACpC;YACD,WAAW,EACT,OAAO,CAAC,0BAA0B,CAAC;gBACnC,wBAAwB,CAAC,WAAW;gBAClC,CAAC,CAAC,wBAAwB,CAAC,WAAW;gBACtC,CAAC,CAAC,wBAAwB,CAAC,eAAe;YAC9C,cAAc,EACZ,OAAO,CAAC,6BAA6B,CAAC;gBACtC,2BAA2B,CAAC,MAAM;gBAChC,CAAC,CAAC,2BAA2B,CAAC,MAAM;gBACpC,CAAC,CAAC,2BAA2B,CAAC,oBAAoB;YACtD,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAC/B,OAAO,CAAC,+BAA+B,CAAC,EACxC,CAAC,CACF;YACD,aAAa,EAAE,IAAI,CAAC,eAAe,CACjC,OAAO,CAAC,4BAA4B,CAAC,CACtC;YACD,cAAc,EAAE,IAAI,CAAC,eAAe,CAClC,OAAO,CAAC,6BAA6B,CAAC,CACvC;YACD,YAAY,EAAE,OAAO,CAAC,2BAA2B,CAAC,KAAK,IAAI;YAC3D,mBAAmB,EAAE,OAAO,CAAC,kCAAkC,CAAC,KAAK,IAAI;YACzE,UAAU,EAAE,OAAO,CAAC,yBAAyB,CAAC,KAAK,IAAI;YACvD,eAAe,EAAE,eAAe,CAAC,kBAAkB,CACjD,sBAAsB,EACtB,qCAAqC,EACrC,wCAAwC,CACzC;YACD,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,CACxC,OAAO,CAAC,gCAAgC,CAAC,CAC1C;YACD,mBAAmB,EAAE,IAAI,CAAC,eAAe,CACvC,OAAO,CAAC,kCAAkC,CAAC,CAC5C;YACD,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAC3C,OAAO,CAAC,sCAAsC,CAAC,CAChD;YACD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACpE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAC/B,OAAO,CAAC,+BAA+B,CAAC,EACxC,CAAC,CACF;YACD,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAClC,OAAO,CAAC,kCAAkC,CAAC,EAC3C,CAAC,CACF;YACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,eAAe,CAC3B,MAA+B,EAC/B,MAA0B;QAE1B;;;;;;;;;;;;;WAaG;QACH,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,gBAAgB,GAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,iBAAiB,GAAW,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAE/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,IAAI,iBAAiB,KAAK,gBAAgB,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,aAAa,GAAW,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEjE,IAAI,aAAa,KAAK,CAAC,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAW,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,GAAW,iBAAiB,CAAC,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;YAEtE;;;eAGG;YACH,IACE,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC;gBACnC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACjC,gBAAgB,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EACvD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QACzD,OAAO,MAAM,2BAA2B,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAmB;QAC1D,OAAO,MAAM,2BAA2B,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,4DAA4D;IACrD,MAAM,CAAC,UAAU,CAAC,SAAgC;QACvD,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,WAAW,CACxB,QAAgB,EAChB,eAAsC;QAEtC,MAAM,QAAQ,GAAgB,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAErE;;;;;;;WAOG;QACH,MAAM,MAAM,GAA4B;YACtC,GAAG,EAAE,IAAI;SACV,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;YACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,MAA+B,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,cAAc,CAAC,GAAmB;QAC/C,MAAM,SAAS,GAAqB,GAAG,CAAC,SAAS,CAAC;QAElD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAErD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAc,EAAE,QAAgB;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,KAAc;QAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,KAAc;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"SessionReplayGateCache.js","sourceRoot":"","sources":["../../../../../Server/Utils/SessionReplay/SessionReplayGateCache.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AACzE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,2BAA2B,EAAE,EAClC,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,OAAO,MAAM,wCAAwC,CAAC;AAC7D,OAAO,cAAc,MAAM,+CAA+C,CAAC;AAG3E,OAAO,2BAA2B,MAAM,gDAAgD,CAAC;AACzF,OAAO,wBAAwB,MAAM,6CAA6C,CAAC;AACnF,OAAiC,EAC/B,6BAA6B,GAC9B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,wCAAwC,EACxC,qCAAqC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,eAAe,MAAM,oCAAoC,CAAC;AACjE,OAAO,eAAe,MAAM,0CAA0C,CAAC;AAEvE;;;;GAIG;AACH,MAAM,wCAAwC,GAAW,GAAG,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,8BAA8B,GAA0B;IAC5D,wBAAwB;IACxB,0BAA0B;IAC1B,4BAA4B;IAC5B,6BAA6B;IAC7B,6BAA6B;IAC7B,0BAA0B;IAC1B,6BAA6B;IAC7B,+BAA+B;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,sCAAsC;IACtC,0BAA0B;IAC1B,+BAA+B;IAC/B,kCAAkC;CACnC,CAAC;AAEF,MAAM,sBAAsB,GAA0B;IACpD,wBAAwB;CACzB,CAAC;AA+EF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,0BAoBX;AApBD,WAAY,0BAA0B;IACpC,mEAAmE;IACnE,uEAAyC,CAAA;IAEzC,0EAA0E;IAC1E,+EAAiD,CAAA;IAEjD;;;;;OAKG;IACH,wEAA0C,CAAA;IAE1C,6DAA6D;IAC7D,8DAAgC,CAAA;IAEhC,wCAAwC;IACxC,0EAA4C,CAAA;AAC9C,CAAC,EApBW,0BAA0B,KAA1B,0BAA0B,QAoBrC;AAoBD,MAAM,CAAC,OAAO,OAAO,sBAAsB;IACzC;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAG7B;QACC,MAAM,UAAU,GACd,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAEjC,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAGjC;QACC,MAAM,aAAa,GAAW,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,0BAA0B,CAAC,iBAAiB;aACtD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QAEvF,MAAM,MAAM,GACV,2BAA2B,CAAC,cAAc,CAAmB,QAAQ,CAAC,CAAC;QAEzE,IACE,MAAM;YACN,MAAM,CAAC,MAAM;YACb,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,mBAAmB,EAClD,CAAC;YACD;;;;eAIG;YACH,IACE,MAAM,CAAC,MAAM,CAAC,MAAM;gBACpB,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,0BAA0B,CAAC,aAAa;iBAClD,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;aAC/B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAkC,MAAM,IAAI,CAAC,UAAU,CAAC;YAClE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QAEH,2BAA2B,CAAC,cAAc,CAAmB,QAAQ,EAAE;YACrE,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QAEH,IACE,MAAM,CAAC,MAAM;YACb,CAAC,MAAM,2BAA2B,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EACnE,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,0BAA0B,CAAC,aAAa;aAClD,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAG/B;QACC,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;aAC/B;YACD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,EAAE,sBAAsB,CAAC;YAC/D,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb;;;eAGG;YACH,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,0BAA0B,CAAC,iBAAiB;aACtD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,OAA8C,CAAC;QAEjD,MAAM,gBAAgB,GACpB,WAAW,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QAEjD,IAAI,GAAG,GAA0B,MAAM,qBAAqB,CAAC,SAAS,CAAC;YACrE,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;aAChE;YACD,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,cAAc,EAAE,EACpB,8BAA8B,CAC/B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH;;;;;;;;;;;;;WAaG;QACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,0BAA0B,CAAC,iBAAiB;iBACtD,CAAC;YACJ,CAAC;YAED,MAAM,qBAAqB,CAAC,2BAA2B,CAAC;gBACtD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YAEH,GAAG,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,aAAa,EAAE,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC;iBAChE;gBACD,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,cAAc,EAAE,EACpB,8BAA8B,CAC/B;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,0BAA0B,CAAC,kBAAkB;aACvD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GACX,GAA0C,CAAC;QAE7C,MAAM,YAAY,GAAY,OAAO,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QAEzE;;;;;;WAMG;QACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,0BAA0B,CAAC,iBAAiB;aACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,0BAA0B,CAAC,qBAAqB;aAC1D,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAW,IAAI,CAAC,UAAU,CACpD,OAAO,CAAC,8BAA8B,CAAC,EACvC,wCAAwC,CACzC,CAAC;QAEF;;;;;;;;;;;WAWG;QACH,OAAO;YACL,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,gBAAgB,EAAE,GAAG,CAAC,EAAE;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,cAAc,EAAE,IAAI,CAAC,eAAe,CAClC,OAAO,CAAC,6BAA6B,CAAC,CACvC;gBACD,WAAW,EAAE,6BAA6B,CACxC,OAAO,CAAC,0BAA0B,CAAC,CACpC;gBACD,WAAW,EACT,OAAO,CAAC,0BAA0B,CAAC;oBACnC,wBAAwB,CAAC,eAAe;oBACtC,CAAC,CAAC,wBAAwB,CAAC,eAAe;oBAC1C,CAAC,CAAC,wBAAwB,CAAC,WAAW;gBAC1C,cAAc,EACZ,OAAO,CAAC,6BAA6B,CAAC;oBACtC,2BAA2B,CAAC,oBAAoB;oBAC9C,CAAC,CAAC,2BAA2B,CAAC,oBAAoB;oBAClD,CAAC,CAAC,2BAA2B,CAAC,MAAM;gBACxC,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAC/B,OAAO,CAAC,+BAA+B,CAAC,EACxC,wCAAwC,CACzC;gBACD,aAAa,EAAE,IAAI,CAAC,eAAe,CACjC,OAAO,CAAC,4BAA4B,CAAC,CACtC;gBACD,cAAc,EAAE,IAAI,CAAC,eAAe,CAClC,OAAO,CAAC,6BAA6B,CAAC,CACvC;gBACD,YAAY,EAAE,OAAO,CAAC,2BAA2B,CAAC,KAAK,IAAI;gBAC3D,mBAAmB,EACjB,OAAO,CAAC,kCAAkC,CAAC,KAAK,IAAI;gBACtD,UAAU,EAAE,OAAO,CAAC,yBAAyB,CAAC,KAAK,IAAI;gBACvD,eAAe,EAAE,eAAe,CAAC,kBAAkB,CACjD,sBAAsB,EACtB,qCAAqC,EACrC,wCAAwC,CACzC;gBACD,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,CACxC,OAAO,CAAC,gCAAgC,CAAC,CAC1C;gBACD,mBAAmB,EAAE,IAAI,CAAC,eAAe,CACvC,OAAO,CAAC,kCAAkC,CAAC,CAC5C;gBACD,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAC3C,OAAO,CAAC,sCAAsC,CAAC,CAChD;gBACD,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;gBACpE,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAC/B,OAAO,CAAC,+BAA+B,CAAC,EACxC,CAAC,CACF;gBACD,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAClC,OAAO,CAAC,kCAAkC,CAAC,EAC3C,CAAC,CACF;gBACD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;aACtC;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,eAAe,CAC3B,MAA+B,EAC/B,MAA0B;QAE1B;;;;;;;;;;;;;WAaG;QACH,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;WAKG;QACH,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAmB;QACzD,OAAO,MAAM,2BAA2B,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAmB;QAC1D,OAAO,MAAM,2BAA2B,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,4DAA4D;IACrD,MAAM,CAAC,UAAU,CAAC,SAAgC;QACvD,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,WAAW,CACxB,QAAgB,EAChB,eAAsC;QAEtC,MAAM,QAAQ,GAAgB,IAAI,GAAG,CAAS,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAErE;;;;;;;WAOG;QACH,MAAM,MAAM,GAA4B;YACtC,GAAG,EAAE,IAAI;SACV,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;YACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,MAA+B,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,cAAc,CAAC,GAAmB;QAC/C,MAAM,SAAS,GAAqB,GAAG,CAAC,SAAS,CAAC;QAElD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAErD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAc,EAAE,QAAgB;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,KAAc;QAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,eAAe,CAAC,KAAc;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAkB,EAAE,CAAC;QAEjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/build/dist/Server/Utils/SessionReplay/SessionReplayHealthCounters.js

@@ -0,0 +1,223 @@
+import Redis from "../../Infrastructure/Redis";
+import logger from "../Logger";
+import { isSessionReplayRefusalReason, } from "../../../Types/Rum/SessionReplayHealth";
+/*
+ * Per-application counters of what the session replay ingest path did NOT
+ * keep, and why.
+ *
+ * The chunk gate answers every refusal with a reason string the recorder
+ * can log, but the person who has to explain "why are there no recordings?"
+ * is looking at the Dashboard, not at a visitor's browser console. These
+ * counters are the server-side memory of those answers: one Redis hash per
+ * (project, application, UTC day) with one field per reason, incremented by
+ * HINCRBY from the gate for every non-accepted request, and read back by
+ * the ingest-status endpoint summed over today and yesterday so the
+ * "last 24h" figure is stable across midnight.
+ *
+ * Two rules that every reader of this module relies on:
+ *
+ *   1. Writes never throw and never delay a response. A counter is
+ *      bookkeeping; the chunk decision has already been made.
+ *   2. Reads return null - never 0, never [] - when Redis could not be
+ *      consulted. "Nothing was refused" and "we cannot tell" are different
+ *      facts, and the health copy renders the second as "unknown".
+ *
+ * Day buckets are UTC so every pod agrees on which hash a refusal lands in,
+ * and the 48h TTL is what bounds the keyspace: a day's hash lives long
+ * enough to be yesterday's half of a 24h window and no longer.
+ */
+const REFUSAL_KEY_PREFIX = "replay:refusals:";
+/*
+ * Worker-side drops are counted separately from gate refusals. A refusal
+ * was answered to the recorder (204 with a reason); a drop happened AFTER a
+ * 202, inside the queue consumer, and the recorder was never told. They
+ * are different explanations for the same missing recording and the
+ * Dashboard must not blur them: "212 refused: origin not allowed" tells the
+ * customer to fix a setting, "12 dropped: scrub incomplete" tells them the
+ * server chose not to store something it had already accepted.
+ */
+const DROP_KEY_PREFIX = "replay:drops:";
+export const SESSION_REPLAY_HEALTH_COUNTER_TTL_SECONDS = 48 * 60 * 60;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/* Bounds a hostile or buggy caller: the reason is a Redis hash field. */
+const MAX_REASON_LENGTH = 64;
+export default class SessionReplayHealthCounters {
+    /* "YYYY-MM-DD" in UTC for the given instant. */
+    static getUtcDayBucket(unixMs) {
+        return new Date(unixMs).toISOString().substring(0, 10);
+    }
+    static getRefusalCounterKey(data) {
+        return `${REFUSAL_KEY_PREFIX}${this.buildScope(data)}:${data.utcDay}`;
+    }
+    static getDropCounterKey(data) {
+        return `${DROP_KEY_PREFIX}${this.buildScope(data)}:${data.utcDay}`;
+    }
+    /*
+     * Count one refused chunk request. Best-effort: a Redis failure is logged
+     * at debug (it would otherwise spam the log for the whole outage) and
+     * swallowed, because the gate has already decided and the response must
+     * not wait on bookkeeping.
+     */
+    static async recordRefusal(data) {
+        var _a;
+        await this.increment({
+            key: this.getRefusalCounterKey({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+                utcDay: this.getUtcDayBucket((_a = data.nowUnixMs) !== null && _a !== void 0 ? _a : Date.now()),
+            }),
+            reason: data.reason,
+            describe: "refusal",
+        });
+    }
+    /* Count one chunk the worker dropped after the route had answered 202. */
+    static async recordDrop(data) {
+        var _a;
+        await this.increment({
+            key: this.getDropCounterKey({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+                utcDay: this.getUtcDayBucket((_a = data.nowUnixMs) !== null && _a !== void 0 ? _a : Date.now()),
+            }),
+            reason: data.reason,
+            describe: "drop",
+        });
+    }
+    /*
+     * Refusals over the last 24 hours, summed over today's and yesterday's
+     * buckets, highest count first. Only the gate's closed vocabulary is
+     * returned: a field that is not a known reason (an older or newer build
+     * of the gate) is dropped rather than rendered as a bare string.
+     *
+     * null when Redis is unavailable or either read failed.
+     */
+    static async readRefusalsLast24h(data) {
+        var _a;
+        const nowUnixMs = (_a = data.nowUnixMs) !== null && _a !== void 0 ? _a : Date.now();
+        const totals = await this.readTwoDayTotals([
+            this.getRefusalCounterKey({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+                utcDay: this.getUtcDayBucket(nowUnixMs),
+            }),
+            this.getRefusalCounterKey({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+                utcDay: this.getUtcDayBucket(nowUnixMs - DAY_MS),
+            }),
+        ]);
+        if (totals === null) {
+            return null;
+        }
+        const refusals = [];
+        for (const [reason, count] of totals.entries()) {
+            if (isSessionReplayRefusalReason(reason) && count > 0) {
+                refusals.push({ reason: reason, count: count });
+            }
+        }
+        return this.sortByCountDescending(refusals);
+    }
+    /*
+     * Worker drops over the last 24 hours. The drop vocabulary is open (it is
+     * whatever recordDrop in the ingest service names), so every non-empty
+     * field is returned. null when Redis is unavailable.
+     */
+    static async readDropsLast24h(data) {
+        var _a;
+        const nowUnixMs = (_a = data.nowUnixMs) !== null && _a !== void 0 ? _a : Date.now();
+        const totals = await this.readTwoDayTotals([
+            this.getDropCounterKey({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+                utcDay: this.getUtcDayBucket(nowUnixMs),
+            }),
+            this.getDropCounterKey({
+                projectId: data.projectId,
+                appIdentifier: data.appIdentifier,
+                utcDay: this.getUtcDayBucket(nowUnixMs - DAY_MS),
+            }),
+        ]);
+        if (totals === null) {
+            return null;
+        }
+        const drops = [];
+        for (const [reason, count] of totals.entries()) {
+            if (reason && count > 0) {
+                drops.push({ reason: reason, count: count });
+            }
+        }
+        return this.sortByCountDescending(drops);
+    }
+    /*
+     * The application identifier is lower-cased because RumApplication lookup
+     * is case-insensitive (QueryHelper.findWithSameText): two recorders that
+     * spell the identifier differently are one application and must share one
+     * counter.
+     */
+    static buildScope(data) {
+        return `${data.projectId.toString()}:${data.appIdentifier.trim().toLowerCase()}`;
+    }
+    static async increment(data) {
+        const reason = data.reason.trim().substring(0, MAX_REASON_LENGTH);
+        if (!reason) {
+            return;
+        }
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            return;
+        }
+        try {
+            /*
+             * One round trip, not two. The EXPIRE is refreshed on every write
+             * rather than only on the first (HINCRBY cannot say whether it
+             * created the key), so pipelining is what keeps the cost of that
+             * choice at a single RTT - which matters because the gate counts a
+             * refusal for every refused request, including the cheap 204s a
+             * misconfigured site sends every 15 seconds.
+             */
+            await client
+                .pipeline()
+                .hincrby(data.key, reason, 1)
+                .expire(data.key, SESSION_REPLAY_HEALTH_COUNTER_TTL_SECONDS)
+                .exec();
+        }
+        catch (err) {
+            logger.debug(`SessionReplayHealthCounters: could not record a ${data.describe} at ${data.key}`);
+            logger.debug(err);
+        }
+    }
+    static async readTwoDayTotals(keys) {
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            return null;
+        }
+        const totals = new Map();
+        try {
+            for (const key of keys) {
+                const fields = await client.hgetall(key);
+                for (const reason of Object.keys(fields || {})) {
+                    const parsed = parseInt(fields[reason], 10);
+                    if (!Number.isFinite(parsed) || parsed <= 0) {
+                        continue;
+                    }
+                    totals.set(reason, (totals.get(reason) || 0) + parsed);
+                }
+            }
+        }
+        catch (err) {
+            logger.warn("SessionReplayHealthCounters: could not read the replay health counters");
+            logger.warn(err);
+            return null;
+        }
+        return totals;
+    }
+    static sortByCountDescending(entries) {
+        return entries.sort((a, b) => {
+            if (b.count !== a.count) {
+                return b.count - a.count;
+            }
+            return a.reason < b.reason ? -1 : a.reason > b.reason ? 1 : 0;
+        });
+    }
+}
+//# sourceMappingURL=SessionReplayHealthCounters.js.map

package/build/dist/Server/Utils/SessionReplay/SessionReplayHealthCounters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionReplayHealthCounters.js","sourceRoot":"","sources":["../../../../../Server/Utils/SessionReplay/SessionReplayHealthCounters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,4BAA4B,CAAC;AAC/D,OAAO,MAAM,MAAM,WAAW,CAAC;AAE/B,OAAO,EAEL,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,kBAAkB,GAAW,kBAAkB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAW,eAAe,CAAC;AAEhD,MAAM,CAAC,MAAM,yCAAyC,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9E,MAAM,MAAM,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,yEAAyE;AACzE,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAOrC,MAAM,CAAC,OAAO,OAAO,2BAA2B;IAC9C,gDAAgD;IACzC,MAAM,CAAC,eAAe,CAAC,MAAc;QAC1C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAAC,IAIlC;QACC,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IAEM,MAAM,CAAC,iBAAiB,CAAC,IAI/B;QACC,OAAO,GAAG,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAKjC;;QACC,MAAM,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,oBAAoB,CAAC;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAA,IAAI,CAAC,SAAS,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aAC3D,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IACnE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAK9B;;QACC,MAAM,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAA,IAAI,CAAC,SAAS,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aAC3D,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAIvC;;QACC,MAAM,SAAS,GAAW,MAAA,IAAI,CAAC,SAAS,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvD,MAAM,MAAM,GAA+B,MAAM,IAAI,CAAC,gBAAgB,CAAC;YACrE,IAAI,CAAC,oBAAoB,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;aACxC,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,GAAG,MAAM,CAAC;aACjD,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAqC,EAAE,CAAC;QAEtD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,IAAI,4BAA4B,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAIpC;;QACC,MAAM,SAAS,GAAW,MAAA,IAAI,CAAC,SAAS,mCAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvD,MAAM,MAAM,GAA+B,MAAM,IAAI,CAAC,gBAAgB,CAAC;YACrE,IAAI,CAAC,iBAAiB,CAAC;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;aACxC,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,GAAG,MAAM,CAAC;aACjD,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAkC,EAAE,CAAC;QAEhD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,IAAI,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,UAAU,CAAC,IAGzB;QACC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACnF,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAI9B;QACC,MAAM,MAAM,GAAW,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAE1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH;;;;;;;eAOG;YACH,MAAM,MAAM;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;iBAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,yCAAyC,CAAC;iBAC3D,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,mDAAmD,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,GAAG,EAAE,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,gBAAgB,CACnC,IAAmB;QAEnB,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAwB,IAAI,GAAG,EAAkB,CAAC;QAE9D,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAA2B,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAEjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC/C,MAAM,MAAM,GAAW,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAW,EAAE,EAAE,CAAC,CAAC;oBAE9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;wBAC5C,SAAS;oBACX,CAAC;oBAED,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAElC,OAAsB;QACtB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE;YACnD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAC3B,CAAC;YAED,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}