@oneuptime/common 13.0.7 → 14.0.0

package/build/dist/Server/Services/TeamComplianceService.js

@@ -1,537 +0,0 @@
-import OnCallReadinessService from "./OnCallReadinessService";
-import TeamComplianceSettingService from "./TeamComplianceSettingService";
-import TeamMemberService from "./TeamMemberService";
-import UserEmailService from "./UserEmailService";
-import UserSmsService from "./UserSmsService";
-import UserCallService from "./UserCallService";
-import UserPushService from "./UserPushService";
-import UserService from "./UserService";
-import TeamService from "./TeamService";
-import ComplianceRuleType from "../../Types/Team/ComplianceRuleType";
-import NotificationRuleType from "../../Types/NotificationRule/NotificationRuleType";
-import BadDataException from "../../Types/Exception/BadDataException";
-import Includes from "../../Types/BaseDatabase/Includes";
-import logger from "../Utils/Logger";
-import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
-/*
- * How many members' channel checks may be in flight at once. Each member costs
- * one small indexed existence check per enabled channel rule (four at most), so
- * twenty members in flight is up to eighty concurrent queries - enough to keep
- * the page quick on a large team, and nowhere near enough to matter to a
- * connection pool shared with the rest of the product. The number is a ceiling
- * on the burst, not a target: a five-member team still issues five.
- */
-const MAX_CONCURRENT_MEMBER_CHECKS = 20;
-/*
- * Teams > View > Compliance. The route (`/team/compliance-status/:teamId`) and
- * every field of the payload above are unchanged, because
- * TeamComplianceStatusTable.tsx renders them verbatim - including the reason
- * strings, which are printed as prose rather than mapped through any lookup.
- *
- * What changed in Phase 2 is where the answers come from. The two "does this
- * user have on-call rules?" questions used to be answered here, by walking every
- * severity in the project and issuing one findBy per severity per user; that
- * walk got four things wrong (it ignored ruleType, so an off-call rule counted
- * as incident coverage; it read only four of the seven channel columns, so a
- * Telegram/WhatsApp/Webhook responder was reported unreachable; it capped alert
- * severities at 100 while capping incident severities at LIMIT_PER_PROJECT; and
- * it was quadratic). All four are now OnCallReadinessService's problem, answered
- * from AT MOST TWO batched, cached computations for the whole team - which also
- * means this page and the on-call readiness surfaces can no longer disagree
- * about whether a given responder is covered.
- *
- * The four "does this user have a verified <channel>?" questions stay here, as
- * direct existence checks. ComplianceRuleType names one specific channel per
- * rule, so there is nothing to batch across severities and nothing for the
- * readiness service to reconcile: both surfaces are asking the same table the
- * same question and necessarily agree already.
- *
- * TENANT SCOPING. Every read below - including the team row itself - carries the
- * projectId the caller was authorised for, and every read is made with
- * `isRoot: true` because this page deliberately reports on people the reader may
- * have no permission to read individually. Root reads mean the projectId in the
- * QUERY is the only tenant boundary there is: the team was previously fetched by
- * id alone, so a team id belonging to another project resolved and its members'
- * reachability was described to a caller from outside that project. The id and
- * the project are now asked for together, in one query, so a foreign team simply
- * does not exist as far as this service is concerned.
- */
-export default class TeamComplianceService {
-    static async getTeamComplianceStatus(teamId, projectId) {
-        /*
-         * The team is looked up BY ID AND BY PROJECT, together. Splitting those into
-         * "read by id, then compare projectId" would work just as well when written
-         * correctly, but the comparison is a line somebody can delete without the
-         * query looking wrong; a query that names both columns cannot be half-right.
-         *
-         * A team from another project therefore comes back null and is answered with
-         * the same "Team not found" a nonexistent id gets - deliberately identical,
-         * so this endpoint cannot be used to learn which team ids exist elsewhere.
-         */
-        const team = await TeamService.findOneBy({
-            query: {
-                _id: teamId.toString(),
-                projectId: projectId,
-            },
-            select: {
-                name: true,
-                _id: true,
-            },
-            props: {
-                isRoot: true,
-            },
-        });
-        if (!team) {
-            throw new BadDataException("Team not found");
-        }
-        /*
-         * LIMIT_PER_PROJECT, not 100, at all three sites below. The old cap was the
-         * worst kind of bug for a compliance page: a truncated list does not render
-         * as an error or as a warning, it renders as fewer rows - and a member who
-         * is simply absent from the table reads exactly like a member with nothing
-         * wrong. TeamComplianceSetting is one row per rule type today so its cap was
-         * harmless, but it is the same mistake and is fixed with the other two.
-         */
-        const complianceSettings = await TeamComplianceSettingService.findBy({
-            query: {
-                teamId: teamId,
-                projectId: projectId,
-            },
-            select: {
-                ruleType: true,
-                enabled: true,
-            },
-            limit: LIMIT_PER_PROJECT,
-            skip: 0,
-            props: {
-                isRoot: true,
-            },
-        });
-        // Get team members
-        const teamMembers = await TeamMemberService.findBy({
-            query: {
-                teamId: teamId,
-                projectId: projectId,
-            },
-            select: {
-                userId: true,
-                _id: true,
-            },
-            limit: LIMIT_PER_PROJECT,
-            skip: 0,
-            props: {
-                isRoot: true,
-            },
-        });
-        /*
-         * LIMIT_PER_PROJECT is a ceiling, not a promise, and a page that hits it
-         * renders as fewer rows rather than as a warning - the 10,001st member is
-         * not reported non-compliant, they are absent, and an absent row reads as
-         * "no problem here". Ten thousand members on one team is not a shape any
-         * install has, which is why this is a log rather than a paging loop, but the
-         * day it happens the operator gets a sentence saying the page is incomplete
-         * instead of a table that quietly is.
-         */
-        if (teamMembers.length >= LIMIT_PER_PROJECT) {
-            logger.error(`TeamComplianceService read ${LIMIT_PER_PROJECT} members of team ${teamId.toString()} in project ${projectId.toString()} and stopped. The compliance page for this team is INCOMPLETE: members past that ceiling are absent from it entirely, and absence reads as compliance.`);
-        }
-        const userIds = teamMembers
-            .map((member) => {
-            return member.userId;
-        })
-            .filter(Boolean);
-        // Get user details
-        const users = await UserService.findBy({
-            query: {
-                _id: new Includes(userIds),
-            },
-            select: {
-                name: true,
-                email: true,
-                _id: true,
-                profilePictureId: true,
-            },
-            limit: LIMIT_PER_PROJECT,
-            skip: 0,
-            props: {
-                isRoot: true,
-            },
-        });
-        const settings = complianceSettings.map((setting) => {
-            return {
-                ruleType: setting.ruleType,
-                enabled: setting.enabled || false,
-            };
-        });
-        const readinessByUserId = await this.getReadinessByUserId(users.map((user) => {
-            return user.id;
-        }), projectId, settings);
-        /*
-         * Users are checked concurrently rather than one at a time - there is no
-         * reason for Ada's lookups to wait on Grace's - but concurrently is not the
-         * same as all at once. Each user's channel rules cost up to four existence
-         * checks, so a bare Promise.all over a 5,000-member team opens twenty
-         * thousand simultaneous queries and the page that was meant to be faster
-         * takes the pool down with it. The bounded map keeps the parallelism and
-         * caps the burst, and it assigns results by index so the table's rows do not
-         * shuffle.
-         */
-        const userComplianceStatuses = await this.mapWithBoundedConcurrency(users, MAX_CONCURRENT_MEMBER_CHECKS, async (user) => {
-            var _a, _b, _c;
-            const complianceStatus = await this.checkUserCompliance(user.id, projectId, settings, readinessByUserId.get(user.id.toString()));
-            return Object.assign({ userId: user.id, userName: ((_a = user.name) === null || _a === void 0 ? void 0 : _a.toString()) || ((_b = user.email) === null || _b === void 0 ? void 0 : _b.toString()) || "Unknown User", userEmail: ((_c = user.email) === null || _c === void 0 ? void 0 : _c.toString()) || "", userProfilePictureId: user.profilePictureId }, complianceStatus);
-        });
-        return {
-            teamId: teamId,
-            teamName: team.name || "Unknown Team",
-            complianceSettings: settings,
-            userComplianceStatuses,
-        };
-    }
-    /*
-     * Readiness for a whole team, in AT MOST TWO readiness computations however
-     * many members the team has.
-     *
-     * The project-scope summary is asked for first and used as the source for
-     * everyone it happens to contain. It resolves every responder on every policy
-     * in the project in one batched pass, so for a team that exists because its
-     * members are on call - which is the only kind of team this page is really
-     * about - it answers for all of them at once, and it is very likely already
-     * warm in the readiness service's 60s cache because the On-Call banner and the
-     * readiness page request that same scope.
-     *
-     * Members the summary does not cover are those on no policy at all. They are
-     * still subject to the team's compliance rules, so they cannot be skipped -
-     * and they are now resolved in ONE batched `getReadinessForUsers` call rather
-     * than one `getReadinessForUser` per member.
-     *
-     * That distinction is the whole point of this function. `getReadinessForUser`
-     * resolves the project's ENTIRE responder set on every call, purely to work
-     * out which policies reach the one user it was asked about, so a 40-member
-     * team with 38 members on no policy used to cost 38 full project resolutions -
-     * hundreds of queries - to render one page. The batched entry point pays for
-     * that resolution once and answers for every member from it.
-     *
-     * A member the batch cannot resolve - somebody removed from the project
-     * between the member read above and this call - is simply absent from the map.
-     * They are NOT an error: one person leaving a team must not blank the page for
-     * the other thirty-nine. checkHasOnCallRules reports their on-call rules as
-     * unverified rather than as fine, because "we could not check" and "there is
-     * nothing wrong" are different answers and only one of them is true.
-     *
-     * Nothing is computed when neither on-call-rule setting is enabled: the
-     * channel rules do not consult readiness, so a team that only checks "has a
-     * verified email" must not pay for a project-wide readiness pass.
-     */
-    static async getReadinessByUserId(userIds, projectId, settings) {
-        const readinessByUserId = new Map();
-        if (userIds.length === 0) {
-            return readinessByUserId;
-        }
-        const needsReadiness = settings.some((setting) => {
-            return (setting.enabled &&
-                (setting.ruleType === ComplianceRuleType.HasIncidentOnCallRules ||
-                    setting.ruleType === ComplianceRuleType.HasAlertOnCallRules));
-        });
-        if (!needsReadiness) {
-            return readinessByUserId;
-        }
-        const wanted = new Set(userIds.map((userId) => {
-            return userId.toString();
-        }));
-        const summary = await OnCallReadinessService.getReadinessForProject(projectId);
-        for (const readiness of summary.users) {
-            const key = readiness.userId.toString();
-            if (wanted.has(key)) {
-                readinessByUserId.set(key, readiness);
-            }
-        }
-        const missing = userIds.filter((userId) => {
-            return !readinessByUserId.has(userId.toString());
-        });
-        if (missing.length === 0) {
-            return readinessByUserId;
-        }
-        /*
-         * One call, whatever `missing.length` is. The batch answers only for the
-         * users it can resolve, so its result is keyed back onto the ids it carries
-         * rather than zipped against `missing` by position - a batch that dropped a
-         * user would otherwise shift everybody after them onto the wrong readiness,
-         * which is the single worst thing this page could do.
-         */
-        const filled = await OnCallReadinessService.getReadinessForUsers(missing, projectId);
-        for (const readiness of filled) {
-            readinessByUserId.set(readiness.userId.toString(), readiness);
-        }
-        return readinessByUserId;
-    }
-    /*
-     * Promise.all with a ceiling.
-     *
-     * Results are written into a pre-sized array by index rather than pushed, so
-     * the output order matches the input order no matter what order the workers
-     * happen to finish in. The table's rows are rendered in this order and a page
-     * whose rows reshuffle between renders is unreadable.
-     *
-     * Rejections are deliberately NOT swallowed here. A member whose data is
-     * merely absent is handled where that absence has meaning (see
-     * checkHasOnCallRules); a query that actually FAILS is an infrastructure
-     * fault, and turning it into "every member is non-compliant" would dress a
-     * database outage up as forty people misconfiguring their phones.
-     */
-    static async mapWithBoundedConcurrency(items, maxConcurrency, mapper) {
-        const results = new Array(items.length);
-        let cursor = 0;
-        const runWorker = async () => {
-            while (cursor < items.length) {
-                const index = cursor;
-                cursor++;
-                results[index] = await mapper(items[index]);
-            }
-        };
-        const workers = [];
-        for (let worker = 0; worker < Math.min(maxConcurrency, items.length); worker++) {
-            workers.push(runWorker());
-        }
-        await Promise.all(workers);
-        return results;
-    }
-    /*
-     * `readiness` is required and may be undefined, matching checkRuleCompliance:
-     * undefined is the answer "the batch could not resolve this member", and an
-     * OPTIONAL parameter would let a future caller forget to thread it through and
-     * silently turn every member into that case.
-     */
-    static async checkUserCompliance(userId, projectId, complianceSettings, readiness) {
-        const nonCompliantRules = [];
-        // Check each enabled compliance rule
-        for (const setting of complianceSettings) {
-            if (!setting.enabled) {
-                continue;
-            }
-            const isCompliant = await this.checkRuleCompliance(userId, projectId, setting.ruleType, readiness);
-            if (!isCompliant.compliant) {
-                nonCompliantRules.push({
-                    ruleType: setting.ruleType,
-                    reason: isCompliant.reason,
-                });
-            }
-        }
-        return {
-            isCompliant: nonCompliantRules.length === 0,
-            nonCompliantRules,
-        };
-    }
-    /*
-     * `readiness` is the caller's already-resolved UserReadiness for this user.
-     *
-     * It is a required parameter that may be undefined, rather than an optional
-     * one, and the difference matters: undefined means "the batch could not
-     * resolve this person", which is an answer, whereas an omitted argument would
-     * mean "the caller forgot" and used to be repaired by fetching readiness right
-     * here. That repair was a per-user, per-RULE fan-out hiding inside a function
-     * that looks like a pure predicate - the on-call rules are two of the six, so
-     * a team with both enabled paid for it twice per member - and it is gone. The
-     * only source of readiness is now the batch in getReadinessByUserId.
-     */
-    static async checkRuleCompliance(userId, projectId, ruleType, readiness) {
-        switch (ruleType) {
-            case ComplianceRuleType.HasNotificationEmailMethod:
-                return await this.checkHasNotificationEmail(userId, projectId);
-            case ComplianceRuleType.HasNotificationSMSMethod:
-                return await this.checkHasNotificationSMS(userId, projectId);
-            case ComplianceRuleType.HasNotificationCallMethod:
-                return await this.checkHasNotificationCall(userId, projectId);
-            case ComplianceRuleType.HasNotificationPushMethod:
-                return await this.checkHasNotificationPush(userId, projectId);
-            /*
-             * Not awaited: checkHasOnCallRules reads an array it was handed and makes
-             * no query at all, so there is nothing to wait for. An async wrapper would
-             * only make it look as though there were.
-             */
-            case ComplianceRuleType.HasIncidentOnCallRules:
-                return this.checkHasOnCallRules({
-                    notificationRuleType: NotificationRuleType.ON_CALL_EXECUTED_INCIDENT,
-                    severityKind: "incident",
-                    readiness: readiness,
-                });
-            case ComplianceRuleType.HasAlertOnCallRules:
-                return this.checkHasOnCallRules({
-                    notificationRuleType: NotificationRuleType.ON_CALL_EXECUTED_ALERT,
-                    severityKind: "alert",
-                    readiness: readiness,
-                });
-            default:
-                return { compliant: true, reason: "" };
-        }
-    }
-    static async checkHasNotificationEmail(userId, projectId) {
-        const userEmails = await UserEmailService.findBy({
-            query: {
-                userId: userId,
-                projectId: projectId,
-                isVerified: true,
-            },
-            select: {
-                _id: true,
-            },
-            props: {
-                isRoot: true,
-            },
-            limit: 1,
-            skip: 0,
-        });
-        const hasEmail = userEmails.length > 0;
-        return {
-            compliant: hasEmail,
-            reason: hasEmail
-                ? ""
-                : "No verified email address configured for notifications",
-        };
-    }
-    static async checkHasNotificationSMS(userId, projectId) {
-        const userSMS = await UserSmsService.findBy({
-            query: {
-                userId: userId,
-                projectId: projectId,
-                isVerified: true,
-            },
-            select: {
-                _id: true,
-            },
-            props: {
-                isRoot: true,
-            },
-            limit: 1,
-            skip: 0,
-        });
-        const hasSMS = userSMS.length > 0;
-        return {
-            compliant: hasSMS,
-            reason: hasSMS
-                ? ""
-                : "No verified phone number configured for SMS notifications",
-        };
-    }
-    static async checkHasNotificationCall(userId, projectId) {
-        const userCalls = await UserCallService.findBy({
-            query: {
-                userId: userId,
-                projectId: projectId,
-                isVerified: true,
-            },
-            select: {
-                _id: true,
-            },
-            props: {
-                isRoot: true,
-            },
-            limit: 1,
-            skip: 0,
-        });
-        const hasCall = userCalls.length > 0;
-        return {
-            compliant: hasCall,
-            reason: hasCall
-                ? ""
-                : "No verified phone number configured for call notifications",
-        };
-    }
-    static async checkHasNotificationPush(userId, projectId) {
-        const userPush = await UserPushService.findBy({
-            query: {
-                userId: userId,
-                projectId: projectId,
-                isVerified: true,
-            },
-            select: {
-                _id: true,
-            },
-            props: {
-                isRoot: true,
-            },
-            limit: 1,
-            skip: 0,
-        });
-        const hasPush = userPush.length > 0;
-        return {
-            compliant: hasPush,
-            reason: hasPush ? "" : "No verified push notification device configured",
-        };
-    }
-    /*
-     * Both on-call-rule compliance rules, answered off one readiness coverage
-     * array. A coverage cell is one (ruleType, severity) pair with the readiness
-     * service's verdict on it, which is what closes all four defects at once:
-     *
-     *  - the cell is keyed BY ruleType, so a rule that only fires when the user
-     *    goes off call can no longer be counted as incident coverage;
-     *  - `hasRule` is true for a rule on any of the seven channels, so a responder
-     *    whose only method is Telegram, WhatsApp or a webhook is no longer
-     *    reported as having nothing;
-     *  - the severities behind the cells are read with LIMIT_PER_PROJECT for both
-     *    kinds, so the incident and alert halves can no longer disagree about how
-     *    many severities a project may have;
-     *  - and the whole array arrives from one batched read, rather than one findBy
-     *    per severity per user.
-     *
-     * `isOptOut` is honoured as coverage, not as a gap. An opt-out row is the user
-     * saying "never notify me for this" on purpose; reporting that as a compliance
-     * failure would send an owner to fix something that is already the way it was
-     * asked to be. It matches the readiness contract, where Ready means every cell
-     * is covered OR explicitly muted.
-     *
-     * Readiness also reports cells for the two EPISODE rule types, and the
-     * ruleType filter drops them here. That is not an oversight: ComplianceRuleType
-     * has no episode rule, so the team's compliance settings never ask about
-     * episode coverage, and silently folding it into the incident or alert verdict
-     * would fail a team against a rule its owner never turned on. Episode coverage
-     * is visible on the readiness surfaces, where it is not gated by an opt-in
-     * per-team setting at all.
-     *
-     * The reason string names the missing severities in the order the readiness
-     * service reports them and falls back to the severity id when a severity has
-     * no name, because the owner reading it has to be able to act on it without
-     * opening anyone's settings.
-     *
-     * NO READINESS AT ALL is its own answer, and it is deliberately not a pass.
-     * The batch omits a user when it cannot resolve them - the ordinary cause
-     * being that they were removed from the project between the member read and
-     * the readiness read - and there are only two honest things to do with that:
-     * fail the whole page for everybody, or report the one row as unchecked. This
-     * feature exists because a responder can be silently unreachable, so reporting
-     * an unchecked responder as compliant would be the exact failure it was built
-     * to prevent, and failing the page over one departed member would take the
-     * other thirty-nine rows with it.
-     */
-    static checkHasOnCallRules(data) {
-        const userReadiness = data.readiness;
-        if (!userReadiness) {
-            return {
-                compliant: false,
-                reason: `Could not check ${data.severityKind} notification rules for this user - they may no longer be a member of this project`,
-            };
-        }
-        const missingSeverities = userReadiness.coverage
-            .filter((cell) => {
-            return (cell.ruleType === data.notificationRuleType &&
-                !cell.hasRule &&
-                !cell.isOptOut);
-        })
-            .map((cell) => {
-            var _a;
-            return cell.severityName || ((_a = cell.severityId) === null || _a === void 0 ? void 0 : _a.toString()) || "";
-        });
-        if (missingSeverities.length > 0) {
-            return {
-                compliant: false,
-                reason: `Missing notification rules for ${data.severityKind} severities: ${missingSeverities.join(", ")}`,
-            };
-        }
-        return {
-            compliant: true,
-            reason: "",
-        };
-    }
-}
-//# sourceMappingURL=TeamComplianceService.js.map

package/build/dist/Server/Services/TeamComplianceService.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"TeamComplianceService.js","sourceRoot":"","sources":["../../../../Server/Services/TeamComplianceService.ts"],"names":[],"mappings":"AAAA,OAAO,sBAIN,MAAM,0BAA0B,CAAC;AAClC,OAAO,4BAA4B,MAAM,gCAAgC,CAAC;AAC1E,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,WAAW,MAAM,eAAe,CAAC;AAExC,OAAO,kBAAkB,MAAM,qCAAqC,CAAC;AACrE,OAAO,oBAAoB,MAAM,mDAAmD,CAAC;AACrF,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,mCAAmC,CAAC;AACzD,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AA2BlE;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAW,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,OAAO,OAAO,qBAAqB;IACjC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CACzC,MAAgB,EAChB,SAAmB;QAEnB;;;;;;;;;WASG;QACH,MAAM,IAAI,GAAyB,MAAM,WAAW,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACtB,SAAS,EAAE,SAAS;aACrB;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED;;;;;;;WAOG;QACH,MAAM,kBAAkB,GAGnB,MAAM,4BAA4B,CAAC,MAAM,CAAC;YAC7C,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;aACrB;YACD,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,IAAI;aACd;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,mBAAmB;QACnB,MAAM,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;aACrB;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH;;;;;;;;WAQG;QACH,IAAI,WAAW,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAC5C,MAAM,CAAC,KAAK,CACV,8BAA8B,iBAAiB,oBAAoB,MAAM,CAAC,QAAQ,EAAE,eAAe,SAAS,CAAC,QAAQ,EAAE,wJAAwJ,CAChR,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAoB,WAAW;aACzC,GAAG,CAAC,CAAC,MAAkB,EAAY,EAAE;YACpC,OAAO,MAAM,CAAC,MAAO,CAAC;QACxB,CAAC,CAAC;aACD,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,mBAAmB;QACnB,MAAM,KAAK,GAAgB,MAAM,WAAW,CAAC,MAAM,CAAC;YAClD,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;aAC3B;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,IAAI;gBACX,GAAG,EAAE,IAAI;gBACT,gBAAgB,EAAE,IAAI;aACvB;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GACZ,kBAAkB,CAAC,GAAG,CACpB,CAAC,OAGA,EAAsD,EAAE;YACvD,OAAO;gBACL,QAAQ,EAAE,OAAO,CAAC,QAAS;gBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;aAClC,CAAC;QACJ,CAAC,CACF,CAAC;QAEJ,MAAM,iBAAiB,GACrB,MAAM,IAAI,CAAC,oBAAoB,CAC7B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAU,EAAY,EAAE;YACjC,OAAO,IAAI,CAAC,EAAG,CAAC;QAClB,CAAC,CAAC,EACF,SAAS,EACT,QAAQ,CACT,CAAC;QAEJ;;;;;;;;;WASG;QACH,MAAM,sBAAsB,GAC1B,MAAM,IAAI,CAAC,yBAAyB,CAClC,KAAK,EACL,4BAA4B,EAC5B,KAAK,EAAE,IAAU,EAAiC,EAAE;;YAClD,MAAM,gBAAgB,GAMlB,MAAM,IAAI,CAAC,mBAAmB,CAChC,IAAI,CAAC,EAAG,EACR,SAAS,EACT,QAAQ,EACR,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YAEF,uBACE,MAAM,EAAE,IAAI,CAAC,EAAG,EAChB,QAAQ,EACN,CAAA,MAAA,IAAI,CAAC,IAAI,0CAAE,QAAQ,EAAE,MAAI,MAAA,IAAI,CAAC,KAAK,0CAAE,QAAQ,EAAE,CAAA,IAAI,cAAc,EACnE,SAAS,EAAE,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,QAAQ,EAAE,KAAI,EAAE,EACvC,oBAAoB,EAAE,IAAI,CAAC,gBAAgB,IACxC,gBAAgB,EACnB;QACJ,CAAC,CACF,CAAC;QAEJ,OAAO;YACL,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,cAAc;YACrC,kBAAkB,EAAE,QAAQ;YAC5B,sBAAsB;SACvB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACK,MAAM,CAAC,KAAK,CAAC,oBAAoB,CACvC,OAAwB,EACxB,SAAmB,EACnB,QAAmE;QAEnE,MAAM,iBAAiB,GAA+B,IAAI,GAAG,EAG1D,CAAC;QAEJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,MAAM,cAAc,GAAY,QAAQ,CAAC,IAAI,CAC3C,CAAC,OAGA,EAAW,EAAE;YACZ,OAAO,CACL,OAAO,CAAC,OAAO;gBACf,CAAC,OAAO,CAAC,QAAQ,KAAK,kBAAkB,CAAC,sBAAsB;oBAC7D,OAAO,CAAC,QAAQ,KAAK,kBAAkB,CAAC,mBAAmB,CAAC,CAC/D,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAgB,IAAI,GAAG,CACjC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAgB,EAAU,EAAE;YACvC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,OAAO,GACX,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAEjE,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACtC,MAAM,GAAG,GAAW,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAoB,OAAO,CAAC,MAAM,CAC7C,CAAC,MAAgB,EAAW,EAAE;YAC5B,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnD,CAAC,CACF,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED;;;;;;WAMG;QACH,MAAM,MAAM,GACV,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAExE,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC5C,KAAoB,EACpB,cAAsB,EACtB,MAA0C;QAE1C,MAAM,OAAO,GAAmB,IAAI,KAAK,CAAU,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,MAAM,GAAW,CAAC,CAAC;QAEvB,MAAM,SAAS,GAAwB,KAAK,IAAmB,EAAE;YAC/D,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAW,MAAM,CAAC;gBAC7B,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAyB,EAAE,CAAC;QAEzC,KACE,IAAI,MAAM,GAAW,CAAC,EACtB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAC/C,MAAM,EAAE,EACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACtC,MAAgB,EAChB,SAAmB,EACnB,kBAGE,EACF,SAAoC;QAKpC,MAAM,iBAAiB,GAGlB,EAAE,CAAC;QAER,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,mBAAmB,CAC5B,MAAM,EACN,SAAS,EACT,OAAO,CAAC,QAAQ,EAChB,SAAS,CACV,CAAC;YAEJ,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,iBAAiB,CAAC,IAAI,CAAC;oBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,WAAW,EAAE,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAC3C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACtC,MAAgB,EAChB,SAAmB,EACnB,QAA4B,EAC5B,SAAoC;QAEpC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,kBAAkB,CAAC,0BAA0B;gBAChD,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEjE,KAAK,kBAAkB,CAAC,wBAAwB;gBAC9C,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAE/D,KAAK,kBAAkB,CAAC,yBAAyB;gBAC/C,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEhE,KAAK,kBAAkB,CAAC,yBAAyB;gBAC/C,OAAO,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEhE;;;;eAIG;YACH,KAAK,kBAAkB,CAAC,sBAAsB;gBAC5C,OAAO,IAAI,CAAC,mBAAmB,CAAC;oBAC9B,oBAAoB,EAAE,oBAAoB,CAAC,yBAAyB;oBACpE,YAAY,EAAE,UAAU;oBACxB,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;YAEL,KAAK,kBAAkB,CAAC,mBAAmB;gBACzC,OAAO,IAAI,CAAC,mBAAmB,CAAC;oBAC9B,oBAAoB,EAAE,oBAAoB,CAAC,sBAAsB;oBACjE,YAAY,EAAE,OAAO;oBACrB,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;YAEL;gBACE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC5C,MAAgB,EAChB,SAAmB;QAEnB,MAAM,UAAU,GAA4B,MAAM,gBAAgB,CAAC,MAAM,CAAC;YACxE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAY,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,OAAO;YACL,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,QAAQ;gBACd,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,wDAAwD;SAC7D,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAC1C,MAAgB,EAChB,SAAmB;QAEnB,MAAM,OAAO,GAA4B,MAAM,cAAc,CAAC,MAAM,CAAC;YACnE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,MAAM,MAAM,GAAY,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,2DAA2D;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAC3C,MAAgB,EAChB,SAAmB;QAEnB,MAAM,SAAS,GAA4B,MAAM,eAAe,CAAC,MAAM,CAAC;YACtE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAY,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,4DAA4D;SACjE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAC3C,MAAgB,EAChB,SAAmB;QAEnB,MAAM,QAAQ,GAA4B,MAAM,eAAe,CAAC,MAAM,CAAC;YACrE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,MAAM,OAAO,GAAY,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iDAAiD;SACzE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACK,MAAM,CAAC,mBAAmB,CAAC,IAIlC;QACC,MAAM,aAAa,GAA8B,IAAI,CAAC,SAAS,CAAC;QAEhE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,mBAAmB,IAAI,CAAC,YAAY,oFAAoF;aACjI,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAkB,aAAa,CAAC,QAAQ;aAC5D,MAAM,CAAC,CAAC,IAA2B,EAAW,EAAE;YAC/C,OAAO,CACL,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,oBAAoB;gBAC3C,CAAC,IAAI,CAAC,OAAO;gBACb,CAAC,IAAI,CAAC,QAAQ,CACf,CAAC;QACJ,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAA2B,EAAU,EAAE;;YAC3C,OAAO,IAAI,CAAC,YAAY,KAAI,MAAA,IAAI,CAAC,UAAU,0CAAE,QAAQ,EAAE,CAAA,IAAI,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEL,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,kCAAkC,IAAI,CAAC,YAAY,gBAAgB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC1G,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;CACF"}