@open-everywhere/core 0.1.0

package/dist/agent/ops/census.d.ts

@@ -0,0 +1,411 @@
+import { type Bundle } from "../access/bundle.js";
+import type { ConnectorCredentials } from "../access/connector-credentials.js";
+import type { CredentialBoundDomain } from "../access/domain-credentials.js";
+import type { WebhookHook } from "../webhooks/config.js";
+/** One credential row the deployment must hold, and the config that makes it required. */
+export interface CensusCredential {
+    /** The stored-credential ref, as the broker resolves it (`db:<connector>:<credentialId>`, or a
+     *  hook's own ref). */
+    readonly ref: string;
+    /** WHY it is required — one clause per config site that names it, joined by "; ". */
+    readonly reason: string;
+}
+/** A channel-plumbing credential a mounted provider resolves. The provider supplies it: the
+ *  credential is named by the code that resolves it, not by any grant, so no config join can find
+ *  it (this is exactly the `db:notion:channel-key` shape). */
+export interface PlumbingCredential {
+    readonly connector: string;
+    readonly credentialId: string;
+    readonly reason: string;
+}
+export interface CredentialPlanInput {
+    readonly bundles: readonly Bundle[];
+    readonly catalogues: readonly ConnectorCredentials[];
+    readonly domains: readonly (CredentialBoundDomain & {
+        readonly name: string;
+    })[];
+    readonly hooks: readonly WebhookHook[];
+    readonly plumbing: readonly PlumbingCredential[];
+}
+export interface CredentialPlan {
+    /** Every required ref, deduplicated and sorted. */
+    readonly required: readonly CensusCredential[];
+    /**
+     * Every OTHER db-homed ref the catalogues declare — declared, but named by no live path.
+     * INVENTORY, never a gate. `db:notion:memory` is the standing example: it is declared so a domain
+     * binding can name it, and the org-default memory read resolves through its own broker arguments
+     * instead, so requiring a row for it would make the census permanently red and therefore ignored.
+     * Reported so the whole declared set is visible, with its store presence stated either way.
+     */
+    readonly declaredOnly: readonly CensusCredential[];
+    /** Config that names a credential its connector does not configure. The resolver contributes
+     *  nothing for such a grant, so the capability reads as live and is not. */
+    readonly problems: readonly string[];
+}
+/**
+ * Derive every credential row this deployment must hold.
+ *
+ * Five config sites name one. Each is a LIVE resolution path — a missing row makes that exact path
+ * fail closed, silently, at the moment it is first used:
+ *   1. a bundle's egress `connections[]` entry stamped `broker: "db"` (the firewall injects it);
+ *   2. a bundle's `connectors[]` grant, through the named credential's catalogue entry;
+ *   3. a domain's `credentials[]` binding, through the credential it names in `use`;
+ *   4. a webhook hook stamped `broker: "db"` — every ref in its list, because a rotation window is
+ *      declared as live until the operator removes the old key;
+ *   5. a mounted provider's channel plumbing, supplied by the caller.
+ */
+export declare function planRequiredCredentials(input: CredentialPlanInput): CredentialPlan;
+/** One route of one mounted channel, as eve's own `defineChannel` declares it. */
+export interface MountedRoute {
+    /** The mounted channel module this route came from — reported so a red names the file to open. */
+    readonly channel: string;
+    readonly method: string;
+    readonly path: string;
+}
+/** One endpoint the census probes, and what an answer proves. */
+export interface CensusEndpoint {
+    readonly method: "POST";
+    readonly path: string;
+    readonly reason: string;
+    /** What "answering" means for THIS endpoint, in operator words. */
+    readonly meaning: string;
+    /** `mounted` — a refusal proves the route serves. `absent` — the negative control, which must 404
+     *  or every other probe on its family proves nothing. */
+    readonly expect: "mounted" | "absent";
+}
+export interface SkippedRoute {
+    readonly method: string;
+    readonly path: string;
+    readonly channel: string;
+    readonly reason: string;
+}
+export interface EndpointPlan {
+    readonly endpoints: readonly CensusEndpoint[];
+    readonly skipped: readonly SkippedRoute[];
+}
+/**
+ * A mounted channel whose routes only SERVE once an arming condition holds. Until then every route
+ * answers 404 by design, and a bare probe cannot tell that apart from a route that is not mounted.
+ *
+ * 🔴 THIS MIRRORS THE CHANNEL'S OWN CODE — it never re-decides the condition. `armed` must read the
+ * same names the channel reads, so a channel that changes what arms it and forgets this entry makes
+ * the census DEMAND a dark route again (a red on a correct deployment), never accept a missing one.
+ * That asymmetry is deliberate: the failure mode of a stale entry is a false red, not a false green.
+ */
+export interface ChannelArming {
+    /** The mounted channel file, exactly as {@link MountedRoute.channel} spells it. */
+    readonly channel: string;
+    /** Whether the plane is armed, from the environment the OPERATOR runs the census with. */
+    readonly armed: (env: NodeJS.ProcessEnv) => boolean;
+    /** The operator sentence a skip prints — it must name what to set to make the route required. */
+    readonly darkReason: string;
+}
+/**
+ * Every channel that ships dark. ONE entry today: the control plane's OAuth authorization server and
+ * MCP mount (OPE-72), which answer 404 unless BOTH the signing secret is set (env — infrastructure)
+ * and the issuer is declared in tracked config. `channels/control-mcp.ts` states the same two
+ * conditions in its own header, and `control/oauth-route.ts`'s `armed()` is the code this mirrors.
+ *
+ * THE TRACKED HALF DECIDES IT TODAY. `CONTROL_OAUTH_ISSUER` is `""` on this repository, so the plane
+ * is dark by tracked config alone and the env half changes nothing until a deployer declares an
+ * issuer by pull request. That is why this entry needs no deployment round trip to be right here.
+ *
+ * ⚠️ WHAT THE ENV HALF WILL REST ON once an issuer IS declared, said plainly because the census
+ * probes a REMOTE deployment: it reads the OPERATOR's environment, not the deployment's, so it is
+ * right only while the two agree — the same `.env.local` convention every credential rung here
+ * already depends on. THE TWO DISAGREEMENTS ARE NOT SYMMETRIC, and only one of them is safe:
+ *   • operator ARMED, deployment DARK ⇒ the route is required and its 404 reds. That is the
+ *     census's original behaviour and the safe direction.
+ *   • operator DARK, deployment ARMED ⇒ the route is SKIPPED WHILE IT IS SERVING, and the census
+ *     passes without probing it. Nothing here can see that: the only trace is a NOT PROBED line
+ *     whose printed reason ("this route's 404 is the shipped design") is then FALSE. The census
+ *     exists because a route can be dead behind a green, and this is a way to buy exactly that.
+ * So set the signing secret in the environment you run the census from, on any deployment whose
+ * issuer is declared. A live arming probe would close this properly; it needs the census RUNNER,
+ * which this module does not hold.
+ */
+export declare const ROUTE_ARMING: readonly ChannelArming[];
+/**
+ * Derive the endpoints to probe from the routes the mounted channels declare.
+ *
+ * A route whose channel is DARK by declaration ({@link ROUTE_ARMING}) is skipped before anything
+ * else, because "this route is deliberately off" is the most specific thing the census can say
+ * about it, and every reason below would be wrong about a route that is not serving at all.
+ *
+ * Otherwise, ONLY POST ROUTES, and only ones a bare probe can interpret:
+ *   • `/webhooks/:id` expands to one endpoint per DECLARED hook — the incident family. A declared id
+ *     refuses an unsigned delivery; an undeclared one 404s. `controlHookId` rides along as the
+ *     negative control: if it does not 404, every id answers and the hook probes prove nothing.
+ *   • a POST route whose path ALSO has a GET route on the same channel is a token-gated page. It
+ *     answers 404 without its signed token, so a probe cannot tell "mounted" from "absent" — skipped
+ *     with that reason rather than asserted.
+ *   • any other parameterised path is skipped: the census cannot synthesise a valid parameter.
+ */
+export declare function planRequiredEndpoints(input: {
+    readonly routes: readonly MountedRoute[];
+    readonly hooks: readonly WebhookHook[];
+    readonly controlHookId: string;
+    /** The environment the arming conditions are read from. Injectable so a suite can drive the dark
+     *  and the armed plan without touching the process. */
+    readonly env?: NodeJS.ProcessEnv;
+    /** The arming declarations to apply. Injectable for the same reason; defaults to the real table. */
+    readonly arming?: readonly ChannelArming[];
+}): EndpointPlan;
+/** What one observed status says about a route. */
+export type EndpointState = "mounted" | "absent" | "accepted-unsigned" | "server-error" | "unreachable";
+/**
+ * Classify one probe. A 4xx that is not 404 is the PASS: the route served the request and refused
+ * it. A 2xx is a failure of a different kind and is named as one — an ingress that accepts an
+ * unsigned body is worse than an ingress that is missing.
+ */
+export declare function classifyEndpoint(status: number | undefined): EndpointState;
+/** Whether the AES key opens the stored envelopes. NEVER carries a plaintext, a prefix or a length
+ *  that could narrow one — only the verdict and a fixed operator sentence. */
+export interface KeyProof {
+    /** The ref whose envelope was tested. */
+    readonly ref: string;
+    readonly ok: boolean;
+    readonly detail: string;
+}
+/**
+ * Prove the AES key can open a stored row.
+ *
+ * 🔴 WHY THE CENSUS NEEDS THIS. `listStoredCredentialRefs` needs no key, so a census without this
+ * check reports "every row present" while `OE_CREDENTIAL_ENCRYPTION_KEY` is absent, wrong or
+ * rotated — and in that state EVERY `broker: "db"` credential fails closed at once, behind 200
+ * responses, with the Notion incident's exact symptom (silence). A presence-only census would be
+ * green through the largest failure in this plane.
+ *
+ * 🔴 WHAT IT DOES NOT PROVE. The key it uses is the one in THIS process. It proves the rows are
+ * openable, not that the deployment's own environment still carries the key — nothing observable
+ * from outside says that, and the census must not imply otherwise.
+ *
+ * NO PLAINTEXT ESCAPES. `decrypt` runs inside this function, its result is measured for emptiness
+ * and discarded, and the error path returns a fixed sentence rather than the thrown message.
+ */
+export declare function proveKeyOpensRow(input: {
+    readonly ref: string;
+    readonly ciphertext: string;
+    readonly decrypt: (blob: string) => string;
+}): KeyProof;
+/** One scheduled action the census GATES on: a stale or missing row fails the census. */
+export interface RequiredHeartbeat {
+    readonly action: string;
+    readonly reason: string;
+    /** The bound to fail against, in hours — see {@link cronCeilingHours}. */
+    readonly maxAgeHours: number;
+}
+/** One scheduled action the census REPORTS the age of but never fails on — see the header above. */
+export interface ReportedHeartbeat {
+    readonly action: string;
+    readonly reason: string;
+}
+/**
+ * The relay heartbeat's own staleness ceiling, DERIVED from its configured interval — never
+ * hand-typed here — the same "derived, not declared" rule {@link cronCeilingHours} follows for the
+ * cron heartbeats.
+ *
+ * Headroom for TWO missed beats, not one: a single skipped tick under network jitter (a Railway
+ * restart, a brief network blip — see OPE-785) must not false-red the census, only a relay that has
+ * gone genuinely quiet. Three beats' worth of headroom (the one due, plus two missed) is what that
+ * buys.
+ *
+ * FAILS LOUD on a non-positive interval, on purpose: a silently-wrong bound is worse than a thrown
+ * error naming exactly what looks wrong. The caller is responsible for routing an explicitly
+ * DISABLED relay heartbeat (`OE_RELAY_HEARTBEAT_MS=0`, the same value that disables it at the relay
+ * itself) around this function entirely, back to the REPORTED half — see {@link channelGatedHeartbeats}.
+ */
+export declare function relayHeartbeatCeilingHours(intervalMs: number): number;
+/**
+ * GATED heartbeats a mounted channel contributes (OPE-785), once the census can derive a ceiling
+ * for them — the channel-contributed counterpart to {@link CHANNEL_REPORTED_HEARTBEATS}, kept as a
+ * separate table because a GATED entry needs a `maxAgeHours` no REPORTED one carries.
+ *
+ * `discordRelayHeartbeatMs` is the operator's own mirror of `OE_RELAY_HEARTBEAT_MS` — the SAME env
+ * var name the always-on relay (deploy/discord-relay/index.js) reads for its own interval, so
+ * pointing the census at the relay's actual value is a one-name copy, not a second config surface.
+ * `0` means what it means to the relay: heartbeat disabled — the census then contributes nothing
+ * here (the channel still contributes its REPORTED `discord.dispatched` unaffected).
+ */
+export declare function channelGatedHeartbeats(files: readonly string[], discordRelayHeartbeatMs: number): readonly RequiredHeartbeat[];
+/**
+ * What `files` — the channel modules the roster actually mounted — contribute to the census. Pure,
+ * so the census script stays a thin caller and the roster-conditional behaviour is testable offline.
+ * An unknown file contributes nothing; it is a channel with no caveat, not an error.
+ */
+export declare function channelCensusContributions(files: readonly string[]): {
+    readonly limits: readonly string[];
+    readonly reportedHeartbeats: readonly ReportedHeartbeat[];
+};
+/** One row's timestamp, as read off the audit trail. `lastSeenIso` absent = no row ever. */
+export interface HeartbeatObservation {
+    readonly action: string;
+    readonly lastSeenIso?: string;
+}
+export interface HeartbeatFinding {
+    readonly action: string;
+    readonly reason: string;
+    readonly lastSeenIso?: string;
+    readonly ageHours?: number;
+    /** Present only for a GATED heartbeat — a REPORTED one carries no bound to measure against. */
+    readonly maxAgeHours?: number;
+    readonly ok: boolean;
+}
+/**
+ * A daily (`"M H * * *"`) or weekly (`"M H * * D"`) cron's staleness ceiling, with headroom for
+ * scheduler jitter and one skipped tick. DERIVED from the schedule's own cron string (read at the
+ * call site off the compiled schedule module — never hand-typed here), so a cadence change updates
+ * the bound automatically instead of silently drifting out of step with it — the same "derived,
+ * never declared" rule {@link planRequiredCredentials} already follows.
+ *
+ * FAILS LOUD on any other shape, on purpose: a silently-wrong bound is worse than a thrown error
+ * naming exactly what to extend.
+ */
+export declare function cronCeilingHours(cron: string): number;
+/** Join the gated + reported heartbeat plans against what the audit trail actually holds. */
+export declare function heartbeatFindings(input: {
+    readonly gated: readonly RequiredHeartbeat[];
+    readonly reported: readonly ReportedHeartbeat[];
+    readonly observations: readonly HeartbeatObservation[];
+    readonly now: Date;
+}): readonly HeartbeatFinding[];
+/** One `GET /control/v1/runtime-signal` observation, or absent when the call could not be made
+ *  (no token, the route 404s/401s, a network failure). */
+export interface RuntimeSignalFinding {
+    readonly ok: boolean;
+    readonly detail: string;
+}
+/**
+ * Turn one `{ hasDeploymentId }` observation (or its absence) into a finding. `observed` undefined
+ * covers every reason the call did not complete — no token configured, the route unmounted
+ * (`OE_CONTROL_READ_TOKENS` unset), a network error — and reads as NOT PROVEN, never as a silent
+ * pass: a census that cannot reach the route says so instead of reporting green by omission.
+ */
+export declare function runtimeSignalFinding(observed: {
+    readonly hasDeploymentId: boolean;
+} | undefined): RuntimeSignalFinding;
+/** One `GET /control/v1/runtime-signal` `credentialBrokerArmed` observation, or absent when the
+ *  call could not be made (no token, the route 404s/401s, a network failure, or an older
+ *  deployment whose route does not yet carry the field). */
+export interface CredentialBrokerArmedFinding {
+    readonly ok: boolean;
+    readonly detail: string;
+}
+/**
+ * Turn one `{ credentialBrokerArmed }` observation (or its absence) into a finding. `observed`
+ * undefined covers every reason the call did not complete or the field was absent from an older
+ * deployment's response — and reads as NOT PROVEN, never as a silent pass, the same posture
+ * {@link runtimeSignalFinding} takes for its own field.
+ */
+export declare function credentialBrokerArmedFinding(observed: {
+    readonly credentialBrokerArmed: boolean;
+} | undefined): CredentialBrokerArmedFinding;
+export interface CredentialFinding {
+    readonly ref: string;
+    readonly reason: string;
+    readonly present: boolean;
+}
+export interface EndpointFinding {
+    readonly method: "POST";
+    readonly path: string;
+    readonly reason: string;
+    readonly meaning: string;
+    readonly expect: "mounted" | "absent";
+    readonly status?: number;
+    readonly state: EndpointState;
+    readonly ok: boolean;
+}
+/**
+ * THE AUDIT-ROW EXERCISE CHECK (OPE-1837) — one finding per CONSEQUENTIAL audit action the registry
+ * declares.
+ *
+ * WHY THE CENSUS AND NOT A TEST TIER. `npm test` proves the code that writes a row. It cannot prove
+ * the ship's own e2e pack ever DROVE the path that writes it, and an action no journey exercises is
+ * an action whose disappearance nothing reds: 22% of this tree's audit actions were named by no
+ * test, e2e or soak (coverage audit, 2026-09-14). The census reads the DEPLOYMENT's own audit log
+ * after a pack, which is the only place that question has an answer.
+ *
+ * 🔴 ABSENCE IS A FINDING, NOT A FAILURE, AND THE DIFFERENCE IS THE REGISTRY'S OWN `notExercised`.
+ * A declaration carrying a reason is reported as a stated gap and does not gate; a declaration
+ * WITHOUT one is a row the pack was supposed to produce and did not. That is what makes the reason
+ * field a debt with somebody's name on it rather than a way to silence the check.
+ */
+export interface AuditRowFinding {
+    readonly action: string;
+    /** True when at least one row with this action was found in the window. */
+    readonly exercised: boolean;
+    /** The registry's reason this row is not exercised, when it carries one. */
+    readonly notExercised?: string;
+    /** ISO timestamp of the most recent row, when there is one. */
+    readonly lastSeenIso?: string;
+    /** False only for a declaration with no row AND no stated reason. */
+    readonly ok: boolean;
+}
+/**
+ * Judges one declaration against what the log holds. Pure, so the whole matrix — exercised,
+ * unexercised-with-reason, unexercised-without — is driven offline without a deployment.
+ */
+export declare function judgeAuditRow(declaration: {
+    readonly action: string;
+    readonly notExercised?: string;
+}, lastSeenIso: string | undefined): AuditRowFinding;
+/** The census's own summary of the audit-row half, for the report and the problem list. */
+export declare function auditRowProblems(findings: readonly AuditRowFinding[]): readonly string[];
+export interface CensusResult {
+    readonly ok: boolean;
+    readonly target: string;
+    readonly storeLabel: string;
+    readonly credentials: readonly CredentialFinding[];
+    /** Declared-but-unrequired refs, with their presence — inventory only, never a gate. */
+    readonly declared: readonly CredentialFinding[];
+    readonly endpoints: readonly EndpointFinding[];
+    readonly skipped: readonly SkippedRoute[];
+    readonly problems: readonly string[];
+    /** Absent when the key check was not run (`--no-key-check`, or no row to test). */
+    readonly keyProof?: KeyProof;
+    /** OPE-635 — the scheduled-action liveness read (see the heartbeat half above). Empty when the
+     *  caller ran with `--no-heartbeat-check`. */
+    readonly heartbeats: readonly HeartbeatFinding[];
+    /** OPE-658 — the runtime-revision signal (see the section above). Absent when the caller ran
+     *  with `--no-runtime-signal-check`. */
+    readonly runtimeSignal?: RuntimeSignalFinding;
+    /** OPE-641 — the deployment's own credential-encryption-key-armed signal (see the section
+     *  above). Absent when the caller ran with `--no-credential-key-armed-check`. */
+    readonly credentialBrokerArmed?: CredentialBrokerArmedFinding;
+    /** OPE-1837 — one finding per consequential audit action the registry declares. Empty when the
+     *  caller ran with `--no-audit-row-check`. */
+    readonly auditRows: readonly AuditRowFinding[];
+    /** What the census did NOT establish, stated so a green is never read as wider than it is. */
+    readonly limits: readonly string[];
+}
+/** One observed probe result. `status` is absent when the request never completed. */
+export interface EndpointObservation {
+    readonly path: string;
+    readonly status?: number;
+}
+/**
+ * Join the plan against what the deployment answered. `presentRefs` is the ref list the broker store
+ * holds — names only, never values.
+ *
+ * The census is clean only when EVERY required row exists, EVERY probed endpoint answers as its
+ * `expect` says, and no config problem was found. There is no partial pass: a census that reports
+ * "mostly complete" is the state the incident was already in.
+ */
+export declare function censusResult(input: {
+    readonly target: string;
+    readonly storeLabel: string;
+    readonly plan: CredentialPlan;
+    readonly endpoints: EndpointPlan;
+    readonly presentRefs: readonly string[];
+    readonly observations: readonly EndpointObservation[];
+    readonly keyProof?: KeyProof;
+    readonly heartbeats?: readonly HeartbeatFinding[];
+    readonly runtimeSignal?: RuntimeSignalFinding;
+    readonly credentialBrokerArmed?: CredentialBrokerArmedFinding;
+    readonly auditRows?: readonly AuditRowFinding[];
+    readonly limits?: readonly string[];
+}): CensusResult;
+/** The operator-facing report. Every line is a fact the census established; nothing is summarised
+ *  away, because a census that hides its inventory cannot be audited. */
+export declare function renderCensusReport(result: CensusResult): string[];
+//# sourceMappingURL=census.d.ts.map

package/dist/agent/ops/census.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"census.d.ts","sourceRoot":"","sources":["../../../agent/ops/census.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAgD,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,KAAK,EAAuB,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAI7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B;2BACuB;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;8DAE8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,qBAAqB,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnD;gFAC4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuFlF;AAID,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;6DACyD;IACzD,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAC3C;AAKD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;IACpD,iGAAiG;IACjG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,aAAa,EAShD,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;2DACuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C,GAAG,YAAY,CA+Ef;AAED,mDAAmD;AACnD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,mBAAmB,GAAG,cAAc,GAAG,aAAa,CAAC;AAExG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAM1E;AAID;8EAC8E;AAC9E,MAAM,WAAW,QAAQ;IACvB,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GAAG,QAAQ,CAenJ;AAiBD,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAuDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,uBAAuB,EAAE,MAAM,GAAG,SAAS,iBAAiB,EAAE,CAU9H;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG;IACpE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC3D,CASA;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,SAAS,gBAAgB,EAAE,CAkB9B;AA6BD;0DAC0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GAAG,oBAAoB,CAsBtH;AAiBD;;4DAE4D;AAC5D,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GAAG,4BAA4B,CAyB5I;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACxE,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,eAAe,CAejB;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,MAAM,EAAE,CAOxF;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACnD,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B;kDAC8C;IAC9C,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACjD;4CACwC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C;qFACiF;IACjF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAC9D;kDAC8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,GAAG,YAAY,CAyCf;AAED;yEACyE;AACzE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CA6GjE"}