@r8s/matrix 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,151 @@
+export interface MatrixSSOProps {
+    /** Keycloak/OIDC issuer URL (e.g. https://keycloak.example.com/realms/berget) */
+    issuer: string;
+    /** OIDC client id registered in the realm */
+    clientId: string;
+    /**
+     * Name of an existing Secret containing key `clientSecret`. Required unless
+     * a secrets backend (openbao/vault) is configured on the surrounding
+     * Platform — the backend then provisions `${name}-keycloak-oidc`.
+     */
+    clientSecretRef?: string;
+    /** Display name on the MAS login button (default: 'SSO') */
+    humanName?: string;
+    /** OIDC scope (default: 'openid email profile') */
+    scope?: string;
+}
+export interface MatrixDatabaseProps {
+    /** CNPG instances (default: 2) */
+    replicas?: number;
+    /** Storage size per database (default: '20Gi') */
+    storage?: string;
+    /** StorageClass name (default: cluster default) */
+    storageClass?: string;
+    /**
+     * Backup configuration — barman object store + scheduled full backups.
+     * Set to false to disable. Defaults to off unless specified (explicit opt-in
+     * so you can't forget: a disk-full WAL incident is exactly what this prevents).
+     */
+    backup?: {
+        /** S3 destination path, e.g. s3://bucket/matrix-cnpg */
+        destinationPath: string;
+        /** S3 endpoint URL (e.g. https://s3.berget.cloud) */
+        endpointURL: string;
+        /** Existing Secret with keys `access-key-id` + `secret-access-key`. Provisioned by the secrets backend when not given. */
+        credentialsSecret?: string;
+        /** Retention policy (default: '30d') */
+        retention?: string;
+        /** Cron schedule for the daily full backup (default: '30 3 * * *') */
+        schedule?: string;
+    } | null;
+}
+export interface MatrixRTCProps {
+    /** Enable MatrixRTC / LiveKit SFU (default: true) */
+    enabled?: boolean;
+    /**
+     * External IP for the SFU LoadBalancer — LiveKit needs a real IP (not DNS)
+     * for ICE. Leave unset to rely on STUN discovery.
+     */
+    manualIP?: string;
+    /** TURN server port on the combined LoadBalancer (default: 30004, 0 disables) */
+    turnPort?: number;
+    /** Extra STUN servers for client NAT traversal */
+    stunServers?: string[];
+    /** LiveKit image tag (default: v1.10.1 — pinned for the IPv6 ICE URL regression) */
+    sfuVersion?: string;
+}
+export interface MatrixProps {
+    /** Resource name (defaults to 'matrix') */
+    name?: string;
+    /** Kubernetes namespace (inherited from Platform context when omitted) */
+    namespace?: string;
+    /** Base domain — derives the five public hosts (see `hosts`) */
+    domain: string;
+    /**
+     * Host overrides. Defaults:
+     * web: `element.<domain>`, synapse: `matrix.<domain>`,
+     * admin: `element-admin.<domain>`, account: `matrix-account.<domain>`,
+     * rtc: `matrix-rtc.<domain>`
+     */
+    hosts?: Partial<Record<'web' | 'synapse' | 'admin' | 'account' | 'rtc', string>>;
+    /** Replicas for the stateless web/admin/mas/haproxy-ish layers (default: 2; synapse and SFU stay at 1 until federation workers land) */
+    replicas?: number;
+    /** Matrix server name — becomes part of user IDs (@user:serverName). Defaults to `domain`. */
+    serverName?: string;
+    /** SSO/OIDC upstream for MAS (Keycloak). Password login disabled when set. */
+    sso?: MatrixSSOProps;
+    /** Per-database sizing + backup for synapse-db and mas-db */
+    database?: MatrixDatabaseProps;
+    /** MatrixRTC / LiveKit SFU (Element Call backend) */
+    rtc?: MatrixRTCProps;
+    /**
+     * Appservice registrations (hookshot, bots…). Each mounts one
+     * `registration.yaml` into Synapse's appservice directory.
+     *
+     * Two modes per entry:
+     * - `registration`: inline YAML data rendered as a **Secret** (never a
+     *   ConfigMap — registrations carry as_token/hs_token). Use placeholders
+     *   for the tokens and let GitOps fill them, or expect the
+     *   noPlaintextSecrets guardrail to flag live token values.
+     * - `secretRef`: name of an existing Secret holding `registration.yaml`
+     *   (key override via `key`). Nothing rendered — the preferred mode when
+     *   the file lives in the secrets backend.
+     */
+    appservices?: ({
+        name: string;
+        registration: Record<string, unknown>;
+        secretRef?: never;
+        key?: never;
+    } | {
+        name: string;
+        secretRef: string;
+        key?: string;
+        registration?: never;
+    })[];
+    /**
+     * Version pinning per component (production: pin these — the defaults are
+     * already pinned for known upstream regressions):
+     * web: v1.12.15 (MSC4143 Authorization header fix),
+     * sfu: v1.10.1 (IPv6 ICE URL fix)
+     */
+    version?: {
+        synapse?: string;
+        mas?: string;
+        web?: string;
+        admin?: string;
+        sfu?: string;
+    };
+    /** Disable the URL-preview SSRF blacklist preset (default: enabled, hardened) */
+    urlPreview?: boolean;
+}
+/**
+ * Matrix — full Element Server Suite: Synapse homeserver, MAS with Keycloak
+ * OIDC, Element Web + Admin, MatrixRTC/LiveKit SFU.
+ *
+ * @title Matrix (Element Server Suite)
+ * @category Collaboration & Productivity
+ *
+ * Renders the whole suite with production HA defaults: two CNPG databases
+ * (optional barman backups), 60s node-failure tolerations + topology spread
+ * (learned from a real node-blip incident), SSRF-hardened URL previews, and
+ * pinned component versions.
+ *
+ * Secrets arrive via the Platform secrets backend (openbao/vault) or the
+ * `clientSecretRef`/`credentialsSecret` escape hatches — never inline.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Matrix } from '@r8s/matrix'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'matrix' }}>
+ *     <Matrix
+ *       domain="example.com"
+ *       sso={{ issuer: 'https://keycloak.example.com/realms/berget', clientId: 'matrix' }}
+ *       database={{ backup: { destinationPath: 's3://backups/matrix-cnpg', endpointURL: 'https://s3.example.com' } }}
+ *     />
+ *   </Platform>
+ * )
+ */
+export declare function Matrix(props: MatrixProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAgEA,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAA;IACd,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,wDAAwD;QACxD,eAAe,EAAE,MAAM,CAAA;QACvB,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAA;QACnB,0HAA0H;QAC1H,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,wCAAwC;QACxC,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,sEAAsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GAAG,IAAI,CAAA;CACT;AAED,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;IAChF,wIAAwI;IACxI,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,qDAAqD;IACrD,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,CACV;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,KAAK,CAAC;QAAC,GAAG,CAAC,EAAE,KAAK,CAAA;KAAE,GACvF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,KAAK,CAAA;KAAE,CAC1E,EAAE,CAAA;IACH;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,GAAG,CAAC,EAAE,MAAM,CAAA;KACb,CAAA;IACD,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,kCAwwBxC"}

package/dist/index.js

@@ -0,0 +1,814 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Matrix = Matrix;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+const postgresql_1 = require("@r8s/crds/postgresql");
+const recipes_1 = require("@r8s/recipes");
+/** HA scheduling defaults learned from a production node-blip incident:
+ *  evict within 60s (instead of the 300s default) and spread replicas
+ *  across nodes so one node loss never takes an entire component down. */
+const HA_TOLERATIONS = [
+    {
+        key: 'node.kubernetes.io/unreachable',
+        operator: 'Exists',
+        effect: 'NoExecute',
+        tolerationSeconds: 60,
+    },
+    {
+        key: 'node.kubernetes.io/not-ready',
+        operator: 'Exists',
+        effect: 'NoExecute',
+        tolerationSeconds: 60,
+    },
+];
+const haTopologySpread = (app) => [
+    {
+        maxSkew: 1,
+        topologyKey: 'kubernetes.io/hostname',
+        whenUnsatisfiable: 'ScheduleAnyway',
+        // Scope the skew calculation to this component's pods — a constraint
+        // without a selector matches every pod in the namespace.
+        labelSelector: { matchLabels: { app } },
+    },
+];
+/** URL preview SSRF hardening — block internal/private ranges (production default) */
+const URL_PREVIEW_BLACKLIST = {
+    url_preview_enabled: true,
+    max_spider_size: '10M',
+    url_preview_ip_range_blacklist: [
+        '0.0.0.0/8',
+        '127.0.0.0/8',
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '192.168.0.0/16',
+        '100.64.0.0/10',
+        '192.0.0.0/24',
+        '192.0.2.0/24',
+        '198.51.100.0/24',
+        '203.0.113.0/24',
+        '224.0.0.0/4',
+        '240.0.0.0/4',
+        '::/128',
+        '::1/128',
+        'fe80::/10',
+        'fc00::/7',
+        '2001:db8::/32',
+        'ff00::/8',
+        'fec0::/10',
+        '169.254.0.0/16',
+    ],
+};
+/**
+ * Matrix — full Element Server Suite: Synapse homeserver, MAS with Keycloak
+ * OIDC, Element Web + Admin, MatrixRTC/LiveKit SFU.
+ *
+ * @title Matrix (Element Server Suite)
+ * @category Collaboration & Productivity
+ *
+ * Renders the whole suite with production HA defaults: two CNPG databases
+ * (optional barman backups), 60s node-failure tolerations + topology spread
+ * (learned from a real node-blip incident), SSRF-hardened URL previews, and
+ * pinned component versions.
+ *
+ * Secrets arrive via the Platform secrets backend (openbao/vault) or the
+ * `clientSecretRef`/`credentialsSecret` escape hatches — never inline.
+ *
+ * @example
+ * import { Platform } from '@r8s/recipes'
+ * import { Matrix } from '@r8s/matrix'
+ *
+ * export default (
+ *   <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'matrix' }}>
+ *     <Matrix
+ *       domain="example.com"
+ *       sso={{ issuer: 'https://keycloak.example.com/realms/berget', clientId: 'matrix' }}
+ *       database={{ backup: { destinationPath: 's3://backups/matrix-cnpg', endpointURL: 'https://s3.example.com' } }}
+ *     />
+ *   </Platform>
+ * )
+ */
+function Matrix(props) {
+    const { name = 'matrix', namespace: namespaceProp, domain, hosts, replicas = 2, serverName, sso, database = {}, rtc = {}, appservices = [], version = {}, urlPreview = true, } = props;
+    const contextNamespace = (0, core_1.useContext)(defaults_1.Namespace);
+    const namespace = namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default';
+    const secretProvider = (0, core_1.useContext)(defaults_1.SecretContext);
+    const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+    const baseDomain = domain;
+    const server = serverName ?? baseDomain;
+    const host = {
+        web: hosts?.web ?? `element.${baseDomain}`,
+        synapse: hosts?.synapse ?? `matrix.${baseDomain}`,
+        admin: hosts?.admin ?? `element-admin.${baseDomain}`,
+        account: hosts?.account ?? `matrix-account.${baseDomain}`,
+        rtc: hosts?.rtc ?? `matrix-rtc.${baseDomain}`,
+    };
+    // --- secrets: backend or explicit refs ------------------------------------
+    const backend = secretProvider?.backend;
+    const hasBackend = backend === 'openbao' || backend === 'vault';
+    if (sso && !sso.clientSecretRef && !hasBackend) {
+        throw new Error(`Matrix "${name}": sso.clientSecretRef is required unless a secrets backend (openbao/vault) is configured on the surrounding Platform.\n\n` +
+            `Fix: wrap in <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'matrix' }}>\n` +
+            `     or pass sso={{ ..., clientSecretRef: '${name}-keycloak-oidc' }} (a pre-created Secret with key 'clientSecret')`);
+    }
+    if (database.backup && !database.backup.credentialsSecret && !hasBackend) {
+        throw new Error(`Matrix "${name}": database.backup.credentialsSecret is required unless a secrets backend (openbao/vault) is configured.\n\n` +
+            `Fix: wrap in <Platform secrets={{ backend: 'openbao', mount: 'kv', path: 'matrix' }}>\n` +
+            `     or pass database={{ backup: { ..., credentialsSecret: '${name}-backup-credentials' } }}`);
+    }
+    const resources = [];
+    // CNPG operator for the two databases
+    if (!sharedOperators.some((op) => op.name === 'cnpg')) {
+        resources.push((0, core_1.declareOperator)(crds_1.operators['cnpg']()));
+    }
+    // --- Secrets via backend (OpenBao/Vault static secret bundles) -------------
+    const secretSecretDefs = [];
+    if (hasBackend) {
+        if (sso && !sso.clientSecretRef) {
+            secretSecretDefs.push({
+                name: `${name}-keycloak-oidc`,
+                path: `${secretProvider.path ?? name}/${name}/keycloak-oidc`,
+                keys: { clientSecret: 'clientSecret' },
+            });
+        }
+        if (database.backup && !database.backup.credentialsSecret) {
+            secretSecretDefs.push({
+                name: `${name}-backup-credentials`,
+                path: `${secretProvider.path ?? name}/${name}/backup`,
+                keys: { 'access-key-id': 'access-key-id', 'secret-access-key': 'secret-access-key' },
+            });
+        }
+    }
+    const StaticSecretComponent = backend === 'openbao' ? 'OpenBaoStaticSecret' : 'VaultStaticSecret';
+    const staticSecretApiVersion = backend === 'openbao' ? 'secrets.openbao.org/v1beta1' : 'secrets.hashicorp.com/v1beta1';
+    for (const def of secretSecretDefs) {
+        resources.push((0, core_1.jsx)(StaticSecretComponent, {
+            apiVersion: staticSecretApiVersion,
+            kind: StaticSecretComponent,
+            metadata: { name: def.name, namespace },
+            spec: {
+                ...(backend === 'openbao'
+                    ? { openbaoAuthRef: secretProvider.authRef ?? 'openbao-auth' }
+                    : { vaultAuthRef: secretProvider.authRef ?? 'vault-auth' }),
+                mount: secretProvider.mount ?? 'secret',
+                type: 'kv-v2',
+                path: def.path,
+                refreshAfter: '3600s',
+                destination: { create: true, name: def.name },
+            },
+        }));
+    }
+    const keycloakSecretName = sso?.clientSecretRef ?? (sso ? `${name}-keycloak-oidc` : undefined);
+    const backupCredsSecret = database.backup?.credentialsSecret ??
+        (database.backup ? `${name}-backup-credentials` : undefined);
+    // --- CNPG databases --------------------------------------------------------
+    const dbSpecs = [
+        {
+            id: 'synapse',
+            roleComment: 'Synapse Matrix homeserver',
+            params: {
+                shared_buffers: '512MB',
+                max_connections: '200',
+                work_mem: '16MB',
+                maintenance_work_mem: '256MB',
+                effective_cache_size: '1536MB',
+            },
+            resources: {
+                requests: { memory: '1Gi', cpu: '500m' },
+                limits: { memory: '2Gi', cpu: '2000m' },
+            },
+        },
+        {
+            id: 'mas',
+            roleComment: 'Matrix Authentication Service',
+            params: {
+                shared_buffers: '256MB',
+                max_connections: '100',
+                work_mem: '8MB',
+                maintenance_work_mem: '128MB',
+                effective_cache_size: '768MB',
+            },
+            resources: {
+                requests: { memory: '512Mi', cpu: '250m' },
+                limits: { memory: '1Gi', cpu: '1000m' },
+            },
+        },
+    ];
+    for (const db of dbSpecs) {
+        const clusterName = `${name}-${db.id}-db`;
+        const backup = database.backup
+            ? {
+                barmanObjectStore: {
+                    destinationPath: `${database.backup.destinationPath}/${db.id}-cnpg`,
+                    endpointURL: database.backup.endpointURL,
+                    s3Credentials: {
+                        accessKeyId: { name: backupCredsSecret, key: 'access-key-id' },
+                        secretAccessKey: { name: backupCredsSecret, key: 'secret-access-key' },
+                    },
+                    wal: { compression: 'gzip', encryption: 'AES256', maxParallel: 2 },
+                    data: { compression: 'gzip', encryption: 'AES256', jobs: 2 },
+                },
+                retentionPolicy: database.backup.retention ?? '30d',
+            }
+            : undefined;
+        resources.push((0, core_1.jsx)(postgresql_1.ClusterComponent, {
+            metadata: { name: clusterName, namespace },
+            spec: {
+                instances: database.replicas ?? 2,
+                bootstrap: {
+                    initdb: {
+                        database: db.id,
+                        owner: db.id,
+                        encoding: 'UTF8',
+                        localeCollate: 'C',
+                        localeCType: 'C',
+                    },
+                },
+                managed: {
+                    roles: [
+                        {
+                            name: db.id,
+                            ensure: 'present',
+                            comment: db.roleComment,
+                            login: true,
+                            superuser: false,
+                            createdb: false,
+                            createrole: false,
+                            inherit: true,
+                            replication: false,
+                            bypassrls: false,
+                        },
+                    ],
+                },
+                monitoring: { enablePodMonitor: true },
+                postgresql: { parameters: db.params },
+                resources: db.resources,
+                storage: {
+                    size: database.storage ?? '20Gi',
+                    ...(database.storageClass && { storageClass: database.storageClass }),
+                },
+                ...(backup && { backup }),
+            },
+        }));
+        if (database.backup) {
+            resources.push((0, core_1.jsx)(postgresql_1.ScheduledBackupComponent, {
+                metadata: { name: `${clusterName}-backup`, namespace },
+                spec: {
+                    cluster: { name: clusterName },
+                    schedule: database.backup.schedule ?? '30 3 * * *',
+                    backupOwnerReference: 'none',
+                    method: 'barmanObjectStore',
+                },
+            }));
+        }
+    }
+    // --- Config Maps -----------------------------------------------------------
+    const synapseConfig = {
+        server_name: server,
+        public_baseurl: `https://${host.synapse}/`,
+        pid_file: '/data/homeserver.pid',
+        listeners: [
+            {
+                port: 8008,
+                tls: false,
+                bind_addresses: ['::'],
+                type: 'http',
+                x_forwarded: true,
+                resources: [
+                    { names: ['client', 'federation'], compress: false },
+                    { names: ['health'], compress: false },
+                ],
+            },
+        ],
+        database: {
+            name: 'psycopg2',
+            args: {
+                host: `${name}-synapse-db-rw`,
+                port: 5432,
+                database: 'synapse',
+                user: 'synapse',
+                password_file: '/secrets/db/password',
+                sslmode: 'prefer',
+            },
+        },
+        report_stats: false,
+        enable_registration: false,
+        ...(urlPreview ? { ...URL_PREVIEW_BLACKLIST } : { url_preview_enabled: false }),
+        ...(rtc.enabled !== false && {
+            experimental_features: { msc4143_rtc_transports: true },
+            matrix_rtc: {
+                transports: [
+                    {
+                        type: 'livekit',
+                        livekit_service_url: `http://${name}-sfu:7880`,
+                    },
+                ],
+            },
+        }),
+        appservice_config_files: appservices.map((a) => `/appservices/${a.name}.yaml`),
+    };
+    resources.push((0, core_1.jsx)('ConfigMap', {
+        apiVersion: 'v1',
+        kind: 'ConfigMap',
+        metadata: { name: `${name}-synapse-config`, namespace },
+        data: {
+            'homeserver.yaml': '# Generated by @r8s/matrix\n' + toYaml(synapseConfig),
+        },
+    }));
+    const masConfig = {
+        database: {
+            uri: `postgresql://mas:$(MASPASSWORD)@${name}-mas-db-rw:5432/mas?sslmode=prefer`,
+        },
+        http: {
+            listeners: [
+                {
+                    name: 'web',
+                    resources: [
+                        { name: 'discovery' },
+                        { name: 'oauthapi' },
+                        { name: 'compatapi' },
+                        { name: 'graphql' },
+                    ],
+                    port: 8080,
+                    host: '0.0.0.0',
+                },
+            ],
+        },
+        ...(sso && {
+            upstream_oauth2: {
+                providers: [
+                    {
+                        id: 'sso',
+                        issuer: sso.issuer,
+                        human_name: sso.humanName ?? 'SSO',
+                        client_id: sso.clientId,
+                        client_secret: '$MAS_OIDC_CLIENT_SECRET',
+                        token_endpoint_auth_method: 'client_secret_basic',
+                        scope: sso.scope ?? 'openid email profile',
+                        claims_imports: {
+                            localpart: { action: 'suggest', template: '{{ user.preferred_username }}' },
+                            displayname: { action: 'suggest', template: '{{ user.name }}' },
+                            email: { action: 'suggest', template: '{{ user.email }}' },
+                        },
+                    },
+                ],
+            },
+            passwords: { enabled: false },
+        }),
+    };
+    resources.push((0, core_1.jsx)('ConfigMap', {
+        apiVersion: 'v1',
+        kind: 'ConfigMap',
+        metadata: { name: `${name}-mas-config`, namespace },
+        data: {
+            'config.yaml': '# Generated by @r8s/matrix\n' + toYaml(masConfig),
+        },
+    }));
+    const elementWebConfig = {
+        default_server_config: {
+            'm.homeserver': {
+                base_url: `https://${host.synapse}`,
+                server_name: server,
+            },
+            'org.matrix.msc4143.rtc_session': {
+                focused_element: { focus_url: `https://${host.rtc}` },
+            },
+        },
+        brand: 'Element',
+        default_country_code: 'SE',
+        show_labs_settings: true,
+    };
+    resources.push((0, core_1.jsx)('ConfigMap', {
+        apiVersion: 'v1',
+        kind: 'ConfigMap',
+        metadata: { name: `${name}-web-config`, namespace },
+        data: { 'config.json': JSON.stringify(elementWebConfig, null, 2) },
+    }));
+    if (rtc.enabled !== false) {
+        const rtcConfig = {
+            port: 7880,
+            log_level: 'info',
+            rtc: {
+                tcp_port: 30001,
+                muxed_udp_port: 30002,
+                ...(rtc.manualIP
+                    ? { node_ip: rtc.manualIP, use_external_ip: false }
+                    : { use_external_ip: true }),
+                ...(rtc.stunServers?.length && { stun_servers: rtc.stunServers }),
+                packet_buffer_size_video: 1000,
+                packet_buffer_size_audio: 400,
+                batch_io: { batch_size: 256, max_flush_interval: '1ms' },
+            },
+            audio: { active_red_encoding: true },
+            ...(rtc.turnPort !== 0 && {
+                turn: {
+                    enabled: true,
+                    domain: host.rtc,
+                    tls_port: 0,
+                    udp_port: rtc.turnPort ?? 30004,
+                },
+            }),
+            keys: 'livekit-key: $(LIVEKIT_API_SECRET)',
+        };
+        resources.push((0, core_1.jsx)('ConfigMap', {
+            apiVersion: 'v1',
+            kind: 'ConfigMap',
+            metadata: { name: `${name}-sfu-config`, namespace },
+            data: { 'livekit.yaml': '# Generated by @r8s/matrix\n' + toYaml(rtcConfig) },
+        }));
+    }
+    // --- Appservice registrations ---------------------------------------------
+    // Registrations carry as_token/hs_token — they render as Secrets, never
+    // ConfigMaps. Prefer `secretRef` (existing Secret from the secrets backend)
+    // or placeholders; the noPlaintextSecrets guardrail flags live token values.
+    for (const appservice of appservices) {
+        if (!appservice.secretRef) {
+            resources.push((0, core_1.jsx)('Secret', {
+                apiVersion: 'v1',
+                kind: 'Secret',
+                metadata: { name: `${name}-appservice-${appservice.name}`, namespace },
+                stringData: { 'registration.yaml': toYaml(appservice.registration ?? {}) },
+            }));
+        }
+    }
+    // --- Deployments ------------------------------------------------------------
+    const synapseVersion = version.synapse ?? 'v1.99.0';
+    const masVersion = version.mas ?? 'latest';
+    const webVersion = version.web ?? 'v1.12.15';
+    const adminVersion = version.admin ?? 'latest';
+    const sfuVersion = version.sfu ?? rtc.sfuVersion ?? 'v1.10.1';
+    const synapseEnv = [
+        {
+            name: 'SYNAPSE_CONFIG_PATH',
+            value: '/data/homeserver.yaml',
+        },
+    ];
+    resources.push((0, core_1.jsx)('Deployment', {
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name: `${name}-synapse`, namespace },
+        spec: {
+            replicas: 1, // federation workers land separately — single writer for now
+            strategy: { type: 'Recreate' },
+            selector: { matchLabels: { app: `${name}-synapse` } },
+            template: {
+                metadata: { labels: { app: `-synapse` } },
+                spec: {
+                    tolerations: HA_TOLERATIONS,
+                    topologySpreadConstraints: haTopologySpread(`${name}-synapse`),
+                    securityContext: { fsGroup: 991, fsGroupChangePolicy: 'OnRootMismatch' },
+                    containers: [
+                        {
+                            name: 'synapse',
+                            image: `matrixdotorg/synapse:${synapseVersion}`,
+                            imagePullPolicy: 'IfNotPresent',
+                            ports: [{ containerPort: 8008, name: 'client' }],
+                            env: synapseEnv,
+                            // /tmp must be writable — readOnlyRootFilesystem + Twisted
+                            // tempfile buffering breaks media uploads otherwise (upstream
+                            // matrix-stack 26.9.0 regression)
+                            volumeMounts: [
+                                {
+                                    name: 'config',
+                                    mountPath: '/data/homeserver.yaml',
+                                    subPath: 'homeserver.yaml',
+                                    readOnly: true,
+                                },
+                                { name: 'db-credentials', mountPath: '/secrets/db', readOnly: true },
+                                { name: 'tmp', mountPath: '/tmp' },
+                                ...appservices.map((a) => ({
+                                    name: `appservice-${a.name}`,
+                                    mountPath: `/appservices/${a.name}.yaml`,
+                                    subPath: a.key ?? 'registration.yaml',
+                                    readOnly: true,
+                                })),
+                            ],
+                            livenessProbe: {
+                                httpGet: { path: '/health', port: 8008 },
+                                periodSeconds: 30,
+                                timeoutSeconds: 5,
+                            },
+                            readinessProbe: {
+                                httpGet: { path: '/health', port: 8008 },
+                                periodSeconds: 10,
+                                timeoutSeconds: 3,
+                            },
+                            resources: {
+                                requests: { memory: '1Gi', cpu: '500m' },
+                                limits: { memory: '2Gi', cpu: '2000m' },
+                            },
+                        },
+                    ],
+                    volumes: [
+                        { name: 'config', configMap: { name: `${name}-synapse-config` } },
+                        // CNPG generates the database credentials Secret (<cluster>-app)
+                        { name: 'db-credentials', secret: { secretName: `${name}-synapse-db-app` } },
+                        { name: 'tmp', emptyDir: { sizeLimit: '1Gi' } },
+                        ...appservices.map((a) => ({
+                            name: `appservice-${a.name}`,
+                            secret: {
+                                secretName: a.secretRef ?? `${name}-appservice-${a.name}`,
+                            },
+                        })),
+                    ],
+                },
+            },
+        },
+    }));
+    const masEnv = [
+        {
+            name: 'MASPASSWORD',
+            valueFrom: { secretKeyRef: { name: `${name}-mas-db-app`, key: 'password' } },
+        },
+        ...(keycloakSecretName
+            ? [
+                {
+                    name: 'MAS_OIDC_CLIENT_SECRET',
+                    valueFrom: { secretKeyRef: { name: keycloakSecretName, key: 'clientSecret' } },
+                },
+            ]
+            : []),
+        {
+            name: 'MAS_CONFIG_FILE',
+            value: '/config/config.yaml',
+        },
+    ];
+    resources.push((0, core_1.jsx)('Deployment', {
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name: `${name}-mas`, namespace },
+        spec: {
+            replicas,
+            strategy: { type: 'RollingUpdate', rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } },
+            selector: { matchLabels: { app: `${name}-mas` } },
+            template: {
+                metadata: { labels: { app: `-mas` } },
+                spec: {
+                    tolerations: HA_TOLERATIONS,
+                    topologySpreadConstraints: haTopologySpread(`${name}-mas`),
+                    containers: [
+                        {
+                            name: 'mas',
+                            image: `ghcr.io/element-hq/matrix-authentication-service:${masVersion}`,
+                            imagePullPolicy: 'IfNotPresent',
+                            args: ['server', '--config', '/config/config.yaml'],
+                            ports: [{ containerPort: 8080, name: 'http' }],
+                            env: masEnv,
+                            volumeMounts: [{ name: 'config', mountPath: '/config', readOnly: true }],
+                            livenessProbe: {
+                                httpGet: { path: '/health', port: 8080 },
+                                periodSeconds: 30,
+                                timeoutSeconds: 5,
+                            },
+                            readinessProbe: {
+                                httpGet: { path: '/health', port: 8080 },
+                                periodSeconds: 10,
+                                timeoutSeconds: 3,
+                            },
+                            resources: {
+                                requests: { memory: '256Mi', cpu: '100m' },
+                                limits: { memory: '512Mi', cpu: '500m' },
+                            },
+                        },
+                    ],
+                    volumes: [{ name: 'config', configMap: { name: `${name}-mas-config` } }],
+                },
+            },
+        },
+    }));
+    resources.push((0, core_1.jsx)('Deployment', {
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name: `${name}-web`, namespace },
+        spec: {
+            replicas,
+            selector: { matchLabels: { app: `${name}-web` } },
+            template: {
+                metadata: { labels: { app: `-web` } },
+                spec: {
+                    tolerations: HA_TOLERATIONS,
+                    topologySpreadConstraints: haTopologySpread(`${name}-web`),
+                    containers: [
+                        {
+                            name: 'web',
+                            image: `vectorim/element-web:${webVersion}`,
+                            imagePullPolicy: 'IfNotPresent',
+                            ports: [{ containerPort: 80, name: 'http' }],
+                            volumeMounts: [
+                                {
+                                    name: 'config',
+                                    mountPath: '/app/config.json',
+                                    subPath: 'config.json',
+                                    readOnly: true,
+                                },
+                            ],
+                            livenessProbe: { httpGet: { path: '/', port: 80 }, periodSeconds: 30 },
+                            readinessProbe: { httpGet: { path: '/', port: 80 }, periodSeconds: 10 },
+                            resources: {
+                                requests: { memory: '64Mi', cpu: '50m' },
+                                limits: { memory: '256Mi', cpu: '200m' },
+                            },
+                        },
+                    ],
+                    volumes: [{ name: 'config', configMap: { name: `${name}-web-config` } }],
+                },
+            },
+        },
+    }));
+    resources.push((0, core_1.jsx)('Deployment', {
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name: `${name}-admin`, namespace },
+        spec: {
+            replicas,
+            selector: { matchLabels: { app: `${name}-admin` } },
+            template: {
+                metadata: { labels: { app: `-admin` } },
+                spec: {
+                    tolerations: HA_TOLERATIONS,
+                    topologySpreadConstraints: haTopologySpread(`${name}-admin`),
+                    containers: [
+                        {
+                            name: 'admin',
+                            image: `ghcr.io/element-hq/element-admin:${adminVersion}`,
+                            imagePullPolicy: 'IfNotPresent',
+                            ports: [{ containerPort: 8080, name: 'http' }],
+                            livenessProbe: { httpGet: { path: '/', port: 8080 }, periodSeconds: 30 },
+                            readinessProbe: { httpGet: { path: '/', port: 8080 }, periodSeconds: 10 },
+                            resources: {
+                                requests: { memory: '64Mi', cpu: '50m' },
+                                limits: { memory: '256Mi', cpu: '200m' },
+                            },
+                        },
+                    ],
+                },
+            },
+        },
+    }));
+    if (rtc.enabled !== false) {
+        resources.push((0, core_1.jsx)('Deployment', {
+            apiVersion: 'apps/v1',
+            kind: 'Deployment',
+            metadata: { name: `${name}-sfu`, namespace },
+            spec: {
+                replicas: 1,
+                strategy: { type: 'Recreate' },
+                selector: { matchLabels: { app: `${name}-sfu` } },
+                template: {
+                    metadata: { labels: { app: `${name}-sfu` } },
+                    spec: {
+                        tolerations: HA_TOLERATIONS,
+                        containers: [
+                            {
+                                name: 'sfu',
+                                image: `livekit/livekit-server:${sfuVersion}`,
+                                imagePullPolicy: 'IfNotPresent',
+                                args: ['--config', '/etc/livekit.yaml'],
+                                ports: [
+                                    { containerPort: 7880, name: 'api' },
+                                    { containerPort: 30001, name: 'rtc-tcp' },
+                                    // LiveKit listens on UDP here even though some Helm charts
+                                    // declare TCP — the Service below routes numerically anyway
+                                    { containerPort: 30002, name: 'rtc-muxed-udp', protocol: 'UDP' },
+                                    { containerPort: rtc.turnPort ?? 30004, name: 'turn-udp', protocol: 'UDP' },
+                                ],
+                                env: [
+                                    {
+                                        name: 'LIVEKIT_API_SECRET',
+                                        valueFrom: { secretKeyRef: { name: `${name}-rtc-auth`, key: 'secret' } },
+                                    },
+                                ],
+                                volumeMounts: [{ name: 'config', mountPath: '/etc', readOnly: true }],
+                                livenessProbe: { httpGet: { path: '/', port: 7880 }, periodSeconds: 30 },
+                                readinessProbe: { httpGet: { path: '/', port: 7880 }, periodSeconds: 10 },
+                                resources: {
+                                    requests: { memory: '512Mi', cpu: '500m' },
+                                    limits: { memory: '2Gi', cpu: '2000m' },
+                                },
+                            },
+                        ],
+                        volumes: [{ name: 'config', configMap: { name: `${name}-sfu-config` } }],
+                    },
+                },
+            },
+        }));
+        // Combined LoadBalancer for all SFU traffic — one external IP for
+        // TCP+UDP (Harvester CCM shares the pool IP via ipam annotation).
+        // Always LoadBalancer: as ClusterIP the UDP/TURN ports are unreachable,
+        // which silently breaks MatrixRTC.
+        // Numeric targetPorts: the pod's muxed-UDP port is sometimes declared
+        // TCP by charts — numeric bypasses that entirely.
+        resources.push((0, core_1.jsx)('Service', {
+            apiVersion: 'v1',
+            kind: 'Service',
+            metadata: {
+                name: `${name}-sfu`,
+                namespace,
+                annotations: {
+                    'cloudprovider.harvesterhci.io/ipam': 'pool',
+                },
+            },
+            spec: {
+                type: 'LoadBalancer',
+                externalTrafficPolicy: 'Local',
+                ...(rtc.manualIP && { loadBalancerIP: rtc.manualIP }),
+                selector: { app: `${name}-sfu` },
+                ports: [
+                    { name: 'api', port: 7880, targetPort: 7880, protocol: 'TCP' },
+                    { name: 'rtc-tcp', port: 30001, targetPort: 30001, protocol: 'TCP' },
+                    { name: 'rtc-muxed-udp', port: 30002, targetPort: 30002, protocol: 'UDP' },
+                    {
+                        name: 'turn-udp',
+                        port: rtc.turnPort ?? 30004,
+                        targetPort: rtc.turnPort ?? 30004,
+                        protocol: 'UDP',
+                    },
+                ],
+            },
+        }));
+    }
+    // --- ClusterIP services -----------------------------------------------------
+    for (const svc of [
+        { svcName: `${name}-synapse`, port: 8008, app: `${name}-synapse` },
+        { svcName: `${name}-mas`, port: 8080, app: `${name}-mas` },
+        { svcName: `${name}-web`, port: 80, app: `${name}-web` },
+        { svcName: `${name}-admin`, port: 8080, app: `${name}-admin` },
+    ]) {
+        resources.push((0, core_1.jsx)('Service', {
+            apiVersion: 'v1',
+            kind: 'Service',
+            metadata: { name: svc.svcName, namespace },
+            spec: {
+                type: 'ClusterIP',
+                selector: { app: svc.app },
+                ports: [{ port: svc.port, targetPort: svc.port }],
+            },
+        }));
+    }
+    // --- Endpoints (5 hosts) ----------------------------------------------------
+    const endpointDefs = [
+        { host: host.web, serviceName: `${name}-web`, servicePort: 80, suffix: 'web' },
+        { host: host.synapse, serviceName: `${name}-synapse`, servicePort: 8008, suffix: 'synapse' },
+        { host: host.admin, serviceName: `${name}-admin`, servicePort: 8080, suffix: 'admin' },
+        { host: host.account, serviceName: `${name}-mas`, servicePort: 8080, suffix: 'account' },
+    ];
+    if (rtc.enabled !== false) {
+        endpointDefs.push({
+            host: host.rtc,
+            serviceName: `${name}-sfu`,
+            servicePort: 7880,
+            suffix: 'rtc',
+        });
+    }
+    for (const ep of endpointDefs) {
+        resources.push((0, core_1.jsx)(recipes_1.Endpoint, {
+            name: `${name}-${ep.suffix}`,
+            namespace,
+            host: ep.host,
+            serviceName: ep.serviceName,
+            servicePort: ep.servicePort,
+            tls: { secretName: `${name}-${ep.suffix}-tls`, clusterIssuer: 'letsencrypt-prod' },
+        }));
+    }
+    return (0, core_1.jsx)(core_1.Fragment, { children: resources });
+}
+/** Minimal YAML serialiser for the embedded configs (the stack is
+ *  configuration-heavy; embedding a full YAML dep just for these is overkill) */
+function toYaml(value, indent = 0) {
+    const pad = ' '.repeat(indent);
+    if (Array.isArray(value)) {
+        return value
+            .map((item) => {
+            if (typeof item === 'object' && item !== null) {
+                const inner = toYaml(item, indent + 2);
+                return `${pad}-\n${inner}`;
+            }
+            return `${pad}- ${item}`;
+        })
+            .join('\n');
+    }
+    if (typeof value === 'object' && value !== null) {
+        return Object.entries(value)
+            .map(([key, val]) => {
+            if (typeof val === 'object' && val !== null) {
+                return `${pad}${key}:\n${toYaml(val, indent + 2)}`;
+            }
+            return `${pad}${key}: ${yamlScalar(val)}`;
+        })
+            .join('\n');
+    }
+    return `${pad}${yamlScalar(value)}`;
+}
+function yamlScalar(value) {
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    if (value === null || value === undefined)
+        return 'null';
+    const str = String(value);
+    if (/[:#\s'"{}[\],&*!|>%@`]/.test(str) || str === '' || str.startsWith('$')) {
+        return `'${str.replace(/'/g, "''")}'`;
+    }
+    return str;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;AAkNA,wBAwwBC;AA19BD,oCAAsE;AAEtE,iDAA8E;AAC9E,oCAAqC;AACrC,qDAAiF;AACjF,0CAAuC;AAEvC;;0EAE0E;AAC1E,MAAM,cAAc,GAAG;IACrB;QACE,GAAG,EAAE,gCAAgC;QACrC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,EAAE;KACtB;IACD;QACE,GAAG,EAAE,8BAA8B;QACnC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW;QACnB,iBAAiB,EAAE,EAAE;KACtB;CACF,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;IACxC;QACE,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,wBAAwB;QACrC,iBAAiB,EAAE,gBAAgB;QACnC,qEAAqE;QACrE,yDAAyD;QACzD,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE;KACxC;CACF,CAAA;AAED,sFAAsF;AACtF,MAAM,qBAAqB,GAAG;IAC5B,mBAAmB,EAAE,IAAI;IACzB,eAAe,EAAE,KAAK;IACtB,8BAA8B,EAAE;QAC9B,WAAW;QACX,aAAa;QACb,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,cAAc;QACd,iBAAiB;QACjB,gBAAgB;QAChB,aAAa;QACb,aAAa;QACb,QAAQ;QACR,SAAS;QACT,WAAW;QACX,UAAU;QACV,eAAe;QACf,UAAU;QACV,WAAW;QACX,gBAAgB;KACjB;CACF,CAAA;AAuHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,MAAM,CAAC,KAAkB;IACvC,MAAM,EACJ,IAAI,GAAG,QAAQ,EACf,SAAS,EAAE,aAAa,EACxB,MAAM,EACN,KAAK,EACL,QAAQ,GAAG,CAAC,EACZ,UAAU,EACV,GAAG,EACH,QAAQ,GAAG,EAAE,EACb,GAAG,GAAG,EAAE,EACR,WAAW,GAAG,EAAE,EAChB,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,IAAI,GAClB,GAAG,KAAK,CAAA;IAET,MAAM,gBAAgB,GAAG,IAAA,iBAAU,EAAC,oBAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GACb,aAAa,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAC/F,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,wBAAa,CAAC,CAAA;IAChD,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;IAEnD,MAAM,UAAU,GAAG,MAAM,CAAA;IACzB,MAAM,MAAM,GAAG,UAAU,IAAI,UAAU,CAAA;IACvC,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,WAAW,UAAU,EAAE;QAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,UAAU,UAAU,EAAE;QACjD,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,iBAAiB,UAAU,EAAE;QACpD,OAAO,EAAE,KAAK,EAAE,OAAO,IAAI,kBAAkB,UAAU,EAAE;QACzD,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,UAAU,EAAE;KAC9C,CAAA;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,cAAc,EAAE,OAAO,CAAA;IACvC,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,OAAO,CAAA;IAE/D,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,4HAA4H;YACzI,yFAAyF;YACzF,8CAA8C,IAAI,mEAAmE,CACxH,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,8GAA8G;YAC3H,yFAAyF;YACzF,+DAA+D,IAAI,2BAA2B,CACjG,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAA6B,EAAE,CAAA;IAE9C,sCAAsC;IACtC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,8EAA8E;IAC9E,MAAM,gBAAgB,GAAmE,EAAE,CAAA;IAC3F,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAChC,gBAAgB,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,GAAG,IAAI,gBAAgB;gBAC7B,IAAI,EAAE,GAAG,cAAe,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,gBAAgB;gBAC7D,IAAI,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;aACvC,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC1D,gBAAgB,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,GAAG,IAAI,qBAAqB;gBAClC,IAAI,EAAE,GAAG,cAAe,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS;gBACtD,IAAI,EAAE,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,EAAE;aACrF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,qBAAqB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACjG,MAAM,sBAAsB,GAC1B,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,+BAA+B,CAAA;IACzF,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,qBAAqB,EAAE;YACzB,UAAU,EAAE,sBAAsB;YAClC,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE;YACvC,IAAI,EAAE;gBACJ,GAAG,CAAC,OAAO,KAAK,SAAS;oBACvB,CAAC,CAAC,EAAE,cAAc,EAAE,cAAe,CAAC,OAAO,IAAI,cAAc,EAAE;oBAC/D,CAAC,CAAC,EAAE,YAAY,EAAE,cAAe,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;gBAC9D,KAAK,EAAE,cAAe,CAAC,KAAK,IAAI,QAAQ;gBACxC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,YAAY,EAAE,OAAO;gBACrB,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;aAC9C;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,GAAG,EAAE,eAAe,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9F,MAAM,iBAAiB,GACrB,QAAQ,CAAC,MAAM,EAAE,iBAAiB;QAClC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAE9D,8EAA8E;IAC9E,MAAM,OAAO,GAKP;QACJ;YACE,EAAE,EAAE,SAAS;YACb,WAAW,EAAE,2BAA2B;YACxC,MAAM,EAAE;gBACN,cAAc,EAAE,OAAO;gBACvB,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,MAAM;gBAChB,oBAAoB,EAAE,OAAO;gBAC7B,oBAAoB,EAAE,QAAQ;aAC/B;YACD,SAAS,EAAE;gBACT,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;gBACxC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;aACxC;SACF;QACD;YACE,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,+BAA+B;YAC5C,MAAM,EAAE;gBACN,cAAc,EAAE,OAAO;gBACvB,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,KAAK;gBACf,oBAAoB,EAAE,OAAO;gBAC7B,oBAAoB,EAAE,OAAO;aAC9B;YACD,SAAS,EAAE;gBACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;aACxC;SACF;KACF,CAAA;IAED,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,KAAK,CAAA;QACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM;YAC5B,CAAC,CAAC;gBACE,iBAAiB,EAAE;oBACjB,eAAe,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,OAAO;oBACnE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW;oBACxC,aAAa,EAAE;wBACb,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAkB,EAAE,GAAG,EAAE,eAAe,EAAE;wBAC/D,eAAe,EAAE,EAAE,IAAI,EAAE,iBAAkB,EAAE,GAAG,EAAE,mBAAmB,EAAE;qBACxE;oBACD,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE;oBAClE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE;iBAC7D;gBACD,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK;aACpD;YACH,CAAC,CAAC,SAAS,CAAA;QAEb,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,6BAAgB,EAAE;YACpB,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;YAC1C,IAAI,EAAE;gBACJ,SAAS,EAAE,QAAQ,CAAC,QAAQ,IAAI,CAAC;gBACjC,SAAS,EAAE;oBACT,MAAM,EAAE;wBACN,QAAQ,EAAE,EAAE,CAAC,EAAE;wBACf,KAAK,EAAE,EAAE,CAAC,EAAE;wBACZ,QAAQ,EAAE,MAAM;wBAChB,aAAa,EAAE,GAAG;wBAClB,WAAW,EAAE,GAAG;qBACjB;iBACF;gBACD,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,EAAE,CAAC,EAAE;4BACX,MAAM,EAAE,SAAS;4BACjB,OAAO,EAAE,EAAE,CAAC,WAAW;4BACvB,KAAK,EAAE,IAAI;4BACX,SAAS,EAAE,KAAK;4BAChB,QAAQ,EAAE,KAAK;4BACf,UAAU,EAAE,KAAK;4BACjB,OAAO,EAAE,IAAI;4BACb,WAAW,EAAE,KAAK;4BAClB,SAAS,EAAE,KAAK;yBACjB;qBACF;iBACF;gBACD,UAAU,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;gBACtC,UAAU,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,EAAE;gBACrC,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ,CAAC,OAAO,IAAI,MAAM;oBAChC,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;aAC1B;SACF,CAAC,CACH,CAAA;QAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,qCAAwB,EAAE;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,SAAS,EAAE,SAAS,EAAE;gBACtD,IAAI,EAAE;oBACJ,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;oBAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,YAAY;oBAClD,oBAAoB,EAAE,MAAM;oBAC5B,MAAM,EAAE,mBAAmB;iBAC5B;aACF,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,aAAa,GAA4B;QAC7C,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,WAAW,IAAI,CAAC,OAAO,GAAG;QAC1C,QAAQ,EAAE,sBAAsB;QAChC,SAAS,EAAE;YACT;gBACE,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,KAAK;gBACV,cAAc,EAAE,CAAC,IAAI,CAAC;gBACtB,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE;oBACT,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;oBACpD,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;iBACvC;aACF;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE;gBACJ,IAAI,EAAE,GAAG,IAAI,gBAAgB;gBAC7B,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,SAAS;gBACf,aAAa,EAAE,sBAAsB;gBACrC,OAAO,EAAE,QAAQ;aAClB;SACF;QACD,YAAY,EAAE,KAAK;QACnB,mBAAmB,EAAE,KAAK;QAC1B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI;YAC3B,qBAAqB,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;YACvD,UAAU,EAAE;gBACV,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,SAAS;wBACf,mBAAmB,EAAE,UAAU,IAAI,WAAW;qBAC/C;iBACF;aACF;SACF,CAAC;QACF,uBAAuB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,IAAI,OAAO,CAAC;KAC/E,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,WAAW,EAAE;QACf,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,EAAE,SAAS,EAAE;QACvD,IAAI,EAAE;YACJ,iBAAiB,EAAE,8BAA8B,GAAG,MAAM,CAAC,aAAa,CAAC;SAC1E;KACF,CAAC,CACH,CAAA;IAED,MAAM,SAAS,GAA4B;QACzC,QAAQ,EAAE;YACR,GAAG,EAAE,mCAAmC,IAAI,oCAAoC;SACjF;QACD,IAAI,EAAE;YACJ,SAAS,EAAE;gBACT;oBACE,IAAI,EAAE,KAAK;oBACX,SAAS,EAAE;wBACT,EAAE,IAAI,EAAE,WAAW,EAAE;wBACrB,EAAE,IAAI,EAAE,UAAU,EAAE;wBACpB,EAAE,IAAI,EAAE,WAAW,EAAE;wBACrB,EAAE,IAAI,EAAE,SAAS,EAAE;qBACpB;oBACD,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,SAAS;iBAChB;aACF;SACF;QACD,GAAG,CAAC,GAAG,IAAI;YACT,eAAe,EAAE;gBACf,SAAS,EAAE;oBACT;wBACE,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,UAAU,EAAE,GAAG,CAAC,SAAS,IAAI,KAAK;wBAClC,SAAS,EAAE,GAAG,CAAC,QAAQ;wBACvB,aAAa,EAAE,yBAAyB;wBACxC,0BAA0B,EAAE,qBAAqB;wBACjD,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,sBAAsB;wBAC1C,cAAc,EAAE;4BACd,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,+BAA+B,EAAE;4BAC3E,WAAW,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE;4BAC/D,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE;yBAC3D;qBACF;iBACF;aACF;YACD,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC9B,CAAC;KACH,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,WAAW,EAAE;QACf,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,SAAS,EAAE;QACnD,IAAI,EAAE;YACJ,aAAa,EAAE,8BAA8B,GAAG,MAAM,CAAC,SAAS,CAAC;SAClE;KACF,CAAC,CACH,CAAA;IAED,MAAM,gBAAgB,GAAG;QACvB,qBAAqB,EAAE;YACrB,cAAc,EAAE;gBACd,QAAQ,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE;gBACnC,WAAW,EAAE,MAAM;aACpB;YACD,gCAAgC,EAAE;gBAChC,eAAe,EAAE,EAAE,SAAS,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;aACtD;SACF;QACD,KAAK,EAAE,SAAS;QAChB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,IAAI;KACzB,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,WAAW,EAAE;QACf,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,SAAS,EAAE;QACnD,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;KACnE,CAAC,CACH,CAAA;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG;YAChB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,MAAM;YACjB,GAAG,EAAE;gBACH,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,KAAK;gBACrB,GAAG,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE;oBACnD,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBAC9B,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;gBACjE,wBAAwB,EAAE,IAAI;gBAC9B,wBAAwB,EAAE,GAAG;gBAC7B,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE;aACzD;YACD,KAAK,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;YACpC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI;gBACxB,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,CAAC,GAAG;oBAChB,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;iBAChC;aACF,CAAC;YACF,IAAI,EAAE,oCAAoC;SAC3C,CAAA;QAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,WAAW,EAAE;YACf,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,SAAS,EAAE;YACnD,IAAI,EAAE,EAAE,cAAc,EAAE,8BAA8B,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE;SAC7E,CAAC,CACH,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,QAAQ,EAAE;gBACZ,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE;gBACtE,UAAU,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE;aAC3E,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAA;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAA;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAA;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAA;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,SAAS,CAAA;IAE7D,MAAM,UAAU,GAAa;QAC3B;YACE,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,uBAAuB;SAC/B;KACF,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,YAAY,EAAE;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE;QAChD,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC,EAAE,6DAA6D;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;YAC9B,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE,EAAE;YACrD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;gBACzC,IAAI,EAAE;oBACJ,WAAW,EAAE,cAAc;oBAC3B,yBAAyB,EAAE,gBAAgB,CAAC,GAAG,IAAI,UAAU,CAAC;oBAC9D,eAAe,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,EAAE;oBACxE,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,SAAS;4BACf,KAAK,EAAE,wBAAwB,cAAc,EAAE;4BAC/C,eAAe,EAAE,cAAc;4BAC/B,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;4BAChD,GAAG,EAAE,UAAU;4BACf,2DAA2D;4BAC3D,8DAA8D;4BAC9D,kCAAkC;4BAClC,YAAY,EAAE;gCACZ;oCACE,IAAI,EAAE,QAAQ;oCACd,SAAS,EAAE,uBAAuB;oCAClC,OAAO,EAAE,iBAAiB;oCAC1B,QAAQ,EAAE,IAAI;iCACf;gCACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;gCACpE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;gCAClC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oCACzB,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE;oCAC5B,SAAS,EAAE,gBAAgB,CAAC,CAAC,IAAI,OAAO;oCACxC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,mBAAmB;oCACrC,QAAQ,EAAE,IAAI;iCACf,CAAC,CAAC;6BACJ;4BACD,aAAa,EAAE;gCACb,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxC,aAAa,EAAE,EAAE;gCACjB,cAAc,EAAE,CAAC;6BAClB;4BACD,cAAc,EAAE;gCACd,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxC,aAAa,EAAE,EAAE;gCACjB,cAAc,EAAE,CAAC;6BAClB;4BACD,SAAS,EAAE;gCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;gCACxC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;6BACxC;yBACF;qBACF;oBACD,OAAO,EAAE;wBACP,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,EAAE,EAAE;wBACjE,iEAAiE;wBACjE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,iBAAiB,EAAE,EAAE;wBAC5E,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;wBAC/C,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACzB,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE;4BAC5B,MAAM,EAAE;gCACN,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE;6BAC1D;yBACF,CAAC,CAAC;qBACJ;iBACF;aACF;SACF;KACF,CAAC,CACH,CAAA;IAED,MAAM,MAAM,GAAa;QACvB;YACE,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;SAC7E;QACD,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;iBACrE;aACZ;YACH,CAAC,CAAC,EAAE,CAAC;QACP;YACE,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,qBAAqB;SAC7B;KACF,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,YAAY,EAAE;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,SAAS,EAAE;QAC5C,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE;YACtF,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE;YACjD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,EAAE;oBACJ,WAAW,EAAE,cAAc;oBAC3B,yBAAyB,EAAE,gBAAgB,CAAC,GAAG,IAAI,MAAM,CAAC;oBAC1D,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,KAAK;4BACX,KAAK,EAAE,oDAAoD,UAAU,EAAE;4BACvE,eAAe,EAAE,cAAc;4BAC/B,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,qBAAqB,CAAC;4BACnD,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;4BAC9C,GAAG,EAAE,MAAM;4BACX,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;4BACxE,aAAa,EAAE;gCACb,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxC,aAAa,EAAE,EAAE;gCACjB,cAAc,EAAE,CAAC;6BAClB;4BACD,cAAc,EAAE;gCACd,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxC,aAAa,EAAE,EAAE;gCACjB,cAAc,EAAE,CAAC;6BAClB;4BACD,SAAS,EAAE;gCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;gCAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;6BACzC;yBACF;qBACF;oBACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;iBACzE;aACF;SACF;KACF,CAAC,CACH,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,YAAY,EAAE;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,SAAS,EAAE;QAC5C,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE;YACjD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,EAAE;oBACJ,WAAW,EAAE,cAAc;oBAC3B,yBAAyB,EAAE,gBAAgB,CAAC,GAAG,IAAI,MAAM,CAAC;oBAC1D,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,KAAK;4BACX,KAAK,EAAE,wBAAwB,UAAU,EAAE;4BAC3C,eAAe,EAAE,cAAc;4BAC/B,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;4BAC5C,YAAY,EAAE;gCACZ;oCACE,IAAI,EAAE,QAAQ;oCACd,SAAS,EAAE,kBAAkB;oCAC7B,OAAO,EAAE,aAAa;oCACtB,QAAQ,EAAE,IAAI;iCACf;6BACF;4BACD,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACtE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACvE,SAAS,EAAE;gCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE;gCACxC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;6BACzC;yBACF;qBACF;oBACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;iBACzE;aACF;SACF;KACF,CAAC,CACH,CAAA;IAED,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,YAAY,EAAE;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAE,SAAS,EAAE;QAC9C,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,QAAQ,EAAE,EAAE;YACnD,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;gBACvC,IAAI,EAAE;oBACJ,WAAW,EAAE,cAAc;oBAC3B,yBAAyB,EAAE,gBAAgB,CAAC,GAAG,IAAI,QAAQ,CAAC;oBAC5D,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,oCAAoC,YAAY,EAAE;4BACzD,eAAe,EAAE,cAAc;4BAC/B,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;4BAC9C,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACxE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACzE,SAAS,EAAE;gCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE;gCACxC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;6BACzC;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC,CACH,CAAA;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1B,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,YAAY,EAAE;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,SAAS,EAAE;YAC5C,IAAI,EAAE;gBACJ,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC9B,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE;gBACjD,QAAQ,EAAE;oBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,EAAE;oBAC5C,IAAI,EAAE;wBACJ,WAAW,EAAE,cAAc;wBAC3B,UAAU,EAAE;4BACV;gCACE,IAAI,EAAE,KAAK;gCACX,KAAK,EAAE,0BAA0B,UAAU,EAAE;gCAC7C,eAAe,EAAE,cAAc;gCAC/B,IAAI,EAAE,CAAC,UAAU,EAAE,mBAAmB,CAAC;gCACvC,KAAK,EAAE;oCACL,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;oCACpC,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE;oCACzC,2DAA2D;oCAC3D,4DAA4D;oCAC5D,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE;oCAChE,EAAE,aAAa,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE;iCAC5E;gCACD,GAAG,EAAE;oCACH;wCACE,IAAI,EAAE,oBAAoB;wCAC1B,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;qCACzE;iCACF;gCACD,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gCACrE,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;gCACxE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;gCACzE,SAAS,EAAE;oCACT,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE;oCAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE;iCACxC;6BACF;yBACF;wBACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;qBACzE;iBACF;aACF;SACF,CAAC,CACH,CAAA;QAED,kEAAkE;QAClE,kEAAkE;QAClE,wEAAwE;QACxE,mCAAmC;QACnC,sEAAsE;QACtE,kDAAkD;QAClD,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,SAAS,EAAE;YACb,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,IAAI,MAAM;gBACnB,SAAS;gBACT,WAAW,EAAE;oBACX,oCAAoC,EAAE,MAAM;iBAC7C;aACF;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,cAAc;gBACpB,qBAAqB,EAAE,OAAO;gBAC9B,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACrD,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE;gBAChC,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;oBACpE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC1E;wBACE,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;wBAC3B,UAAU,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;wBACjC,QAAQ,EAAE,KAAK;qBAChB;iBACF;aACF;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,KAAK,MAAM,GAAG,IAAI;QAChB,EAAE,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE;QAClE,EAAE,OAAO,EAAE,GAAG,IAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE;QAC1D,EAAE,OAAO,EAAE,GAAG,IAAI,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE;QACxD,EAAE,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,QAAQ,EAAE;KAC/D,EAAE,CAAC;QACF,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,SAAS,EAAE;YACb,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE;YAC1C,IAAI,EAAE;gBACJ,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE;gBAC1B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;aAClD;SACF,CAAC,CACH,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,MAAM,YAAY,GAChB;QACE,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,IAAI,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAC9E,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE;QAC5F,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QACtF,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE;KACzF,CAAA;IACH,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1B,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,WAAW,EAAE,GAAG,IAAI,MAAM;YAC1B,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CACZ,IAAA,UAAG,EAAC,kBAAQ,EAAE;YACZ,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,MAAM,EAAE;YAC5B,SAAS;YACT,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,MAAM,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE;SACnF,CAAC,CACH,CAAA;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;iFACiF;AACjF,SAAS,MAAM,CAAC,KAAc,EAAE,MAAM,GAAG,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;gBACtC,OAAO,GAAG,GAAG,MAAM,KAAK,EAAE,CAAA;YAC5B,CAAC;YACD,OAAO,GAAG,GAAG,KAAK,IAAI,EAAE,CAAA;QAC1B,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE;YAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,GAAG,GAAG,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;YACpD,CAAC;YACD,OAAO,GAAG,GAAG,GAAG,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,CAAA;QAC3C,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,CAAA;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACvC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@r8s/matrix",
+  "version": "0.2.0",
+  "description": "Matrix (Element Server Suite) — Synapse homeserver, MAS auth with Keycloak OIDC, Element Web/Admin, MatrixRTC/LiveKit SFU with HA defaults",
+  "license": "MIT",
+  "author": "Berget AI AB",
+  "homepage": "https://r8s.berget.ai",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/berget-ai/r8s",
+    "directory": "packages/matrix"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc --build",
+    "test": "vitest run",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "category": "Collaboration & Productivity",
+  "keywords": [
+    "matrix",
+    "element",
+    "synapse",
+    "chat",
+    "rtc",
+    "oidc"
+  ],
+  "dependencies": {
+    "@r8s/core": "^0.2.0",
+    "@r8s/crds": "^0.2.0",
+    "@r8s/k8s-types": "^0.2.0",
+    "@r8s/recipes": "^0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  },
+  "bugs": "https://github.com/berget-ai/r8s/issues",
+  "r8s": {
+    "category": "Collaboration & Productivity"
+  }
+}