@substrat-run/kernel 0.140.0 → 0.142.0

package/dist/invocation-log.d.ts

@@ -1,447 +0,0 @@
-/**
- * One structured log line per invocation, carrying the two dimensions Cloudflare
- * structurally cannot record: which TENANT and which SCOPE a request belonged to
- * (`docs/architecture/observability.md` §4.2/§4.3).
- *
- * ## Why this exists at all
- *
- * Observability is keyed on the deployed unit — a worker script — and one vertical's
- * script serves every tenant that installed it. That makes script-grain data safe for
- * staff and for the vertical's builder, and unsafe for an installer: their own numbers
- * are inseparable from everyone else's (§3). The router already stamps `tenantId` on the
- * datapoints and log lines IT emits, which is why tenant-keyed *metrics* need no code in
- * this package. Logs are the other half, and the router cannot supply it: a trace does
- * not cross the dispatch hop. Verified against production — a router line's `traceId`
- * reaches `substrat-control-plane` (a service binding) but never the dispatched vertical,
- * and every vertical event is a trace of exactly one event. There is nothing to join on,
- * so the line has to be emitted on this side.
- *
- * ## What it makes possible that nothing else does
- *
- * A vertical's successful request emits NO log event whatsoever — the host logs only on a
- * platform fault, and the scope host logs nothing at all. So before this middleware, a
- * vertical's entire log presence was its crashes. The stamped line is therefore not only
- * the correlation key; it is the thing that makes a tenant-facing log view have any rows.
- *
- * ## The correlation contract
- *
- * Every log line emitted during one invocation shares `$metadata.requestId`, so a reader
- * resolves a tenant's lines in two phases: filter on `tenantId` to find the invocations,
- * then fetch every line sharing their request ids. That is what attributes a vertical's
- * OWN `console.log` output — which carries no tenant of its own — to the tenant whose
- * request produced it.
- *
- * The inverse of that contract is a rule, not an optimisation: a line with no `tenantId`
- * is never shown to a tenant (§4.3). An un-routed local invocation has no asserted
- * headers and therefore emits no line — there is no tenant it could be attributed to, and
- * inventing one is the only way this could ever leak.
- *
- * ## The tenant is a VERIFIED assertion, never a header
- *
- * Which is why the line is written from `readRoutedNode`'s answer and not from
- * `headers.get('x-substrat-tenant')`. The two look interchangeable — behind the router
- * they are — and they are not, for exactly the reason #966 made `readRoutedNode` itself
- * fail closed: K-26's boundary is that a vertical's script has no public route, and that
- * is a DEPLOYMENT fact, with `workers.dev` on by default. Reading the header directly
- * meant anyone who could reach the script could name any tenant they liked and have the
- * line filed under it — a request the vertical then refuses with a 400, since `nodeFor`
- * does verify, while this middleware's `finally` had already written the forged line.
- *
- * That is not a cosmetic wrong row. The read path uses the stamped line as PROOF that an
- * invocation was a given tenant's, and admits that invocation's other log lines — which
- * carry no tenant of their own — into that tenant's view on the strength of it. A forged
- * stamp is therefore a way to put chosen text on somebody else's dashboard. So the same
- * verification the vertical does for its own routing happens here, with the same secret
- * and the same dev opt-out, and a failed one writes nothing at all.
- */
-import { type InvocationLevel } from '@substrat-run/contracts/invocation-record';
-import type { HeaderReader } from './routed-node.js';
-import type { EmittedReport } from './scope-host.js';
-/**
- * The per-request store key the middleware parks its {@link InvocationRecord} under (#1746).
- * A published name, like `substratInvocationId`: `mountOperations` reads it in another
- * package, and a vertical's own routes may fill it in too.
- */
-export declare const INVOCATION_RECORD_KEY = "substratInvocationRecord";
-/**
- * What the handler chain learns about a request that the middleware cannot see from
- * outside it (#1746): which operation ran, who it ran as, how it failed, and what it
- * touched. The middleware creates one per request, hands it down through the context, and
- * writes whatever was filled in when the request ends.
- *
- * Mutable on purpose. The alternative was reading several context keys back in the
- * `finally`, which would add a `get` to the structural context below and make every field
- * a string-keyed lookup; one object handed down and written back is the smaller seam.
- *
- * Every field is optional, and an unfilled one is written as `null`: a custom route that
- * never reaches an operation is still logged, it just has nothing to say about these.
- */
-export interface InvocationRecord {
-    /** The operation name `mountOperations` dispatched to. */
-    operation?: string;
-    /** The `errorCode` a failed call was classified with, when the kernel's vocabulary names it. */
-    problemCode?: string;
-    /** The kind of subject the stub acted as — `ScopeStub.subjectKind`. */
-    principalKind?: string;
-    /** What the operation itself emitted — `InvokeOptions.onEmitted`. */
-    emitted?: EmittedReport;
-    /**
-     * #1331: which of the operation's DECLARED output fields its response carried. Filled
-     * only on a request the router armed the walk for ({@link fieldCoverageArmed}), and absent
-     * otherwise — never an empty report, so "not walked" cannot read as "returned nothing".
-     */
-    outputFields?: OutputFieldsReport;
-}
-/**
- * The field walk's answer for one response (#1331). Names only, and only names the
- * operation DECLARES: a key the response carries that the declaration does not name is
- * never written down, since a key can be data (a map keyed by email is still a map). No
- * value is ever read into it.
- */
-export interface OutputFieldsReport {
-    /** Declared fields the response carried with a value other than `null`, in declaration order. */
-    present: string[];
-    /** Declared fields the response carried as `null` — on the wire, carrying nothing. */
-    empty: string[];
-    /** Declared fields the response did not carry (missing, or `undefined`). */
-    absent: string[];
-}
-export { invocationLevelOf, type InvocationLevel } from '@substrat-run/contracts/invocation-record';
-/**
- * The middleware's context, taken STRUCTURALLY — kernel depends on no web framework,
- * not even for a type. The shape below is the subset of a Hono context this reads, so
- * `app.use('*', invocationLog())` type-checks inside a vertical without this package
- * knowing which framework that vertical chose. Same posture as `vertical-host` taking
- * its scope host as `VerticalScopeHost` rather than importing a concrete adapter: the
- * seam is the shape, not the vendor.
- *
- * This line belongs with the router-assertion family (`readRoutedNode`,
- * `assertPlatformCall`) — the code that reads what the router asserted about a request —
- * because it is the same family seen from the other end: it writes that assertion down so
- * a reader can find it again. The family is moving from the kernel to `vertical-host`
- * (#1978), which already re-exports it; `vertical-host` keeps its AI SDK behind the
- * `./model` subpath, so a vertical importing this from its root bundles none of it.
- */
-export interface InvocationLogContext<Env = unknown> {
-    req: {
-        method: string;
-        raw: {
-            url: string;
-            headers: HeaderReader;
-        };
-    };
-    res?: {
-        status: number;
-    };
-    /**
-     * The framework's per-request store (#1237). Hono's `Context` has one; the type is
-     * structural and narrow on purpose, so it is declared optional — a caller that does
-     * not provide it simply gets no invocation id on the scope's events, which reads as
-     * unrecorded exactly like every other absent stamp.
-     */
-    set?: {
-        (key: 'substratInvocationId', value: string): void;
-        /** #1746: the record the handler chain fills in. See {@link InvocationRecord}. */
-        (key: typeof INVOCATION_RECORD_KEY, value: InvocationRecord): void;
-    };
-    /** The worker's bindings — read ONLY through the options below, never otherwise. */
-    env: Env;
-}
-/**
- * How this middleware verifies the router's assertion, in the vertical's own terms.
- *
- * Both are functions of the env rather than plain values because a Worker's bindings
- * arrive per-request, while `app.use(...)` runs once at module scope. They are the same
- * two knobs the vertical already passes to `readRoutedNode` in its `nodeFor`, and they
- * must be given the same answers: a log that trusts more than the router does is the
- * forged-tenant hole, and one that trusts less is silently empty.
- */
-export interface InvocationLogOptions<Env = unknown> {
-    /**
-     * The router's shared secret as this worker holds it — `(env) => env.ROUTER_SECRET`.
-     *
-     * Omitting it is not a shortcut: with no secret to check against, an assertion can
-     * only be accepted by `allowUnsigned`, so a bare `invocationLog()` in a deployed
-     * vertical writes NOTHING. `pnpm lint:invocation-log` refuses that arrangement rather
-     * than leaving a vertical to discover it from an empty log view.
-     */
-    routerSecret?: (env: Env) => string | undefined;
-    /**
-     * The vertical's own `ALLOW_DEV_NODE` — an un-routed local instance behind a dev
-     * router that holds no secret either. Anywhere else this must stay false, or the
-     * header is a claim again.
-     */
-    allowUnsigned?: (env: Env) => boolean;
-}
-/**
- * The shape of the emitted line. Deliberately a published contract rather than an
- * incidental object: the read proxy filters on these key names, and Workers Logs indexes
- * a `JSON.stringify`ed `console.log` as queryable TOP-LEVEL fields (`tenantId`, not
- * `$metadata.tenantId` nor `source.tenantId` — verified against the live telemetry API).
- * Renaming a key here silently empties a view, because a filter on a key that does not
- * exist returns `success: true` with zero events. Add fields; never rename one.
- */
-export interface InvocationLogLine {
-    /** Discriminator — what lets a reader tell this line from a vertical's own output. */
-    substrat: 'invocation';
-    /**
-     * #1901: what kind of work the line is about. ABSENT on a request's line — the line every
-     * reader already knew — and present only on the scope host's lines for async work: a
-     * consumer delivery (`consumer`) or a schedule run (`schedule`). A reader treats a missing
-     * `kind` as `request`, which keeps every line written before this field existed meaning
-     * what it meant.
-     */
-    kind?: AsyncInvocationKind;
-    tenantId: string;
-    scopeId: string | null;
-    vertical: string | null;
-    /**
-     * The K-26 surface that answered. Taken from the verified node, so an assertion that
-     * named none reads as `readRoutedNode`'s documented default (`app`) rather than as a
-     * null only this writer would produce — one representation across the platform.
-     */
-    surface: string | null;
-    /** The request's method. `null` on an async line (#1901), which no request carried. */
-    method: string | null;
-    /** Path ONLY — see `pathOf`. `null` on an async line (#1901). */
-    path: string | null;
-    /**
-     * #1237: the id every event this invocation emitted is stamped with.
-     *
-     * The join nothing could make before. `$metadata.requestId` correlates the LINES of
-     * one invocation, and it is stamped by the log platform at ingestion — no code here
-     * can read it, and the spine could not have been given it. So the platform mints its
-     * own, writes it here, and carries it to the scope on `InvokeOptions`.
-     *
-     * Which makes this line the other half of a trace: the events say what happened and
-     * in what order, and this says how long the whole call took and how it ended.
-     */
-    invocationId: string;
-    /**
-     * The response status as the caller received it — including the status `onError`
-     * mapped a thrown error to.
-     *
-     * Hono composes `onError` INSIDE the handler chain, not around it, so a handler that
-     * throws does not reject this middleware's `await next()`: the envelope has already
-     * turned it into a response by the time control comes back, and `c.res` holds the
-     * mapped status. That is worth stating because the opposite is the natural guess, and
-     * guessing it would have put `null` on every error line — the exact rows a tenant
-     * opens this view to find.
-     *
-     * `null` therefore survives only for a genuine escape: an error that got past the
-     * envelope itself, which `threw` marks.
-     *
-     * Always `null` on an async line (#1901): no caller received a status. Its `outcome` and
-     * `level` say how it ended instead.
-     */
-    status: number | null;
-    /** The error escaped even `onError` — rare, and the most interesting line on the page. */
-    threw: boolean;
-    durationMs: number;
-    /** {@link invocationLevelOf}. Always present: it is derived from the two fields above. */
-    level: InvocationLevel;
-    /** The operation that ran. `null` for a route that is not a mounted operation. */
-    operation: string | null;
-    /** The kernel `errorCode` of a failed call, when it has one. */
-    problemCode: string | null;
-    /** Who the call ran as: `principal`, `connection`, `system`, `capability` or `vertical`. */
-    principalKind: string | null;
-    /**
-     * How many events the operation itself emitted. `null` when not recorded, which is
-     * different from `0`: a read emits nothing, and that is a fact about it.
-     */
-    eventCount: number | null;
-    /** The distinct types among those events, in emission order (capped, see `entities`). */
-    eventTypes: string[];
-    /**
-     * The distinct entities those events were about, as `<entityType>:<entityId>`. Taken from
-     * at most `EMITTED_REPORT_CAP` events, so a bulk operation's line names the first few and
-     * `eventCount` says how many there were.
-     */
-    entities: string[];
-    /**
-     * The registry id of the version that served the call — the platform's
-     * `SUBSTRAT_VERSION_ID` binding, the same identity the spine stamps on events. `null`
-     * locally and on a script pushed before the binding existed.
-     */
-    versionId: string | null;
-    /**
-     * #1331: which declared output fields the response carried. The one field on this line
-     * that is OMITTED rather than `null` when unrecorded: the walk behind it is off by
-     * default, and an unarmed line must stay byte-for-byte what it was before the field
-     * existed. A reader treats absence exactly as it treats `null` elsewhere.
-     */
-    outputFields?: OutputFieldsReport;
-    /**
-     * #1923: the router's dispatch id for the request whose response {@link outputFields}
-     * describes — its provenance. Present exactly when `outputFields` is: a reader joins it to
-     * the router's own line for the request, and counts the report only for the tenant and app
-     * that line names.
-     */
-    fieldCoverageId?: string;
-    /** How the unit ended — see {@link AsyncOutcome}. */
-    outcome?: AsyncOutcome;
-    /** A consumer's event type. */
-    eventType?: string | null;
-    /** A consumer's event id — the join to the spine's outbox and delivery journal. */
-    eventId?: string | null;
-    /** Which attempt at this delivery the line is about, counting from 1. */
-    attempt?: number | null;
-    /** A schedule run's due time (ISO 8601), or `null` for a schedule's first run. */
-    dueAt?: string | null;
-    /** How late the run started against `dueAt`, in milliseconds; `null` on a first run. */
-    latenessMs?: number | null;
-    /** A `suppressed` line's count of the lines the pass's cap withheld. */
-    suppressed?: number;
-    /** The same count per `<kind>:<outcome>`, so a storm of one outcome is named, not averaged. */
-    suppressedBy?: Record<string, number>;
-}
-/** #1901: the kinds of async work a scope host writes a line for. A request has no `kind`. */
-export type AsyncInvocationKind = 'consumer' | 'schedule';
-/**
- * #1901: how a unit of async work ended.
- *
- * - `delivered` — a consumer's handler ran and its delivery is journaled done.
- * - `retrying` — the handler threw and the delivery is due again later.
- * - `dead-lettered` — the delivery is journaled failed for good: the handler threw on its
- *   last attempt, or the event never reached it (undecodable, a schema version the consumer
- *   does not take, withheld by the producer).
- * - `inert` — a copy of a scope (#2005): the delivery is journaled terminal and NO handler
- *   ran. Never `delivered`, because nothing was.
- * - `routed` — the delivery was handed to the platform's drain to run with authority this
- *   host lacks (a connector on a control-plane-less host).
- * - `ok` / `failed` — a schedule run.
- * - `suppressed` — the pass's line cap was reached; the line counts what it withheld.
- */
-export type AsyncOutcome = 'delivered' | 'retrying' | 'dead-lettered' | 'inert' | 'routed' | 'ok' | 'failed' | 'suppressed';
-/**
- * The fields of an invocation line, before defaults. The ONE place the line's grammar lives
- * (#1901): the request writer below and the scope host's async writer both build through
- * {@link invocationLine}, so a field added to one is a field added to both, in one order.
- */
-export interface InvocationLineFields {
-    kind?: AsyncInvocationKind;
-    tenantId: string;
-    scopeId: string | null;
-    vertical?: string | null;
-    surface?: string | null;
-    method?: string | null;
-    path?: string | null;
-    invocationId: string;
-    status?: number | null;
-    threw: boolean;
-    durationMs: number;
-    level: InvocationLevel;
-    operation?: string | null;
-    problemCode?: string | null;
-    principalKind?: string | null;
-    emitted?: EmittedReport;
-    /**
-     * #1901: write `entities` from `emitted` (the default). An async line passes `false`: an
-     * entity id is data a vertical chose — an email, a customer number — and the async line
-     * carries ids the platform minted, declared names and codes only. Its `entities` is then
-     * always `[]`, which a reader takes as "not recorded" beside a non-null `eventCount`.
-     */
-    withEntities?: boolean;
-    versionId?: string | null;
-    outputFields?: OutputFieldsReport;
-    /** #1923: written only beside `outputFields`. */
-    fieldCoverageId?: string;
-    async?: Pick<InvocationLogLine, 'outcome' | 'eventType' | 'eventId' | 'attempt' | 'dueAt' | 'latenessMs' | 'suppressed' | 'suppressedBy'>;
-}
-/** Build a line. Unfilled fields are `null` (or empty), as the line's contract says. */
-export declare function invocationLine(f: InvocationLineFields): InvocationLogLine;
-/**
- * #1893: one request's stamp — the id minted for it and the record the handler chain fills
- * in — shared by whichever layer started it.
- */
-export interface InvocationStamp {
-    invocationId: string;
-    record: InvocationRecord;
-    /**
-     * #1923: the dispatch id the router armed this request's field walk with, when it did and
-     * the request's router assertion verified. Decided once, when the stamp begins — see
-     * {@link armedFieldCoverageId}. Written on the line beside the report, as its provenance.
-     */
-    fieldCoverageId?: string;
-}
-/**
- * The stamp a request already carries, if a layer outside this one started it (#1893).
- * `vertical-host` reads the record through this when the Hono context has none, which is
- * the case when the platform's entry stamped the request and the vertical mounts nothing.
- */
-export declare function invocationStampOf(request: object): InvocationStamp | undefined;
-/**
- * #1923: whether the per-response field walk is armed for this request — the one question the
- * walk's two callers in `vertical-host` (the operation routes and the MCP door) ask.
- *
- * `false` for a request no stamp covers, and for a stamp begun by a layer that predates the
- * switch: every version skew between the platform's entry and a vertical's bundled kernel
- * reads as off, never as on.
- */
-export declare function fieldCoverageArmed(request: object): boolean;
-/**
- * Mount as the FIRST middleware on a vertical's app, with the same two answers the
- * vertical gives `readRoutedNode` in its own `nodeFor`:
- *
- * ```ts
- * const app = new Hono<{ Bindings: Env }>();
- * app.use(
- *   '*',
- *   invocationLog<Env>({
- *     routerSecret: (env) => env.ROUTER_SECRET,
- *     allowUnsigned: (env) => env.ALLOW_DEV_NODE === 'true',
- *   }),
- * );
- * ```
- *
- * First, because Hono composes handlers in registration order and stops at the one that
- * returns a response — middleware registered after a route does not wrap that route.
- *
- * **Since #1893 the platform stamps every deployed request itself**, by wrapping the
- * uploaded entry with `withInvocationLog`. A vertical that still mounts this middleware
- * then finds the request already stamped and steps aside — it hands the platform's stamp
- * to the handler chain through the context, as it always did, and writes no second line.
- * Mounted where no platform entry runs (a dev server behind a dev router), it stamps as
- * before.
- *
- * Nothing here can fail a request: the line is written in a `finally`, and a throw from
- * the handler is re-thrown untouched for `onError` to map as it always did.
- */
-export declare function invocationLog<Env = unknown>(options?: InvocationLogOptions<Env>): (c: InvocationLogContext<Env>, next: () => Promise<void>) => Promise<void>;
-/** The request a module worker's `fetch` receives, as far as the stamp reads it. */
-export interface IncomingRequest {
-    method: string;
-    url: string;
-    headers: HeaderReader;
-}
-/**
- * The module-worker shape `withInvocationLog` wraps: a default export with handlers. Typed
- * structurally — kernel compiles with no DOM and no workers types — so a Hono app, a plain
- * `{ fetch }` object and anything else with the method all fit.
- */
-export interface ModuleWorker<Env = unknown> {
-    fetch?: (request: IncomingRequest, env: Env, ctx: unknown) => {
-        status: number;
-    } | Promise<{
-        status: number;
-    }>;
-    [handler: string]: unknown;
-}
-/**
- * The platform's half of the stamp (#1893): wrap a module worker's `fetch` so every request
- * it serves is stamped, whatever framework the worker is written in and whether or not it
- * mounts the middleware.
- *
- * The control plane builds this into the entry it uploads in front of every vertical's
- * bundle (`platform-entry.generated.ts`), which is what makes the stamp the platform's
- * rather than a line each vertical has to remember. A request the vertical's own
- * middleware already stamped — possible only if something wrapped this one — is passed
- * straight through. The other handlers (`scheduled`, `queue`, …) are passed through
- * untouched, bound to the worker, since a stamp is about a routed request.
- *
- * Nothing here can fail a request: the line is written in a `finally`, and a throw is
- * re-thrown untouched.
- */
-export declare function withInvocationLog<Env = unknown>(worker: ModuleWorker<Env>, options?: InvocationLogOptions<Env>): ModuleWorker<Env>;
-//# sourceMappingURL=invocation-log.d.ts.map

package/dist/invocation-log.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invocation-log.d.ts","sourceRoot":"","sources":["../src/invocation-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iGAAiG;IACjG,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,sFAAsF;IACtF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAID,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,2CAA2C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB,CAAC,GAAG,GAAG,OAAO;IACjD,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,YAAY,CAAA;SAAE,CAAA;KAAE,CAAC;IACrE,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB;;;;;OAKG;IACH,GAAG,CAAC,EAAE;QACJ,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACnD,kFAAkF;QAClF,CAAC,GAAG,EAAE,OAAO,qBAAqB,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACpE,CAAC;IACF,oFAAoF;IACpF,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB,CAAC,GAAG,GAAG,OAAO;IACjD;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;CACvC;AASD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,uFAAuF;IACvF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;;;;;;;OAUG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IAMnB,0FAA0F;IAC1F,KAAK,EAAE,eAAe,CAAC;IACvB,kFAAkF;IAClF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4FAA4F;IAC5F,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yFAAyF;IACzF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAMzB,qDAAqD;IACrD,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,UAAU,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,UAAU,GACV,eAAe,GACf,OAAO,GACP,QAAQ,GACR,IAAI,GACJ,QAAQ,GACR,YAAY,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,IAAI,CACV,iBAAiB,EACjB,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CACzG,CAAC;CACH;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,CAAC,EAAE,oBAAoB,GAAG,iBAAiB,CA0BzE;AAwCD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE9E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3D;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAG,OAAO,EACzC,OAAO,GAAE,oBAAoB,CAAC,GAAG,CAAM,GACtC,CAAC,CAAC,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAkC5E;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY,CAAC,GAAG,GAAG,OAAO;IACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,KAAK;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/G,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAG,OAAO,EAC7C,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,EACzB,OAAO,GAAE,oBAAoB,CAAC,GAAG,CAAM,GACtC,YAAY,CAAC,GAAG,CAAC,CA8BnB"}