@venturekit/infra 0.0.40 → 0.0.41

package/dist/cdk/services-stack.js

@@ -0,0 +1,562 @@
+/**
+ * Tier — Services stack: the long-running processes (`services[]`), each
+ * as an ECS service on its `compute[]` pool — and the other ventures'
+ * services this one reaches through a private link (`external`).
+ *
+ * Per owned service, whatever the pool's kind: a task definition with the
+ * declared containers (images built at deploy from their Dockerfiles, for
+ * the pool's architecture, or pulled from a registry), one log group, the
+ * database contract the venture's Lambdas get (`DB_HOST` … `DB_TENANT_ROLE`)
+ * when the intent names a database, secrets handed over as environment
+ * values by the ECS agent, and a topic of alarms.
+ *
+ * Then per kind:
+ *
+ *   - `instance` — an EC2 service with `host` networking, one task on every
+ *     machine of the pool (the daemon strategy): the ports are the machines',
+ *     the doors are the pool's balancers (compute tier), the machines' group
+ *     admits what the ports declare, persistent volumes are directories on
+ *     the machines' disks, and the name is the pool's — the machine's
+ *     wildcard record, or the internal balancer's alias. A rollout stops a
+ *     machine's task before starting the new one (host ports), one machine
+ *     at a time on a pool of several.
+ *   - `serverless` — a Fargate service in the private subnets with a group
+ *     of its own: `vpc` ports admitted from the VPC, `public` ports reached
+ *     through an internet-facing Network Load Balancer with an Elastic IP
+ *     per AZ (client addresses preserved, TLS terminated there when a port
+ *     asks), EFS under persistent volumes, and the name kept on the task by
+ *     service discovery.
+ *
+ * Per external service: an interface VPC endpoint in this venture's VPC,
+ * connected to the endpoint service the owner published, admitted from
+ * this VPC; the Lambdas are told its name (`SERVICE_<ID>_HOST`) and a URL
+ * on the owner's first shared port (`SERVICE_<ID>_URL`). An owner that has
+ * not published yet (`external.resolved === null`, the deploy's pre-flight
+ * looked) gets a warning and no endpoint until the next deploy.
+ *
+ * # Lifecycle position
+ *
+ * The most often deployed tier after `app`: every image change rolls the
+ * service that uses it — and only that one, since each image's fingerprint
+ * is its own context less what `build.ignore` keeps out.
+ *
+ * # Public surface (via SSM)
+ *
+ *   - `servicesKeys.serviceName / logGroupName / alarmTopicArn` per owned
+ *     service; `url` when it has a name; `addresses / loadBalancerDnsName`
+ *     when its ports are public; `endpointServiceName / sharedPorts / port`
+ *     when they are shared.
+ *
+ * # What this stack does NOT do
+ *
+ * - **No public DNS.** A public port has fixed addresses (one per AZ) and a
+ *   load balancer name; the operator points a hostname at them where the
+ *   venture's DNS lives.
+ * - **No TLS without a balancer.** A pool of one machine has nothing in
+ *   front of it to terminate TLS on; the container does it, or an operator
+ *   reaches the port through an SSM port forward.
+ */
+import * as path from 'node:path';
+import * as cdk from 'aws-cdk-lib';
+import * as ec2 from 'aws-cdk-lib/aws-ec2';
+import { Platform } from 'aws-cdk-lib/aws-ecr-assets';
+import * as ecs from 'aws-cdk-lib/aws-ecs';
+import * as efs from 'aws-cdk-lib/aws-efs';
+import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import * as logs from 'aws-cdk-lib/aws-logs';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as servicediscovery from 'aws-cdk-lib/aws-servicediscovery';
+import { DATA_SAFETY_CONFIG, assertValid, validateComputeAndServices, } from '@venturekit/core';
+import { readSsmString, writeSsm } from './shared/cross-stack-refs.js';
+import { toLogRetention } from './shared/lambda-helpers.js';
+import { servicesKeys } from './shared/ssm-keys.js';
+import { ServiceAlarms } from './shared/service-alarms.js';
+import { instanceVolumePath, poolOf } from './compute-stack.js';
+/** Where a service's containers log: one group per service, a stream prefix per container. */
+export function serviceLogGroupName(projectName, stage, serviceId) {
+    return `/venturekit/${projectName}/${stage}/services/${serviceId}`;
+}
+/** The service's private address, when it has a name and a port to answer on: the first `vpc` or `shared` port, else the first. */
+export function serviceUrl(service, zoneName) {
+    if (!service.dns)
+        return undefined;
+    const ports = (service.containers ?? []).flatMap((c) => c.ports ?? []);
+    const port = ports.find((p) => p.expose === 'vpc' || p.expose === 'shared') ?? ports[0];
+    return port ? `http://${service.dns}.${zoneName}:${port.port}` : undefined;
+}
+/** The memory floor (MiB) a container on an instance pool gets when its intent names none: counted by the scheduler, no ceiling. */
+export const DEFAULT_MEMORY_RESERVATION_MIB = 128;
+/** A synth warning id per closed public port, so the deploy log says which door admits nobody. */
+export const CLOSED_PORT_WARNING = 'venturekit:services:public-port-closed';
+export class VentureServicesStack extends cdk.Stack {
+    services = new Map();
+    /** The other ventures' services reached through a private link, by intent id. */
+    externals = new Map();
+    /** What the app tier injects as `SERVICE_<ID>_URL`: a plain string for an owned service, a token for an external one. */
+    serviceUrlsById = new Map();
+    /** What the app tier injects as `SERVICE_<ID>_HOST` for external services (a token). */
+    serviceHostsById = new Map();
+    isStrictRetain;
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        const { projectName, stage, envConfig, infrastructure } = props;
+        assertValid(validateComputeAndServices(infrastructure));
+        this.isStrictRetain = DATA_SAFETY_CONFIG[envConfig.dataSafety].removalPolicy === 'retain';
+        const compute = infrastructure.compute ?? [];
+        for (const intent of infrastructure.services ?? []) {
+            if (intent.external) {
+                if (intent.external.resolved === null) {
+                    // The pre-flight found nothing published: the owner deploys after
+                    // this venture on a fresh stage. Nothing to connect to yet; the
+                    // Lambdas get no SERVICE_<ID>_HOST and the next deploy creates it.
+                    cdk.Annotations.of(this).addWarningV2(`venturekit:services:external-unpublished:${intent.id}`, `${projectName}-${stage}-${intent.id}: ${intent.external.project} has not published its '${intent.external.intent ?? intent.id}' service on this stage yet, ` +
+                        `so no endpoint is created and the Lambdas get no SERVICE_${upperSnake(intent.id)}_HOST. Deploy ${intent.external.project}, then this venture again.`);
+                    continue;
+                }
+                const external = this.createExternal(intent, props);
+                this.externals.set(intent.id, external);
+                this.serviceUrlsById.set(intent.id, external.url);
+                this.serviceHostsById.set(intent.id, external.host);
+                continue;
+            }
+            const poolIntent = poolOf(intent, compute);
+            const pool = poolIntent && props.pools.get(poolIntent.id);
+            if (!pool) {
+                throw new Error(`[venturekit] services stack: service '${intent.id}' is on pool '${poolIntent?.id ?? intent.compute}' ` +
+                    `but pools has no entry for it. The CLI generator must wire computeStack.pools into VentureServicesStackProps.pools.`);
+            }
+            const deployed = this.createService(intent, pool, props);
+            this.services.set(intent.id, deployed);
+            if (deployed.url)
+                this.serviceUrlsById.set(intent.id, deployed.url);
+            writeSsm(this, servicesKeys.serviceName(projectName, stage, intent.id), deployed.service.serviceName, {
+                description: `ECS service of '${intent.id}' on pool '${pool.intent.id}'.`,
+            });
+            writeSsm(this, servicesKeys.logGroupName(projectName, stage, intent.id), deployed.logGroup.logGroupName, {
+                description: `Log group of every container of '${intent.id}'.`,
+            });
+            writeSsm(this, servicesKeys.alarmTopicArn(projectName, stage, intent.id), deployed.alarms.topic.topicArn, {
+                description: `SNS topic '${intent.id}''s alarms ring.`,
+            });
+            if (deployed.url) {
+                writeSsm(this, servicesKeys.url(projectName, stage, intent.id), deployed.url, {
+                    description: `Private address of '${intent.id}' (inside the VPC); the app tier injects it as SERVICE_${upperSnake(intent.id)}_URL.`,
+                });
+            }
+            const publicAddresses = deployed.addresses.length > 0 ? deployed.addresses : pool.addresses;
+            const publicPorts = (intent.containers ?? []).flatMap((c) => (c.ports ?? []).filter((p) => p.expose === 'public'));
+            if (publicPorts.length > 0 && publicAddresses.length > 0) {
+                writeSsm(this, servicesKeys.addresses(projectName, stage, intent.id), cdk.Fn.join(',', publicAddresses.map((a) => a.ref)), {
+                    description: `Fixed public addresses of '${intent.id}''s public ports (one per AZ).`,
+                });
+            }
+            const loadBalancer = deployed.loadBalancer ?? (publicPorts.length > 0 ? pool.publicLoadBalancer : undefined);
+            if (loadBalancer) {
+                writeSsm(this, servicesKeys.loadBalancerDnsName(projectName, stage, intent.id), loadBalancer.loadBalancerDnsName, {
+                    description: `Load balancer in front of '${intent.id}''s public ports — a CNAME target.`,
+                });
+            }
+            const sharedPorts = (intent.containers ?? []).flatMap((c) => (c.ports ?? []).filter((p) => p.expose === 'shared').map((p) => p.port));
+            if (sharedPorts.length > 0 && pool.endpointService) {
+                writeSsm(this, servicesKeys.endpointServiceName(projectName, stage, intent.id), pool.endpointService.vpcEndpointServiceName, {
+                    description: `Endpoint service a consumer venture connects to for '${intent.id}' (services[].external).`,
+                });
+                writeSsm(this, servicesKeys.sharedPorts(projectName, stage, intent.id), sharedPorts.join(','), {
+                    description: `Ports of '${intent.id}' reachable through the private link.`,
+                });
+                writeSsm(this, servicesKeys.port(projectName, stage, intent.id), String(sharedPorts[0]), {
+                    description: `First shared port of '${intent.id}' — what a consumer's SERVICE_<ID>_URL names.`,
+                });
+            }
+        }
+    }
+    createExternal(intent, props) {
+        const { projectName, stage, vpc } = props;
+        const owner = intent.external.project;
+        const ownerIntent = intent.external.intent ?? intent.id;
+        const suffix = logicalSuffix(intent.id);
+        const name = `${projectName}-${stage}-${intent.id}`;
+        // The owner published these when it deployed (same account, region and
+        // stage). `vk deploy`'s pre-flight read them and pinned them on the
+        // intent; standalone, they are read at deploy time through
+        // CloudFormation, so this synth needs no credentials either way.
+        const resolved = intent.external.resolved;
+        const serviceName = resolved ? resolved.endpointServiceName : readSsmString(this, servicesKeys.endpointServiceName(owner, stage, ownerIntent));
+        const port = resolved ? resolved.port : readSsmString(this, servicesKeys.port(owner, stage, ownerIntent));
+        // The endpoint's interfaces live in this VPC's private subnets; what
+        // reaches them is decided here — the VPC, on every port, since the
+        // owner's balancer only listens on the shared ones anyway.
+        const securityGroup = new ec2.SecurityGroup(this, `EndpointSg${suffix}`, {
+            vpc,
+            description: `${name}: this VPC to ${owner}/${ownerIntent} through the private link`,
+            allowAllOutbound: true,
+        });
+        securityGroup.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.allTcp(), `${owner}/${ownerIntent} from the VPC`);
+        const endpoint = new ec2.InterfaceVpcEndpoint(this, `Endpoint${suffix}`, {
+            vpc,
+            service: new ec2.InterfaceVpcEndpointService(serviceName),
+            subnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+            securityGroups: [securityGroup],
+            privateDnsEnabled: false,
+            open: false,
+        });
+        // `vpcEndpointDnsEntries` are `<hosted zone id>:<dns name>`; the first is the regional name.
+        const host = cdk.Fn.select(1, cdk.Fn.split(':', cdk.Fn.select(0, endpoint.vpcEndpointDnsEntries)));
+        const url = `http://${host}:${port}`;
+        new cdk.CfnOutput(this, `External${suffix}Host`, { value: host, description: `${owner}/${ownerIntent} through the private link; SERVICE_${upperSnake(intent.id)}_HOST in the Lambdas` });
+        return { intent, endpoint, host, url };
+    }
+    createService(intent, pool, props) {
+        const { projectName, stage, envConfig, projectDir, vpc } = props;
+        const name = `${projectName}-${stage}-${intent.id}`;
+        const suffix = logicalSuffix(intent.id);
+        const onInstance = pool.kind === 'instance';
+        const containers = intent.containers ?? [];
+        const removalPolicy = this.isStrictRetain ? cdk.RemovalPolicy.RETAIN : cdk.RemovalPolicy.DESTROY;
+        const logGroup = new logs.LogGroup(this, `Logs${suffix}`, {
+            logGroupName: serviceLogGroupName(projectName, stage, intent.id),
+            retention: toLogRetention(intent.logRetentionDays ?? envConfig.observability.logs.retentionDays),
+            removalPolicy,
+        });
+        // ── The task ─────────────────────────────────────────────────────
+        const volumes = intent.volumes ?? [];
+        const fileSystems = new Map();
+        let taskSecurityGroup;
+        let taskDefinition;
+        if (onInstance) {
+            taskDefinition = new ecs.Ec2TaskDefinition(this, `Task${suffix}`, {
+                family: name,
+                networkMode: ecs.NetworkMode.HOST,
+                // A persistent volume is a directory the compute tier created on the
+                // machine's disk; a scratch one is ECS's own, gone with the task.
+                volumes: volumes.map((v) => (v.persistent ? { name: v.name, host: { sourcePath: instanceVolumePath(intent.id, v.name) } } : { name: v.name })),
+            });
+        }
+        else {
+            taskSecurityGroup = new ec2.SecurityGroup(this, `TaskSg${suffix}`, {
+                vpc,
+                description: `${name} tasks: the declared vpc ports from the VPC, public ones from the load balancer`,
+                allowAllOutbound: true,
+            });
+            for (const v of volumes) {
+                if (!v.persistent)
+                    continue;
+                // The volume outlives any one task: a replacement serves what the previous one built.
+                const fsSg = new ec2.SecurityGroup(this, `Volume${suffix}${logicalSuffix(v.name)}Sg`, {
+                    vpc,
+                    description: `${name} volume ${v.name}: from the task only`,
+                    allowAllOutbound: false,
+                });
+                const fileSystem = new efs.FileSystem(this, `Volume${suffix}${logicalSuffix(v.name)}`, {
+                    vpc,
+                    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+                    securityGroup: fsSg,
+                    encrypted: true,
+                    // Read once per task start, written now and then: pay per byte, not for provisioned throughput.
+                    throughputMode: efs.ThroughputMode.ELASTIC,
+                    removalPolicy,
+                });
+                fileSystem.connections.allowDefaultPortFrom(taskSecurityGroup, `${name} task to volume ${v.name}`);
+                fileSystems.set(v.name, fileSystem);
+            }
+            taskDefinition = new ecs.FargateTaskDefinition(this, `Task${suffix}`, {
+                family: name,
+                cpu: intent.cpu ?? 256,
+                memoryLimitMiB: intent.memoryMiB ?? 512,
+                runtimePlatform: {
+                    cpuArchitecture: pool.architecture === 'arm64' ? ecs.CpuArchitecture.ARM64 : ecs.CpuArchitecture.X86_64,
+                    operatingSystemFamily: ecs.OperatingSystemFamily.LINUX,
+                },
+                volumes: volumes.map((v) => {
+                    const fileSystem = fileSystems.get(v.name);
+                    return fileSystem ? { name: v.name, efsVolumeConfiguration: { fileSystemId: fileSystem.fileSystemId, transitEncryption: 'ENABLED' } } : { name: v.name };
+                }),
+            });
+        }
+        // ── The database ─────────────────────────────────────────────────
+        // The same contract every Lambda of the venture gets; the container
+        // fetches the password itself from DB_SECRET_ARN, so the task role is
+        // granted that read and nothing else of the secret's.
+        const databaseEnv = {};
+        if (intent.database) {
+            const db = props.databaseEndpointsById?.get(intent.database);
+            if (!db) {
+                throw new Error(`[venturekit] services stack: service '${intent.id}' declares database '${intent.database}' ` +
+                    `but databaseEndpointsById has no entry for it. The CLI generator must wire dataStack.databases into VentureServicesStackProps.`);
+            }
+            databaseEnv.DB_HOST = db.host;
+            databaseEnv.DB_PORT = db.port;
+            databaseEnv.DB_NAME = db.name;
+            databaseEnv.DB_SSL = 'true';
+            if (db.secretArn) {
+                databaseEnv.DB_SECRET_ARN = db.secretArn;
+                secretsmanager.Secret.fromSecretCompleteArn(this, `DbSecret${suffix}`, db.secretArn).grantRead(taskDefinition.taskRole);
+            }
+            if (db.tenantRole)
+                databaseEnv.DB_TENANT_ROLE = db.tenantRole;
+            if (taskSecurityGroup) {
+                const conn = props.databaseConnectionsById?.get(intent.database);
+                if (conn) {
+                    const dbSg = ec2.SecurityGroup.fromSecurityGroupId(this, `ImportedDbSg${suffix}`, conn.securityGroupId, { mutable: true });
+                    dbSg.connections.allowFrom(taskSecurityGroup, ec2.Port.tcp(conn.port), `Allow ${name} tasks to connect to db ${intent.database}`);
+                }
+            }
+        }
+        // ── The containers ───────────────────────────────────────────────
+        const platform = pool.architecture === 'arm64' ? Platform.LINUX_ARM64 : Platform.LINUX_AMD64;
+        const publicPorts = [];
+        const sharedPorts = [];
+        const vpcPorts = [];
+        for (const container of containers) {
+            const secrets = {};
+            for (const s of container.secrets ?? []) {
+                const arn = props.secretArnsById?.get(s.id);
+                if (!arn) {
+                    throw new Error(`[venturekit] services stack: container '${container.name}' of '${intent.id}' names secret '${s.id}' ` +
+                        `but secretArnsById has no entry for it. The CLI generator must wire configStack.secrets into VentureServicesStackProps.`);
+                }
+                secrets[s.env] = ecs.Secret.fromSecretsManager(secretsmanager.Secret.fromSecretCompleteArn(this, `Secret${suffix}${logicalSuffix(container.name)}${logicalSuffix(s.id)}`, arn));
+            }
+            // ECS wants a floor or a ceiling for every container of an EC2 task.
+            // Unset, the container gets the smallest floor the scheduler counts
+            // and no ceiling — it takes what is free, as the intent promises.
+            const memory = onInstance
+                ? container.memory
+                    ? { memoryReservationMiB: container.memory.reservationMiB ?? (container.memory.limitMiB === undefined ? DEFAULT_MEMORY_RESERVATION_MIB : undefined), memoryLimitMiB: container.memory.limitMiB }
+                    : { memoryReservationMiB: DEFAULT_MEMORY_RESERVATION_MIB }
+                : {};
+            const swap = onInstance && container.swap && pool.intent.swapMiB
+                ? { linuxParameters: new ecs.LinuxParameters(this, `Linux${suffix}${logicalSuffix(container.name)}`, { maxSwap: cdk.Size.mebibytes(pool.intent.swapMiB), swappiness: 60 }) }
+                : {};
+            const healthCheck = container.healthCheck
+                ? {
+                    healthCheck: {
+                        command: container.healthCheck.test,
+                        interval: cdk.Duration.seconds(container.healthCheck.intervalSec ?? 30),
+                        timeout: cdk.Duration.seconds(container.healthCheck.timeoutSec ?? 5),
+                        retries: container.healthCheck.retries ?? 3,
+                        startPeriod: cdk.Duration.seconds(container.healthCheck.startPeriodSec ?? 30),
+                    },
+                }
+                : {};
+            const defined = taskDefinition.addContainer(`Container${suffix}${logicalSuffix(container.name)}`, {
+                containerName: container.name,
+                image: container.build
+                    ? ecs.ContainerImage.fromAsset(path.resolve(projectDir, container.build.context ?? '.'), {
+                        file: container.build.dockerfile ?? 'Dockerfile',
+                        platform,
+                        ignoreMode: cdk.IgnoreMode.DOCKER,
+                        exclude: container.build.ignore,
+                        assetName: `${projectName}-${intent.id}-${container.name}`,
+                    })
+                    : ecs.ContainerImage.fromRegistry(container.image),
+                logging: ecs.LogDrivers.awsLogs({ logGroup, streamPrefix: container.name }),
+                environment: { ...databaseEnv, ...(container.env ?? {}) },
+                secrets,
+                portMappings: (container.ports ?? []).map((p) => ({ containerPort: p.port, protocol: ecs.Protocol.TCP })),
+                essential: container.essential ?? true,
+                ...memory,
+                ...swap,
+                ...healthCheck,
+            });
+            for (const mount of container.mounts ?? []) {
+                defined.addMountPoints({ containerPath: mount.path, sourceVolume: mount.volume, readOnly: mount.readOnly ?? false });
+            }
+            for (const p of container.ports ?? []) {
+                if (p.expose === 'public') {
+                    publicPorts.push({ container, port: p.port, from: p.from ?? [], tls: p.tls });
+                    if ((p.from ?? []).length === 0 && !onInstance) {
+                        cdk.Annotations.of(this).addWarningV2(`${CLOSED_PORT_WARNING}:${intent.id}:${p.port}`, `${name}: port ${p.port} of container ${container.name} is public with no ranges in 'from', so it admits nobody. List the ranges that may reach it.`);
+                    }
+                }
+                else if (p.expose === 'shared') {
+                    sharedPorts.push(p.port);
+                }
+                else if (p.expose === 'vpc') {
+                    vpcPorts.push(p.port);
+                }
+            }
+        }
+        // ── The service ──────────────────────────────────────────────────
+        let service;
+        let loadBalancer;
+        const addresses = [];
+        const targetGroups = [];
+        if (onInstance) {
+            // One task on every machine of the pool. Host networking: a machine's
+            // ports are released by the old task before the new one binds them, so
+            // a pool of one goes dark for the switch, a pool of several keeps all
+            // but one machine serving.
+            const machines = Math.max(1, pool.machines.min);
+            service = new ecs.Ec2Service(this, `Service${suffix}`, {
+                cluster: pool.cluster,
+                serviceName: name,
+                taskDefinition,
+                daemon: true,
+                minHealthyPercent: machines > 1 ? Math.ceil((100 * (machines - 1)) / machines) : 0,
+                maxHealthyPercent: 100,
+                circuitBreaker: { enable: true, rollback: true },
+                propagateTags: ecs.PropagatedTagSource.SERVICE,
+            });
+            // The pool's balancers front this service's ports; their target groups are what the alarms watch.
+            for (const port of [...publicPorts.map((p) => p.port), ...sharedPorts]) {
+                const group = pool.targetGroups.get(port);
+                if (group)
+                    targetGroups.push({ id: String(port), port, group });
+            }
+        }
+        else {
+            const taskSg = taskSecurityGroup;
+            for (const port of vpcPorts) {
+                taskSg.addIngressRule(ec2.Peer.ipv4(vpc.vpcCidrBlock), ec2.Port.tcp(port), `${intent.id} :${port} from the VPC`);
+            }
+            const nlbSecurityGroup = publicPorts.length > 0
+                ? new ec2.SecurityGroup(this, `LoadBalancerSg${suffix}`, {
+                    vpc,
+                    description: `${name} load balancer: the public ports from their ranges, TLS doors from anywhere`,
+                    allowAllOutbound: true,
+                })
+                : undefined;
+            if (nlbSecurityGroup) {
+                for (const p of publicPorts) {
+                    for (const cidr of p.from)
+                        nlbSecurityGroup.addIngressRule(ec2.Peer.ipv4(cidr), ec2.Port.tcp(p.port), `${intent.id}/${p.container.name} :${p.port} from ${cidr}`);
+                    if (p.tls)
+                        nlbSecurityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(p.tls.port ?? 443), `${intent.id}/${p.container.name} TLS to :${p.port}`);
+                    // ECS opens nothing by itself for a network target group.
+                    taskSg.addIngressRule(nlbSecurityGroup, ec2.Port.tcp(p.port), `load balancer to ${intent.id} :${p.port}`);
+                }
+                if (intent.health)
+                    taskSg.addIngressRule(nlbSecurityGroup, ec2.Port.tcp(intent.health.port), `load balancer health checks to ${intent.id} :${intent.health.port}`);
+            }
+            const fargate = new ecs.FargateService(this, `Service${suffix}`, {
+                cluster: pool.cluster,
+                serviceName: name,
+                taskDefinition: taskDefinition,
+                desiredCount: intent.replicas ?? 1,
+                vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
+                securityGroups: [taskSg],
+                assignPublicIp: false,
+                // A replacement task is healthy before the old one is drained, and a task that cannot start rolls the deployment back instead of flapping.
+                minHealthyPercent: 100,
+                maxHealthyPercent: 200,
+                circuitBreaker: { enable: true, rollback: true },
+                ...(nlbSecurityGroup ? { healthCheckGracePeriod: cdk.Duration.seconds(60) } : {}),
+                propagateTags: ecs.PropagatedTagSource.SERVICE,
+                ...(intent.dns && pool.namespace
+                    ? {
+                        cloudMapOptions: {
+                            cloudMapNamespace: pool.namespace,
+                            name: intent.dns,
+                            dnsRecordType: servicediscovery.DnsRecordType.A,
+                            dnsTtl: cdk.Duration.seconds(30),
+                        },
+                    }
+                    : {}),
+            });
+            service = fargate;
+            if (nlbSecurityGroup) {
+                vpc.publicSubnets.forEach((_, i) => {
+                    const address = new ec2.CfnEIP(this, `Address${suffix}${i + 1}`, { domain: 'vpc', tags: [{ key: 'Name', value: `${name}-${i + 1}` }] });
+                    address.applyRemovalPolicy(removalPolicy);
+                    addresses.push(address);
+                });
+                loadBalancer = new elbv2.NetworkLoadBalancer(this, `LoadBalancer${suffix}`, {
+                    vpc,
+                    loadBalancerName: name.slice(0, 32),
+                    internetFacing: true,
+                    // One task in one AZ must be reachable through every address.
+                    crossZoneEnabled: true,
+                    securityGroups: [nlbSecurityGroup],
+                    subnetMappings: vpc.publicSubnets.map((subnet, i) => ({ subnet, allocationId: addresses[i].attrAllocationId })),
+                });
+                const healthCheck = intent.health
+                    ? {
+                        protocol: elbv2.Protocol.HTTP,
+                        path: intent.health.path,
+                        port: String(intent.health.port),
+                        interval: cdk.Duration.seconds(10),
+                        timeout: cdk.Duration.seconds(5),
+                        healthyThresholdCount: 2,
+                        unhealthyThresholdCount: 2,
+                    }
+                    : { protocol: elbv2.Protocol.TCP, interval: cdk.Duration.seconds(10), healthyThresholdCount: 2, unhealthyThresholdCount: 2 };
+                for (const p of publicPorts) {
+                    const id = `${logicalSuffix(p.container.name)}${p.port}`;
+                    const group = new elbv2.NetworkTargetGroup(this, `Targets${suffix}${id}`, {
+                        vpc,
+                        port: p.port,
+                        protocol: elbv2.Protocol.TCP,
+                        targetType: elbv2.TargetType.IP,
+                        preserveClientIp: true,
+                        // A client whose task is going away should reconnect now, not when its keepalive notices.
+                        connectionTermination: true,
+                        deregistrationDelay: cdk.Duration.seconds(30),
+                        healthCheck,
+                        targets: [fargate.loadBalancerTarget({ containerName: p.container.name, containerPort: p.port })],
+                    });
+                    targetGroups.push({ id, port: p.port, group });
+                    loadBalancer.addListener(`Listener${suffix}${id}`, { port: p.port, protocol: elbv2.Protocol.TCP, defaultTargetGroups: [group] });
+                    if (p.tls) {
+                        loadBalancer.addListener(`Tls${suffix}${id}`, {
+                            port: p.tls.port ?? 443,
+                            protocol: elbv2.Protocol.TLS,
+                            certificates: [elbv2.ListenerCertificate.fromArn(p.tls.certificateArn)],
+                            sslPolicy: elbv2.SslPolicy.RECOMMENDED_TLS,
+                            defaultTargetGroups: [group],
+                        });
+                    }
+                }
+            }
+        }
+        // ── Who hears when it is not working ─────────────────────────────
+        const alarms = new ServiceAlarms(this, `Alarms${suffix}`, { name, email: pool.intent.alarms?.email });
+        alarms.taskDown(service, `${name} (${containers.map((c) => c.name).join(', ')})`);
+        const logErrors = intent.alarms?.logErrors ?? true;
+        if (logErrors !== false)
+            alarms.logErrors(logGroup, name, name, typeof logErrors === 'object' ? logErrors : {});
+        if (intent.alarms?.silence)
+            alarms.silence(logGroup, name, name, intent.alarms.silence);
+        for (const { id, port, group } of targetGroups)
+            alarms.unhealthyTargets(id, group, `${name} port ${port}`);
+        // ── What an operator needs to know ───────────────────────────────
+        const url = serviceUrl(intent, pool.zoneName);
+        if (url)
+            new cdk.CfnOutput(this, `Service${suffix}Url`, { value: url, description: `SERVICE_${upperSnake(intent.id)}_URL for the venture's Lambdas; resolves inside the VPC only` });
+        if (publicPorts.length > 0) {
+            new cdk.CfnOutput(this, `Service${suffix}PublicPorts`, {
+                value: publicPorts.map((p) => `tcp/${p.port}${p.tls ? ` (+tls/${p.tls.port ?? 443})` : ''} from ${p.from.length > 0 ? p.from.join(' ') : 'nobody (closed)'}`).join('; '),
+            });
+            const fixed = addresses.length > 0 ? addresses : pool.addresses;
+            new cdk.CfnOutput(this, `Service${suffix}Addresses`, {
+                value: fixed.length > 0 ? cdk.Fn.join(', ', fixed.map((a) => a.ref)) : 'none',
+                description: 'One Elastic IP per AZ — point the public hostname at them, or a CNAME at LoadBalancerDnsName',
+            });
+        }
+        const front = loadBalancer ?? (publicPorts.length > 0 ? pool.publicLoadBalancer : undefined);
+        if (front)
+            new cdk.CfnOutput(this, `Service${suffix}LoadBalancerDnsName`, { value: front.loadBalancerDnsName });
+        if (sharedPorts.length > 0 && pool.endpointService) {
+            new cdk.CfnOutput(this, `Service${suffix}EndpointService`, { value: pool.endpointService.vpcEndpointServiceName, description: `Shared ports ${sharedPorts.join(', ')} — what another venture's services[].external resolves to` });
+        }
+        new cdk.CfnOutput(this, `Service${suffix}LogGroup`, { value: logGroup.logGroupName });
+        new cdk.CfnOutput(this, `Service${suffix}Compute`, {
+            value: onInstance
+                ? `instance pool ${pool.intent.id}: one task on each of ${pool.machines.min}–${pool.machines.max} machines (cluster ${pool.cluster.clusterName})`
+                : `serverless (${intent.cpu ?? 256} CPU units, ${intent.memoryMiB ?? 512} MiB, ${pool.architecture}, ${intent.replicas ?? 1} cop${(intent.replicas ?? 1) === 1 ? 'y' : 'ies'})`,
+        });
+        return { intent, pool, service, logGroup, alarms, url, loadBalancer, addresses, fileSystems };
+    }
+}
+function upperSnake(id) {
+    return String(id).toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+}
+/** `my-service` → `MyService`, for construct ids. */
+function logicalSuffix(id) {
+    return id
+        .split(/[^a-zA-Z0-9]+/)
+        .filter(Boolean)
+        .map((part) => part[0].toUpperCase() + part.slice(1))
+        .join('');
+}
+//# sourceMappingURL=services-stack.js.map

package/dist/cdk/services-stack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services-stack.js","sourceRoot":"","sources":["../../src/cdk/services-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,KAAK,MAAM,wCAAwC,CAAC;AAChE,OAAO,KAAK,IAAI,MAAM,sBAAsB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,gBAAgB,MAAM,kCAAkC,CAAC;AAErE,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,0BAA0B,GAK3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAoB,MAAM,oBAAoB,CAAC;AAElF,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,KAAa,EAAE,SAAiB;IACvF,OAAO,eAAe,WAAW,IAAI,KAAK,aAAa,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,UAAU,CAAC,OAAsB,EAAE,QAAgB;IACjE,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,GAAG,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,oIAAoI;AACpI,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AA+D5E,MAAM,OAAO,oBAAqB,SAAQ,GAAG,CAAC,KAAK;IACjC,QAAQ,GAAiC,IAAI,GAAG,EAAE,CAAC;IAEnE,iFAAiF;IACjE,SAAS,GAAiC,IAAI,GAAG,EAAE,CAAC;IAEpE,yHAAyH;IACzG,eAAe,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEjE,wFAAwF;IACxE,gBAAgB,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEjD,cAAc,CAAU;IAEzC,YAAY,KAAgB,EAAE,EAAU,EAAE,KAAgC;QACxE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;QAChE,WAAW,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC;QAE1F,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7C,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACnD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtC,kEAAkE;oBAClE,gEAAgE;oBAChE,mEAAmE;oBACnE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CACnC,4CAA4C,MAAM,CAAC,EAAE,EAAE,EACvD,GAAG,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,+BAA+B;wBAC3J,4DAA4D,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,MAAM,CAAC,QAAQ,CAAC,OAAO,4BAA4B,CACxJ,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACpD,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,EAAE,iBAAiB,UAAU,EAAE,EAAE,IAAI,MAAM,CAAC,OAAO,IAAI;oBACrG,qHAAqH,CACxH,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvC,IAAI,QAAQ,CAAC,GAAG;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YAEpE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;gBACpG,WAAW,EAAE,mBAAmB,MAAM,CAAC,EAAE,cAAc,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI;aAC1E,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE;gBACvG,WAAW,EAAE,oCAAoC,MAAM,CAAC,EAAE,IAAI;aAC/D,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE;gBACxG,WAAW,EAAE,cAAc,MAAM,CAAC,EAAE,kBAAkB;aACvD,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE;oBAC5E,WAAW,EAAE,uBAAuB,MAAM,CAAC,EAAE,0DAA0D,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO;iBACpI,CAAC,CAAC;YACL,CAAC;YACD,MAAM,eAAe,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5F,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC;YACnH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE;oBACzH,WAAW,EAAE,8BAA8B,MAAM,CAAC,EAAE,gCAAgC;iBACrF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC7G,IAAI,YAAY,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,mBAAmB,EAAE;oBAChH,WAAW,EAAE,8BAA8B,MAAM,CAAC,EAAE,oCAAoC;iBACzF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,sBAAsB,EAAE;oBAC3H,WAAW,EAAE,wDAAwD,MAAM,CAAC,EAAE,0BAA0B;iBACzG,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAC7F,WAAW,EAAE,aAAa,MAAM,CAAC,EAAE,uCAAuC;iBAC3E,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;oBACvF,WAAW,EAAE,yBAAyB,MAAM,CAAC,EAAE,+CAA+C;iBAC/F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAAqB,EAAE,KAAgC;QAC5E,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAS,CAAC,OAAO,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAS,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QAEpD,uEAAuE;QACvE,oEAAoE;QACpE,2DAA2D;QAC3D,iEAAiE;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAS,CAAC,QAAQ,CAAC;QAC3C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/I,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1G,qEAAqE;QACrE,mEAAmE;QACnE,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,MAAM,EAAE,EAAE;YACvE,GAAG;YACH,WAAW,EAAE,GAAG,IAAI,iBAAiB,KAAK,IAAI,WAAW,2BAA2B;YACpF,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,IAAI,WAAW,eAAe,CAAC,CAAC;QACzH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,MAAM,EAAE,EAAE;YACvE,GAAG;YACH,OAAO,EAAE,IAAI,GAAG,CAAC,2BAA2B,CAAC,WAAW,CAAC;YACzD,OAAO,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE;YAC3D,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,iBAAiB,EAAE,KAAK;YACxB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,6FAA6F;QAC7F,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAErC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,WAAW,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,IAAI,WAAW,sCAAsC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACzL,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACzC,CAAC;IAEO,aAAa,CAAC,MAAqB,EAAE,IAAiB,EAAE,KAAgC;QAC9F,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QACjE,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC;QAEjG,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,EAAE;YACxD,YAAY,EAAE,mBAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAChE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,gBAAgB,IAAI,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YAChG,aAAa;SACd,CAAC,CAAC;QAEH,oEAAoE;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;QACtD,IAAI,iBAAgD,CAAC;QACrD,IAAI,cAAkC,CAAC;QAEvC,IAAI,UAAU,EAAE,CAAC;YACf,cAAc,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,EAAE;gBAChE,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI;gBACjC,qEAAqE;gBACrE,kEAAkE;gBAClE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAC/I,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE;gBACjE,GAAG;gBACH,WAAW,EAAE,GAAG,IAAI,iFAAiF;gBACrG,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,CAAC,UAAU;oBAAE,SAAS;gBAC5B,sFAAsF;gBACtF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;oBACpF,GAAG;oBACH,WAAW,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC,IAAI,sBAAsB;oBAC3D,gBAAgB,EAAE,KAAK;iBACxB,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE;oBACrF,GAAG;oBACH,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE;oBAC9D,aAAa,EAAE,IAAI;oBACnB,SAAS,EAAE,IAAI;oBACf,gGAAgG;oBAChG,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,OAAO;oBAC1C,aAAa;iBACd,CAAC,CAAC;gBACH,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACtC,CAAC;YACD,cAAc,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,MAAM,EAAE,EAAE;gBACpE,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG;gBACtB,cAAc,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;gBACvC,eAAe,EAAE;oBACf,eAAe,EAAE,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM;oBACvG,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,CAAC,KAAK;iBACvD;gBACD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC3C,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3J,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,EAAE,wBAAwB,MAAM,CAAC,QAAQ,IAAI;oBAC3F,gIAAgI,CACnI,CAAC;YACJ,CAAC;YACD,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAC9B,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAC9B,WAAW,CAAC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;YAC9B,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;YAC5B,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;gBACjB,WAAW,CAAC,aAAa,GAAG,EAAE,CAAC,SAAS,CAAC;gBACzC,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,MAAM,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC1H,CAAC;YACD,IAAI,EAAE,CAAC,UAAU;gBAAE,WAAW,CAAC,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC;YAC9D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjE,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,mBAAmB,CAAC,IAAI,EAAE,eAAe,MAAM,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3H,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,IAAI,2BAA2B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpI,CAAC;YACH,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7F,MAAM,WAAW,GAA0H,EAAE,CAAC;QAC9I,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,OAAO,GAA+B,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,IAAI,KAAK,CACb,2CAA2C,SAAS,CAAC,IAAI,SAAS,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,IAAI;wBACpG,yHAAyH,CAC5H,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAClL,CAAC;YACD,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,MAAM,GAAG,UAAU;gBACvB,CAAC,CAAC,SAAS,CAAC,MAAM;oBAChB,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;oBAChM,CAAC,CAAC,EAAE,oBAAoB,EAAE,8BAA8B,EAAE;gBAC5D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GACR,UAAU,IAAI,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjD,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE;gBAC5K,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW;gBACvC,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,IAAI;wBACnC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC;wBACvE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;wBACpE,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC;wBAC3C,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;qBAC9E;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,YAAY,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE;gBAChG,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,KAAK,EAAE,SAAS,CAAC,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE;wBACrF,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY;wBAChD,QAAQ;wBACR,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM;wBACjC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;wBAC/B,SAAS,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,EAAE;qBAC3D,CAAC;oBACJ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,SAAS,CAAC,KAAM,CAAC;gBACrD,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC3E,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;gBACzD,OAAO;gBACP,YAAY,EAAE,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzG,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI;gBACtC,GAAG,MAAM;gBACT,GAAG,IAAI;gBACP,GAAG,WAAW;aACf,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAC3C,OAAO,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;YACvH,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1B,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC9E,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBAC/C,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CACnC,GAAG,mBAAmB,IAAI,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAC/C,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,iBAAiB,SAAS,CAAC,IAAI,8FAA8F,CACrJ,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;qBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC9B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,IAAI,OAAwB,CAAC;QAC7B,IAAI,YAAmD,CAAC;QACxD,MAAM,SAAS,GAAiB,EAAE,CAAC;QACnC,MAAM,YAAY,GAAyE,EAAE,CAAC;QAE9F,IAAI,UAAU,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChD,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,IAAI;gBACjB,cAAc;gBACd,MAAM,EAAE,IAAI;gBACZ,iBAAiB,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClF,iBAAiB,EAAE,GAAG;gBACtB,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChD,aAAa,EAAE,GAAG,CAAC,mBAAmB,CAAC,OAAO;aAC/C,CAAC,CAAC;YACH,kGAAkG;YAClG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;gBACvE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,KAAK;oBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,iBAAkB,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI,eAAe,CAAC,CAAC;YACnH,CAAC;YACD,MAAM,gBAAgB,GACpB,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,iBAAiB,MAAM,EAAE,EAAE;oBACrD,GAAG;oBACH,WAAW,EAAE,GAAG,IAAI,6EAA6E;oBACjG,gBAAgB,EAAE,IAAI;iBACvB,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI;wBAAE,gBAAgB,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;oBAClK,IAAI,CAAC,CAAC,GAAG;wBAAE,gBAAgB,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtJ,0DAA0D;oBAC1D,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,oBAAoB,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5G,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM;oBAAE,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,kCAAkC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrK,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE;gBAC/D,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,IAAI;gBACjB,cAAc,EAAE,cAA2C;gBAC3D,YAAY,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;gBAClC,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE;gBAC9D,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,cAAc,EAAE,KAAK;gBACrB,2IAA2I;gBAC3I,iBAAiB,EAAE,GAAG;gBACtB,iBAAiB,EAAE,GAAG;gBACtB,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,aAAa,EAAE,GAAG,CAAC,mBAAmB,CAAC,OAAO;gBAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS;oBAC9B,CAAC,CAAC;wBACE,eAAe,EAAE;4BACf,iBAAiB,EAAE,IAAI,CAAC,SAAS;4BACjC,IAAI,EAAE,MAAM,CAAC,GAAG;4BAChB,aAAa,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;4BAC/C,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;yBACjC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,OAAO,GAAG,OAAO,CAAC;YAElB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxI,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;oBAC1C,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBACH,YAAY,GAAG,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,EAAE,eAAe,MAAM,EAAE,EAAE;oBAC1E,GAAG;oBACH,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBACnC,cAAc,EAAE,IAAI;oBACpB,8DAA8D;oBAC9D,gBAAgB,EAAE,IAAI;oBACtB,cAAc,EAAE,CAAC,gBAAgB,CAAC;oBAClC,cAAc,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;iBACjH,CAAC,CAAC;gBACH,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM;oBAClD,CAAC,CAAC;wBACE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;wBAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;wBACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;wBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAClC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;wBAChC,qBAAqB,EAAE,CAAC;wBACxB,uBAAuB,EAAE,CAAC;qBAC3B;oBACH,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC;gBAC/H,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC5B,MAAM,EAAE,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,MAAM,GAAG,EAAE,EAAE,EAAE;wBACxE,GAAG;wBACH,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;wBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;wBAC/B,gBAAgB,EAAE,IAAI;wBACtB,0FAA0F;wBAC1F,qBAAqB,EAAE,IAAI;wBAC3B,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC7C,WAAW;wBACX,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;qBAClG,CAAC,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC/C,YAAY,CAAC,WAAW,CAAC,WAAW,MAAM,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACjI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;wBACV,YAAY,CAAC,WAAW,CAAC,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE;4BAC5C,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG;4BACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;4BAC5B,YAAY,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;4BACvE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;4BAC1C,mBAAmB,EAAE,CAAC,KAAK,CAAC;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;QACnD,IAAI,SAAS,KAAK,KAAK;YAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,YAAY;YAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;QAE3G,oEAAoE;QACpE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,8DAA8D,EAAE,CAAC,CAAC;QACrL,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,aAAa,EAAE;gBACrD,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;aACzK,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAChE,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,WAAW,EAAE;gBACnD,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC7E,WAAW,EAAE,8FAA8F;aAC5G,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7F,IAAI,KAAK;YAAE,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAChH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACnD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D,EAAE,CAAC,CAAC;QACrO,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS,EAAE;YACjD,KAAK,EAAE,UAAU;gBACf,CAAC,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,EAAE,yBAAyB,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,sBAAsB,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG;gBACjJ,CAAC,CAAC,eAAe,MAAM,CAAC,GAAG,IAAI,GAAG,eAAe,MAAM,CAAC,SAAS,IAAI,GAAG,SAAS,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;SAClL,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAChG,CAAC;CACF;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,qDAAqD;AACrD,SAAS,aAAa,CAAC,EAAU;IAC/B,OAAO,EAAE;SACN,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACrD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC"}