@vibesdotdev/hq 0.0.0-stage → 1.0.0-rc.2

package/dist/friction/friction-signals.record.descriptor.js

@@ -0,0 +1,52 @@
+import { FrictionSignalSchema } from "./schemas/signal.js";
+export const osFrictionSignalsRecordDescriptor = {
+    kind: 'storage/record',
+    id: 'os.friction-signals',
+    name: 'OS Friction Signals',
+    description: 'Friction signals (agent- or user-sourced) feeding the distillation + autopilot loop',
+    schema: FrictionSignalSchema,
+    tableName: 'os_friction_signals',
+    primaryKey: 'id',
+    relations: {},
+    indexes: [
+        { fields: ['signatureHash'], unique: false },
+        { fields: ['orgId', 'fingerprintVersion', 'fingerprint'], unique: true },
+        { fields: ['surface'], unique: false },
+        { fields: ['severity'], unique: false },
+        { fields: ['audience'], unique: false },
+        { fields: ['source'], unique: false },
+        { fields: ['orgId'], unique: false }
+    ],
+    version: 2,
+    timestamps: false,
+    autoId: false,
+    allowedAdapters: ['storage.localdb', 'storage.cloud-api'],
+    defaultAdapter: 'storage.localdb',
+    persistence: {
+        mode: 'local-first',
+        localAdapters: ['storage.localdb'],
+        remoteAdapters: ['storage.cloud-api']
+    },
+    adapterConfig: {
+        'storage.localdb': { dbName: 'os.db', scope: 'global' },
+        'storage.cloud-api': {
+            ownerApp: 'hq',
+            endpoint: '/api/hq/friction-signals',
+            apiPath: '/api/hq/friction-signals',
+            entityPath: '/api/hq/friction-signals/:id',
+            idField: 'id'
+        }
+    },
+    scope: 'global',
+    validateOnWrite: false,
+    validateOnRead: false,
+    versioning: false,
+    audit: false,
+    changeTracking: false,
+    internal: false,
+    softDelete: false,
+    namespace: 'os.friction-signals',
+    tags: ['os', 'friction', 'signals']
+};
+export default osFrictionSignalsRecordDescriptor;
+//# sourceMappingURL=friction-signals.record.descriptor.js.map

package/dist/friction/friction-signals.record.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"friction-signals.record.descriptor.js","sourceRoot":"","sources":["../../src/friction/friction-signals.record.descriptor.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,CAAC,MAAM,iCAAiC,GAAiC;IAC9E,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,qFAAqF;IACtF,MAAM,EAAE,oBAAoB;IAC5B,SAAS,EAAE,qBAAqB;IAChC,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;QACxE,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACtC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACvC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACvC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACrC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACpC;IACD,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,eAAe,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACzD,cAAc,EAAE,iBAAiB;IACjC,WAAW,EAAE;QACZ,IAAI,EAAE,aAAa;QACnB,aAAa,EAAE,CAAC,iBAAiB,CAAC;QAClC,cAAc,EAAE,CAAC,mBAAmB,CAAC;KACrC;IACD,aAAa,EAAE;QACd,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;QACvD,mBAAmB,EAAE;YACpB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,0BAA0B;YACpC,OAAO,EAAE,0BAA0B;YACnC,UAAU,EAAE,8BAA8B;YAC1C,OAAO,EAAE,IAAI;SACb;KACD;IACD,KAAK,EAAE,QAAQ;IACf,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;IACjB,KAAK,EAAE,KAAK;IACZ,cAAc,EAAE,KAAK;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,qBAAqB;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC;CACnC,CAAC;AAEF,eAAe,iCAAiC,CAAC"}

package/dist/friction/intake.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The package-owned friction intake (moved from hq-web, PROPOSAL
+ * bug-report-flow P0-3), so every HQ deployment, ours and users', runs the
+ * same admission.
+ *
+ * - {@link recordFrictionReport}: the browser "Report a problem" body behind
+ *   `POST /api/hq/reports`. Tenancy comes from the verified `Origin` through
+ *   Auth's app registry, never from the body.
+ * - {@link recordFrictionIntake}: the authenticated internal intake behind
+ *   `POST /api/internal/friction` (a verified user, or a service the route
+ *   already authenticated).
+ *
+ * Both rate limit through `cache/rate-limiter` where the caller is a browser,
+ * redact through `security/redactor` before the write, compute
+ * `personalDataLevel` from what was kept and what the redactor found, and
+ * fingerprint by the typed report context (fixes defects 1 and 2). A report
+ * whose stack points into `@vibesdotdev/*` also files a redacted upstream copy
+ * for the Vibes org (`hq.friction.upstream`, default on).
+ *
+ * Framework-free: a route hands typed request facts and maps the thrown
+ * `CapabilityError` to its HTTP status.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type FrictionSignal } from './schemas/signal.ts';
+import { type FrictionIntakeResponse, type FrictionReportResponse } from './schemas/intake.ts';
+/** The durable write. Defaults to the package store; hq-web binds its owner-scoped D1 writer. */
+export interface FrictionIntakeDeps {
+    writeSignal?(runtime: RuntimeRef, signal: FrictionSignal): Promise<FrictionSignal>;
+}
+/** Typed request facts from the route. */
+export interface FrictionReportRequest {
+    /** The request's `Origin` header. Tenancy derives from it, never from the body. */
+    origin: string | null;
+    /** The client address the host saw. Hashed here as a limiter key; never stored. */
+    clientAddress?: string;
+    body: unknown;
+}
+export type FrictionUpstreamOutcome = {
+    status: 'copied';
+    signalId: string;
+} | {
+    status: 'skipped';
+    reason: 'disabled' | 'unconfigured' | 'same-org' | 'no-platform-frame';
+} | {
+    status: 'failed';
+    reason: string;
+};
+export interface FrictionReportResult {
+    response: FrictionReportResponse;
+    signal: FrictionSignal;
+    upstream: FrictionUpstreamOutcome;
+}
+/** A caller the internal route already verified. */
+export type FrictionIntakeCaller = {
+    kind: 'user';
+    userId: string;
+    orgId?: string;
+} | {
+    kind: 'service';
+    onBehalfOf?: string;
+};
+export interface FrictionIntakeRequest {
+    caller: FrictionIntakeCaller;
+    body: unknown;
+}
+/** The page URL without its query and fragment (they carry tokens and personal data). */
+export declare function stripUrl(value: string): string;
+/**
+ * Record one browser report. The route has admitted the origin through CORS;
+ * this re-derives the app and target org from that same `Origin`.
+ */
+export declare function recordFrictionReport(runtime: RuntimeRef, request: FrictionReportRequest, deps?: FrictionIntakeDeps): Promise<FrictionReportResult>;
+/**
+ * Record one internal intake body for a caller the route verified (a user
+ * principal, or the internal service token). A user's org is the caller's
+ * own; a service names one or gets `hq.friction.upstreamOrgId`.
+ */
+export declare function recordFrictionIntake(runtime: RuntimeRef, request: FrictionIntakeRequest, deps?: FrictionIntakeDeps): Promise<FrictionIntakeResponse>;
+//# sourceMappingURL=intake.d.ts.map

package/dist/friction/intake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../../src/friction/intake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EASN,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAY7B,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAKN,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,MAAM,qBAAqB,CAAC;AAc7B,iGAAiG;AACjG,MAAM,WAAW,kBAAkB;IAClC,WAAW,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACnF;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACrC,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;CACd;AAED,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,cAAc,GAAG,UAAU,GAAG,mBAAmB,CAAA;CAAE,GAC7F;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,uBAAuB,CAAC;CAClC;AAED,oDAAoD;AACpD,MAAM,MAAM,oBAAoB,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC;CACd;AAwBD,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO9C;AA0PD;;;GAGG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,qBAAqB,EAC9B,IAAI,GAAE,kBAAuB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAkG/B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,qBAAqB,EAC9B,IAAI,GAAE,kBAAuB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA2DjC"}

package/dist/friction/intake.js

@@ -0,0 +1,459 @@
+/**
+ * The package-owned friction intake (moved from hq-web, PROPOSAL
+ * bug-report-flow P0-3), so every HQ deployment, ours and users', runs the
+ * same admission.
+ *
+ * - {@link recordFrictionReport}: the browser "Report a problem" body behind
+ *   `POST /api/hq/reports`. Tenancy comes from the verified `Origin` through
+ *   Auth's app registry, never from the body.
+ * - {@link recordFrictionIntake}: the authenticated internal intake behind
+ *   `POST /api/internal/friction` (a verified user, or a service the route
+ *   already authenticated).
+ *
+ * Both rate limit through `cache/rate-limiter` where the caller is a browser,
+ * redact through `security/redactor` before the write, compute
+ * `personalDataLevel` from what was kept and what the redactor found, and
+ * fingerprint by the typed report context (fixes defects 1 and 2). A report
+ * whose stack points into `@vibesdotdev/*` also files a redacted upstream copy
+ * for the Vibes org (`hq.friction.upstream`, default on).
+ *
+ * Framework-free: a route hands typed request facts and maps the thrown
+ * `CapabilityError` to its HTTP status.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, isCapabilityError, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { getLogger } from '@vibesdotdev/logging';
+import { sha256Hex } from '@vibesdotdev/shared/hashing';
+import { canonicalRegisteredOrigin, RegisteredAppSchema } from '@vibesdotdev/auth/schemas/registered-app';
+import { loadHqFrictionConfig } from "../config/hq-friction.config.descriptor.js";
+import { computeFrictionSignalFingerprint } from "./fingerprint.js";
+import { generateFrictionId, writeFrictionSignal } from "./store.js";
+import { emitFrictionSignalRecorded } from "./signal-recorded.event.descriptor.js";
+import { FrictionEvidenceLinkKindSchema } from "./schemas/signal.js";
+import { FrictionIntakeInputSchema, FrictionIntakeResponseSchema, FrictionReportInputSchema, FrictionReportResponseSchema } from "./schemas/intake.js";
+/**
+ * Auth's registered-app answer (P0-1), parsed at the boundary: null is the only
+ * "untrusted" answer, and a thrown error is not "untrusted". `ownership` says
+ * whether this caller sees the owner (HQ's `apps:owner` scope grants it).
+ */
+const RegisteredAppAnswerSchema = RegisteredAppSchema.nullable();
+const RATE_WINDOW_SECONDS = 3600;
+const PLATFORM_FRAME = /@vibesdotdev\//;
+function refuse(message, code, reason, details) {
+    return new CapabilityError(message, code, { reason, retryable: code === 'RATE_LIMITED', details: details });
+}
+/** The active request principal, or anonymous on a host without request principals. */
+function requestPrincipal(runtime) {
+    if (runtime.scope.capabilities?.requestPrincipals !== true)
+        return { kind: 'anonymous' };
+    const principal = settleNow(() => runtime.requestPrincipal());
+    if (principal.ok)
+        return principal.value;
+    if (principal.cause instanceof Error && isCapabilityError(principal.cause) && principal.cause.reason === 'invocation-inactive')
+        return { kind: 'anonymous' };
+    throw principal.cause;
+}
+function isLoopback(origin) {
+    const host = new URL(origin).hostname;
+    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host.endsWith('.localhost');
+}
+/** The page URL without its query and fragment (they carry tokens and personal data). */
+export function stripUrl(value) {
+    const parsed = z.url().safeParse(value);
+    if (parsed.success) {
+        const url = new URL(parsed.data);
+        return `${url.origin}${url.pathname}`;
+    }
+    return value.split(/[?#]/, 1)[0] ?? '';
+}
+async function resolveRegisteredApp(runtime, origin) {
+    const auth = await getVibesClient('auth', runtime);
+    return RegisteredAppAnswerSchema.parse(await auth.resolveRegisteredOrigin(origin));
+}
+async function rateLimiter(runtime) {
+    const limiter = runtime.hasKind('cache/rate-limiter') ? (await runtime.query('cache/rate-limiter').select())?.impl : undefined;
+    if (!limiter)
+        throw refuse('Friction reports need a rate limiter; compose a cache/rate-limiter.', 'UNAVAILABLE', 'friction-report-rate-limiter-unavailable');
+    return limiter;
+}
+async function enforceLimit(limiter, key, identifier, limit) {
+    const result = await limiter.limit({ key, identifier, limit, windowSeconds: RATE_WINDOW_SECONDS });
+    if (!result.allowed) {
+        throw refuse('Too many problem reports; try again later.', 'RATE_LIMITED', 'friction-report-rate-limited', {
+            limiter: key,
+            retryAfterSeconds: result.retryAfterSeconds ?? RATE_WINDOW_SECONDS
+        });
+    }
+}
+const RedactedTextsSchema = z.array(z.string());
+/**
+ * Redact every text field through the runtime's `security/redactor`. One
+ * call redacts the whole bundle (the built-in redactor runs a supervised
+ * child per call); if a redactor's replacement breaks the bundle's shape,
+ * each text is redacted on its own. No redactor, or one that ran nothing,
+ * refuses: a row is never marked redacted unless redaction ran.
+ */
+async function redactTexts(runtime, texts) {
+    const redactor = runtime.hasKind('security/redactor')
+        ? (await runtime.query('security/redactor').select())?.impl
+        : undefined;
+    if (!redactor)
+        throw refuse('Friction intake needs a security/redactor.', 'UNAVAILABLE', 'friction-report-redactor-unavailable');
+    const ran = (result) => {
+        if (result.redactorAvailable === false)
+            throw refuse('The security redactor is unavailable on this host.', 'UNAVAILABLE', 'friction-report-redactor-unavailable');
+        return result;
+    };
+    if (texts.length === 0)
+        return { texts: [], matches: 0 };
+    const bundled = ran(await redactor.redact(JSON.stringify(texts)));
+    const parsed = settleNow(() => RedactedTextsSchema.parse(JSON.parse(bundled.redacted)));
+    if (parsed.ok && parsed.value.length === texts.length)
+        return { texts: parsed.value, matches: bundled.matches.length };
+    const out = [];
+    let matches = 0;
+    for (const text of texts) {
+        const result = ran(await redactor.redact(text));
+        out.push(result.redacted);
+        matches += result.matches.length;
+    }
+    return { texts: out, matches };
+}
+/** Redact the free text, the URL, and every captured error; nothing else holds reporter-typed text. */
+async function redactReport(runtime, report) {
+    const texts = [report.observed, report.expected ?? '', report.repro ?? '', report.workaround ?? '', report.evidence === undefined ? '' : JSON.stringify(report.evidence)];
+    const errors = report.context?.errors ?? [];
+    if (report.context)
+        texts.push(report.context.url);
+    for (const error of errors)
+        texts.push(error.message, error.stack ?? '');
+    const { texts: out, matches } = await redactTexts(runtime, texts);
+    let cursor = 0;
+    const next = () => out[cursor++] ?? '';
+    const observed = next();
+    const expected = next();
+    const repro = next();
+    const workaround = next();
+    const evidenceText = next();
+    const evidence = report.evidence === undefined
+        ? undefined
+        : (() => {
+            // A replacement that breaks the JSON keeps the redacted text itself, never the original.
+            const reparsed = settleNow(() => JsonValueSchema.parse(JSON.parse(evidenceText)));
+            return reparsed.ok ? reparsed.value : evidenceText;
+        })();
+    const context = report.context
+        ? {
+            ...report.context,
+            url: next(),
+            errors: errors.map((error) => {
+                const message = next();
+                const stack = next();
+                return { ...error, message: message || '[REDACTED]', stack: error.stack !== undefined ? stack : undefined };
+            })
+        }
+        : undefined;
+    return {
+        report: {
+            ...report,
+            observed,
+            expected: report.expected !== undefined ? expected : undefined,
+            repro: report.repro !== undefined ? repro : undefined,
+            workaround: report.workaround !== undefined ? workaround : undefined,
+            evidence: evidence,
+            context: context
+        },
+        matches
+    };
+}
+/**
+ * `identified` when the row keeps the reporter's identity; otherwise
+ * `redacted` when the redactor removed something, else `none`.
+ */
+function personalDataLevel(identified, matches) {
+    if (identified)
+        return 'identified';
+    return matches > 0 ? 'redacted' : 'none';
+}
+function storedContext(capture, config, facts) {
+    const attachments = facts.anonymous
+        ? []
+        : capture.attachments.filter((attachment) => config.intake.screenshots || attachment.kind !== 'screenshot');
+    return {
+        ...capture,
+        url: stripUrl(capture.url),
+        errors: config.intake.errors ? capture.errors : [],
+        attachments,
+        tenancy: facts.tenancy,
+        appClientId: facts.appClientId,
+        reporterOrgId: facts.reporterOrgId
+    };
+}
+async function withFingerprint(signal) {
+    const fingerprint = await computeFrictionSignalFingerprint(signal);
+    return { ...signal, signatureHash: fingerprint.hash, fingerprint: fingerprint.fingerprint, fingerprintVersion: fingerprint.version };
+}
+async function writeAndAnnounce(runtime, deps, signal, upstreamOf) {
+    const write = deps.writeSignal ?? writeFrictionSignal;
+    const written = await write(runtime, await withFingerprint(signal));
+    // The write is durable; a failing subscriber is logged, never turned into a lost report.
+    const announced = await settle(() => emitFrictionSignalRecorded(runtime, {
+        signalId: written.id,
+        orgId: written.orgId,
+        source: written.source,
+        severity: written.severity,
+        fingerprint: written.fingerprint ?? `v1:${written.signatureHash}`,
+        occurrenceCount: written.occurrenceCount ?? 1,
+        tenancy: written.context?.tenancy,
+        upstreamOf: upstreamOf
+    }));
+    if (!announced.ok) {
+        getLogger('hq:friction', runtime).error('Friction signal-recorded event failed.', {
+            error: valueFreeFailure(CaughtFailureSchema.parse(announced.cause)),
+            signalId: written.id
+        });
+    }
+    return written;
+}
+function pointsIntoPlatform(context) {
+    return context?.errors.some((error) => PLATFORM_FRAME.test(error.stack ?? '') || PLATFORM_FRAME.test(error.message)) ?? false;
+}
+/**
+ * The Vibes copy of a report whose stack points into `@vibesdotdev/*`:
+ * redacted again, no screenshot or attachment, no reporter identity, linked
+ * back to the original. Its occurrence derives from the original's, so a
+ * retried submit stays one upstream occurrence.
+ */
+async function fileUpstreamCopy(runtime, deps, config, original, occurrence, originalMatches) {
+    if (!config.upstream.enabled)
+        return { status: 'skipped', reason: 'disabled' };
+    if (!pointsIntoPlatform(original.context))
+        return { status: 'skipped', reason: 'no-platform-frame' };
+    const upstreamOrgId = config.upstreamOrgId;
+    if (!upstreamOrgId)
+        return { status: 'skipped', reason: 'unconfigured' };
+    if (upstreamOrgId === original.orgId)
+        return { status: 'skipped', reason: 'same-org' };
+    const copied = await settle(async () => {
+        const { report, matches } = await redactReport(runtime, {
+            observed: original.observed,
+            expected: original.expected,
+            repro: original.repro,
+            workaround: original.workaround,
+            context: original.context
+        });
+        const { reporterOrgId: _reporterOrgId, attachments: _attachments, ...context } = report.context;
+        const link = { kind: 'friction-signal', ref: `${original.orgId}/${original.id}` };
+        // Vibes gets the route template, never the concrete path (it can carry tenant or user ids).
+        const pageUrl = z.url().safeParse(context.url);
+        const templateUrl = pageUrl.success ? `${new URL(pageUrl.data).origin}${context.route}` : context.route;
+        const copy = {
+            id: generateFrictionId(),
+            orgId: upstreamOrgId,
+            source: original.source,
+            audience: original.audience,
+            surface: original.surface,
+            severity: original.severity,
+            observed: report.observed,
+            expected: report.expected,
+            repro: report.repro,
+            evidenceLinks: [{ kind: 'url', ref: templateUrl }, link],
+            context: { ...context, url: templateUrl, attachments: [], tenancy: 'upstream-copy' },
+            signatureHash: 'pending',
+            personalDataLevel: personalDataLevel(false, matches + originalMatches),
+            createdAt: original.createdAt,
+            createdBy: 'upstream',
+            occurrenceId: `upstream:${original.orgId}:${occurrence}`
+        };
+        return writeAndAnnounce(runtime, deps, copy, link.ref);
+    });
+    if (copied.ok)
+        return { status: 'copied', signalId: copied.value.id };
+    const failure = valueFreeFailure(CaughtFailureSchema.parse(copied.cause));
+    // The reporter's own report is durable; the upstream copy is best effort and logged.
+    getLogger('hq:friction', runtime).error('Friction upstream copy failed.', { error: failure, signalId: original.id });
+    return { status: 'failed', reason: failure.reason ?? failure.code ?? 'upstream-copy-failed' };
+}
+function invalidBody(error) {
+    const issue = error.issues[0];
+    if (issue?.path[0] === 'evidenceLinks') {
+        return refuse(`Invalid evidenceLinks[${String(issue.path[1] ?? '')}]; allowed kinds: ${FrictionEvidenceLinkKindSchema.options.join(', ')}`, 'INVALID_INPUT', 'friction-intake-invalid');
+    }
+    return refuse(issue ? `${issue.path.join('.')}: ${issue.message}` : 'Invalid friction report', 'INVALID_INPUT', 'friction-intake-invalid');
+}
+/**
+ * Record one browser report. The route has admitted the origin through CORS;
+ * this re-derives the app and target org from that same `Origin`.
+ */
+export async function recordFrictionReport(runtime, request, deps = {}) {
+    const parsed = FrictionReportInputSchema.safeParse(request.body);
+    if (!parsed.success)
+        throw invalidBody(parsed.error);
+    const body = parsed.data;
+    const principal = requestPrincipal(runtime);
+    if (principal.kind === 'service') {
+        throw refuse('Service callers report through the internal friction intake.', 'PERMISSION_DENIED', 'friction-report-service-caller');
+    }
+    const user = principal.kind === 'user' ? principal : undefined;
+    const config = await loadHqFrictionConfig(runtime);
+    if (!user) {
+        if (!config.intake.publicOnError)
+            throw refuse('Sign in to report a problem.', 'AUTH_REQUIRED', 'friction-report-sign-in-required');
+        if (body.context.errors.length === 0) {
+            throw refuse('Signed-out visitors can report a problem only after an error.', 'PERMISSION_DENIED', 'friction-report-public-needs-error');
+        }
+    }
+    const origin = canonicalRegisteredOrigin(request.origin);
+    if (!origin)
+        throw refuse('A problem report needs its page origin.', 'INVALID_INPUT', 'friction-report-origin-missing');
+    const app = await resolveRegisteredApp(runtime, origin);
+    let tenancy;
+    let orgId;
+    if (app?.ownership === 'hidden') {
+        // An owner exists that this intake may not see: routing upstream would hand a customer's report to Vibes.
+        throw refuse('This app\'s owner is not visible to this HQ intake.', 'PERMISSION_DENIED', 'friction-report-app-owner-hidden', { clientId: app.clientId });
+    }
+    else if (app?.ownership === 'owned') {
+        orgId = app.organizationId;
+        tenancy = 'app-owner';
+    }
+    else if (app?.ownership === 'unowned') {
+        orgId = config.upstreamOrgId;
+        tenancy = 'upstream-fallback';
+    }
+    else if (runtime.scope.qualifiers?.dev === true && isLoopback(origin)) {
+        orgId = config.upstreamOrgId;
+        tenancy = 'dev-loopback';
+    }
+    else {
+        throw refuse('This origin is not a registered app.', 'PERMISSION_DENIED', 'friction-report-origin-unregistered');
+    }
+    if (!orgId) {
+        throw refuse('No org receives reports from this app; set hq.friction.upstreamOrgId.', 'UNAVAILABLE', 'friction-report-tenant-unresolved');
+    }
+    const limiter = await rateLimiter(runtime);
+    await enforceLimit(limiter, 'hq.friction.report.origin', origin, config.intake.rateLimit.perOriginPerHour);
+    if (user) {
+        await enforceLimit(limiter, 'hq.friction.report.user', user.userId, config.intake.rateLimit.signedInPerHour);
+    }
+    else {
+        const address = request.clientAddress?.trim();
+        if (!address)
+            throw refuse('A signed-out report needs the client address for rate limiting.', 'INVALID_INPUT', 'friction-report-client-address-missing');
+        await enforceLimit(limiter, 'hq.friction.report.public', sha256Hex(`hq.friction:${address}`), config.intake.rateLimit.publicPerHour);
+    }
+    const context = storedContext(body.context, config, {
+        appClientId: app?.clientId,
+        tenancy,
+        reporterOrgId: user?.orgId && user.orgId !== orgId ? user.orgId : undefined,
+        anonymous: !user
+    });
+    const { report, matches } = await redactReport(runtime, {
+        observed: body.observed,
+        expected: body.expected,
+        repro: body.repro,
+        context
+    });
+    const occurrence = body.occurrenceId ?? generateFrictionId();
+    const signal = {
+        id: generateFrictionId(),
+        orgId,
+        source: 'user-explicit',
+        audience: 'both',
+        surface: body.surface ?? context.route,
+        severity: body.severity,
+        observed: report.observed,
+        expected: report.expected,
+        repro: report.repro,
+        evidenceLinks: report.context.url ? [{ kind: 'url', ref: report.context.url }] : [],
+        context: report.context,
+        signatureHash: 'pending',
+        personalDataLevel: personalDataLevel(Boolean(user), matches),
+        createdAt: new Date().toISOString(),
+        createdBy: user?.userId ?? 'anonymous',
+        userSessionId: user?.sessionId,
+        occurrenceId: occurrence
+    };
+    const written = await writeAndAnnounce(runtime, deps, signal);
+    const upstream = await fileUpstreamCopy(runtime, deps, config, written, occurrence, matches);
+    return {
+        signal: written,
+        upstream,
+        response: FrictionReportResponseSchema.parse({
+            id: written.id,
+            severity: written.severity,
+            surface: written.surface,
+            personalDataLevel: written.personalDataLevel,
+            occurrenceCount: written.occurrenceCount ?? 1
+        })
+    };
+}
+/**
+ * Record one internal intake body for a caller the route verified (a user
+ * principal, or the internal service token). A user's org is the caller's
+ * own; a service names one or gets `hq.friction.upstreamOrgId`.
+ */
+export async function recordFrictionIntake(runtime, request, deps = {}) {
+    const parsed = FrictionIntakeInputSchema.safeParse(request.body);
+    if (!parsed.success)
+        throw invalidBody(parsed.error);
+    const body = parsed.data;
+    const { caller } = request;
+    const config = await loadHqFrictionConfig(runtime);
+    let orgId;
+    if (caller.kind === 'user') {
+        orgId = caller.orgId ?? config.upstreamOrgId;
+        if (body.orgId && body.orgId !== orgId) {
+            throw refuse('Friction organization must match the authenticated caller or the configured intake organization.', 'PERMISSION_DENIED', 'friction-intake-org-mismatch');
+        }
+    }
+    else {
+        orgId = body.orgId ?? config.upstreamOrgId;
+    }
+    if (!orgId)
+        throw refuse('orgId is required', 'INVALID_INPUT', 'friction-intake-org-required');
+    const userId = caller.kind === 'user' ? caller.userId : caller.onBehalfOf?.trim() || undefined;
+    const createdBy = userId ?? body.createdBy ?? 'marshal-cloud';
+    const evidenceLinks = [...body.evidenceLinks];
+    if (body.page)
+        evidenceLinks.push({ kind: 'url', ref: stripUrl(body.page) });
+    const context = body.context
+        ? storedContext(body.context, config, { tenancy: 'caller', anonymous: false })
+        : undefined;
+    const { report, matches } = await redactReport(runtime, {
+        observed: body.observed,
+        expected: body.expected,
+        repro: body.repro,
+        workaround: body.workaround,
+        evidence: body.evidence,
+        context: context
+    });
+    const signal = {
+        id: generateFrictionId(),
+        orgId,
+        source: body.source,
+        audience: body.audience,
+        surface: body.surface,
+        severity: body.severity,
+        observed: report.observed,
+        expected: report.expected,
+        repro: report.repro,
+        workaround: report.workaround,
+        evidenceLinks,
+        evidence: report.evidence,
+        context: report.context,
+        signatureHash: 'pending',
+        personalDataLevel: personalDataLevel(userId !== undefined, matches),
+        createdAt: new Date().toISOString(),
+        createdBy,
+        agentRunId: body.agentRunId,
+        userSessionId: body.userSessionId,
+        occurrenceId: body.occurrenceId ?? body.agentRunId ?? body.userSessionId
+    };
+    const written = await writeAndAnnounce(runtime, deps, signal);
+    await fileUpstreamCopy(runtime, deps, config, written, signal.occurrenceId ?? written.id, matches);
+    return FrictionIntakeResponseSchema.parse(written);
+}
+//# sourceMappingURL=intake.js.map

package/dist/friction/intake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake.js","sourceRoot":"","sources":["../../src/friction/intake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,MAAM,EACN,SAAS,EACT,gBAAgB,EAIhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAsB,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,eAAe,EAAkB,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAG1G,OAAO,EAAE,oBAAoB,EAAyB,MAAM,4CAA4C,CAAC;AACzG,OAAO,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EACN,8BAA8B,EAI9B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACN,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAG5B,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;AA0CjE,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,SAAS,MAAM,CAAC,OAAe,EAAE,IAAsD,EAAE,MAAc,EAAE,OAAgC;IACxI,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,KAAK,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,uFAAuF;AACvF,SAAS,gBAAgB,CAAC,OAAmB;IAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,iBAAiB,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACzF,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC;IACzC,IAAI,SAAS,CAAC,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,qBAAqB;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC7J,MAAM,SAAS,CAAC,KAAK,CAAC;AACvB,CAAC;AAGD,SAAS,UAAU,CAAC,MAAc;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IACtC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACxG,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,MAAM,cAAc,CAA4B,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,yBAAyB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;AACpF,CAAC;AAMD,KAAK,UAAU,WAAW,CAAC,OAAmB;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAqB,oBAAoB,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnJ,IAAI,CAAC,OAAO;QAAE,MAAM,MAAM,CAAC,qEAAqE,EAAE,aAAa,EAAE,0CAA0C,CAAC,CAAC;IAC7J,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAoB,EAAE,GAAW,EAAE,UAAkB,EAAE,KAAa;IAC/F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,4CAA4C,EAAE,cAAc,EAAE,8BAA8B,EAAE;YAC1G,OAAO,EAAE,GAAG;YACZ,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,mBAAmB;SAClE,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,OAAmB,EAAE,KAAwB;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACpD,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAiC,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI;QAC3F,CAAC,CAAC,SAAS,CAAC;IACb,IAAI,CAAC,QAAQ;QAAE,MAAM,MAAM,CAAC,4CAA4C,EAAE,aAAa,EAAE,sCAAsC,CAAC,CAAC;IACjI,MAAM,GAAG,GAAG,CAAC,MAA8D,EAAE,EAAE;QAC9E,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK;YAAE,MAAM,MAAM,CAAC,oDAAoD,EAAE,aAAa,EAAE,sCAAsC,CAAC,CAAC;QAClK,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACvH,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAWD,uGAAuG;AACvG,KAAK,UAAU,YAAY,CAA6B,OAAmB,EAAE,MAAS;IACrF,MAAM,KAAK,GAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpL,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;IACrB,MAAM,UAAU,GAAG,IAAI,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,IAAI,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,GAAG,EAAE;YACP,yFAAyF;YACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAClF,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO;QAC7B,CAAC,CAAC;YACD,GAAG,MAAM,CAAC,OAAO;YACjB,GAAG,EAAE,IAAI,EAAE;YACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC5B,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAC7G,CAAC,CAAC;SACF;QACD,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,MAAM,EAAE;YACP,GAAG,MAAM;YACT,QAAQ;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAC9D,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACrD,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACpE,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,OAAO;SAChB;QACD,OAAO;KACP,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,UAAmB,EAAE,OAAe;IAC9D,IAAI,UAAU;QAAE,OAAO,YAAY,CAAC;IACpC,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CACrB,OAA8B,EAC9B,MAAwB,EACxB,KAA2G;IAE3G,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS;QAClC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAC7G,OAAO;QACN,GAAG,OAAO;QACV,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;QACX,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;KAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,WAAW,GAAG,MAAM,gCAAgC,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;AACtI,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,IAAwB,EACxB,MAAsB,EACtB,UAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,yFAAyF;IACzF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,OAAO,EAAE;QACxE,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM,OAAO,CAAC,aAAa,EAAE;QACjE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO;QACjC,UAAU,EAAE,UAAU;KACtB,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,wCAAwC,EAAE;YACjF,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnE,QAAQ,EAAE,OAAO,CAAC,EAAE;SACpB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0C;IACrE,OAAO,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC;AAC/H,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC9B,OAAmB,EACnB,IAAwB,EACxB,MAAwB,EACxB,QAAwB,EACxB,UAAkB,EAClB,eAAuB;IAEvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/E,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrG,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzE,IAAI,aAAa,KAAK,QAAQ,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACtC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;YACvD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,OAAQ,CAAC;QACjG,MAAM,IAAI,GAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;QACxG,4FAA4F;QAC5F,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACxG,MAAM,IAAI,GAAmB;YAC5B,EAAE,EAAE,kBAAkB,EAAE;YACxB,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC;YACxD,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;YACpF,aAAa,EAAE,SAAS;YACxB,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAAC;YACtE,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,UAAU;YACrB,YAAY,EAAE,YAAY,QAAQ,CAAC,KAAK,IAAI,UAAU,EAAE;SACxD,CAAC;QACF,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,qFAAqF;IACrF,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACrH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,MAAM,CACZ,yBAAyB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,qBAAqB,8BAA8B,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5H,eAAe,EACf,yBAAyB,CACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,yBAAyB,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAC;AAC5I,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAmB,EACnB,OAA8B,EAC9B,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,8DAA8D,EAAE,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;YAAE,MAAM,MAAM,CAAC,8BAA8B,EAAE,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACpI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,CAAC,+DAA+D,EAAE,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;QAC1I,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,MAAM,MAAM,CAAC,yCAAyC,EAAE,eAAe,EAAE,gCAAgC,CAAC,CAAC;IACxH,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,OAA8B,CAAC;IACnC,IAAI,KAAyB,CAAC;IAC9B,IAAI,GAAG,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjC,0GAA0G;QAC1G,MAAM,MAAM,CAAC,qDAAqD,EAAE,mBAAmB,EAAE,kCAAkC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1J,CAAC;SAAM,IAAI,GAAG,EAAE,SAAS,KAAK,OAAO,EAAE,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC;QAC3B,OAAO,GAAG,WAAW,CAAC;IACvB,CAAC;SAAM,IAAI,GAAG,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QACzC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7B,OAAO,GAAG,mBAAmB,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7B,OAAO,GAAG,cAAc,CAAC;IAC1B,CAAC;SAAM,CAAC;QACP,MAAM,MAAM,CAAC,sCAAsC,EAAE,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,uEAAuE,EAAE,aAAa,EAAE,mCAAmC,CAAC,CAAC;IAC3I,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3G,IAAI,IAAI,EAAE,CAAC;QACV,MAAM,YAAY,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACP,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,iEAAiE,EAAE,eAAe,EAAE,wCAAwC,CAAC,CAAC;QACzJ,MAAM,YAAY,CAAC,OAAO,EAAE,2BAA2B,EAAE,SAAS,CAAC,eAAe,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACtI,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE;QACnD,WAAW,EAAE,GAAG,EAAE,QAAQ;QAC1B,OAAO;QACP,aAAa,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC3E,SAAS,EAAE,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;QACvD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO;KACP,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAmB;QAC9B,EAAE,EAAE,kBAAkB,EAAE;QACxB,KAAK;QACL,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK;QACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,aAAa,EAAE,MAAM,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,OAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QACrF,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,SAAS;QACxB,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAC5D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,EAAE,MAAM,IAAI,WAAW;QACtC,aAAa,EAAE,IAAI,EAAE,SAAS;QAC9B,YAAY,EAAE,UAAU;KACxB,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO;QACN,MAAM,EAAE,OAAO;QACf,QAAQ;QACR,QAAQ,EAAE,4BAA4B,CAAC,KAAK,CAAC;YAC5C,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;SAC7C,CAAC;KACF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAmB,EACnB,OAA8B,EAC9B,OAA2B,EAAE;IAE7B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,aAAa,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,MAAM,CAAC,kGAAkG,EAAE,mBAAmB,EAAE,8BAA8B,CAAC,CAAC;QACvK,CAAC;IACF,CAAC;SAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,aAAa,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAE/F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC/F,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;IAC9D,MAAM,aAAa,GAA2B,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI;QAAE,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;QAC3B,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;QACvD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,OAAO;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAmB;QAC9B,EAAE,EAAE,kBAAkB,EAAE;QACxB,KAAK;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,SAAS;QACxB,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,CAAC;QACnE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa;KACxE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnG,OAAO,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC"}