@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts

@@ -16,6 +16,55 @@ import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes
 import { QueueBackendService } from '../../../queue/queue.backend.service';
 import { type SecurityAuditEventEnvelope, type AuditableEvent, type SiemExportConfigBase, AuthScopeType } from '@wildo-ai/saas-models';
 import type { ExecutionContext } from '../../../runtime/models/execution-context.backend.schemas';
+import type { RedisService } from '../../../databases/services/redis.service';
+/**
+ * **A SIEM export configuration change takes effect on EVERY replica within 60 seconds — and within
+ * milliseconds when the change goes through the engine.**
+ *
+ * That sentence is the guarantee this subsystem makes, and the two halves come from two different
+ * mechanisms, so read both before changing either.
+ *
+ * ## Why the number is 60 seconds, and why it used to be 300
+ *
+ * The lease is the ONLY thing that covers a write no hook can see — a repository-tier write, or a
+ * direct database write. There is a live one: `examples/wonder-todos/e2e/adapter.ts` (`case 'siem'`)
+ * repoints an organization's export config with `upsertOrganizationSingleton(...)`, straight at the
+ * store, bypassing the engine entirely. Its own comment records what the old 300 s cost — *"A freshly
+ * provisioned org has a cold 5-min config cache, so the first login cold-reads this"* — i.e. the lane
+ * is correct only because it is ORDERED to run before the organization's first audited action. A
+ * five-minute convergence bound is not something a scenario, or an operator doing surgery, can wait
+ * for; it is something they have to design around. Sixty seconds is something they can wait for.
+ *
+ * The old 300 s was never chosen for that job — it was chosen to bound READ AMPLIFICATION, because a
+ * miss costs more than a repository read: `AuthOrganizationConfigurationService.loadSiemExportConfig`
+ * reads through `readAsSystem`, which emits its own `system_context_read` audit row to the database
+ * AND to immudb. So shortening the lease multiplies audit-trail plumbing noise, not just queries.
+ * Two properties make 60 s affordable anyway:
+ *
+ * - **Refreshes are LAZY and STALE-WHILE-REVALIDATE** ({@link LeasedValueCache}). A quiet organization
+ *   costs one read per event, not one per minute; only a continuously busy one reaches the ceiling of
+ *   one read per lease per replica. At 60 s that ceiling is 60 reads/hour/replica per ACTIVE
+ *   organization — for an organization emitting 1000 audit events an hour, under 5 % amplification of
+ *   its own audit volume, against 12/hour before.
+ * - **Nothing blocks on it.** Past the lease the cached value is served immediately and the re-read
+ *   runs off the emission path, so shortening it costs read volume and never latency.
+ *
+ * ## The other half: the engine-routed write converges in milliseconds
+ *
+ * {@link AuditEventDispatcherBackendService.invalidateSiemConfig} drops the local entry AND publishes
+ * the organization id on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}, which every replica
+ * subscribes to. Before that broadcast the invalidation reached exactly ONE process — the one that
+ * happened to handle the write — and every other replica served the stale value for the rest of the
+ * lease, which is the defect this constant's neighbours document.
+ *
+ * **Do not raise this back toward the read-amplification number.** If the amplification ever needs to
+ * come down, the right lever is the `system_context_read` row on the config read itself:
+ * `SystemAccessBackendService.readAsSystem` already takes `suppressSystemAudit`, and its own JSDoc
+ * names this exact read — *"the audit pipeline resolving … an org's SIEM config to ROUTE an audit
+ * event"* — as the case it exists for. `loadSiemExportConfig` is the one such reader that does not
+ * pass it. Fixing that makes a miss cost a single indexed read and removes the constraint entirely.
+ */
+export declare const SIEM_CONFIG_REFRESH_AFTER_MS: number;
 /**
  * The per-org audit sink TYPES an organization can route its authenticated audit
  * events to. Today the only type is the SIEM webhook. Adding a per-org destination
@@ -33,12 +82,48 @@ export declare class AuditEventDispatcherBackendService {
     private readonly orgConfigService;
     private readonly queueService;
     private readonly repositoriesRegistry;
+    /**
+     * `@optional()` and APPENDED LAST — the constructor-parameter discipline.
+     *
+     * Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a
+     * precondition for routing: a container with no Redis binding (several partial test containers, and
+     * any single-replica deployment) must still dispatch audit events, converging on the lease alone.
+     * Appended last so the five existing construction sites keep compiling unchanged.
+     */
+    private readonly redisService?;
     private readonly logDebug;
-    /** F3: Lightweight org name cache to avoid per-event DB lookups */
+    /**
+     * F3: org NAME cache — a display label on the envelope. See {@link ORG_NAME_REFRESH_AFTER_MS}.
+     *
+     * No `onRefreshFailure`, and it would be dead code if there were one: {@link _resolveOrgName}'s loader
+     * swallows its own error and yields `undefined`, so nothing this cache runs can ever reject. That
+     * swallow is what makes the negative result CACHEABLE, which is the amplification fix described there;
+     * the price is that a persistently unreadable organization row is silent, which is the right trade for
+     * an optional label whose authoritative sibling (`organizationId`) is on the envelope regardless.
+     */
     private readonly _orgNameCache;
-    /** R2: per-org SIEM-config cache — avoids a per-event per-org audited `readAsSystem` config load. */
+    /** R2: per-org SIEM-config cache — the value that decides ROUTING. See {@link SIEM_CONFIG_REFRESH_AFTER_MS}. */
     private readonly _siemConfigCache;
-    constructor(logger: LoggerService, appConfigService: AppConfigurationService, orgConfigService: AuthOrganizationConfigurationService, queueService: QueueBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService);
+    /**
+     * Latch so {@link _ensureInvalidationSubscriber} is idempotent; cleared on `end` so a dropped
+     * subscriber re-arms.
+     *
+     * Deliberately the ONLY subscriber state kept. `A2ATaskCancellationBackendService` also holds the
+     * client itself, because it has a shutdown path that closes it; this service has none, and a field
+     * nothing reads is a field the next reader has to reason about for nothing. The socket keeps the
+     * subscriber alive on its own, and a connection that emitted `end` is already closed.
+     */
+    private _invalidationSubscribeStarted;
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, orgConfigService: AuthOrganizationConfigurationService, queueService: QueueBackendService, repositoriesRegistry: RepositoriesRegistryHandlerBackendService, 
+    /**
+     * `@optional()` and APPENDED LAST — the constructor-parameter discipline.
+     *
+     * Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a
+     * precondition for routing: a container with no Redis binding (several partial test containers, and
+     * any single-replica deployment) must still dispatch audit events, converging on the lease alone.
+     * Appended last so the five existing construction sites keep compiling unchanged.
+     */
+    redisService?: RedisService);
     /**
      * Dispatch an audit event to the organization's configured per-org audit SINKS.
      *
@@ -104,15 +189,110 @@ export declare class AuditEventDispatcherBackendService {
      */
     private _resolveOrgAuditSinks;
     /**
-     * R2: load the org's SIEM config through a short-TTL cache. Without it,
-     * {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem` PER
-     * EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every
-     * routed audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to
-     * the DB + immudb. Mirrors {@link _orgNameCache}: an enable/disable/rename takes effect within
-     * the TTL, acceptable for a rarely-changed config. `null` is cached too (an org with no SIEM
-     * config) so a non-configured org is not re-read every event.
+     * R2: load the org's SIEM config through the leased cache.
+     *
+     * Without a cache, {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem`
+     * PER EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every routed
+     * audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to the DB + immudb.
+     * `null` is cached too (an org whose config load failed) so a non-configured org is not re-read every
+     * event.
+     *
+     * The cache is STALE-WHILE-REVALIDATE ({@link LeasedValueCache}), so only the very first event for an
+     * organization waits on a read; every later one is served from memory while the refresh runs off this
+     * path. That is what lets {@link SIEM_CONFIG_REFRESH_AFTER_MS} be sixty seconds rather than five
+     * minutes — read the guarantee stated there before changing it.
+     *
+     * The loader closes over `ec`, which is the audit service's synthesised super-admin APPLICATION-scoped
+     * temp context (`audit-logs.backend.service.ts:284`, handed here at `:349`) and is therefore equally
+     * privileged on every call — the precondition {@link LeasedValueCache} states for joining an in-flight
+     * load. `loadSiemExportConfig` in fact ignores `ec` entirely (`void ec`) and reads system-context.
      */
     private _loadSiemConfigCached;
+    /**
+     * Drop one organization's cached SIEM config so the NEXT event re-reads it.
+     *
+     * ## Why this exists
+     *
+     * Without it the cache had no invalidation at all — only the 5-minute TTL and the size-1000
+     * FIFO — so enabling a sink left the organization's events unrouted for up to that window, and
+     * audit events are not replayed. The ENABLE direction is the sharp one: `null` is cached
+     * deliberately (see {@link _loadSiemConfigCached}) and `null` is exactly the state an
+     * organization is in the moment before it first configures a sink, so the first five minutes of
+     * a newly-pointed SIEM were silently empty.
+     *
+     * ## Where it is called from, and why not from the config service
+     *
+     * From a postfix hook on the SIEM-export-config RESOURCE
+     * (`siem-export-config-cache-invalidation.custom-impl.backend.service.ts`), not from
+     * `AuthOrganizationConfigurationService.saveSiemExportConfig`.
+     *
+     * That service was the obvious call site and it is the WRONG one: it is only one of the writers.
+     * The config is an ordinary resource, so an update also lands through
+     * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the
+     * service would have applied the invariant at one of two call sites, which is the defect shape
+     * `.claude/rules/invariant-call-site-enumeration.md` exists to stop. The resource operation is
+     * the chokepoint BOTH writers pass through — `saveSiemExportConfig` itself dispatches its write
+     * via `ServicesRegistryHandler`, so covering the resource covers it for free.
+     *
+     * Note `saveSiemExportConfig` separately refreshes its OWN `siemExportConfigs` map. That is a
+     * different cache in a different service and was never the one deciding routing.
+     *
+     * ## Semantics
+     *
+     * Deleting the entry rather than overwriting it: the next read goes to the repository, so this
+     * cannot install a wrong value, only force a re-read. Idempotent, and a no-op for an
+     * organization with no entry — which is the common case, since only organizations that have
+     * raised an audit event since the last eviction are in the map at all. Synchronous and
+     * infallible on purpose, so the caller needs no error handling.
+     *
+     * ## It reaches EVERY replica, which it did not before
+     *
+     * The local drop above is only ever correct for ONE process — the one that happened to handle the
+     * write. With N replicas behind a load balancer, the other N-1 went on serving the pre-write config
+     * for the rest of the lease, so "the invalidation covers engine-routed writes" was true of a single
+     * instance and false of every real deployment. The broadcast closes that: the organization id goes
+     * out on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX} and every replica's subscriber drops its own
+     * entry within milliseconds.
+     *
+     * The publish is fire-and-forget and cannot fail this call: a broadcast that does not go out degrades
+     * the OTHER replicas to the lease, which is exactly where they were before, and refusing a
+     * configuration write to protect a cache would invert the priority. This method's synchronous,
+     * infallible contract therefore still holds for its caller.
+     *
+     * **What it still does NOT cover, and cannot.** A write that never reaches the service tier — a
+     * repository-tier write, or a direct database write like `examples/wonder-todos/e2e/adapter.ts`'s
+     * `upsertOrganizationSingleton('organizationSiemExportConfig', …)` — raises no postfix hook, so
+     * nothing calls this and nothing is broadcast. For those the lease is the entire guarantee; that is
+     * why it is chosen and argued at {@link SIEM_CONFIG_REFRESH_AFTER_MS} rather than left incidental.
+     */
+    invalidateSiemConfig(organizationId: string): void;
+    /**
+     * Tell the rest of the fleet to drop this organization's cached SIEM config.
+     *
+     * Returns nothing and awaits nothing — the caller is a postfix write hook whose contract is that it
+     * cannot fail the write it follows.
+     */
+    private _publishSiemConfigInvalidation;
+    /** App-prefixed so two applications sharing one Redis never invalidate each other's caches. */
+    private _invalidationChannel;
+    /**
+     * Arm this replica's single subscriber to the invalidation channel. Idempotent.
+     *
+     * Called (never awaited) from {@link dispatchToOrganizationAuditSinks}, so no startup ordering is
+     * required and nothing has to be wired in `start-application` — the same lazy-arm pattern
+     * `A2ATaskCancellationBackendService.ensureSubscriber` uses, for the same reason.
+     *
+     * Fails OPEN by design: a replica that cannot subscribe still routes audit events, converging on the
+     * lease instead of on the broadcast. The failure is logged at ERROR because a persistent one silently
+     * returns that replica to the per-process behaviour this mechanism exists to remove.
+     *
+     * Two details are copied deliberately rather than reinvented, because each was a recorded defect in
+     * the A2A original: the `end` handler RE-ARMS (a subscriber that connected and then dropped — a Redis
+     * restart, a failover, an idle reap — otherwise stayed dead for the life of the process while every
+     * other signal looked healthy), and the catch DESTROYS a half-built connection (`connect()` can
+     * succeed while `subscribe()` throws, and retrying without destroying leaks one socket per attempt).
+     */
+    private _ensureInvalidationSubscriber;
     /**
      * Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,
      * build + HMAC the envelope, and enqueue for async delivery via the SIEM webhook
@@ -168,14 +348,84 @@ export declare class AuditEventDispatcherBackendService {
      * Build a SecurityAuditEventEnvelope from an audit event.
      */
     private _buildEnvelope;
+    /**
+     * The id the DELIVERED envelope carries — the audit row's OWN `eventId`, never a freshly minted one.
+     *
+     * ## Why it must be the audit event's id
+     *
+     * `SecurityAuditEventEnvelope.eventId` is the only identifier that leaves the application on a SIEM
+     * delivery, and it is doing two jobs at once:
+     *
+     *  1. it is what a RECEIVER deduplicates on — the delivery service's own header says "Idempotency via
+     *     eventId", and every wire format carries this one field through to the receiver's dedup key
+     *     (CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured` body's
+     *     top-level `eventId`); and
+     *  2. it is the only handle an analyst has for joining a record in the customer's SIEM back to the
+     *     audit row it was projected from.
+     *
+     * Minting a fresh uuid here satisfied (1) and silently destroyed (2). The id was ALREADY on the value
+     * being projected: `AuditableEvent.eventId` is minted in `AuditLogsBackendService._createAuditLog`
+     * BEFORE the DB write, is documented on the schema as the "store-agnostic, server-minted correlation
+     * key", and already joins the DB row to its immudb record and to `verifyAuditEvent(eventId)`. It
+     * survives the `Omit` on this method's parameter type, so it was in hand and thrown away — the
+     * envelope replaced it with an id that exists nowhere else in the system, making a delivered SIEM
+     * event deduplicable but unexplainable.
+     *
+     * ## Why the cutover is safe — the risk this looks like it carries, it does not
+     *
+     * Changing what a receiver deduplicates on normally risks re-accepting events at the switch. Not here:
+     * the OLD value was a per-delivery random uuid, never reused and not re-derivable from anything, so
+     * every id crossing the cutover is still one no receiver has ever seen. Nothing is re-delivered and
+     * nothing is newly deduped away.
+     *
+     * What genuinely changes is the FAN-OUT. `AuditLogsBackendService` dispatches one audit event to each
+     * of the user's verified member orgs, so those N deliveries now carry ONE id instead of N. They go to
+     * N different tenants' sinks, so there is no cross-receiver dedup interaction — and one id is the
+     * truthful statement, because it is one event. (The DLQ row records this id too, so a dead letter is
+     * now joinable to its audit row as well; `SiemDeliveryDlqBaseSchema.eventId` carries no unique index,
+     * so the shared id cannot collide there.)
+     *
+     * Per-attempt idempotency is untouched: the envelope is built ONCE, and both the in-process retry loop
+     * in `SIEMWebhookDeliveryBackendService.processDelivery` and the DLQ drain re-send that same stored
+     * object — so one delivery keeps one id across every attempt, which is exactly what a receiver's dedup
+     * needs.
+     *
+     * ## The fallback, and why it is not a hedge
+     *
+     * `eventId` is required on `AuditableEvent` and the sole production caller always sets it, so this
+     * branch should be unreachable. It exists because the two failures are ASYMMETRIC: an absent id is not
+     * merely an unjoinable delivery, it is a delivery with NO dedup key at all — every projection renders
+     * the field only `if (e.eventId)`, so the receiver stores `dedupKey: null` and answers `deduped: false`
+     * forever against a service that retries and drains a DLQ. Losing the join degrades an investigation;
+     * losing idempotency duplicates events inside a customer's SIEM. So an absent id still gets a minted
+     * one, and is logged loudly rather than shipping a blank.
+     */
+    private _resolveEnvelopeEventId;
     /**
      * Infer success/failure outcome from event type.
      */
     private _inferOutcome;
     /**
-     * F3: Resolve organization name with a lightweight in-memory cache.
-     * Cache entries expire after ORG_NAME_CACHE_TTL_MS to pick up renames.
-     * Returns undefined if lookup fails (fire-and-forget context — don't throw).
+     * F3: resolve an organization NAME for SIEM-analyst readability, through the leased cache.
+     *
+     * Renames are picked up within {@link ORG_NAME_REFRESH_AFTER_MS} — read that constant for why this
+     * lease is five minutes while the routing config's is sixty seconds. There is no invalidation hook on
+     * this one, deliberately: a stale label costs a reader nothing (the `organizationId` beside it in the
+     * envelope is authoritative and always current), so the lease alone is a proportionate answer.
+     *
+     * Never throws — a missing name is optional in the envelope, and this runs on a fire-and-forget path.
+     * The loader therefore swallows its own failure and yields `undefined`, which means the COLD path of
+     * {@link LeasedValueCache} can never reject here.
+     *
+     * **`undefined` IS cached, and that is a fix rather than an oversight.** Before this, a lookup that
+     * failed or returned a nameless row cached nothing, so an organization whose read kept failing was
+     * re-read on EVERY exported event — the read amplification a cache exists to prevent, arriving
+     * precisely when the repository is already unhealthy. Caching the negative bounds it to one read per
+     * lease, and a rename or a repaired read still lands within that lease.
+     *
+     * The loader closes over `ec` — the audit service's synthesised super-admin APPLICATION-scoped temp
+     * context (`audit-logs.backend.service.ts:284` → `:349`), identical in privilege on every dispatch —
+     * which is the precondition {@link LeasedValueCache} states for joining an in-flight load.
      */
     private _resolveOrgName;
     /**

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-event-dispatcher.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAErF,OAAO,EAKL,KAAK,0BAA0B,EAG/B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAoB5G;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;CAEtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAYjG,qBACa,kCAAkC;IASR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAZtG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyD;IACvF,qGAAqG;IACrG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgF;gBAG3D,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACvE,YAAY,EAAE,mBAAmB,EAClB,oBAAoB,EAAE,yCAAyC;IAMjJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACU,gCAAgC,CAC3C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC,EACnE,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IAgDhB;;;;;;;;;;;;OAYG;YACW,qBAAqB;IAgBnC;;;;;;;;OAQG;YACW,qBAAqB;IAmBnC;;;;;;OAMG;YACW,sBAAsB;IAyCpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,0BAA0B,CAAC,MAAM,EAAE;QAC9C,QAAQ,EAAE,0BAA0B,CAAC;QACrC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,oBAAoB,CAAC;QACjC,SAAS,CAAC,EAAE,aAAa,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCjB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6B1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+CtB;;OAEG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;YACW,eAAe;IAiC7B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACH,OAAO,CAAC,WAAW;IAMnB;;;OAGG;IACI,kBAAkB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;CAQ/F"}
+{"version":3,"file":"audit-event-dispatcher.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,kBAAkB,CAAC;AAM1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAIrF,OAAO,EAKL,KAAK,0BAA0B,EAG/B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,aAAa,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAKxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,4BAA4B,QAAY,CAAC;AAoCtD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB;;CAEtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAYjG,qBACa,kCAAkC;IA6CR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY;IACd,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACpG;;;;;;;OAOG;IACkD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAzDrF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAG3B;IAEH,gHAAgH;IAChH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAa9B;IAEH;;;;;;;;OAQG;IACH,OAAO,CAAC,6BAA6B,CAAS;gBAGQ,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACvE,YAAY,EAAE,mBAAmB,EAClB,oBAAoB,EAAE,yCAAyC;IAC/I;;;;;;;OAOG;IACmE,YAAY,CAAC,EAAE,YAAY;IAMnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACU,gCAAgC,CAC3C,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC,EACnE,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC;IAsDhB;;;;;;;;;;;;OAYG;YACW,qBAAqB;IAgBnC;;;;;;;;;;;;;;;;;;OAkBG;YACW,qBAAqB;IASnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACI,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAKzD;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAkBtC,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB;IAI5B;;;;;;;;;;;;;;;;OAgBG;YACW,6BAA6B;IA6C3C;;;;;;OAMG;YACW,sBAAsB;IAyCpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,0BAA0B,CAAC,MAAM,EAAE;QAC9C,QAAQ,EAAE,0BAA0B,CAAC;QACrC,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,oBAAoB,CAAC;QACjC,SAAS,CAAC,EAAE,aAAa,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCjB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6B1B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+CtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,eAAe;IAiB7B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACH,OAAO,CAAC,WAAW;IAMnB;;;OAGG;IACI,kBAAkB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;CAQ/F"}