cursedbelt 2.8.0 → 3.0.0

package/dist/server/search/pgSearchProvider.pg.test.js

@@ -1,339 +0,0 @@
-// search-writer-allow-file: schema-lifecycle suite — it DROPs and rebuilds the saas
-// search schema per run and TRUNCATEs between tests, because the schema and its RLS
-// policy ARE the subject here. No statement below writes an index row outside the
-// provider.
-/**
- * The saas search tier against a REAL Postgres (04 §3).
- *
- * Everything this provider claims is a claim about Postgres, not about
- * TypeScript: that a `GENERATED ALWAYS AS … STORED` tsvector stays in step
- * through an `ON CONFLICT DO UPDATE`, that `websearch_to_tsquery` cannot be made
- * to raise on user input, that `ts_rank` with the 4× title weighting orders a
- * corpus the way the SQLite side does, that `FORCE ROW LEVEL SECURITY` binds the
- * owning role, and that `bytea` round-trips an embedding bit-for-bit. A fake
- * pool can prove the plumbing and nothing else — it would be answering those
- * questions with our own assumptions, which is how the previous arc shipped a
- * search tier that had never run.
- *
- *   bun run test:pg          (starts a disposable container, runs, tears down)
- *   CC_PG_URL=postgres://…   (or point it at any throwaway database)
- *
- * SKIPPED, loudly, when `CC_PG_URL` is absent — the skip is a missing proof,
- * never a passing one. It runs nightly (`.github/workflows/nightly.yml`).
- */
-import { SQL } from 'bun';
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
-import { createPgSearchProvider } from './pgSearchProvider';
-import { ensureSaasSearchSchema } from './pgSearchSchema';
-const ADMIN_URL = process.env.CC_PG_URL;
-/**
- * A dedicated NON-SUPERUSER owner, and the reason is the finding this suite
- * produced.
- *
- * Connecting as the container's default `postgres` role, the RLS test passed
- * with BOTH tenants' rows: a **superuser bypasses row-level security
- * unconditionally**, and `FORCE ROW LEVEL SECURITY` does not change that — FORCE
- * subjects the table's OWNER to its policy, not a superuser. So the whole
- * isolation guarantee is invisible to a suite that connects as one, and it would
- * be equally invisible in a deployment whose application connects as one. This
- * suite therefore runs as the shape a deployment should have (a non-superuser
- * role that owns its own schema), which makes the policy load-bearing here
- * rather than decorative.
- */
-const ROLE = 'cc_search_rls';
-const PASSWORD = 'cc_search_rls_pw';
-const DATABASE = 'cc_search_rls_db';
-const appUrl = () => {
-    const admin = new URL(ADMIN_URL);
-    admin.username = ROLE;
-    admin.password = PASSWORD;
-    admin.pathname = `/${DATABASE}`;
-    return admin.toString();
-};
-let sql;
-let pool;
-const TENANT = 't_saas';
-const OTHER = 't_other';
-const CORPUS = 'knowledge';
-const MODEL = 'vocab-v1';
-/** Deterministic token-count embedder — see the local provider's suite for why. */
-const VOCAB = ['canine', 'puppy', 'feline', 'kitten', 'ledger', 'invoice'];
-const embed = async (text) => {
-    const lower = text.toLowerCase();
-    return Float32Array.from(VOCAB.map((word) => lower.split(word).length - 1));
-};
-const doc = (id, title, body, tenantId = TENANT) => ({
-    corpus: CORPUS,
-    id,
-    tenantId,
-    title,
-    body,
-});
-// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
-describe.skipIf(!ADMIN_URL)('createPgSearchProvider against a real Postgres (04 §3)', () => {
-    // 120s for the same reason the control-plane suite gives: this hook drops and
-    // rebuilds a whole role, database and schema, and on a shared CI runner a 5s
-    // default times out mid-migration and reports the failure as though the SQL
-    // were wrong.
-    beforeAll(async () => {
-        const admin = new SQL(ADMIN_URL);
-        await admin.unsafe(`DROP DATABASE IF EXISTS ${DATABASE}`);
-        await admin.unsafe(`DROP ROLE IF EXISTS ${ROLE}`);
-        await admin.unsafe(`CREATE ROLE ${ROLE} LOGIN PASSWORD '${PASSWORD}' NOSUPERUSER NOBYPASSRLS`);
-        await admin.unsafe(`CREATE DATABASE ${DATABASE} OWNER ${ROLE}`);
-        await admin.close();
-        // `max: 1` is load-bearing, not tuning. The provider issues
-        // BEGIN / set_config / … / COMMIT, and a driver free to move the next
-        // statement onto a different physical connection would scope one connection
-        // and query another — which is the exact bug the transaction-local setting
-        // exists to prevent, arriving from the test harness instead of the code.
-        sql = new SQL(appUrl(), { max: 1 });
-        const connection = {
-            async query(text, params = []) {
-                return (await sql.unsafe(text, [...params]));
-            },
-            async execute(text, params = []) {
-                const result = await sql.unsafe(text, [...params]);
-                return { rowCount: result.count ?? 0 };
-            },
-        };
-        pool = {
-            async withConnection(fn) {
-                return await fn(connection);
-            },
-        };
-        await sql.unsafe('DROP TABLE IF EXISTS search_chunks');
-        await sql.unsafe('DROP TABLE IF EXISTS search_docs');
-        await ensureSaasSearchSchema(pool);
-    }, 120_000);
-    afterAll(async () => {
-        await sql?.end();
-    });
-    beforeEach(async () => {
-        // TRUNCATE, not DELETE — and the difference is the whole point of running as
-        // a non-superuser. A `DELETE` issued outside a tenant scope is checked
-        // against the policy, matches nothing, and SILENTLY LEAVES EVERY ROW, so
-        // state leaks from test to test and the failures read as ranking bugs.
-        // TRUNCATE requires ownership rather than a policy match, so it is the one
-        // cleanup that is honest under FORCE RLS.
-        await sql.unsafe('TRUNCATE search_chunks, search_docs RESTART IDENTITY');
-    });
-    const keywordOnly = () => createPgSearchProvider({ pool });
-    const hybrid = () => createPgSearchProvider({ pool, embed, embedModel: MODEL });
-    describe('schema', () => {
-        it('creates itself idempotently — a second deployment run is not a hard failure', async () => {
-            // `CREATE POLICY` has no `IF NOT EXISTS`, so this is the assertion that the
-            // skip-if-present path works rather than throwing 42710.
-            await ensureSaasSearchSchema(pool);
-            const policies = (await sql.unsafe("SELECT policyname FROM pg_policies WHERE tablename = 'search_docs'"));
-            expect(policies.map((row) => row.policyname)).toEqual(['tenant_isolation']);
-        });
-        it('FORCES row level security, so the owning role is subject to it too', async () => {
-            const [row] = (await sql.unsafe("SELECT relrowsecurity, relforcerowsecurity FROM pg_class WHERE relname = 'search_docs'"));
-            // ENABLE alone is decoration for the role that owns the schema — which, in
-            // this platform, is the role that serves every request.
-            expect(row?.relrowsecurity).toBe(true);
-            expect(row?.relforcerowsecurity).toBe(true);
-        });
-        it('keeps the tsvector in step through an ON CONFLICT DO UPDATE', async () => {
-            const search = keywordOnly();
-            await search.index(doc('d1', 'First title', 'canine body'));
-            await search.index(doc('d1', 'Second title', 'feline body'));
-            // A trigger written for INSERT only would leave the old postings here. A
-            // generated column cannot, because no code path writes it — which is the
-            // reason the schema uses one.
-            await expect(search.query('feline', { tenantId: TENANT })).resolves.toHaveLength(1);
-            await expect(search.query('canine', { tenantId: TENANT })).resolves.toEqual([]);
-        });
-    });
-    describe('the keyword tier', () => {
-        it('finds a document and reports a higher-is-better score', async () => {
-            const search = keywordOnly();
-            await search.index(doc('d1', 'Dogs', 'canine puppy notes'));
-            const hits = await search.query('canine', { tenantId: TENANT });
-            expect(hits).toHaveLength(1);
-            expect(hits[0]?.id).toBe('d1');
-            // `ts_rank` is already higher-is-better. The available mistake is copying
-            // the SQLite provider's sign flip, which would invert every ranking.
-            expect(hits[0]?.score).toBeGreaterThan(0);
-            expect(hits[0]?.snippet.length).toBeGreaterThan(0);
-        });
-        it('weights a title hit above a body hit, exactly as the SQLite profile does', async () => {
-            const search = keywordOnly();
-            await search.index(doc('body', 'Notes', 'ledger ledger ledger canine'));
-            await search.index(doc('title', 'Canine', 'ledger ledger ledger ledger'));
-            const hits = await search.query('canine', { tenantId: TENANT });
-            // Two profiles that ranked one corpus differently would make "search ranks
-            // wrong in production" unreproducible on a laptop.
-            expect(hits.map((hit) => hit.id)).toEqual(['title', 'body']);
-        });
-        it('survives every punctuation a real person types into a search box', async () => {
-            const search = keywordOnly();
-            await search.index(doc('d1', 'Quotes', 'canine puppy'));
-            // The SQLite side needs a phrase-literal retry for these because FTS5
-            // raises. `websearch_to_tsquery` is total, so a 500 on a hyphen — a product
-            // defect, not user error — is not reachable here at all.
-            for (const query of ['"canine', 'canine -', 'AND OR NEAR', 'canine)("', '""""', '-canine']) {
-                await expect(search.query(query, { tenantId: TENANT })).resolves.toBeArray();
-            }
-        });
-        it('returns nothing for an empty box rather than the whole corpus', async () => {
-            const search = keywordOnly();
-            await search.index(doc('d1', 'Any', 'canine'));
-            await expect(search.query('   ', { tenantId: TENANT })).resolves.toEqual([]);
-        });
-    });
-    describe('tenancy', () => {
-        it('never returns another tenant’s document', async () => {
-            const search = keywordOnly();
-            await search.index(doc('mine', 'Mine', 'canine puppy'));
-            await search.index(doc('theirs', 'Theirs', 'canine puppy', OTHER));
-            await expect(search.count(CORPUS, TENANT)).resolves.toBe(1);
-            const hits = await search.query('canine', { tenantId: TENANT });
-            expect(hits.map((hit) => hit.id)).toEqual(['mine']);
-        });
-        it('is protected by the DATABASE, not only by the predicate', async () => {
-            const search = keywordOnly();
-            await search.index(doc('mine', 'Mine', 'canine'));
-            await search.index(doc('theirs', 'Theirs', 'canine', OTHER));
-            // The same statement the provider runs, minus its tenant predicate, inside
-            // the same tenant scope. If the policy were merely ENABLEd (not FORCEd) or
-            // the predicate were the only control, this would return both rows.
-            const rows = await pool.withConnection(async (connection) => {
-                await connection.execute('BEGIN');
-                await connection.execute('SELECT set_config($1, $2, true)', ['app.tenant_id', TENANT]);
-                const all = await connection.query('SELECT source_id FROM search_docs');
-                await connection.execute('COMMIT');
-                return all;
-            });
-            expect(rows.map((row) => row.source_id)).toEqual(['mine']);
-        });
-        it('refuses an operation with no tenant', async () => {
-            const search = keywordOnly();
-            await expect(search.query('canine', { tenantId: '' })).rejects.toThrow(/tenantId/);
-        });
-    });
-    describe('the vector tier', () => {
-        it('writes chunks only when an embedder is wired', async () => {
-            await keywordOnly().index(doc('kw', 'Keyword', 'canine puppy'));
-            await expect(keywordOnly().countChunks(CORPUS, TENANT)).resolves.toBe(0);
-            const search = hybrid();
-            await search.index(doc('vec', 'Vector', 'canine puppy'));
-            await expect(search.countChunks(CORPUS, TENANT)).resolves.toBe(1);
-        });
-        it('round-trips an embedding through bytea bit-for-bit', async () => {
-            const search = hybrid();
-            await search.index(doc('d1', 'Dogs', 'canine puppy'));
-            const [row] = (await sql.unsafe('SELECT embedding, dims, model FROM search_chunks'));
-            const expected = await embed('Dogs\n\ncanine puppy');
-            // Decoded through the same little-endian codec the reader uses. A driver
-            // that handed back a hex string or a differently-offset view would fail
-            // here rather than silently ranking by noise.
-            const { decodeEmbedding } = await import('cwip/search');
-            expect([...decodeEmbedding(row?.embedding)]).toEqual([...expected]);
-            expect(row?.dims).toBe(VOCAB.length);
-            expect(row?.model).toBe(MODEL);
-        });
-        it('ranks the semantically nearest document above a keyword-only match', async () => {
-            const search = hybrid();
-            // Same fixture shape as the SQLite suite, and for the same reason — read
-            // that suite's comment before simplifying this to two documents.
-            await search.index(doc('decoy', 'Canine Puppy Ledger', 'ledger invoice ledger invoice ledger invoice ledger invoice canine puppy'));
-            await search.index(doc('near', 'Notes', 'canine puppy canine puppy canine puppy'));
-            await search.index(doc('canines', 'Canines', 'canine canine canine'));
-            await search.index(doc('pups', 'Pups', 'puppy puppy puppy'));
-            const keyword = await keywordOnly().query('canine puppy', { tenantId: TENANT });
-            const fused = await search.query('canine puppy', { tenantId: TENANT });
-            // The negative control first: BM25/ts_rank alone puts `decoy` on top.
-            expect(keyword[0]?.id).toBe('decoy');
-            expect(fused[0]?.id).toBe('near');
-            expect(fused.map((hit) => hit.id)).toContain('decoy');
-        });
-        it('surfaces a document the keyword tier cannot find, with a hydrated title', async () => {
-            const search = hybrid();
-            await search.index(doc('semantic', 'Puppy notes', 'canine puppy'));
-            await expect(keywordOnly().query('kitten feline', { tenantId: TENANT })).resolves.toEqual([]);
-            const fused = await search.query('canine kitten', { tenantId: TENANT });
-            expect(fused.map((hit) => hit.id)).toContain('semantic');
-            expect(fused.find((hit) => hit.id === 'semantic')?.title).toBe('Puppy notes');
-        });
-        it('never ranks another tenant’s chunks', async () => {
-            const search = hybrid();
-            await search.index(doc('mine', 'Mine', 'canine puppy'));
-            await search.index(doc('theirs', 'Theirs', 'canine puppy', OTHER));
-            const hits = await search.query('canine puppy', { tenantId: TENANT });
-            expect(hits.map((hit) => hit.id)).toEqual(['mine']);
-        });
-        it('replaces a document’s chunks on re-index rather than accumulating them', async () => {
-            const search = hybrid();
-            await search.index(doc('r1', 'First', 'canine puppy'));
-            await search.index(doc('r1', 'Second', 'feline kitten'));
-            await expect(search.countChunks(CORPUS, TENANT)).resolves.toBe(1);
-            await expect(search.count(CORPUS, TENANT)).resolves.toBe(1);
-        });
-        it('degrades to the keyword tier when the embedder is down', async () => {
-            const phases = [];
-            const flaky = createPgSearchProvider({
-                pool,
-                embed: async () => {
-                    throw new Error('embedding provider is down');
-                },
-                onVectorError: (_error, phase) => phases.push(phase),
-            });
-            await flaky.index(doc('d1', 'Dogs', 'canine puppy'));
-            // The document still landed — a failing embedder must not look like a
-            // write failure to the CDC tap, which would retry into an outage.
-            await expect(flaky.count(CORPUS, TENANT)).resolves.toBe(1);
-            await expect(flaky.query('canine', { tenantId: TENANT })).resolves.toHaveLength(1);
-            expect(phases).toEqual(['index', 'query']);
-        });
-        it('reports a truncated candidate scan', async () => {
-            const truncations = [];
-            const search = createPgSearchProvider({
-                pool,
-                embed,
-                embedModel: MODEL,
-                vectorCandidateLimit: 1,
-                onVectorTruncated: (detail) => truncations.push(detail),
-            });
-            await search.index(doc('t1', 'One', 'canine puppy'));
-            await search.index(doc('t2', 'Two', 'canine kitten'));
-            await search.query('canine', { tenantId: TENANT });
-            expect(truncations).toHaveLength(1);
-        });
-    });
-    describe('rebuild operations', () => {
-        it('reads its epoch from the DATABASE clock, in the index’s own format', async () => {
-            const epoch = await keywordOnly().now();
-            // Same format the SQLite provider's `strftime` produces — the reindexer
-            // compares this string against `indexed_at`, and two formats would make
-            // that comparison quietly wrong rather than loudly broken.
-            expect(epoch).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
-        });
-        it('sweeps documents older than the epoch, and their chunks with them', async () => {
-            const search = hybrid();
-            await search.index(doc('old', 'Old', 'canine puppy'));
-            await Bun.sleep(5);
-            const epoch = await search.now();
-            await search.index(doc('new', 'New', 'canine puppy'));
-            // Counted as DOCUMENTS. Reading the delete's row count would report the
-            // cascaded chunks too, and the reindex job's log would lie about how much
-            // it removed.
-            await expect(search.sweepStale(CORPUS, TENANT, epoch)).resolves.toBe(1);
-            await expect(search.count(CORPUS, TENANT)).resolves.toBe(1);
-            await expect(search.countChunks(CORPUS, TENANT)).resolves.toBe(1);
-            await expect(search.query('canine', { tenantId: TENANT })).resolves.toHaveLength(1);
-        });
-        it('removes a document and its chunks together', async () => {
-            const search = hybrid();
-            await search.index(doc('gone', 'Gone', 'canine puppy'));
-            await search.remove(CORPUS, 'gone', TENANT);
-            await expect(search.count(CORPUS, TENANT)).resolves.toBe(0);
-            await expect(search.countChunks(CORPUS, TENANT)).resolves.toBe(0);
-        });
-        it('does not treat removing an unindexed document as an error', async () => {
-            await expect(keywordOnly().remove(CORPUS, 'never-indexed', TENANT)).resolves.toBeUndefined();
-        });
-    });
-});
-//# sourceMappingURL=pgSearchProvider.pg.test.js.map

package/dist/server/search/pgSearchProvider.pg.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pgSearchProvider.pg.test.js","sourceRoot":"","sources":["../../../src/server/search/pgSearchProvider.pg.test.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oFAAoF;AACpF,kFAAkF;AAClF,YAAY;AACZ;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,IAAI,GAAG,eAAe,CAAC;AAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,MAAM,MAAM,GAAG,GAAW,EAAE;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAmB,CAAC,CAAC;IAC3C,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,KAAK,CAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,IAAI,GAAQ,CAAC;AACb,IAAI,IAAc,CAAC;AAEnB,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,KAAK,GAAG,SAAS,CAAC;AACxB,MAAM,MAAM,GAAG,WAAW,CAAC;AAC3B,MAAM,KAAK,GAAG,UAAU,CAAC;AAEzB,mFAAmF;AACnF,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACpF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAyB,EAAE;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,IAAY,EAAE,QAAQ,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,EAAE,MAAM;IACd,EAAE;IACF,QAAQ;IACR,KAAK;IACL,IAAI;CACL,CAAC,CAAC;AAEH,4HAA4H;AAC5H,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACzF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,cAAc;IACd,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAmB,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QAC1D,MAAM,KAAK,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,oBAAoB,QAAQ,2BAA2B,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,QAAQ,UAAU,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAEpB,4DAA4D;QAC5D,sEAAsE;QACtE,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,UAAU,GAAmB;YACjC,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,SAA6B,EAAE;gBAC1D,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAQ,CAAC;YACtD,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAA6B,EAAE;gBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAG,MAA6B,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACjE,CAAC;SACF,CAAC;QACF,IAAI,GAAG;YACL,KAAK,CAAC,cAAc,CAAC,EAAE;gBACrB,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;SACF,CAAC;QAEF,MAAM,GAAG,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACrD,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,6EAA6E;QAC7E,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,GAAG,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhF,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,4EAA4E;YAC5E,yDAAyD;YACzD,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAChC,oEAAoE,CACrE,CAA6B,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAC7B,wFAAwF,CACzF,CAAgE,CAAC;YAClE,2EAA2E;YAC3E,wDAAwD;YACxD,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC3E,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;YAE7D,yEAAyE;YACzE,yEAAyE;YACzE,8BAA8B;YAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;YACxF,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,2EAA2E;YAC3E,mDAAmD;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;YAChF,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;YACxD,sEAAsE;YACtE,4EAA4E;YAC5E,yDAAyD;YACzD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC3F,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC/E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/C,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;YAEnE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAE7D,2EAA2E;YAC3E,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC1D,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,UAAU,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;gBACvF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAwB,mCAAmC,CAAC,CAAC;gBAC/F,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnC,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAChE,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEzE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAIhF,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACrD,yEAAyE;YACzE,wEAAwE;YACxE,8CAA8C;YAC9C,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YACxD,MAAM,CAAC,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,SAAuB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,MAAM,CAAC,KAAK,CAChB,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,0EAA0E,CAAC,CAChH,CAAC;YACF,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAC,CAAC;YACnF,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAE7D,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAEvE,sEAAsE;YACtE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;YACvF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;YAEnE,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9F,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC;gBACnC,IAAI;gBACJ,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,aAAa,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aACrD,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACrD,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,WAAW,GAAc,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,sBAAsB,CAAC;gBACpC,IAAI;gBACJ,KAAK;gBACL,UAAU,EAAE,KAAK;gBACjB,oBAAoB,EAAE,CAAC;gBACvB,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC,GAAG,EAAE,CAAC;YACxC,wEAAwE;YACxE,wEAAwE;YACxE,2DAA2D;YAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;YAEtD,wEAAwE;YACxE,0EAA0E;YAC1E,cAAc;YACd,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/search/pgSearchSchema.d.ts

@@ -1,82 +0,0 @@
-/**
- * The saas search schema (04 §3) — `search_docs` + `search_chunks` on Postgres.
- *
- * `domains/search.ts` refuses to compile its SQLite chain for Postgres
- * (`PG_DDL_UNSUPPORTED`) and says why: `search_fts` is an FTS5 external-content
- * virtual table maintained by SQLite triggers, which is not a dialect
- * difference — it is a different search engine. So the saas keyword tier is
- * authored here, natively, and the two providers share only the vector tier
- * (`cwip`'s `searchVectorTier`, one implementation for both).
- *
- * ## Why a GENERATED column rather than a trigger
- *
- * The SQLite side keeps its FTS shadow in step with three triggers, and its own
- * header explains the hazard: "application-maintained shadow tables drift the
- * moment one code path forgets". Postgres offers something stronger than a
- * trigger for this — a `GENERATED ALWAYS AS (…) STORED` column cannot drift at
- * all, because there is no code path that writes it. A trigger can be dropped, a
- * migration can forget to recreate it, and `INSERT ... ON CONFLICT DO UPDATE`
- * can bypass one that was written for the wrong event. A generated column has
- * none of those failure modes: the tsvector is a function of the row, enforced
- * by the storage engine.
- *
- * ## `simple` rather than `english`
- *
- * The text config is `simple` — no stemming, no stopwords. Two reasons, and the
- * second is the load-bearing one:
- *
- *   1. This platform's corpora are multi-lingual by construction (a customer's
- *      notes, filenames, contact names). Stemming with the WRONG language is
- *      worse than not stemming: `english` drops "die"/"das" as if they were
- *      stopwords and stems "arbeiten" to nothing useful.
- *   2. `english` discards stopwords, so a search for a title that IS a stopword
- *      phrase ("The Who", "It") returns nothing at all — and the SQLite side's
- *      `unicode61` tokenizer has no stopword list either. Two tiers that
- *      disagree about whether a document is findable is a bug report a customer
- *      files as "search works on my laptop".
- *
- * ## RLS
- *
- * `search_docs` is tenant-rooted (`SEARCH_TENANCY`), so it carries the same
- * `tenant_isolation` policy every domain table does, and `search_chunks`
- * inherits through its `doc_id` FK. That is defense in depth, not the primary
- * control: the provider binds `tenant_id` into every statement it issues, the
- * way the SQLite provider does. The policy is what makes a future statement that
- * forgets return zero rows instead of everyone's.
- *
- * DDL is NEVER issued on a process start — {@link ensureSaasSearchSchema} is a
- * named call a deployment makes once, for the same reason
- * `ensureSaasControlPlaneSchema` is: a shared database has one schema owner, and
- * a library that migrated on boot would be N of them racing.
- */
-import type { SaasPool } from 'cwip/storage';
-/**
- * Weights fed to `ts_rank`, in Postgres' `{D, C, B, A}` order. Title 4× body,
- * matching the SQLite provider's `bm25(search_fts, 4.0, 1.0)` exactly — two
- * profiles that ranked the same corpus differently would make "it ranks wrong in
- * production" unreproducible on a laptop.
- */
-export declare const PG_RANK_WEIGHTS = "{0.1, 0.1, 0.25, 1.0}";
-export declare const PG_SEARCH_DOCS_DDL = "CREATE TABLE IF NOT EXISTS search_docs (\n  id         BIGSERIAL PRIMARY KEY,\n  corpus     TEXT NOT NULL,\n  source_id  TEXT NOT NULL,\n  tenant_id  TEXT NOT NULL,\n  user_id    TEXT,\n  title      TEXT NOT NULL DEFAULT '',\n  body       TEXT NOT NULL DEFAULT '',\n  rev        INTEGER NOT NULL DEFAULT 0,\n  indexed_at TEXT NOT NULL,\n  tsv        tsvector GENERATED ALWAYS AS (setweight(to_tsvector('simple', coalesce(title, '')), 'A') || setweight(to_tsvector('simple', coalesce(body, '')), 'B')) STORED\n)";
-export declare const PG_SEARCH_CHUNKS_DDL = "CREATE TABLE IF NOT EXISTS search_chunks (\n  id         BIGSERIAL PRIMARY KEY,\n  doc_id     BIGINT NOT NULL REFERENCES search_docs(id) ON DELETE CASCADE,\n  seq        INTEGER NOT NULL,\n  text       TEXT NOT NULL,\n  embedding  BYTEA,\n  dims       INTEGER,\n  model      TEXT,\n  indexed_at TEXT NOT NULL\n)";
-/**
- * Every statement that builds the saas search schema, in dependency order.
- *
- * The unique index on `(corpus, source_id, tenant_id)` is what makes the
- * provider's upsert idempotent — it is the same natural key the SQLite schema
- * declares, and 05 §A1's cross-tenant-uniqueness lesson is why `tenant_id` is
- * in it rather than assumed.
- */
-export declare const PG_SEARCH_DDL: readonly string[];
-/**
- * Create the saas search schema. Idempotent, and called EXPLICITLY by a
- * deployment — never on a process start. See the file header.
- *
- * `CREATE POLICY` has no `IF NOT EXISTS` in Postgres, so the policy statements
- * are skipped when the policy is already there rather than being wrapped in a
- * swallow-everything `DO` block: a block that ignores the duplicate-object error
- * also ignores a typo in the predicate, which would leave the table enabled,
- * forced, and isolated by a policy that never matches.
- */
-export declare const ensureSaasSearchSchema: (pool: SaasPool) => Promise<void>;
-//# sourceMappingURL=pgSearchSchema.d.ts.map

package/dist/server/search/pgSearchSchema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pgSearchSchema.d.ts","sourceRoot":"","sources":["../../../src/server/search/pgSearchSchema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,cAAc,CAAC;AAMhE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,0BAA0B,CAAC;AAEvD,eAAO,MAAM,kBAAkB,mgBAW7B,CAAC;AAEH,eAAO,MAAM,oBAAoB,4TAS/B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAiB1C,CAAC;AASF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,GAAU,MAAM,QAAQ,KAAG,OAAO,CAAC,IAAI,CAazE,CAAC"}

package/dist/server/search/pgSearchSchema.js

@@ -1,90 +0,0 @@
-import { assertRowLevelSecurity, createPostgresControlExecutor, rlsStatements } from 'cwip/storage';
-/** The tsvector expression. Title weighted `A`, body `B` — `ts_rank` reads the weights. */
-const TSV_EXPRESSION = `setweight(to_tsvector('simple', coalesce(title, '')), 'A') || setweight(to_tsvector('simple', coalesce(body, '')), 'B')`;
-/**
- * Weights fed to `ts_rank`, in Postgres' `{D, C, B, A}` order. Title 4× body,
- * matching the SQLite provider's `bm25(search_fts, 4.0, 1.0)` exactly — two
- * profiles that ranked the same corpus differently would make "it ranks wrong in
- * production" unreproducible on a laptop.
- */
-export const PG_RANK_WEIGHTS = '{0.1, 0.1, 0.25, 1.0}';
-export const PG_SEARCH_DOCS_DDL = `CREATE TABLE IF NOT EXISTS search_docs (
-  id         BIGSERIAL PRIMARY KEY,
-  corpus     TEXT NOT NULL,
-  source_id  TEXT NOT NULL,
-  tenant_id  TEXT NOT NULL,
-  user_id    TEXT,
-  title      TEXT NOT NULL DEFAULT '',
-  body       TEXT NOT NULL DEFAULT '',
-  rev        INTEGER NOT NULL DEFAULT 0,
-  indexed_at TEXT NOT NULL,
-  tsv        tsvector GENERATED ALWAYS AS (${TSV_EXPRESSION}) STORED
-)`;
-export const PG_SEARCH_CHUNKS_DDL = `CREATE TABLE IF NOT EXISTS search_chunks (
-  id         BIGSERIAL PRIMARY KEY,
-  doc_id     BIGINT NOT NULL REFERENCES search_docs(id) ON DELETE CASCADE,
-  seq        INTEGER NOT NULL,
-  text       TEXT NOT NULL,
-  embedding  BYTEA,
-  dims       INTEGER,
-  model      TEXT,
-  indexed_at TEXT NOT NULL
-)`;
-/**
- * Every statement that builds the saas search schema, in dependency order.
- *
- * The unique index on `(corpus, source_id, tenant_id)` is what makes the
- * provider's upsert idempotent — it is the same natural key the SQLite schema
- * declares, and 05 §A1's cross-tenant-uniqueness lesson is why `tenant_id` is
- * in it rather than assumed.
- */
-export const PG_SEARCH_DDL = [
-    PG_SEARCH_DOCS_DDL,
-    'CREATE UNIQUE INDEX IF NOT EXISTS search_docs_source ON search_docs(corpus, source_id, tenant_id)',
-    'CREATE INDEX IF NOT EXISTS search_docs_tenant ON search_docs(tenant_id, corpus, indexed_at DESC)',
-    'CREATE INDEX IF NOT EXISTS search_docs_tsv ON search_docs USING GIN(tsv)',
-    PG_SEARCH_CHUNKS_DDL,
-    'CREATE UNIQUE INDEX IF NOT EXISTS search_chunks_seq ON search_chunks(doc_id, seq)',
-    // The vector tier's candidate scan filters on the join plus (dims, model);
-    // without this it is a sequential scan of every tenant's chunks per query.
-    'CREATE INDEX IF NOT EXISTS search_chunks_space ON search_chunks(doc_id, dims, model)',
-    // The platform's OWN policy text, not a hand-written copy. `rlsStatements`
-    // also emits `FORCE ROW LEVEL SECURITY`, which is the half a hand-written
-    // chain forgets and the half that matters here: a table's OWNER bypasses RLS
-    // unless it is FORCEd, and in this platform the application role owns its own
-    // schema. Without it the policy is decoration for exactly the connection that
-    // serves every request.
-    ...rlsStatements('search_docs'),
-];
-// Self-check at module load, the same one `toPostgresChain` performs on a
-// compiled chain. This chain is hand-authored (SQLite's FTS5 shadow has no
-// Postgres translation), so it does NOT go through the compiler that would
-// normally apply this gate — and a hand-authored chain is precisely the one that
-// can ship a tenant-rooted table with no policy.
-assertRowLevelSecurity(PG_SEARCH_DDL);
-/**
- * Create the saas search schema. Idempotent, and called EXPLICITLY by a
- * deployment — never on a process start. See the file header.
- *
- * `CREATE POLICY` has no `IF NOT EXISTS` in Postgres, so the policy statements
- * are skipped when the policy is already there rather than being wrapped in a
- * swallow-everything `DO` block: a block that ignores the duplicate-object error
- * also ignores a typo in the predicate, which would leave the table enabled,
- * forced, and isolated by a policy that never matches.
- */
-export const ensureSaasSearchSchema = async (pool) => {
-    await pool.withConnection(async (connection) => {
-        const executor = createPostgresControlExecutor(connection);
-        const existing = await executor.all({
-            sql: "SELECT policyname FROM pg_policies WHERE tablename = 'search_docs'",
-        });
-        const present = new Set(existing.map((row) => row.policyname));
-        for (const statement of PG_SEARCH_DDL) {
-            const policy = /^CREATE\s+POLICY\s+([a-z_]+)\s+ON\b/i.exec(statement.trim());
-            if (policy?.[1] !== undefined && present.has(policy[1]))
-                continue;
-            await executor.write({ sql: statement });
-        }
-    });
-};
-//# sourceMappingURL=pgSearchSchema.js.map

package/dist/server/search/pgSearchSchema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pgSearchSchema.js","sourceRoot":"","sources":["../../../src/server/search/pgSearchSchema.ts"],"names":[],"mappings":"AAoDA,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEpG,2FAA2F;AAC3F,MAAM,cAAc,GAAG,yHAAyH,CAAC;AAEjJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEvD,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;6CAUW,cAAc;EACzD,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;EASlC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,kBAAkB;IAClB,mGAAmG;IACnG,kGAAkG;IAClG,0EAA0E;IAC1E,oBAAoB;IACpB,mFAAmF;IACnF,2EAA2E;IAC3E,2EAA2E;IAC3E,sFAAsF;IACtF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,wBAAwB;IACxB,GAAG,aAAa,CAAC,aAAa,CAAC;CAChC,CAAC;AAEF,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,iFAAiF;AACjF,iDAAiD;AACjD,sBAAsB,CAAC,aAAa,CAAC,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,IAAc,EAAiB,EAAE;IAC5E,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAsB,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAyB;YAC1D,GAAG,EAAE,oEAAoE;SAC1E,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClE,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/server/services/accountService.d.ts

@@ -1,73 +0,0 @@
-import { type RegistryIdentityStore } from 'cwip/cc-registry';
-import { type Argon2idDeriver } from 'cwip/guard';
-import type { SignupMode } from '../../config/appConfig';
-import { type CCUserClaims } from '../../core/session/claims';
-import { AppError } from '../errors';
-import type { AccountService } from '../mixins/services';
-import { type PasswordVerifierPort } from '../guard/passwordVerifier';
-import type { SessionSigner } from '../guard/sessionSigner';
-export type { AccountService, AccountView, InvitationView, LoginRequest, MemberPatch, MemberView, PasswordChangeRequest, SessionView, SignupRequest, TenantView, } from '../mixins/services';
-/** Which resolution rule applies — mirrors `manifest.profile`. */
-export type AccountProfile = 'local' | 'saas';
-/**
- * The ONE rule for whether a signup attempt is admissible under a
- * {@link SignupMode} (D33). Shared by the service (authoritative, refuses
- * before the KDF or any store write) and the guard mixin (a cheap short-circuit
- * before the password bytes are even read), so the two can never disagree
- * about what a closed door is. Returns the error to throw, or null.
- */
-export declare const refuseGatedSignup: (mode: SignupMode, hasInviteToken: boolean) => AppError | null;
-export interface CreateAccountServiceOptions {
-    /** The opened identity store (handle injection — the host owns the registry db). */
-    readonly identity: RegistryIdentityStore;
-    /** `local` resolves the bootstrap owner; `saas` resolves the request session. */
-    readonly profile: AccountProfile;
-    /**
-     * saas only: the verified claims of the in-flight request. The server sets this
-     * per request (the signer has already verified the token); the resolver reads it
-     * back. Returning `null` (no session) resolves the identity to `null`. Ignored
-     * under `local`, where there is no per-request session.
-     */
-    readonly currentClaims?: () => CCUserClaims | null;
-    /**
-     * The session signer used to MINT on login (the SAME instance the runtime
-     * verifies with). Optional: a resolveIdentity-only construction (the recipe's
-     * local default) omits it; `login` then fails loudly rather than minting an
-     * unverifiable token.
-     */
-    readonly signer?: SessionSigner;
-    /**
-     * The argon2id deriver for password verifiers. Omitted ⇒ the process-wide one
-     * registered at boot (`setArgon2idDeriver`) is used — the normal path.
-     */
-    readonly deriver?: Argon2idDeriver;
-    /**
-     * WHERE password derivation runs (05 §B6). Omitted ⇒ on this thread, using
-     * `deriver` — the behavior that shipped before this option existed, and the
-     * right one for a single-user local app.
-     *
-     * A saas host expecting login concurrency passes
-     * `createKdfWorkerPasswordVerifier({ entry: kdfWorkerEntryUrl() })` instead:
-     * argon2id is ~150–250 ms of pure CPU per attempt and the seam is synchronous,
-     * so on one thread a login burst serializes AND stalls every unrelated request
-     * on the node. Supplying a port DOES NOT change the KDF, the envelope format
-     * or the verifier — the worker runs these very functions — so the two
-     * configurations are interoperable: an envelope sealed on one opens on the
-     * other. When both are given, `passwords` wins and `deriver` is unused.
-     */
-    readonly passwords?: PasswordVerifierPort;
-    /**
-     * The launch gate (D33): who may sign up. `guard.features.signupMode` feeds
-     * this (the recipe passes `effectiveSignupMode(manifest.instances)`).
-     * Default `open` — the pre-gate behavior, and the right one for local apps.
-     */
-    readonly signupMode?: SignupMode;
-    /** Id generator for new users/tenants. Default `crypto.randomUUID`. */
-    readonly mintId?: () => string;
-    /** Clock (epoch ms) for invitation expiry. Injected by tests. */
-    readonly now?: () => number;
-    /** Default invitation lifetime. 7 days. */
-    readonly invitationTtlMinutes?: number;
-}
-export declare function createAccountService(options: CreateAccountServiceOptions): AccountService;
-//# sourceMappingURL=accountService.d.ts.map

package/dist/server/services/accountService.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"accountService.d.ts","sourceRoot":"","sources":["../../../src/server/services/accountService.ts"],"names":[],"mappings":"AA2BA,OAAO,EAGL,KAAK,qBAAqB,EAE3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAEL,KAAK,YAAY,EAMlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EACV,cAAc,EAMf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmC,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAK5D,YAAY,EACV,cAAc,EACd,WAAW,EACX,cAAc,EACd,YAAY,EACZ,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,WAAW,EACX,aAAa,EACb,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,kEAAkE;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,UAAU,EAAE,gBAAgB,OAAO,KAAG,QAAQ,GAAG,IAcxF,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAwBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,CAmoBzF"}