typekro 0.26.0 → 0.27.0

package/dist/core/deployment/kro-instance-safety.js

@@ -1,8 +1,9 @@
+import { CEL_EXPRESSION_BRAND } from '../../shared/brands.js';
 import { isCelExpression, isKubernetesRef } from '../../utils/type-guards.js';
 import { createCompositionContext, runWithCompositionContext } from '../composition/context.js';
 import { KUBERNETES_REF_SCHEMA_MARKER_SOURCE } from '../constants/brands.js';
 import { TypeKroError } from '../errors.js';
-import { getIncludeWhen } from '../metadata/index.js';
+import { copyResourceMetadata, getIncludeWhen } from '../metadata/index.js';
 import { evaluateSchemaCelExpression } from './schema-cel-evaluator.js';
 function resourceEntries(resources) {
     if (!resources)
@@ -21,7 +22,7 @@ function resolveSpecPath(spec, fieldPath) {
     }
     return current;
 }
-function resolveNamespaceName(value, spec) {
+export function resolveNamespaceName(value, spec) {
     if (isKubernetesRef(value)) {
         if (value.resourceId !== '__schema__')
             return undefined;
@@ -57,6 +58,64 @@ function resolveNamespaceName(value, spec) {
     });
     return unresolved ? undefined : resolved;
 }
+/**
+ * Resolve a Namespace METADATA value (a label or annotation VALUE) to its concrete
+ * string form (finding #5).
+ *
+ * Unlike {@link resolveNamespaceName} — which resolves a namespace NAME and is
+ * correctly restricted to DNS-label shape — metadata values are UNRESTRICTED strings:
+ * `Team_A`, free text with spaces, arbitrary annotation content. The old path routed
+ * these through `resolveNamespaceName`, whose DNS-label short-circuit only accepts a
+ * CEL body matching a DNS label and then hands anything else to the CEL evaluator,
+ * which throws / returns undefined for a plain literal like `Team_A` or `some text` —
+ * silently DROPPING valid metadata.
+ *
+ * A concrete re-execution collapses a schema-derived value into a CEL whose BODY is
+ * the resolved literal. So for a CEL value we:
+ *   - first try evaluating it (handles genuine expressions — `has()`, `orValue()`,
+ *     concatenations); if that yields a primitive, use it;
+ *   - otherwise the body is a concrete literal that is not a valid standalone CEL
+ *     program (e.g. `Team_A`, `some text`) — return it VERBATIM as the concrete value,
+ *     with NO DNS-label restriction.
+ * Numbers / booleans are stringified; refs resolve against the spec; plain strings and
+ * marker-embedded strings defer to {@link resolveNamespaceName} (which returns them
+ * verbatim / resolves the marker). Returns `undefined` only for a genuinely
+ * unresolvable value (an unresolved schema ref), so the caller drops just those.
+ */
+export function resolveConcreteMetadataValue(value, spec) {
+    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
+        return String(value);
+    }
+    if (isCelExpression(value)) {
+        const body = value.expression.trim().replace(/^\$\{\s*|\s*\}$/g, '');
+        // A concrete re-execution collapses a schema-derived value into a CEL whose BODY is
+        // the resolved LITERAL — that literal must be returned VERBATIM, NEVER fed to the
+        // CEL evaluator, which mis-parses many literals (e.g. `data-platform` → `data -
+        // platform` → NaN, `Team_A`/free text → identifier/parse errors). Only a body that
+        // STILL references the schema (`spec.*` / `schema.spec.*`) or uses a schema CEL
+        // helper (`has()` / `.orValue()`) genuinely needs evaluation against the spec.
+        const referencesSchema = /(?<![\w$])(?:schema\.)?spec\.[A-Za-z_$]/.test(body) ||
+            /\bhas\(/.test(body) ||
+            /\.orValue\(/.test(body);
+        if (referencesSchema) {
+            try {
+                const evaluated = evaluateSchemaCelExpression(value, spec);
+                if (typeof evaluated === 'string')
+                    return evaluated;
+                if (typeof evaluated === 'number' ||
+                    typeof evaluated === 'boolean' ||
+                    typeof evaluated === 'bigint') {
+                    return String(evaluated);
+                }
+            }
+            catch {
+                // Unevaluable despite looking schema-shaped — fall through to the verbatim body.
+            }
+        }
+        return body.length > 0 ? body : undefined;
+    }
+    return resolveNamespaceName(value, spec);
+}
 function concreteResources(input) {
     if (!input.compositionFn)
         return resourceEntries(input.resources);
@@ -99,7 +158,7 @@ function concreteBoolean(value, spec) {
     const resolved = resolveSpecPath(spec, schemaPath);
     return typeof resolved === 'boolean' ? resolved : undefined;
 }
-function isActiveOwnedResource(resource, spec) {
+export function isActiveOwnedResource(resource, spec) {
     if (Reflect.get(resource, '__externalRef') === true)
         return false;
     const metadataConditions = getIncludeWhen(resource);
@@ -108,14 +167,19 @@ function isActiveOwnedResource(resource, spec) {
     return !conditions?.some((condition) => concreteBoolean(condition, spec) === false);
 }
 /**
- * Reject a KRO instance that would own the Namespace containing its own CR.
+ * Per-resource detection: for each actively-owned Namespace, its resource id
+ * mapped to its resolved concrete name. `unresolved` holds the ids of owned
+ * Namespaces whose name cannot be evaluated from the spec.
  *
- * KRO deletes graph children before clearing the owner CR's finalizer. If a
- * child Namespace contains that CR, namespace termination can strand the
- * finalizer permanently. Re-executing with the concrete instance spec makes
- * this check survive nested compositions and schema-driven namespace names.
+ * The resource ids are stable across the re-execution used here (dedup + explicit
+ * `id`s), so a factory can match them back to its own `resources` to HOIST the
+ * owned namespace out of the RGD graph. Re-execution is also what resolves the
+ * schema-driven names to concrete values (the built `resources` carry `${...}`
+ * KRO templates that can't be evaluated directly).
  */
-export function assertKroInstanceNamespaceOwnershipSafe(input) {
+export function detectOwnedNamespaceResources(input) {
+    const ownedById = new Map();
+    const unresolved = [];
     for (const [resourceId, resource] of concreteResources(input)) {
         if (resource.kind !== 'Namespace')
             continue;
@@ -123,24 +187,442 @@ export function assertKroInstanceNamespaceOwnershipSafe(input) {
             continue;
         const ownedNamespace = resolveNamespaceName(resource.metadata?.name, input.spec);
         if (ownedNamespace === undefined) {
-            throw new TypeKroError(`Cannot prove KRO instance namespace '${input.instanceNamespace}' is safe because active owned Namespace '${resourceId}' in composition '${input.compositionName}' has a name that cannot be evaluated from the concrete spec. ` +
-                'Use a concrete or schema-only CEL Namespace name, or move the KRO instance to a control-plane namespace whose safety can be established.', 'UNRESOLVED_KRO_NAMESPACE_OWNERSHIP', {
-                composition: input.compositionName,
-                instanceNamespace: input.instanceNamespace,
-                resourceId,
-                mode: 'kro',
-            });
+            unresolved.push(resourceId);
         }
-        if (ownedNamespace === input.instanceNamespace) {
-            throw new TypeKroError(`KRO instance namespace '${input.instanceNamespace}' cannot also be an owned Namespace in composition '${input.compositionName}'. ` +
-                'Place the KRO instance in a separate control-plane namespace so deleting it cannot terminate the namespace containing its own finalizer.', 'UNSAFE_KRO_NAMESPACE_OWNERSHIP', {
-                composition: input.compositionName,
-                instanceNamespace: input.instanceNamespace,
-                ownedNamespace,
-                resourceId,
-                mode: 'kro',
+        else {
+            ownedById.set(resourceId, ownedNamespace);
+        }
+    }
+    return { ownedById, unresolved };
+}
+export function detectOwnedNamespaces(input) {
+    const { ownedById, unresolved } = detectOwnedNamespaceResources(input);
+    return { owned: new Set(ownedById.values()), unresolved };
+}
+/**
+ * The CONCRETE (re-executed against the spec) resource objects for each
+ * actively-owned Namespace, keyed by resource id. Unlike
+ * {@link detectOwnedNamespaceResources} (which returns only the resolved names),
+ * this returns the full concrete metadata — labels (incl. Pod Security),
+ * annotations, name — so the KRO factory can PRESERVE the original Namespace
+ * configuration when it hoists the Namespace out of the graph and re-emits it as
+ * a sibling resource (finding #5), rather than synthesizing a bare Namespace.
+ */
+export function concreteOwnedNamespaceResources(input) {
+    const byId = new Map();
+    for (const [resourceId, resource] of concreteResources(input)) {
+        if (resource.kind !== 'Namespace')
+            continue;
+        if (!isActiveOwnedResource(resource, input.spec))
+            continue;
+        byId.set(resourceId, resource);
+    }
+    return byId;
+}
+/**
+ * Select EVERY Namespace to HOIST out of the RGD graph — the new, UNCONDITIONAL
+ * model: typekro NEVER emits a Namespace into RGD YAML. Selection is trivially
+ * `kind === 'Namespace'` (excluding `__externalRef` observed namespaces, which are
+ * not owned graph children), NOT the old structural "name tracks spec.namespace"
+ * detection. Every owned Namespace becomes a sibling resource applied before the
+ * RGD and torn down after it, so KRO never owns a namespace.
+ *
+ * Returns a map from each hoisted Namespace's resource id to its RAW
+ * `metadata.name` VALUE (a schema `KubernetesRef`, a `CelExpression`, or a plain
+ * string). The name value is what {@link rewriteHoistedNamespaceReferences} /
+ * {@link rewriteHoistedNamespaceRefsInValue} rewrite dangling references TO — a
+ * reference to a hoisted Namespace's `metadata.name` becomes that Namespace's own
+ * concrete name expression. The map is a STABLE STRUCTURAL property of the graph
+ * (spec-independent), so the shared RGD's shape is identical for every instance.
+ *
+ * Deliberately does NOT filter on `includeWhen`: a namespace's ACTIVITY is
+ * spec-dependent, but whether a resource is a Namespace is not. A namespace that is
+ * inactive for a given spec is simply not created as a sibling; removing it from the
+ * RGD is harmless (it was not going to be created there either).
+ */
+export function selectHoistedNamespaces(resources) {
+    const byId = new Map();
+    for (const [resourceId, resource] of resourceEntries(resources)) {
+        if (resource.kind !== 'Namespace')
+            continue;
+        if (Reflect.get(resource, '__externalRef') === true)
+            continue;
+        byId.set(resourceId, resource.metadata?.name);
+    }
+    return byId;
+}
+/** A branded CEL expression object built from a bare expression body. */
+function makeCelExpression(expression) {
+    return { [CEL_EXPRESSION_BRAND]: true, expression };
+}
+function hoistedNamespaceNameForms(nameValue) {
+    if (isKubernetesRef(nameValue)) {
+        // Only a schema-driven name is representable as an RGD-portable expression.
+        if (nameValue.resourceId !== '__schema__')
+            return undefined;
+        const fieldPath = nameValue.fieldPath === 'namespace' ? 'spec.namespace' : nameValue.fieldPath;
+        const celBody = `schema.${fieldPath}`;
+        return {
+            celBody,
+            marker: `__KUBERNETES_REF___schema___${fieldPath}__`,
+            ref: makeCelExpression(celBody),
+        };
+    }
+    if (isCelExpression(nameValue)) {
+        const celBody = nameValue.expression.trim().replace(/^\$\{\s*|\s*\}$/g, '');
+        // If the CEL body is itself a bare schema field, it has a clean marker form too.
+        const schemaField = /^schema\.(spec\.[A-Za-z_$][\w$.]*)$/.exec(celBody)?.[1];
+        return {
+            celBody,
+            marker: schemaField ? `__KUBERNETES_REF___schema___${schemaField}__` : undefined,
+            ref: nameValue,
+        };
+    }
+    if (typeof nameValue === 'string') {
+        // A serialized schema marker (whole string) → schema field.
+        const markerMatch = /^__KUBERNETES_REF___schema___(spec\.[A-Za-z0-9_.$]+?)__$/.exec(nameValue.trim());
+        if (markerMatch?.[1]) {
+            const fieldPath = markerMatch[1];
+            return {
+                celBody: `schema.${fieldPath}`,
+                marker: nameValue.trim(),
+                ref: makeCelExpression(`schema.${fieldPath}`),
+            };
+        }
+        // A template string carrying embedded markers is a concatenation with no simple
+        // single-token substitution — fail closed.
+        if (/__KUBERNETES_REF_/.test(nameValue))
+            return undefined;
+        // A plain string literal (a concrete DNS namespace name).
+        return { celBody: JSON.stringify(nameValue), marker: nameValue, ref: nameValue };
+    }
+    return undefined;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Rewrite every reference to a HOISTED Namespace's `metadata.name` — ANYWHERE it
+ * appears in a value — to that Namespace's CONCRETE name expression (findings
+ * #3 + #6).
+ *
+ * `hoisted` maps each hoisted Namespace's resource id to its RAW `metadata.name`
+ * value (see {@link selectHoistedNamespaces}). When a Namespace is hoisted OUT of
+ * the RGD graph, any other value that still refers to it would leave a live
+ * reference to a resource KRO no longer knows about, and KRO rejects the whole
+ * graph. Each reference is rewritten to the referenced Namespace's own name
+ * expression — for a Namespace named `${schema.spec.namespace}` that is
+ * `schema.spec.namespace` (as before); for a literally-named Namespace `"foo"`
+ * that is the constant `foo` — which is exactly the value the removed resource
+ * would have produced.
+ *
+ * The rewrite is STRUCTURAL, not exact-string (finding #6): it replaces the
+ * reference TOKEN `<id>.metadata.name` wherever it occurs, so embedded /
+ * concatenated (`ns-${string(id.metadata.name)}`), function-wrapped
+ * (`string(id.metadata.name)`), and ternary (`... ? id.metadata.name : "x"`)
+ * forms are all handled — in plain strings, CEL expressions, and raw
+ * `__KUBERNETES_REF_*` markers alike. It applies to arbitrary values (resource
+ * bodies AND status mappings). A reference whose target Namespace name has no
+ * representable form is left as-is and caught by
+ * {@link findDanglingHoistedReference}.
+ */
+export function rewriteHoistedNamespaceRefsInValue(value, hoisted) {
+    if (hoisted.size === 0)
+        return value;
+    // Per-id substitution forms; ids whose name is not representable are skipped
+    // (the reference is left dangling for the post-serialization assertion).
+    const forms = new Map();
+    for (const [id, nameValue] of hoisted) {
+        const f = hoistedNamespaceNameForms(nameValue);
+        if (f)
+            forms.set(id, f);
+    }
+    if (forms.size === 0)
+        return value;
+    // TOKEN-level (not whole-`${...}`) patterns for a reference to
+    // `<id>.metadata.name`, so wrappers/concatenation/ternaries are handled. A
+    // negative lookbehind avoids matching an id that is only a SUFFIX of a longer
+    // identifier (e.g. `myOwnedNamespace` when the hoisted id is `ownedNamespace`).
+    const celTokenReplacers = [...forms].map(([id, f]) => ({
+        pattern: new RegExp(`(?<![A-Za-z0-9_$])${escapeRegExp(id)}\\.metadata\\.name\\b`, 'g'),
+        replacement: f.celBody,
+    }));
+    const markerTokenReplacers = [...forms]
+        .filter(([, f]) => f.marker !== undefined)
+        .map(([id, f]) => ({
+        pattern: new RegExp(`__KUBERNETES_REF_${escapeRegExp(id)}_metadata\\.name__`, 'g'),
+        // biome-ignore lint/style/noNonNullAssertion: filtered on marker !== undefined
+        replacement: f.marker,
+    }));
+    const rewriteString = (input) => {
+        let out = input;
+        // Use a function replacer so `$` in a replacement is never treated as a
+        // special replacement pattern.
+        for (const { pattern, replacement } of celTokenReplacers)
+            out = out.replace(pattern, () => replacement);
+        for (const { pattern, replacement } of markerTokenReplacers)
+            out = out.replace(pattern, () => replacement);
+        return out;
+    };
+    const rewriteValue = (val) => {
+        if (isKubernetesRef(val)) {
+            // Rewrite ONLY an exact `metadata.name` reference to a hoisted Namespace
+            // (finding #7); requiring EXACT field equality lets any unsupported reference
+            // fall through to the dangling-reference validation instead.
+            const f = forms.get(val.resourceId);
+            return f && val.fieldPath === 'metadata.name' ? f.ref : val;
+        }
+        if (isCelExpression(val)) {
+            const rewritten = rewriteString(val.expression);
+            return rewritten === val.expression ? val : makeCelExpression(rewritten);
+        }
+        if (typeof val === 'string') {
+            return rewriteString(val);
+        }
+        if (Array.isArray(val)) {
+            let changed = false;
+            const next = val.map((item) => {
+                const rewritten = rewriteValue(item);
+                if (rewritten !== item)
+                    changed = true;
+                return rewritten;
             });
+            return changed ? next : val;
+        }
+        if (val !== null && typeof val === 'object') {
+            let changed = false;
+            const next = {};
+            for (const [key, item] of Object.entries(val)) {
+                const rewritten = rewriteValue(item);
+                if (rewritten !== item)
+                    changed = true;
+                next[key] = rewritten;
+            }
+            return changed ? next : val;
+        }
+        return val;
+    };
+    return rewriteValue(value);
+}
+/**
+ * The top-level STATUS field names whose value, once the owned Namespace is HOISTED
+ * out of the RGD, can no longer be represented in the KRO status schema (finding #6).
+ *
+ * When a Namespace is hoisted OUT of the RGD, a status field that referenced its
+ * `metadata.name` is rewritten to the Namespace's own name expression. KRO requires
+ * every instance status field to reference at least one RESOURCE (KRO builder.go:
+ * `instance status field must refer to a resource`), and its status CEL environment
+ * has no `schema` identifier. So a rewritten value that references NO managed resource
+ * is unrepresentable in the KRO status — in BOTH shapes:
+ *   - schema-only (`schema.spec.namespace`, for a schema-named Namespace) — KRO
+ *     status CEL cannot evaluate `schema`; and
+ *   - a plain CONSTANT (for a literally-named Namespace) — a literal has zero resource
+ *     dependencies, so KRO rejects it, AND typekro's own schema generation classifies
+ *     a literal-only status as static and DROPS it from the emitted KRO status.
+ * BOTH were previously handled inconsistently (schema-only rejected, literal silently
+ * dropped). We now REJECT both consistently (see {@link assertNoHoistWeakenedStatusFields})
+ * — the one behavior. A field that ALSO references a real managed resource stays
+ * representable (KRO accepts it; a literal inside it is fine) and is NOT flagged.
+ *
+ * Returns only TOP-LEVEL status keys (the KRO status schema is a flat map of field →
+ * CEL); a field is included iff rewriting its value CHANGED it (it referenced the
+ * hoisted Namespace) AND the rewritten value references no managed resource (i.e. it
+ * references `schema`, or is a pure constant).
+ */
+export function hoistWeakenedStatusFields(statusMappings, hoisted) {
+    if (!statusMappings || hoisted.size === 0)
+        return [];
+    const weakened = [];
+    for (const [key, value] of Object.entries(statusMappings)) {
+        if (key.startsWith('__'))
+            continue; // internal composition metadata, not a status field
+        const rewritten = rewriteHoistedNamespaceRefsInValue(value, hoisted);
+        if (rewritten === value)
+            continue; // did not reference a hoisted Namespace
+        // Unrepresentable in KRO status when the rewritten value references `schema`
+        // (KRO can't eval it) OR references NO managed resource (a pure constant — KRO
+        // requires a resource dependency, and typekro would drop it as static).
+        if (rewrittenReferencesSchema(rewritten) || !rewrittenReferencesManagedResource(rewritten)) {
+            weakened.push(key);
+        }
+    }
+    return weakened;
+}
+/**
+ * Whether a rewritten status value still references the `schema` identifier — a
+ * schema-only expression KRO status CEL cannot evaluate.
+ */
+function rewrittenReferencesSchema(value) {
+    const hasSchema = (s) => /(?<![A-Za-z0-9_$])schema\./.test(s) || /__KUBERNETES_REF___schema__/.test(s);
+    if (typeof value === 'string')
+        return hasSchema(value);
+    if (isCelExpression(value))
+        return hasSchema(value.expression);
+    if (isKubernetesRef(value))
+        return value.resourceId === '__schema__';
+    if (Array.isArray(value))
+        return value.some(rewrittenReferencesSchema);
+    if (value !== null && typeof value === 'object') {
+        return Object.values(value).some(rewrittenReferencesSchema);
+    }
+    return false;
+}
+/**
+ * Whether a rewritten status value references at least one MANAGED RESOURCE — a
+ * non-`schema` KubernetesRef, or a `<id>.status|spec|metadata` / `__KUBERNETES_REF_<id>_`
+ * token whose id is not `schema`. KRO requires every status field to reference a
+ * resource; a value that references none (a pure constant, or schema-only) is
+ * unrepresentable. Used together with {@link rewrittenReferencesSchema} so the
+ * literal-only case (finding #6) is rejected consistently with the schema-only case.
+ */
+function rewrittenReferencesManagedResource(value) {
+    const hasResourceToken = (s) => {
+        const dotRef = /(?<![A-Za-z0-9_$])([A-Za-z_$][\w$]*)\.(?:status|spec|metadata)\b/g;
+        for (const match of s.matchAll(dotRef)) {
+            if (match[1] !== 'schema')
+                return true;
+        }
+        const markerRef = /__KUBERNETES_REF_([A-Za-z0-9_$]+?)_/g;
+        for (const match of s.matchAll(markerRef)) {
+            if (match[1] !== '__schema__' && match[1] !== 'schema')
+                return true;
+        }
+        return false;
+    };
+    if (typeof value === 'string')
+        return hasResourceToken(value);
+    if (isCelExpression(value))
+        return hasResourceToken(value.expression);
+    if (isKubernetesRef(value))
+        return value.resourceId !== '__schema__';
+    if (Array.isArray(value))
+        return value.some(rewrittenReferencesManagedResource);
+    if (value !== null && typeof value === 'object') {
+        return Object.values(value).some(rewrittenReferencesManagedResource);
+    }
+    return false;
+}
+/**
+ * HONEST, CONSISTENT behavior for finding #6: REJECT (throw) a composition whose
+ * status field(s) resolve ONLY to a hoisted owned Namespace's `metadata.name` — i.e.
+ * once the Namespace leaves the RGD the field references no managed resource.
+ *
+ * KRO requires every instance status field to reference a resource and cannot
+ * evaluate `schema` in status CEL, so such a field is unrepresentable in the emitted
+ * KRO status whether the Namespace is schema-named (rewrites to `schema.spec.namespace`)
+ * or literally-named (rewrites to a constant). Previously the schema case threw while
+ * the literal case was silently dropped (schema generation classifies literal-only
+ * status as static and excludes it) — the two code paths disagreed. Both are now
+ * REJECTED the same way: FAIL LOUDLY at serialization, naming the field(s), so the
+ * author restructures the status (derive the value from a managed resource, or drop
+ * the field) instead of shipping a silently-weakened status API.
+ */
+export function assertNoHoistWeakenedStatusFields(statusMappings, hoisted, compositionName) {
+    const weakened = hoistWeakenedStatusFields(statusMappings, hoisted);
+    if (weakened.length === 0)
+        return;
+    throw new TypeKroError(`Composition "${compositionName}" cannot be serialized for KRO: status field(s) ` +
+        `[${weakened.join(', ')}] resolve ONLY to a hoisted owned Namespace's metadata.name. ` +
+        `Once that Namespace is hoisted out of the RGD the reference no longer targets any managed ` +
+        `resource (it becomes a schema-only expression \`schema.spec.namespace\` for a schema-named ` +
+        `Namespace, or a bare constant for a literally-named one). KRO requires every status field ` +
+        `to reference a resource and cannot evaluate \`schema\` in status CEL, so the field cannot be ` +
+        `represented in the KRO status schema either way. Remove the field or derive its value from a ` +
+        `managed resource instead of the owned Namespace's name. See docs/advanced/migration.md.`, 'HOIST_WEAKENED_STATUS_FIELD', { compositionName, fields: weakened });
+}
+/**
+ * Resource-map form of {@link rewriteHoistedNamespaceRefsInValue}: rewrite every
+ * dangling reference to a hoisted Namespace across a resource collection.
+ *
+ * Only resources that actually contain such a reference are reconstructed; every
+ * other resource is passed through by identity, so the common case (no reference
+ * to the hoisted Namespace) is untouched. When a resource IS reconstructed, its
+ * TypeKro metadata (WeakMap-stored `includeWhen` / `readinessEvaluator` /
+ * `__resourceId` / readiness+iteration markers) is copied onto the new object via
+ * {@link copyResourceMetadata} so the rewrite never silently drops it (finding #7).
+ */
+export function rewriteHoistedNamespaceReferences(resources, hoisted) {
+    if (hoisted.size === 0)
+        return resources;
+    const result = {};
+    for (const [id, resource] of Object.entries(resources)) {
+        const rewritten = rewriteHoistedNamespaceRefsInValue(resource, hoisted);
+        if (rewritten !== resource) {
+            // Reconstructed a NEW resource object — carry its non-enumerable / WeakMap
+            // TypeKro metadata across so readiness/iteration/includeWhen survive.
+            copyResourceMetadata(resource, rewritten);
         }
+        result[id] = rewritten;
+    }
+    return result;
+}
+/**
+ * Scan an emitted RGD YAML for any leftover reference to a hoisted (removed)
+ * resource id — either a CEL interpolation `${<id>.…}` or a raw
+ * `__KUBERNETES_REF_<id>_…` marker. Returns the FIRST offending id, or
+ * `undefined` when the RGD is clean.
+ *
+ * This is the shared post-serialization dangling-reference check applied to BOTH
+ * the factory serialization path ({@link KroResourceFactoryImpl.buildRgdYaml})
+ * and the graph/composition serialization path (`core.ts`). After hoisting an
+ * owned Namespace out of the RGD, NO reference to it may remain anywhere in the
+ * emitted RGD (resource templates, status CEL, nested CEL, overrides); otherwise
+ * KRO rejects the graph at runtime with a dangling `${...}` reference. A negative
+ * lookbehind avoids matching an id that is only a suffix of a longer identifier.
+ */
+export function findDanglingHoistedReference(rgdYaml, hoistedIds) {
+    for (const id of hoistedIds) {
+        const escaped = escapeRegExp(id);
+        const celRef = new RegExp(`\\$\\{[^}]*?(?<![A-Za-z0-9_$])${escaped}\\.`);
+        const markerRef = new RegExp(`__KUBERNETES_REF_${escaped}_`);
+        if (celRef.test(rgdYaml) || markerRef.test(rgdYaml))
+            return id;
+    }
+    return undefined;
+}
+/**
+ * Reject a KRO instance that would own the Namespace containing its own CR.
+ *
+ * KRO deletes graph children before clearing the owner CR's finalizer. If a
+ * child Namespace contains that CR, namespace termination can strand the
+ * finalizer permanently. Re-executing with the concrete instance spec makes
+ * this check survive nested compositions and schema-driven namespace names.
+ *
+ * The KRO factory now HOISTS every owned Namespace OUT of the RGD graph (emitting
+ * it as a SIBLING resource created deps-first and torn down after the RGD) before
+ * calling this guard, and passes the hoisted names in `hoistedNamespaces`. Because
+ * a hoisted namespace is no longer a graph child, deleting the instance can't GC
+ * it, so the common create-namespace-and-put-the-instance-in-it pattern is safe —
+ * this guard skips it. The guard remains the defense-in-depth net for HAND-AUTHORED
+ * graphs that hoisting does not cover: an owned Namespace whose name can't be proven
+ * safe (fails closed), and a caller who places `instanceNamespace` on a namespace
+ * the composition owns WITHOUT hoisting it (opts into the unsafe pattern).
+ */
+export function assertKroInstanceNamespaceOwnershipSafe(input) {
+    const { owned, unresolved } = detectOwnedNamespaces(input);
+    const unresolvedId = unresolved[0];
+    if (unresolvedId !== undefined) {
+        throw new TypeKroError(`Cannot prove KRO instance namespace '${input.instanceNamespace}' is safe because active owned Namespace '${unresolvedId}' in composition '${input.compositionName}' has a name that cannot be evaluated from the concrete spec. ` +
+            'Use a concrete or schema-only CEL Namespace name, or move the KRO instance to a control-plane namespace whose safety can be established.', 'UNRESOLVED_KRO_NAMESPACE_OWNERSHIP', {
+            composition: input.compositionName,
+            instanceNamespace: input.instanceNamespace,
+            resourceId: unresolvedId,
+            mode: 'kro',
+        });
+    }
+    // An owned namespace the factory has HOISTED out of the graph is safe: it is no
+    // longer a graph child, so deleting the instance can never garbage-collect it.
+    if (owned.has(input.instanceNamespace) && input.hoistedNamespaces?.has(input.instanceNamespace)) {
+        return;
+    }
+    if (owned.has(input.instanceNamespace)) {
+        throw new TypeKroError(`KRO instance namespace '${input.instanceNamespace}' cannot also be an owned Namespace in composition '${input.compositionName}'. ` +
+            'Place the KRO instance in a separate control-plane namespace so deleting it cannot terminate the namespace containing its own finalizer.', 'UNSAFE_KRO_NAMESPACE_OWNERSHIP', {
+            composition: input.compositionName,
+            instanceNamespace: input.instanceNamespace,
+            ownedNamespace: input.instanceNamespace,
+            mode: 'kro',
+        });
     }
 }
 /** Validate the fixed registry namespace used by a shared singleton owner. */

package/dist/core/deployment/kro-instance-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"kro-instance-safety.js","sourceRoot":"","sources":["../../../src/core/deployment/kro-instance-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAkBxE,SAAS,eAAe,CACtB,SAAyC;IAEzC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAuB;IACnE,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC3E,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAiB,EAAE,EAAE;QACnE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACpD,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA6C;IAE7C,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,wBAAwB,CAAC,uBAAuB,KAAK,CAAC,eAAe,EAAE,EAAE;QACvF,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,yBAAyB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAmC,CAAC;IACrF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAuB;IAC9D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7C,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,UAAU,GAAG,gEAAgE,CAAC,IAAI,CACtF,UAAU,CACX,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA4B,EAAE,IAAuB;IAClF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAElE,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,UAAU,GACd,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzF,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CACrD,KAA6C;IAE7C,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAE3D,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,YAAY,CACpB,wCAAwC,KAAK,CAAC,iBAAiB,6CAA6C,UAAU,qBAAqB,KAAK,CAAC,eAAe,gEAAgE;gBAC9N,0IAA0I,EAC5I,oCAAoC,EACpC;gBACE,WAAW,EAAE,KAAK,CAAC,eAAe;gBAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,UAAU;gBACV,IAAI,EAAE,KAAK;aACZ,CACF,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC/C,MAAM,IAAI,YAAY,CACpB,2BAA2B,KAAK,CAAC,iBAAiB,uDAAuD,KAAK,CAAC,eAAe,KAAK;gBACjI,0IAA0I,EAC5I,gCAAgC,EAChC;gBACE,WAAW,EAAE,KAAK,CAAC,eAAe;gBAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,cAAc;gBACd,UAAU;gBACV,IAAI,EAAE,KAAK;aACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0CAA0C,CACxD,UAAqC;IAErC,MAAM,WAAW,GAAG,UAAU,CAAC,WAAmD,CAAC;IACnF,uCAAuC,CAAC;QACtC,eAAe,EAAE,WAAW,CAAC,IAAI,IAAI,iBAAiB;QACtD,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"kro-instance-safety.js","sourceRoot":"","sources":["../../../src/core/deployment/kro-instance-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAI5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAgCxE,SAAS,eAAe,CACtB,SAAyC;IAEzC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,SAAiB;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAuB;IAC1E,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC3E,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACpE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAiB,EAAE,EAAE;QACnE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACpD,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAc,EACd,IAAuB;IAEvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACrE,oFAAoF;QACpF,kFAAkF;QAClF,gFAAgF;QAChF,mFAAmF;QACnF,gFAAgF;QAChF,+EAA+E;QAC/E,MAAM,gBAAgB,GACpB,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;YACpD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,gBAAgB,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBACpD,IACE,OAAO,SAAS,KAAK,QAAQ;oBAC7B,OAAO,SAAS,KAAK,SAAS;oBAC9B,OAAO,SAAS,KAAK,QAAQ,EAC7B,CAAC;oBACD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iFAAiF;YACnF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,CAAC;IACD,OAAO,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAwE;IAExE,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,wBAAwB,CAAC,uBAAuB,KAAK,CAAC,eAAe,EAAE,EAAE;QACvF,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,yBAAyB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAmC,CAAC;IACrF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAuB;IAC9D,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7C,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAEzC,MAAM,UAAU,GAAG,gEAAgE,CAAC,IAAI,CACtF,UAAU,CACX,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnD,OAAO,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,IAAuB;IAEvB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAElE,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,UAAU,GACd,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzF,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AACtF,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAwE;IAExE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAE3D,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAwE;IAExE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAwE;IAExE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA6B;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,KAAK,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,KAAK,IAAI;YAAE,SAAS;QAC9D,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAa,CAAC;AACjE,CAAC;AA6BD,SAAS,yBAAyB,CAAC,SAAkB;IACnD,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,4EAA4E;QAC5E,IAAI,SAAS,CAAC,UAAU,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC;QAC/F,MAAM,OAAO,GAAG,UAAU,SAAS,EAAE,CAAC;QACtC,OAAO;YACL,OAAO;YACP,MAAM,EAAE,+BAA+B,SAAS,IAAI;YACpD,GAAG,EAAE,iBAAiB,CAAC,OAAO,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAC5E,iFAAiF;QACjF,MAAM,WAAW,GAAG,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO;YACL,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,+BAA+B,WAAW,IAAI,CAAC,CAAC,CAAC,SAAS;YAChF,GAAG,EAAE,SAAS;SACf,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,4DAA4D;QAC5D,MAAM,WAAW,GAAG,0DAA0D,CAAC,IAAI,CACjF,SAAS,CAAC,IAAI,EAAE,CACjB,CAAC;QACF,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,UAAU,SAAS,EAAE;gBAC9B,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE;gBACxB,GAAG,EAAE,iBAAiB,CAAC,UAAU,SAAS,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;QACD,gFAAgF;QAChF,2CAA2C;QAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,0DAA0D;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAQ,EACR,OAAqC;IAErC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,+DAA+D;IAC/D,2EAA2E;IAC3E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,iBAAiB,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,MAAM,CAAC,qBAAqB,YAAY,CAAC,EAAE,CAAC,uBAAuB,EAAE,GAAG,CAAC;QACtF,WAAW,EAAE,CAAC,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;IACJ,MAAM,oBAAoB,GAAG,CAAC,GAAG,KAAK,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,oBAAoB,YAAY,CAAC,EAAE,CAAC,oBAAoB,EAAE,GAAG,CAAC;QAClF,+EAA+E;QAC/E,WAAW,EAAE,CAAC,CAAC,MAAO;KACvB,CAAC,CAAC,CAAC;IAEN,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;QAC9C,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,wEAAwE;QACxE,+BAA+B;QAC/B,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,iBAAiB;YACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QAChD,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,oBAAoB;YACzD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,GAAY,EAAW,EAAE;QAC7C,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,yEAAyE;YACzE,8EAA8E;YAC9E,6DAA6D;YAC7D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChD,OAAO,SAAS,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,SAAS,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;gBACvC,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;gBACzE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,SAAS,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;gBACvC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;YACxB,CAAC;YACD,OAAO,OAAO,CAAC,CAAC,CAAE,IAAgB,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,YAAY,CAAC,KAAK,CAAM,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAAmD,EACnD,OAAqC;IAErC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,oDAAoD;QACxF,MAAM,SAAS,GAAG,kCAAkC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,SAAS,KAAK,KAAK;YAAE,SAAS,CAAC,wCAAwC;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,wEAAwE;QACxE,IAAI,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3F,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,SAAS,GAAG,CAAC,CAAS,EAAW,EAAE,CACvC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACvE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kCAAkC,CAAC,KAAc;IACxD,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAW,EAAE;QAC9C,MAAM,MAAM,GAAG,mEAAmE,CAAC;QACnF,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;QACD,MAAM,SAAS,GAAG,sCAAsC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC;IACrE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC,CAC/C,cAAmD,EACnD,OAAqC,EACrC,eAAuB;IAEvB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,YAAY,CACpB,gBAAgB,eAAe,kDAAkD;QAC/E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D;QACtF,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,yFAAyF,EAC3F,6BAA6B,EAC7B,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,SAAY,EACZ,OAAqC;IAErC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,2EAA2E;YAC3E,sEAAsE;YACtE,oBAAoB,CAAC,QAAkB,EAAE,SAAmB,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,UAA+B;IAE/B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,oBAAoB,OAAO,GAAG,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uCAAuC,CACrD,KAA6C;IAE7C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE3D,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,wCAAwC,KAAK,CAAC,iBAAiB,6CAA6C,YAAY,qBAAqB,KAAK,CAAC,eAAe,gEAAgE;YAChO,0IAA0I,EAC5I,oCAAoC,EACpC;YACE,WAAW,EAAE,KAAK,CAAC,eAAe;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,UAAU,EAAE,YAAY;YACxB,IAAI,EAAE,KAAK;SACZ,CACF,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChG,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CACpB,2BAA2B,KAAK,CAAC,iBAAiB,uDAAuD,KAAK,CAAC,eAAe,KAAK;YACjI,0IAA0I,EAC5I,gCAAgC,EAChC;YACE,WAAW,EAAE,KAAK,CAAC,eAAe;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,iBAAiB;YACvC,IAAI,EAAE,KAAK;SACZ,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0CAA0C,CACxD,UAAqC;IAErC,MAAM,WAAW,GAAG,UAAU,CAAC,WAAmD,CAAC;IACnF,uCAAuC,CAAC;QACtC,eAAe,EAAE,WAAW,CAAC,IAAI,IAAI,iBAAiB;QACtD,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAC;AACL,CAAC"}