@agent-beam/beam 0.2.34 → 0.2.35

package/dist/monitor-pause.js

@@ -0,0 +1,510 @@
+import { isAuthPath, isLlmPath } from "./monitor-rules.js";
+export const PAUSE_SCOPES = ["all", "auth", "llm"];
+export const PAUSE_MODES = ["off", "dry_run", "auto"];
+export const DEFAULT_PAUSE_SETTINGS = { mode: "off", allowlist: [], maxActive: 500, burst: 50 };
+const ALLOW = Object.freeze({ paused: false });
+const MINUTE = 60_000;
+const DAY = 24 * 60 * MINUTE;
+export const MAX_AUTO_PAUSE_MS = DAY;
+const BURST_WINDOW_MS = 10 * MINUTE;
+const BREAKER_MS = 30 * MINUTE;
+// After an admin lifts a pause, the sender isn't paused automatically again for this long.
+const LIFTED_GRACE_MS = DAY;
+/**
+ * Detections that pause their sender automatically, and for how long the first time. A repeat
+ * within a day pauses for four times as long, up to a day. Detections from a single request are
+ * left alone unless they're critical exploits that weren't refused: one odd request is rarely
+ * worth refusing someone, a pattern is.
+ */
+export const AUTO_PAUSES = {
+    "app.auth_bruteforce": { scope: "auth", minutes: 15, label: "repeated failed sign-ins", by: "ip" },
+    "llm.denial_of_wallet": { scope: "llm", minutes: 15, label: "LLM request flood", by: "sender" },
+    "llm.token_spend": { scope: "llm", minutes: 15, label: "unusual LLM spend", by: "sender" },
+    "signal.path_walk": { scope: "all", minutes: 60, label: "walking the app's paths", by: "ip" },
+    "signal.probe_hit": { scope: "all", minutes: 60, label: "scan found a live path", by: "ip" },
+};
+const EXPLOIT_PAUSE = { scope: "all", minutes: 60, label: "critical exploit attempt", by: "ip" };
+/** How a finding pauses its sender, or null when it doesn't. */
+export function autoPauseFor(finding) {
+    if (finding.rollup)
+        return null;
+    const listed = AUTO_PAUSES[finding.ruleId];
+    if (listed)
+        return listed;
+    const outcome = finding.request?.outcome;
+    if (finding.severity === "critical" && finding.category === "exploit" && finding.source === "http" && outcome !== "blocked" && outcome !== "not_applicable")
+        return EXPLOIT_PAUSE;
+    return null;
+}
+/** An IPv4 or IPv6 address as bytes (IPv4-mapped IPv6 is read as IPv4), or null. */
+export function parseIp(text) {
+    if (typeof text !== "string")
+        return null;
+    let s = text.trim();
+    if (!s || s.length > 64)
+        return null;
+    if (s.startsWith("["))
+        s = s.slice(1, s.indexOf("]") > 0 ? s.indexOf("]") : undefined);
+    s = s.replace(/%[\w.-]+$/, ""); // zone id
+    const v4 = s.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (v4) {
+        const bytes = v4.slice(1).map(Number);
+        return bytes.every(b => b <= 255) ? { v: 4, bytes } : null;
+    }
+    if (!/^[0-9a-fA-F:.]+$/.test(s) || !s.includes(":"))
+        return null;
+    let tail = [];
+    const lastColon = s.lastIndexOf(":");
+    const last = s.slice(lastColon + 1);
+    if (last.includes(".")) {
+        // An IPv4 tail (::ffff:192.0.2.1, 64:ff9b::192.0.2.1) is the last two groups.
+        const embedded = /^\d{1,3}(?:\.\d{1,3}){3}$/.test(last) ? parseIp(last) : null;
+        if (!embedded)
+            return null;
+        tail = [(embedded.bytes[0] << 8) | embedded.bytes[1], (embedded.bytes[2] << 8) | embedded.bytes[3]];
+        s = s.slice(0, lastColon + 1);
+        if (!s.endsWith("::"))
+            s = s.slice(0, -1);
+    }
+    const halves = s.split("::");
+    if (halves.length > 2)
+        return null;
+    const part = (h) => (h ? h.split(":") : []);
+    const head = part(halves[0]);
+    const back = halves.length === 2 ? part(halves[1]) : [];
+    if (![...head, ...back].every(g => /^[0-9a-fA-F]{1,4}$/.test(g)))
+        return null;
+    const groups = 8 - tail.length;
+    const missing = groups - head.length - back.length;
+    if (halves.length === 1 ? missing !== 0 : missing < 1)
+        return null;
+    const words = [...head.map(g => parseInt(g, 16)), ...new Array(halves.length === 2 ? missing : 0).fill(0), ...back.map(g => parseInt(g, 16)), ...tail];
+    if (words.length !== 8)
+        return null;
+    const bytes = words.flatMap(w => [w >> 8, w & 0xff]);
+    // ::ffff:a.b.c.d is an IPv4 client on a dual-stack socket.
+    if (bytes.slice(0, 10).every(b => b === 0) && bytes[10] === 0xff && bytes[11] === 0xff)
+        return { v: 4, bytes: bytes.slice(12) };
+    return { v: 6, bytes };
+}
+function parseRange(text) {
+    const [addr, len, extra] = text.trim().split("/");
+    if (extra !== undefined)
+        return null;
+    const ip = parseIp(addr);
+    if (!ip)
+        return null;
+    const max = ip.v === 4 ? 32 : 128;
+    const bits = len === undefined ? max : /^\d{1,3}$/.test(len) ? Number(len) : -1;
+    return bits >= 0 && bits <= max ? { ...ip, bits } : null;
+}
+/** A range in one canonical spelling: host bits cleared, IPv6 in its shortest form. */
+function formatRange(range) {
+    const bytes = range.bytes.map((b, i) => {
+        const bit = i * 8;
+        if (bit >= range.bits)
+            return 0;
+        const take = Math.min(8, range.bits - bit);
+        return b & ((0xff << (8 - take)) & 0xff);
+    });
+    if (range.v === 4)
+        return `${bytes.join(".")}/${range.bits}`;
+    const words = [];
+    for (let i = 0; i < 16; i += 2)
+        words.push((bytes[i] << 8) | bytes[i + 1]);
+    return `${formatV6(words)}/${range.bits}`;
+}
+/** Eight 16-bit words as RFC 5952 text: lowercase, the longest run of two or more zero words as "::". */
+function formatV6(words) {
+    let best = -1, bestLen = 0;
+    for (let i = 0; i < 8;) {
+        if (words[i] !== 0) {
+            i++;
+            continue;
+        }
+        let j = i;
+        while (j < 8 && words[j] === 0)
+            j++;
+        if (j - i > bestLen && j - i >= 2) {
+            best = i;
+            bestLen = j - i;
+        }
+        i = j;
+    }
+    const hex = words.map(w => w.toString(16));
+    if (best < 0)
+        return hex.join(":");
+    return `${hex.slice(0, best).join(":")}::${hex.slice(best + bestLen).join(":")}`;
+}
+function inRange(ip, range) {
+    if (ip.v !== range.v)
+        return false;
+    for (let bit = 0; bit < range.bits; bit += 8) {
+        const take = Math.min(8, range.bits - bit);
+        const mask = (0xff << (8 - take)) & 0xff;
+        if ((ip.bytes[bit / 8] & mask) !== (range.bytes[bit / 8] & mask))
+            return false;
+    }
+    return true;
+}
+// Private, loopback, link-local, shared (CGNAT) and unspecified ranges: usually a proxy, a load
+// balancer or the app's own network. Pausing one could refuse everyone behind it.
+const PROTECTED = ["0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.168.0.0/16", "255.255.255.255/32", "::/128", "::1/128", "fc00::/7", "fe80::/10"]
+    .map(r => parseRange(r));
+export function isProtectedIp(ip) {
+    const parsed = parseIp(ip);
+    return !parsed || PROTECTED.some(r => inRange(parsed, r));
+}
+/**
+ * What a pause on this address is keyed by: the address itself for IPv4, the /64 for IPv6 (one
+ * customer's network: rotating within it is free), or null when it isn't an address.
+ */
+export function pauseTarget(ip) {
+    const parsed = parseIp(ip);
+    if (!parsed)
+        return null;
+    if (parsed.v === 4)
+        return parsed.bytes.join(".");
+    return formatRange({ ...parsed, bits: 64 });
+}
+/** user:<id> for a user id, or null. */
+export function userTarget(user) {
+    const id = typeof user === "string" ? user.trim().slice(0, 80) : "";
+    return id ? `user:${id}` : null;
+}
+/** A target as typed by a person (an address, a CIDR range, or user:<id>), normalized; or null. */
+export function normalizeTarget(text) {
+    const s = text.trim();
+    if (/^user:/i.test(s))
+        return userTarget(s.slice(5));
+    if (!s.includes("/"))
+        return pauseTarget(s);
+    const range = parseRange(s);
+    if (!range || range.bits < (range.v === 4 ? 16 : 32))
+        return null; // nothing wider than a /16 or a /32
+    if (range.v === 6 && range.bits === 64)
+        return pauseTarget(s.split("/")[0]);
+    if (range.v === 4 && range.bits === 32)
+        return range.bytes.join(".");
+    return formatRange(range);
+}
+function compileAllowlist(entries) {
+    const ranges = [];
+    const users = new Set();
+    for (const entry of entries.slice(0, 1000)) {
+        if (typeof entry !== "string")
+            continue;
+        if (/^user:/i.test(entry.trim())) {
+            const u = userTarget(entry.trim().slice(5));
+            if (u)
+                users.add(u);
+            continue;
+        }
+        const range = parseRange(entry);
+        if (range)
+            ranges.push(range);
+    }
+    return { ranges, users };
+}
+/** Pauses on a range wider than one sender (an admin's CIDR pause), to test addresses against. */
+function rangeTargets(map) {
+    const out = [];
+    for (const pause of map.values()) {
+        if (!pause.target.includes("/") || pause.target.endsWith("::/64"))
+            continue;
+        const range = parseRange(pause.target);
+        if (range)
+            out.push({ range, pause });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------------------------
+// Trusted client address
+// ---------------------------------------------------------------------------------------------
+/**
+ * The client address of a request, when it can be trusted enough to pause: one the client can't
+ * forge. Platforms that set or overwrite the header (Cloudflare, Vercel, Fly.io) are read
+ * directly. Otherwise the address the app passed is checked against X-Forwarded-For: the first
+ * entry of a list is whatever the client sent, so it's never trusted, while the last entry (added
+ * by the app's own proxy), the only entry, or an address not in the header (the socket's, or
+ * Express's req.ip with trust proxy) is. Returns null when the address can't be trusted.
+ */
+export function trustedRequestIp(ip, header, platform) {
+    const valid = (v) => (parseIp(v) ? String(v).trim() : null);
+    if (platform.cloudflare)
+        return valid(header("cf-connecting-ip")) ?? valid(ip);
+    if (platform.fly)
+        return valid(header("fly-client-ip")) ?? valid(ip);
+    // Vercel overwrites X-Forwarded-For and sets X-Real-IP; neither carries what the client sent.
+    if (platform.vercel)
+        return valid(header("x-real-ip")) ?? valid(header("x-forwarded-for")?.split(",")[0]) ?? valid(ip);
+    const given = valid(ip);
+    if (!given || platform.trustGiven)
+        return given;
+    const forwarded = header("x-forwarded-for")?.split(",").map(s => s.trim()).filter(Boolean) ?? [];
+    if (forwarded.length < 2)
+        return given;
+    const at = forwarded.indexOf(given);
+    return at === -1 || at === forwarded.length - 1 ? given : null;
+}
+const key = (target, scope) => `${target}\0${scope}`;
+/**
+ * The pauses one app instance knows about: those it made itself (local) and those from the
+ * workspace (remote: admins' pauses, and other instances' when pausing is on). Bounded.
+ */
+export class PauseBook {
+    opts;
+    local = new Map();
+    remote = new Map();
+    remoteRanges = [];
+    lifted = new Map();
+    strikes = new Map();
+    recent = [];
+    breakerUntil = 0;
+    capNoticeAt = 0;
+    reports = [];
+    allow = { ranges: [], users: new Set() };
+    maintainedMinute = -1;
+    changes = 0;
+    settings = { ...DEFAULT_PAUSE_SETTINGS };
+    /** Goes up whenever a pause is made here, so a caller can skip re-checking when nothing changed. */
+    get version() { return this.changes; }
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    now() { return this.opts.now?.() ?? Date.now(); }
+    get size() {
+        return { local: this.local.size, remote: this.remote.size, strikes: this.strikes.size, reports: this.reports.length };
+    }
+    /** The workspace's settings, its active pauses, and pauses an admin lifted (from the config). */
+    configure(settings, pauses, lifted) {
+        const s = settings && typeof settings === "object" ? settings : {};
+        this.settings = {
+            mode: PAUSE_MODES.includes(s.mode) ? s.mode : "off",
+            allowlist: Array.isArray(s.allowlist) ? s.allowlist.filter((e) => typeof e === "string").slice(0, 1000) : [],
+            maxActive: typeof s.maxActive === "number" && s.maxActive >= 0 ? Math.min(s.maxActive, 5000) : DEFAULT_PAUSE_SETTINGS.maxActive,
+            burst: typeof s.burst === "number" && s.burst >= 1 ? Math.min(s.burst, 1000) : DEFAULT_PAUSE_SETTINGS.burst,
+        };
+        this.allow = compileAllowlist(this.settings.allowlist);
+        const now = this.now();
+        this.remote.clear();
+        for (const p of Array.isArray(pauses) ? pauses.slice(0, 5000) : []) {
+            const pause = readPause(p, now);
+            if (pause)
+                this.remote.set(key(pause.target, pause.scope), pause);
+        }
+        this.remoteRanges = rangeTargets(this.remote);
+        for (const l of Array.isArray(lifted) ? lifted.slice(0, 5000) : []) {
+            const target = typeof l?.target === "string" ? l.target : null;
+            const at = typeof l?.at === "string" ? Date.parse(l.at) : Number.NaN;
+            if (!target || !Number.isFinite(at))
+                continue;
+            if (at + LIFTED_GRACE_MS > now)
+                this.lifted.set(target, at + LIFTED_GRACE_MS);
+            for (const scope of PAUSE_SCOPES)
+                this.local.delete(key(target, scope));
+        }
+        if (this.lifted.size > 5000)
+            this.lifted = new Map([...this.lifted].slice(-5000));
+        // Turned down in the dashboard: this instance's own pauses stop being enforced too. Turned up
+        // to auto: dry runs are dropped rather than enforced, so a pause always follows fresh evidence.
+        for (const [k, pause] of this.local) {
+            if (this.settings.mode === "off" || (this.settings.mode === "auto" && pause.dryRun))
+                this.local.delete(k);
+            else if (this.settings.mode === "dry_run")
+                pause.dryRun = true;
+        }
+    }
+    /** Whether the sender (address and/or user) is paused for this request. Never throws. */
+    check(who, where = {}) {
+        try {
+            const now = this.now();
+            this.maintain(now);
+            if (!this.local.size && !this.remote.size)
+                return ALLOW;
+            const scopes = ["all"];
+            if (where.path !== undefined && isAuthPath(where.path))
+                scopes.push("auth");
+            if (where.llm || (where.path !== undefined && isLlmPath(where.path)))
+                scopes.push("llm");
+            const targets = [];
+            const parsed = parseIp(who.ip);
+            const ipTarget = pauseTarget(who.ip);
+            if (ipTarget && !this.allowedIp(parsed))
+                targets.push(ipTarget);
+            const user = userTarget(who.user);
+            if (user && !this.allow.users.has(user))
+                targets.push(user);
+            let dry = null;
+            for (const target of targets)
+                for (const scope of scopes) {
+                    const found = this.find(target, scope, now);
+                    if (found && !found.dryRun)
+                        return verdictFor(found, now);
+                    if (found)
+                        dry ??= found;
+                }
+            // A pause on a range (an admin's, from the dashboard) covers every address in it.
+            if (parsed && this.remoteRanges.length && !this.allowedIp(parsed))
+                for (const { range, pause } of this.remoteRanges)
+                    if (scopes.includes(pause.scope) && pause.until > now && !pause.dryRun && inRange(parsed, range))
+                        return verdictFor(pause, now);
+            return dry ? { ...verdictFor(dry, now), paused: false, wouldPause: true } : ALLOW;
+        }
+        catch {
+            return ALLOW;
+        }
+    }
+    find(target, scope, now) {
+        const k = key(target, scope);
+        const local = this.local.get(k);
+        const remote = this.remote.get(k);
+        const live = [local, remote].filter((p) => Boolean(p && p.until > now));
+        return live.find(p => !p.dryRun) ?? live[0];
+    }
+    allowedIp(ip) { return this.allow.ranges.some(r => inRange(ip, r)); }
+    /**
+     * A finding was raised (or repeated) about a sender. Pauses the sender when the finding calls
+     * for it and the mode allows. `who` holds only what can be trusted: an address from
+     * trustedRequestIp, or the app's own user id. Returns the new pause, or null.
+     */
+    consider(finding, who) {
+        try {
+            if (this.settings.mode === "off")
+                return null;
+            const rule = autoPauseFor(finding);
+            if (!rule)
+                return null;
+            const now = this.now();
+            this.maintain(now);
+            const user = rule.by === "sender" ? userTarget(who.user) : null;
+            const ip = user ? null : pauseTarget(who.ip);
+            const target = user ?? ip;
+            if (!target)
+                return null;
+            if (ip && (isProtectedIp(who.ip) || this.allowedIp(parseIp(who.ip))))
+                return null;
+            if (user && this.allow.users.has(user))
+                return null;
+            if ((this.lifted.get(target) ?? 0) > now)
+                return null;
+            for (const scope of rule.scope === "all" ? ["all"] : ["all", rule.scope]) {
+                const existing = this.find(target, scope, now);
+                if (existing && (!existing.dryRun || this.settings.mode === "dry_run"))
+                    return null;
+            }
+            if (now < this.breakerUntil)
+                return null;
+            this.recent = this.recent.filter(t => t > now - BURST_WINDOW_MS);
+            if (this.recent.length >= this.settings.burst) {
+                this.breakerUntil = now + BREAKER_MS;
+                this.opts.onNotice?.(`${this.recent.length} senders were paused within 10 minutes, the most this app pauses in a burst. Automatic pausing is stopped for 30 minutes so a misread can't refuse real users. If this is a large attack, turn on your CDN's attack mode.`, "breaker");
+                return null;
+            }
+            let active = 0;
+            for (const p of this.local.values())
+                if (p.until > now)
+                    active++;
+            if (active >= this.settings.maxActive) {
+                if (now - this.capNoticeAt > 60 * MINUTE) {
+                    this.capNoticeAt = now;
+                    this.opts.onNotice?.(`${active} senders are paused, the most this app pauses at once. New automatic pauses wait until some expire.`, "cap");
+                }
+                return null;
+            }
+            const prior = this.strikes.get(target);
+            const count = prior && prior.last > now - DAY ? prior.count + 1 : 1;
+            this.strikes.delete(target);
+            this.strikes.set(target, { count, last: now });
+            if (this.strikes.size > 10_000)
+                this.strikes.delete(this.strikes.keys().next().value);
+            const ms = Math.min(MAX_AUTO_PAUSE_MS, rule.minutes * MINUTE * 4 ** (count - 1));
+            const pause = {
+                target, scope: rule.scope, until: now + ms, source: "auto", dryRun: this.settings.mode !== "auto",
+                reason: `${rule.label[0].toUpperCase()}${rule.label.slice(1)} from ${target}${count > 1 ? ` (again: pause ${count})` : ""}`,
+                ruleId: finding.ruleId, findingId: finding.id,
+            };
+            this.local.set(key(target, rule.scope), pause);
+            this.changes++;
+            this.recent.push(now);
+            if (this.reports.length >= 200)
+                this.reports.shift();
+            this.reports.push({
+                target, scope: pause.scope, until: new Date(pause.until).toISOString(), reason: pause.reason, ruleId: finding.ruleId,
+                findingId: finding.id, source: "auto", dryRun: Boolean(pause.dryRun), strike: count,
+            });
+            return pause;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** New pauses to send to the workspace; taken once. */
+    takeReports() { return this.reports.splice(0); }
+    /** Puts reports back after a failed send (newest kept when over the cap). */
+    returnReports(reports) { this.reports = [...reports, ...this.reports].slice(-200); }
+    /** Every pause in force now (not dry runs), local and remote, for a deny list. */
+    active() {
+        const now = this.now();
+        const out = new Map();
+        for (const map of [this.remote, this.local])
+            for (const [k, p] of map)
+                if (p.until > now && !p.dryRun && !out.has(k))
+                    out.set(k, p);
+        return [...out.values()].filter(p => !this.isAllowlistedTarget(p.target));
+    }
+    isAllowlistedTarget(target) {
+        if (target.startsWith("user:"))
+            return this.allow.users.has(target);
+        const parsed = parseIp(target.split("/")[0]);
+        return Boolean(parsed && !target.includes("/") && this.allowedIp(parsed));
+    }
+    /** Once a minute: forget expired pauses, old strikes and lifted grace periods. */
+    maintain(now) {
+        const minute = Math.floor(now / MINUTE);
+        if (minute === this.maintainedMinute)
+            return;
+        this.maintainedMinute = minute;
+        for (const [k, p] of this.local)
+            if (p.until <= now)
+                this.local.delete(k);
+        for (const [k, p] of this.remote)
+            if (p.until <= now)
+                this.remote.delete(k);
+        for (const [t, s] of this.strikes)
+            if (s.last <= now - DAY)
+                this.strikes.delete(t);
+        for (const [t, until] of this.lifted)
+            if (until <= now)
+                this.lifted.delete(t);
+    }
+}
+function verdictFor(pause, now) {
+    return {
+        paused: true, scope: pause.scope, reason: pause.reason, target: pause.target,
+        until: new Date(pause.until).toISOString(), retryAfter: Math.max(1, Math.ceil((pause.until - now) / 1000)),
+    };
+}
+/** A pause from the config, validated: unknown, expired or malformed ones are dropped. */
+function readPause(value, now) {
+    if (!value || typeof value !== "object")
+        return null;
+    const v = value;
+    const target = typeof v.target === "string" ? normalizeTarget(v.target) : null;
+    const scope = PAUSE_SCOPES.includes(v.scope) ? v.scope : "all";
+    const until = typeof v.until === "string" ? Date.parse(v.until) : Number.NaN;
+    if (!target || !Number.isFinite(until) || until <= now)
+        return null;
+    return {
+        target, scope, until: Math.min(until, now + 30 * DAY),
+        reason: typeof v.reason === "string" ? v.reason.slice(0, 200) : "Paused in the dashboard",
+        ruleId: typeof v.ruleId === "string" ? v.ruleId.slice(0, 100) : undefined,
+        source: v.source === "auto" ? "auto" : "manual",
+        dryRun: v.dryRun === true,
+    };
+}
+/** The body an app returns to a paused sender: generic, so it tells an attacker nothing about why. */
+export function pausedBody() {
+    return JSON.stringify({ error: "Too many requests. Try again later." });
+}
+//# sourceMappingURL=monitor-pause.js.map

package/dist/monitor-pause.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor-pause.js","sourceRoot":"","sources":["../src/monitor-pause.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI3D,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,WAAW,GAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AA+BnE,MAAM,CAAC,MAAM,sBAAsB,GAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAe/G,MAAM,KAAK,GAAY,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAY,CAAC;AAEnE,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,2FAA2F;AAC3F,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAA+F;IACrH,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,IAAI,EAAE;IAClG,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE;IAC/F,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE;IAC1F,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,IAAI,EAAE;IAC7F,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,IAAI,EAAE;CAC7F,CAAC;AACF,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,KAAc,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;AAEnH,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,OAAmG;IAC9H,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,gBAAgB;QACzJ,OAAO,aAAa,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,oFAAoF;AACpF,MAAM,UAAU,OAAO,CAAC,IAA+B;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU;IAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACnE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACxG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,KAAK,CAAS,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/J,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,2DAA2D;IAC3D,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IAChI,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAGD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AACD,uFAAuF;AACvF,SAAS,WAAW,CAAC,KAAY;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,GAAG,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AACD,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAe;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACvB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,IAAI,GAAG,CAAC,CAAC;YAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QACjE,CAAC,GAAG,CAAC,CAAC;IACR,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACnF,CAAC;AACD,SAAS,OAAO,CAAC,EAAM,EAAE,KAAY;IACnC,IAAI,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,kFAAkF;AAClF,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC;KACnM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;AAC5B,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,EAA6B;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,UAAU,CAAC,IAA+B;IACxD,MAAM,EAAE,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,oCAAoC;IACvG,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAGD,SAAS,gBAAgB,CAAC,OAAiB;IACzC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,kGAAkG;AAClG,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,yBAAyB;AACzB,gGAAgG;AAEhG;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAA6B,EAC7B,MAA4C,EAC5C,QAAyF;IAEzF,MAAM,KAAK,GAAG,CAAC,CAA4B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,QAAQ,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,8FAA8F;IAC9F,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAYD,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,KAAiB,EAAE,EAAE,CAAC,GAAG,MAAM,KAAK,KAAK,EAAE,CAAC;AAEzE;;;GAGG;AACH,MAAM,OAAO,SAAS;IAkBS;IAjBrB,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAC1D,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAClC,YAAY,GAAqC,EAAE,CAAC;IACpD,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC7D,MAAM,GAAa,EAAE,CAAC;IACtB,YAAY,GAAG,CAAC,CAAC;IACjB,WAAW,GAAG,CAAC,CAAC;IAChB,OAAO,GAAkB,EAAE,CAAC;IAC5B,KAAK,GAAc,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACpD,gBAAgB,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC,CAAC;IACpB,QAAQ,GAAkB,EAAE,GAAG,sBAAsB,EAAE,CAAC;IAExD,oGAAoG;IACpG,IAAI,OAAO,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9C,YAA6B,OAAyB,EAAE;QAA3B,SAAI,GAAJ,IAAI,CAAuB;IAAG,CAAC;IAEpD,GAAG,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEjE,IAAI,IAAI;QACN,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACxH,CAAC;IAED,iGAAiG;IACjG,SAAS,CAAC,QAAmD,EAAE,MAAe,EAAE,MAAe;QAC7F,MAAM,CAAC,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG;YACd,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAiB,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,IAAkB,CAAC,CAAC,CAAC,KAAK;YAC/E,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACzH,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,SAAS;YAC/H,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK;SAC5G,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACrE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC9C,IAAI,EAAE,GAAG,eAAe,GAAG,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,eAAe,CAAC,CAAC;YAC9E,KAAK,MAAM,KAAK,IAAI,YAAY;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,8FAA8F;QAC9F,gGAAgG;QAChG,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACjE,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,GAAiD,EAAE,QAA0C,EAAE;QACnG,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,MAAM,GAAiB,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzF,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,GAAG,GAAiB,IAAI,CAAC;YAC7B,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC5C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;wBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC1D,IAAI,KAAK;wBAAE,GAAG,KAAK,KAAK,CAAC;gBAC3B,CAAC;YACH,kFAAkF;YAClF,IAAI,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC/D,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,YAAY;oBAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;wBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACpI,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,MAAc,EAAE,KAAiB,EAAE,GAAW;QACzD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAc,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAEO,SAAS,CAAC,EAAM,IAAa,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F;;;;OAIG;IACH,QAAQ,CAAC,OAAuB,EAAE,GAAiD;QACjF,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAc,CAAC,CAAC,CAAC,CAAC,CAAC,KAAc,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC/C,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;YACtF,CAAC;YACD,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC9C,IAAI,CAAC,YAAY,GAAG,GAAG,GAAG,UAAU,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAClB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,2NAA2N,EAChP,SAAS,CACV,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG;oBAAE,MAAM,EAAE,CAAC;YACjE,IAAI,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACtC,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;oBACzC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;oBACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,qGAAqG,EAAE,KAAK,CAAC,CAAC;gBAC9I,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;YACvF,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACjF,MAAM,KAAK,GAAmC;gBAC5C,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM;gBACjG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5H,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;aAC9C,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACpH,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK;aACpF,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,WAAW,KAAoB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,6EAA6E;IAC7E,aAAa,CAAC,OAAsB,IAAU,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEzG,kFAAkF;IAClF,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG;gBAAE,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpI,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,mBAAmB,CAAC,MAAc;QACxC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,kFAAkF;IAC1E,QAAQ,CAAC,GAAW;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAC7C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;QAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,GAAG,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,KAAK,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAY,EAAE,GAAW;IAC3C,OAAO;QACL,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;QAC5E,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;KAC3G,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,KAAc,EAAE,GAAW;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,KAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC;QACrD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB;QACzF,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/monitor-pipeline.d.ts

@@ -49,6 +49,11 @@ export interface PipelineOptions {
      * are rolled up as not applicable, and its own framework's rules count in full.
      */
     stack?: Stack;
+    /**
+     * Called for every finding raised about a sender, new or a repeat folded into one already
+     * queued (the pause book decides whether to pause them). Errors are ignored.
+     */
+    onRaise?: (finding: MonitorFinding) => void;
 }
 /**
  * A hard cap on detection time per minute, so monitoring can never take more than a fixed share of
@@ -146,6 +151,7 @@ export declare class MonitorPipeline {
     /** Queues a finding produced elsewhere (dependency checks) under its own stable id, once. */
     addFinding(finding: MonitorFinding): boolean;
     private raise;
+    private notify;
     private emitSuppressed;
     private enqueue;
     /**

package/dist/monitor-pipeline.js

@@ -562,6 +562,7 @@ export class MonitorPipeline {
         const existing = this.seen.get(fp);
         if (existing && existing.bucket === bucket) {
             existing.finding.count++; // still queued: the batch carries the new count
+            this.notify(existing.finding);
             return;
         }
         const flood = Math.floor(now / FLOOD_WINDOW_MS);
@@ -573,12 +574,21 @@ export class MonitorPipeline {
         if (this.floodCount >= MAX_NEW_FINDINGS_PER_10_MIN) {
             const worst = this.suppressed && RANK[this.suppressed.severity] >= RANK[partial.severity] ? this.suppressed.severity : partial.severity;
             this.suppressed = { count: (this.suppressed?.count ?? 0) + 1, severity: worst };
+            // Not sent one by one, but a flood is exactly when pausing its senders matters.
+            this.notify({ id: `${fp}-${bucket}`, ...partial, count: 1, firstSeen: new Date(now).toISOString() });
             return;
         }
         this.floodCount++;
         const finding = { id: `${fp}-${bucket}`, ...partial, count: 1, firstSeen: new Date(now).toISOString() };
         this.seen.set(fp, { bucket, finding, at: now });
         this.enqueue(finding);
+        this.notify(finding);
+    }
+    notify(finding) {
+        try {
+            this.opts.onRaise?.(finding);
+        }
+        catch { /* never let a hook break detection */ }
     }
     emitSuppressed() {
         if (!this.suppressed)