@antasphere/chassis-server 1.0.0

package/dist/identity/hub-reconcile.js

@@ -0,0 +1,400 @@
+import { Counter } from 'prom-client';
+import { and, eq, inArray, isNotNull, ne, notInArray, sql } from 'drizzle-orm';
+import { workspaceMembers, workspaces } from '@antasphere/chassis-db';
+import { deleteMembershipGrants } from '../members/removal.js';
+import { projectOrgMembership, projectOrgTeams, projectTeamSeats } from './hub-projection.js';
+export const DEFAULT_FEDERATION_DIALS = {
+    reconcileTtlMs: 10_000,
+    reconcileStaleMaxMs: 15 * 60_000,
+    retryMs: 15_000,
+    orgsTimeoutMs: 1_500,
+    tokenTimeoutMs: 5_000,
+    accessSkewMs: 60_000,
+    // Must cover probe + presentation under the refresh lock (hub-grant.ts
+    // clamps it up if not): 5 s + 5 s + 2 s headroom.
+    lockWatchdogMs: 12_000,
+    orgTeamsTtlMs: 5 * 60_000
+};
+/** Bound the cache — a user-id flood must never balloon memory. */
+const MAX_CACHE_ENTRIES = 10_000;
+export class HubOrgReconciler {
+    deps;
+    /** local userId → pass freshness. */
+    cache = new Map();
+    inFlight = new Map();
+    /** hub org id → its whole team list's freshness (bounded like the user cache). */
+    orgTeams = new Map();
+    now;
+    dials;
+    /** Registered into the Prometheus registry by boot (cloud only). */
+    promMetrics;
+    passes;
+    orgTeamsRefreshes;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? Date.now;
+        this.dials = deps.dials;
+        // registers: [] — boot attaches this to the app registry on cloud; an
+        // oss boot never constructs this class, so the metric never exists there.
+        this.passes = new Counter({
+            name: 'hub_reconcile_passes_total',
+            help: 'Hub org-list reconciliation passes by outcome',
+            labelNames: ['outcome'],
+            registers: []
+        });
+        this.orgTeamsRefreshes = new Counter({
+            name: 'hub_org_teams_refresh_total',
+            help: 'Reads of a hub organization’s whole team list by outcome',
+            labelNames: ['outcome'],
+            registers: []
+        });
+        this.promMetrics = [this.passes, this.orgTeamsRefreshes];
+    }
+    /**
+     * The identity-path read-through: cached per user (~10 s), single-flight,
+     * retry-throttled after failures. Awaits one pass on expiry — the request
+     * that triggered it observes the reconciled state — and NEVER throws.
+     * Returns the windowed verdict the live gate enforces.
+     */
+    async reconcile(localUserId) {
+        const now = this.now();
+        const entry = this.cache.get(localUserId);
+        if (!entry || now - entry.fetchedAt >= this.dials.reconcileTtlMs) {
+            let flight = this.inFlight.get(localUserId);
+            if (!flight) {
+                // Outage throttle: after a FAILED pass (lastAttemptAt advanced past
+                // the last success), at most one re-probe per retryMs — a down hub
+                // costs each user one bounded timeout per window. A successful pass
+                // is never throttled beyond its own TTL.
+                const throttled = entry !== undefined &&
+                    entry.lastAttemptAt > entry.fetchedAt &&
+                    now - entry.lastAttemptAt < this.dials.retryMs;
+                if (!throttled) {
+                    flight = this.startPass(localUserId);
+                }
+            }
+            if (flight)
+                await flight;
+        }
+        return this.verdict(localUserId);
+    }
+    /**
+     * The login-time pass (assertLogin step 3): TTL and throttle deliberately
+     * bypassed — a login is the freshest signal there is, and `login` carries
+     * the callback access token so no refresh is needed. Returns the PASS'S
+     * OWN outcome (not the windowed verdict): the fail-CLOSED login requires
+     * this very pass to have succeeded, never a recent cached one.
+     */
+    async forceReconcile(localUserId, login) {
+        const flight = this.runPass(localUserId, login).finally(() => {
+            if (this.inFlight.get(localUserId) === flight)
+                this.inFlight.delete(localUserId);
+        });
+        // Concurrent cached reconciles join this pass instead of doubling it.
+        this.inFlight.set(localUserId, flight);
+        return flight;
+    }
+    startPass(localUserId) {
+        const flight = this.runPass(localUserId, undefined).finally(() => {
+            if (this.inFlight.get(localUserId) === flight)
+                this.inFlight.delete(localUserId);
+        });
+        this.inFlight.set(localUserId, flight);
+        return flight;
+    }
+    verdict(localUserId) {
+        const entry = this.cache.get(localUserId);
+        const now = this.now();
+        if (entry && entry.lastDefinitive && now - entry.fetchedAt < this.dials.reconcileStaleMaxMs) {
+            // Definitive data within the window. A definitive DEAD grant refuses
+            // immediately (no stale grace — Romain's decision 3); 'ok'/'no_link'
+            // serve on local rows.
+            return entry.lastDefinitive === 'grant_dead' ? { kind: 'grant_dead' } : { kind: 'ok' };
+        }
+        // No definitive pass within the window (or ever, e.g. a replica that
+        // restarted mid-outage) and the hub keeps failing: fail closed.
+        return { kind: 'unavailable' };
+    }
+    async runPass(localUserId, login) {
+        try {
+            const result = await this.deps.client.orgs(localUserId, login);
+            if (result.kind === 'no_link') {
+                // A purely local user: the hub asserts nothing about them, and that
+                // IS the definitive answer. Nothing is swept.
+                //
+                // EXCEPT (CLOUD-1, PRDCT-1356) when the user HOLDS origin='hub'
+                // membership rows: those rows exist only because a hub link once
+                // projected them, so "no link" means the link was SEVERED (an
+                // unlinked account row, a partial cleanup) — and treating that as
+                // the fail-open definitive answer, cached like a success, was the
+                // one way to switch cloud enforcement off permanently. It fails
+                // CLOSED instead, as a dead grant: the gate answers 401
+                // hub_grant_expired, and a browser SSO re-login (which re-links)
+                // heals it. Local/guest rows are untouched — they never reconcile.
+                const [hubRow] = await this.deps.db
+                    .select({ id: workspaceMembers.id })
+                    .from(workspaceMembers)
+                    .where(and(eq(workspaceMembers.userId, localUserId), eq(workspaceMembers.origin, 'hub')))
+                    .limit(1);
+                if (hubRow) {
+                    this.deps.logger.warn({ userId: localUserId }, 'hub org reconcile: no hub link but hub-origin memberships exist — link severed; failing CLOSED');
+                    this.remember(localUserId, 'grant_dead');
+                    this.passes.inc({ outcome: 'link_severed' });
+                    return 'grant_dead';
+                }
+                this.remember(localUserId, 'no_link');
+                this.passes.inc({ outcome: 'no_link' });
+                return 'no_link';
+            }
+            if (result.kind === 'grant_dead') {
+                // Definitive: the grant family is gone. Freshness-wise a real
+                // answer (cached); enforcement is the gate's 401 hub_grant_expired.
+                // Nothing is swept — org truth was not read, only the grant state.
+                this.remember(localUserId, 'grant_dead');
+                this.passes.inc({ outcome: 'grant_dead' });
+                return 'grant_dead';
+            }
+            if (result.kind === 'inconclusive') {
+                // Loudly logged by the client already; retry at the next window.
+                this.remember(localUserId, null);
+                this.passes.inc({ outcome: 'inconclusive' });
+                return 'inconclusive';
+            }
+            // Definitive 200 list — the ONLY thing that may ever mutate state.
+            // Every listed org is kept, suspended ones included (visible but
+            // blocked: the synced hub_status is what refuses their requests);
+            // role-null entries are kept but not projected/synced.
+            const keep = new Set(result.orgs.map((o) => o.id));
+            // Deactivation sweep FIRST (removal must win over projection within
+            // one pass): ONE conditional UPDATE covering exactly the rows the hub
+            // no longer asserts — origin='hub' AND active AND the workspace IS a
+            // projection whose hub org is off the keep-set. local/guest rows and
+            // rows in non-projected workspaces are structurally out of scope.
+            // `is_active = true` in the WHERE makes the flip observable: only the
+            // pass that actually flipped a row audits it — one logical removal
+            // writes ONE member.deactivate row.
+            const keepIds = [...keep];
+            const sweptWorkspaces = this.deps.db
+                .select({ id: workspaces.id })
+                .from(workspaces)
+                .where(keepIds.length > 0
+                ? and(isNotNull(workspaces.centralAccountId), notInArray(workspaces.centralAccountId, keepIds))
+                : isNotNull(workspaces.centralAccountId));
+            // The project grants that rode on a swept membership go WITH it, in the
+            // same transaction. The sweep deactivates the row and never deletes it
+            // (a re-add at the hub reactivates the very same row), so the foreign
+            // key's cascade never fires here: without this delete, a person removed
+            // at the hub and added back later would find every old project grant
+            // waiting. A removal is a removal: a re-add starts with none. (A LOCAL
+            // deactivation by an admin is a pause, not a removal, and keeps them.)
+            const deactivated = await this.deps.db.transaction(async (tx) => {
+                const rows = await tx
+                    .update(workspaceMembers)
+                    .set({ isActive: false })
+                    .where(and(eq(workspaceMembers.userId, localUserId), eq(workspaceMembers.origin, 'hub'), eq(workspaceMembers.isActive, true), inArray(workspaceMembers.workspaceId, sweptWorkspaces)))
+                    .returning({ id: workspaceMembers.id, workspaceId: workspaceMembers.workspaceId });
+                // The grants and the seats go with the membership: the one statement
+                // of what a removal takes, shared with the tool's own removal route.
+                await deleteMembershipGrants(tx, rows.map((row) => ({ memberId: row.id, workspaceId: row.workspaceId, userId: localUserId })), this.deps.onMembershipRemoval);
+                return rows;
+            });
+            for (const row of deactivated) {
+                await this.deps.audit.write({
+                    workspaceId: row.workspaceId,
+                    principal: null,
+                    action: 'member.deactivate',
+                    resourceType: 'member',
+                    resourceId: localUserId,
+                    metadata: { reason: 'hub_reconcile' }
+                });
+                this.deps.logger.info({ userId: localUserId, workspaceId: row.workspaceId }, 'hub reconcile: membership no longer asserted by the hub — local membership deactivated');
+            }
+            // Then project/upsert every well-formed entry (role upserts are
+            // deliberately NOT audited — the login-projection precedent), the
+            // person's team seats in it, and sync the org-level hub_status. One
+            // failing entry logs and moves on: a single bad org must never starve
+            // the others.
+            for (const org of result.orgs) {
+                try {
+                    if (org.role !== null) {
+                        const projected = await projectOrgMembership(this.deps.db, {
+                            localUserId,
+                            hubWorkspaceId: org.id,
+                            hubWorkspaceName: org.name,
+                            role: org.role
+                        });
+                        // The person's own seats in this org's teams: one transaction
+                        // per org, so a seat set is never half-applied.
+                        await this.deps.db.transaction(async (tx) => {
+                            await projectTeamSeats(tx, {
+                                workspaceId: projected.workspaceId,
+                                memberId: projected.memberId,
+                                teams: org.teams
+                            });
+                        });
+                        // Then the org's whole team list, when it is due (never fails the pass).
+                        await this.refreshOrgTeams(localUserId, org.id, projected.workspaceId, login !== undefined);
+                    }
+                    // Org-level suspension is LOCALLY MATERIALIZED truth: the gate
+                    // (and guests' requests — the accepted staleness bound) read this
+                    // column, never a hub round-trip of their own. A role-null entry
+                    // still syncs it when the projection already exists.
+                    await this.deps.db
+                        .update(workspaces)
+                        .set({ hubStatus: org.status })
+                        .where(and(eq(workspaces.centralAccountId, org.id), ne(workspaces.hubStatus, org.status)));
+                }
+                catch (err) {
+                    this.deps.logger.error({ err, userId: localUserId, hubOrgId: org.id }, 'hub reconcile: projecting one org failed — continuing with the rest');
+                }
+            }
+            // Materialize the hub-level default org on the user's membership rows
+            // (selection happens inside the resolvers, before any gate — the flag
+            // must live locally). Clear-then-set in ONE transaction: the partial
+            // unique index (user_id WHERE is_default) forbids two trues even
+            // transiently, so a single both-ways UPDATE could trip it on row
+            // order. A cross-replica race still can — the violation aborts only
+            // this step and self-heals next pass.
+            try {
+                const defaultOrgId = result.orgs.find((o) => o.isDefault)?.id ?? null;
+                let defaultWorkspaceId = null;
+                if (defaultOrgId) {
+                    const [ws] = await this.deps.db
+                        .select({ id: workspaces.id })
+                        .from(workspaces)
+                        .where(eq(workspaces.centralAccountId, defaultOrgId))
+                        .limit(1);
+                    defaultWorkspaceId = ws?.id ?? null;
+                }
+                await this.deps.db.transaction(async (tx) => {
+                    await tx
+                        .update(workspaceMembers)
+                        .set({ isDefault: false })
+                        .where(and(eq(workspaceMembers.userId, localUserId), eq(workspaceMembers.isDefault, true), ...(defaultWorkspaceId ? [ne(workspaceMembers.workspaceId, defaultWorkspaceId)] : [])));
+                    if (defaultWorkspaceId) {
+                        await tx
+                            .update(workspaceMembers)
+                            .set({ isDefault: true })
+                            .where(and(eq(workspaceMembers.userId, localUserId), eq(workspaceMembers.workspaceId, defaultWorkspaceId), eq(workspaceMembers.isDefault, false)));
+                    }
+                });
+            }
+            catch (err) {
+                this.deps.logger.warn({ err, userId: localUserId }, 'hub reconcile: default-org sync failed — selection falls back to oldest-active until the next pass');
+            }
+            this.remember(localUserId, 'ok', result.denied);
+            this.passes.inc({ outcome: 'ok' });
+            return 'ok';
+        }
+        catch (err) {
+            // Fail open, always: reconciliation is freshness; enforcement lives
+            // in the gate's windowed verdict.
+            this.remember(localUserId, null);
+            this.passes.inc({ outcome: 'error' });
+            this.deps.logger.error({ err, userId: localUserId }, 'hub org reconcile pass failed — serving local state');
+            return 'error';
+        }
+    }
+    /**
+     * Read the organization's WHOLE team list as this person and project it
+     * (PRDCT-2813), when the last read is older than `orgTeamsTtlMs` (or never
+     * happened) and no failed read happened within `retryMs`. The LOGIN pass
+     * reads it whatever the window says (`force`): a login is the freshest
+     * signal there is, and Romain's rule is "at login, then every five minutes". A refinement
+     * of a pass whose org list already succeeded: it never throws and never
+     * fails the pass; a failed read keeps the previous list and is logged once
+     * per throttle window.
+     *
+     * No lock: two replicas (or two passes) may both refresh the same org. The
+     * upsert is idempotent and the delete is by membership of the list each
+     * one read, so the last writer leaves the hub's list, whichever it is.
+     */
+    async refreshOrgTeams(localUserId, hubOrgId, workspaceId, 
+    /** A login: the freshest signal there is, read whatever the window says (the login pass's own rule). */
+    force = false) {
+        const now = this.now();
+        const entry = this.orgTeams.get(hubOrgId);
+        if (entry) {
+            // A login skips the window, never the failure throttle: a hub whose
+            // team list hangs must not cost every sign-in one timeout per org
+            // (verifier round 2).
+            if (!force && entry.refreshedAt > 0 && now - entry.refreshedAt < this.dials.orgTeamsTtlMs)
+                return;
+            if (entry.lastAttemptAt > entry.refreshedAt && now - entry.lastAttemptAt < this.dials.retryMs)
+                return;
+        }
+        let outcome;
+        try {
+            // Stamped BEFORE the read, on the DATABASE's clock (the one the rows'
+            // `created_at` is written from, whatever the app host's says; never the
+            // test seam): a team projected here while the hub answered is newer
+            // than the list and is not deleted by it.
+            const [clock] = (await this.deps.db.execute(sql `SELECT now() AS now`)).rows;
+            const readAt = new Date(clock.now);
+            const result = await this.deps.client.orgTeams(localUserId, hubOrgId);
+            if (result.kind === 'ok') {
+                await this.deps.db.transaction(async (tx) => {
+                    await projectOrgTeams(tx, { workspaceId, teams: result.teams, complete: result.complete, readAt });
+                });
+                outcome = 'ok';
+            }
+            else {
+                outcome = result.kind;
+            }
+        }
+        catch (err) {
+            this.deps.logger.warn({ err, hubOrgId }, 'hub reconcile: projecting the org’s team list failed');
+            outcome = 'error';
+        }
+        this.orgTeamsRefreshes.inc({ outcome });
+        const at = this.now();
+        pruneOversized(this.orgTeams, (e) => at - e.refreshedAt >= this.dials.orgTeamsTtlMs);
+        const prev = this.orgTeams.get(hubOrgId);
+        if (outcome === 'ok') {
+            this.orgTeams.set(hubOrgId, { refreshedAt: at, lastAttemptAt: prev?.lastAttemptAt ?? 0 });
+            return;
+        }
+        this.orgTeams.set(hubOrgId, { refreshedAt: prev?.refreshedAt ?? 0, lastAttemptAt: at });
+        if (outcome !== 'error') {
+            this.deps.logger.warn({ hubOrgId, outcome }, 'hub reconcile: the org’s team list could not be read — keeping the previous one');
+        }
+    }
+    /**
+     * The organizations the person's last definitive hub list named as not
+     * opening this tool to them (`GET /me`'s `hubDenied`, the refusal page's
+     * words). Empty when unknown: never read, evicted, or cleared by a
+     * `no_link` / `grant_dead` pass. Per replica, like the rest of the cache.
+     */
+    deniedOrgs(localUserId) {
+        return this.cache.get(localUserId)?.denied ?? [];
+    }
+    remember(localUserId, definitive, denied = []) {
+        const now = this.now();
+        pruneOversized(this.cache, (entry) => now - entry.fetchedAt >= this.dials.reconcileTtlMs);
+        const prev = this.cache.get(localUserId);
+        this.cache.set(localUserId, {
+            fetchedAt: definitive ? now : (prev?.fetchedAt ?? 0),
+            lastAttemptAt: now,
+            lastDefinitive: definitive ?? prev?.lastDefinitive ?? null,
+            // 'ok' carries the fresh list; a failed pass keeps the last one; a
+            // definitive no_link / grant_dead has no list to show.
+            denied: definitive === 'ok' ? denied : definitive === null ? (prev?.denied ?? []) : []
+        });
+    }
+}
+/** Keep a cache under MAX_CACHE_ENTRIES: drop expired entries first, then oldest-inserted. */
+export function pruneOversized(cache, expired) {
+    if (cache.size < MAX_CACHE_ENTRIES)
+        return;
+    for (const [key, value] of cache) {
+        if (expired(value))
+            cache.delete(key);
+    }
+    while (cache.size >= MAX_CACHE_ENTRIES) {
+        const oldest = cache.keys().next();
+        if (oldest.done)
+            break;
+        cache.delete(oldest.value);
+    }
+}
+//# sourceMappingURL=hub-reconcile.js.map

package/dist/identity/hub-reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-reconcile.js","sourceRoot":"","sources":["../../src/identity/hub-reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAW,MAAM,wBAAwB,CAAC;AAG/E,OAAO,EAAE,sBAAsB,EAA8B,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAsD9F,MAAM,CAAC,MAAM,wBAAwB,GAAuB;IAC1D,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,EAAE,GAAG,MAAM;IAChC,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE,KAAK;IACrB,YAAY,EAAE,MAAM;IACpB,uEAAuE;IACvE,kDAAkD;IAClD,cAAc,EAAE,MAAM;IACtB,aAAa,EAAE,CAAC,GAAG,MAAM;CAC1B,CAAC;AAmDF,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAcjC,MAAM,OAAO,gBAAgB;IAcE;IAb7B,qCAAqC;IACpB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC7E,kFAAkF;IACjE,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,GAAG,CAAe;IAC1B,KAAK,CAAqB;IAEnC,oEAAoE;IAC3D,WAAW,CAAY;IACf,MAAM,CAAU;IAChB,iBAAiB,CAAU;IAE5C,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;QACrD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC;YACxB,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,+CAA+C;YACrD,UAAU,EAAE,CAAC,SAAS,CAAU;YAChC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,OAAO,CAAC;YACnC,IAAI,EAAE,6BAA6B;YACnC,IAAI,EAAE,0DAA0D;YAChE,UAAU,EAAE,CAAC,SAAS,CAAU;YAChC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YACjE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,yCAAyC;gBACzC,MAAM,SAAS,GACb,KAAK,KAAK,SAAS;oBACnB,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS;oBACrC,GAAG,GAAG,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBACjD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,MAAM,MAAM,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB,EAAE,KAAwB;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,sEAAsE;QACtE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,SAAS,CAAC,WAAmB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,WAAmB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,IAAI,KAAK,CAAC,cAAc,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC5F,qEAAqE;YACrE,qEAAqE;YACrE,uBAAuB;YACvB,OAAO,KAAK,CAAC,cAAc,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzF,CAAC;QACD,qEAAqE;QACrE,gEAAgE;QAChE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,KAAwB;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,oEAAoE;gBACpE,8CAA8C;gBAC9C,EAAE;gBACF,gEAAgE;gBAChE,iEAAiE;gBACjE,8DAA8D;gBAC9D,kEAAkE;gBAClE,kEAAkE;gBAClE,gEAAgE;gBAChE,wDAAwD;gBACxD,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;qBAChC,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;qBACnC,IAAI,CAAC,gBAAgB,CAAC;qBACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;qBACxF,KAAK,CAAC,CAAC,CAAC,CAAC;gBACZ,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,WAAW,EAAE,EACvB,gGAAgG,CACjG,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;oBAC7C,OAAO,YAAY,CAAC;gBACtB,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,8DAA8D;gBAC9D,oEAAoE;gBACpE,mEAAmE;gBACnE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC3C,OAAO,YAAY,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACnC,iEAAiE;gBACjE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC7C,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,uDAAuD;YACvD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAEnD,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,mEAAmE;YACnE,oCAAoC;YACpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;iBACjC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CACJ,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBAC/F,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAC3C,CAAC;YACJ,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC9D,MAAM,IAAI,GAAG,MAAM,EAAE;qBAClB,MAAM,CAAC,gBAAgB,CAAC;qBACxB,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;qBACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAClC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EACnC,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,eAAe,CAAC,CACvD,CACF;qBACA,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;gBACrF,qEAAqE;gBACrE,qEAAqE;gBACrE,MAAM,sBAAsB,CAC1B,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,EAC5F,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAC9B,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;oBAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,YAAY,EAAE,QAAQ;oBACtB,UAAU,EAAE,WAAW;oBACvB,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;iBACtC,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EACrD,wFAAwF,CACzF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,cAAc;YACd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;wBACtB,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;4BACzD,WAAW;4BACX,cAAc,EAAE,GAAG,CAAC,EAAE;4BACtB,gBAAgB,EAAE,GAAG,CAAC,IAAI;4BAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;yBACf,CAAC,CAAC;wBACH,8DAA8D;wBAC9D,gDAAgD;wBAChD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;4BAC1C,MAAM,gBAAgB,CAAC,EAAE,EAAE;gCACzB,WAAW,EAAE,SAAS,CAAC,WAAW;gCAClC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gCAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;6BACjB,CAAC,CAAC;wBACL,CAAC,CAAC,CAAC;wBACH,yEAAyE;wBACzE,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;oBAC9F,CAAC;oBACD,+DAA+D;oBAC/D,kEAAkE;oBAClE,iEAAiE;oBACjE,qDAAqD;oBACrD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;yBACf,MAAM,CAAC,UAAU,CAAC;yBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;yBAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/F,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,EAC9C,qEAAqE,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,iEAAiE;YACjE,iEAAiE;YACjE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;gBACtE,IAAI,kBAAkB,GAAkB,IAAI,CAAC;gBAC7C,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;yBAC5B,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;yBAC7B,IAAI,CAAC,UAAU,CAAC;yBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;yBACpD,KAAK,CAAC,CAAC,CAAC,CAAC;oBACZ,kBAAkB,GAAG,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC;gBACtC,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBAC1C,MAAM,EAAE;yBACL,MAAM,CAAC,gBAAgB,CAAC;yBACxB,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;yBACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,EACpC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACtF,CACF,CAAC;oBACJ,IAAI,kBAAkB,EAAE,CAAC;wBACvB,MAAM,EAAE;6BACL,MAAM,CAAC,gBAAgB,CAAC;6BACxB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;6BACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,kBAAkB,CAAC,EACpD,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CACtC,CACF,CAAC;oBACN,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAC5B,oGAAoG,CACrG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kCAAkC;YAClC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAC5B,qDAAqD,CACtD,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,QAAgB,EAChB,WAAmB;IACnB,wGAAwG;IACxG,KAAK,GAAG,KAAK;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,oEAAoE;YACpE,kEAAkE;YAClE,sBAAsB;YACtB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa;gBAAE,OAAO;YAClG,IAAI,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,WAAW,IAAI,GAAG,GAAG,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO;QACxG,CAAC;QACD,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,sEAAsE;YACtE,wEAAwE;YACxE,oEAAoE;YACpE,0CAA0C;YAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,qBAAqB,CAAC,CAAC,CAAC,IAErE,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBAC1C,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrG,CAAC,CAAC,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,sDAAsD,CAAC,CAAC;YACjG,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QACxF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,OAAO,EAAE,EACrB,iFAAiF,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,WAAmB;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;IACnD,CAAC;IAEO,QAAQ,CACd,WAAmB,EACnB,UAAiF,EACjF,SAAyB,EAAE;QAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC;YACpD,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,UAAU,IAAI,IAAI,EAAE,cAAc,IAAI,IAAI;YAC1D,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;SACvF,CAAC,CAAC;IACL,CAAC;CACF;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAI,KAAqB,EAAE,OAA8B;IACrF,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB;QAAE,OAAO;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM;QACvB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC"}