@antseed/cli 0.1.179 → 0.1.180

package/dist/gateway/auth/auth.test.js

@@ -0,0 +1,337 @@
+import assert from 'node:assert/strict';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { SESSION_ABSOLUTE_MS, SESSION_IDLE_MS } from './db.js';
+import { SoftwarePasskey, startHarness } from './test-helpers.js';
+let harness;
+afterEach(async () => {
+    await harness?.close();
+});
+function setupToken(link) {
+    return link.slice(link.indexOf('#') + 1);
+}
+async function registerPasskey(browser, enrollment, passkey, overrides = {}) {
+    const options = await browser.request('POST', '/auth/passkey/register/options', enrollment ? { enrollment } : {});
+    assert.equal(options.status, 200, JSON.stringify(options.body));
+    const origin = `http://${browser.host}`;
+    return browser.request('POST', '/auth/passkey/register/verify', { enrollment, response: passkey.register(options.body, origin, overrides), label: 'Laptop' });
+}
+async function loginPasskey(browser, passkey, overrides = {}) {
+    const options = await browser.request('POST', '/auth/passkey/login/options', {});
+    assert.equal(options.status, 200, JSON.stringify(options.body));
+    return browser.request('POST', '/auth/passkey/login/verify', { response: passkey.login(options.body, `http://${browser.host}`, overrides) });
+}
+async function claimOwner(h, browser, passkey = new SoftwarePasskey()) {
+    const setup = await browser.request('POST', '/auth/setup', { token: setupToken(h.auth.createSetupLink()), email: 'owner@example.com' });
+    assert.equal(setup.status, 200, JSON.stringify(setup.body));
+    const registered = await registerPasskey(browser, setup.body.enrollment, passkey);
+    assert.equal(registered.status, 200, JSON.stringify(registered.body));
+    return { passkey, me: registered.body };
+}
+describe('console auth: setup and passkeys', () => {
+    it('claims the console with a setup link, registers a passkey and signs in with it', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        assert.equal((await browser.request('GET', '/auth/config')).body.setupRequired, true);
+        assert.equal((await browser.request('GET', '/auth/config')).body.passkey, true);
+        const link = harness.auth.createSetupLink();
+        assert.match(link, new RegExp(`^http://localhost:${harness.port}/console/setup#[A-Za-z0-9_-]{40,}$`));
+        const token = setupToken(link);
+        const setup = await browser.request('POST', '/auth/setup', { token });
+        assert.equal(setup.status, 200);
+        assert.equal(setup.body.orgRole, 'owner');
+        // Single use.
+        const again = await harness.browser().request('POST', '/auth/setup', { token });
+        assert.equal(again.status, 400);
+        const passkey = new SoftwarePasskey();
+        const registered = await registerPasskey(browser, setup.body.enrollment, passkey);
+        assert.equal(registered.status, 200, JSON.stringify(registered.body));
+        assert.equal(registered.body.kind, 'member');
+        assert.equal(registered.body.me.member.orgRole, 'owner');
+        assert.equal(registered.body.me.member.credentials.length, 1);
+        assert.equal(registered.body.me.member.credentials[0].kind, 'passkey');
+        assert.deepEqual(registered.body.me.member.limits, { daily: '5.000000', weekly: null, monthly: null, total: null });
+        assert.equal(registered.body.me.workspaces.length, 2, 'org owners see every workspace');
+        // Loopback http: no Secure flag, but HttpOnly + Strict + /console.
+        const cookie = browser.lastSetCookies.find((line) => line.startsWith('antseed_console='));
+        assert.match(cookie, /HttpOnly/);
+        assert.match(cookie, /SameSite=Strict/);
+        assert.match(cookie, /Path=\/console/);
+        assert.doesNotMatch(cookie, /Secure/);
+        assert.equal((await browser.request('GET', '/auth/me')).status, 200);
+        assert.equal((await browser.request('GET', '/auth/config')).body.setupRequired, false);
+        assert.throws(() => harness.auth.createSetupLink(), /already been claimed/);
+        assert.equal((await harness.browser().request('POST', '/auth/setup', { token: 'x'.repeat(43) })).status, 409);
+        // Fresh browser signs in with the discoverable passkey.
+        const other = harness.browser();
+        const login = await loginPasskey(other, passkey);
+        assert.equal(login.status, 200, JSON.stringify(login.body));
+        assert.equal(login.body.me.member.id, registered.body.me.member.id);
+        assert.equal((await other.request('GET', '/auth/me')).status, 200);
+        // A replayed (non-increasing) counter is refused.
+        const replay = await loginPasskey(harness.browser(), passkey, { counter: 1 });
+        assert.equal(replay.status, 401);
+        assert.equal(replay.body.error.code, 'passkey_invalid');
+    });
+    it('requires user verification for passkey registration and sign-in', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const setup = await browser.request('POST', '/auth/setup', { token: setupToken(harness.auth.createSetupLink()), email: 'owner@example.com' });
+        assert.equal(setup.status, 200, JSON.stringify(setup.body));
+        const registerOptions = await browser.request('POST', '/auth/passkey/register/options', { enrollment: setup.body.enrollment });
+        assert.equal(registerOptions.body.authenticatorSelection.userVerification, 'required');
+        const loginOptions = await harness.browser().request('POST', '/auth/passkey/login/options', {});
+        assert.equal(loginOptions.body.userVerification, 'required');
+        // Presence alone (no PIN or biometric) does not register a passkey...
+        const unverified = await registerPasskey(browser, setup.body.enrollment, new SoftwarePasskey(), { userVerified: false });
+        assert.equal(unverified.status, 400);
+        assert.equal(unverified.body.error.code, 'passkey_invalid');
+        // ...nor sign in with one.
+        const passkey = new SoftwarePasskey();
+        assert.equal((await registerPasskey(browser, setup.body.enrollment, passkey)).status, 200);
+        const login = await loginPasskey(harness.browser(), passkey, { userVerified: false });
+        assert.equal(login.status, 401);
+        assert.equal(login.body.error.code, 'passkey_invalid');
+        assert.equal((await loginPasskey(harness.browser(), passkey)).status, 200);
+    });
+    it('only the newest setup link works, and an owner who never registered can re-claim', async () => {
+        harness = await startHarness();
+        const first = setupToken(harness.auth.createSetupLink());
+        const second = setupToken(harness.auth.createSetupLink());
+        assert.equal((await harness.browser().request('POST', '/auth/setup', { token: first })).status, 400);
+        const claimed = await harness.browser().request('POST', '/auth/setup', { token: second });
+        assert.equal(claimed.status, 200);
+        // The enrollment was never used, so setup is still open, for the same owner.
+        assert.equal((await harness.browser().request('GET', '/auth/config')).body.setupRequired, true);
+        const reclaim = await harness.browser().request('POST', '/auth/setup', { token: setupToken(harness.auth.createSetupLink()) });
+        assert.equal(reclaim.status, 200);
+        const owners = [...harness.store.members.values()].filter((member) => member.orgRole === 'owner');
+        assert.equal(owners.length, 1);
+    });
+    it('uses publicUrl for the setup link', async () => {
+        harness = await startHarness({ publicUrl: 'https://gateway.example.test/' });
+        assert.match(harness.auth.createSetupLink(), /^https:\/\/gateway\.example\.test\/console\/setup#/);
+    });
+    it('lets a signed-in member add a second passkey', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        await claimOwner(harness, browser);
+        const second = await registerPasskey(browser, undefined, new SoftwarePasskey());
+        assert.equal(second.status, 200, JSON.stringify(second.body));
+        assert.equal(second.body.me.member.credentials.length, 2);
+        // Without a session or enrollment there is nobody to register for.
+        assert.equal((await harness.browser().request('POST', '/auth/passkey/register/options', {})).status, 401);
+    });
+    it('reports passkeys unavailable on a bare IP host', async () => {
+        harness = await startHarness();
+        const browser = harness.browser(`127.0.0.1:${harness.port}`);
+        assert.equal((await browser.request('GET', '/auth/config')).body.passkey, false);
+        assert.equal((await browser.request('POST', '/auth/passkey/login/options', {})).status, 400);
+    });
+});
+describe('console auth: invites and wallets', () => {
+    it('adds no sign-in method when the invite lapsed during sign-up', async () => {
+        harness = await startHarness();
+        const wallet = Wallet.createRandom();
+        const { member, token } = harness.store.invite({ label: 'Lee' });
+        const browser = harness.browser();
+        const enrollment = (await browser.request('POST', '/auth/invite', { token })).body.enrollment;
+        for (const invite of harness.store.invites.values())
+            invite.expiresAt = harness.clock.now - 1;
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const refused = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment });
+        assert.equal(refused.status, 400);
+        assert.equal(refused.body.error.code, 'invite_expired');
+        assert.equal(harness.auth.credentialsFor(member.id).length, 0);
+        assert.equal(harness.store.getMember(member.id).status, 'invited');
+    });
+    it('consumes an invite once and signs in with a wallet', async () => {
+        harness = await startHarness();
+        const wallet = Wallet.createRandom();
+        const { member, token } = harness.store.invite({ label: 'Dana', email: 'dana@example.com' }, [['ws_research', 'member']]);
+        const browser = harness.browser();
+        const invited = await browser.request('POST', '/auth/invite', { token });
+        assert.equal(invited.status, 200);
+        assert.equal(invited.body.label, 'Dana');
+        // Until a sign-in method is registered the invite stays open: opening it again (a refresh) still works.
+        const reopened = await harness.browser().request('POST', '/auth/invite', { token });
+        assert.equal(reopened.status, 200);
+        assert.equal(harness.store.getMember(member.id).status, 'invited');
+        const nonce = await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address });
+        const message = nonce.body.message;
+        assert.match(message, new RegExp(`^localhost:${harness.port} wants you to sign in with your Ethereum account:\n${wallet.address}\n`));
+        assert.match(message, /Chain ID: 8453/);
+        assert.match(message, /Expiration Time: /);
+        const verified = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment: invited.body.enrollment });
+        assert.equal(verified.status, 200, JSON.stringify(verified.body));
+        assert.equal(verified.body.me.member.id, member.id);
+        assert.deepEqual(verified.body.me.workspaces.map((entry) => [entry.workspace.id, entry.role]), [['ws_research', 'member']]);
+        assert.equal(harness.store.getMember(member.id).status, 'active');
+        const used = await harness.browser().request('POST', '/auth/invite', { token });
+        assert.equal(used.body.error.code, 'invite_used');
+        // The nonce is single use.
+        const replay = await harness.browser().request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message) });
+        assert.equal(replay.status, 400);
+        // Later logins need no enrollment.
+        const later = harness.browser();
+        const second = (await later.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const login = await later.request('POST', '/auth/wallet/verify', { message: second, signature: await wallet.signMessage(second) });
+        assert.equal(login.status, 200);
+        assert.equal(login.body.me.member.credentials[0].kind, 'wallet');
+    });
+    it('rejects a signature from another wallet and an unknown wallet without enrollment', async () => {
+        harness = await startHarness();
+        const wallet = Wallet.createRandom();
+        const browser = harness.browser();
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const forged = await browser.request('POST', '/auth/wallet/verify', { message, signature: await Wallet.createRandom().signMessage(message) });
+        assert.equal(forged.status, 401);
+        const unknown = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const response = await browser.request('POST', '/auth/wallet/verify', { message: unknown, signature: await wallet.signMessage(unknown) });
+        assert.equal(response.status, 401);
+        assert.equal(response.body.error.code, 'unknown_credential');
+        // An edited message doesn't match the issued one.
+        const issued = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const edited = issued.replace('Sign in to', 'Sign into');
+        assert.equal((await browser.request('POST', '/auth/wallet/verify', { message: edited, signature: await wallet.signMessage(edited) })).status, 400);
+    });
+});
+describe('console auth: API keys, tokens and sessions', () => {
+    it('opens a read-only key session and ends it when the key is revoked', async () => {
+        harness = await startHarness();
+        const key = harness.store.addKey();
+        const browser = harness.browser();
+        assert.equal((await browser.request('POST', '/auth/api-key', { key: 'antseed_wrong' })).status, 401);
+        const login = await browser.request('POST', '/auth/api-key', { key: key.secret });
+        assert.equal(login.status, 200);
+        assert.equal(login.body.kind, 'key');
+        assert.equal(login.body.me.key.id, key.id);
+        assert.equal(login.body.me.key.usage.spent, '1.250000');
+        assert.equal(login.body.me.key.limits.monthly, '10.000000');
+        assert.equal((await browser.request('GET', '/auth/me')).body.kind, 'key');
+        harness.store.keys.set(key.id, { ...key, status: 'revoked' });
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        const expired = harness.store.addKey({ expiresAt: harness.clock.now - 1 });
+        assert.equal((await harness.browser().request('POST', '/auth/api-key', { key: expired.secret })).status, 401);
+        const fresh = harness.store.addKey();
+        const other = harness.browser();
+        await other.request('POST', '/auth/api-key', { key: fresh.secret });
+        harness.auth.revokeKeySessions(fresh.id);
+        assert.equal((await other.request('GET', '/auth/me')).status, 401);
+    });
+    it('authenticates management tokens through the store', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const secret = 'antseed_admin_' + 'a'.repeat(43);
+        assert.equal(await harness.auth.authenticate(fakeRequest({ authorization: `Bearer ${secret}` })), null);
+        harness.store.adminTokens.set(secret, { id: 'adm_1', scope: 'read', revokedAt: null, lastUsedAt: null });
+        const principal = await harness.auth.authenticate(fakeRequest({ authorization: `Bearer ${secret}` }));
+        assert.deepEqual(principal, { kind: 'token', tokenId: 'adm_1', scope: 'read' });
+        assert.notEqual(harness.store.adminTokens.get(secret).lastUsedAt, null);
+        // Tokens have no /auth/me profile.
+        assert.equal((await browser.request('GET', '/auth/me', undefined, { authorization: `Bearer ${secret}` })).status, 403);
+        harness.store.adminTokens.get(secret).revokedAt = 2;
+        assert.equal(await harness.auth.authenticate(fakeRequest({ authorization: `Bearer ${secret}` })), null);
+    });
+    it('never falls back to the session cookie when a bearer header is sent', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        await claimOwner(harness, browser);
+        assert.equal((await browser.request('GET', '/auth/me')).status, 200);
+        for (const authorization of ['Bearer not-a-management-token', 'Bearer antseed_admin_unknown']) {
+            assert.equal((await browser.request('GET', '/auth/me', undefined, { authorization })).status, 401, authorization);
+        }
+    });
+    it('expires idle and old sessions, rotates on login and logs out', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const { passkey } = await claimOwner(harness, browser);
+        // Idle timeout.
+        harness.clock.now += SESSION_IDLE_MS + 1;
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        // Absolute lifetime, despite activity.
+        assert.equal((await loginPasskey(browser, passkey)).status, 200);
+        const started = harness.clock.now;
+        while (harness.clock.now < started + SESSION_ABSOLUTE_MS - SESSION_IDLE_MS / 2) {
+            harness.clock.now += SESSION_IDLE_MS / 2;
+            assert.equal((await browser.request('GET', '/auth/me')).status, 200);
+        }
+        harness.clock.now = started + SESSION_ABSOLUTE_MS + 1;
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        // Rotation: the cookie a browser held before logging in no longer works.
+        assert.equal((await loginPasskey(browser, passkey)).status, 200);
+        const before = browser.cookies.get('antseed_console');
+        assert.equal((await loginPasskey(browser, passkey)).status, 200);
+        const after = browser.cookies.get('antseed_console');
+        assert.notEqual(before, after);
+        assert.equal((await harness.raw('GET', '/auth/me', undefined, { host: browser.host, cookie: `antseed_console=${before}` })).status, 401);
+        const logout = await browser.request('POST', '/auth/logout');
+        assert.equal(logout.status, 204);
+        assert.match(browser.lastSetCookies[0], /Max-Age=0/);
+        assert.equal((await harness.raw('GET', '/auth/me', undefined, { host: browser.host, cookie: `antseed_console=${after}` })).status, 401);
+    });
+    it('locks out a disabled member immediately', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const { passkey, me } = await claimOwner(harness, browser);
+        harness.store.setStatus(me.me.member.id, 'disabled');
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        assert.equal((await loginPasskey(harness.browser(), passkey)).status, 403);
+        harness.store.setStatus(me.me.member.id, 'active');
+        const again = harness.browser();
+        assert.equal((await loginPasskey(again, passkey)).status, 200);
+        harness.auth.revokeMemberSessions(me.me.member.id);
+        assert.equal((await again.request('GET', '/auth/me')).status, 401);
+    });
+});
+describe('console auth: rate limits and cookies', () => {
+    it('limits attempts per account and per client IP', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        let last;
+        for (let attempt = 0; attempt < 11; attempt += 1)
+            last = await browser.request('POST', '/auth/api-key', { key: 'antseed_guess' });
+        assert.equal(last.status, 429);
+        assert.ok(Number(last.headers['retry-after']) > 0);
+        // Per IP: forwarded addresses are trusted because the harness peer is loopback.
+        const proxied = harness.browser(undefined, { 'x-forwarded-for': '198.51.100.7' });
+        for (let attempt = 0; attempt < 30; attempt += 1) {
+            assert.equal((await proxied.request('POST', '/auth/api-key', { key: `antseed_guess_${attempt}` })).status, 401);
+        }
+        assert.equal((await proxied.request('POST', '/auth/api-key', { key: 'antseed_guess_x' })).status, 429);
+        const elsewhere = harness.browser(undefined, { 'x-forwarded-for': '198.51.100.7, 203.0.113.9' });
+        assert.equal((await elsewhere.request('POST', '/auth/api-key', { key: 'antseed_guess_y' })).status, 401);
+        harness.clock.now += 61 * 60 * 1000;
+        assert.equal((await proxied.request('POST', '/auth/api-key', { key: 'antseed_guess_z' })).status, 401);
+    });
+    it('limits setup attempts per token, not across every client', async () => {
+        harness = await startHarness();
+        const link = harness.auth.createSetupLink();
+        const token = link.slice(link.indexOf('#') + 1);
+        const guesser = harness.browser(undefined, { 'x-forwarded-for': '198.51.100.7' });
+        let last;
+        for (let attempt = 0; attempt < 11; attempt += 1)
+            last = await guesser.request('POST', '/auth/setup', { token: 'guess' });
+        assert.equal(last.status, 429);
+        const owner = harness.browser(undefined, { 'x-forwarded-for': '203.0.113.9' });
+        assert.equal((await owner.request('POST', '/auth/setup', { token })).status, 200);
+    });
+    it('marks cookies Secure over https only, so plain-http LAN sign-in works', async () => {
+        harness = await startHarness({ publicUrl: 'https://gateway.example.test' });
+        const key = harness.store.addKey();
+        const proxied = harness.browser('gateway.example.test', { 'x-forwarded-proto': 'https' });
+        await proxied.request('POST', '/auth/api-key', { key: key.secret });
+        assert.match(proxied.lastSetCookies[0], /; Secure/);
+        const lan = harness.browser('192.168.1.20:8379');
+        await lan.request('POST', '/auth/api-key', { key: key.secret });
+        assert.doesNotMatch(lan.lastSetCookies[0], /Secure/);
+        const local = harness.browser(`127.0.0.1:${harness.port}`);
+        await local.request('POST', '/auth/api-key', { key: key.secret });
+        assert.doesNotMatch(local.lastSetCookies[0], /Secure/);
+    });
+});
+function fakeRequest(headers) {
+    return { headers, socket: { remoteAddress: '127.0.0.1' } };
+}
+export const consoleDepsSatisfyAuth = (deps) => deps;
+//# sourceMappingURL=auth.test.js.map

package/dist/gateway/auth/auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.js","sourceRoot":"","sources":["../../../src/gateway/auth/auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,YAAY,EAA8B,MAAM,mBAAmB,CAAA;AAE7F,IAAI,OAAgB,CAAA;AACpB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,UAA8B,EAAE,OAAwB,EAAE,YAAwC,EAAE;IACnJ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACjH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,UAAU,OAAO,CAAC,IAAI,EAAE,CAAA;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AAC/J,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAwB,EAAE,YAA0D,EAAE;IAClI,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAA;IAChF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;AAC9I,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAU,EAAE,OAAgB,EAAE,OAAO,GAAG,IAAI,eAAe,EAAE;IACrF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACvI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACjF,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,CAAA;AACzC,CAAC;AAED,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QACrF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAE/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAA;QAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,qBAAqB,OAAO,CAAC,IAAI,oCAAoC,CAAC,CAAC,CAAA;QACrG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QAE9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACzC,cAAc;QACd,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE/B,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACtE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACnH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,gCAAgC,CAAC,CAAA;QAEvF,mEAAmE;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAE,CAAA;QAC1F,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;QACtC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAErC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACtF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,sBAAsB,CAAC,CAAA;QAC3E,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE7G,wDAAwD;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAElE,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;QAC7I,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAE3D,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9H,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAA;QACtF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAA;QAC/F,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAA;QAE5D,sEAAsE;QACtE,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;QACxH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAE3D,2BAA2B;QAC3B,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAA;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC1F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACzF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,6EAA6E;QAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7H,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;QACjG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,+BAA+B,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,oDAAoD,CAAC,CAAA;IACpG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,eAAe,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QACzD,mEAAmE;QACnE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAC7F,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;QAC7F,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QAC3I,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAA;QACvD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;QAEzH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACxE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxC,wGAAwG;QACxG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QACnF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAEnE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9F,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,CAAC,OAAO,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,cAAc,OAAO,CAAC,IAAI,sDAAsD,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAA;QACrI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACrK,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACnD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAkD,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;QACxK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;QAEjD,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEhC,mCAAmC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC5G,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC7I,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;QAC5D,kDAAkD;QAClD,MAAM,MAAM,GAAW,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QACtH,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACvD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAEzE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEpE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1E,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE7G,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAEvG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QACxG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QACrG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACxE,mCAAmC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEtH,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,SAAS,GAAG,CAAC,CAAA;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACzG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpE,KAAK,MAAM,aAAa,IAAI,CAAC,+BAA+B,EAAE,8BAA8B,CAAC,EAAE,CAAC;YAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;QACnH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAEtD,gBAAgB;QAChB,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,eAAe,GAAG,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEpE,uCAAuC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAA;QACjC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,GAAG,mBAAmB,GAAG,eAAe,GAAG,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,eAAe,GAAG,CAAC,CAAA;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,GAAG,mBAAmB,GAAG,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEpE,yEAAyE;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAA;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAA;QACrD,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAExI,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACzI,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC1D,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAE1E,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC9D,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,IAAI,IAAI,CAAA;QACR,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC;YAAE,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAA;QACjI,MAAM,CAAC,KAAK,CAAC,IAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAEnD,gFAAgF;QAChF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAA;QACjF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,iBAAiB,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACtG,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,CAAC,CAAA;QAChG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAExG,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACxG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAA;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,CAAA;QACjF,IAAI,IAAI,CAAA;QACR,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC;YAAE,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QACzH,MAAM,CAAC,KAAK,CAAC,IAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAA;QAC9E,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,SAAS,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAA;QACzF,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,UAAU,CAAC,CAAA;QAEpD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QAChD,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC/D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAA;QAErD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1D,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,SAAS,WAAW,CAAC,OAA+B;IAClD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAoD,CAAA;AAC9G,CAAC;AAKD,MAAM,CAAC,MAAM,sBAAsB,GAAoC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAA"}

package/dist/gateway/auth/credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credentials.test.d.ts.map

package/dist/gateway/auth/credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/credentials.test.ts"],"names":[],"mappings":""}

package/dist/gateway/auth/credentials.test.js

@@ -0,0 +1,132 @@
+import assert from 'node:assert/strict';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from 'jose';
+import { FRESH_SIGN_IN_MS, sessionSignIn } from './db.js';
+import { enrollWallet, reauthWallet, sessionId, SoftwarePasskey, startHarness } from './test-helpers.js';
+let harness;
+afterEach(async () => {
+    await harness?.close();
+});
+const MINUTE = 60_000;
+/** Signs a wallet sign-in message from `browser` (no enrollment: links the wallet to the signed-in member, or signs in with it). */
+async function walletVerify(browser, wallet, headers = {}) {
+    const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address }, headers)).body.message;
+    return browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message) }, headers);
+}
+/** Confirms the session with `wallet`, which must succeed. */
+async function confirmWithWallet(browser, wallet) {
+    const result = await reauthWallet(browser, wallet);
+    assert.equal(result.status, 200, JSON.stringify(result.body));
+}
+describe('console auth: adding sign-in methods', () => {
+    it('needs a fresh sign-in to link a wallet from a session, and audits the add', async () => {
+        harness = await startHarness();
+        const own = Wallet.createRandom();
+        const { member, browser } = await enrollWallet(harness, 'Owner', own, 'owner');
+        harness.clock.now += FRESH_SIGN_IN_MS + MINUTE;
+        const planted = Wallet.createRandom();
+        const refused = await walletVerify(browser, planted);
+        assert.equal(refused.status, 403);
+        assert.equal(refused.body.error.code, 'reauth_required');
+        assert.equal(harness.auth.credentialsFor(member.id).length, 1, 'nothing was linked');
+        await confirmWithWallet(browser, own);
+        const linked = await walletVerify(browser, planted);
+        assert.equal(linked.status, 200, JSON.stringify(linked.body));
+        assert.equal(harness.auth.credentialsFor(member.id).length, 2);
+        const adds = harness.store.audits.filter((entry) => entry.action === 'auth.credential_add');
+        assert.deepEqual(adds.map((entry) => entry.details?.['via']), ['enrollment', 'session']);
+        assert.equal(adds[1].details?.['address'], planted.address.toLowerCase());
+        assert.equal(adds[1].actor.id, member.id);
+    });
+    it('needs a fresh sign-in to register a passkey from a session', async () => {
+        harness = await startHarness();
+        const { browser } = await enrollWallet(harness, 'Owner', Wallet.createRandom(), 'owner');
+        const passkey = new SoftwarePasskey();
+        const fresh = await browser.request('POST', '/auth/passkey/register/options', {});
+        assert.equal(fresh.status, 200, JSON.stringify(fresh.body));
+        harness.clock.now += FRESH_SIGN_IN_MS + MINUTE;
+        const stale = await browser.request('POST', '/auth/passkey/register/options', {});
+        assert.equal(stale.status, 403);
+        assert.equal(stale.body.error.code, 'reauth_required');
+        // Options fetched while fresh don't help once the sign-in went stale.
+        const verify = await browser.request('POST', '/auth/passkey/register/verify', { response: passkey.register(fresh.body, `http://${browser.host}`) });
+        assert.equal(verify.status, 403);
+        assert.equal(verify.body.error.code, 'reauth_required');
+    });
+    it('records which credential proved each sign-in and re-authentication', async () => {
+        harness = await startHarness();
+        const first = Wallet.createRandom();
+        const { member, browser } = await enrollWallet(harness, 'Owner', first, 'owner');
+        const [firstCredential] = harness.auth.credentialsFor(member.id);
+        assert.equal(sessionSignIn(harness.store.database, sessionId(browser))?.credentialId, firstCredential.id);
+        const second = Wallet.createRandom();
+        assert.equal((await walletVerify(browser, second)).status, 200);
+        const secondCredential = harness.auth.credentialsFor(member.id).find((entry) => entry.id !== firstCredential.id);
+        harness.clock.now += 10 * MINUTE;
+        await confirmWithWallet(browser, second);
+        assert.deepEqual(sessionSignIn(harness.store.database, sessionId(browser)), { authenticatedAt: harness.clock.now, credentialId: secondCredential.id });
+        const other = harness.browser();
+        assert.equal((await walletVerify(other, first)).status, 200);
+        assert.equal(sessionSignIn(harness.store.database, sessionId(other))?.credentialId, firstCredential.id);
+    });
+});
+describe('console auth: removing sign-in methods', () => {
+    it('ends the member\'s other sessions, keeping the caller\'s own', async () => {
+        harness = await startHarness();
+        const first = Wallet.createRandom();
+        const second = Wallet.createRandom();
+        const { member, browser } = await enrollWallet(harness, 'Dana', first);
+        assert.equal((await walletVerify(browser, second)).status, 200);
+        const elsewhere = harness.browser();
+        assert.equal((await walletVerify(elsewhere, second)).status, 200);
+        const [firstCredential] = harness.auth.credentialsFor(member.id);
+        assert.equal(harness.auth.deleteCredential(member.id, firstCredential.id, sessionId(browser)), true);
+        assert.equal((await browser.request('GET', '/auth/me')).status, 200, 'the caller stays signed in');
+        assert.equal((await elsewhere.request('GET', '/auth/me')).status, 401, 'other sessions end');
+        const secondCredential = harness.auth.credentialsFor(member.id)[0];
+        assert.equal(harness.auth.deleteCredential(member.id, secondCredential.id), true);
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401, 'removed by someone else: every session ends');
+        assert.equal(harness.auth.deleteCredential(member.id, secondCredential.id), false);
+    });
+    it('keeps the console claimed once the setup owner has registered a credential', async () => {
+        harness = await startHarness();
+        const token = harness.auth.createSetupLink().split('#')[1];
+        const browser = harness.browser();
+        const enrollment = (await browser.request('POST', '/auth/setup', { token, label: 'Owner' })).body.enrollment;
+        const wallet = Wallet.createRandom();
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const signedIn = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment });
+        assert.equal(signedIn.status, 200);
+        const ownerId = signedIn.body.me.member.id;
+        assert.equal(harness.auth.authConfig().setupRequired, false);
+        for (const credential of harness.auth.credentialsFor(ownerId))
+            harness.auth.deleteCredential(ownerId, credential.id);
+        assert.equal(harness.auth.credentialsFor(ownerId).length, 0);
+        assert.equal(harness.auth.authConfig().setupRequired, false, 'removing credentials does not reopen setup');
+        assert.throws(() => harness.auth.createSetupLink(), /already been claimed/);
+    });
+});
+describe('console auth: Cloudflare Access principals adding a sign-in method', () => {
+    it('need an Access token issued within the fresh sign-in window', async () => {
+        const { privateKey, publicKey } = await generateKeyPair('RS256');
+        const jwks = createLocalJWKSet({ keys: [{ ...(await exportJWK(publicKey)), kid: 'cf1', alg: 'RS256' }] });
+        harness = await startHarness({
+            env: { ANTSEED_CF_ACCESS_TEAM_DOMAIN: 'myteam.cloudflareaccess.com', ANTSEED_CF_ACCESS_AUD: 'aud-123' },
+            authOptions: { cloudflareAccessKeys: jwks },
+        });
+        const sign = (issuedAt) => new SignJWT({ email: 'lee@acme.example' }).setProtectedHeader({ alg: 'RS256', kid: 'cf1' })
+            .setIssuer('https://myteam.cloudflareaccess.com').setAudience('aud-123').setSubject('cf-sub')
+            .setIssuedAt(Math.floor(issuedAt / 1000)).setExpirationTime(Math.floor(harness.clock.now / 1000) + 3600).sign(privateKey);
+        const member = harness.store.addMember({ label: 'Lee', email: 'lee@acme.example', orgRole: 'owner' });
+        const browser = harness.browser();
+        const stale = await walletVerify(browser, Wallet.createRandom(), { 'cf-access-jwt-assertion': await sign(harness.clock.now - FRESH_SIGN_IN_MS - MINUTE) });
+        assert.equal(stale.status, 403);
+        assert.equal(stale.body.error.code, 'access_reauth_required');
+        assert.equal(harness.auth.credentialsFor(member.id).length, 0);
+        const fresh = await walletVerify(browser, Wallet.createRandom(), { 'cf-access-jwt-assertion': await sign(harness.clock.now - MINUTE) });
+        assert.equal(fresh.status, 200, JSON.stringify(fresh.body));
+        assert.equal(harness.auth.credentialsFor(member.id).length, 1);
+    });
+});
+//# sourceMappingURL=credentials.test.js.map

package/dist/gateway/auth/credentials.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.js","sourceRoot":"","sources":["../../../src/gateway/auth/credentials.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,MAAM,EAAqB,MAAM,QAAQ,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAY,MAAM,MAAM,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAA8B,MAAM,mBAAmB,CAAA;AAEpI,IAAI,OAAgB,CAAA;AACpB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,MAAM,CAAA;AAErB,oIAAoI;AACpI,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAoB,EAAE,UAAkC,EAAE;IACtG,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;IACxH,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;AAC3H,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,MAAoB;IACrE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACjC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QAE9E,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,gBAAgB,GAAG,MAAM,CAAA;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACxD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAEpF,MAAM,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,qBAAqB,CAAC,CAAA;QAC3F,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAA;QACxF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAA;QACxF,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAA;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAE3D,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,gBAAgB,GAAG,MAAM,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACtD,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,+BAA+B,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACnJ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACnC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAChF,MAAM,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,eAAgB,CAAC,EAAE,CAAC,CAAA;QAE1G,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,eAAgB,CAAC,EAAE,CAAE,CAAA;QAClH,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;QAChC,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAA;QAEtJ,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,eAAgB,CAAC,EAAE,CAAC,CAAA;IAC1G,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACtE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAEjE,MAAM,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,eAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QACrG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAA;QAClG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAA;QAE5F,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,6CAA6C,CAAC,CAAA;QACnH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,OAAO,GAAG,MAAM,YAAY,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAA;QAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAA;QAC/G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QAC5I,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAY,CAAA;QACpD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QAE5D,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;QACpH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,4CAA4C,CAAC,CAAA;QAC1G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,sBAAsB,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAClF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;QAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAS,CAAC,EAAE,CAAC,CAAA;QAChH,OAAO,GAAG,MAAM,YAAY,CAAC;YAC3B,GAAG,EAAE,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,SAAS,EAAE;YACvG,WAAW,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAC3H,SAAS,CAAC,qCAAqC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC5F,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3H,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QACrG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAEjC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1J,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;QAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,yBAAyB,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QACvI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}