@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.75145ef

package/dist/packages/server/src/teams/provision.d.ts

@@ -0,0 +1,84 @@
+import { ConnectError, type Fetch, type VendorRequest, type VendorResponse } from "../../../connector-kit/src/types.js";
+export declare const ARM = "https://management.azure.com";
+export declare const CATALOG_SCOPE = "https://graph.microsoft.com/AppCatalog.ReadWrite.All";
+/** The live checks the Teams page's set-up-once steps name (`live` in connectors/teams.json). */
+export declare const LIVE_CHECKS: readonly ["azure-target", "azure-role"];
+export type Call = (request: VendorRequest, origin?: string) => Promise<VendorResponse>;
+export type StepState = {
+    id: "app" | "principal" | "azureBot" | "channel" | "signIn";
+    label: string;
+    state: "done" | "failed" | "waiting" | "todo";
+    message?: string;
+};
+export type AzureTarget = {
+    subscriptionId: string;
+    resourceGroup: string;
+};
+export declare function azureTarget(config: Record<string, string>): AzureTarget | null;
+export declare const azureBotName: (botAppId: string) => string;
+/** A Graph refusal in plain words. A missing permission names it. */
+export declare function graphFailure(res: VendorResponse, what: string, permission: string): ConnectError;
+/** An Azure Resource Manager refusal in plain words. */
+export declare function armFailure(res: VendorResponse, target: AzureTarget, what: string, onRoleStep?: boolean): ConnectError;
+export type ProvisionInput = {
+    call: Call;
+    bot: {
+        id: string;
+        displayName: string;
+        tenantId: string;
+        certificate: string;
+    };
+    config: Record<string, string>;
+    save: (config: Record<string, string>) => Promise<void>;
+    target: AzureTarget;
+    publicUrl: string;
+    prove: (botAppId: string) => Promise<void>;
+    sleep: (ms: number) => Promise<void>;
+    waits?: number[];
+};
+/** Makes the bot in the tenant, each part only if missing, so running it again finishes what
+ *  an earlier try left. Steps after a failed one are left to do. */
+export declare function provisionBot(input: ProvisionInput): Promise<{
+    steps: StepState[];
+    botAppId: string | null;
+}>;
+/** Removes what provisioning made: the Azure Bot and the app registration (which also ends
+ *  its service principal). Each failure is returned in plain words, never dropped. The app
+ *  registration is kept while its Azure Bot is: the removal script deletes a bot only when its
+ *  app still carries the bot's unique name. */
+export declare function deprovisionBot(call: Call, config: Record<string, string>): Promise<string[]>;
+export type LiveCheck = {
+    state: "done" | "failing" | "todo";
+    message: string;
+};
+export declare function setupChecks(call: Call, config: Record<string, string>): Promise<Record<(typeof LIVE_CHECKS)[number], LiveCheck>>;
+/** The id token's claims must be this connection's app, tenant and sign-in, by someone of the
+ *  organization (a guest names another home in `idp`). */
+export declare function checkSignIn(claims: Record<string, unknown>, expect: {
+    clientId: string;
+    tenantId: string;
+    nonce: string;
+}, now?: number): void;
+/** Publishes the package, or a new version of it, under the manifest id `externalId`. Finds the
+ *  catalog app first, so publishing twice changes nothing. */
+export declare function publishPackage(input: {
+    token: string;
+    externalId: string;
+    version: string;
+    zip: Buffer;
+}, fetchImpl?: Fetch): Promise<{
+    catalogAppId: string;
+    changed: boolean;
+}>;
+export type InstallKind = "team" | "chat" | "person";
+/** Adds the published app there, consenting to the package's resource-specific permissions
+ *  (Microsoft requires exactly the package's list). Already there counts as added. */
+export declare function installBot(call: Call, catalogAppId: string, kind: InstallKind, id: string): Promise<"added" | "already">;
+/** Chat ids from a pasted Teams link or the id itself. */
+export declare function chatIdFrom(raw: string): string | null;
+/** Teams or people matching what the admin typed, for the picker. */
+export declare function searchTargets(call: Call, kind: "team" | "person", rawQuery: string): Promise<{
+    id: string;
+    name: string;
+    detail: string | null;
+}[]>;

package/dist/packages/server/src/teams/provision.js

@@ -0,0 +1,505 @@
+import { X509Certificate } from "node:crypto";
+import { brand } from "../../../connector-kit/src/branding.js";
+import { describeCertificate } from "../../../connector-kit/src/certificate.js";
+import { ConnectError, } from "../../../connector-kit/src/types.js";
+import { RSC_PERMISSIONS } from "./package.js";
+// "Add to Teams": what the Microsoft connection's own app (branding.microsoft.appName) does in the
+// customer's tenant to make an agent's bot, app-only: the bot's app registration and service
+// principal (Application.ReadWrite.OwnedBy), its Azure Bot with the Teams channel (a custom
+// role on one resource group), and installing it where the admin picks
+// (TeamsAppInstallation.ReadWriteAndConsentFor{Team,Chat,User}.All). Publishing to the org's
+// Teams app catalog has no app-only permission, so an administrator signs in for it
+// (delegated AppCatalog.ReadWrite.All). docs/teams.md "Add to Teams".
+export const ARM = "https://management.azure.com";
+const BOT_API = "2022-09-15";
+export const CATALOG_SCOPE = "https://graph.microsoft.com/AppCatalog.ReadWrite.All";
+const GRAPH = "https://graph.microsoft.com";
+const LOGIN = "https://login.microsoftonline.com";
+/** The live checks the Teams page's set-up-once steps name (`live` in connectors/teams.json). */
+export const LIVE_CHECKS = ["azure-target", "azure-role"];
+export function azureTarget(config) {
+    const { azureSubscriptionId: subscriptionId, azureResourceGroup: resourceGroup } = config;
+    return subscriptionId && resourceGroup ? { subscriptionId, resourceGroup } : null;
+}
+// The same name the setup script gives it, so either way's removal finds it.
+export const azureBotName = (botAppId) => `${brand().resourcePrefix}-${botAppId.slice(0, 8)}`;
+const botPath = (t, name) => `/subscriptions/${t.subscriptionId}/resourceGroups/${encodeURIComponent(t.resourceGroup)}/providers/Microsoft.BotService/botServices/${name}`;
+function errorOf(data) {
+    const e = data?.error;
+    return {
+        code: typeof e?.code === "string" ? e.code : "",
+        message: (typeof e?.message === "string" ? e.message : "").split(/\r?\n/)[0].slice(0, 300),
+    };
+}
+/** A Graph refusal in plain words. A missing permission names it. */
+export function graphFailure(res, what, permission) {
+    const { code, message } = errorOf(res.data);
+    if (res.status === 403 && (code === "Authorization_RequestDenied" || code === "Forbidden"))
+        return new ConnectError(`Microsoft refused ${what}: ${brand().microsoft.appName} needs the ${permission} permission with admin consent (Add the Microsoft Graph permissions for adding bots, then Grant admin consent, on the Microsoft Teams page).`);
+    return new ConnectError(`Microsoft refused ${what} (${res.status}${code ? `, ${code}` : ""})${message ? `: ${message}` : ""}`);
+}
+/** An Azure Resource Manager refusal in plain words. */
+export function armFailure(res, target, what, 
+// Shown on the role step itself, which then points at "this step".
+onRoleStep = false) {
+    const { code, message } = errorOf(res.data);
+    if (code === "AuthorizationFailed" || code === "LinkedAuthorizationFailed")
+        return new ConnectError(`${brand().microsoft.appName} has no role on the resource group ${target.resourceGroup} yet (${onRoleStep ? "this step" : `Give ${brand().microsoft.appName} a role on that resource group, on the Microsoft Teams page`}). A new role assignment can take a few minutes to apply.`);
+    if (code === "MissingSubscriptionRegistration")
+        return new ConnectError(`The subscription ${target.subscriptionId} is not registered for Azure Bot Service yet. Register Microsoft.BotService (Register the Bot Service in the subscription, on the Microsoft Teams page), then try again.`);
+    if (code === "ResourceGroupNotFound")
+        return new ConnectError(`There is no resource group ${target.resourceGroup} in the subscription ${target.subscriptionId}.`);
+    if (code === "SubscriptionNotFound" || code === "InvalidSubscriptionId")
+        return new ConnectError(`Azure has no subscription ${target.subscriptionId} that ${brand().microsoft.appName} can see.`);
+    return new ConnectError(`Azure refused ${what} (${res.status}${code ? `, ${code}` : ""})${message ? `: ${message}` : ""}`);
+}
+const ok = (res) => res.status >= 200 && res.status < 300;
+// Graph returns a certificate's customKeyIdentifier as its SHA-1 thumbprint, base64.
+function hasCertificate(keys, certificate) {
+    const thumbprint = describeCertificate(certificate).thumbprint.toUpperCase();
+    return (Array.isArray(keys) ? keys : []).some((k) => {
+        const id = k.customKeyIdentifier;
+        if (typeof id !== "string")
+            return false;
+        const bytes = Buffer.from(id, "base64");
+        return (bytes.toString("hex").toUpperCase() === thumbprint ||
+            bytes.toString("utf8").toUpperCase() === thumbprint);
+    });
+}
+const LABELS = {
+    app: "App registration with the bot's certificate",
+    principal: "Its service principal",
+    azureBot: "Azure Bot on the free tier",
+    channel: "Teams channel on the Azure Bot",
+    signIn: "The bot signs in to Microsoft",
+};
+// Retried while Microsoft replicates a new app (a few seconds, sometimes a minute).
+const REPLICATION_MS = [2000, 4000, 8000];
+/** Makes the bot in the tenant, each part only if missing, so running it again finishes what
+ *  an earlier try left. Steps after a failed one are left to do. */
+export async function provisionBot(input) {
+    const { call, bot, target } = input;
+    const waits = input.waits ?? REPLICATION_MS;
+    const config = { ...input.config };
+    const steps = [];
+    let failed = false;
+    async function step(id, run) {
+        if (failed)
+            return void steps.push({ id, label: LABELS[id], state: "todo" });
+        try {
+            // A message back means it is not done yet, only waiting on Microsoft.
+            const waiting = await run();
+            if (waiting)
+                failed = true;
+            steps.push({
+                id,
+                label: LABELS[id],
+                ...(waiting ? { state: "waiting", message: waiting } : { state: "done" }),
+            });
+        }
+        catch (error) {
+            if (!(error instanceof ConnectError))
+                throw error;
+            failed = true;
+            steps.push({ id, label: LABELS[id], state: "failed", message: error.message });
+        }
+    }
+    async function retried(attempt, again) {
+        let res = await attempt();
+        for (const wait of waits) {
+            if (!again(res))
+                break;
+            await input.sleep(wait);
+            res = await attempt();
+        }
+        return res;
+    }
+    const uniqueName = `${brand().resourcePrefix}-bot-${bot.id}`;
+    await step("app", async () => {
+        const upsert = await call({
+            method: "PATCH",
+            path: `/v1.0/applications(uniqueName='${uniqueName}')`,
+            headers: { prefer: "create-if-missing" },
+            body: {
+                displayName: `${bot.displayName} (${brand().productName})`,
+                signInAudience: "AzureADMyOrg",
+            },
+        });
+        if (!ok(upsert))
+            throw graphFailure(upsert, "creating the bot's app registration", "Application.ReadWrite.OwnedBy");
+        const read = await retried(() => call({
+            method: "GET",
+            path: `/v1.0/applications(uniqueName='${uniqueName}')?$select=id,appId,keyCredentials`,
+        }), (r) => r.status === 404);
+        if (!ok(read))
+            throw graphFailure(read, "reading the bot's app registration", "Application.ReadWrite.OwnedBy");
+        const app = read.data;
+        config.appObjectId = app.id;
+        config.appId = app.appId;
+        await input.save(config);
+        // The service owns this app's credentials outright (it is the bot's own, found by its unique
+        // name), so replacing them all with the current certificate is intended.
+        if (!hasCertificate(app.keyCredentials, bot.certificate)) {
+            const set = await call({
+                method: "PATCH",
+                path: `/v1.0/applications/${app.id}`,
+                body: {
+                    keyCredentials: [
+                        {
+                            type: "AsymmetricX509Cert",
+                            usage: "Verify",
+                            key: new X509Certificate(bot.certificate).raw.toString("base64"),
+                            displayName: brand().productName,
+                        },
+                    ],
+                },
+            });
+            if (!ok(set))
+                throw graphFailure(set, "adding the bot's certificate", "Application.ReadWrite.OwnedBy");
+        }
+        return null;
+    });
+    const appId = config.appId ?? null;
+    await step("principal", async () => {
+        const found = await call({
+            method: "GET",
+            path: `/v1.0/servicePrincipals(appId='${appId}')?$select=id`,
+        });
+        if (ok(found))
+            return null;
+        if (found.status !== 404)
+            throw graphFailure(found, "reading the bot's service principal", "Application.ReadWrite.OwnedBy");
+        const made = await retried(() => call({ method: "POST", path: "/v1.0/servicePrincipals", body: { appId } }), 
+        // A new app is not known everywhere at once.
+        (r) => r.status === 400 || r.status === 404);
+        if (!ok(made) && made.status !== 409)
+            throw graphFailure(made, "creating the bot's service principal", "Application.ReadWrite.OwnedBy");
+        return null;
+    });
+    const path = appId ? botPath(target, azureBotName(appId)) : "";
+    await step("azureBot", async () => {
+        // The name holds only 8 hex of the app id, so one made for another app may hold it.
+        const found = await call({ method: "GET", path: `${path}?api-version=${BOT_API}` }, ARM);
+        if (!ok(found) && found.status !== 404)
+            throw armFailure(found, target, "reading the Azure Bot");
+        const owner = ok(found)
+            ? found.data?.properties?.msaAppId
+            : appId;
+        if (owner !== appId)
+            throw new ConnectError(`An Azure Bot named ${azureBotName(appId)} in ${target.resourceGroup} belongs to another app, so it is left as it is. Rename or remove it, then add the bot again.`);
+        const res = await call({
+            method: "PUT",
+            path: `${path}?api-version=${BOT_API}`,
+            body: {
+                location: "global",
+                kind: "azurebot",
+                sku: { name: "F0" },
+                properties: {
+                    displayName: bot.displayName,
+                    endpoint: `${input.publicUrl}/teams/bots/${appId}/messages`,
+                    msaAppId: appId,
+                    msaAppType: "SingleTenant",
+                    msaAppTenantId: bot.tenantId,
+                },
+            },
+        }, ARM);
+        if (!ok(res))
+            throw armFailure(res, target, "creating the Azure Bot");
+        config.azureBot = path;
+        await input.save(config);
+        return null;
+    });
+    await step("channel", async () => {
+        const res = await call({
+            method: "PUT",
+            path: `${path}/channels/MsTeamsChannel?api-version=${BOT_API}`,
+            body: {
+                location: "global",
+                properties: { channelName: "MsTeamsChannel", properties: { isEnabled: true } },
+            },
+        }, ARM);
+        if (!ok(res))
+            throw armFailure(res, target, "adding the Teams channel");
+        return null;
+    });
+    let signedIn = false;
+    await step("signIn", async () => {
+        let last = null;
+        for (const wait of [0, ...waits]) {
+            if (wait)
+                await input.sleep(wait);
+            try {
+                await input.prove(appId);
+                signedIn = true;
+                return null;
+            }
+            catch (error) {
+                if (!(error instanceof ConnectError))
+                    throw error;
+                last = error;
+            }
+        }
+        return `Microsoft is still setting up the new app (${last.message}). Select Add to Teams again in a minute: nothing is made twice.`;
+    });
+    return { steps, botAppId: signedIn ? appId : null };
+}
+/** Removes what provisioning made: the Azure Bot and the app registration (which also ends
+ *  its service principal). Each failure is returned in plain words, never dropped. The app
+ *  registration is kept while its Azure Bot is: the removal script deletes a bot only when its
+ *  app still carries the bot's unique name. */
+export async function deprovisionBot(call, config) {
+    const failed = [];
+    if (config.azureBot) {
+        const res = await call({ method: "DELETE", path: `${config.azureBot}?api-version=${BOT_API}` }, ARM);
+        if (!ok(res) && res.status !== 404) {
+            const { code, message } = errorOf(res.data);
+            return [
+                `Azure did not delete the bot (${res.status}${code ? `, ${code}` : ""})${message ? `: ${message}` : ""}`,
+            ];
+        }
+    }
+    if (config.appObjectId) {
+        const res = await call({ method: "DELETE", path: `/v1.0/applications/${config.appObjectId}` });
+        if (!ok(res) && res.status !== 404)
+            failed.push(graphFailure(res, "deleting the bot's app registration", "Application.ReadWrite.OwnedBy")
+                .message);
+    }
+    return failed;
+}
+// ---- the set-up-once steps, checked live ----
+// What Add to Teams writes in the resource group.
+const BOT_WRITES = [
+    "Microsoft.BotService/botServices/write",
+    "Microsoft.BotService/botServices/channels/write",
+];
+// Azure's permissions answer: one entry per role, each allowing its `actions` (with *
+// wildcards, any case) except its `notActions`.
+function allows(data, action) {
+    const matches = (pattern) => typeof pattern === "string" &&
+        new RegExp(`^${pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*")}$`, "i").test(action);
+    const entries = data?.value;
+    return (Array.isArray(entries) ? entries : []).some((e) => Array.isArray(e.actions) &&
+        e.actions.some(matches) &&
+        !(Array.isArray(e.notActions) && e.notActions.some(matches)));
+}
+export async function setupChecks(call, config) {
+    const target = azureTarget(config);
+    if (!target) {
+        const todo = {
+            state: "todo",
+            message: "Enter the subscription and resource group first.",
+        };
+        return { "azure-target": { state: "todo", message: "Not entered yet." }, "azure-role": todo };
+    }
+    const saved = {
+        state: "done",
+        message: `Bots go in the resource group ${target.resourceGroup} of the subscription ${target.subscriptionId}.`,
+    };
+    let role;
+    try {
+        // What the Microsoft app may do there (all its role assignments, inherited ones too): seeing
+        // the group is not enough, since Add to Teams writes the bot and its channel.
+        const res = await call({
+            method: "GET",
+            path: `/subscriptions/${target.subscriptionId}/resourceGroups/${encodeURIComponent(target.resourceGroup)}/providers/Microsoft.Authorization/permissions?api-version=2022-04-01`,
+        }, ARM);
+        const missing = ok(res) ? BOT_WRITES.filter((a) => !allows(res.data, a)) : [];
+        role = !ok(res)
+            ? {
+                state: "failing",
+                message: armFailure(res, target, "reading its permissions", true).message,
+            }
+            : missing.length === BOT_WRITES.length
+                ? {
+                    state: "failing",
+                    message: `${brand().microsoft.appName} has no role on the resource group ${target.resourceGroup} that can create Azure Bots yet (this step). A new role assignment can take a few minutes to apply.`,
+                }
+                : missing.length
+                    ? {
+                        state: "failing",
+                        message: `${brand().microsoft.appName}'s role on ${target.resourceGroup} lacks ${missing.join(" and ")} (this step).`,
+                    }
+                    : {
+                        state: "done",
+                        message: `Checked live: ${brand().microsoft.appName} can create and change Azure Bots in ${target.resourceGroup}.`,
+                    };
+    }
+    catch (error) {
+        if (!(error instanceof ConnectError))
+            throw error;
+        role = { state: "failing", message: error.message };
+    }
+    const missingGroup = role.state === "failing" && role.message.startsWith("There is no resource group");
+    return {
+        "azure-target": missingGroup ? { state: "failing", message: role.message } : saved,
+        "azure-role": role,
+    };
+}
+// ---- publishing to the org's Teams app catalog, as the administrator who signed in ----
+/** The id token's claims must be this connection's app, tenant and sign-in, by someone of the
+ *  organization (a guest names another home in `idp`). */
+export function checkSignIn(claims, expect, now = Date.now()) {
+    const fresh = typeof claims.exp === "number" && claims.exp * 1000 > now;
+    if (claims.aud !== expect.clientId ||
+        claims.iss !== `${LOGIN}/${expect.tenantId}/v2.0` ||
+        claims.nonce !== expect.nonce ||
+        !fresh)
+        throw new ConnectError("Microsoft's sign-in did not match this request. Start again.");
+    const guest = typeof claims.idp === "string" && !claims.idp.includes(expect.tenantId);
+    if (claims.tid !== expect.tenantId || guest)
+        throw new ConnectError("Sign in with an administrator of your own organization, not a guest or another organization's account.");
+}
+function catalogFailure(res) {
+    const error = res.data?.error;
+    const inner = error?.innerError;
+    if (inner?.code === "UnableToParseTeamsAppManifest") {
+        const details = (Array.isArray(inner.details) ? inner.details : [])
+            .map((d) => `${d.target ? `${d.target}: ` : ""}${d.message ?? ""}`)
+            .join("; ");
+        return new ConnectError(`Microsoft refused the Teams app package: ${details || errorOf(res.data).message}`);
+    }
+    if (res.status === 403 || res.status === 401)
+        return new ConnectError(`Microsoft refused to publish: sign in as a Teams Administrator or Global Administrator, and check that ${brand().microsoft.appName} has AppCatalog.ReadWrite.All with admin consent.`);
+    if (res.status === 409)
+        return new ConnectError("Your Teams apps already have an app for this bot under another ID. Delete it in the Teams admin center under Teams apps, then Manage apps, and publish again.");
+    const { code, message } = errorOf(res.data);
+    return new ConnectError(`Microsoft refused to publish (${res.status}${code ? `, ${code}` : ""})${message ? `: ${message}` : ""}`);
+}
+/** Publishes the package, or a new version of it, under the manifest id `externalId`. Finds the
+ *  catalog app first, so publishing twice changes nothing. */
+export async function publishPackage(input, fetchImpl = fetch) {
+    const as = async (path, init) => {
+        const res = await fetchImpl(`${GRAPH}${path}`, {
+            method: init.method,
+            redirect: "error",
+            headers: {
+                authorization: `Bearer ${input.token}`,
+                accept: "application/json",
+                ...(init.zip ? { "content-type": "application/zip" } : {}),
+            },
+            body: init.zip ? new Uint8Array(init.zip) : undefined,
+        });
+        const text = await res.text();
+        let data = null;
+        try {
+            data = text ? JSON.parse(text) : null;
+        }
+        catch {
+            data = text;
+        }
+        return { status: res.status, data };
+    };
+    const q = new URLSearchParams({
+        $filter: `externalId eq '${input.externalId}'`,
+        $expand: "appDefinitions($select=version)",
+    });
+    const found = await as(`/v1.0/appCatalogs/teamsApps?${q}`, { method: "GET" });
+    if (!ok(found) || errorOf(found.data).code)
+        throw catalogFailure(found);
+    const existing = found.data.value?.[0];
+    if (existing?.appDefinitions?.some((d) => d.version === input.version))
+        return { catalogAppId: existing.id, changed: false };
+    const res = existing
+        ? await as(`/v1.0/appCatalogs/teamsApps/${existing.id}/appDefinitions?requiresReview=false`, {
+            method: "POST",
+            zip: input.zip,
+        })
+        : await as("/v1.0/appCatalogs/teamsApps?requiresReview=false", {
+            method: "POST",
+            zip: input.zip,
+        });
+    // Microsoft can answer a refused package with 200 and an error body.
+    if (!ok(res) || errorOf(res.data).code)
+        throw catalogFailure(res);
+    const id = existing?.id ?? res.data?.id;
+    if (!id)
+        throw new ConnectError("Microsoft did not say which app it published");
+    return { catalogAppId: id, changed: true };
+}
+const INSTALL = {
+    team: {
+        path: (id) => `/v1.0/teams/${id}/installedApps`,
+        permission: "TeamsAppInstallation.ReadWriteAndConsentForTeam.All",
+        what: "team",
+    },
+    chat: {
+        path: (id) => `/v1.0/chats/${encodeURIComponent(id)}/installedApps`,
+        permission: "TeamsAppInstallation.ReadWriteAndConsentForChat.All",
+        what: "chat",
+    },
+    person: {
+        path: (id) => `/v1.0/users/${id}/teamwork/installedApps`,
+        permission: "TeamsAppInstallation.ReadWriteAndConsentForUser.All",
+        what: "person",
+    },
+};
+/** Adds the published app there, consenting to the package's resource-specific permissions
+ *  (Microsoft requires exactly the package's list). Already there counts as added. */
+export async function installBot(call, catalogAppId, kind, id) {
+    const spec = INSTALL[kind];
+    const res = await call({
+        method: "POST",
+        path: spec.path(id),
+        body: {
+            "teamsApp@odata.bind": `${GRAPH}/v1.0/appCatalogs/teamsApps/${catalogAppId}`,
+            consentedPermissionSet: {
+                resourceSpecificPermissions: RSC_PERMISSIONS.map((permissionValue) => ({
+                    permissionValue,
+                    permissionType: "application",
+                })),
+            },
+        },
+    });
+    if (ok(res))
+        return "added";
+    if (res.status === 409)
+        return "already";
+    const { code, message } = errorOf(res.data);
+    if (res.status === 403 && code !== "Authorization_RequestDenied")
+        throw new ConnectError(`Microsoft would not add the bot to this ${spec.what}. Your organization's Teams app settings may block it (the app's status, who it is available to, or a permission policy)${message ? `: ${message}` : "."}`);
+    if (res.status === 404)
+        throw new ConnectError(`Microsoft found no such ${spec.what}, or the bot is not in your Teams apps yet. Publish it first.`);
+    throw graphFailure(res, `adding the bot to this ${spec.what}`, spec.permission);
+}
+/** Chat ids from a pasted Teams link or the id itself. */
+export function chatIdFrom(raw) {
+    let text = raw.trim();
+    try {
+        text = decodeURIComponent(text);
+    }
+    catch {
+        return null;
+    }
+    return /19:[A-Za-z0-9_.-]+@thread\.(v2|skype)/.exec(text)?.[0] ?? null;
+}
+/** Teams or people matching what the admin typed, for the picker. */
+export async function searchTargets(call, kind, rawQuery) {
+    const query = rawQuery.replace(/["\\]/g, "").trim().slice(0, 100);
+    if (kind === "team") {
+        const q = new URLSearchParams({ $select: "id,displayName,description", $top: "20" });
+        if (query)
+            q.set("$filter", `startswith(displayName,'${query.replaceAll("'", "''")}')`);
+        const res = await call({ method: "GET", path: `/v1.0/teams?${q}` });
+        if (!ok(res))
+            throw graphFailure(res, "listing teams", "Team.ReadBasic.All");
+        return (res.data
+            .value ?? []).map((t) => ({ id: t.id, name: t.displayName ?? t.id, detail: t.description || null }));
+    }
+    if (!query)
+        return [];
+    const q = new URLSearchParams({
+        $search: `"displayName:${query}" OR "mail:${query}"`,
+        $select: "id,displayName,mail",
+        $top: "20",
+        $count: "true",
+    });
+    const res = await call({
+        method: "GET",
+        path: `/v1.0/users?${q}`,
+        headers: { consistencylevel: "eventual" },
+    });
+    if (!ok(res))
+        throw graphFailure(res, "looking up people", "User.ReadBasic.All");
+    return (res.data.value ?? []).map((u) => ({ id: u.id, name: u.displayName ?? u.id, detail: u.mail ?? null }));
+}
+//# sourceMappingURL=provision.js.map

package/dist/packages/server/src/teams/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../../../../packages/server/src/teams/provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,wCAAwC,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,EACL,YAAY,GAIb,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,mGAAmG;AACnG,6FAA6F;AAC7F,4FAA4F;AAC5F,uEAAuE;AACvE,6FAA6F;AAC7F,oFAAoF;AACpF,sEAAsE;AAEtE,MAAM,CAAC,MAAM,GAAG,GAAG,8BAA8B,CAAC;AAClD,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,CAAC,MAAM,aAAa,GAAG,sDAAsD,CAAC;AACpF,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,MAAM,KAAK,GAAG,mCAAmC,CAAC;AAElD,iGAAiG;AACjG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,cAAc,EAAE,YAAY,CAAU,CAAC;AAanE,MAAM,UAAU,WAAW,CAAC,MAA8B;IACxD,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC1F,OAAO,cAAc,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC/C,GAAG,KAAK,EAAE,CAAC,cAAc,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAEtD,MAAM,OAAO,GAAG,CAAC,CAAc,EAAE,IAAY,EAAE,EAAE,CAC/C,kBAAkB,CAAC,CAAC,cAAc,mBAAmB,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,+CAA+C,IAAI,EAAE,CAAC;AAEhJ,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,CAAC,GAAI,IAAiE,EAAE,KAAK,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC/C,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,IAAY,EAAE,UAAkB;IAChF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,6BAA6B,IAAI,IAAI,KAAK,WAAW,CAAC;QACxF,OAAO,IAAI,YAAY,CACrB,qBAAqB,IAAI,KAAK,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,cAAc,UAAU,8IAA8I,CAC9N,CAAC;IACJ,OAAO,IAAI,YAAY,CACrB,qBAAqB,IAAI,KAAK,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtG,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,UAAU,CACxB,GAAmB,EACnB,MAAmB,EACnB,IAAY;AACZ,mEAAmE;AACnE,UAAU,GAAG,KAAK;IAElB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,2BAA2B;QACxE,OAAO,IAAI,YAAY,CACrB,GAAG,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,sCAAsC,MAAM,CAAC,aAAa,SAAS,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,6DAA6D,2DAA2D,CACpR,CAAC;IACJ,IAAI,IAAI,KAAK,iCAAiC;QAC5C,OAAO,IAAI,YAAY,CACrB,oBAAoB,MAAM,CAAC,cAAc,0KAA0K,CACpN,CAAC;IACJ,IAAI,IAAI,KAAK,uBAAuB;QAClC,OAAO,IAAI,YAAY,CACrB,8BAA8B,MAAM,CAAC,aAAa,wBAAwB,MAAM,CAAC,cAAc,GAAG,CACnG,CAAC;IACJ,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,uBAAuB;QACrE,OAAO,IAAI,YAAY,CACrB,6BAA6B,MAAM,CAAC,cAAc,SAAS,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,WAAW,CAChG,CAAC;IACJ,OAAO,IAAI,YAAY,CACrB,iBAAiB,IAAI,KAAK,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClG,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,GAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;AAE1E,qFAAqF;AACrF,SAAS,cAAc,CAAC,IAAa,EAAE,WAAmB;IACxD,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClD,MAAM,EAAE,GAAI,CAAuC,CAAC,mBAAmB,CAAC;QACxE,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU;YAClD,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CACpD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD,MAAM,MAAM,GAAoC;IAC9C,GAAG,EAAE,6CAA6C;IAClD,SAAS,EAAE,uBAAuB;IAClC,QAAQ,EAAE,4BAA4B;IACtC,OAAO,EAAE,gCAAgC;IACzC,MAAM,EAAE,+BAA+B;CACxC,CAAC;AAEF,oFAAoF;AACpF,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1C;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAqB;IAItD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,UAAU,IAAI,CAAC,EAAmB,EAAE,GAAiC;QACxE,IAAI,MAAM;YAAE,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC;YAC5B,IAAI,OAAO;gBAAE,MAAM,GAAG,IAAI,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE;gBACF,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;gBACjB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAe,EAAE,CAAC;aAC5F,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,OAAsC,EACtC,KAAqC;QAErC,IAAI,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,MAAM;YACvB,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,KAAK,EAAE,CAAC,cAAc,QAAQ,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7D,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,kCAAkC,UAAU,IAAI;YACtD,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;YACxC,IAAI,EAAE;gBACJ,WAAW,EAAE,GAAG,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC,WAAW,GAAG;gBAC1D,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;YACb,MAAM,YAAY,CAChB,MAAM,EACN,qCAAqC,EACrC,+BAA+B,CAChC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,GAAG,EAAE,CACH,IAAI,CAAC;YACH,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kCAAkC,UAAU,oCAAoC;SACvF,CAAC,EACJ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;YACX,MAAM,YAAY,CAChB,IAAI,EACJ,oCAAoC,EACpC,+BAA+B,CAChC,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,IAA+D,CAAC;QACjF,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,6FAA6F;QAC7F,yEAAyE;QACzE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC;gBACrB,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,sBAAsB,GAAG,CAAC,EAAE,EAAE;gBACpC,IAAI,EAAE;oBACJ,cAAc,EAAE;wBACd;4BACE,IAAI,EAAE,oBAAoB;4BAC1B,KAAK,EAAE,QAAQ;4BACf,GAAG,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;4BAChE,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW;yBACjC;qBACF;iBACF;aACF,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;gBACV,MAAM,YAAY,CAAC,GAAG,EAAE,8BAA8B,EAAE,+BAA+B,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;IACnC,MAAM,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC;YACvB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kCAAkC,KAAK,eAAe;SAC7D,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YACtB,MAAM,YAAY,CAChB,KAAK,EACL,qCAAqC,EACrC,+BAA+B,CAChC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QAChF,6CAA6C;QAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAC5C,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAClC,MAAM,YAAY,CAChB,IAAI,EACJ,sCAAsC,EACtC,+BAA+B,CAChC,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QAChC,oFAAoF;QACpF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YACpC,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;YACrB,CAAC,CAAE,KAAK,CAAC,IAAuD,EAAE,UAAU,EAAE,QAAQ;YACtF,CAAC,CAAC,KAAK,CAAC;QACV,IAAI,KAAK,KAAK,KAAK;YACjB,MAAM,IAAI,YAAY,CACpB,sBAAsB,YAAY,CAAC,KAAM,CAAC,OAAO,MAAM,CAAC,aAAa,+FAA+F,CACrK,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,IAAI,gBAAgB,OAAO,EAAE;YACtC,IAAI,EAAE;gBACJ,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gBACnB,UAAU,EAAE;oBACV,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,QAAQ,EAAE,GAAG,KAAK,CAAC,SAAS,eAAe,KAAK,WAAW;oBAC3D,QAAQ,EAAE,KAAK;oBACf,UAAU,EAAE,cAAc;oBAC1B,cAAc,EAAE,GAAG,CAAC,QAAQ;iBAC7B;aACF;SACF,EACD,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACtE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,IAAI,wCAAwC,OAAO,EAAE;YAC9D,IAAI,EAAE;gBACJ,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;aAC/E;SACF,EACD,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,IAAI,IAAI,GAAwB,IAAI,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,IAAI;gBAAE,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC;gBAC1B,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAClD,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,8CAA8C,IAAK,CAAC,OAAO,kEAAkE,CAAC;IACvI,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;+CAG+C;AAC/C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE,MAA8B;IAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,gBAAgB,OAAO,EAAE,EAAE,EACvE,GAAG,CACJ,CAAC;QACF,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;gBACL,iCAAiC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACzG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAChC,MAAM,CAAC,IAAI,CACT,YAAY,CAAC,GAAG,EAAE,qCAAqC,EAAE,+BAA+B,CAAC;iBACtF,OAAO,CACX,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gDAAgD;AAEhD,kDAAkD;AAClD,MAAM,UAAU,GAAG;IACjB,wCAAwC;IACxC,iDAAiD;CAClD,CAAC;AAEF,sFAAsF;AACtF,gDAAgD;AAChD,SAAS,MAAM,CAAC,IAAa,EAAE,MAAc;IAC3C,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAE,EAAE,CACnC,OAAO,OAAO,KAAK,QAAQ;QAC3B,IAAI,MAAM,CACR,IAAI,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAC1E,GAAG,CACJ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,OAAO,GAAI,IAAmC,EAAE,KAAK,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,CAA8C,EAAE,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAU,EACV,MAA8B;IAE9B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAe;YACtB,OAAO,EAAE,kDAAkD;SAC5D,CAAC;QACF,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,KAAK,GAAc;QACvB,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,iCAAiC,MAAM,CAAC,aAAa,wBAAwB,MAAM,CAAC,cAAc,GAAG;KAC/G,CAAC;IACF,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,6FAA6F;QAC7F,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,uEAAuE;SAChL,EACD,GAAG,CACJ,CAAC;QACF,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;YACb,CAAC,CAAC;gBACE,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC,OAAO;aAC1E;YACH,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;gBACpC,CAAC,CAAC;oBACE,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,sCAAsC,MAAM,CAAC,aAAa,qGAAqG;iBACrM;gBACH,CAAC,CAAC,OAAO,CAAC,MAAM;oBACd,CAAC,CAAC;wBACE,KAAK,EAAE,SAAS;wBAChB,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,cAAc,MAAM,CAAC,aAAa,UAAU,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe;qBACtH;oBACH,CAAC,CAAC;wBACE,KAAK,EAAE,MAAM;wBACb,OAAO,EAAE,iBAAiB,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,wCAAwC,MAAM,CAAC,aAAa,GAAG;qBACnH,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;YAAE,MAAM,KAAK,CAAC;QAClD,IAAI,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,YAAY,GAChB,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IACpF,OAAO;QACL,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK;QAClF,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,0FAA0F;AAE1F;0DAC0D;AAC1D,MAAM,UAAU,WAAW,CACzB,MAA+B,EAC/B,MAA6D,EAC7D,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;IACxE,IACE,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ;QAC9B,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,QAAQ,OAAO;QACjD,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAC7B,CAAC,KAAK;QAEN,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,IAAI,KAAK;QACzC,MAAM,IAAI,YAAY,CACpB,wGAAwG,CACzG,CAAC;AACN,CAAC;AAED,SAAS,cAAc,CAAC,GAAmB;IACzC,MAAM,KAAK,GACT,GAAG,CAAC,IACL,EAAE,KAAK,CAAC;IACT,MAAM,KAAK,GAAG,KAAK,EAAE,UAAU,CAAC;IAChC,IAAI,KAAK,EAAE,IAAI,KAAK,+BAA+B,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,GAAG,CACF,CAAC,CAAwC,EAAE,EAAE,CAC3C,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CACzD;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,YAAY,CACrB,4CAA4C,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAC1C,OAAO,IAAI,YAAY,CACrB,0GAA0G,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,mDAAmD,CACvL,CAAC;IACJ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QACpB,OAAO,IAAI,YAAY,CACrB,+JAA+J,CAChK,CAAC;IACJ,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,IAAI,YAAY,CACrB,iCAAiC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACzG,CAAC;AACJ,CAAC;AAED;8DAC8D;AAC9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA0E,EAC1E,YAAmB,KAAK;IAExB,MAAM,EAAE,GAAG,KAAK,EAAE,IAAY,EAAE,IAAsC,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,KAAK,GAAG,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBACtC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;SACtD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,OAAO,EAAE,kBAAkB,KAAK,CAAC,UAAU,GAAG;QAC9C,OAAO,EAAE,iCAAiC;KAC3C,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,QAAQ,GACZ,KAAK,CAAC,IACP,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACb,IAAI,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;QACpE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ;QAClB,CAAC,CAAC,MAAM,EAAE,CAAC,+BAA+B,QAAQ,CAAC,EAAE,sCAAsC,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC;QACJ,CAAC,CAAC,MAAM,EAAE,CAAC,kDAAkD,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;IACP,qEAAqE;IACrE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,QAAQ,EAAE,EAAE,IAAK,GAAG,CAAC,IAA+B,EAAE,EAAE,CAAC;IACpE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,8CAA8C,CAAC,CAAC;IAChF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC;AAMD,MAAM,OAAO,GAGT;IACF,IAAI,EAAE;QACJ,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,gBAAgB;QAC/C,UAAU,EAAE,qDAAqD;QACjE,IAAI,EAAE,MAAM;KACb;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,kBAAkB,CAAC,EAAE,CAAC,gBAAgB;QACnE,UAAU,EAAE,qDAAqD;QACjE,IAAI,EAAE,MAAM;KACb;IACD,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,EAAE,yBAAyB;QACxD,UAAU,EAAE,qDAAqD;QACjE,IAAI,EAAE,QAAQ;KACf;CACF,CAAC;AAEF;sFACsF;AACtF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAU,EACV,YAAoB,EACpB,IAAiB,EACjB,EAAU;IAEV,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC;QACrB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,EAAE;YACJ,qBAAqB,EAAE,GAAG,KAAK,+BAA+B,YAAY,EAAE;YAC5E,sBAAsB,EAAE;gBACtB,2BAA2B,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBACrE,eAAe;oBACf,cAAc,EAAE,aAAa;iBAC9B,CAAC,CAAC;aACJ;SACF;KACF,CAAC,CAAC;IACH,IAAI,EAAE,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,6BAA6B;QAC9D,MAAM,IAAI,YAAY,CACpB,2CAA2C,IAAI,CAAC,IAAI,2HAA2H,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAChN,CAAC;IACJ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QACpB,MAAM,IAAI,YAAY,CACpB,2BAA2B,IAAI,CAAC,IAAI,+DAA+D,CACpG,CAAC;IACJ,MAAM,YAAY,CAAC,GAAG,EAAE,0BAA0B,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAU,EACV,IAAuB,EACvB,QAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,2BAA2B,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC7E,OAAO,CACJ,GAAG,CAAC,IAAiF;aACnF,KAAK,IAAI,EAAE,CACf,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;QAC5B,OAAO,EAAE,gBAAgB,KAAK,cAAc,KAAK,GAAG;QACpD,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC;QACrB,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe,CAAC,EAAE;QACxB,OAAO,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;IACjF,OAAO,CACJ,GAAG,CAAC,IAA0E,CAAC,KAAK,IAAI,EAAE,CAC5F,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC"}