@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.9022f22

package/dist/connectors/microsoft/client.d.ts

@@ -0,0 +1,66 @@
+import type { Toolset } from "../../packages/connector-kit/src/common.js";
+import { type ConnectorContext, type ConnectorModule } from "../../packages/connector-kit/src/connector.js";
+import { type CheckInput, type Fetch, type ProviderClient, type Vendor, type VendorConnection, type VendorRequest } from "../../packages/connector-kit/src/types.js";
+/** config.auth of a connection approved for the shared app. A value stored in existing rows
+ *  (it predates the service's own name), so it never changes. */
+export declare const SHARED_APP_AUTH = "arbium_app";
+export declare const EXCHANGE_SUFFIX = " (Exchange Online)";
+export declare const GUID: RegExp;
+export type SharedApp = {
+    clientId: string;
+    clientSecret: string;
+};
+export declare function tokenClaim(jwt: string, claim: string): string | null;
+/** The application permissions in an access token (its `roles` claim). */
+export declare function tokenRoles(jwt: string): string[];
+/** The permissions the ticked capabilities need that the app lacks. Extra ones are the
+ *  admin's choice, so they are not called out. */
+export declare function compareRoles(granted: string[], input: CheckInput): string | undefined;
+export declare function microsoftClient(options: {
+    sharedApp: SharedApp | null;
+}, unguarded?: Fetch, sleep?: (ms: number) => Promise<unknown>): {
+    provider: ProviderClient;
+    call: (connection: VendorConnection, request: VendorRequest, origin?: string) => Promise<{
+        status: number;
+        data: unknown;
+        headers: {
+            [k: string]: string;
+        };
+    }>;
+    permissions: (connection: VendorConnection, input: CheckInput) => Promise<{
+        values: string[];
+        warning: string | undefined;
+    }>;
+    cancelUpload: (uploadUrl: string) => Promise<number>;
+    delegated: {
+        signInUrl(c: VendorConnection, input: {
+            state: string;
+            redirectUri: string;
+            nonce: string;
+            scope: string;
+        }): string;
+        /** The code redeemed with the connection's own credential. Returns the access token and
+         *  the id token's claims (straight from Microsoft over TLS, so not signature-checked). */
+        redeem(c: VendorConnection, input: {
+            code: string;
+            redirectUri: string;
+            scope: string;
+        }): Promise<{
+            accessToken: string;
+            claims: Record<string, unknown>;
+        }>;
+    };
+};
+export type MicrosoftClient = ReturnType<typeof microsoftClient>;
+/** What a built-in app's module is given: also the deployment's Microsoft client. */
+export type BuiltinContext = ConnectorContext & {
+    microsoft: MicrosoftClient;
+};
+export type BuiltinModule = ConnectorModule<BuiltinContext>;
+/** Apps that need only the Microsoft connection: Outlook mail and calendar (mailboxes are
+ *  reached through the customer's Exchange role assignments to the app, scoped to the
+ *  branding's mailbox group, never through Graph Mail or Calendars permissions), Teams, Entra ID
+ *  and Intune. `keep`: the app's own choice fields kept in its config; nothing else the form
+ *  sends is, so no field can shadow the provider's config. */
+export declare function mailboxVendor(ms: MicrosoftClient, keep?: readonly string[]): Vendor;
+export declare const microsoftApp: (id: string, toolset: Toolset) => BuiltinModule;

package/dist/connectors/microsoft/client.js

@@ -0,0 +1,452 @@
+import { createHash } from "node:crypto";
+import { brand } from "../../packages/connector-kit/src/branding.js";
+import { clientAssertion } from "../../packages/connector-kit/src/certificate.js";
+import { choiceFields, } from "../../packages/connector-kit/src/connector.js";
+import { vendorFetch, vendorUrl } from "../../packages/connector-kit/src/fetch.js";
+import { ConnectError, TokenCache, } from "../../packages/connector-kit/src/types.js";
+// One Microsoft connection per organization, shared by the Microsoft apps (mail, files).
+// Normally the customer's own single-tenant Entra app, signing in with a certificate the
+// service made (client assertion) or a client secret. Where the deployment offers it, instead
+// the deployment's shared multi-tenant app, approved by the customer's administrator.
+// config.auth: "certificate" | "client_secret" | SHARED_APP_AUTH.
+/** config.auth of a connection approved for the shared app. A value stored in existing rows
+ *  (it predates the service's own name), so it never changes. */
+export const SHARED_APP_AUTH = "arbium_app";
+// Entra role template ids (the same in every tenant) of the roles that can approve an app:
+// Global Administrator, Privileged Role Administrator, Cloud Application Administrator,
+// Application Administrator.
+const APPROVER_ROLES = new Set([
+    "62e90394-69f5-4237-9190-012177145e10",
+    "e8611ab8-c189-46e8-94e1-60213ab1f814",
+    "158c047a-c907-4556-b7ef-446551a6b5f7",
+    "9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3",
+]);
+const LOGIN = "https://login.microsoftonline.com";
+const GRAPH = "https://graph.microsoft.com";
+// Office 365 Exchange Online: permissions granted on it in Entra (full_access_as_app, its
+// Mail.*) open mailboxes through EWS and never show in a Graph token.
+const EXCHANGE = "https://outlook.office365.com";
+export const EXCHANGE_SUFFIX = " (Exchange Online)";
+export const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+// Right after approval Microsoft can take a few seconds to make the app usable in the tenant.
+const CONNECT_RETRY_MS = [3000, 6000, 10000];
+const tokenUrl = (tenant) => `${LOGIN}/${tenant}/oauth2/v2.0/token`;
+// Claims of a token Microsoft just handed us over TLS; no signature check needed.
+function tokenClaims(jwt) {
+    try {
+        return JSON.parse(Buffer.from(jwt.split(".")[1], "base64url").toString("utf8"));
+    }
+    catch {
+        throw new ConnectError("Microsoft returned an unreadable token");
+    }
+}
+export function tokenClaim(jwt, claim) {
+    try {
+        const value = tokenClaims(jwt)[claim];
+        return typeof value === "string" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The application permissions in an access token (its `roles` claim). */
+export function tokenRoles(jwt) {
+    const roles = tokenClaims(jwt).roles;
+    return (Array.isArray(roles) ? roles : [])
+        .filter((r) => typeof r === "string")
+        .sort();
+}
+/** The permissions the ticked capabilities need that the app lacks. Extra ones are the
+ *  admin's choice, so they are not called out. */
+export function compareRoles(granted, input) {
+    const missing = input.expected.filter((r) => !granted.includes(r));
+    if (!missing.length)
+        return undefined;
+    const them = missing.length > 1 ? "them" : "it";
+    return `Missing: ${missing.join(", ")}. Add ${them} to the app and grant admin consent, or agents cannot do what you ticked.`;
+}
+function safeJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+export function microsoftClient(options, unguarded = fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms))) {
+    const fetchImpl = vendorFetch("Microsoft", unguarded, (s) => sleep(s * 1000));
+    const { sharedApp } = options;
+    const tokens = new TokenCache();
+    async function requestToken(tenant, form) {
+        const res = await fetchImpl(tokenUrl(tenant), {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form),
+        });
+        const body = (await res.json().catch(() => ({})));
+        return { ok: res.ok, status: res.status, body };
+    }
+    // The token request's form for this connection's way of signing in.
+    function credentials(c) {
+        const { auth, tenantId, clientId, certificate } = c.config;
+        if (auth === SHARED_APP_AUTH) {
+            if (!sharedApp)
+                throw new ConnectError(`This Microsoft connection was approved for ${brand().productName}'s shared app, which this deployment does not offer. Disconnect Microsoft and connect it with your own app registration.`);
+            return { client_id: sharedApp.clientId, client_secret: sharedApp.clientSecret };
+        }
+        if (!GUID.test(tenantId ?? "") || !GUID.test(clientId ?? ""))
+            throw new Error("Microsoft connection has no tenantId or clientId");
+        if (auth === "client_secret") {
+            if (!c.secret.client_secret)
+                throw new Error("Microsoft connection has no client secret");
+            return { client_id: clientId, client_secret: c.secret.client_secret };
+        }
+        if (auth === "certificate") {
+            if (!certificate || !c.secret.private_key)
+                throw new Error("Microsoft connection has no certificate");
+            return {
+                client_id: clientId,
+                client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                client_assertion: clientAssertion({
+                    clientId,
+                    tokenUrl: tokenUrl(tenantId),
+                    certificate,
+                    privateKey: c.secret.private_key,
+                }),
+            };
+        }
+        throw new Error(`Microsoft connection has unknown sign-in ${auth}`);
+    }
+    // `resource`: the API the token is for, Microsoft Graph unless an app names another (e.g.
+    // Exchange Online).
+    async function mint(c, resource = GRAPH) {
+        const tenant = c.config.tenantId ?? "";
+        if (!GUID.test(tenant))
+            throw new Error("Microsoft connection has no tenantId");
+        const { ok, status, body } = await requestToken(tenant, {
+            grant_type: "client_credentials",
+            scope: `${resource}/.default`,
+            ...credentials(c),
+        });
+        if (!ok || !body.access_token) {
+            const why = (body.error_description ?? body.error ?? String(status)).split(/\r?\n/)[0];
+            throw new ConnectError(`Microsoft refused the app's sign-in: ${why.slice(0, 300)}`);
+        }
+        return { token: body.access_token, expiresIn: body.expires_in ?? 3600 };
+    }
+    // Cached per credential, so a new certificate or secret never reuses an old token.
+    const cacheKey = (c, resource) => createHash("sha256")
+        .update([
+        resource,
+        c.config.auth,
+        c.config.tenantId,
+        c.config.clientId,
+        c.config.certificate,
+        c.secret.client_secret,
+    ].join("\n"))
+        .digest("hex");
+    async function send(token, request, origin = GRAPH) {
+        // Uploads send the file's bytes; everything else is JSON.
+        const raw = request.body instanceof Uint8Array;
+        // A file's content answers 302 to a pre-authenticated SharePoint download address, fetched
+        // without the token; any other redirect is refused.
+        const download = request.responseType === "text" ? unguarded : fetchImpl;
+        let res = await download(vendorUrl(origin, request.path), {
+            redirect: "manual",
+            method: request.method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: "application/json",
+                ...request.headers,
+                ...(request.body === undefined
+                    ? {}
+                    : { "content-type": raw ? "application/octet-stream" : "application/json" }),
+            },
+            body: request.body === undefined
+                ? undefined
+                : raw
+                    ? request.body
+                    : JSON.stringify(request.body),
+        });
+        if (download === unguarded && res.status >= 300 && res.status < 400) {
+            await res.body?.cancel();
+            res = await fetchImpl(sharePointUrl(res.headers.get("location") ?? ""));
+        }
+        const text = await res.text();
+        const asText = request.responseType === "text" && res.ok;
+        return {
+            status: res.status,
+            data: asText ? text : text ? safeJson(text) : null,
+            headers: Object.fromEntries(res.headers),
+        };
+    }
+    /** A request to Graph, or to `origin` with a token for it, re-minting the token once on a
+     *  401. */
+    async function call(connection, request, origin = GRAPH) {
+        const key = cacheKey(connection, origin);
+        const token = () => tokens.get(key, () => mint(connection, origin));
+        let res = await send(await token(), request, origin);
+        if (res.status === 401) {
+            tokens.forget(key);
+            res = await send(await token(), request, origin);
+        }
+        return res;
+    }
+    /** Compares the app's permissions, read from fresh Graph and Exchange Online tokens, with
+     *  what the app's capabilities need. Exchange Online ones are shown with EXCHANGE_SUFFIX.
+     *  Microsoft calls its tokens opaque to clients, so an unreadable one only means this
+     *  readout is unavailable; the connection itself still works. */
+    async function permissions(connection, input) {
+        const [graph, exchange] = await Promise.all([mint(connection), mint(connection, EXCHANGE)]);
+        let roles;
+        try {
+            roles = [
+                ...tokenRoles(graph.token),
+                ...tokenRoles(exchange.token).map((r) => `${r}${EXCHANGE_SUFFIX}`),
+            ];
+        }
+        catch (error) {
+            if (!(error instanceof ConnectError))
+                throw error;
+            return {
+                values: [],
+                warning: "Could not read the app's permissions from Microsoft's token.",
+            };
+        }
+        return { values: roles, warning: compareRoles(roles, input) };
+    }
+    const provider = {
+        async connect(fields, existing) {
+            const tenantId = fields.tenant_id?.trim().toLowerCase() ?? "";
+            const clientId = fields.client_id?.trim().toLowerCase() ?? "";
+            const clientSecret = fields.client_secret?.trim() ?? "";
+            if (!GUID.test(tenantId))
+                throw new ConnectError("Enter the Directory (tenant) ID from the app's Overview page");
+            if (!GUID.test(clientId))
+                throw new ConnectError("Enter the Application (client) ID from the app's Overview page");
+            let connection;
+            if (clientSecret)
+                connection = {
+                    config: { auth: "client_secret", tenantId, clientId },
+                    secret: { client_secret: clientSecret },
+                };
+            else {
+                const certificate = existing?.config.certificate;
+                const privateKey = existing?.secret.private_key;
+                if (!certificate || !privateKey)
+                    throw new ConnectError("Create the certificate and upload it to the app, or enter a client secret");
+                connection = {
+                    config: { auth: "certificate", tenantId, clientId, certificate },
+                    secret: { private_key: privateKey },
+                };
+            }
+            const { token } = await mint(connection);
+            const servicePrincipalId = tokenClaim(token, "oid");
+            if (!servicePrincipalId)
+                throw new Error("Microsoft token has no oid claim");
+            if (tokenClaim(token, "tid") !== tenantId)
+                throw new ConnectError("Microsoft signed the app in to another organization");
+            // A certificate made for rotating stays waiting with the connection.
+            const next = existing?.config.nextCertificate;
+            return {
+                config: {
+                    ...connection.config,
+                    servicePrincipalId,
+                    ...(next ? { nextCertificate: next } : {}),
+                },
+                secret: {
+                    ...connection.secret,
+                    ...(next && existing?.secret.next_private_key
+                        ? { next_private_key: existing.secret.next_private_key }
+                        : {}),
+                },
+                accountLabel: tenantId,
+            };
+        },
+        async verify(connection) {
+            await mint(connection);
+        },
+        ...(sharedApp ? { approval: sharedApproval(sharedApp) } : {}),
+    };
+    function sharedApproval(app) {
+        return {
+            clientId: app.clientId,
+            consentUrl({ state, redirectUri }) {
+                const q = new URLSearchParams({
+                    client_id: app.clientId,
+                    scope: `${GRAPH}/.default`,
+                    redirect_uri: redirectUri,
+                    state,
+                });
+                return `${LOGIN}/organizations/v2.0/adminconsent?${q}`;
+            },
+            signInUrl({ tenant, state, redirectUri, nonce }) {
+                if (!GUID.test(tenant))
+                    throw new ConnectError(`Microsoft did not say which organization approved ${brand().productName}`);
+                const q = new URLSearchParams({
+                    client_id: app.clientId,
+                    response_type: "code",
+                    response_mode: "query",
+                    scope: "openid",
+                    redirect_uri: redirectUri,
+                    state,
+                    nonce,
+                });
+                return `${LOGIN}/${tenant}/oauth2/v2.0/authorize?${q}`;
+            },
+            async proveTenant({ tenant, code, redirectUri, nonce }) {
+                const { ok, status, body } = await requestToken(tenant, {
+                    grant_type: "authorization_code",
+                    client_id: app.clientId,
+                    client_secret: app.clientSecret,
+                    code,
+                    redirect_uri: redirectUri,
+                    scope: "openid",
+                });
+                if (!ok || !body.id_token)
+                    throw new ConnectError(`Microsoft did not confirm the sign-in (${body.error ?? status})`);
+                // Straight from Microsoft's token endpoint over TLS with the shared app's secret, so the token's
+                // signature need not be checked again (OpenID Connect Core 3.1.3.7).
+                const claims = tokenClaims(body.id_token);
+                const issuer = `${LOGIN}/${tenant}/v2.0`;
+                const fresh = typeof claims.exp === "number" && claims.exp * 1000 > Date.now();
+                if (claims.aud !== app.clientId ||
+                    claims.iss !== issuer ||
+                    claims.nonce !== nonce ||
+                    !fresh)
+                    throw new ConnectError("Microsoft's sign-in did not match this approval. Start again.");
+                // A guest signs in to the tenant but belongs to another one (idp names its home).
+                const guest = typeof claims.idp === "string" && !claims.idp.includes(tenant);
+                if (claims.tid !== tenant || guest)
+                    throw new ConnectError(`Sign in with an account of the organization that approved ${brand().productName}, not a guest or another organization's account.`);
+                // The approval's admin_consent=true came through the browser, so the account signing in
+                // must itself hold a role that can approve apps. `wids` is in the id token only when
+                // the shared app's manifest sets groupMembershipClaims to DirectoryRole (or All).
+                const roles = Array.isArray(claims.wids) ? claims.wids : null;
+                if (!roles)
+                    throw new ConnectError(`Microsoft did not say whether this account is an administrator, so the approval cannot be confirmed. Contact ${brand().productName}.`);
+                if (!roles.some((r) => typeof r === "string" && APPROVER_ROLES.has(r.toLowerCase())))
+                    throw new ConnectError("Sign in with an administrator who can approve apps for your organization (Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator).");
+            },
+            async connect(rawTenant) {
+                const tenant = rawTenant.trim().toLowerCase();
+                if (!GUID.test(tenant))
+                    throw new ConnectError(`Microsoft did not say which organization approved ${brand().productName}`);
+                const connection = {
+                    config: { auth: SHARED_APP_AUTH, tenantId: tenant, clientId: app.clientId },
+                    secret: {},
+                };
+                let failure = null;
+                for (const wait of [0, ...CONNECT_RETRY_MS]) {
+                    if (wait)
+                        await sleep(wait);
+                    try {
+                        // A fresh token each try: one minted before the approval applied lacks its role.
+                        const { token } = await mint(connection);
+                        const org = await send(token, {
+                            method: "GET",
+                            path: "/v1.0/organization?$select=displayName,verifiedDomains",
+                        });
+                        if (org.status !== 200) {
+                            failure = new ConnectError(`Microsoft answered ${org.status} when ${brand().productName} checked the connection`);
+                            continue;
+                        }
+                        const servicePrincipalId = tokenClaim(token, "oid");
+                        if (!servicePrincipalId)
+                            throw new Error("Microsoft token has no oid claim");
+                        const info = org.data.value?.[0];
+                        const domain = info?.verifiedDomains?.find((d) => d.isDefault)?.name;
+                        const name = info?.displayName ?? tenant;
+                        return {
+                            config: { ...connection.config, servicePrincipalId, organization: name },
+                            secret: {},
+                            accountLabel: domain ? `${name} (${domain})` : name,
+                        };
+                    }
+                    catch (error) {
+                        if (!(error instanceof ConnectError))
+                            throw error;
+                        failure = error;
+                    }
+                }
+                throw failure;
+            },
+        };
+    }
+    // Cancels an upload session. Its address is pre-authenticated, so no token is sent, and
+    // only a SharePoint address is called.
+    async function cancelUpload(uploadUrl) {
+        return (await fetchImpl(sharePointUrl(uploadUrl), { method: "DELETE" })).status;
+    }
+    // An administrator signing in to the connection's own app, for what Microsoft allows only on
+    // a person's behalf (publishing to the Teams app catalog). The token is used at once and
+    // never kept.
+    const delegated = {
+        signInUrl(c, input) {
+            const { tenantId, clientId } = c.config;
+            if (!GUID.test(tenantId ?? "") || !GUID.test(clientId ?? ""))
+                throw new Error("Microsoft connection has no tenantId or clientId");
+            const q = new URLSearchParams({
+                client_id: clientId,
+                response_type: "code",
+                response_mode: "query",
+                scope: `openid ${input.scope}`,
+                redirect_uri: input.redirectUri,
+                state: input.state,
+                nonce: input.nonce,
+                prompt: "select_account",
+            });
+            return `${LOGIN}/${tenantId}/oauth2/v2.0/authorize?${q}`;
+        },
+        /** The code redeemed with the connection's own credential. Returns the access token and
+         *  the id token's claims (straight from Microsoft over TLS, so not signature-checked). */
+        async redeem(c, input) {
+            const { ok, status, body } = await requestToken(c.config.tenantId ?? "", {
+                grant_type: "authorization_code",
+                code: input.code,
+                redirect_uri: input.redirectUri,
+                scope: `openid ${input.scope}`,
+                ...credentials(c),
+            });
+            if (!ok || !body.access_token || !body.id_token) {
+                const why = (body.error_description ?? body.error ?? String(status)).split(/\r?\n/)[0];
+                throw new ConnectError(`Microsoft did not confirm the sign-in: ${why.slice(0, 300)}`);
+            }
+            return { accessToken: body.access_token, claims: tokenClaims(body.id_token) };
+        },
+    };
+    return { provider, call, permissions, cancelUpload, delegated };
+}
+// Pre-authenticated addresses Graph hands out (downloads, upload sessions) are on SharePoint.
+function sharePointUrl(raw) {
+    const url = URL.parse(raw);
+    if (url?.protocol !== "https:" || !/\.sharepoint\.com$/i.test(url.hostname))
+        throw new ConnectError(`Microsoft pointed to an address that is not SharePoint: ${url?.hostname ?? "none"}`);
+    return url.toString();
+}
+/** Apps that need only the Microsoft connection: Outlook mail and calendar (mailboxes are
+ *  reached through the customer's Exchange role assignments to the app, scoped to the
+ *  branding's mailbox group, never through Graph Mail or Calendars permissions), Teams, Entra ID
+ *  and Intune. `keep`: the app's own choice fields kept in its config; nothing else the form
+ *  sends is, so no field can shadow the provider's config. */
+export function mailboxVendor(ms, keep = []) {
+    return {
+        async connect(fields, provider) {
+            if (!provider)
+                throw new Error("Microsoft apps connect through the Microsoft connection");
+            const config = Object.fromEntries(keep.filter((k) => fields[k]).map((k) => [k, fields[k]]));
+            return { config, secret: {}, accountLabel: provider.accountLabel };
+        },
+        call: ms.call,
+        checks: { permissions: ms.permissions },
+    };
+}
+// A Microsoft app keeps its own choice fields (its JSON) and nothing else.
+export const microsoftApp = (id, toolset) => ({
+    id,
+    create: ({ microsoft, connector }) => ({
+        vendor: mailboxVendor(microsoft, choiceFields(connector)),
+        toolset,
+    }),
+});
+//# sourceMappingURL=client.js.map

package/dist/connectors/microsoft/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../connectors/microsoft/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,8CAA8C,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAElF,OAAO,EACL,YAAY,GAGb,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,YAAY,EACZ,UAAU,GAOX,MAAM,2CAA2C,CAAC;AAEnD,yFAAyF;AACzF,yFAAyF;AACzF,8FAA8F;AAC9F,sFAAsF;AACtF,kEAAkE;AAElE;iEACiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,2FAA2F;AAC3F,wFAAwF;AACxF,6BAA6B;AAC7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;IACtC,sCAAsC;CACvC,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,mCAAmC,CAAC;AAClD,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,0FAA0F;AAC1F,sEAAsE;AACtE,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AACpD,MAAM,CAAC,MAAM,IAAI,GAAG,gEAAgE,CAAC;AACrF,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAI7C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,MAAM,oBAAoB,CAAC;AAE5E,kFAAkF;AAClF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,wCAAwC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SACjD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;kDACkD;AAClD,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,KAAiB;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,OAAO,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,2EAA2E,CAAC;AAChI,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,eAAe,CAC7B,OAAwC,EACxC,YAAmB,KAAK,EACxB,QAAQ,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,IAA4B;QACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAgB,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,oEAAoE;IACpE,SAAS,WAAW,CAAC,CAAmB;QACtC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3D,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,YAAY,CACpB,8CAA8C,KAAK,EAAE,CAAC,WAAW,0HAA0H,CAC5L,CAAC;YACJ,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC1F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;gBACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,OAAO;gBACL,SAAS,EAAE,QAAQ;gBACnB,qBAAqB,EAAE,wDAAwD;gBAC/E,gBAAgB,EAAE,eAAe,CAAC;oBAChC,QAAQ;oBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;oBAC5B,WAAW;oBACX,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW;iBACjC,CAAC;aACH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,0FAA0F;IAC1F,oBAAoB;IACpB,KAAK,UAAU,IAAI,CAAC,CAAmB,EAAE,QAAQ,GAAG,KAAK;QACvD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAChF,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;YACtD,UAAU,EAAE,oBAAoB;YAChC,KAAK,EAAE,GAAG,QAAQ,WAAW;YAC7B,GAAG,WAAW,CAAC,CAAC,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,YAAY,CAAC,wCAAwC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAG,CAAC,CAAmB,EAAE,QAAgB,EAAE,EAAE,CACzD,UAAU,CAAC,QAAQ,CAAC;SACjB,MAAM,CACL;QACE,QAAQ;QACR,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,MAAM,CAAC,aAAa;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,OAAsB,EAAE,MAAM,GAAG,KAAK;QACvE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC;QAC/C,2FAA2F;QAC3F,oDAAoD;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACxD,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,OAAO,CAAC,OAAO;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC5B,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;aAC/E;YACD,IAAI,EACF,OAAO,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG;oBACH,CAAC,CAAE,OAAO,CAAC,IAAgC;oBAC3C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAClD,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;eACW;IACX,KAAK,UAAU,IAAI,CAAC,UAA4B,EAAE,OAAsB,EAAE,MAAM,GAAG,KAAK;QACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;qEAGiE;IACjE,KAAK,UAAU,WAAW,CAAC,UAA4B,EAAE,KAAiB;QACxE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG;gBACN,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC1B,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;gBAAE,MAAM,KAAK,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,8DAA8D;aACxE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAmB;QAC/B,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,gEAAgE,CAAC,CAAC;YAC3F,IAAI,UAA4B,CAAC;YACjC,IAAI,YAAY;gBACd,UAAU,GAAG;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;oBACrD,MAAM,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;iBACxC,CAAC;iBACC,CAAC;gBACJ,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;gBACjD,MAAM,UAAU,GAAG,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC;gBAChD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;oBAC7B,MAAM,IAAI,YAAY,CACpB,2EAA2E,CAC5E,CAAC;gBACJ,UAAU,GAAG;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE;oBAChE,MAAM,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;iBACpC,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,kBAAkB,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC7E,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,QAAQ;gBACvC,MAAM,IAAI,YAAY,CAAC,qDAAqD,CAAC,CAAC;YAChF,qEAAqE;YACrE,MAAM,IAAI,GAAG,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC;YAC9C,OAAO;gBACL,MAAM,EAAE;oBACN,GAAG,UAAU,CAAC,MAAM;oBACpB,kBAAkB;oBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;gBACD,MAAM,EAAE;oBACN,GAAG,UAAU,CAAC,MAAM;oBACpB,GAAG,CAAC,IAAI,IAAI,QAAQ,EAAE,MAAM,CAAC,gBAAgB;wBAC3C,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE;wBACxD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,YAAY,EAAE,QAAQ;aACvB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;IAEF,SAAS,cAAc,CAAC,GAAc;QACpC,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE;gBAC/B,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;oBAC5B,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,KAAK,EAAE,GAAG,KAAK,WAAW;oBAC1B,YAAY,EAAE,WAAW;oBACzB,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,oCAAoC,CAAC,EAAE,CAAC;YACzD,CAAC;YAED,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;gBAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBACpB,MAAM,IAAI,YAAY,CACpB,qDAAqD,KAAK,EAAE,CAAC,WAAW,EAAE,CAC3E,CAAC;gBACJ,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;oBAC5B,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,aAAa,EAAE,MAAM;oBACrB,aAAa,EAAE,OAAO;oBACtB,KAAK,EAAE,QAAQ;oBACf,YAAY,EAAE,WAAW;oBACzB,KAAK;oBACL,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,IAAI,MAAM,0BAA0B,CAAC,EAAE,CAAC;YACzD,CAAC;YAED,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;gBACpD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE;oBACtD,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,GAAG,CAAC,QAAQ;oBACvB,aAAa,EAAE,GAAG,CAAC,YAAY;oBAC/B,IAAI;oBACJ,YAAY,EAAE,WAAW;oBACzB,KAAK,EAAE,QAAQ;iBAChB,CAAC,CAAC;gBACH,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;oBACvB,MAAM,IAAI,YAAY,CAAC,0CAA0C,IAAI,CAAC,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC;gBAC5F,iGAAiG;gBACjG,qEAAqE;gBACrE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,OAAO,CAAC;gBACzC,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/E,IACE,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ;oBAC3B,MAAM,CAAC,GAAG,KAAK,MAAM;oBACrB,MAAM,CAAC,KAAK,KAAK,KAAK;oBACtB,CAAC,KAAK;oBAEN,MAAM,IAAI,YAAY,CAAC,+DAA+D,CAAC,CAAC;gBAC1F,kFAAkF;gBAClF,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7E,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,IAAI,KAAK;oBAChC,MAAM,IAAI,YAAY,CACpB,6DAA6D,KAAK,EAAE,CAAC,WAAW,kDAAkD,CACnI,CAAC;gBACJ,wFAAwF;gBACxF,qFAAqF;gBACrF,kFAAkF;gBAClF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7E,IAAI,CAAC,KAAK;oBACR,MAAM,IAAI,YAAY,CACpB,gHAAgH,KAAK,EAAE,CAAC,WAAW,GAAG,CACvI,CAAC;gBACJ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;oBAClF,MAAM,IAAI,YAAY,CACpB,+LAA+L,CAChM,CAAC;YACN,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,SAAS;gBACrB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;oBACpB,MAAM,IAAI,YAAY,CACpB,qDAAqD,KAAK,EAAE,CAAC,WAAW,EAAE,CAC3E,CAAC;gBACJ,MAAM,UAAU,GAAG;oBACjB,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;oBAC3E,MAAM,EAAE,EAAE;iBACX,CAAC;gBACF,IAAI,OAAO,GAAwB,IAAI,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC5B,IAAI,CAAC;wBACH,iFAAiF;wBACjF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;wBACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;4BAC5B,MAAM,EAAE,KAAK;4BACb,IAAI,EAAE,wDAAwD;yBAC/D,CAAC,CAAC;wBACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;4BACvB,OAAO,GAAG,IAAI,YAAY,CACxB,sBAAsB,GAAG,CAAC,MAAM,SAAS,KAAK,EAAE,CAAC,WAAW,yBAAyB,CACtF,CAAC;4BACF,SAAS;wBACX,CAAC;wBACD,MAAM,kBAAkB,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;wBACpD,IAAI,CAAC,kBAAkB;4BAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;wBAC7E,MAAM,IAAI,GAAI,GAAG,CAAC,IAA8B,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC5D,MAAM,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;wBACrE,MAAM,IAAI,GAAG,IAAI,EAAE,WAAW,IAAI,MAAM,CAAC;wBACzC,OAAO;4BACL,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,IAAI,EAAE;4BACxE,MAAM,EAAE,EAAE;4BACV,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI;yBACpD,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;4BAAE,MAAM,KAAK,CAAC;wBAClD,OAAO,GAAG,KAAK,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,MAAM,OAAQ,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,uCAAuC;IACvC,KAAK,UAAU,YAAY,CAAC,SAAiB;QAC3C,OAAO,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,CAAC;IAED,6FAA6F;IAC7F,yFAAyF;IACzF,cAAc;IACd,MAAM,SAAS,GAAG;QAChB,SAAS,CACP,CAAmB,EACnB,KAA2E;YAE3E,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;gBAC5B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,MAAM;gBACrB,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBAC9B,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO,GAAG,KAAK,IAAI,QAAQ,0BAA0B,CAAC,EAAE,CAAC;QAC3D,CAAC;QAED;kGAC0F;QAC1F,KAAK,CAAC,MAAM,CAAC,CAAmB,EAAE,KAA2D;YAC3F,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;gBACvE,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,KAAK,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBAC9B,GAAG,WAAW,CAAC,CAAC,CAAC;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChD,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvF,MAAM,IAAI,YAAY,CAAC,0CAA0C,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,CAAC;KACF,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAQD,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzE,MAAM,IAAI,YAAY,CACpB,2DAA2D,GAAG,EAAE,QAAQ,IAAI,MAAM,EAAE,CACrF,CAAC;IACJ,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAID;;;;8DAI8D;AAC9D,MAAM,UAAU,aAAa,CAAC,EAAmB,EAAE,OAA0B,EAAE;IAC7E,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ;YAC5B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAiB,EAAE,CAAC,CAAC;IAC5E,EAAE;IACF,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACzD,OAAO;KACR,CAAC;CACH,CAAC,CAAC"}