@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/nhost.js

@@ -0,0 +1,304 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphqlError = void 0;
+exports.exportNhost = exportNhost;
+exports.refreshTokenHash = refreshTokenHash;
+exports.decryptTotp = decryptTotp;
+exports.byteaToBase64url = byteaToBase64url;
+exports.nhostGraphqlUrl = nhostGraphqlUrl;
+exports.fetchNhostRows = fetchNhostRows;
+exports.readNhostDump = readNhostDump;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const pocketbase_1 = require("./pocketbase");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/** Roles every Nhost user has implicitly: not carried as Atlas roles. */
+const IMPLICIT_ROLES = new Set(['user', 'me', 'anonymous', 'public']);
+function exportNhost(rows, opts = {}) {
+    const set = new record_set_1.RecordSet();
+    const now = (opts.now ?? Date.now)();
+    const key = opts.encryptionKey ? parseKey(opts.encryptionKey) : undefined;
+    const rolesOf = new Map();
+    for (const r of rows.userRoles) {
+        const userId = (0, record_set_1.str)(r.userId);
+        const role = (0, record_set_1.str)(r.role);
+        if (!userId || !role || IMPLICIT_ROLES.has(role))
+            continue;
+        (rolesOf.get(userId) ?? rolesOf.set(userId, new Set()).get(userId)).add((0, translate_kit_1.keyOf)(role));
+    }
+    const ids = new Set();
+    const allRoles = new Set();
+    let totpLocked = 0;
+    let totpBroken = 0;
+    for (const u of rows.users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id)
+            continue;
+        const user = mapUser(u, rolesOf.get(id));
+        if (!user) {
+            set.omit('user', 'user without an email or phone number who is not anonymous');
+            continue;
+        }
+        ids.add(id);
+        for (const r of user.roles ?? [])
+            allRoles.add(r);
+        set.add('user', (0, record_set_1.compact)(user));
+        const mfa = (0, record_set_1.str)(u.activeMfaType);
+        const secret = (0, record_set_1.str)(u.totpSecret);
+        if (mfa === 'totp' && secret) {
+            const plain = secret.length < 64 ? secret : key ? decryptTotp(secret, key) : undefined;
+            if (plain && /^[A-Z2-7]+=*$/i.test(plain))
+                set.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: plain.toUpperCase().replace(/=+$/, ''), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
+            else if (secret.length >= 64 && !key)
+                totpLocked++;
+            else
+                totpBroken++;
+        }
+        else if (mfa === 'sms') {
+            const phone = (0, record_set_1.e164)(u.phoneNumber);
+            if (phone)
+                set.add('mfa_factor', { user_id: id, type: 'phone', phone, verified: truthy(u.phoneNumberVerified) });
+        }
+    }
+    for (const r of [...allRoles].sort())
+        set.add('role', { key: r, name: r, scope: 'app' }, r);
+    if (totpLocked)
+        set.omit('mfa_factor', 'TOTP secret encrypted with AUTH_ENCRYPTION_KEY: pass --set nhost-encryption-key=<hex> to carry it, else those users enrol again', totpLocked);
+    if (totpBroken)
+        set.omit('mfa_factor', 'TOTP secret that does not decrypt with the given AUTH_ENCRYPTION_KEY', totpBroken);
+    for (const p of rows.providers) {
+        const userId = (0, record_set_1.str)(p.userId);
+        const provider = (0, record_set_1.str)(p.providerId);
+        const providerUserId = (0, record_set_1.str)(p.providerUserId);
+        if (!userId || !provider || !providerUserId || !ids.has(userId))
+            continue;
+        set.add('identity', (0, record_set_1.compact)({ id: (0, record_set_1.str)(p.id), user_id: userId, provider, provider_user_id: providerUserId, kind: 'oauth' }), `${provider}:${providerUserId}`);
+    }
+    const keys = rows.securityKeys.filter((k) => ids.has((0, record_set_1.str)(k.userId) ?? ''));
+    if (keys.length && !opts.rpId) {
+        set.omit('passkey', 'security key without a relying-party id: pass --set rp-id=<your WebAuthn rp id> (nhost.toml auth.method.webauthn.relyingParty.id)', keys.length);
+    }
+    else {
+        for (const k of keys) {
+            const credentialId = (0, record_set_1.str)(k.credentialId);
+            const publicKey = byteaToBase64url(k.credentialPublicKey);
+            if (!credentialId || !publicKey) {
+                set.omit('passkey', 'security key without its credential id or public key');
+                continue;
+            }
+            const transports = ((0, record_set_1.str)(k.transports) ?? '').split(',').map((t) => t.trim()).filter(Boolean);
+            set.add('passkey', (0, record_set_1.compact)({ id: (0, record_set_1.str)(k.id), user_id: (0, record_set_1.str)(k.userId), credential_id: credentialId, public_key: publicKey, sign_count: num(k.counter), rp_id: opts.rpId, transports, name: (0, record_set_1.str)(k.nickname) }));
+        }
+    }
+    let pats = 0;
+    let expired = 0;
+    for (const t of rows.refreshTokens) {
+        const userId = (0, record_set_1.str)(t.userId);
+        if (!userId || !ids.has(userId))
+            continue;
+        if (((0, record_set_1.str)(t.type) ?? 'regular') !== 'regular') {
+            pats++;
+            continue;
+        }
+        const expires = Date.parse((0, record_set_1.str)(t.expiresAt) ?? '');
+        if (!Number.isFinite(expires) || expires <= now) {
+            expired++;
+            continue;
+        }
+        const hash = refreshTokenHash(t);
+        if (!hash) {
+            set.omit('session', 'refresh token row without a readable hash');
+            continue;
+        }
+        set.add('session', (0, record_set_1.compact)({ id: (0, record_set_1.str)(t.id) ?? hash.slice(0, 32), user_id: userId, token_hash: hash, expires_at: (0, record_set_1.str)(t.expiresAt), created_at: (0, record_set_1.str)(t.createdAt) }));
+    }
+    if (pats)
+        set.omit('session', 'personal access token (reissue it as an Atlas API key)', pats);
+    if (expired)
+        set.omit('session', 'expired refresh token', expired);
+    const providers = new Set(set.list('identity').map((i) => i.provider));
+    set.manifest = { ...set.manifest, origin: opts.origin ?? 'nhost', providers: [...providers].sort(), ...(opts.rpId ? { rpId: opts.rpId } : {}) };
+    return set;
+}
+function mapUser(u, roles) {
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phoneNumber);
+    const anonymous = truthy(u.isAnonymous);
+    if (!email && !phone && !anonymous)
+        return null;
+    const all = new Set(roles ?? []);
+    const def = (0, record_set_1.str)(u.defaultRole);
+    if (def && !IMPLICIT_ROLES.has(def))
+        all.add((0, translate_kit_1.keyOf)(def));
+    const hash = (0, record_set_1.str)(u.passwordHash);
+    const meta = (0, record_set_1.isObj)(u.metadata) ? u.metadata : typeof u.metadata === 'string' ? safeJson(u.metadata) : undefined;
+    const locale = (0, record_set_1.str)(u.locale);
+    const user = {
+        id: (0, record_set_1.str)(u.id),
+        emails: email ? [{ email, verified: truthy(u.emailVerified), primary: true }] : undefined,
+        phones: phone ? [{ phone, verified: truthy(u.phoneNumberVerified), primary: !email }] : undefined,
+        name: (0, record_set_1.str)(u.displayName),
+        image_url: (0, record_set_1.str)(u.avatarUrl),
+        password: hash && /^\$2[aby]\$\d{2}\$/.test(hash) ? { algorithm: 'auto', hash } : undefined,
+        roles: all.size ? [...all].sort() : undefined,
+        banned: truthy(u.disabled) ? true : undefined,
+        anonymous: anonymous && !email && !phone ? true : undefined,
+        public_metadata: (0, record_set_1.bag)({ ...((0, record_set_1.isObj)(meta) ? meta : {}), ...(locale ? { locale } : {}) }),
+        created_at: (0, record_set_1.str)(u.createdAt),
+        last_sign_in_at: (0, record_set_1.str)(u.lastSeen),
+    };
+    return user;
+}
+/** `\x` + hex(sha256(token)) as Nhost stores it → the bundle's lowercase hex. */
+function refreshTokenHash(t) {
+    const raw = (0, record_set_1.str)(t.refreshTokenHash);
+    if (!raw) {
+        // Legacy hasura-auth kept the token itself (a UUID) in refresh_token.
+        const plain = (0, record_set_1.str)(t.refreshToken);
+        return plain ? (0, node_crypto_1.createHash)('sha256').update(plain, 'utf8').digest('hex') : undefined;
+    }
+    const hex = raw.replace(/^\\x/i, '').toLowerCase();
+    return /^[0-9a-f]{64}$/.test(hex) ? hex : undefined;
+}
+/**
+ * Current Nhost encrypts TOTP secrets: AES-256-GCM, stored as
+ * hex(nonce(12) || ciphertext || tag(16)), key = AUTH_ENCRYPTION_KEY (hex).
+ */
+function decryptTotp(stored, key) {
+    try {
+        const raw = Buffer.from(stored, 'hex');
+        if (raw.length < 12 + 16 + 1)
+            return undefined;
+        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, raw.subarray(0, 12));
+        decipher.setAuthTag(raw.subarray(raw.length - 16));
+        return Buffer.concat([decipher.update(raw.subarray(12, raw.length - 16)), decipher.final()]).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseKey(hex) {
+    const k = Buffer.from(hex.trim(), 'hex');
+    if (k.length !== 32)
+        throw new Error('The Nhost encryption key (AUTH_ENCRYPTION_KEY) must be 32 bytes as 64 hex characters.');
+    return k;
+}
+/** Postgres bytea as Hasura / psql print it (`\x…` hex), or base64 → base64url. */
+function byteaToBase64url(v) {
+    const s = (0, record_set_1.str)(v);
+    if (!s)
+        return undefined;
+    if (/^\\x[0-9a-f]*$/i.test(s))
+        return Buffer.from(s.slice(2), 'hex').toString('base64url');
+    return Buffer.from(s, 'base64').toString('base64url');
+}
+const truthy = (v) => v === true || v === 1 || v === '1' || v === 't' || v === 'true';
+const num = (v) => (typeof v === 'number' ? v : typeof v === 'string' && /^\d+$/.test(v) ? Number(v) : undefined);
+function safeJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return undefined;
+    }
+}
+// ── readers ─────────────────────────────────────────────────────────────────
+/** Nhost Cloud's GraphQL endpoint for a subdomain and region. */
+function nhostGraphqlUrl(o) {
+    return `https://${o.subdomain}.graphql.${o.region}.nhost.run/v1`;
+}
+const PAGE = 1000;
+const QUERIES = {
+    users: 'id createdAt lastSeen disabled displayName avatarUrl locale email phoneNumber passwordHash emailVerified phoneNumberVerified defaultRole isAnonymous totpSecret activeMfaType metadata',
+    authUserProviders: 'id userId providerId providerUserId',
+    authUserSecurityKeys: 'id userId credentialId credentialPublicKey counter transports nickname',
+    authUserRoles: 'userId role',
+    authRefreshTokens: 'id userId createdAt expiresAt refreshTokenHash type',
+};
+/** The auth tables through Hasura with the admin secret (sent only to the project). */
+async function fetchNhostRows(opts) {
+    const http = new vendor_http_1.VendorHttp({ vendor: 'Nhost', baseUrl: opts.graphqlUrl, headers: { 'x-hasura-admin-secret': opts.adminSecret }, fetchImpl: opts.fetchImpl, sleep: opts.sleep });
+    const progress = opts.onProgress ?? (() => undefined);
+    const list = async (root, fields, order) => {
+        const out = [];
+        for (let offset = 0;; offset += PAGE) {
+            const query = `query { ${root}(limit: ${PAGE}, offset: ${offset}, order_by: { ${order}: asc }) { ${fields} } }`;
+            const { body } = await http.post(opts.graphqlUrl, { query });
+            const errors = (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body.errors) : [];
+            if (errors.length)
+                throw new GraphqlError((0, record_set_1.str)(errors[0].message) ?? 'GraphQL error');
+            const rows = (0, record_set_1.isObj)(body) && (0, record_set_1.isObj)(body.data) ? (0, record_set_1.objs)(body.data[root]) : [];
+            out.push(...rows);
+            if (rows.length < PAGE)
+                return out;
+        }
+    };
+    progress('users');
+    const users = await list('users', QUERIES.users, 'createdAt');
+    progress('social links');
+    const providers = await list('authUserProviders', QUERIES.authUserProviders, 'id');
+    progress('security keys');
+    const securityKeys = await list('authUserSecurityKeys', QUERIES.authUserSecurityKeys, 'id');
+    progress('roles');
+    const userRoles = await list('authUserRoles', QUERIES.authUserRoles, 'userId');
+    progress('refresh tokens');
+    let refreshTokens;
+    try {
+        refreshTokens = await list('authRefreshTokens', QUERIES.authRefreshTokens, 'createdAt');
+    }
+    catch (err) {
+        // Projects older than personal access tokens have no `type` column.
+        if (!(err instanceof GraphqlError) || !/type/.test(err.message))
+            throw err;
+        refreshTokens = await list('authRefreshTokens', 'id userId createdAt expiresAt refreshTokenHash', 'createdAt');
+    }
+    return { users, providers, securityKeys, userRoles, refreshTokens };
+}
+class GraphqlError extends Error {
+}
+exports.GraphqlError = GraphqlError;
+/** Table names a dump may use for each auth table (`auth.users.csv`, `users.json`, `auth_users.ndjson` …). */
+const DUMP_TABLES = {
+    users: ['auth.users', 'auth_users', 'users'],
+    providers: ['auth.user_providers', 'auth_user_providers', 'user_providers'],
+    securityKeys: ['auth.user_security_keys', 'auth_user_security_keys', 'user_security_keys', 'auth.user_authenticators', 'user_authenticators'],
+    userRoles: ['auth.user_roles', 'auth_user_roles', 'user_roles'],
+    refreshTokens: ['auth.refresh_tokens', 'auth_refresh_tokens', 'refresh_tokens'],
+};
+/** A folder of `auth.*` table dumps (JSON, NDJSON or CSV with a header; snake_case columns). */
+function readNhostDump(dir) {
+    const byName = new Map();
+    for (const file of (0, node_fs_1.readdirSync)(dir).sort()) {
+        const path = (0, node_path_1.join)(dir, file);
+        const ext = (0, node_path_1.extname)(file).toLowerCase();
+        if (!(0, node_fs_1.statSync)(path).isFile() || !['.json', '.ndjson', '.jsonl', '.csv'].includes(ext))
+            continue;
+        byName.set((0, node_path_1.basename)(file, (0, node_path_1.extname)(file)).toLowerCase(), (0, pocketbase_1.parseTable)((0, node_fs_1.readFileSync)(path, 'utf8'), ext).map(camelRow));
+    }
+    const pick = (k) => {
+        for (const n of DUMP_TABLES[k]) {
+            const rows = byName.get(n);
+            if (rows)
+                return rows;
+        }
+        return [];
+    };
+    const rows = { users: pick('users'), providers: pick('providers'), securityKeys: pick('securityKeys'), userRoles: pick('userRoles'), refreshTokens: pick('refreshTokens') };
+    if (!rows.users.length)
+        throw new Error(`No auth.users table in ${dir} (expected users.json, auth.users.csv, …).`);
+    return rows;
+}
+/** `phone_number_verified` → `phoneNumberVerified`; empty CSV cells drop out. */
+function camelRow(r) {
+    const out = {};
+    for (const [k, v] of Object.entries(r)) {
+        if (v === '' || v === null)
+            continue;
+        out[k.replace(/_([a-z])/g, (_, c) => c.toUpperCase())] = v;
+    }
+    return out;
+}
+//# sourceMappingURL=nhost.js.map

package/dist/migrate/export/nhost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhost.js","sourceRoot":"","sources":["../../../src/migrate/export/nhost.ts"],"names":[],"mappings":";;;AAmDA,kCAgGC;AA+BD,4CASC;AAMD,kCAUC;AASD,4CAKC;AAeD,0CAEC;AAaD,wCAiCC;AAcD,sCAkBC;AAxTD,6CAA2D;AAC3D,qCAA8D;AAC9D,yCAAoD;AAEpD,6CAA0C;AAC1C,6CAAyF;AACzF,mDAAwC;AACxC,+CAA2C;AAyC3C,yEAAyE;AACzE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtE,SAAgB,WAAW,CAAC,IAAe,EAAE,OAA2B,EAAE;IACxE,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,GAAG,CAAC,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,4DAA4D,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,oBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IAAI,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC5M,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,GAAG;gBAAE,UAAU,EAAE,CAAC;;gBAC9C,UAAU,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,iIAAiI,EAAE,UAAU,CAAC,CAAC;IACtL,IAAI,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,sEAAsE,EAAE,UAAU,CAAC,CAAC;IAE3H,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,cAAc,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,EAAE,GAAG,QAAQ,IAAI,cAAc,EAAE,CAAC,CAAC;IACxK,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,mIAAmI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxK,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,YAAY,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;YAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7F,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAE,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAChN,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,EAAE,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAA,oBAAO,EAAC,EAAE,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAE,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACtK,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wDAAwD,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAEnE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAM,EAAE,KAA8B;IACrD,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAA,qBAAK,EAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAe;QACvB,EAAE,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAE;QACd,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACzF,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACjG,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC;QACxB,SAAS,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC3B,QAAQ,EAAE,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3F,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7C,SAAS,EAAE,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3D,eAAe,EAAE,IAAA,gBAAG,EAAC,EAAE,GAAG,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrF,UAAU,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC;QAC5B,eAAe,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;KACjC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAgB,gBAAgB,CAAC,CAAM;IACrC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,sEAAsE;QACtE,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,MAAc,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,SAAgB,gBAAgB,CAAC,CAAU;IACzC,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,CAAC;AACxG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC/I,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,iEAAiE;AACjE,SAAgB,eAAe,CAAC,CAAwC;IACtE,OAAO,WAAW,CAAC,CAAC,SAAS,YAAY,CAAC,CAAC,MAAM,eAAe,CAAC;AACnE,CAAC;AAED,MAAM,IAAI,GAAG,IAAI,CAAC;AAElB,MAAM,OAAO,GAAG;IACd,KAAK,EAAE,wLAAwL;IAC/L,iBAAiB,EAAE,qCAAqC;IACxD,oBAAoB,EAAE,wEAAwE;IAC9F,aAAa,EAAE,aAAa;IAC5B,iBAAiB,EAAE,qDAAqD;CAChE,CAAC;AAEX,uFAAuF;AAChF,KAAK,UAAU,cAAc,CAAC,IAAoJ;IACvL,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjL,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,EAAE,IAA0B,EAAE,MAAc,EAAE,KAAa,EAAkB,EAAE;QAC/F,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,KAAK,IAAI,MAAM,GAAG,CAAC,GAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,IAAI,WAAW,IAAI,aAAa,MAAM,iBAAiB,KAAK,cAAc,MAAM,MAAM,CAAC;YAChH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,YAAY,CAAC,IAAA,gBAAG,EAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;gBAAE,OAAO,GAAG,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9D,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACnF,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC5F,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC/E,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC3B,IAAI,aAAoB,CAAC;IACzB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,GAAG,CAAC;QAC3E,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,gDAAgD,EAAE,WAAW,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AACtE,CAAC;AAED,MAAa,YAAa,SAAQ,KAAK;CAAG;AAA1C,oCAA0C;AAE1C,8GAA8G;AAC9G,MAAM,WAAW,GAAsC;IACrD,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC;IAC5C,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;IAC3E,YAAY,EAAE,CAAC,yBAAyB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,qBAAqB,CAAC;IAC7I,SAAS,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,CAAC;IAC/D,aAAa,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,gBAAgB,CAAC;CAChF,CAAC;AAEF,gGAAgG;AAChG,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAChG,MAAM,CAAC,GAAG,CAAC,IAAA,oBAAQ,EAAC,IAAI,EAAE,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAA,uBAAU,EAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,EAAE;QAClC,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,MAAM,IAAI,GAAc,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;IACvL,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,4CAA4C,CAAC,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,CAAM;IACtB,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACrC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/okta-config.d.ts

@@ -0,0 +1,30 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate okta config` — an Okta org's policies and integrations →
+ * Atlas config, read with an API token on this machine: password policies,
+ * global session policy (lifetimes), authenticator enrollment (which second
+ * factors), social identity providers, custom authorization servers (APIs and
+ * scopes), OIDC apps (redirect URIs) and groups (roles). Sign-on rules beyond
+ * MFA, network zones, hooks and the sign-in widget are reported as manual.
+ */
+export interface OktaConfigSnapshot {
+    domain: string;
+    passwordPolicies: Obj[];
+    signOnPolicies: Array<Obj & {
+        rules?: Obj[];
+    }>;
+    authenticators: Obj[];
+    idps: Obj[];
+    authorizationServers: Array<Obj & {
+        scopes?: Obj[];
+    }>;
+    apps: Obj[];
+    groups: Obj[];
+    inlineHooks: Obj[];
+}
+export declare function fetchOktaConfig(http: VendorHttp, domain: string): Promise<OktaConfigSnapshot>;
+export declare function translateOktaConfig(snap: OktaConfigSnapshot, opts?: {
+    groupsAs?: 'roles' | 'organizations' | 'skip';
+}): TranslationResult;

package/dist/migrate/export/okta-config.js

@@ -0,0 +1,205 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchOktaConfig = fetchOktaConfig;
+exports.translateOktaConfig = translateOktaConfig;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchOktaConfig(http, domain) {
+    const all = async (path) => {
+        const out = [];
+        let next = path;
+        try {
+            while (next) {
+                const res = await http.get(next);
+                out.push(...(0, record_set_1.objs)(res.body));
+                next = (0, vendor_http_1.nextLink)(res.headers.get('link'));
+            }
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
+                return out;
+            throw err;
+        }
+        return out;
+    };
+    const signOn = (await all('/policies?type=OKTA_SIGN_ON'));
+    for (const p of signOn)
+        p.rules = await all(`/policies/${(0, record_set_1.str)(p.id)}/rules`);
+    const servers = (await all('/authorizationServers'));
+    for (const s of servers)
+        s.scopes = await all(`/authorizationServers/${(0, record_set_1.str)(s.id)}/scopes`);
+    return {
+        domain,
+        passwordPolicies: await all('/policies?type=PASSWORD'),
+        signOnPolicies: signOn,
+        authenticators: await all('/authenticators'),
+        idps: await all('/idps'),
+        authorizationServers: servers,
+        apps: await all('/apps?limit=200&filter=status%20eq%20%22ACTIVE%22'),
+        groups: (await all('/groups?limit=200')).filter((g) => (0, record_set_1.str)(g.type) !== 'BUILT_IN'),
+        inlineHooks: await all('/inlineHooks'),
+    };
+}
+function translateOktaConfig(snap, opts = {}) {
+    const b = new translate_kit_1.ConfigBuilder();
+    b.set('strategies.password', true);
+    b.add('differs', 'authentication', 'password', 'Password sign-in. Okta never exports password hashes: the okta lazy-migration preset checks each password against Okta on first sign-in.', 'auth_config.strategies.password');
+    // ── password policy: the default (lowest priority) policy is the org baseline ──
+    const pwPolicy = [...snap.passwordPolicies].sort((a, c) => Number(c.priority ?? 0) - Number(a.priority ?? 0))[0];
+    if (pwPolicy) {
+        const name = (0, record_set_1.str)(pwPolicy.name) ?? 'password policy';
+        const settings = (0, record_set_1.isObj)(pwPolicy.settings) && (0, record_set_1.isObj)(pwPolicy.settings.password) ? pwPolicy.settings.password : {};
+        const complexity = (0, record_set_1.isObj)(settings.complexity) ? settings.complexity : {};
+        const min = typeof complexity.minLength === 'number' ? complexity.minLength : 8;
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        b.add(min < 8 ? 'differs' : 'mapped', `policies ${name}`, 'settings.password.complexity.minLength', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+        if (['minLowerCase', 'minUpperCase', 'minNumber', 'minSymbol'].some((k) => Number(complexity[k] ?? 0) > 0)) {
+            b.add('differs', `policies ${name}`, 'settings.password.complexity (character classes)', 'Atlas follows NIST 800-63B: length and breached-password checks, no character-class rules.', 'auth_config.passwordPolicy');
+        }
+        if ((0, record_set_1.isObj)(complexity.dictionary) && (0, record_set_1.isObj)(complexity.dictionary.common) && complexity.dictionary.common.exclude === true) {
+            b.set('passwordPolicy.checkBreaches', true);
+            b.add('mapped', `policies ${name}`, 'settings.password.complexity.dictionary.common.exclude', 'Common / breached passwords are refused.', 'auth_config.passwordPolicy.checkBreaches');
+        }
+        const age = (0, record_set_1.isObj)(settings.age) ? settings.age : {};
+        if (Number(age.maxAgeDays ?? 0) > 0)
+            b.add('manual', `policies ${name}`, 'settings.password.age.maxAgeDays', 'Atlas does not expire passwords (NIST 800-63B).');
+        if (Number(age.historyCount ?? 0) > 0)
+            b.add('manual', `policies ${name}`, 'settings.password.age.historyCount', 'Atlas does not keep a password history.');
+        const lockout = (0, record_set_1.isObj)(settings.lockout) ? settings.lockout : {};
+        if (Number(lockout.maxAttempts ?? 0) > 0)
+            b.add('mapped', `policies ${name}`, 'settings.password.lockout.maxAttempts', `Okta locks after ${lockout.maxAttempts} attempts; Atlas throttles failed sign-ins per account and IP.`, 'auth_config.rateLimit');
+    }
+    if (snap.passwordPolicies.length > 1)
+        b.add('differs', 'policies', 'password policies', `${snap.passwordPolicies.length} password policies by group: Atlas has one instance-wide policy (the default one was used).`, 'auth_config.passwordPolicy');
+    // ── global session policy ──
+    const defaultSignOn = snap.signOnPolicies.find((p) => p.system === true) ?? snap.signOnPolicies[snap.signOnPolicies.length - 1];
+    const rule = (defaultSignOn?.rules ?? []).find((r) => r.system !== true && (0, record_set_1.str)(r.status) === 'ACTIVE') ?? defaultSignOn?.rules?.[0];
+    const session = rule && (0, record_set_1.isObj)(rule.actions) && (0, record_set_1.isObj)(rule.actions.signon) && (0, record_set_1.isObj)(rule.actions.signon.session) ? rule.actions.signon.session : undefined;
+    if (session) {
+        const area = `policies ${(0, record_set_1.str)(defaultSignOn?.name) ?? 'global session'}`;
+        const life = Number(session.maxSessionLifetimeMinutes ?? 0);
+        const idle = Number(session.maxSessionIdleMinutes ?? 0);
+        if (life > 0) {
+            b.set('session.absoluteMs', (0, translate_kit_1.clampSessionMs)(life * 60_000));
+            b.add('mapped', area, 'actions.signon.session.maxSessionLifetimeMinutes', `${life} minutes.`, 'auth_config.session.absoluteMs');
+        }
+        if (idle > 0) {
+            b.set('session.idleMs', (0, translate_kit_1.clampSessionMs)(idle * 60_000));
+            b.add('mapped', area, 'actions.signon.session.maxSessionIdleMinutes', `${idle} minutes idle.`, 'auth_config.session.idleMs');
+        }
+        if (rule && (0, record_set_1.isObj)(rule.actions) && (0, record_set_1.isObj)(rule.actions.signon) && rule.actions.signon.requireFactor === true) {
+            b.set('mfaPolicy', 'required');
+            b.add('mapped', area, 'actions.signon.requireFactor', 'A second factor on every sign-in.', 'auth_config.mfaPolicy');
+        }
+    }
+    if (snap.signOnPolicies.length > 1)
+        b.add('manual', 'policies', 'sign-on policies by group / network zone', 'Okta applies different sign-on rules per group and network zone; Atlas has instance-wide session settings plus step-up. Review the per-group rules by hand.', 'auth_config.stepUp');
+    // ── authenticators ──
+    for (const a of snap.authenticators) {
+        if ((0, record_set_1.str)(a.status) !== 'ACTIVE')
+            continue;
+        const key = (0, record_set_1.str)(a.key);
+        const name = (0, record_set_1.str)(a.name) ?? key ?? '?';
+        if (key === 'google_otp' || key === 'okta_verify') {
+            b.set('mfa.factors.totp', true);
+            b.add(key === 'okta_verify' ? 'differs' : 'mapped', 'authenticators', `${name} (${key})`, key === 'okta_verify' ? 'Okta Verify push / number challenge has no Atlas counterpart; its TOTP mode maps to authenticator apps (seeds do not move: users re-enrol).' : 'Authenticator apps (users re-enrol: Okta does not export seeds).', 'auth_config.mfa.factors.totp');
+        }
+        else if (key === 'webauthn') {
+            b.set('mfa.factors.passkey', true);
+            b.set('strategies.passkey', true);
+            b.add('differs', 'authenticators', `${name} (webauthn)`, 'Security keys and biometrics. Okta does not export WebAuthn credentials: users register again.', 'auth_config.mfa.factors.passkey');
+        }
+        else if (key === 'okta_email') {
+            b.set('mfa.factors.emailCode', true);
+            b.add('mapped', 'authenticators', `${name} (okta_email)`, 'Email code.', 'auth_config.mfa.factors.emailCode');
+        }
+        else if (key === 'phone_number') {
+            b.add('differs', 'authenticators', `${name} (phone_number)`, 'SMS / voice: phone factors move with --factors; Atlas recommends TOTP or passkeys as the second factor.', 'auth_config.mfa');
+        }
+        else if (key && key !== 'okta_password') {
+            b.add('manual', 'authenticators', `${name} (${key})`, 'No Atlas counterpart (security question, Duo, RSA, YubiKey OTP, smart card…): those users enrol an Atlas factor.');
+        }
+    }
+    // ── social identity providers ──
+    for (const idp of snap.idps) {
+        if ((0, record_set_1.str)(idp.status) === 'INACTIVE')
+            continue;
+        const type = (0, record_set_1.str)(idp.type) ?? '';
+        const name = (0, record_set_1.str)(idp.name) ?? type;
+        if (type === 'SAML2' || type === 'OIDC') {
+            b.add('mapped', 'identity providers', `${name} (${type})`, 'Enterprise IdP: moves with the data export as an Atlas SSO connection; update the IdP with Atlas\'s ACS URL / redirect URI, and replace Okta routing rules with the connection\'s domains.', 'sso_connections');
+            continue;
+        }
+        const key = (0, translate_kit_1.socialKey)(type);
+        if (!key) {
+            b.add('manual', 'identity providers', `${name} (${type})`, 'No built-in Atlas provider: add it as a custom OAuth provider.', 'custom_oauth_providers');
+            continue;
+        }
+        const protocol = (0, record_set_1.isObj)(idp.protocol) ? idp.protocol : {};
+        const client = (0, record_set_1.isObj)(protocol.credentials) && (0, record_set_1.isObj)(protocol.credentials.client) ? protocol.credentials.client : {};
+        b.socialProvider({ atlasKey: key, vendorName: name, area: 'identity providers', setting: `${name} (${type})`, clientId: (0, record_set_1.str)(client.client_id), scopes: (0, record_set_1.strs)(protocol.scopes) });
+    }
+    // ── authorization servers → APIs ──
+    for (const s of snap.authorizationServers) {
+        if ((0, record_set_1.str)(s.status) === 'INACTIVE')
+            continue;
+        const audiences = (0, record_set_1.strs)(s.audiences);
+        const scopes = (s.scopes ?? []).filter((sc) => sc.system !== true).map((sc) => (0, record_set_1.str)(sc.name)).filter((sc) => !!sc);
+        for (const aud of audiences) {
+            b.push('resource_servers', { identifier: aud, name: (0, record_set_1.str)(s.name) ?? aud, scopes });
+            b.add('mapped', `authorization servers ${(0, record_set_1.str)(s.name) ?? (0, record_set_1.str)(s.id)}`, `audiences ${aud}`, `An API with ${scopes.length} custom scope(s); Atlas access tokens for it keep "aud": "${aud}".`, `resource_servers ${aud}`);
+        }
+        if ((0, record_set_1.objs)(s.claims).length)
+            b.add('manual', `authorization servers ${(0, record_set_1.str)(s.name) ?? (0, record_set_1.str)(s.id)}`, 'claims', 'Custom token claims: recreate them as an Atlas JWT template / session claims.', 'jwt_templates');
+    }
+    // ── OIDC apps → redirect URLs ──
+    const redirects = new Set();
+    for (const app of snap.apps) {
+        const oauth = (0, record_set_1.isObj)(app.settings) && (0, record_set_1.isObj)(app.settings.oauthClient) ? app.settings.oauthClient : undefined;
+        if (!oauth)
+            continue;
+        for (const u of (0, record_set_1.strs)(oauth.redirect_uris))
+            redirects.add(u);
+        const grants = (0, record_set_1.strs)(oauth.grant_types);
+        if (grants.includes('client_credentials'))
+            b.add('manual', `apps ${(0, record_set_1.str)(app.label) ?? (0, record_set_1.str)(app.name)}`, 'grant_types client_credentials', 'A service app: create an Atlas M2M client for it.', 'oauth_clients');
+    }
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*')) {
+            b.add('differs', 'apps', `redirect_uris ${url}`, 'Atlas redirect URLs are exact (no wildcards).', 'redirect_urls');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        b.add('mapped', 'apps', 'redirect_uris', `${exact} redirect URI(s).`, 'redirect_urls');
+    // ── groups ──
+    const groupsAs = opts.groupsAs ?? 'roles';
+    if (groupsAs === 'roles') {
+        for (const g of snap.groups) {
+            const name = (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.name : undefined);
+            if (!name)
+                continue;
+            const key = (0, translate_kit_1.keyOf)(name);
+            b.roles[name] = key;
+            b.push('roles', { key, name, description: (0, record_set_1.str)((0, record_set_1.isObj)(g.profile) ? g.profile.description : undefined) ?? '', permissions: [] });
+        }
+        if (snap.groups.length)
+            b.add('differs', 'groups', 'groups', `${snap.groups.length} group(s) become Atlas app roles (memberships move with the data export). Group rules and app assignments are not translated.`, 'roles');
+    }
+    else if (groupsAs === 'organizations' && snap.groups.length) {
+        b.add('differs', 'groups', 'groups', 'Groups become organizations with the data export (--groups-as organizations).', 'organizations');
+    }
+    for (const h of snap.inlineHooks) {
+        if ((0, record_set_1.str)(h.status) === 'ACTIVE')
+            b.add('manual', 'inline hooks', `${(0, record_set_1.str)(h.name) ?? '?'} (${(0, record_set_1.str)(h.type) ?? '?'})`, 'Okta inline hook: port it to an Atlas action or webhook.', 'actions');
+    }
+    return b.result(`Okta org ${snap.domain}`, {
+        bridge: { preset: 'okta', vars: { domain: snap.domain } },
+        lazy: { preset: 'okta', config: { domain: snap.domain } },
+    });
+}
+//# sourceMappingURL=okta-config.js.map

package/dist/migrate/export/okta-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"okta-config.js","sourceRoot":"","sources":["../../../src/migrate/export/okta-config.ts"],"names":[],"mappings":";;AA0BA,0CA+BC;AAED,kDAoJC;AA7MD,6CAAgE;AAChE,mDAAkF;AAClF,+CAAqE;AAsB9D,KAAK,UAAU,eAAe,CAAC,IAAgB,EAAE,MAAc;IACpE,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAkB,EAAE;QACjD,MAAM,GAAG,GAAU,EAAE,CAAC;QACtB,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAwC,MAAM,IAAI,CAAC,GAAG,CAAU,IAAI,CAAC,CAAC;gBAC/E,GAAG,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,IAAI,GAAG,IAAA,sBAAQ,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC;YACjF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,6BAA6B,CAAC,CAAyC,CAAC;IAClG,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,uBAAuB,CAAC,CAA+C,CAAC;IACnG,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,yBAAyB,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3F,OAAO;QACL,MAAM;QACN,gBAAgB,EAAE,MAAM,GAAG,CAAC,yBAAyB,CAAC;QACtD,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,MAAM,GAAG,CAAC,iBAAiB,CAAC;QAC5C,IAAI,EAAE,MAAM,GAAG,CAAC,OAAO,CAAC;QACxB,oBAAoB,EAAE,OAAO;QAC7B,IAAI,EAAE,MAAM,GAAG,CAAC,mDAAmD,CAAC;QACpE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;QAClF,WAAW,EAAE,MAAM,GAAG,CAAC,cAAc,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAwB,EAAE,OAA0D,EAAE;IACxH,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,0IAA0I,EAAE,iCAAiC,CAAC,CAAC;IAE9N,kFAAkF;IAClF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,UAAU,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,GAAG,GAAG,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,wCAAwC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACzO,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3G,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,IAAI,EAAE,EAAE,kDAAkD,EAAE,4FAA4F,EAAE,4BAA4B,CAAC,CAAC;QACvN,CAAC;QACD,IAAI,IAAA,kBAAK,EAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAA,kBAAK,EAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACzH,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,wDAAwD,EAAE,0CAA0C,EAAE,0CAA0C,CAAC,CAAC;QACxL,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,kCAAkC,EAAE,iDAAiD,CAAC,CAAC;QAChK,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,oCAAoC,EAAE,yCAAyC,CAAC,CAAC;QAC5J,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,uCAAuC,EAAE,oBAAoB,OAAO,CAAC,WAAW,gEAAgE,EAAE,uBAAuB,CAAC,CAAC;IAC3P,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,6FAA6F,EAAE,4BAA4B,CAAC,CAAC;IAEpP,8BAA8B;IAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChI,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,IAAI,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1J,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,YAAY,IAAA,gBAAG,EAAC,aAAa,EAAE,IAAI,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAA,8BAAc,EAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,kDAAkD,EAAE,GAAG,IAAI,WAAW,EAAE,gCAAgC,CAAC,CAAC;QAClI,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAA,8BAAc,EAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,8CAA8C,EAAE,GAAG,IAAI,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;QAC/H,CAAC;QACD,IAAI,IAAI,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5G,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,0CAA0C,EAAE,6JAA6J,EAAE,oBAAoB,CAAC,CAAC;IAEjS,uBAAuB;IACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,SAAS;QACzC,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC;QACvC,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAClD,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,6IAA6I,CAAC,CAAC,CAAC,kEAAkE,EAAE,8BAA8B,CAAC,CAAC;QACxW,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI,aAAa,EAAE,gGAAgG,EAAE,iCAAiC,CAAC,CAAC;QAChM,CAAC;aAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,eAAe,EAAE,aAAa,EAAE,mCAAmC,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,IAAI,iBAAiB,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;QAC7L,CAAC;aAAM,IAAI,GAAG,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,kHAAkH,CAAC,CAAC;QAC5K,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,SAAS;QAC7C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,4LAA4L,EAAE,iBAAiB,CAAC,CAAC;YAC5Q,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,gEAAgE,EAAE,wBAAwB,CAAC,CAAC;YACvJ,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAA,kBAAK,EAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpH,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClL,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1C,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,UAAU;YAAE,SAAS;QAC3C,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChI,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAU,CAAC,CAAC;YAC1F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,eAAe,MAAM,CAAC,MAAM,6DAA6D,GAAG,IAAI,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACxN,CAAC;QACD,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,+EAA+E,EAAE,eAAe,CAAC,CAAC;IAC9M,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAA,kBAAK,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,KAAK,CAAC,aAAa,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAA,gBAAG,EAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,gCAAgC,EAAE,mDAAmD,EAAE,eAAe,CAAC,CAAC;IAChN,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAiB,GAAG,EAAE,EAAE,+CAA+C,EAAE,eAAe,CAAC,CAAC;YACnH,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,mBAAmB,EAAE,eAAe,CAAC,CAAC;IAElG,eAAe;IACf,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YACpB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,+HAA+H,EAAE,OAAO,CAAC,CAAC;IAC9N,CAAC;SAAM,IAAI,QAAQ,KAAK,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,+EAA+E,EAAE,eAAe,CAAC,CAAC;IACzI,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,0DAA0D,EAAE,SAAS,CAAC,CAAC;IAC1L,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;QACzD,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;KAC1D,CAAC,CAAC;AACL,CAAC"}