@atlasauth/emulator-core 0.2.0 → 0.3.0

package/dist/handlers/emu4-trust.js

@@ -0,0 +1,543 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordAudit = recordAudit;
+exports.auditMutation = auditMutation;
+exports.sweepChain = sweepChain;
+exports.emu4TrustHandlers = emu4TrustHandlers;
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const backend_1 = require("@atlasauth/backend");
+const crypto_util_1 = require("../crypto-util");
+const errors_1 = require("../errors");
+const jws_1 = require("../jws");
+const store_1 = require("../store");
+const emu4_trust_binding_1 = require("./emu4-trust-binding");
+const support_1 = require("./support");
+/**
+ * Trust surfaces: the audit log every successful write leaves, the tamper-evident hash chain over it (status, links,
+ * signed checkpoints, verification), one-time capability tickets, and the trusted devices a user remembers for MFA.
+ * Session binding and device-bound sessions live in `emu4-trust-binding.ts`.
+ */
+const ROW_CAP = 20_000;
+/** Rows must be this old before the chain links them (the real worker's settling delay). */
+const SETTLE_MS = 60_000;
+const CHECKPOINT_TYP = 'audit-checkpoint+jwt';
+const MAX_INT = Number.MAX_SAFE_INTEGER;
+const st = (0, support_1.engineState)((e) => ({
+    rows: [],
+    byId: new Map(),
+    chain: null,
+    tickets: new Map(),
+    devices: new store_1.Table('trusted_devices', e.clock.now, 'tdev'),
+}));
+/** Append one audit row (what the real service writes for every mutation); the oldest rows fall off at 20000, like retention. */
+function recordAudit(e, a) {
+    const s = st(e);
+    const row = { id: e.db.newId('audit'), actor_type: a.actor_type, actor_id: a.actor_id, action: a.action, target_type: a.target_type, target_id: a.target_id, ip: a.ip ?? null, user_agent: a.user_agent ?? null, metadata: a.metadata ?? {}, created_at: e.clock.now() };
+    s.rows.push(row);
+    s.byId.set(row.id, row);
+    if (s.rows.length > ROW_CAP)
+        s.byId.delete(s.rows.shift().id);
+    return row;
+}
+const singular = (w) => (/ies$/.test(w) ? `${w.slice(0, -3)}y` : /[^s]s$/.test(w) ? w.slice(0, -1) : w);
+const past = (v) => (/e$/.test(v) ? `${v}d` : /ed$/.test(v) ? v : /^(un)?(ban|pin|tag|log|rip)$/.test(v) ? `${v}${v.slice(-1)}ed` : `${v}ed`);
+/** Paths that are reads, protocol traffic or already audited by their own handler. */
+const NOT_AUDITED = /^\/(__emulator|\.well-known|oauth2|scim)|^\/v1\/(audit\/chain|client\/session_binding|client\/dbsc|tickets|client\/tickets)|\/binding$|\/tokens(\/[^/]+)?$|\/(verify|introspect|resolve|explain|simulate|evaluate|check|preview|test)$/;
+/** Called by the engine after every successful write: leaves the audit row the real service would (names like `user.created`, `session.revoked`). */
+function auditMutation(e, w) {
+    if (w.method === 'GET' || NOT_AUDITED.test(w.path))
+        return;
+    const ids = new Set(Object.values(w.params));
+    const segs = w.path.replace(/^\/v1\//, '').split('/').filter(Boolean);
+    const idsInPath = segs.filter((x) => ids.has(x));
+    const names = segs.filter((x) => !ids.has(x));
+    const object = typeof w.body?.object === 'string' ? String(w.body.object) : null;
+    const lastIsId = ids.has(segs[segs.length - 1] ?? '');
+    const last = names[names.length - 1] ?? 'resource';
+    const parent = names[names.length - 2];
+    let type = singular(last);
+    let verb = w.method === 'DELETE' ? 'deleted' : w.method === 'POST' && !lastIsId ? 'created' : 'updated';
+    // `POST /things/:id/ban` is a verb on the thing; `POST /orgs/:id/memberships` creates a nested row (its answer names another object).
+    if (w.method === 'POST' && !lastIsId && idsInPath.length > 0 && parent && object !== singular(last) && (object === null || object === singular(parent))) {
+        type = singular(parent);
+        verb = past(last);
+    }
+    const bodyId = typeof w.body?.id === 'string' ? String(w.body.id) : null;
+    recordAudit(e, {
+        actor_type: w.key ? 'api_key' : 'public',
+        actor_id: w.key ? `emulator_key_${Math.max(0, e.keys.indexOf(w.key))}` : null,
+        action: `${type}.${verb}`,
+        target_type: type,
+        target_id: idsInPath[idsInPath.length - 1] ?? bodyId,
+        // The route, never the request body: bodies carry personal data and secrets.
+        metadata: { method: w.method, path: w.path },
+    });
+}
+// ── the chain ──
+const jwksUri = (e) => `${e.issuer}/.well-known/jwks.json`;
+const linkHashAt = (e, ch, seq) => (seq <= 0 ? (0, backend_1.auditChainGenesis)(e.instanceId) : ch.links.find((l) => l.seq === seq)?.link_hash);
+const noChain = () => new errors_1.EmulatorError('NOT_FOUND', 'The audit chain is not on.');
+const cpView = (c) => ({ object: 'audit_chain_checkpoint', id: c.id, seq: c.seq, link_hash: c.link_hash, kid: c.kid, alg: c.alg, jws: c.jws, signed_at: c.signed_at });
+function unchainedRows(e, ch, settleMs) {
+    const cutoff = e.clock.now() - settleMs;
+    return st(e).rows.filter((r) => r.created_at >= ch.enabled_at && r.created_at < cutoff && !ch.chained.has(r.id));
+}
+/** Sign a checkpoint with the engine's current signing key; the header type is the documented `audit-checkpoint+jwt`. */
+async function signCheckpoint(e, seq, linkHash) {
+    // The token service keeps its keys private; a checkpoint needs a custom header type, so read the current key from it.
+    const t = e.tokens;
+    await t.ensure();
+    const cur = t.current();
+    const alg = cur.jwks.keys[0].alg;
+    const enc = (o) => (0, crypto_util_1.bytesToB64url)(new TextEncoder().encode(JSON.stringify(o)));
+    const input = `${enc({ alg, kid: cur.kid, typ: CHECKPOINT_TYP })}.${enc({ instance_id: e.instanceId, seq, link_hash: linkHash, link_count: seq, iat: Math.floor(e.clock.now() / 1000) })}`;
+    const ec = alg === 'ES256';
+    let key = cur.privateKey;
+    if (typeof key.export === 'function')
+        key = await crypto.subtle.importKey('jwk', key.export({ format: 'jwk' }), ec ? { name: 'ECDSA', namedCurve: 'P-256' } : { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign(ec ? { name: 'ECDSA', hash: 'SHA-256' } : { name: 'RSASSA-PKCS1-v1_5' }, key, new TextEncoder().encode(input));
+    return { jws: `${input}.${(0, crypto_util_1.bytesToB64url)(new Uint8Array(sig))}`, kid: cur.kid, alg };
+}
+/** Recompute the chain from `fromSeq` against the audit rows as stored now. */
+function verifyLinks(e, ch, o) {
+    const from = Math.max(1, o.fromSeq ?? 1);
+    const maxLinks = Math.min(o.maxLinks ?? 20_000, 100_000);
+    const to = Math.min(o.toSeq ?? ch.head_seq, ch.head_seq);
+    let prev = linkHashAt(e, ch, from - 1);
+    const v = { ok: true, checked: 0, pruned: 0, firstBreak: null, nextSeq: from - 1, done: false };
+    if (prev === undefined)
+        return { ...v, ok: false, firstBreak: { seq: from - 1, reason: 'gap' } };
+    let cursor = from - 1;
+    const todo = ch.links.filter((l) => l.seq > cursor && l.seq <= to).sort((a, b) => a.seq - b.seq);
+    for (const l of todo) {
+        if (v.checked >= maxLinks)
+            break;
+        if (l.seq !== cursor + 1)
+            return { ...v, ok: false, firstBreak: { seq: cursor + 1, reason: 'gap' } };
+        const row = st(e).byId.get(l.audit_id);
+        if (row) {
+            if ((0, backend_1.auditRowHash)(row) !== l.row_hash)
+                return { ...v, ok: false, firstBreak: { seq: l.seq, reason: 'row_modified' } };
+        }
+        else
+            v.pruned += 1;
+        if ((0, backend_1.auditLinkHash)(prev, l.seq, l.row_hash) !== l.link_hash)
+            return { ...v, ok: false, firstBreak: { seq: l.seq, reason: 'link_mismatch' } };
+        prev = l.link_hash;
+        cursor = l.seq;
+        v.checked += 1;
+        v.nextSeq = cursor;
+    }
+    // The stored head must be the last link examined when the whole chain was walked.
+    if (cursor >= ch.head_seq && ch.head_seq > 0 && prev !== ch.head_hash)
+        return { ...v, ok: false, firstBreak: { seq: ch.head_seq, reason: 'link_mismatch' } };
+    v.done = cursor >= to;
+    return v;
+}
+/** Signature against the published keys and the claimed head against the stored link; a key that left the published set is `unverifiable`, not a break. */
+async function checkCheckpoints(e, ch, cps) {
+    const keys = (await e.tokens.jwks()).keys;
+    const out = { checked: 0, valid: 0, unverifiable: 0, mismatched: 0 };
+    for (const c of cps) {
+        out.checked += 1;
+        const d = (0, jws_1.decodeJwt)(c.jws);
+        const jwk = keys.find((k) => k.kid === c.kid);
+        const verified = !!(d && jwk && d.header.typ === CHECKPOINT_TYP && d.header.kid === c.kid && (await (0, jws_1.verifyJws)(d, jwk)));
+        const claims = verified ? d.payload : null;
+        if (!claims)
+            out.unverifiable += 1;
+        const claimed = claims ? claims.link_hash : c.link_hash;
+        if (linkHashAt(e, ch, c.seq) !== c.link_hash || claimed !== c.link_hash || (claims && (claims.seq !== c.seq || claims.instance_id !== e.instanceId)))
+            out.mismatched += 1;
+        else if (claims)
+            out.valid += 1;
+    }
+    return out;
+}
+function raiseTamper(e, detail) {
+    recordAudit(e, { actor_type: 'system', actor_id: 'audit_chain', action: 'audit_chain.tamper_detected', target_type: 'instance', target_id: e.instanceId, metadata: detail });
+    e.webhooks.emit('audit_chain.tamper_detected', { object: 'audit_chain', ...detail });
+}
+async function makeCheckpoint(e, ch) {
+    const signed = await signCheckpoint(e, ch.head_seq, ch.head_hash);
+    const cp = { id: e.db.newId('acp'), seq: ch.head_seq, link_hash: ch.head_hash, kid: signed.kid, alg: signed.alg, jws: signed.jws, signed_at: e.clock.now() };
+    ch.cps.push(cp);
+    ch.last_cp_seq = cp.seq;
+    ch.last_cp_at = cp.signed_at;
+    return cp;
+}
+/**
+ * One pass of the real worker: link the settled rows, then (when the checkpoint interval passed) verify what was added since
+ * the last checkpoint and sign a new one. Nothing is signed over a chain that does not verify: `audit_chain.tamper_detected`
+ * is raised instead. `settle: false` links every row now (the test helper); the routes call it with the real 60 s delay.
+ */
+async function sweepChain(e, settle = true) {
+    const ch = st(e).chain;
+    if (!ch)
+        return { appended: 0, checkpoint: false, tampered: false, head_seq: 0 };
+    const due = unchainedRows(e, ch, settle ? SETTLE_MS : -1).sort((a, b) => a.created_at - b.created_at);
+    for (const r of due) {
+        const seq = ch.head_seq + 1;
+        const rowHash = (0, backend_1.auditRowHash)(r);
+        ch.head_hash = (0, backend_1.auditLinkHash)(ch.head_hash, seq, rowHash);
+        ch.head_seq = seq;
+        ch.links.push({ seq, audit_id: r.id, row_hash: rowHash, link_hash: ch.head_hash });
+        ch.chained.add(r.id);
+    }
+    const out = { appended: due.length, checkpoint: false, tampered: false, head_seq: ch.head_seq };
+    if (ch.head_seq <= ch.last_cp_seq)
+        return out;
+    if (ch.last_cp_at !== null && e.clock.now() - ch.last_cp_at < ch.interval_s * 1000)
+        return out;
+    const last = ch.cps[ch.cps.length - 1];
+    if (last && linkHashAt(e, ch, last.seq) !== last.link_hash) {
+        raiseTamper(e, { reason: 'checkpointed_link_changed', seq: last.seq });
+        return { ...out, tampered: true };
+    }
+    const verdict = verifyLinks(e, ch, { fromSeq: (last?.seq ?? 0) + 1, toSeq: ch.head_seq, maxLinks: 100_000 });
+    if (!verdict.ok || !verdict.done) {
+        if (!verdict.ok)
+            raiseTamper(e, { reason: verdict.firstBreak?.reason ?? 'unknown', seq: verdict.firstBreak?.seq ?? null });
+        return { ...out, tampered: !verdict.ok };
+    }
+    const cp = await makeCheckpoint(e, ch);
+    e.webhooks.emit('audit_chain.checkpoint_signed', { object: 'audit_chain_checkpoint', seq: cp.seq, link_hash: cp.link_hash, kid: cp.kid, alg: cp.alg, signed_at: cp.signed_at });
+    return { ...out, checkpoint: true };
+}
+function statusView(e) {
+    const ch = st(e).chain;
+    return {
+        object: 'audit_chain',
+        enabled: !!ch,
+        enabled_at: ch?.enabled_at ?? null,
+        checkpoint_interval_seconds: ch?.interval_s ?? null,
+        head_seq: ch?.head_seq ?? null,
+        head_hash: ch && ch.head_seq > 0 ? ch.head_hash : null,
+        genesis_hash: (0, backend_1.auditChainGenesis)(e.instanceId),
+        last_checkpoint_seq: ch?.last_cp_seq ?? null,
+        last_checkpoint_at: ch?.last_cp_at ?? null,
+        // Rows old enough to be chained that no link covers: 0 on a healthy chain.
+        unchained_rows: ch ? unchainedRows(e, ch, SETTLE_MS * 5).length : 0,
+        algorithm: { row: 'atlas.audit.row.v1', link: 'atlas.audit.link.v1', genesis: 'atlas.audit.genesis.v1', checkpoint_typ: CHECKPOINT_TYP },
+        jwks_uri: jwksUri(e),
+    };
+}
+const strictKeys = (c, allowed) => {
+    const bad = Object.keys(c.body).find((k) => !allowed.includes(k));
+    if (bad && (c.engine.options.strict === true || c.request.headers.get('atlas-strict') === 'true'))
+        throw new errors_1.EmulatorError('UNKNOWN_FIELD', `Unknown field: ${bad}.`, bad);
+};
+const q = (c, k) => c.query.get(k) ?? undefined;
+// ── tickets ──
+const TICKET_MAX_TTL_S = 24 * 60 * 60;
+const ticketGone = () => new errors_1.EmulatorError('NOT_FOUND', 'This ticket is invalid, expired, or already redeemed.');
+/** The consuming logic both surfaces share: unknown, expired and spent all answer the same 404; a binding mismatch is a 403 and spends nothing. */
+function redeemTicket(e, secret, redeemer) {
+    const t = st(e).tickets.get(secret);
+    if (!t || t.expires_at <= e.clock.now())
+        throw ticketGone();
+    if ((t.bound_user && t.bound_user !== redeemer.userId) || (t.bound_org && t.bound_org !== redeemer.orgId))
+        throw new errors_1.EmulatorError('FORBIDDEN', 'This ticket is not redeemable in this context.');
+    if (t.single_use && t.redeemed_at)
+        throw ticketGone();
+    t.redeemed_at = e.clock.now();
+    return { object: 'ticket_redemption', id: t.id, payload: t.payload, single_use: t.single_use };
+}
+// ── trusted devices ──
+const deviceView = (r) => ({ object: 'trusted_device', id: r.id, device: r.device, created_at: r.created_at, last_used_at: r.last_used_at, expires_at: r.expires_at });
+const liveDevices = (e, userId) => st(e).devices.filter((r) => r.user_id === userId && r.expires_at > e.clock.now());
+function emu4TrustHandlers() {
+    return [
+        ...(0, emu4_trust_binding_1.emu4TrustBindingHandlers)(),
+        // ── audit chain: status and switch ──
+        {
+            method: 'GET',
+            pattern: '/v1/audit/chain',
+            scope: 'audit:read',
+            handler: async (c) => {
+                await sweepChain(c.engine);
+                return { body: statusView(c.engine) };
+            },
+        },
+        {
+            method: 'PUT',
+            pattern: '/v1/audit/chain',
+            scope: 'audit:write',
+            handler: async (c) => {
+                const e = c.engine;
+                strictKeys(c, ['enabled', 'checkpoint_interval_seconds']);
+                if (typeof c.body.enabled !== 'boolean')
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'enabled must be true or false.', 'enabled');
+                const interval = c.body.checkpoint_interval_seconds === undefined || c.body.checkpoint_interval_seconds === '' ? undefined : (0, support_1.intIn)(c.body.checkpoint_interval_seconds, 'checkpoint_interval_seconds', 60, 86_400);
+                const before = st(e).chain;
+                if (!c.body.enabled) {
+                    // The links are the evidence; the chain only ever grows.
+                    if (before)
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'A chain that is on cannot be turned off: its links are the evidence. Contact support to retire an instance chain.', 'enabled');
+                }
+                else {
+                    st(e).chain ??= { enabled_at: e.clock.now(), interval_s: interval ?? 3600, head_seq: 0, head_hash: (0, backend_1.auditChainGenesis)(e.instanceId), last_cp_seq: 0, last_cp_at: null, links: [], cps: [], chained: new Set() };
+                    if (interval)
+                        st(e).chain.interval_s = interval;
+                }
+                recordAudit(e, { actor_type: 'api_key', actor_id: null, action: before ? 'audit_chain.updated' : 'audit_chain.enabled', target_type: 'instance', target_id: e.instanceId, metadata: { checkpoint_interval_seconds: interval ?? before?.interval_s ?? 3600 } });
+                await sweepChain(e);
+                return { body: statusView(e) };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/audit/chain/links',
+            scope: 'audit:read',
+            handler: async (c) => {
+                const e = c.engine;
+                const afterSeq = (0, support_1.intIn)(q(c, 'after_seq'), 'after_seq', 0, MAX_INT, 0);
+                const limit = (0, support_1.intIn)(q(c, 'limit'), 'limit', 1, 1000, 200);
+                await sweepChain(e);
+                const links = (st(e).chain?.links ?? []).filter((l) => l.seq > afterSeq).sort((a, b) => a.seq - b.seq).slice(0, limit);
+                return {
+                    body: {
+                        object: 'list',
+                        data: links.map((l) => ({ object: 'audit_chain_link', seq: l.seq, audit_id: l.audit_id, row_hash: l.row_hash, link_hash: l.link_hash, row: st(e).byId.get(l.audit_id) ?? null })),
+                        has_more: links.length === limit,
+                        next_after_seq: links.length ? links[links.length - 1].seq : afterSeq,
+                    },
+                };
+            },
+        },
+        {
+            method: 'GET',
+            pattern: '/v1/audit/chain/checkpoints',
+            scope: 'audit:read',
+            handler: async (c) => {
+                const e = c.engine;
+                const afterSeq = (0, support_1.intIn)(q(c, 'after_seq'), 'after_seq', 0, MAX_INT, 0);
+                const limit = (0, support_1.intIn)(q(c, 'limit'), 'limit', 1, 500, 100);
+                await sweepChain(e);
+                const rows = (st(e).chain?.cps ?? []).filter((x) => x.seq > afterSeq).sort((a, b) => a.seq - b.seq).slice(0, limit);
+                return { body: { object: 'list', data: rows.map(cpView), has_more: rows.length === limit, jwks_uri: jwksUri(e) } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/audit/chain/checkpoints',
+            scope: 'audit:write',
+            handler: async (c) => {
+                const e = c.engine;
+                await sweepChain(e);
+                const ch = st(e).chain;
+                if (!ch)
+                    throw noChain();
+                if (ch.head_seq === 0)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'The chain has no links yet.');
+                const last = ch.cps[ch.cps.length - 1];
+                if (last && last.seq === ch.head_seq)
+                    return { status: 200, body: cpView(last) };
+                const v = verifyLinks(e, ch, { fromSeq: (last?.seq ?? 0) + 1, toSeq: ch.head_seq });
+                if (!v.ok)
+                    throw new errors_1.EmulatorError('CONFLICT', 'The chain does not verify, so it is not checkpointed. Run a verification for the details.');
+                const cp = await makeCheckpoint(e, ch);
+                recordAudit(e, { actor_type: 'api_key', actor_id: null, action: 'audit_chain.checkpoint_signed', target_type: 'instance', target_id: e.instanceId, metadata: { seq: cp.seq } });
+                return { status: 201, body: cpView(cp) };
+            },
+        },
+        {
+            // Read only: recomputes the chain from the stored rows; pages through large chains with next_seq.
+            method: 'POST',
+            pattern: '/v1/audit/chain/verify',
+            scope: 'audit:read',
+            handler: async (c) => {
+                const e = c.engine;
+                strictKeys(c, ['from_seq', 'to_seq', 'max_links']);
+                await sweepChain(e);
+                const ch = st(e).chain;
+                if (!ch)
+                    throw noChain();
+                const fromSeq = c.body.from_seq === undefined ? undefined : (0, support_1.intIn)(c.body.from_seq, 'from_seq', 1, MAX_INT);
+                const toSeq = c.body.to_seq === undefined ? undefined : (0, support_1.intIn)(c.body.to_seq, 'to_seq', 1, MAX_INT);
+                const maxLinks = c.body.max_links === undefined ? undefined : (0, support_1.intIn)(c.body.max_links, 'max_links', 1, 100_000);
+                const v = verifyLinks(e, ch, { fromSeq, toSeq, maxLinks });
+                const cps = ch.cps.filter((x) => x.seq > Math.max(0, (fromSeq ?? 1) - 1) && x.seq <= (toSeq ?? MAX_INT)).slice(0, 500);
+                const checkpoints = await checkCheckpoints(e, ch, cps);
+                return { body: { object: 'audit_chain_verification', ok: v.ok && checkpoints.mismatched === 0, checked: v.checked, pruned: v.pruned, first_break: v.firstBreak, next_seq: v.nextSeq, done: v.done, checkpoints } };
+            },
+        },
+        // ── audit chain: emulator controls ──
+        {
+            // The worker, on demand: links every audit row now (the routes only link rows older than 60 seconds), and signs a checkpoint when one is due.
+            method: 'POST',
+            pattern: '/__emulator/audit_chain/sweep',
+            public: true,
+            handler: async (c) => ({ body: { object: 'audit_chain_sweep', ...(await sweepChain(c.engine, c.body.settle === true)) } }),
+        },
+        {
+            method: 'GET',
+            pattern: '/__emulator/audit_chain/rows',
+            public: true,
+            handler: (c) => ({ body: { object: 'list', data: [...st(c.engine).rows].reverse(), has_more: false } }),
+        },
+        {
+            // Edit the stored data the way an attacker with database access would, without touching the hashes.
+            // kind: `row` (change an audit row's metadata), `link` (change a link hash), `drop_link` (remove a link), `prune_row` (what retention does: the link stays and still chains).
+            method: 'POST',
+            pattern: '/__emulator/audit_chain/tamper',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                const kind = String(c.body.kind ?? '');
+                if (!['row', 'link', 'drop_link', 'prune_row'].includes(kind))
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'kind must be one of row, link, drop_link, prune_row.', 'kind');
+                const ch = st(e).chain;
+                const link = c.body.seq !== undefined ? ch?.links.find((l) => l.seq === c.body.seq) : undefined;
+                if ((kind === 'link' || kind === 'drop_link') && !link)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'There is no link with that seq.', 'seq');
+                const auditId = c.body.audit_id ?? link?.audit_id;
+                const row = auditId ? st(e).byId.get(auditId) : undefined;
+                if ((kind === 'row' || kind === 'prune_row') && !row)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'There is no such audit row (give seq or audit_id).', 'audit_id');
+                if (kind === 'row')
+                    row.metadata = { ...row.metadata, tampered: true };
+                else if (kind === 'link')
+                    link.link_hash = link.link_hash.replace(/^./, (x) => (x === '0' ? '1' : '0'));
+                else if (kind === 'drop_link')
+                    ch.links.splice(ch.links.indexOf(link), 1);
+                else {
+                    st(e).byId.delete(row.id);
+                    st(e).rows.splice(st(e).rows.indexOf(row), 1);
+                }
+                return { body: { object: 'audit_chain_tamper', kind, seq: link?.seq ?? null, audit_id: auditId ?? null } };
+            },
+        },
+        // ── one-time capability tickets ──
+        {
+            method: 'POST',
+            pattern: '/v1/tickets',
+            scope: 'tickets:write',
+            handler: (c) => {
+                const e = c.engine;
+                const b = c.body;
+                // The lifetime is required and clamped: an absent one would make a "one-time" ticket a long-lived bearer secret.
+                if (typeof b.ttl_seconds !== 'number' || !Number.isFinite(b.ttl_seconds) || b.ttl_seconds <= 0)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'ttl_seconds must be a positive number of seconds.', 'ttl_seconds');
+                if (b.single_use !== undefined && typeof b.single_use !== 'boolean')
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'single_use must be a boolean.', 'single_use');
+                if (b.bound_user !== undefined && typeof b.bound_user !== 'string')
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'bound_user must be a user id.', 'bound_user');
+                if (b.bound_org !== undefined && typeof b.bound_org !== 'string')
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'bound_org must be an organization id.', 'bound_org');
+                const now = e.clock.now();
+                const secret = `tkt_${(0, store_1.randomToken)(32)}`;
+                const t = { id: e.db.newId('tkt'), payload: b.payload ?? {}, single_use: b.single_use ?? true, bound_user: b.bound_user ?? null, bound_org: b.bound_org ?? null, created_at: now, expires_at: now + Math.min(Math.floor(b.ttl_seconds), TICKET_MAX_TTL_S) * 1000, redeemed_at: null };
+                st(e).tickets.set(secret, t);
+                recordAudit(e, { actor_type: 'api_key', actor_id: null, action: 'ticket.created', target_type: 'capability_ticket', target_id: t.id });
+                // The plaintext is returned exactly once.
+                return { status: 201, body: { object: 'ticket', id: t.id, ticket: secret, single_use: t.single_use, bound_user: t.bound_user, bound_org: t.bound_org, created_at: t.created_at, expires_at: t.expires_at } };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/tickets/redeem',
+            scope: 'tickets:write',
+            handler: (c) => {
+                const e = c.engine;
+                if (typeof c.body.ticket !== 'string' || !c.body.ticket)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'A ticket is required.', 'ticket');
+                // A backend caller asserts the redeemer context; the secret key is already the trust boundary.
+                const out = redeemTicket(e, c.body.ticket, { userId: c.body.for_user, orgId: c.body.for_org });
+                recordAudit(e, { actor_type: 'api_key', actor_id: null, action: 'ticket.redeemed', target_type: 'capability_ticket', target_id: String(out.id) });
+                return { body: out };
+            },
+        },
+        {
+            method: 'POST',
+            pattern: '/v1/client/tickets/redeem',
+            public: true,
+            handler: async (c) => {
+                const e = c.engine;
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                if (typeof c.body.ticket !== 'string' || !c.body.ticket)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', 'A ticket is required.', 'ticket');
+                // The redeemer is the session's own identity; an organization is accepted only after proving membership.
+                let orgId;
+                if (c.body.organization_id !== undefined) {
+                    if (typeof c.body.organization_id !== 'string')
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'organization_id must be an organization id.', 'organization_id');
+                    if (!e.db.memberships.find((m) => m.user_id === userId && m.organization_id === c.body.organization_id))
+                        throw new errors_1.EmulatorError('FORBIDDEN', 'You are not a member of that organization.');
+                    orgId = c.body.organization_id;
+                }
+                const out = redeemTicket(e, c.body.ticket, { userId, orgId });
+                recordAudit(e, { actor_type: 'user', actor_id: userId, action: 'ticket.redeemed', target_type: 'capability_ticket', target_id: String(out.id) });
+                return { body: out };
+            },
+        },
+        // ── trusted devices (the browsers a user remembered to skip MFA) ──
+        {
+            method: 'GET',
+            pattern: '/v1/client/me/trusted_devices',
+            public: true,
+            handler: async (c) => {
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                return { body: { object: 'list', data: liveDevices(c.engine, userId).map(deviceView) } };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/client/me/trusted_devices/:id',
+            public: true,
+            handler: async (c) => {
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                // Scoped by user: someone else's device id is an unknown id.
+                const d = st(c.engine).devices.get(c.params.id);
+                if (!d || d.user_id !== userId)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'Unknown trusted device.');
+                st(c.engine).devices.delete(d.id);
+                return { body: { object: 'trusted_device', id: d.id, deleted: true } };
+            },
+        },
+        {
+            method: 'DELETE',
+            pattern: '/v1/client/me/trusted_devices',
+            public: true,
+            handler: async (c) => {
+                const { userId } = await (0, support_1.sessionFromBearer)(c);
+                const mine = st(c.engine).devices.filter((r) => r.user_id === userId);
+                for (const d of mine)
+                    st(c.engine).devices.delete(d.id);
+                return { body: { object: 'trusted_device', deleted: true, count: mine.length } };
+            },
+        },
+        {
+            // Remember a device for a user (what "remember this device" does after MFA); the secret is returned once, as the cookie value would be.
+            method: 'POST',
+            pattern: '/__emulator/trusted_devices',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                const user = e.db.users.get(String(c.body.user_id ?? ''));
+                if (!user || user.deleted)
+                    throw new errors_1.EmulatorError('NOT_FOUND', 'User not found.', 'user_id');
+                const ttlDays = (0, support_1.intIn)(c.body.ttl_days, 'ttl_days', 1, 365, 30);
+                const info = c.body.device && typeof c.body.device === 'object' ? c.body.device : {};
+                const secret = (0, store_1.randomToken)(32);
+                const now = e.clock.now();
+                const row = st(e).devices.insert({ user_id: user.id, secret, device: info, created_at: now, last_used_at: null, expires_at: now + ttlDays * 86_400_000 });
+                return { status: 201, body: { object: 'trusted_device_secret', id: row.id, secret, expires_at: row.expires_at } };
+            },
+        },
+        {
+            // Is this secret a live trust for this user (the MFA-skip check); a hit stamps last_used_at.
+            method: 'POST',
+            pattern: '/__emulator/trusted_devices/verify',
+            public: true,
+            handler: (c) => {
+                const e = c.engine;
+                const d = st(e).devices.find((r) => r.user_id === c.body.user_id && r.secret === c.body.secret && r.expires_at > e.clock.now());
+                if (d)
+                    d.last_used_at = e.clock.now();
+                return { body: { object: 'trusted_device_check', trusted: !!d, id: d?.id ?? null } };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=emu4-trust.js.map

package/dist/handlers/emu4-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-trust.js","sourceRoot":"","sources":["../../src/handlers/emu4-trust.ts"],"names":[],"mappings":";;AAuEA,kCAOC;AASD,sCA2BC;AAyGD,gCA4BC;AA+CD,8CA8QC;AApjBD,uDAAuD;AACvD,gDAA0G;AAE1G,gDAA+C;AAC/C,sCAA0C;AAC1C,gCAA8C;AAE9C,oCAA8C;AAC9C,6DAAgE;AAChE,uCAAkE;AAElE;;;;GAIG;AACH,MAAM,OAAO,GAAG,MAAM,CAAC;AACvB,4FAA4F;AAC5F,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC;AA6BxC,MAAM,EAAE,GAAG,IAAA,qBAAW,EAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,EAAE,EAAuB;IAC7B,IAAI,EAAE,IAAI,GAAG,EAA2B;IACxC,KAAK,EAAE,IAAoB;IAC3B,OAAO,EAAE,IAAI,GAAG,EAAe;IAC/B,OAAO,EAAE,IAAI,aAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC;CAC3D,CAAC,CAAC,CAAC;AAeJ,iIAAiI;AACjI,SAAgB,WAAW,CAAC,CAAS,EAAE,CAAa;IAClD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChB,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC1R,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO;QAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAE9J,sFAAsF;AACtF,MAAM,WAAW,GAAG,wOAAwO,CAAC;AAE7P,qJAAqJ;AACrJ,SAAgB,aAAa,CAAC,CAAS,EAAE,CAAuG;IAC9I,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO;IAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAQ,CAAC,CAAC,IAAwB,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,IAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,sIAAsI;IACtI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACxJ,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,OAAQ,CAAC,CAAC,IAAwB,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,IAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,WAAW,CAAC,CAAC,EAAE;QACb,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QACxC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC7E,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;QACzB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;QACpD,6EAA6E;QAC7E,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,kBAAkB;AAElB,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,wBAAwB,CAAC;AAC3E,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAS,EAAE,GAAW,EAAsB,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,2BAAiB,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5K,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,sBAAa,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;AAClG,MAAM,MAAM,GAAG,CAAC,CAAa,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;AAExL,SAAS,aAAa,CAAC,CAAS,EAAE,EAAS,EAAE,QAAgB;IAC3D,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,yHAAyH;AACzH,KAAK,UAAU,cAAc,CAAC,CAAS,EAAE,GAAW,EAAE,QAAgB;IACpE,sHAAsH;IACtH,MAAM,CAAC,GAAQ,CAAC,CAAC,MAAM,CAAC;IACxB,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACxB,MAAM,GAAG,GAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,CAAM,EAAU,EAAE,CAAC,IAAA,2BAAa,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3L,MAAM,EAAE,GAAG,GAAG,KAAK,OAAO,CAAC;IAC3B,IAAI,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU;QAAE,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/N,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpJ,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,IAAA,2BAAa,EAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AACtF,CAAC;AAWD,+EAA+E;AAC/E,SAAS,WAAW,CAAC,CAAS,EAAE,EAAS,EAAE,CAA0D;IACnG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAY,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzG,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IACjG,IAAI,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACjG,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ;YAAE,MAAM;QACjC,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,IAAA,sBAAY,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ;gBAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC;QACvH,CAAC;;YAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrB,IAAI,IAAA,uBAAa,EAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;QAC5I,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC;QACnB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;QACf,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,kFAAkF;IAClF,IAAI,MAAM,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;IAC7J,CAAC,CAAC,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IACtB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2JAA2J;AAC3J,KAAK,UAAU,gBAAgB,CAAC,CAAS,EAAE,EAAS,EAAE,GAAiB;IACrE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,IAAA,eAAS,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,IAAA,eAAS,EAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,WAAW,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;YAAE,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;aACrK,IAAI,MAAM;YAAE,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,MAAW;IACzC,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,6BAA6B,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7K,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,CAAS,EAAE,EAAS;IAChD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,EAAE,GAAe,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IACzK,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,CAAC;IACxB,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,SAAS,CAAC;IAC7B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,MAAM,GAAG,IAAI;IACvD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACjF,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IACtG,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,CAAC,CAAC,CAAC;QAChC,EAAE,CAAC,SAAS,GAAG,IAAA,uBAAa,EAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,EAAE,CAAC,QAAQ,GAAG,GAAG,CAAC;QAClB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;IAChG,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC;IAC9C,IAAI,EAAE,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC;IAC/F,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3D,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7G,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAChL,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvB,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,CAAC,CAAC,EAAE;QACb,UAAU,EAAE,EAAE,EAAE,UAAU,IAAI,IAAI;QAClC,2BAA2B,EAAE,EAAE,EAAE,UAAU,IAAI,IAAI;QACnD,QAAQ,EAAE,EAAE,EAAE,QAAQ,IAAI,IAAI;QAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACtD,YAAY,EAAE,IAAA,2BAAiB,EAAC,CAAC,CAAC,UAAU,CAAC;QAC7C,mBAAmB,EAAE,EAAE,EAAE,WAAW,IAAI,IAAI;QAC5C,kBAAkB,EAAE,EAAE,EAAE,UAAU,IAAI,IAAI;QAC1C,2EAA2E;QAC3E,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnE,SAAS,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,cAAc,EAAE;QACxI,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAe,EAAE,OAAiB,EAAQ,EAAE;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,kBAAkB,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;AAC7K,CAAC,CAAC;AACF,MAAM,CAAC,GAAG,CAAC,CAAe,EAAE,CAAS,EAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAE1F,gBAAgB;AAEhB,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtC,MAAM,UAAU,GAAG,GAAkB,EAAE,CAAC,IAAI,sBAAa,CAAC,WAAW,EAAE,uDAAuD,CAAC,CAAC;AAEhI,mJAAmJ;AACnJ,SAAS,YAAY,CAAC,CAAS,EAAE,MAAc,EAAE,QAA6C;IAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAAE,MAAM,UAAU,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,gDAAgD,CAAC,CAAC;IAClM,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW;QAAE,MAAM,UAAU,EAAE,CAAC;IACtD,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;AACjG,CAAC;AAED,wBAAwB;AAExB,MAAM,UAAU,GAAG,CAAC,CAAM,EAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;AACjL,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,MAAc,EAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AAE5I,SAAgB,iBAAiB;IAC/B,OAAO;QACL,GAAG,IAAA,6CAAwB,GAAE;QAE7B,uCAAuC;QACvC;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,iBAAiB;YAC1B,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,iBAAiB;YAC1B,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,UAAU,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC,CAAC;gBAC1D,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,gCAAgC,EAAE,SAAS,CAAC,CAAC;gBACnI,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,2BAA2B,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,EAAE,6BAA6B,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBAClN,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC3B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACpB,yDAAyD;oBACzD,IAAI,MAAM;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mHAAmH,EAAE,SAAS,CAAC,CAAC;gBAC3L,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAA,2BAAiB,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;oBAC/M,IAAI,QAAQ;wBAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,UAAU,GAAG,QAAQ,CAAC;gBACnD,CAAC;gBACD,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,2BAA2B,EAAE,QAAQ,IAAI,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/P,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpB,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,QAAQ,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBACtE,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC1D,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvH,OAAO;oBACL,IAAI,EAAE;wBACJ,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;wBACjL,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,KAAK;wBAChC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ;qBACvE;iBACF,CAAC;YACJ,CAAC;SACF;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,6BAA6B;YACtC,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,QAAQ,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBACtE,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzD,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpH,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACrH,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6BAA6B;YACtC,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACvB,IAAI,CAAC,EAAE;oBAAE,MAAM,OAAO,EAAE,CAAC;gBACzB,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC;gBACnG,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACvC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,QAAQ;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpF,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,IAAI,sBAAa,CAAC,UAAU,EAAE,2FAA2F,CAAC,CAAC;gBAC5I,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvC,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAChL,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,CAAC;SACF;QACD;YACE,kGAAkG;YAClG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wBAAwB;YACjC,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,UAAU,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACvB,IAAI,CAAC,EAAE;oBAAE,MAAM,OAAO,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC3G,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBACnG,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC/G,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACvH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,WAAW,CAAC,UAAU,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACrN,CAAC;SACF;QAED,uCAAuC;QACvC;YACE,8IAA8I;YAC9I,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;SAC3H;QACD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,8BAA8B;YACvC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;SACxG;QACD;YACE,oGAAoG;YACpG,8KAA8K;YAC9K,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gCAAgC;YACzC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBACvC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,sDAAsD,EAAE,MAAM,CAAC,CAAC;gBAC5K,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACvB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChG,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,iCAAiC,EAAE,KAAK,CAAC,CAAC;gBACvI,MAAM,OAAO,GAAuB,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,QAAQ,CAAC;gBACtE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1D,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,oDAAoD,EAAE,UAAU,CAAC,CAAC;gBAC7J,IAAI,IAAI,KAAK,KAAK;oBAAE,GAAI,CAAC,QAAQ,GAAG,EAAE,GAAI,GAAI,CAAC,QAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;qBAC7E,IAAI,IAAI,KAAK,MAAM;oBAAE,IAAK,CAAC,SAAS,GAAG,IAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;qBACrG,IAAI,IAAI,KAAK,WAAW;oBAAE,EAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,CAAC;qBACxE,CAAC;oBACJ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC;oBAC3B,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjD,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7G,CAAC;SACF;QAED,oCAAoC;QACpC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,iHAAiH;gBACjH,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mDAAmD,EAAE,aAAa,CAAC,CAAC;gBACjN,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,SAAS;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,+BAA+B,EAAE,YAAY,CAAC,CAAC;gBACjK,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,+BAA+B,EAAE,YAAY,CAAC,CAAC;gBAChK,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,uCAAuC,EAAE,WAAW,CAAC,CAAC;gBACrK,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,OAAO,IAAA,mBAAW,EAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC3R,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC7B,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvI,0CAA0C;gBAC1C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;YAC/M,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB;YAC7B,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;gBACzI,+FAA+F;gBAC/F,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/F,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAClJ,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;SACF;QACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2BAA2B;YACpC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,QAAQ,CAAC,CAAC;gBACzI,yGAAyG;gBACzG,IAAI,KAAyB,CAAC;gBAC9B,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;oBACzC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,6CAA6C,EAAE,iBAAiB,CAAC,CAAC;oBAC/J,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;wBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;oBAC5L,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;gBACjC,CAAC;gBACD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9D,WAAW,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjJ,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;SACF;QAED,qEAAqE;QACrE;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YAC3F,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,mCAAmC;YAC5C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,6DAA6D;gBAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;gBAChG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACzE,CAAC;SACF;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,+BAA+B;YACxC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,2BAAiB,EAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;gBACtE,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnF,CAAC;SACF;QACD;YACE,wIAAwI;YACxI,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,sBAAa,CAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;gBAC9F,MAAM,OAAO,GAAG,IAAA,eAAK,EAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,CAAC;gBAC1J,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;YACpH,CAAC;SACF;QACD;YACE,6FAA6F;YAC7F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oCAAoC;YAC7C,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBAChI,IAAI,CAAC;oBAAE,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACvF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}