@caelo-cms/provisioning 0.10.29 → 0.10.31

package/dist/runtime-secrets.js

@@ -0,0 +1,444 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The runtime identities and secrets of a GCP install that the CLI (not
+ * Pulumi) creates and maintains, through gcloud:
+ *
+ *   - {@link ensureGatewayServiceAccount}: the gateway's own run SA, so it
+ *     can be granted only the secrets the gateway reads.
+ *   - {@link ensureGeneratedSecrets}: the secrets in
+ *     `CLI_GENERATED_SECRETS` (stack-contract.ts). The wizard runs it before
+ *     `pulumi up`, upgrade on every roll, so installs that predate a secret
+ *     get it without operator action. Values are generated here and go to
+ *     Secret Manager on stdin — never on argv, never to disk.
+ *   - {@link rotateRuntimeSecret}: `cms-provision rotate-secret`.
+ *
+ * Every function reports instead of throwing on a gcloud failure.
+ */
+import { randomBytes } from "node:crypto";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { gatewayServiceAccountEmail, gatewayServiceAccountId, gcpSecretId } from "./gcp-names.js";
+import { CLI_GENERATED_SECRETS, SERVICE_SECRET_ENV, serviceSecrets, } from "./stack-contract.js";
+import { liveContainerEnv } from "./stack-converge.js";
+/** 32 random bytes as hex — the shape of every secret the stacks generate. */
+export function generateSecretValue() {
+    return randomBytes(32).toString("hex");
+}
+const NOT_FOUND = /NOT_FOUND|not found|does not exist/i;
+const ALREADY_EXISTS = /ALREADY_EXISTS|already exists/i;
+// ===========================================================================
+// Gateway service account
+// ===========================================================================
+/** Create the gateway's run SA unless it exists. */
+export async function ensureGatewayServiceAccount(install, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const email = gatewayServiceAccountEmail(install.projectId, install.env);
+    const id = `service account ${email}`;
+    const project = `--project=${install.projectId}`;
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        email,
+        project,
+        "--format=value(email)",
+    ]);
+    if (describe.ok)
+        return { id, status: "present" };
+    if (!NOT_FOUND.test(describe.stderr)) {
+        return { id, status: "failed", error: describe.stderr.trim() };
+    }
+    const create = await run([
+        "iam",
+        "service-accounts",
+        "create",
+        gatewayServiceAccountId(install.env),
+        project,
+        `--display-name=Caelo ${install.env} gateway`,
+        "--quiet",
+    ]);
+    if (create.ok || ALREADY_EXISTS.test(create.stderr))
+        return { id, status: "applied" };
+    return { id, status: "failed", error: create.stderr.trim() };
+}
+// ===========================================================================
+// Generated secrets
+// ===========================================================================
+/**
+ * Values of CLI-generated secrets a service runs with as plain env vars,
+ * for {@link ensureGeneratedSecrets}'s `seed`.
+ */
+export function plainGeneratedSecretSeed(liveEnv) {
+    const seed = {};
+    for (const [name, secret] of Object.entries(SERVICE_SECRET_ENV.admin)) {
+        const generated = CLI_GENERATED_SECRETS.find((g) => g === secret);
+        const live = liveEnv.get(name);
+        if (generated && live?.kind === "value" && live.value)
+            seed[generated] = live.value;
+    }
+    return seed;
+}
+/** The stacks' `secretReplication` config value as a {@link SecretReplication}. */
+export function stackSecretReplication(mode, region) {
+    return mode === "auto" ? { kind: "automatic" } : { kind: "user-managed", locations: [region] };
+}
+/**
+ * The replication of the install's existing `postgres-password` secret, so
+ * secrets created later match what the stack pinned (orgs with a
+ * `gcp.resourceLocations` policy reject `automatic`).
+ */
+export async function readSecretReplication(install, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const secretId = gcpSecretId(install.env, "postgres-password");
+    const r = await run([
+        "secrets",
+        "describe",
+        secretId,
+        `--project=${install.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok)
+        return { ok: false, error: `describe ${secretId}: ${r.stderr.trim()}` };
+    const replication = JSON.parse(r.stdout).replication;
+    if (replication?.automatic)
+        return { ok: true, replication: { kind: "automatic" } };
+    const locations = (replication?.userManaged?.replicas ?? [])
+        .map((r) => r.location)
+        .filter((l) => Boolean(l));
+    if (locations.length > 0) {
+        return { ok: true, replication: { kind: "user-managed", locations } };
+    }
+    return { ok: false, error: `${secretId} has no replication policy gcloud reports` };
+}
+function replicationArgs(replication) {
+    return replication.kind === "automatic"
+        ? ["--replication-policy=automatic"]
+        : ["--replication-policy=user-managed", `--locations=${replication.locations.join(",")}`];
+}
+/**
+ * Create each secret in `CLI_GENERATED_SECRETS` that is missing, and give
+ * one that exists without an enabled version a first version. A secret that
+ * already has an enabled version is never touched, so re-runs keep values.
+ *
+ * `seed` carries values a service already runs with as plain env vars (an
+ * operator-set `CAELO_INTERNAL_SECRET`): the new secret starts with that
+ * value, so moving the var to Secret Manager migrates the credential
+ * instead of silently rotating it under callers that sign with it.
+ */
+export async function ensureGeneratedSecrets(install, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const generate = deps.generate ?? generateSecretValue;
+    const project = `--project=${install.projectId}`;
+    const outcomes = [];
+    for (const name of CLI_GENERATED_SECRETS) {
+        const secretId = gcpSecretId(install.env, name);
+        const id = `secret ${secretId}`;
+        const describe = await run(["secrets", "describe", secretId, project, "--format=value(name)"]);
+        if (!describe.ok && !NOT_FOUND.test(describe.stderr)) {
+            outcomes.push({ id, status: "failed", error: describe.stderr.trim() });
+            continue;
+        }
+        if (!describe.ok) {
+            const create = await run([
+                "secrets",
+                "create",
+                secretId,
+                project,
+                ...replicationArgs(install.replication),
+                "--data-file=-",
+                "--quiet",
+            ], { stdin: install.seed?.[name] || generate() });
+            if (create.ok) {
+                outcomes.push({ id, status: "applied" });
+                continue;
+            }
+            if (!ALREADY_EXISTS.test(create.stderr)) {
+                outcomes.push({ id, status: "failed", error: create.stderr.trim() });
+                continue;
+            }
+            // Created concurrently — fall through to the version check.
+        }
+        const versions = await runWithRetry(run, sleep, [
+            "secrets",
+            "versions",
+            "list",
+            secretId,
+            project,
+            "--filter=state:ENABLED",
+            "--limit=1",
+            "--format=value(name)",
+        ]);
+        if (!versions.ok) {
+            outcomes.push({ id, status: "failed", error: versions.stderr.trim() });
+            continue;
+        }
+        if (versions.stdout.trim()) {
+            outcomes.push({ id, status: "present" });
+            continue;
+        }
+        const add = await addVersion(run, secretId, project, install.seed?.[name] || generate());
+        outcomes.push(add.ok ? { id, status: "applied" } : { id, status: "failed", error: add.error });
+    }
+    return outcomes;
+}
+async function addVersion(run, secretId, project, value) {
+    const r = await run(["secrets", "versions", "add", secretId, project, "--data-file=-"], {
+        stdin: value,
+    });
+    return r.ok ? { ok: true } : { ok: false, error: r.stderr.trim() };
+}
+// ===========================================================================
+// rotate-secret
+// ===========================================================================
+/** The secrets `rotate-secret` can rotate. */
+export const ROTATABLE_SECRETS = [
+    "postgres-password",
+    "internal-secret",
+    "tool-approval-secret",
+];
+/**
+ * Why `name` cannot be rotated, or `null` when it can.
+ *
+ * The KEK is refused: AI provider keys and other at-rest secrets in
+ * cms_admin are encrypted under it, and a new KEK without re-encrypting
+ * them would make them unreadable.
+ */
+export function rotationRefusal(name) {
+    if (ROTATABLE_SECRETS.includes(name))
+        return null;
+    if (name === "secret-kek") {
+        return "secret-kek encrypts the AI provider keys and other at-rest secrets in cms_admin; a new KEK would make them unreadable. Rotating it needs a re-encryption step that does not exist yet.";
+    }
+    return `${name} is not a runtime secret of this install. Rotatable: ${ROTATABLE_SECRETS.join(", ")}.`;
+}
+/** The database roles that authenticate with `postgres-password`. */
+const DATABASE_ROLES = ["admin_role", "public_role"];
+/**
+ * The env vars each reader of `secret` must take from Secret Manager at
+ * `latest` for a new revision to pick up a rotated value. An install
+ * `upgrade` hasn't moved over still has the password inline in its URLs (a
+ * label-only roll would copy it unchanged), and a reference pinned to an
+ * older version would keep the old value — rotating either would report
+ * success and leave the services on a value the database no longer accepts.
+ */
+async function checkRotationReaders(run, target, secret) {
+    const secretId = gcpSecretId(target.env, secret);
+    for (const service of ["admin", "gateway"]) {
+        const vars = Object.entries(SERVICE_SECRET_ENV[service])
+            .filter(([, s]) => s === secret)
+            .map(([name]) => name);
+        if (vars.length === 0)
+            continue;
+        const name = target.services[service];
+        const describe = await run([
+            "run",
+            "services",
+            "describe",
+            name,
+            "--region",
+            target.region,
+            `--project=${target.projectId}`,
+            "--format=json",
+        ]);
+        if (!describe.ok)
+            return `read the ${service} (${name}): ${describe.stderr.trim()}`;
+        const env = liveContainerEnv(describe.stdout);
+        const wrong = vars.filter((v) => {
+            const live = env.get(v);
+            return (live?.kind !== "secret" ||
+                !(live.secret === secretId || live.secret.endsWith(`/secrets/${secretId}`)) ||
+                live.version !== "latest");
+        });
+        if (wrong.length > 0) {
+            return `the ${service} (${name}) does not read ${wrong.join(", ")} from ${secretId} at latest, so a rotated value would not reach it. Run \`cms-provision upgrade\` first (it moves the services onto Secret Manager references), then rotate. Nothing was changed.`;
+        }
+    }
+    return null;
+}
+const SQL_ADMIN = "https://sqladmin.googleapis.com/v1";
+const SQL_OPERATION_POLLS = 60;
+/**
+ * Set a Cloud SQL user's password through the Cloud SQL Admin API, with the
+ * password in the request body. `gcloud sql users set-password` only takes
+ * it on argv (visible in process listings and exec logs) or from a tty
+ * prompt, so it is not used. The bearer token comes from the operator's
+ * gcloud session, like every other call here.
+ */
+async function setSqlUserPassword(run, http, sleep, user) {
+    const token = await run(["auth", "print-access-token"]);
+    const bearer = token.ok ? token.stdout.trim() : "";
+    if (!bearer) {
+        return {
+            ok: false,
+            error: `gcloud auth print-access-token: ${token.stderr.trim() || "empty"}`,
+        };
+    }
+    const headers = { Authorization: `Bearer ${bearer}`, "Content-Type": "application/json" };
+    const project = `${SQL_ADMIN}/projects/${encodeURIComponent(user.projectId)}`;
+    const failed = async (what, res) => ({
+        ok: false,
+        error: `${what}: HTTP ${res.status} ${(await res.text()).slice(0, 500)}`,
+    });
+    const put = await http(`${project}/instances/${encodeURIComponent(user.instance)}/users?name=${encodeURIComponent(user.role)}`, { method: "PUT", headers, body: JSON.stringify({ name: user.role, password: user.password }) });
+    if (!put.ok)
+        return failed("update the user", put);
+    let op = JSON.parse(await put.text());
+    for (let i = 0; op.status !== "DONE" && i < SQL_OPERATION_POLLS; i++) {
+        if (!op.name)
+            return { ok: false, error: "the Cloud SQL API returned no operation name" };
+        await sleep(2_000);
+        const poll = await http(`${project}/operations/${encodeURIComponent(op.name)}`, {
+            method: "GET",
+            headers,
+        });
+        if (!poll.ok)
+            return failed(`poll operation ${op.name}`, poll);
+        op = JSON.parse(await poll.text());
+    }
+    if (op.status !== "DONE") {
+        return { ok: false, error: `operation ${op.name ?? "?"} did not finish in time` };
+    }
+    if (op.error) {
+        return {
+            ok: false,
+            error: (op.error.errors ?? []).map((e) => e.message ?? "?").join("; ") || "operation failed",
+        };
+    }
+    return { ok: true };
+}
+/** The two gcloud calls that roll `name` onto the `latest` version of its secrets. */
+function rollArgs(name, region, projectId) {
+    const location = ["--region", region, `--project=${projectId}`];
+    return [
+        // A label change copies to the revision template, so it creates a new
+        // revision, which resolves `latest` again.
+        [
+            "run",
+            "services",
+            "update",
+            name,
+            ...location,
+            `--update-labels=caelo-secret-rotated=${Date.now()}`,
+            "--quiet",
+        ],
+        ["run", "services", "update-traffic", name, ...location, "--to-latest", "--quiet"],
+    ];
+}
+/**
+ * Rotate one runtime secret: store a new value as a new Secret Manager
+ * version and roll every service that reads it, so new revisions resolve
+ * `latest` to the new value.
+ *
+ * Nothing changes unless every reader takes the secret from Secret Manager
+ * at `latest` ({@link checkRotationReaders}).
+ *
+ * `postgres-password` also changes the password of both database roles,
+ * first, so the new version never holds a password the database rejects.
+ * The password goes to the Cloud SQL Admin API in a request body, never on
+ * argv. If a step before the new version is stored fails, the roles are
+ * set back to the previous value. Between the password change and the
+ * roll, instances of the old revision keep their open connections but
+ * cannot open new ones — the roll follows immediately, and it is attempted
+ * for every reader even when one fails, so one failed service never leaves
+ * the other behind. A failed roll is resumed with the printed commands
+ * (rolling again picks up the stored value; it does not rotate again).
+ */
+export async function rotateRuntimeSecret(target, secret, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const http = deps.http ?? fetch;
+    const generate = deps.generate ?? generateSecretValue;
+    const project = `--project=${target.projectId}`;
+    const secretId = gcpSecretId(target.env, secret);
+    const steps = [];
+    const notReady = await checkRotationReaders(run, target, secret);
+    if (notReady)
+        return { ok: false, steps, error: notReady };
+    const value = generate();
+    if (secret === "postgres-password") {
+        if (!target.sqlInstance) {
+            return { ok: false, steps, error: "the Cloud SQL instance was not found" };
+        }
+        const instance = target.sqlInstance;
+        const current = await run([
+            "secrets",
+            "versions",
+            "access",
+            "latest",
+            `--secret=${secretId}`,
+            project,
+        ]);
+        if (!current.ok) {
+            return { ok: false, steps, error: `read the current password: ${current.stderr.trim()}` };
+        }
+        const previous = current.stdout;
+        const setPassword = (role, password) => setSqlUserPassword(run, http, sleep, {
+            projectId: target.projectId,
+            instance,
+            role,
+            password,
+        });
+        const changed = [];
+        const restore = async () => {
+            const failed = [];
+            for (const role of changed) {
+                if (!(await setPassword(role, previous)).ok)
+                    failed.push(role);
+            }
+            return failed.length === 0
+                ? "the database roles were set back to the previous password"
+                : `could NOT set ${failed.join(", ")} back to the previous password — set it to the latest version of ${secretId} by hand`;
+        };
+        for (const role of DATABASE_ROLES) {
+            const r = await setPassword(role, value);
+            if (!r.ok) {
+                const restored = changed.length > 0 ? `; ${await restore()}` : "";
+                return {
+                    ok: false,
+                    steps,
+                    error: `set the ${role} password: ${r.error}${restored}`,
+                };
+            }
+            changed.push(role);
+            steps.push(`set a new password on database role ${role}`);
+        }
+        const add = await addVersion(run, secretId, project, value);
+        if (!add.ok) {
+            return {
+                ok: false,
+                steps,
+                error: `store the new password in ${secretId}: ${add.error}; ${await restore()}`,
+            };
+        }
+    }
+    else {
+        const add = await addVersion(run, secretId, project, value);
+        if (!add.ok)
+            return { ok: false, steps, error: `add a version to ${secretId}: ${add.error}` };
+    }
+    steps.push(`added a new version to ${secretId}`);
+    const failures = [];
+    for (const service of ["admin", "gateway"]) {
+        if (!serviceSecrets(service).includes(secret))
+            continue;
+        const name = target.services[service];
+        const [update, flip] = rollArgs(name, target.region, target.projectId);
+        const rolled = await run(update);
+        const flipped = rolled.ok ? await run(flip) : rolled;
+        if (flipped.ok) {
+            steps.push(`rolled the ${service} onto the new value`);
+            continue;
+        }
+        failures.push(`roll the ${service} (${name}) onto the new value: ${flipped.stderr.trim()}\n  resume with:\n    gcloud ${update.join(" ")}\n    gcloud ${flip.join(" ")}`);
+    }
+    if (failures.length > 0) {
+        return {
+            ok: false,
+            steps,
+            error: `The new value is stored${secret === "postgres-password" ? " and the database uses it" : ""}, but not every service runs on it yet. Do not rotate again — roll the remaining services onto it:\n${failures.join("\n")}`,
+        };
+    }
+    return { ok: true, steps };
+}
+//# sourceMappingURL=runtime-secrets.js.map

package/dist/runtime-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-secrets.js","sourceRoot":"","sources":["../src/runtime-secrets.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClG,OAAO,EACL,qBAAqB,EAGrB,kBAAkB,EAClB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAQD,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,mBAAmB,KAAK,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,OAAO;QACP,wBAAwB,OAAO,CAAC,GAAG,UAAU;QAC7C,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgF;IAEhF,MAAM,IAAI,GAAoE,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,SAAS,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,IAAyB,EACzB,MAAc;IAEd,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,WAAW,GACf,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAMpB,CAAC,WAAW,CAAC;IACd,IAAI,WAAW,EAAE,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,2CAA2C,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,eAAe,CAAC,WAA8B;IACrD,OAAO,WAAW,CAAC,IAAI,KAAK,WAAW;QACrC,CAAC,CAAC,CAAC,gCAAgC,CAAC;QACpC,CAAC,CAAC,CAAC,mCAAmC,EAAE,eAAe,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAKC,EACD,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB;gBACE,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,OAAO;gBACP,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;gBACvC,eAAe;gBACf,SAAS;aACV,EACD,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,EAAE,CAC9C,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,4DAA4D;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YAC9C,SAAS;YACT,UAAU;YACV,MAAM;YACN,QAAQ;YACR,OAAO;YACP,wBAAwB;YACxB,WAAW;YACX,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;QACzF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,KAAa;IAEb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE;QACtF,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,mBAAmB;IACnB,iBAAiB;IACjB,sBAAsB;CACqB,CAAC;AAG9C;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAK,iBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,wLAAwL,CAAC;IAClM,CAAC;IACD,OAAO,GAAG,IAAI,wDAAwD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACxG,CAAC;AAoBD,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,aAAa,CAAU,CAAC;AAE9D;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAiB,EACjB,MAAsB,EACtB,MAAuB;IAEvB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;aACrD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,KAAK;YACL,UAAU;YACV,UAAU;YACV,IAAI;YACJ,UAAU;YACV,MAAM,CAAC,MAAM;YACb,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,YAAY,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,CACL,IAAI,EAAE,IAAI,KAAK,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,OAAO,KAAK,QAAQ,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,OAAO,OAAO,KAAK,IAAI,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,kLAAkL,CAAC;QACvQ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AACvD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAiB,EACjB,IAAe,EACf,KAAY,EACZ,IAA6E;IAE7E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC1F,MAAM,OAAO,GAAG,GAAG,SAAS,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,GAAgD,EAAE,EAAE,CAAC,CAAC;QACxF,EAAE,EAAE,KAAc;QAClB,KAAK,EAAE,GAAG,IAAI,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,GAAG,OAAO,cAAc,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAC/F,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAMnD,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QACrE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAC1F,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,eAAe,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAC9E,MAAM,EAAE,KAAK;YACb,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAc,CAAC;IAClD,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB;SAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB;IAC/D,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,sEAAsE;QACtE,2CAA2C;QAC3C;YACE,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI;YACJ,GAAG,QAAQ;YACX,wCAAwC,IAAI,CAAC,GAAG,EAAE,EAAE;YACpD,SAAS;SACV;QACD,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,MAAuB,EACvB,OAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY,QAAQ,EAAE;YACtB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAE,CACrD,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ;YACR,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;QACL,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE,QAAQ,UAAU,CAAC;QAC/H,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK;oBACL,KAAK,EAAE,WAAW,IAAI,cAAc,CAAC,CAAC,KAAK,GAAG,QAAQ,EAAE;iBACzD,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,KAAK,EAAE,6BAA6B,QAAQ,KAAK,GAAG,CAAC,KAAK,KAAK,MAAM,OAAO,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,KAAK,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAyB,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,qBAAqB,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,YAAY,OAAO,KAAK,IAAI,yBAAyB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,gCAAgC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,0BAA0B,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,uGAAuG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/N,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}