@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/mcp/proxy/verifyInterceptor.js

@@ -0,0 +1,559 @@
+/**
+ * Where verification meets the forwarding loop.
+ *
+ * The loop's job is to move messages; deciding what a tool list means is this
+ * file's. It plugs into the `Interceptor` seam Phase 1 left, and touches
+ * exactly three things:
+ *
+ *   - a `tools/list` RESPONSE, which it may replace;
+ *   - a `tools/call` REQUEST for one of the proxy's own tools, which it
+ *     answers itself and never forwards — the upstream has never heard of
+ *     `vibedefend_alert` and would return an error the agent would relay as
+ *     a bug of ours;
+ *   - a `tools/call` REQUEST, which is where the judgement is BOUGHT — for
+ *     the called tool only (`verifyOne`) — and where the SERVER'S ACTION is
+ *     executed: on a BLOCKED server it is refused outright (hiding the list
+ *     is not locking the door — an agent that remembers a tool name can
+ *     still call it); a tool the server blocks is refused the same way; a
+ *     tool the server says to ASK about has the user asked, through MCP
+ *     elicitation, whether to send the call anyway — once per server and
+ *     session on a yes, every time on a no; a tool the server only WARNS
+ *     about goes through, its result framed. A client that cannot be asked
+ *     (no `elicitation` capability) gets the previous behaviour: the call
+ *     goes through, `vibedefend_alert` was in the list. Never fail-open on a
+ *     question that WAS asked and got no answer;
+ *   - `notifications/tools/list_changed`, which it notes and lets through so
+ *     the client asks again;
+ *   - `notifications/cancelled` from the agent, for a call still waiting on
+ *     the user: the call is dropped, unanswered, and the notification is not
+ *     forwarded — the upstream never saw the call. Any other cancellation
+ *     passes through.
+ *
+ * Everything else passes untouched, which is the whole point of the seam.
+ */
+import { applyToToolsList, CONFIRMATION_SCHEMA, confirmationPrompt, isSyntheticTool, prefixResult, refusedCallResponse, replaceResult, syntheticCallResponse, } from './inject.js';
+import { scanArguments } from '../scan/args.js';
+import { scanResult } from '../scan/results.js';
+import { toolDigest } from '../verify/digest.js';
+import { idKey, isRequest, isResponse, methodOf } from './jsonrpc.js';
+/**
+ * How long a question may stay on screen. A user who is away is not a user
+ * who said yes: past this, the call is refused and the agent is told why.
+ */
+export const CONFIRMATION_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * A call's seat in the queue for the user, and the way to pull it out.
+ *
+ * `race` settles with the user's answer or, if the agent sends
+ * `notifications/cancelled` for the call first, with a no — the call is
+ * dropped either way, but the caller can tell which, and only the former is
+ * answered.
+ */
+class Cancellation {
+    tool;
+    cancelled = false;
+    signal;
+    settle = () => undefined;
+    constructor(tool) {
+        this.tool = tool;
+        this.signal = new Promise((resolve) => {
+            this.settle = resolve;
+        });
+    }
+    cancel() {
+        this.cancelled = true;
+        this.settle({ proceed: false, remember: false });
+    }
+    race(answer) {
+        return Promise.race([answer, this.signal]);
+    }
+}
+/**
+ * The last finding, so a call to a synthetic tool can answer with the detail
+ * that produced it rather than re-running a verification.
+ */
+const NO_FINDING = {
+    serverName: 'this server',
+    kind: 'no finding is on record',
+    tools: [],
+};
+export function createVerifyInterceptor(options) {
+    const { verifier, logger } = options;
+    /** Ids of the `tools/list` requests in flight, so the answers can be matched. */
+    const pendingLists = new Set();
+    /** Calls in flight, so a result can be scanned knowing which tool it is from. */
+    const pendingCalls = new Map();
+    /** The last list, for the schema a call's arguments are judged against. */
+    let knownTools = new Map();
+    let lastFinding = NO_FINDING;
+    /** The last verification, for the gate a `tools/call` goes through. */
+    let lastOutcome;
+    /** The user said yes for this server, for the rest of the session. */
+    let confirmed = false;
+    /** A question already on screen: calls that arrive meanwhile wait for its answer. */
+    let openQuestion;
+    /**
+     * Calls waiting on the user, by request id, so a `notifications/cancelled`
+     * from the agent can settle the one it names. A client that gave up on the
+     * call has told its model the call failed; a yes that arrives afterwards
+     * must not send it anyway.
+     */
+    const pendingConfirmations = new Map();
+    let warnedCannotAsk = false;
+    return {
+        name: 'verify',
+        async fromAgent(message, context) {
+            const method = methodOf(message);
+            if (method === 'notifications/cancelled') {
+                const requestId = typeof message.params === 'object' && message.params !== null
+                    ? message.params.requestId
+                    : undefined;
+                const key = idKey(requestId);
+                const waiting = key ? pendingConfirmations.get(key) : undefined;
+                if (waiting) {
+                    // The call is still here, waiting on the user: it never reached
+                    // the upstream, so the upstream has nothing to cancel and must not
+                    // hear of an id it never saw. Settle the call as declined instead.
+                    logger.info('verify: the agent cancelled a tools/call while the user was being asked', {
+                        tool: waiting.tool,
+                    });
+                    waiting.cancel();
+                    return { action: 'drop', reason: 'the cancelled call was never forwarded' };
+                }
+                return { action: 'forward' };
+            }
+            if (isRequest(message) && method === 'tools/list') {
+                const key = idKey(message.id);
+                if (key)
+                    pendingLists.add(key);
+                return { action: 'forward' };
+            }
+            if (isRequest(message) && method === 'tools/call') {
+                const params = typeof message.params === 'object' && message.params !== null
+                    ? message.params
+                    : {};
+                const name = params.name;
+                if (isSyntheticTool(name)) {
+                    // Answered here, never forwarded: it is our tool, not theirs.
+                    return {
+                        action: 'respond',
+                        message: syntheticCallResponse(message.id, String(name), lastFinding),
+                        reason: 'a VibeDefend tool is answered by VibeDefend',
+                    };
+                }
+                const toolName = typeof name === 'string' ? name : '(unnamed)';
+                // The SERVER-level gate, from the last list: a blocked server takes
+                // every call with it, whatever the individual tool's record says.
+                if (lastOutcome?.decision.action === 'block') {
+                    logger.info('verify: refused a tools/call to a blocked server', { tool: toolName });
+                    return {
+                        action: 'respond',
+                        message: refusedCallResponse(message.id, options.serverName, toolName, lastFinding, 'blocked'),
+                        reason: 'the server is blocked',
+                    };
+                }
+                const definition = knownTools.get(toolName);
+                const findings = scanArguments(params.arguments, {
+                    spec: options.spec,
+                    inputSchema: definition?.inputSchema,
+                    description: definition?.description,
+                });
+                if (findings.length > 0) {
+                    // Reported, never blocked: the plan's default here is `warn`, and a
+                    // proxy that refused a call because a value looked like a token
+                    // would break the tools people use to manage tokens.
+                    logger.warn('scan: something in the arguments of a tools/call', {
+                        tool: toolName,
+                        findings: findings.map((finding) => finding.rule),
+                    });
+                }
+                // The judgement, bought here and for this tool only.
+                let verdictFinding;
+                let policy = verifier.policy();
+                if (definition) {
+                    const outcome = await verifier.verifyOne(definition);
+                    policy = outcome.policy;
+                    options.onOutcome?.({
+                        action: outcome.decision.action,
+                        verdict: outcome.verdict,
+                        fromCache: outcome.fromCache,
+                        tool: toolName,
+                    });
+                    if (outcome.decision.action !== 'pass') {
+                        lastFinding = outcome.finding;
+                        logger.info('verify: decided for a call', {
+                            tool: toolName,
+                            action: outcome.decision.action,
+                            rationale: outcome.decision.rationale,
+                            verdict: outcome.verdict,
+                            fromCache: outcome.fromCache,
+                        });
+                        if (outcome.decision.action === 'block') {
+                            // Answered here, never forwarded: the call would have reached
+                            // a tool the verdict says must not run.
+                            return {
+                                action: 'respond',
+                                message: refusedCallResponse(message.id, options.serverName, toolName, outcome.finding, 'blocked'),
+                                reason: 'the called tool is refused by its verdict',
+                            };
+                        }
+                        // The TOOL-level gate: this tool's own verdict, bought just now or
+                        // served from the dictionary. The user decides, once per server
+                        // and session on a yes.
+                        if (needsConfirmation(outcome)) {
+                            const refused = await confirmOrRefuse(message, toolName, outcome.finding, context.agent);
+                            if (refused)
+                                return refused;
+                        }
+                        verdictFinding = verdictFindingOf(outcome);
+                    }
+                }
+                else if (!lastOutcome) {
+                    // No list yet this session: nothing has been verified, so there is
+                    // no server verdict to gate on and no definition to judge. The call
+                    // goes through like everything else this seam does not understand,
+                    // and the first `tools/list` sets the gate for the ones after it.
+                    logger.info('verify: a tools/call before any tools/list, forwarding without a verdict', {
+                        tool: toolName,
+                    });
+                }
+                else if (needsConfirmation(lastOutcome)) {
+                    // A name the last list did not carry — added after a
+                    // `list_changed` the client did not follow up on, or one the agent
+                    // remembered. There is no definition to judge, but the SERVER's
+                    // verdict still stands, and a suspicious server is not vouched for
+                    // by the tool being new. The user decides, as for a listed tool.
+                    const refused = await confirmOrRefuse(message, toolName, lastFinding, context.agent);
+                    if (refused)
+                        return refused;
+                }
+                const key = idKey(message.id);
+                if (key) {
+                    pendingCalls.set(key, {
+                        tool: toolName,
+                        digest: definition ? safeDigest(definition) : undefined,
+                        argumentBytes: byteLength(params.arguments),
+                        findings,
+                        verdictFinding,
+                        withholdOnFinding: policy.mode === 'block',
+                        startedAt: Date.now(),
+                    });
+                }
+            }
+            return { action: 'forward' };
+        },
+        async fromUpstream(message, context) {
+            if (methodOf(message) === 'notifications/tools/list_changed') {
+                // Noted, and forwarded: the client is the one that decides to ask
+                // again, and swallowing this would leave it with a stale list.
+                verifier.noteListChanged();
+                logger.info('verify: the upstream announced its tool list changed');
+                return { action: 'forward' };
+            }
+            if (!isResponse(message))
+                return { action: 'forward' };
+            const key = idKey(message.id);
+            if (!key)
+                return { action: 'forward' };
+            const call = pendingCalls.get(key);
+            if (call) {
+                pendingCalls.delete(key);
+                return finishCall(call, message);
+            }
+            if (!pendingLists.has(key))
+                return { action: 'forward' };
+            pendingLists.delete(key);
+            const result = message.result;
+            if (typeof result !== 'object' || result === null)
+                return { action: 'forward' };
+            const tools = result.tools;
+            if (!Array.isArray(tools))
+                return { action: 'forward' };
+            knownTools = new Map(tools
+                .filter((tool) => typeof tool?.name === 'string')
+                .map((tool) => [tool.name, tool]));
+            const outcome = await verifier.verify(tools);
+            options.onOutcome?.({
+                action: outcome.decision.action,
+                verdict: outcome.verdict,
+                fromCache: outcome.fromCache,
+            });
+            lastFinding = outcome.finding;
+            lastOutcome = outcome;
+            logger.info('verify: decided', {
+                action: outcome.decision.action,
+                rationale: outcome.decision.rationale,
+                verdict: outcome.verdict,
+                fromCache: outcome.fromCache,
+                tools: tools.length,
+            });
+            if (outcome.decision.action === 'pass')
+                return { action: 'forward' };
+            // The alert must not promise a prompt that will not come: none comes
+            // for an agent that cannot be asked, nor for a finding nobody is asked
+            // about (a contract error).
+            const canAsk = Boolean(context.agent?.supports('elicitation'));
+            const willAsk = needsConfirmation(outcome) && canAsk;
+            // Each flagged tool's own verdict, so the notice that replaces its
+            // description names ITS finding — see `withheldTool`.
+            const flagged = (outcome.tools ?? [])
+                .filter((tool) => tool.verdict === 'malicious' || tool.verdict === 'suspicious')
+                .map((tool) => ({ name: tool.name, verdict: tool.verdict, reason: tool.reason }));
+            // A server nobody is asked about (malicious, under `warn`) can still
+            // carry a suspicious tool — and a call to THAT one is put to the user.
+            const willAskForSuspicious = !willAsk && canAsk && flagged.some((tool) => tool.verdict === 'suspicious');
+            return {
+                action: 'replace',
+                message: {
+                    ...message,
+                    result: applyToToolsList(result, outcome.decision.action, outcome.finding, {
+                        willAsk,
+                        willAskForSuspicious,
+                        flagged,
+                    }),
+                },
+            };
+        },
+    };
+    /**
+     * The confirmation step of a `tools/call`: the decision that ends the call
+     * (refused, or dropped after a cancellation), or nothing when it may go on.
+     */
+    async function confirmOrRefuse(message, toolName, finding, agent) {
+        if (confirmed)
+            return undefined;
+        const { answer, cancelled } = await askAbout(message.id, toolName, finding, agent);
+        if (cancelled) {
+            // No response, on purpose: the spec has the receiver of a cancellation
+            // "not send a response for the cancelled request", and the sender
+            // ignore one that arrives anyway. A late refusal text would land in
+            // the agent's context as a fresh tool error for a call it already
+            // wrote off.
+            return { action: 'drop', reason: 'the agent cancelled the call before the user answered' };
+        }
+        if (answer.proceed)
+            return undefined;
+        if (answer.answered === false) {
+            logger.info('verify: no answer to the confirmation, the tools/call is not sent', { tool: toolName });
+            return {
+                action: 'respond',
+                message: refusedCallResponse(message.id, options.serverName, toolName, finding, 'unanswered'),
+                reason: 'the confirmation got no answer',
+            };
+        }
+        logger.info('verify: the user declined a tools/call to a suspicious tool', { tool: toolName });
+        return {
+            action: 'respond',
+            message: refusedCallResponse(message.id, options.serverName, toolName, finding, 'declined'),
+            reason: 'the user declined to send the call',
+        };
+    }
+    async function askAbout(requestId, toolName, finding, agent) {
+        const cancellation = new Cancellation(toolName);
+        const key = idKey(requestId);
+        if (key)
+            pendingConfirmations.set(key, cancellation);
+        try {
+            const answer = await confirmWithUser(toolName, finding, agent, cancellation);
+            return { answer, cancelled: cancellation.cancelled };
+        }
+        finally {
+            if (key)
+                pendingConfirmations.delete(key);
+        }
+    }
+    /**
+     * Puts the question to the user, once at a time.
+     *
+     * Two calls arriving while the prompt is up must not produce two prompts —
+     * the second would be answered by reflex — so the second WAITS on the open
+     * one. What the answer then covers depends on what the user said:
+     *
+     *   - a yes with `remember` covers the session, so every waiter goes through;
+     *   - a yes WITHOUT `remember` covers only the call the prompt named. The
+     *     user vouched for `read_file`, not for the `exfiltrate_env` that queued
+     *     behind it. A waiter re-asks, in turn, once the prompt closes — one
+     *     open question at a time, each naming its own tool;
+     *   - a no covers every call that waited on it. "Not this one" said while
+     *     N calls were queued is N refusals, not one refusal and N-1 nudges, and
+     *     the next call after the prompt closes asks again — a no is never
+     *     remembered.
+     */
+    async function confirmWithUser(toolName, finding, agent, cancellation) {
+        if (!agent || !agent.supports('elicitation')) {
+            if (!warnedCannotAsk) {
+                warnedCannotAsk = true;
+                logger.warn('verify: the agent cannot be asked (no elicitation capability), forwarding calls to a suspicious server');
+            }
+            return { proceed: true, remember: false };
+        }
+        for (;;) {
+            if (confirmed)
+                return { proceed: true, remember: true };
+            if (openQuestion) {
+                // Somebody else's prompt. Its answer is ours only if it was a no, or
+                // a yes for the whole session.
+                const shared = await cancellation.race(openQuestion);
+                if (!shared.proceed || shared.remember)
+                    return shared;
+                continue;
+            }
+            openQuestion = ask(agent, toolName, finding)
+                .then((answer) => {
+                if (answer.proceed && answer.remember)
+                    confirmed = true;
+                return answer;
+            })
+                .finally(() => {
+                openQuestion = undefined;
+            });
+            const answer = await cancellation.race(openQuestion);
+            if (cancellation.cancelled)
+                return answer;
+            logger.info('verify: the user answered the confirmation', {
+                tool: toolName,
+                proceed: answer.proceed,
+                remember: answer.remember,
+            });
+            return answer;
+        }
+    }
+    async function ask(agent, toolName, finding) {
+        let response;
+        try {
+            response = await agent.request('elicitation/create', {
+                message: confirmationPrompt(options.serverName, toolName, finding),
+                requestedSchema: CONFIRMATION_SCHEMA,
+            }, CONFIRMATION_TIMEOUT_MS);
+        }
+        catch (error) {
+            // A question that got no answer is a no. The alternative — forwarding
+            // because the prompt broke — would make a crashed dialog the way past
+            // the gate.
+            logger.warn('verify: the confirmation prompt failed, refusing the call', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return { proceed: false, remember: false, answered: false };
+        }
+        const result = typeof response.result === 'object' && response.result !== null
+            ? response.result
+            : undefined;
+        if (!result || result.action !== 'accept')
+            return { proceed: false, remember: false };
+        const content = typeof result.content === 'object' && result.content !== null
+            ? result.content
+            : {};
+        return { proceed: true, remember: content.remember !== false };
+    }
+    /**
+     * Scans a result, frames it if there is something to say, and writes the
+     * audit line either way.
+     */
+    function finishCall(call, message) {
+        const resultFindings = message.result === undefined ? [] : scanResult(message.result);
+        const findings = [...call.findings, ...resultFindings];
+        const resultBytes = byteLength(message.result);
+        options.audit?.record({
+            serverId: options.serverId,
+            serverName: options.serverName,
+            tool: call.tool,
+            digest: call.digest,
+            // Rules only. The arguments and the result are never written down: a
+            // file that quoted them would be a second copy of everything the user
+            // has done, sitting in their home directory.
+            findings: findings.length > 0 ? findings.map((finding) => finding.rule) : undefined,
+            argumentBytes: call.argumentBytes,
+            resultBytes,
+            isError: Boolean(message.result?.isError),
+            durationMs: Date.now() - call.startedAt,
+        });
+        if (resultFindings.length === 0 && !call.verdictFinding)
+            return { action: 'forward' };
+        if (resultFindings.length > 0) {
+            logger.warn('scan: something in the result of a tools/call', {
+                tool: call.tool,
+                findings: resultFindings.map((finding) => finding.rule),
+            });
+            lastFinding = {
+                serverName: options.serverName,
+                kind: 'a tool result tried to give you instructions',
+                tools: [call.tool],
+                reason: resultFindings[0]?.detail,
+            };
+        }
+        // The verdict frames, it never withholds: a call the server blocks was
+        // answered before it left, so a verdict here is one the server let
+        // through. Only a RESULT finding — an injection in the text — is
+        // withheld, and only under the organization's `block` policy.
+        const framed = [...(call.verdictFinding ? [call.verdictFinding] : []), ...resultFindings];
+        return {
+            action: 'replace',
+            message: {
+                ...message,
+                result: call.withholdOnFinding && resultFindings.length > 0
+                    ? replaceResult(options.serverName, call.tool, resultFindings)
+                    : prefixResult(message.result, options.serverName, call.tool, framed),
+            },
+        };
+    }
+}
+/**
+ * Whether a verification is one the user must be asked about.
+ *
+ * A block is enforced without a question. `alert` is the path for a
+ * SUSPICIOUS verdict or a list that changed mid-session — the two findings
+ * where the user's judgement is the missing piece. A contract error alerts
+ * too, but it is about OUR machinery, and asking the user to vouch for a
+ * server because our backend disagrees with our client would be asking the
+ * wrong person the wrong question.
+ */
+function needsConfirmation(outcome) {
+    return (outcome.decision.action === 'alert' &&
+        (outcome.verdict === 'suspicious' || outcome.decision.rationale === 'changed-mid-session'));
+}
+/**
+ * The word put on a result, when the tool's own verdict deserves one.
+ *
+ * Only a verdict ABOUT THE TOOL — suspicious, malicious, refused by the user,
+ * a list that changed under the session — earns the frame. A contract error
+ * is about our backend and our client disagreeing: the list-level alert
+ * already says so, and a "- ok (tool-verdict)" banner on every result of a
+ * clean tool would say nothing at all.
+ */
+function verdictFindingOf(outcome) {
+    const { verdict, decision, finding } = outcome;
+    const aboutTheTool = verdict === 'suspicious' ||
+        verdict === 'malicious' ||
+        decision.rationale === 'denied-by-user' ||
+        decision.rationale === 'changed-mid-session';
+    if (!aboutTheTool)
+        return undefined;
+    return {
+        kind: 'tool-verdict',
+        rule: 'tool-verdict',
+        where: 'tool',
+        detail: finding.reason ? `${finding.kind}: ${finding.reason}` : finding.kind,
+        severity: 'high',
+    };
+}
+/** A digest, or nothing: an un-hashable schema is not a reason to fail a call. */
+function safeDigest(tool) {
+    try {
+        return toolDigest(tool);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** How big a value is on the wire. Sizes are audited; contents never are. */
+function byteLength(value) {
+    if (value === undefined)
+        return 0;
+    try {
+        return Buffer.byteLength(JSON.stringify(value) ?? '', 'utf8');
+    }
+    catch {
+        return 0;
+    }
+}
+//# sourceMappingURL=verifyInterceptor.js.map

package/dist/mcp/proxy/verifyInterceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyInterceptor.js","sourceRoot":"","sources":["../../../src/mcp/proxy/verifyInterceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAuB,MAAM,cAAc,CAAC;AAM3F;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAarD;;;;;;;GAOG;AACH,MAAM,YAAY;IAKK;IAJrB,SAAS,GAAG,KAAK,CAAC;IACD,MAAM,CAAwB;IACvC,MAAM,GAAmC,GAAG,EAAE,CAAC,SAAS,CAAC;IAEjE,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,MAA6B;QAChC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF;AAiBD;;;GAGG;AACH,MAAM,UAAU,GAAmB;IACjC,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,EAAE;CACV,CAAC;AAqBF,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,iFAAiF;IACjF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,iFAAiF;IACjF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,2EAA2E;IAC3E,IAAI,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,IAAI,WAAW,GAAmB,UAAU,CAAC;IAC7C,uEAAuE;IACvE,IAAI,WAA4C,CAAC;IACjD,sEAAsE;IACtE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,qFAAqF;IACrF,IAAI,YAA+C,CAAC;IACpD;;;;;OAKG;IACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7D,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,OAAO;QACL,IAAI,EAAE,QAAQ;QAEd,KAAK,CAAC,SAAS,CAAC,OAAuB,EAAE,OAAyB;YAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEjC,IAAI,MAAM,KAAK,yBAAyB,EAAE,CAAC;gBACzC,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;oBAC3D,CAAC,CAAE,OAAO,CAAC,MAAkC,CAAC,SAAS;oBACvD,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,IAAI,OAAO,EAAE,CAAC;oBACZ,gEAAgE;oBAChE,mEAAmE;oBACnE,mEAAmE;oBACnE,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;wBACrF,IAAI,EAAE,OAAO,CAAC,IAAI;qBACnB,CAAC,CAAC;oBACH,OAAO,CAAC,MAAM,EAAE,CAAC;oBACjB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;gBAC9E,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,GAAG;oBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAClD,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;oBAC3D,CAAC,CAAE,OAAO,CAAC,MAAkD;oBAC7D,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,8DAA8D;oBAC9D,OAAO;wBACL,MAAM,EAAE,SAAS;wBACjB,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;wBACrE,MAAM,EAAE,6CAA6C;qBACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;gBAE/D,oEAAoE;gBACpE,kEAAkE;gBAClE,IAAI,WAAW,EAAE,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC7C,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACpF,OAAO;wBACL,MAAM,EAAE,SAAS;wBACjB,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC;wBAC9F,MAAM,EAAE,uBAAuB;qBAChC,CAAC;gBACJ,CAAC;gBAED,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE;oBAC/C,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,WAAW,EAAE,UAAU,EAAE,WAAW;oBACpC,WAAW,EAAE,UAAU,EAAE,WAAW;iBACrC,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,oEAAoE;oBACpE,gEAAgE;oBAChE,qDAAqD;oBACrD,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;wBAC9D,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBAClD,CAAC,CAAC;gBACL,CAAC;gBACD,qDAAqD;gBACrD,IAAI,cAAuC,CAAC;gBAC5C,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC/B,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;oBACrD,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBACxB,OAAO,CAAC,SAAS,EAAE,CAAC;wBAClB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;wBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;oBACH,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBACvC,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;4BACxC,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;4BAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;4BACrC,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,SAAS,EAAE,OAAO,CAAC,SAAS;yBAC7B,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BACxC,8DAA8D;4BAC9D,wCAAwC;4BACxC,OAAO;gCACL,MAAM,EAAE,SAAS;gCACjB,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;gCAClG,MAAM,EAAE,2CAA2C;6BACpD,CAAC;wBACJ,CAAC;wBACD,mEAAmE;wBACnE,gEAAgE;wBAChE,wBAAwB;wBACxB,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;4BAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;4BACzF,IAAI,OAAO;gCAAE,OAAO,OAAO,CAAC;wBAC9B,CAAC;wBACD,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;oBAC7C,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBACxB,mEAAmE;oBACnE,oEAAoE;oBACpE,mEAAmE;oBACnE,kEAAkE;oBAClE,MAAM,CAAC,IAAI,CAAC,0EAA0E,EAAE;wBACtF,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1C,qDAAqD;oBACrD,mEAAmE;oBACnE,gEAAgE;oBAChE,mEAAmE;oBACnE,iEAAiE;oBACjE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBACrF,IAAI,OAAO;wBAAE,OAAO,OAAO,CAAC;gBAC9B,CAAC;gBAED,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,GAAG,EAAE,CAAC;oBACR,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;wBACpB,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;wBACvD,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;wBAC3C,QAAQ;wBACR,cAAc;wBACd,iBAAiB,EAAE,MAAM,CAAC,IAAI,KAAK,OAAO;wBAC1C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,OAAuB,EAAE,OAAyB;YACnE,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBAC7D,kEAAkE;gBAClE,+DAA+D;gBAC/D,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAEvC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACT,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnC,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACzD,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAChF,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAExD,UAAU,GAAG,IAAI,GAAG,CACjB,KAAsB;iBACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC;iBAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CACpC,CAAC;YAEF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAqB,CAAC,CAAC;YAC7D,OAAO,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YACH,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;YAC9B,WAAW,GAAG,OAAO,CAAC;YAEtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC7B,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;gBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,KAAK,CAAC,MAAM;aACpB,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,4BAA4B;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;YACrD,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;iBAClC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,WAAW,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC;iBAC/E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpF,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,oBAAoB,GAAG,CAAC,OAAO,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;YACzG,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE;oBACP,GAAG,OAAO;oBACV,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE;wBACzE,OAAO;wBACP,oBAAoB;wBACpB,OAAO;qBACR,CAAC;iBACH;aACF,CAAC;QACJ,CAAC;KACF,CAAC;IAEF;;;OAGG;IACH,KAAK,UAAU,eAAe,CAC5B,OAAuB,EACvB,QAAgB,EAChB,OAAuB,EACvB,KAA+B;QAE/B,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,kEAAkE;YAClE,aAAa;YACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrG,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC;gBAC7F,MAAM,EAAE,gCAAgC;aACzC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,6DAA6D,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/F,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3F,MAAM,EAAE,oCAAoC;SAC7C,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,SAAkB,EAClB,QAAgB,EAChB,OAAuB,EACvB,KAA+B;QAE/B,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,GAAG;YAAE,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAC7E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,IAAI,GAAG;gBAAE,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,OAAuB,EACvB,KAA+B,EAC/B,YAA0B;QAE1B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,eAAe,GAAG,IAAI,CAAC;gBACvB,MAAM,CAAC,IAAI,CACT,wGAAwG,CACzG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC;YACR,IAAI,SAAS;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,YAAY,EAAE,CAAC;gBACjB,qEAAqE;gBACrE,+BAA+B;gBAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBACtD,SAAS;YACX,CAAC;YACD,YAAY,GAAG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;iBACzC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ;oBAAE,SAAS,GAAG,IAAI,CAAC;gBACxD,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC,CAAC,CAAC;YACL,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,YAAY,CAAC,SAAS;gBAAE,OAAO,MAAM,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;gBACxD,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,GAAG,CAAC,KAAmB,EAAE,QAAgB,EAAE,OAAuB;QAC/E,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAC5B,oBAAoB,EACpB;gBACE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC;gBAClE,eAAe,EAAE,mBAAmB;aACrC,EACD,uBAAuB,CACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,sEAAsE;YACtE,YAAY;YACZ,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;gBACvE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;QACD,MAAM,MAAM,GACV,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;YAC7D,CAAC,CAAE,QAAQ,CAAC,MAAkD;YAC9D,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtF,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAC3D,CAAC,CAAE,MAAM,CAAC,OAAkC;YAC5C,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,SAAS,UAAU,CAAC,IAAiB,EAAE,OAAuB;QAC5D,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,qEAAqE;YACrE,sEAAsE;YACtE,6CAA6C;YAC7C,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACnF,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW;YACX,OAAO,EAAE,OAAO,CAAE,OAAO,CAAC,MAA4C,EAAE,OAAO,CAAC;YAChF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;SACxC,CAAC,CAAC;QAEH,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEtF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;aACxD,CAAC,CAAC;YACH,WAAW,GAAG;gBACZ,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,8CAA8C;gBACpD,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClB,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM;aAClC,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC;QAC1F,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,MAAM,EACJ,IAAI,CAAC,iBAAiB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;oBACjD,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;oBAC9D,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;aAC1E;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,OAA4B;IACrD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO;QACnC,CAAC,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,OAA4B;IACpD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,YAAY,GAChB,OAAO,KAAK,YAAY;QACxB,OAAO,KAAK,WAAW;QACvB,QAAQ,CAAC,SAAS,KAAK,gBAAgB;QACvC,QAAQ,CAAC,SAAS,KAAK,qBAAqB,CAAC;IAC/C,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;QAC5E,QAAQ,EAAE,MAAM;KACjB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,IAAgB;IAClC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}