@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/auth/connect.js

@@ -0,0 +1,392 @@
+/**
+ * The `vibedefend connect` flow, for one server.
+ *
+ * Probe → discovery → an agent's sign-in, else dynamic registration → browser
+ * → exchange → store. Each
+ * step is allowed to end the flow, and the outcome is a CLOSED vocabulary:
+ * nothing from the network is ever interpolated into a status, a reason or a
+ * hint. That is not squeamishness — a hostile server's `error_description` is
+ * the obvious place to put a sentence telling the user to run something, and
+ * we print these.
+ *
+ * Two properties this file exists to keep:
+ *
+ *  - a token never leaves the machine. The only origins reached are the MCP
+ *    server's and its authorization server's, both of which come from a
+ *    discovery bound to the URL the user chose.
+ *  - a failure on one server never stops the others. `connectAll` catches per
+ *    server; the worst a bad entry can do is report itself.
+ */
+import { pkceChallenge, randomBase64url } from '../../auth/pkce.js';
+import { findAgentSignIns } from './agent-sign-ins.js';
+import { canonicalMcpUrl, exchangeMcpCode, McpSuspiciousRedirectError, refreshMcpToken, registerMcpClient, } from './oauth.js';
+import { AuthorizationRedirectError, callbackRedirectUri, startMcpAuthorizationCallbackServer, } from './callback.js';
+import { discoverMcpOAuthOutcome } from './discovery.js';
+import { probeMcpHttp } from './probe.js';
+import { loadMcpAuth, loadMcpClient, storeMcpAuth, storeMcpClient, validMcpAccessToken, } from './store.js';
+const DEFAULT_AUTHORIZATION_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Stores a bearer supplied by the operator, for CI.
+ *
+ * There is no refresh token and no client: this credential dies when the
+ * server says so, which is exactly what a CI secret should do. No device flow
+ * in v1 — it needs a polling loop and a second UX, and a `--token` covers the
+ * case it was wanted for.
+ */
+export function connectWithToken(serverUrl, token, deps = {}) {
+    const server = canonicalMcpUrl(serverUrl) ?? serverUrl;
+    const stored = storeMcpAuth(serverUrl, {
+        accessToken: token,
+        refreshToken: null,
+        expiresAt: null,
+        clientId: 'headless',
+        clientSecret: null,
+        tokenEndpoint: '',
+        resource: server,
+    }, deps.storeDeps);
+    const result = stored
+        ? { server, status: 'token-stored' }
+        : { server, status: 'failed', reason: 'store-failed' };
+    deps.onEvent?.({ kind: 'done', result });
+    return result;
+}
+/** The whole flow for one server. Never throws. */
+export async function connectMcpServer(serverUrl, deps = {}) {
+    const server = canonicalMcpUrl(serverUrl) ?? serverUrl;
+    const finish = (result) => {
+        deps.onEvent?.({ kind: 'done', result });
+        return result;
+    };
+    if (!deps.force && validMcpAccessToken(serverUrl, deps.storeDeps)) {
+        return finish({ server, status: 'already-connected' });
+    }
+    // 1. Does it even want a token?
+    deps.onEvent?.({ kind: 'probing', server });
+    const probe = await probeMcpHttp(serverUrl, {
+        fetchImpl: deps.fetchImpl,
+        timeoutMs: deps.timeoutMs,
+        clientInfo: deps.clientInfo,
+        // A stored-but-expired credential must not make an open server look
+        // closed, so the probe goes out bare.
+        token: null,
+    });
+    if (probe.verdict === 'open')
+        return finish({ server, status: 'no-auth-needed' });
+    if (probe.verdict === 'unreachable') {
+        return finish({ server, status: 'failed', reason: 'unreachable' });
+    }
+    if (probe.verdict === 'unusable') {
+        return finish({ server, status: 'failed', reason: 'unusable' });
+    }
+    // 2. Where do we authenticate?
+    deps.onEvent?.({ kind: 'discovering', server });
+    const discovery = await discoverMcpOAuthOutcome(serverUrl, {
+        fetchImpl: deps.fetchImpl,
+        timeoutMs: deps.timeoutMs,
+        knownChallenge: probe.challenge,
+    });
+    if (discovery.reason !== 'ok' || !discovery.endpoints) {
+        const reason = discovery.reason === 'no-oauth'
+            ? 'closed-door'
+            : discovery.reason;
+        return finish({ server, status: 'failed', reason });
+    }
+    const endpoints = discovery.endpoints;
+    // 3. The RFC 9207 gate, before anything opens a browser: a refusal under
+    // strict verification. Otherwise the flow goes on, and whether the response
+    // can be tied back to its server is only known once it arrives (5b).
+    if (!endpoints.issParameterSupported && deps.strictIssuer) {
+        return finish({ server, status: 'failed', reason: 'unverifiable-issuer' });
+    }
+    // 3b. A sign-in an agent already holds for this very server.
+    if (deps.reuse !== false && !deps.force) {
+        const taken = await takeOverAgentSignIn(serverUrl, endpoints, deps);
+        if (taken.outcome === 'reused')
+            return finish({ server, status: 'reused', from: taken.from });
+        if (taken.outcome === 'failed')
+            return finish({ server, status: 'failed', reason: taken.reason });
+    }
+    if (deps.reuseOnly)
+        return finish({ server, status: 'failed', reason: 'sign-in-needed' });
+    // 4. A client to authorize as, and somewhere for the browser to land.
+    //
+    // The `state` is generated here and handed to the callback server, which
+    // is what checks it: `code` cannot reach the exchange before that check has
+    // passed, whatever this function does with it afterwards.
+    //
+    // A client registered by hand and remembered from a previous connect
+    // outlives the credential, and so does the port its redirect URI names.
+    const remembered = deps.clientId ? null : loadMcpClient(serverUrl, deps.storeDeps);
+    const callbackPort = deps.callbackPort ?? remembered?.callbackPort ?? undefined;
+    const state = randomBase64url(32);
+    const callback = await (deps.startCallbackServer ?? startMcpAuthorizationCallbackServer)(state, endpoints.issuer, endpoints.issParameterSupported, callbackPort === undefined ? {} : { port: callbackPort }).catch(() => null);
+    if (!callback)
+        return finish({ server, status: 'failed', reason: 'browser-failed' });
+    // Settled BEFORE the browser step, not after. The callback server rejects
+    // as soon as a bad response arrives — a replayed state, a foreign `iss` —
+    // and that can happen while `openBrowser` is still running. A rejection
+    // with nothing attached to it is an unhandled rejection, which crashes a
+    // process started with `--unhandled-rejections=strict`.
+    const settled = callback.redirectPromise.then((value) => ({ ok: true, value }), (error) => ({ ok: false, error }));
+    try {
+        const redirectUri = callbackRedirectUri(callback.port);
+        let clientId = deps.clientId ?? remembered?.clientId;
+        let clientSecret = deps.clientId
+            ? (deps.clientSecret ?? null)
+            : (remembered?.clientSecret ?? null);
+        if (!clientId) {
+            if (!endpoints.registrationEndpoint) {
+                return finish({ server, status: 'failed', reason: 'no-registration' });
+            }
+            deps.onEvent?.({ kind: 'registering', server });
+            let registration;
+            try {
+                registration = await registerMcpClient(endpoints.registrationEndpoint, redirectUri, {
+                    fetchImpl: deps.fetchImpl,
+                    timeoutMs: deps.timeoutMs,
+                });
+            }
+            catch (error) {
+                if (error instanceof McpSuspiciousRedirectError) {
+                    return finish({ server, status: 'failed', reason: 'suspicious-redirect' });
+                }
+                return finish({ server, status: 'failed', reason: 'registration-failed' });
+            }
+            if (!registration)
+                return finish({ server, status: 'failed', reason: 'registration-failed' });
+            clientId = registration.clientId;
+            clientSecret = registration.clientSecret;
+        }
+        // 5. The browser.
+        const verifier = randomBase64url(64);
+        const authorizationUrl = buildAuthorizationUrl({
+            endpoints,
+            clientId,
+            redirectUri,
+            state,
+            challenge: pkceChallenge(verifier),
+            scope: deps.scope ?? endpoints.scopesSupported.join(' '),
+        });
+        deps.onEvent?.({ kind: 'awaiting-browser', server, url: authorizationUrl });
+        // A browser that does not open is not fatal: the URL was just announced,
+        // and the user may paste it. Announcing it again only repeated it.
+        await (deps.openBrowser ?? (() => true))(authorizationUrl);
+        let outcome;
+        try {
+            outcome = await withTimeout(settled, deps.authorizationTimeoutMs ?? DEFAULT_AUTHORIZATION_TIMEOUT_MS);
+        }
+        catch {
+            return finish({ server, status: 'failed', reason: 'authorization-timeout' });
+        }
+        if (!outcome.ok) {
+            // `kind` is a closed vocabulary of ours, never a string from the wire.
+            if (outcome.error instanceof AuthorizationRedirectError) {
+                return finish({ server, status: 'failed', reason: outcome.error.kind });
+            }
+            return finish({ server, status: 'failed', reason: 'denied' });
+        }
+        const redirect = outcome.value;
+        // 5b. An AS that does not announce RFC 9207 may still stamp `iss`:
+        // mcp-service does on every response, and cannot announce it (Devin's
+        // client loses the parameter, then requires it). The callback server
+        // compared any `iss` it got, so only a response WITHOUT one could not be
+        // tied back to the server it came from.
+        if (!endpoints.issParameterSupported && redirect.iss === null) {
+            deps.onEvent?.({ kind: 'unverifiable-issuer', server });
+        }
+        // 6. The exchange.
+        deps.onEvent?.({ kind: 'exchanging', server });
+        let tokens;
+        try {
+            tokens = await exchangeMcpCode({
+                tokenEndpoint: endpoints.tokenEndpoint,
+                clientId,
+                clientSecret,
+                code: redirect.code,
+                codeVerifier: verifier,
+                redirectUri,
+                resource: endpoints.resource,
+                fetchImpl: deps.fetchImpl,
+                timeoutMs: deps.timeoutMs,
+            });
+        }
+        catch (error) {
+            if (error instanceof McpSuspiciousRedirectError) {
+                return finish({ server, status: 'failed', reason: 'suspicious-redirect' });
+            }
+            return finish({ server, status: 'failed', reason: 'exchange-failed' });
+        }
+        if (!tokens)
+            return finish({ server, status: 'failed', reason: 'exchange-failed' });
+        const persisted = storeMcpAuth(serverUrl, {
+            ...tokens,
+            clientId,
+            clientSecret,
+            tokenEndpoint: endpoints.tokenEndpoint,
+            resource: endpoints.resource,
+        }, deps.storeDeps);
+        if (!persisted)
+            return finish({ server, status: 'failed', reason: 'store-failed' });
+        if (deps.clientId) {
+            // Registered by hand: remembered, so the next connect — after an
+            // invalid_grant erased the credential, say — needs no flags.
+            storeMcpClient(serverUrl, { clientId, clientSecret, callbackPort: deps.callbackPort ?? null }, deps.storeDeps);
+        }
+        // 7. Does the resource actually accept it? An AS can hand out a token the
+        // resource then refuses — measured on a server whose PRM advertised
+        // scopes we had not asked for.
+        const confirm = await probeMcpHttp(serverUrl, {
+            fetchImpl: deps.fetchImpl,
+            timeoutMs: deps.timeoutMs,
+            clientInfo: deps.clientInfo,
+            token: tokens.accessToken,
+        });
+        if (confirm.verdict === 'refused') {
+            return finish({ server, status: 'failed', reason: 'token-rejected' });
+        }
+        return finish({ server, status: 'connected' });
+    }
+    finally {
+        await callback.stop().catch(() => undefined);
+    }
+}
+/**
+ * Stores the first agent sign-in the server accepts.
+ *
+ * A token only goes back where it came from: the access token to the server
+ * it was issued for (the probe), the refresh token to the token endpoint
+ * discovered from that server, and only when the agent recorded no issuer or
+ * the same one. The agent's copy keeps working until the proxy renews it;
+ * after that, a server that rotates refresh tokens asks the agent to sign in
+ * again if it ever talks to the server without the proxy.
+ */
+async function takeOverAgentSignIn(serverUrl, endpoints, deps) {
+    let signIns;
+    try {
+        signIns = (deps.findAgentSignIns ?? ((url) => findAgentSignIns(url)))(serverUrl);
+    }
+    catch {
+        return { outcome: 'none' };
+    }
+    for (const signIn of signIns) {
+        if (signIn.issuer !== null && !sameIssuer(signIn.issuer, endpoints.issuer))
+            continue;
+        deps.onEvent?.({ kind: 'reusing', server: canonicalMcpUrl(serverUrl) ?? serverUrl, from: signIn.source });
+        let tokens = null;
+        const access = signIn.accessToken;
+        const fresh = access !== null && (signIn.expiresAt === null || signIn.expiresAt - 60_000 > Date.now());
+        if (fresh && (await accepted(serverUrl, access, deps))) {
+            tokens = { accessToken: access, refreshToken: signIn.refreshToken, expiresAt: signIn.expiresAt };
+        }
+        else if (signIn.refreshToken !== null) {
+            const renewed = await refreshMcpToken({
+                tokenEndpoint: endpoints.tokenEndpoint,
+                clientId: signIn.clientId,
+                clientSecret: signIn.clientSecret,
+                refreshToken: signIn.refreshToken,
+                resource: endpoints.resource,
+                fetchImpl: deps.fetchImpl,
+                timeoutMs: deps.timeoutMs,
+            });
+            if (!renewed.ok && renewed.reason === 'suspicious_redirect') {
+                return { outcome: 'failed', reason: 'suspicious-redirect' };
+            }
+            if (renewed.ok && (await accepted(serverUrl, renewed.tokens.accessToken, deps)))
+                tokens = renewed.tokens;
+        }
+        if (!tokens)
+            continue;
+        const stored = storeMcpAuth(serverUrl, {
+            ...tokens,
+            clientId: signIn.clientId,
+            clientSecret: signIn.clientSecret,
+            tokenEndpoint: endpoints.tokenEndpoint,
+            resource: endpoints.resource,
+        }, deps.storeDeps);
+        return stored ? { outcome: 'reused', from: signIn.source } : { outcome: 'failed', reason: 'store-failed' };
+    }
+    return { outcome: 'none' };
+}
+async function accepted(serverUrl, token, deps) {
+    const probe = await probeMcpHttp(serverUrl, {
+        fetchImpl: deps.fetchImpl,
+        timeoutMs: deps.timeoutMs,
+        clientInfo: deps.clientInfo,
+        token,
+    });
+    return probe.verdict === 'open';
+}
+function sameIssuer(a, b) {
+    return a.trim().replace(/\/+$/, '') === b.trim().replace(/\/+$/, '');
+}
+/**
+ * The authorization URL, exactly as the browser will receive it.
+ *
+ * `resource` (RFC 8707) is always the canonical MCP URL, which is what stops
+ * the token from being valid elsewhere, and `scope` comes from the PRM: an AS
+ * asked for no scope issues a token the RESOURCE then refuses, which looks
+ * like a broken login after a successful OAuth.
+ */
+export function buildAuthorizationUrl(params) {
+    const url = new URL(params.endpoints.authorizationEndpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', params.clientId);
+    url.searchParams.set('redirect_uri', params.redirectUri);
+    url.searchParams.set('code_challenge', params.challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', params.state);
+    url.searchParams.set('resource', params.endpoints.resource);
+    if (params.scope.trim() !== '')
+        url.searchParams.set('scope', params.scope.trim());
+    return url.toString();
+}
+class TimeoutError extends Error {
+}
+function withTimeout(promise, ms) {
+    return Promise.race([
+        promise,
+        new Promise((_, reject) => {
+            const timer = setTimeout(() => reject(new TimeoutError('authorization timed out')), ms);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+        }),
+    ]);
+}
+/** Whether a usable credential is on file for this server. */
+export function isConnected(serverUrl, deps = {}) {
+    return loadMcpAuth(serverUrl, deps) !== null;
+}
+/**
+ * Connects a whole park.
+ *
+ * Sequential on purpose: the interactive step opens a browser tab, and three
+ * tabs at once is not a flow anybody can complete. A failure is recorded and
+ * the loop moves on — the measured worst outcome of the previous generation
+ * was one malformed server blinding the verification of every other.
+ */
+export async function connectAll(targets, deps = {}) {
+    const connect = deps.connectFn ?? connectMcpServer;
+    const results = [];
+    for (const target of targets) {
+        let result;
+        try {
+            result = await connect(target.url, deps);
+        }
+        catch {
+            // `connectMcpServer` is documented as never throwing; this is the belt
+            // that keeps a broken entry from ending the loop if it ever does.
+            result = {
+                server: canonicalMcpUrl(target.url) ?? target.url,
+                status: 'failed',
+                reason: 'unusable',
+            };
+        }
+        results.push({ ...result, name: target.name });
+    }
+    return { results, ok: results.every((result) => result.status !== 'failed') };
+}
+/** What a status means for the exit code and for what the user should do. */
+export function needsAttention(result) {
+    return result.status === 'failed';
+}
+//# sourceMappingURL=connect.js.map

package/dist/mcp/auth/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/mcp/auth/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAA4C,MAAM,qBAAqB,CAAC;AACjG,OAAO,EACL,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,GAElB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,mCAAmC,GAGpC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAA0B,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,mBAAmB,GAEpB,MAAM,YAAY,CAAC;AA4GpB,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,KAAa,EACb,OAAoB,EAAE;IAEtB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IACvD,MAAM,MAAM,GAAG,YAAY,CACzB,SAAS,EACT;QACE,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,MAAM;KACjB,EACD,IAAI,CAAC,SAAS,CACf,CAAC;IACF,MAAM,MAAM,GAAkB,MAAM;QAClC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE;QACpC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,OAAoB,EAAE;IAEtB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAiB,EAAE;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,oEAAoE;QACpE,sCAAsC;QACtC,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE;QACzD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,KAAK,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACtD,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,KAAK,UAAU;YAC7B,CAAC,CAAC,aAAa;YACf,CAAC,CAAE,SAAS,CAAC,MAA+B,CAAC;QACjD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;IAEtC,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,CAAC,SAAS,CAAC,qBAAqB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAE1F,sEAAsE;IACtE,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,0DAA0D;IAC1D,EAAE;IACF,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE,YAAY,IAAI,SAAS,CAAC;IAChF,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,mCAAmC,CAAC,CACtF,KAAK,EACL,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,qBAAqB,EAC/B,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CACzD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAErF,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,IAAI,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC,EACzC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC,CACpD,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC;QACrD,IAAI,YAAY,GAAkB,IAAI,CAAC,QAAQ;YAC7C,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,IAAI,IAAI,CAAC,CAAC;QAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;YAChD,IAAI,YAAY,CAAC;YACjB,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,oBAAoB,EAAE,WAAW,EAAE;oBAClF,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;oBAChD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,YAAY;gBAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC9F,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;YACjC,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC3C,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;YAC7C,SAAS;YACT,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC;YAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAE3D,IAAI,OAAmF,CAAC;QACxF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CACzB,OAAO,EACP,IAAI,CAAC,sBAAsB,IAAI,gCAAgC,CAChE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,uEAAuE;YACvE,IAAI,OAAO,CAAC,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBACxD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;QAE/B,mEAAmE;QACnE,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,qBAAqB,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,eAAe,CAAC;gBAC7B,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,QAAQ;gBACR,YAAY;gBACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,YAAY,EAAE,QAAQ;gBACtB,WAAW;gBACX,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAEpF,MAAM,SAAS,GAAG,YAAY,CAC5B,SAAS,EACT;YACE,GAAG,MAAM;YACT,QAAQ;YACR,YAAY;YACZ,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B,EACD,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,iEAAiE;YACjE,6DAA6D;YAC7D,cAAc,CACZ,SAAS,EACT,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,EACnE,IAAI,CAAC,SAAS,CACf,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,oEAAoE;QACpE,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE;YAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,MAAM,CAAC,WAAW;SAC1B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAOD;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,SAA4B,EAC5B,IAAiB;IAEjB,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC;YAAE,SAAS;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE1G,IAAI,MAAM,GAA0B,IAAI,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvG,IAAI,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACnG,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;gBACpC,aAAa,EAAE,SAAS,CAAC,aAAa;gBACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBAC5D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,MAAM,GAAG,YAAY,CACzB,SAAS,EACT;YACE,GAAG,MAAM;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B,EACD,IAAI,CAAC,SAAS,CACf,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,SAAiB,EAAE,KAAa,EAAE,IAAiB;IACzE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO;QACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACvD,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,OAA0B,EAAE;IACzE,OAAO,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAiC,EACjC,OAGI,EAAE;IAEN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACnD,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,GAAG;gBACP,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG;gBACjD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;AACpC,CAAC"}