@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/verify/api.js

@@ -0,0 +1,514 @@
+/**
+ * Client for the ORG-SCOPED backend routes of the MCP verifier.
+ *
+ * The response envelopes are read from the real gateway controllers
+ * (`gateway-service/src/modules/mcp-verify/mcp-org-verify.controller.ts`,
+ * `organization/mcp-org-policy.controller.ts`), not inferred from a spec:
+ *
+ *   POST /mcp/organization/:id/servers/check -> `{ success, data: { policy, results }, message }`
+ *   POST /mcp/organization/:id/tools/verify  -> `{ success, data: { policy, verdicts }, message }`
+ *   GET  /mcp/organization/:id/policy        -> `{ success, data: { mode, strictIssuer }, message }`
+ *
+ * The organization is in the PATH, so the backend checks membership before
+ * anything else, and the organization's policy is applied SERVER-SIDE: every
+ * verdict and every result carries the `action` the client executes, and the
+ * envelope carries the `policy` it was decided under. The deprecated
+ * user-scoped routes (`/mcp/tools/verify`, `/mcp/servers/check`) are never
+ * called by this binary: they return a verdict without an action, and a
+ * client that turned a verdict into a decision by reading a mode out of its
+ * own environment is exactly what the org-scoped line removes.
+ *
+ * Invariants held by this module:
+ *  - `known: false` on a tool verdict means "not verified", never "nothing to
+ *    report". It is carried as an explicit boolean all the way to the caller.
+ *  - An `action` this binary cannot read — absent, or out of vocabulary — is
+ *    `pending`, NEVER `allow`. Nothing opens a door nobody decided to open.
+ *  - A response without a readable `policy` throws: the deprecated envelope
+ *    is not this contract, and reading it as one would decide on nothing.
+ *  - An untrusted `apiBase` is refused BEFORE any network call
+ *    (`isTrustedApiBase`, applied on the real request path of both functions).
+ *  - A `401` triggers EXACTLY one token refresh and one retry, never a loop
+ *    (`requestWithAuthRetry`).
+ *  - The backend refuses more than 500 tools / 200 servers per request
+ *    (`VerifyToolsBodyDto`, `CheckMcpServersBodyDto` on the gateway side).
+ *    This client splits into batches instead of letting the caller hit
+ *    `INVALID_ARGUMENT`, and declares the split through `onBatchSplit`.
+ *  - A response missing an expected field (`data.results`, `data.verdicts`)
+ *    throws, never a silence that would read as "empty, nothing to report".
+ *  - No token ever leaves this module inside an error message.
+ */
+import { resolveTokenWithRefresh } from '../../hooks/runtime/resolve.js';
+import { GatewayHttpError } from '../../hooks/runtime/gateway-http-error.js';
+import { parseRetryAfter } from '../../hooks/runtime/retry-policy.js';
+import { REPORT_HTTP_TIMEOUT_MS } from '../report/constants.js';
+import { DIGEST_VERSION } from './digest.js';
+import { isContractErrorStatus } from './contract-errors.js';
+import { isPolicyMode, isServerAction } from './policy.js';
+import { isTrustedApiBase, } from '../../hooks/runtime/trusted-api-base.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+// ─── Failure taxonomy ───────────────────────────────────────────────────────
+/**
+ * Any non-2xx from the backend.
+ *
+ * Carries the STATUS and the ROUTE, because the caller's decision depends on
+ * both and re-parsing a message to recover them is how that decision starts
+ * being made on prose.
+ */
+export class McpBackendError extends Error {
+    route;
+    status;
+    constructor(route, status, message) {
+        super(message ?? `/mcp/organization/:organizationId/${route} failed with HTTP ${status}`);
+        this.route = route;
+        this.status = status;
+        this.name = 'McpBackendError';
+    }
+}
+/**
+ * The backend ANSWERED, and refused what we sent: 400, 409, 422 — and, on the
+ * org-scoped routes, 403 (not a member of that organization) and 404 (no such
+ * organization).
+ *
+ * ⚠️ This is not an outage, and the difference is the whole point. An outage
+ * is fail-open — the tool list goes through, the verdict is `pending`, the
+ * agent is told nothing, because the user can do nothing about it. A contract
+ * refusal filed the same way says "we will retry and it will work", when
+ * retrying cannot help: the request that was refused is the request we would
+ * send again.
+ *
+ * Left as `pending`, a client that has stopped verifying ANYTHING looks
+ * exactly like a client waiting on a slow backend — for as long as nobody
+ * looks.
+ */
+export class McpContractError extends McpBackendError {
+    constructor(route, status, message) {
+        super(route, status, message);
+        this.name = 'McpContractError';
+    }
+}
+/**
+ * `409 DIGEST_VERSION_UNSUPPORTED` — the backend cannot compute the digest
+ * formula this binary uses.
+ *
+ * Its own class because its remedy is its own: every digest we send is
+ * unmatchable, so nothing can be verified until one side is upgraded, and the
+ * `supported` list is the only actionable thing in the whole exchange.
+ */
+export class DigestVersionUnsupportedError extends McpContractError {
+    code;
+    supported;
+    constructor(route, code, supported, message) {
+        super(route, 409, message);
+        this.code = code;
+        this.supported = supported;
+        this.name = 'DigestVersionUnsupportedError';
+    }
+}
+/** `{ error: { code, supported } }`, when the backend sent one. */
+function errorEnvelope(body) {
+    if (!body || typeof body !== 'object')
+        return {};
+    const error = body.error;
+    if (!error || typeof error !== 'object')
+        return {};
+    const shape = error;
+    return {
+        code: typeof shape.code === 'string' ? shape.code : undefined,
+        supported: Array.isArray(shape.supported)
+            ? shape.supported.filter((value) => typeof value === 'string')
+            : undefined,
+    };
+}
+/**
+ * Turns a non-2xx into the right kind of error.
+ *
+ * The body is read ONLY to name the refusal. A body that is not JSON, or that
+ * carries no `error.code`, still produces a contract error when the status
+ * says so: a server being terse does not make its refusal an outage.
+ *
+ * ⚠️ Nothing from the request — token, headers, payload — goes into the
+ * message. A contract error is precisely what ends up in a log.
+ */
+async function backendError(res, route, requestLabel) {
+    const label = `${requestLabel} failed with HTTP ${res.status}`;
+    if (!isContractErrorStatus(res.status))
+        return new McpBackendError(route, res.status, label);
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const { code, supported } = errorEnvelope(body);
+    if (res.status === 409 && code === 'DIGEST_VERSION_UNSUPPORTED') {
+        const list = supported ?? [];
+        return new DigestVersionUnsupportedError(route, code, list, `${label}: this backend cannot compute digest version "${DIGEST_VERSION}"` +
+            (list.length > 0 ? `; it supports ${list.join(', ')}` : ''));
+    }
+    return new McpContractError(route, res.status, code ? `${label} (${code})` : label);
+}
+/**
+ * Mirrors `VerifyToolsBodyDto` (`ArrayMaxSize(500)`) on the gateway. A request
+ * over this bound is refused as `INVALID_ARGUMENT`; we split client-side.
+ */
+export const MAX_TOOLS_PER_REQUEST = 500;
+/**
+ * Mirrors `CheckMcpServersBodyDto`'s own `MAX_SERVERS_PER_REQUEST` (200), a
+ * different bound than {@link MAX_TOOLS_PER_REQUEST}.
+ */
+export const MAX_SERVERS_PER_REQUEST = 200;
+/**
+ * Gate every outbound call behind the same origin allowlist that protects the
+ * hooks (`isTrustedApiBase`, `src/hooks/runtime/trusted-api-base.ts`). Throws,
+ * never a silent `false`-shaped result: a rejected apiBase has no valid
+ * representation in any of the return types below, so failing the promise is
+ * the only way to guarantee it cannot be mistaken for "checked, nothing to
+ * report".
+ */
+/**
+ * We refused to call, and the backend has nothing to do with it.
+ *
+ * ⚠️ Its own class because the caller was filing it as "backend unreachable,
+ * fail-open" — the same words an outage produces. A user whose region is
+ * mis-declared then goes and checks their network, their VPN and the
+ * backend's health, for a local configuration problem with a one-line fix.
+ * The direction is right (fail-open either way); the DIAGNOSIS was wrong, and
+ * a wrong diagnosis costs more than a missing one.
+ */
+export class UntrustedApiBaseError extends Error {
+    apiBase;
+    constructor(apiBase) {
+        super(`refusing to call the CybeDefend gateway: the origin of "${apiBase}" is not in the ` +
+            'trusted allowlist. Declare it in ~/.cybedefend/regions.json, which is the ' +
+            'documented escape hatch for an internal or local cluster.');
+        this.apiBase = apiBase;
+        this.name = 'UntrustedApiBaseError';
+    }
+}
+function assertTrustedApiBase(apiBase, opts) {
+    if (!isTrustedApiBase(apiBase, opts.trustDeps)) {
+        throw new UntrustedApiBaseError(apiBase);
+    }
+}
+/**
+ * Run `attempt(ctx.token)`. On a `401`, ask {@link McpApiOpts.resolveTokenFn}
+ * for a fresh token and retry EXACTLY ONCE with it, never a loop. If no
+ * fresher token is available, or the retry ALSO comes back `401`, the second
+ * response (or the first, if there was no retry) is returned as-is: the
+ * caller's own `!res.ok` handling turns it into a thrown error, same as any
+ * other non-2xx status.
+ */
+async function requestWithAuthRetry(ctx, opts, attempt) {
+    const res = await attempt(ctx.token);
+    if (res.status !== 401)
+        return res;
+    const resolveTokenFn = opts.resolveTokenFn ?? resolveTokenWithRefresh;
+    const refreshed = await resolveTokenFn(ctx.mcpName);
+    if (!refreshed)
+        return res;
+    return attempt(refreshed); // the ONE retry; its outcome is final either way
+}
+/** Split `items` into batches of at most `size`. Never yields an empty batch. */
+function chunk(items, size) {
+    if (items.length === 0)
+        return [];
+    if (items.length <= size)
+        return [items.slice()];
+    const batches = [];
+    for (let i = 0; i < items.length; i += size)
+        batches.push(items.slice(i, i + size));
+    return batches;
+}
+/**
+ * A silent split would be indistinguishable from a machine that never needed
+ * one, so the split is always declared, through `opts.onBatchSplit` rather
+ * than a direct write to `stderr`.
+ */
+function declareSplit(route, total, batches, cap, opts) {
+    opts.onBatchSplit?.(route, total, batches, cap);
+}
+async function parseJsonBody(res, label) {
+    try {
+        return await res.json();
+    }
+    catch {
+        throw new Error(`${label}: response body is not valid JSON`);
+    }
+}
+/**
+ * Unwrap the gateway's `{ success, data, message }` envelope down to `data`,
+ * and ONLY `data`. `body` and `body.data` are both rejected as insufficient.
+ */
+function unwrapEnvelope(body, label) {
+    if (!body || typeof body !== 'object') {
+        throw new Error(`${label}: response is not a JSON object`);
+    }
+    const root = body;
+    if (root.success !== true) {
+        throw new Error(`${label}: response missing \`success: true\``);
+    }
+    const data = root.data;
+    if (!data || typeof data !== 'object') {
+        throw new Error(`${label}: response missing \`data\``);
+    }
+    return data;
+}
+/** A named field that MUST be an array: `data.results` / `data.verdicts`. */
+function extractArray(data, field, label) {
+    const value = data[field];
+    if (!Array.isArray(value)) {
+        throw new Error(`${label}: response missing \`data.${field}\` array`);
+    }
+    return value;
+}
+/**
+ * `{ mode, strictIssuer }`, or a throw. Strict on purpose: a policy is what
+ * every action in the response was decided under, and a response without
+ * one is the deprecated envelope — reading it as this contract would decide
+ * on nothing. A mode out of vocabulary is refused rather than widened.
+ */
+function parseOrgPolicy(raw, label) {
+    const shape = raw && typeof raw === 'object' ? raw : undefined;
+    if (!shape || !isPolicyMode(shape.mode) || typeof shape.strictIssuer !== 'boolean') {
+        throw new Error(`${label}: response missing a readable \`policy\` ({ mode, strictIssuer })`);
+    }
+    return { mode: shape.mode, strictIssuer: shape.strictIssuer };
+}
+/**
+ * The action to execute, or `pending` when the backend sent none we can read.
+ * `pending` and not `allow`: an unreadable decision is no decision.
+ */
+function parseAction(raw) {
+    return isServerAction(raw) ? raw : 'pending';
+}
+/** The org-scoped path of a route. The id goes in the PATH, encoded. */
+function orgRoute(ctx, suffix) {
+    return `${ctx.apiBase}/mcp/organization/${encodeURIComponent(ctx.organizationId)}/${suffix}`;
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// POST /mcp/organization/:organizationId/servers/check
+// ═══════════════════════════════════════════════════════════════════════════
+const SERVERS_CHECK_LABEL = 'POST /mcp/organization/:organizationId/servers/check';
+function toMcpServerCheckInput(raw) {
+    const r = (raw ?? {});
+    return {
+        url: typeof r.url === 'string' ? r.url : undefined,
+        purl: typeof r.purl === 'string' ? r.purl : undefined,
+        serverKey: typeof r.serverKey === 'string' ? r.serverKey : undefined,
+    };
+}
+function toAdvisory(raw) {
+    const a = (raw ?? {});
+    return {
+        id: typeof a.id === 'string' ? a.id : '',
+        category: typeof a.category === 'string' ? a.category : '',
+        severity: typeof a.severity === 'string' ? a.severity : '',
+        summary: typeof a.summary === 'string' ? a.summary : '',
+        source: typeof a.source === 'string' ? a.source : '',
+    };
+}
+function toServerCheckResult(raw) {
+    const r = (raw ?? {});
+    const advisories = Array.isArray(r.advisories) ? r.advisories : [];
+    return {
+        input: toMcpServerCheckInput(r.input),
+        advisories: advisories.map(toAdvisory),
+        mirrored: Boolean(r.mirrored),
+        action: parseAction(r.action),
+        blockedBy: r.blockedBy === 'organization' ? 'organization' : null,
+    };
+}
+async function checkMcpServersOnce(ctx, servers, opts) {
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = orgRoute(ctx, 'servers/check');
+    const attempt = (token) => f(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ digestVersion: DIGEST_VERSION, servers }),
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        throw await backendError(res, 'servers/check', SERVERS_CHECK_LABEL);
+    }
+    const body = await parseJsonBody(res, SERVERS_CHECK_LABEL);
+    const data = unwrapEnvelope(body, SERVERS_CHECK_LABEL);
+    const policy = parseOrgPolicy(data.policy, SERVERS_CHECK_LABEL);
+    const results = extractArray(data, 'results', SERVERS_CHECK_LABEL);
+    return { policy, results: results.map(toServerCheckResult) };
+}
+/**
+ * Checks a list of MCP server coordinates against the backend's advisory
+ * lookup + registry mirror.
+ *
+ * The gateway refuses more than {@link MAX_SERVERS_PER_REQUEST} servers in a
+ * single request (`CheckMcpServersBodyDto`): larger inputs are split into
+ * sequential batches here and the split is declared through `onBatchSplit`.
+ */
+export async function checkMcpServers(ctx, servers, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    if (servers.length === 0)
+        return { policy: null, results: [] };
+    const batches = chunk(servers, MAX_SERVERS_PER_REQUEST);
+    if (batches.length > 1) {
+        declareSplit(SERVERS_CHECK_LABEL, servers.length, batches.length, MAX_SERVERS_PER_REQUEST, opts);
+    }
+    // One organization, one policy: every batch answers with the same one, and
+    // the last is as fresh as any.
+    let policy = null;
+    const results = [];
+    for (const batch of batches) {
+        const answer = await checkMcpServersOnce(ctx, batch, opts);
+        policy = answer.policy;
+        results.push(...answer.results);
+    }
+    return { policy, results };
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// POST /mcp/organization/:organizationId/tools/verify
+// ═══════════════════════════════════════════════════════════════════════════
+const TOOLS_VERIFY_LABEL = 'POST /mcp/organization/:organizationId/tools/verify';
+/**
+ * CLOSED vocabulary of the tool verdicts THIS client knows how to interpret.
+ *
+ * `verdict` stays typed `string` in {@link ToolVerdict}: the backend is free
+ * to emit a value this binary does not know, and that is precisely the case
+ * that must be NAMED rather than collapsed. The list below says what this
+ * client can DO, not what the backend is allowed to say.
+ */
+export const KNOWN_TOOL_VERDICTS = ['CLEAN', 'SUSPICIOUS', 'MALICIOUS'];
+/** `true` only for a verdict this binary knows how to interpret. */
+export function isKnownToolVerdict(verdict) {
+    return KNOWN_TOOL_VERDICTS.includes(verdict);
+}
+function toToolVerdict(raw) {
+    const v = (raw ?? {});
+    return {
+        digest: typeof v.digest === 'string' ? v.digest : '',
+        known: Boolean(v.known),
+        verdict: typeof v.verdict === 'string' ? v.verdict : '',
+        category: typeof v.category === 'string' ? v.category : '',
+        severity: typeof v.severity === 'string' ? v.severity : '',
+        reason: typeof v.reason === 'string' ? v.reason : '',
+        action: parseAction(v.action),
+    };
+}
+async function verifyMcpToolsOnce(ctx, tools, opts) {
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = orgRoute(ctx, 'tools/verify');
+    const attempt = (token) => f(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ digestVersion: DIGEST_VERSION, tools }),
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        throw await backendError(res, 'tools/verify', TOOLS_VERIFY_LABEL);
+    }
+    const body = await parseJsonBody(res, TOOLS_VERIFY_LABEL);
+    const data = unwrapEnvelope(body, TOOLS_VERIFY_LABEL);
+    const policy = parseOrgPolicy(data.policy, TOOLS_VERIFY_LABEL);
+    const verdicts = extractArray(data, 'verdicts', TOOLS_VERIFY_LABEL);
+    return { policy, verdicts: verdicts.map(toToolVerdict) };
+}
+/**
+ * Verifies a list of MCP tool submissions by digest, judging the ones that
+ * carry a `definition`.
+ *
+ * The gateway refuses more than {@link MAX_TOOLS_PER_REQUEST} tools in a
+ * single request (`VerifyToolsBodyDto`, `ArrayMaxSize(500)`): larger inputs
+ * are split into sequential batches here and the split is declared through
+ * `onBatchSplit`.
+ */
+export async function verifyMcpTools(ctx, submissions, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    if (submissions.length === 0)
+        return { policy: null, verdicts: [] };
+    const batches = chunk(submissions, MAX_TOOLS_PER_REQUEST);
+    if (batches.length > 1) {
+        declareSplit(TOOLS_VERIFY_LABEL, submissions.length, batches.length, MAX_TOOLS_PER_REQUEST, opts);
+    }
+    let policy = null;
+    const verdicts = [];
+    for (const batch of batches) {
+        const answer = await verifyMcpToolsOnce(ctx, batch, opts);
+        policy = answer.policy;
+        verdicts.push(...answer.verdicts);
+    }
+    return { policy, verdicts };
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// GET /mcp/organization/:organizationId/policy
+// ═══════════════════════════════════════════════════════════════════════════
+const POLICY_LABEL = 'GET /mcp/organization/:organizationId/policy';
+/**
+ * Reads the organization's policy on its own.
+ *
+ * Not needed to APPLY it — every verify/check response already carries the
+ * policy its actions were decided under — but it is how the policy is shown
+ * (`vibedefend status`, `vibedefend org`), how `connect` learns
+ * `strictIssuer` before any OAuth discovery, and how a verifier refreshes
+ * what it knows before a decision that only the cache will answer.
+ */
+export async function getOrgPolicy(ctx, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = orgRoute(ctx, 'policy');
+    const attempt = (token) => f(url, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        throw await backendError(res, 'policy', POLICY_LABEL);
+    }
+    const body = await parseJsonBody(res, POLICY_LABEL);
+    return parseOrgPolicy(unwrapEnvelope(body, POLICY_LABEL), POLICY_LABEL);
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// POST /mcp/organization/:organizationId/reports
+// ═══════════════════════════════════════════════════════════════════════════
+const REPORTS_LABEL = 'POST /mcp/organization/:organizationId/reports';
+/**
+ * Sends one call report (inventory + events). Answers 204.
+ *
+ * A refusal is a `GatewayHttpError`, never a `McpContractError`: a report the
+ * backend does not take (VibeDefend off, an older gateway) says nothing about
+ * the verification contract and must not be filed as one. The report buffer
+ * decides what to do with the status.
+ */
+export async function postMcpReport(ctx, body, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const url = orgRoute(ctx, 'reports');
+    const payload = JSON.stringify(body);
+    const attempt = (token) => f(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: payload,
+        signal: AbortSignal.timeout(opts.timeoutMs ?? REPORT_HTTP_TIMEOUT_MS),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        const retryAfterMs = parseRetryAfter(res.headers?.get('retry-after') ?? null);
+        throw new GatewayHttpError(res.status, `${REPORTS_LABEL} failed with HTTP ${res.status}`, {
+            retryAfterMs,
+        });
+    }
+}
+//# sourceMappingURL=api.js.map

package/dist/mcp/verify/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/mcp/verify/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAsB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAqC,MAAM,aAAa,CAAC;AAC9F,OAAO,EACL,gBAAgB,GAEjB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B;IACA;IAFX,YACW,KAAoB,EACpB,MAAc,EACvB,OAAgB;QAEhB,KAAK,CAAC,OAAO,IAAI,qCAAqC,KAAK,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAJjF,UAAK,GAAL,KAAK,CAAe;QACpB,WAAM,GAAN,MAAM,CAAQ;QAIvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,KAAoB,EAAE,MAAc,EAAE,OAAgB;QAChE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IAGtD;IACA;IAHX,YACE,KAAoB,EACX,IAAY,EACZ,SAAmB,EAC5B,OAAgB;QAEhB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAJlB,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAU;QAI5B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAgD,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7D,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC/E,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,KAAoB,EAAE,YAAoB;IACnF,MAAM,KAAK,GAAG,GAAG,YAAY,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC;IAC/D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE7F,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,SAAS,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,6BAA6B,CACtC,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,GAAG,KAAK,iDAAiD,cAAc,GAAG;YACxE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AA8C3C;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACzB;IAArB,YAAqB,OAAe;QAClC,KAAK,CACH,2DAA2D,OAAO,kBAAkB;YAClF,4EAA4E;YAC5E,2DAA2D,CAC9D,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAMlC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,IAAgB;IAC7D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAyC,EACzC,IAAgB,EAChB,OAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,CAAC;IAE3B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,KAAK,CAAI,KAAmB,EAAE,IAAY;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,OAAe,EAAE,GAAW,EAAE,IAAgB;IAChG,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,KAAa;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAa,EAAE,KAAa;IAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAA6B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,KAAK,UAAU,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mEAAmE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,GAAkD,EAAE,MAAc;IAClF,OAAO,GAAG,GAAG,CAAC,OAAO,qBAAqB,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,EAAE,CAAC;AAC/F,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,sDAAsD,CAAC;AA6CnF,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACrD,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACxC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;KAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAc,EACd,OAAuC,EACvC,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAChE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAc,EACd,OAAuC,EACvC,OAAmB,EAAE;IAErB,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACnG,CAAC;IAED,2EAA2E;IAC3E,+BAA+B;IAC/B,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AAqBjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAGjF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAyBD,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,GAAc,EACd,KAAwC,EACxC,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAc,EACd,WAA8C,EAC9C,OAAmB,EAAE;IAErB,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEpE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAc,EAAE,OAAmB,EAAE;IACtE,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpD,OAAO,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,aAAa,GAAG,gDAAgD,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc,EACd,IAAmB,EACnB,OAAmB,EAAE;IAErB,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;KACtE,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,aAAa,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE;YACxF,YAAY;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}