@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/lib/linux-cgroups.js

@@ -0,0 +1,517 @@
+import { spawn } from 'node:child_process';
+import { readFile, lstat, mkdir, readdir, realpath, rmdir, statfs, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+import { setTimeout as pause } from 'node:timers/promises';
+import { linuxUserNamespaceProof, validateLinuxUserNamespaceWitness } from './linux-user-namespace.js';
+const UUID = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/u;
+const HEX = /^[a-f0-9]{32}$/u;
+const TICKS = /^[1-9][0-9]{0,63}$/u;
+const V1_MAGIC = 0x27e0eb;
+const V2_MAGIC = 0x63677270;
+const CONTROLLERS = ['cpu', 'memory', 'pids', 'freezer'];
+const PERIOD_US = 100_000;
+function fail(message) { throw new Error(`linux cgroup: ${message}`); }
+const uid = () => {
+    if (process.platform !== 'linux' || !['x64', 'arm64'].includes(process.arch)
+        || typeof process.getuid !== 'function' || process.getuid() === 0)
+        fail('non-root Linux x64/arm64 is required');
+    return process.getuid();
+};
+const positive = (value) => Number.isSafeInteger(value) && value > 0;
+const name = (jobId, nonce) => `job-${jobId}-${nonce}`;
+const keys = (value, expected) => Object.keys(value).sort().join() === [...expected].sort().join();
+function validateLimits(value) {
+    if (!value || !keys(value, ['memoryMiB', 'pidsLimit', 'cpus']) || !positive(value.memoryMiB)
+        || value.memoryMiB > 65_536 || !positive(value.pidsLimit) || value.pidsLimit > 4096
+        || !Number.isFinite(value.cpus) || value.cpus < 0.1 || value.cpus > 64
+        || !positive(Math.floor(value.cpus * PERIOD_US)))
+        fail('invalid resource limits');
+    return { ...value };
+}
+function rootEntries(value, owner) {
+    if (!value || value.mode !== 'v1' && value.mode !== 'v2')
+        fail('invalid cgroup mode');
+    if (value.mode === 'v1' && !keys(value, ['mode', ...CONTROLLERS])
+        || value.mode === 'v2' && !keys(value, ['mode', 'unified']))
+        fail('invalid controller roots');
+    const roots = value.mode === 'v1'
+        ? CONTROLLERS.map(controller => [controller, value[controller]]) : [['unified', value.unified]];
+    if (new Set(roots.map(([, root]) => root)).size !== roots.length)
+        fail('duplicate controller root');
+    for (const [controller, root] of roots) {
+        const expected = value.mode === 'v2' ? `/sys/fs/cgroup/dsh-native/uid-${owner}` : undefined;
+        if (typeof root !== 'string' || !isAbsolute(root) || resolve(root) !== root
+            || value.mode === 'v2' && root !== expected
+            || value.mode === 'v1' && !new RegExp(`^/sys/fs/cgroup/[A-Za-z0-9_,]+/dsh-native/uid-${owner}$`, 'u').test(root)
+            || controller.length === 0)
+            fail('unexpected delegated root');
+    }
+    return roots;
+}
+async function bootId() {
+    const value = (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim().toLowerCase();
+    if (!UUID.test(value))
+        fail('boot identity is unavailable');
+    return value;
+}
+async function root(path, owner, mode, controller) {
+    if (await realpath(path) !== path)
+        fail('delegated root is not canonical');
+    const item = await lstat(path);
+    if (!item.isDirectory() || item.isSymbolicLink() || item.uid !== owner || item.mode & 0o022)
+        fail('delegated root ownership differs');
+    if ((await statfs(path)).type !== (mode === 'v1' ? V1_MAGIC : V2_MAGIC))
+        fail('delegated root filesystem differs');
+    const mount = mode === 'v1' ? path.split('/').slice(0, 5).join('/') : '/sys/fs/cgroup';
+    const lines = (await readFile('/proc/self/mountinfo', 'utf8')).split('\n');
+    const matching = lines.filter(line => {
+        const [before, after] = line.split(' - ');
+        const fields = before?.split(' '), fs = after?.split(' ');
+        return fields?.[4] === mount && fs?.[0] === (mode === 'v1' ? 'cgroup' : 'cgroup2')
+            && (mode === 'v2' || fs?.[2]?.split(',').includes(controller));
+    });
+    if (matching.length !== 1)
+        fail('controller mount identity differs');
+}
+async function directory(path, expected, owner, mode) {
+    if (expected.path !== path || await realpath(path) !== path)
+        fail('job cgroup path changed');
+    const item = await lstat(path);
+    if (!item.isDirectory() || item.isSymbolicLink() || item.uid !== owner || item.dev !== expected.dev || item.ino !== expected.ino
+        || item.mode & 0o022 || (await statfs(path)).type !== (mode === 'v1' ? V1_MAGIC : V2_MAGIC))
+        fail('job cgroup identity changed');
+}
+async function number(path) {
+    const raw = (await readFile(path, 'utf8')).trim();
+    if (!/^[0-9]{1,18}$/u.test(raw))
+        fail('resource limit was not numeric');
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value))
+        fail('resource limit overflow');
+    return value;
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+async function writeAndVerify(path, expected) {
+    await writeFile(path, `${expected}\n`);
+    if (await number(path) !== expected)
+        fail('resource limit readback differs');
+}
+async function readProcesses(path) {
+    // cgroup.procs does not include descendants. A child cgroup would make an
+    // apparently empty parent unsafe to settle or delete.
+    for (const entry of await readdir(path, { withFileTypes: true })) {
+        if (entry.isDirectory() || entry.isSymbolicLink())
+            fail('nested or linked cgroup is not supported');
+    }
+    const content = await readFile(join(path, 'cgroup.procs'), 'utf8');
+    const values = content.trim() === '' ? [] : content.trim().split(/\s+/u).map(Number);
+    if (values.some(pid => !positive(pid)) || new Set(values).size !== values.length || values.length > 16_384)
+        fail('invalid cgroup process inventory');
+    return values;
+}
+async function processIdentity(pid) {
+    if (!positive(pid))
+        return undefined;
+    try {
+        const [raw, status] = await Promise.all([readFile(`/proc/${pid}/stat`, 'utf8'), readFile(`/proc/${pid}/status`, 'utf8')]);
+        const close = raw.lastIndexOf(') ');
+        const fields = close < 0 ? [] : raw.slice(close + 2).trim().split(/\s+/u);
+        const owner = /^Uid:\s+(\d+)/mu.exec(status);
+        const startTicks = fields[19];
+        if (!TICKS.test(startTicks ?? '') || !owner)
+            return undefined;
+        return { startTicks: startTicks, uid: Number(owner[1]), state: fields[0] };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+// Python's pidfd signal operation targets the opened process, even if a numeric PID is reused.
+// This fixed helper receives only PID/start-time/cgroup identity; no candidate code or shell is executed.
+const PIDFD_KILL = String.raw `import json,os,signal,sys
+data=json.loads(sys.argv[1]); expected=data['cgroup']; uid=data['uid']
+for pid,ticks in data['processes']:
+ try:
+  fd=os.pidfd_open(pid,0)
+  try:
+   raw=open('/proc/%d/stat'%pid).read(); fields=raw[raw.rfind(') ')+2:].split()
+   status=open('/proc/%d/status'%pid).read(); groups=open('/proc/%d/cgroup'%pid).read().splitlines()
+   if fields[19]!=ticks or int(status.split('Uid:')[1].split()[0])!=uid or not any(line.split(':',2)[1:]==expected for line in groups):
+    raise RuntimeError('process identity or cgroup differs')
+   signal.pidfd_send_signal(fd,signal.SIGKILL,None,0)
+  finally: os.close(fd)
+ except ProcessLookupError: pass
+`;
+const PIDFD_ADMIT = String.raw `import json,os,sys,time
+data=json.loads(sys.argv[1]); pid=data['pid']; ticks=data['ticks']; uid=data['uid']; boot=data['boot']
+fd=os.pidfd_open(pid,0)
+try:
+ def checked():
+  if open('/proc/sys/kernel/random/boot_id').read().strip().lower()!=boot: raise RuntimeError('boot changed')
+  if time.time()*1000>=data['deadline']: raise RuntimeError('admission deadline passed')
+  raw=open('/proc/%d/stat'%pid).read(); fields=raw[raw.rfind(') ')+2:].split()
+  status=open('/proc/%d/status'%pid).read()
+  if fields[19]!=ticks or fields[0]=='Z' or int(status.split('Uid:')[1].split()[0])!=uid: raise RuntimeError('process changed')
+ checked()
+ for path,kind,group in data['groups']:
+  with open(path+'/cgroup.procs','w') as out: out.write(str(pid)+'\n')
+  checked()
+  memberships=open('/proc/%d/cgroup'%pid).read().splitlines()
+  if not any(line.split(':',2)[1:]==[kind,group] for line in memberships): raise RuntimeError('cgroup admission differs')
+ checked()
+finally: os.close(fd)
+`;
+async function fixedPython(source, data) {
+    const output = await new Promise((resolvePromise, reject) => {
+        const child = spawn('/usr/bin/python3', ['-I', '-S', '-c', source, JSON.stringify(data)], { stdio: ['ignore', 'ignore', 'pipe'], env: { PATH: '/usr/bin:/bin', LANG: 'C', LC_ALL: 'C' }, shell: false });
+        let stderr = '';
+        const timer = setTimeout(() => child.kill('SIGKILL'), 3_000);
+        child.stderr.setEncoding('utf8');
+        child.stderr.on('data', (chunk) => { stderr = (stderr + chunk).slice(-4096); });
+        child.once('error', reject);
+        child.once('close', code => { clearTimeout(timer); resolvePromise({ code, stderr }); });
+    });
+    if (output.code !== 0)
+        fail(`pidfd operation was unproven: ${output.stderr.slice(-160)}`);
+}
+async function killWithPidfds(path, owner, mode, namespaceTermination) {
+    const processes = [];
+    for (const pid of await readProcesses(path)) {
+        const current = await processIdentity(pid);
+        if (!current)
+            continue;
+        if (current.state === 'Z' || !namespaceTermination && current.uid !== owner)
+            fail('cgroup contains an unexpected process');
+        processes.push([pid, current.startTicks]);
+    }
+    if (!processes.length)
+        return;
+    const relative = path.slice('/sys/fs/cgroup/'.length).split('/').slice(mode === 'v1' ? 1 : 0).join('/');
+    const membership = mode === 'v1' ? ['freezer', `/${relative}`] : ['', `/${relative}`];
+    if (namespaceTermination) {
+        if (mode !== 'v1')
+            fail('mapped repository termination requires verified v1 freezer');
+        await linuxUserNamespaceProof({ operation: 'kill', witness: namespaceTermination.witness,
+            outsideGates: namespaceTermination.outsideGate ? [namespaceTermination.outsideGate] : [],
+            cgroup: membership, freezerPath: path, processes });
+    }
+    else
+        await fixedPython(PIDFD_KILL, { uid: owner, cgroup: membership, processes });
+}
+/** Existing jobs are recovery-only: dispatch is never inferred from a cgroup directory.
+ * The Host must persist jobId/nonce and its dispatch intent before create(), and
+ * persist the returned snapshot before releasing a trusted process's start gate.
+ * This primitive does not supply that durable journal or discover orphan groups.
+ * One Host controller must own each resource set, including recovered leases.
+ */
+export class LinuxCgroupLease {
+    snapshot;
+    #allowAdmission;
+    #closing = false;
+    #operation = Promise.resolve();
+    #namespaceTermination;
+    constructor(snapshot, allowAdmission) {
+        this.snapshot = Object.freeze({ ...snapshot, limits: Object.freeze({ ...snapshot.limits }),
+            directories: Object.freeze(Object.fromEntries(Object.entries(snapshot.directories).map(([key, value]) => [key, Object.freeze({ ...value })]))) });
+        this.#allowAdmission = allowAdmission;
+        this.#closing = !allowAdmission;
+    }
+    static async create(input) {
+        const owner = uid(), roots = rootEntries(input.roots, owner), limits = validateLimits(input.limits);
+        if (!UUID.test(input.jobId) || !HEX.test(input.nonce) || !positive(input.deadline) || input.deadline <= Date.now())
+            fail('invalid job identity or deadline');
+        // Root directory ownership alone cannot authorize migration from an
+        // unrelated v2 subtree. Do not advertise an unverified placement fallback.
+        if (input.roots.mode === 'v2')
+            fail('cgroup v2 process placement is not yet verified');
+        const initialBoot = await bootId();
+        for (const [controller, path] of roots)
+            await root(path, owner, input.roots.mode, controller);
+        const directories = {};
+        try {
+            for (const [key, parent] of roots) {
+                const path = join(parent, name(input.jobId, input.nonce));
+                await mkdir(path, { mode: 0o700 });
+                const item = await lstat(path);
+                if (!item.isDirectory() || item.uid !== owner)
+                    fail('job cgroup was not created by owner');
+                directories[key] = { path, dev: item.dev, ino: item.ino };
+            }
+            const path = (key) => directories[key]?.path ?? fail('missing controller');
+            if (input.roots.mode === 'v1') {
+                await writeAndVerify(join(path('memory'), 'memory.limit_in_bytes'), limits.memoryMiB * 1024 * 1024);
+                // Swapping must not evade the memory cap. Kernels without memsw support are refused.
+                await writeAndVerify(join(path('memory'), 'memory.memsw.limit_in_bytes'), limits.memoryMiB * 1024 * 1024);
+                await writeAndVerify(join(path('pids'), 'pids.max'), limits.pidsLimit);
+                await writeAndVerify(join(path('cpu'), 'cpu.cfs_period_us'), PERIOD_US);
+                await writeAndVerify(join(path('cpu'), 'cpu.cfs_quota_us'), Math.floor(limits.cpus * PERIOD_US));
+                if ((await readFile(join(path('freezer'), 'freezer.state'), 'utf8')).trim() !== 'THAWED')
+                    fail('freezer is unavailable');
+            }
+            else {
+                await writeAndVerify(join(path('unified'), 'memory.max'), limits.memoryMiB * 1024 * 1024);
+                await writeAndVerify(join(path('unified'), 'memory.swap.max'), 0);
+                await writeAndVerify(join(path('unified'), 'pids.max'), limits.pidsLimit);
+                await writeFile(join(path('unified'), 'cpu.max'), `${Math.floor(limits.cpus * PERIOD_US)} ${PERIOD_US}\n`);
+                if ((await readFile(join(path('unified'), 'cpu.max'), 'utf8')).trim() !== `${Math.floor(limits.cpus * PERIOD_US)} ${PERIOD_US}`)
+                    fail('CPU quota readback differs');
+                if ((await readFile(join(path('unified'), 'cgroup.freeze'), 'utf8')).trim() !== '0')
+                    fail('freezer is unavailable');
+                await readFile(join(path('unified'), 'cgroup.kill'), 'utf8').catch(error => { if (error.code !== 'EINVAL')
+                    throw error; });
+            }
+            if (await bootId() !== initialBoot)
+                fail('boot changed during cgroup creation');
+            return new LinuxCgroupLease({ schemaVersion: 1, mode: input.roots.mode, bootId: initialBoot,
+                jobId: input.jobId, nonce: input.nonce, uid: owner, deadline: input.deadline, limits, directories }, true);
+        }
+        catch (error) {
+            // Only remove provably empty directories created by this invocation. A failed
+            // cleanup is part of the error; the caller must retain the unknown reservation.
+            const cleanup = [];
+            for (const value of Object.values(directories).reverse()) {
+                try {
+                    if ((await readProcesses(value.path)).length !== 0)
+                        throw new Error('nonempty cgroup');
+                    await rmdir(value.path);
+                }
+                catch (failure) {
+                    cleanup.push(failure);
+                }
+            }
+            if (cleanup.length)
+                throw new AggregateError([error, ...cleanup], 'linux cgroup preparation cleanup unproven');
+            throw error;
+        }
+    }
+    static async recover(snapshot, namespaceTermination) {
+        if (!snapshot || !keys(snapshot, ['schemaVersion', 'mode', 'bootId', 'jobId', 'nonce', 'uid', 'deadline', 'limits', 'directories'])
+            || snapshot.schemaVersion !== 1 || snapshot.uid !== uid() || !UUID.test(snapshot.bootId)
+            || !UUID.test(snapshot.jobId) || !HEX.test(snapshot.nonce) || !positive(snapshot.deadline))
+            fail('invalid recovery snapshot');
+        validateLimits(snapshot.limits);
+        const roots = snapshot.mode === 'v1'
+            ? Object.fromEntries(CONTROLLERS.map(key => [key, snapshot.directories[key]?.path.split('/').slice(0, -1).join('/')]))
+            : { unified: snapshot.directories.unified?.path.split('/').slice(0, -1).join('/') };
+        rootEntries({ mode: snapshot.mode, ...roots }, snapshot.uid);
+        const expected = snapshot.mode === 'v1' ? CONTROLLERS : ['unified'];
+        if (!keys(snapshot.directories, expected))
+            fail('recovery controller inventory differs');
+        const lease = new LinuxCgroupLease(snapshot, false);
+        if (namespaceTermination)
+            lease.bindUserNamespace(namespaceTermination);
+        await lease.#verify(true);
+        return lease;
+    }
+    /** Bind a Host-observed immutable anchor before releasing candidate START.
+     * Recovery receives the original witness from its versioned private journal. */
+    bindUserNamespace(value) {
+        if (!value || !keys(value, value.outsideGate ? ['witness', 'outsideGate'] : ['witness']))
+            fail('invalid namespace termination binding');
+        const witness = validateLinuxUserNamespaceWitness(value.witness);
+        if (this.snapshot.mode !== 'v1' || witness.bootId !== this.snapshot.bootId || witness.ownerUid !== this.snapshot.uid)
+            fail('namespace termination owner differs');
+        const gate = value.outsideGate;
+        if (gate && (!keys(gate, ['pid', 'startTicks', 'bootId', 'uid']) || !positive(gate.pid) || !TICKS.test(gate.startTicks)
+            || gate.bootId !== this.snapshot.bootId || gate.uid !== this.snapshot.uid))
+            fail('invalid original keeper gate');
+        const binding = Object.freeze({ witness, ...(gate ? { outsideGate: Object.freeze({ ...gate }) } : {}) });
+        if (this.#namespaceTermination && JSON.stringify(this.#namespaceTermination) !== JSON.stringify(binding))
+            fail('namespace termination binding changed');
+        this.#namespaceTermination = binding;
+    }
+    async #verify(allowMissing = false) {
+        if (await bootId() !== this.snapshot.bootId)
+            fail('job boot identity changed');
+        const roots = this.snapshot.mode === 'v1'
+            ? Object.fromEntries(CONTROLLERS.map(key => [key, this.snapshot.directories[key].path.split('/').slice(0, -1).join('/')]))
+            : { unified: this.snapshot.directories.unified.path.split('/').slice(0, -1).join('/') };
+        for (const [key, parent] of rootEntries({ mode: this.snapshot.mode, ...roots }, this.snapshot.uid)) {
+            await root(parent, this.snapshot.uid, this.snapshot.mode, key);
+            try {
+                await directory(join(parent, name(this.snapshot.jobId, this.snapshot.nonce)), this.snapshot.directories[key], this.snapshot.uid, this.snapshot.mode);
+            }
+            catch (error) {
+                if (!allowMissing || error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        const limits = this.snapshot.limits;
+        const path = (key) => this.snapshot.directories[key]?.path ?? fail('missing controller');
+        if (this.snapshot.mode === 'v1') {
+            if ((!allowMissing || await exists(path('memory'))) && (await number(join(path('memory'), 'memory.limit_in_bytes')) !== limits.memoryMiB * 1024 * 1024
+                || await number(join(path('memory'), 'memory.memsw.limit_in_bytes')) !== limits.memoryMiB * 1024 * 1024)
+                || (!allowMissing || await exists(path('pids'))) && await number(join(path('pids'), 'pids.max')) !== limits.pidsLimit
+                || (!allowMissing || await exists(path('cpu'))) && (await number(join(path('cpu'), 'cpu.cfs_period_us')) !== PERIOD_US
+                    || await number(join(path('cpu'), 'cpu.cfs_quota_us')) !== Math.floor(limits.cpus * PERIOD_US)))
+                fail('resource limits changed');
+        }
+        else if ((!allowMissing || await exists(path('unified'))) && (await number(join(path('unified'), 'memory.max')) !== limits.memoryMiB * 1024 * 1024
+            || await number(join(path('unified'), 'memory.swap.max')) !== 0
+            || await number(join(path('unified'), 'pids.max')) !== limits.pidsLimit
+            || (await readFile(join(path('unified'), 'cpu.max'), 'utf8')).trim() !== `${Math.floor(limits.cpus * PERIOD_US)} ${PERIOD_US}`))
+            fail('resource limits changed');
+    }
+    #serialize(operation) {
+        const result = this.#operation.then(operation);
+        // A failed operation must not strand cleanup behind a rejected queue.
+        this.#operation = result.then(() => { }, () => { });
+        return result;
+    }
+    #assertAdmissionOpen() {
+        if (this.#closing || Date.now() >= this.snapshot.deadline)
+            fail('job no longer admits a process');
+    }
+    async admit(identity) {
+        if (!this.#allowAdmission || this.#closing || Date.now() >= this.snapshot.deadline)
+            fail('job no longer admits a process');
+        if (!identity || !keys(identity, ['pid', 'startTicks', 'bootId', 'uid']) || !positive(identity.pid)
+            || !TICKS.test(identity.startTicks) || identity.uid !== this.snapshot.uid || identity.bootId !== this.snapshot.bootId)
+            fail('invalid process identity');
+        // Consume the one attempt synchronously. No second caller can enter while
+        // the first awaits identity or controller I/O; failures never reopen it.
+        this.#allowAdmission = false;
+        return this.#serialize(async () => {
+            try {
+                this.#assertAdmissionOpen();
+                await this.#verify();
+                this.#assertAdmissionOpen();
+                const current = await processIdentity(identity.pid);
+                this.#assertAdmissionOpen();
+                if (!current || current.uid !== this.snapshot.uid || current.startTicks !== identity.startTicks || current.state === 'Z')
+                    fail('process identity differs');
+                // The trusted supervisor stays behind its start gate until this promise
+                // resolves. pidfd detects death/reuse; cgroup.procs still accepts a PID,
+                // so the caller must retain and reap that blocked trusted process.
+                const groups = Object.entries(this.snapshot.directories).sort(([left], [right]) => {
+                    if (left === 'freezer')
+                        return -1;
+                    if (right === 'freezer')
+                        return 1;
+                    return left.localeCompare(right, 'en');
+                }).map(([, value]) => {
+                    const parts = value.path.slice('/sys/fs/cgroup/'.length).split('/');
+                    const relative = parts.slice(this.snapshot.mode === 'v1' ? 1 : 0).join('/');
+                    return [value.path, this.snapshot.mode === 'v1' ? parts[0] : '', `/${relative}`];
+                });
+                this.#assertAdmissionOpen();
+                await fixedPython(PIDFD_ADMIT, { pid: identity.pid, ticks: identity.startTicks, uid: identity.uid,
+                    boot: identity.bootId, deadline: this.snapshot.deadline, groups });
+                this.#assertAdmissionOpen();
+                const after = await processIdentity(identity.pid);
+                this.#assertAdmissionOpen();
+                if (!after || after.uid !== current.uid || after.startTicks !== current.startTicks || after.state === 'Z')
+                    fail('admitted process changed');
+                for (const value of Object.values(this.snapshot.directories)) {
+                    if (!(await readProcesses(value.path)).includes(identity.pid))
+                        fail('process escaped cgroup admission');
+                    this.#assertAdmissionOpen();
+                }
+                await this.#verify();
+                this.#assertAdmissionOpen();
+            }
+            catch (error) {
+                this.#closing = true;
+                throw error;
+            }
+        });
+    }
+    async observe() {
+        return this.#serialize(() => this.#observe());
+    }
+    async #observe() {
+        await this.#verify(this.#closing);
+        const processes = {};
+        for (const [key, value] of Object.entries(this.snapshot.directories)) {
+            processes[key] = this.#closing && !(await exists(value.path)) ? [] : await readProcesses(value.path);
+        }
+        return { quiescent: Object.values(processes).every(value => value.length === 0), processes };
+    }
+    async terminateAndProve(timeoutMs) {
+        if (!positive(timeoutMs) || timeoutMs > 30_000)
+            fail('invalid termination deadline');
+        // Fence admission before awaiting either the operation queue or the kernel.
+        this.#closing = true;
+        this.#allowAdmission = false;
+        const deadline = Date.now() + timeoutMs;
+        return this.#serialize(() => this.#terminateAndProve(deadline));
+    }
+    async #terminateAndProve(deadline) {
+        await this.#verify(true);
+        if ((await this.#observe()).quiescent)
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        if (this.snapshot.mode === 'v2') {
+            const path = this.snapshot.directories.unified.path;
+            if (!(await exists(path)))
+                return false;
+            await writeFile(join(path, 'cgroup.freeze'), '1\n');
+            while (Date.now() < deadline && !(await readFile(join(path, 'cgroup.events'), 'utf8')).includes('frozen 1'))
+                await pause(20);
+            if (!(await readFile(join(path, 'cgroup.events'), 'utf8')).includes('frozen 1'))
+                return false;
+            await writeFile(join(path, 'cgroup.kill'), '1\n');
+            await writeFile(join(path, 'cgroup.freeze'), '0\n');
+        }
+        else {
+            const freezer = this.snapshot.directories.freezer.path;
+            // A missing freezer with live processes elsewhere is ambiguous. Never
+            // turn a partial deletion into permission to signal unrelated processes.
+            if (!(await exists(freezer)))
+                return false;
+            await writeFile(join(freezer, 'freezer.state'), 'FROZEN\n');
+            while (Date.now() < deadline && (await readFile(join(freezer, 'freezer.state'), 'utf8')).trim() !== 'FROZEN')
+                await pause(20);
+            if ((await readFile(join(freezer, 'freezer.state'), 'utf8')).trim() !== 'FROZEN')
+                return false;
+            try {
+                await killWithPidfds(freezer, this.snapshot.uid, 'v1', this.#namespaceTermination);
+            }
+            finally {
+                await writeFile(join(freezer, 'freezer.state'), 'THAWED\n');
+            }
+        }
+        while (Date.now() < deadline) {
+            if ((await this.#observe()).quiescent)
+                return true;
+            await pause(20);
+        }
+        return (await this.#observe()).quiescent;
+    }
+    async removeWhenEmpty() {
+        this.#closing = true;
+        this.#allowAdmission = false;
+        return this.#serialize(() => this.#removeWhenEmpty());
+    }
+    async #removeWhenEmpty() {
+        if (!(await this.#observe()).quiescent)
+            return false;
+        await pause(20);
+        if (!(await this.#observe()).quiescent)
+            return false;
+        for (const value of Object.values(this.snapshot.directories).reverse()) {
+            if (await exists(value.path)) {
+                await directory(value.path, value, this.snapshot.uid, this.snapshot.mode);
+                await rmdir(value.path);
+            }
+        }
+        for (const value of Object.values(this.snapshot.directories))
+            if (await exists(value.path))
+                return false;
+        return true;
+    }
+}
+//# sourceMappingURL=linux-cgroups.js.map

package/lib/linux-cgroups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-cgroups.js","sourceRoot":"","sources":["../src/linux-cgroups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,uBAAuB,EAAE,iCAAiC,EAAkC,MAAM,2BAA2B,CAAA;AA0BtI,MAAM,IAAI,GAAG,gDAAgD,CAAA;AAC7D,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,KAAK,GAAG,qBAAqB,CAAA;AACnC,MAAM,QAAQ,GAAG,QAAQ,CAAA;AACzB,MAAM,QAAQ,GAAG,UAAU,CAAA;AAC3B,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AACjE,MAAM,SAAS,GAAG,OAAO,CAAA;AAEzB,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AACrF,MAAM,GAAG,GAAG,GAAW,EAAE;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;WACvE,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACjH,OAAO,OAAO,CAAC,MAAM,EAAE,CAAA;AACzB,CAAC,CAAA;AACD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;AACrF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE,CAAC,OAAO,KAAK,IAAI,KAAK,EAAE,CAAA;AAC9E,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;AAEtI,SAAS,cAAc,CAAC,KAAwB;IAC9C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;WACvF,KAAK,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI;WAChF,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;WACnE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACnF,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,KAAuB,EAAE,KAAa;IACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACrF,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC;WAC5D,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC/F,MAAM,KAAK,GAA4B,KAAK,CAAC,IAAI,KAAK,IAAI;QACxD,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IACjG,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACnG,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;eACtE,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ;eACxC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,iDAAiD,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;eAC7G,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC3D,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,KAAa,EAAE,IAA8B,EAAE,UAAkB;IACjG,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACrI,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAClH,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAA;IACtF,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACnC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACzD,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;eAC7E,CAAC,IAAI,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,QAA8B,EAAE,KAAa,EAAE,IAA8B;IAClH,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IAC5F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;WAC3H,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;AACpI,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACjE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IACtC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,QAAgB;IAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAA;IACtC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;AAC9E,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,0EAA0E;IAC1E,sDAAsD;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,IAAI,CAAC,0CAA0C,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACpJ,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;QACzH,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAA;QAC7D,OAAO,EAAE,UAAU,EAAE,UAAW,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,CAAA;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxE,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,0GAA0G;AAC1G,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;CAa5B,CAAA;AAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;CAkB7B,CAAA;AAED,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAA0C,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACnG,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EACtF,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAChH,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5D,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAChC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACtF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,IAA8B,EAAE,oBAAsD;IAC/I,MAAM,SAAS,GAA4B,EAAE,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK;YAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;QAC1H,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAM;IAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvG,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAA;IACrF,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,CAAC,4DAA4D,CAAC,CAAA;QACrF,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO;YACtF,YAAY,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACxF,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;;QAAM,MAAM,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAClB,QAAQ,CAAqB;IACtC,eAAe,CAAS;IACxB,QAAQ,GAAG,KAAK,CAAA;IAChB,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAC7C,qBAAqB,CAAkC;IACvD,YAAoB,QAA6B,EAAE,cAAuB;QACxE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnJ,IAAI,CAAC,eAAe,GAAG,cAAc,CAAA;QACrC,IAAI,CAAC,QAAQ,GAAG,CAAC,cAAc,CAAA;IACjC,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAA6G;QAC/H,MAAM,KAAK,GAAG,GAAG,EAAE,EAAE,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QAC5J,oEAAoE;QACpE,2EAA2E;QAC3E,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;QACtF,MAAM,WAAW,GAAG,MAAM,MAAM,EAAE,CAAA;QAClC,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,KAAK;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7F,MAAM,WAAW,GAAyC,EAAE,CAAA;QAC5D,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;gBACzD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK;oBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;gBAC1F,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3D,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,CAAA;YAC1F,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;gBACnG,qFAAqF;gBACrF,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;gBACzG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;gBACtE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,EAAE,SAAS,CAAC,CAAA;gBACvE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAA;gBAChG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;YAC1H,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAA;gBACzF,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAA;gBACjE,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,CAAA;gBAC1G,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,SAAS,EAAE;oBAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;gBACnK,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;gBACnH,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA,CAAC,CAAC,CAAC,CAAA;YACtJ,CAAC;YACD,IAAI,MAAM,MAAM,EAAE,KAAK,WAAW;gBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;YAC/E,OAAO,IAAI,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;gBACzF,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAA;QAC9G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8EAA8E;YAC9E,gFAAgF;YAChF,MAAM,OAAO,GAAc,EAAE,CAAA;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBACzD,IAAI,CAAC;oBAAC,IAAI,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAAC,CAAC;gBACvH,OAAO,OAAO,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAAC,CAAC;YAC3C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE,2CAA2C,CAAC,CAAA;YAC9G,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,oBAAsD;QACxG,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;eAC9H,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;eACrF,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC/H,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI;YAClC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtH,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QACrF,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,KAAK,EAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;QACxF,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACnD,IAAI,oBAAoB;YAAE,KAAK,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;QACvE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD;oFACgF;IAChF,iBAAiB,CAAC,KAAsC;QACtD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;QACvI,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG;YAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACjK,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAA;QAC9B,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;eAClH,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAClH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACxG,IAAI,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;QACvJ,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAA;IACtC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,YAAY,GAAG,KAAK;QAChC,IAAI,MAAM,MAAM,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YACvC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3H,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,KAAK,EAAsB,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YAC9D,IAAI,CAAC;gBAAC,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAC7J,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,YAAY,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA;YAAC,CAAC;QACxG,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAA;QACnC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACxG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI;mBACjJ,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;mBACrG,CAAC,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS;mBAClH,CAAC,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC,KAAK,SAAS;uBACnH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;gBAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;QACpI,CAAC;aAAM,IAAI,CAAC,CAAC,YAAY,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI;eAC/I,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC,KAAK,CAAC;eAC5D,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS;eACpE,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;YAAE,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACpK,CAAC;IACD,UAAU,CAAI,SAA2B;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9C,sEAAsE;QACtE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACjD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,oBAAoB;QAClB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACnG,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAA6B;QACvC,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;QAC1H,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;eAC9F,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACzJ,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAA;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC3B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;gBACpB,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC3B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnD,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG;oBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;gBAC1J,wEAAwE;gBACxE,yEAAyE;gBACzE,mEAAmE;gBACnE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;oBAChF,IAAI,IAAI,KAAK,SAAS;wBAAE,OAAO,CAAC,CAAC,CAAA;oBACjC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,CAAC,CAAA;oBACjC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;gBACxC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE;oBACnB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;oBACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC3E,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAA;gBAClF,CAAC,CAAC,CAAA;gBACF,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC3B,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG;oBAC/F,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBACpE,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC3B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACjD,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC3B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;oBAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;gBAC3I,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7D,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;oBACvG,IAAI,CAAC,oBAAoB,EAAE,CAAA;gBAC7B,CAAC;gBACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;gBACpB,IAAI,CAAC,oBAAoB,EAAE,CAAA;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAA;YAAC,CAAC;QACvD,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,SAAS,GAA6B,EAAE,CAAA;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACtG,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,CAAA;IAC9F,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,MAAM;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QACpF,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,eAAe,GAAG,KAAK,CAAA;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAClD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAQ,CAAC,IAAI,CAAA;YACpD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;YACvC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAA;YACnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;YAC5H,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC7F,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAA;YACjD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,CAAA;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAQ,CAAC,IAAI,CAAA;YACvD,sEAAsE;YACtE,yEAAyE;YACzE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC1C,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC,CAAA;YAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;YAC7H,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YAC9F,IAAI,CAAC;gBAAC,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;YAAC,CAAC;oBAClF,CAAC;gBAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC,CAAA;YAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAA;IAC1C,CAAC;IACD,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,eAAe,GAAG,KAAK,CAAA;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAA;QACpD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAA;QACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS;YAAE,OAAO,KAAK,CAAA;QACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACzE,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAA;QACxG,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}