@filelayer/core 0.3.0

package/dist/simple.js

@@ -0,0 +1,492 @@
+/**
+ * PROGRESSIVE DISCLOSURE -- the tiered surface.
+ *
+ * This file exists to answer one question:
+ *
+ *   "A developer who only needs a public avatar should be able to use an
+ *    extremely simple version. A developer who needs a multi-tenant document
+ *    system should be able to turn on the advanced capabilities."
+ *
+ * WHAT THIS FILE IS
+ * -----------------
+ * A thin, additive facade over `Filelayer`. It provisions the concepts the
+ * developer did not ask for (a workspace, a service identity, a membership) so
+ * that the trivial case costs one line, and it names the concepts the developer
+ * DID ask for (an owner, an org, a role) so that the advanced case is reachable
+ * by adding an option rather than by rewriting.
+ *
+ * WHAT THIS FILE IS NOT
+ * ---------------------
+ * It contains **no authorization logic**. Every call below goes through the same
+ * `authz.ts` engine as the full API, with the same audit guarantee. Grep it: the
+ * only `if` statements are about which identifier to resolve, never about
+ * whether access is permitted.
+ *
+ * THE FOUR SECURITY PROPERTIES, AND HOW EACH SURVIVES THE ERGONOMICS
+ * -----------------------------------------------------------------
+ * P1 (deny by default, no public boolean).
+ *     `{ public: true }` does NOT set a flag. It creates an `anonymous` grant
+ *     row -- the same row `share({subject:{type:'anonymous'}})` creates -- which
+ *     is explicit, listable, revocable and audited. `unpublish()` revokes it.
+ *     There is still no `file.public` column and there never will be.
+ *
+ * P2 (no ambient authority).
+ *     Auto-provisioning creates IDENTITIES, never PERMISSIONS beyond the file
+ *     the caller is creating. A user auto-registered by `put({owner})` gets the
+ *     `member` role, and `member` + the default `private` visibility means they
+ *     can read exactly their own files and nothing else. Reads never
+ *     auto-provision: an unknown `as:` is a 404, not a silent downgrade to
+ *     anonymous. That last rule is the one that would have been easy to get
+ *     wrong and is tested explicitly.
+ *
+ * P3 (tenant isolation is structural).
+ *     Untouched. Every file still has a real `org_id`. The "no org" experience
+ *     is a DEFAULT org, not a NULL one -- see ARCHITECTURE-PROGRESSIVE.md for
+ *     the measurement showing that a nullable `org_id` silently disables the
+ *     composite foreign key that P3 rests on.
+ *
+ * P4 (a URL never outlives its permission).
+ *     The public URL is `/f/:id` served by our own delivery path, which
+ *     re-authorizes on every request. Revoke the anonymous grant and the URL is
+ *     dead on the next request. This is the property a public S3 bucket and
+ *     Supabase's `getPublicUrl` cannot offer at any price. It is ALSO the
+ *     property that CDN caching would weaken -- see `delivery.ts`, which
+ *     defaults to `no-store` for that reason.
+ */
+import { FilelayerError, } from "./filelayer.js";
+import { DEFAULT_PROJECT_ID } from "./store.js";
+/**
+ * The org every file lands in when the developer never mentioned an org.
+ *
+ * A reserved `external_id`, not a magic NULL. Tier 3 is reached by naming a
+ * different org, not by turning a boundary on.
+ */
+export const DEFAULT_WORKSPACE = '__filelayer_workspace__';
+/**
+ * The identity that owns files uploaded with no `owner:`.
+ *
+ * It is the `owner` of the default workspace (so tier 1 works with no user
+ * model at all) and a plain `member` of any org the developer names (so it does
+ * NOT acquire admin read over a real tenant's documents as a side effect of
+ * being used for an unowned upload).
+ */
+export const SYSTEM_ACTOR = '__filelayer_system__';
+// -----------------------------------------------------------------------------
+// Content sniffing
+// -----------------------------------------------------------------------------
+//
+// Deliberately a short, conservative list of formats with unambiguous magic
+// bytes. Everything else is `application/octet-stream`, which -- combined with
+// the `X-Content-Type-Options: nosniff` and sandbox CSP headers in delivery.ts
+// -- means an unrecognised upload is downloaded rather than executed. SVG is
+// absent on purpose: it has no reliable magic number and it is a script
+// execution context. Pass `contentType` explicitly if you need one.
+const MAGIC = [
+    [[0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a], 'image/png'],
+    [[0xff, 0xd8, 0xff], 'image/jpeg'],
+    [[0x47, 0x49, 0x46, 0x38], 'image/gif'],
+    [[0x25, 0x50, 0x44, 0x46], 'application/pdf'],
+];
+export function sniffContentType(body) {
+    for (const [sig, type] of MAGIC) {
+        if (sig.every((b, i) => body[i] === b))
+            return type;
+    }
+    // RIFF....WEBP
+    if (body[0] === 0x52 && body[1] === 0x49 && body[2] === 0x46 && body[3] === 0x46 &&
+        body[8] === 0x57 && body[9] === 0x45 && body[10] === 0x42 && body[11] === 0x50) {
+        return 'image/webp';
+    }
+    return 'application/octet-stream';
+}
+class Identities {
+    fl;
+    constructor(fl) {
+        this.fl = fl;
+    }
+    /** The project this facade resolves identities in. See P8 in schema.sql. */
+    get project() {
+        return this.fl.projectId ?? DEFAULT_PROJECT_ID;
+    }
+    /**
+     * Get-or-create an org by the customer's own id.
+     *
+     * `ON CONFLICT (project_id, external_id)` rather than a read-then-write, so
+     * two cold requests racing to publish the first avatar cannot produce a
+     * duplicate-key error in the developer's face.
+     *
+     * P8 (THE CUSTOMER'S ID SPACE IS THE CUSTOMER'S), AND THIS IS THE SHARPEST
+     * EDGE OF IT. When `external_id` was globally
+     * unique, this exact statement was a cross-tenant compromise: customer B
+     * calling `put({ org: 'acme' })` did not get an error, it got customer A's
+     * org id -- and `membership()` below then added B's user to A's tenant. The
+     * conflict target is now the (project, external_id) pair, so "acme" in one
+     * customer's application and "acme" in another are different rows that can
+     * never resolve to each other.
+     */
+    async org(externalId, opts = {}) {
+        const { rows } = await this.fl.store.db.query(`INSERT INTO org (project_id, external_id, name) VALUES ($3, $1, $2)
+         ON CONFLICT (project_id, external_id) DO UPDATE SET external_id = EXCLUDED.external_id
+       RETURNING id`, [externalId, opts.name ?? externalId, this.project]);
+        const id = rows[0].id;
+        if (opts.ownerActorId)
+            await this.membership(id, opts.ownerActorId, 'owner', true);
+        return id;
+    }
+    /**
+     * Get-or-create an identity by the customer's own id, within this project.
+     *
+     * FAILS CLOSED ON A DELETED IDENTITY. Auto-provisioning must never resurrect
+     * someone who has been deleted: `ON CONFLICT DO UPDATE` would otherwise hand
+     * back a soft-deleted actor's id, and the caller would go on to create a file
+     * owned by a person the system has been told no longer exists. Access would
+     * still be denied downstream (P7 kills their role and their grants), so the
+     * failure is fail-closed either way -- but silently owning rows to a deleted
+     * identity is a data-integrity mess, not a security decision we should be
+     * making by accident.
+     */
+    async actor(externalId) {
+        const { rows } = await this.fl.store.db.query(`INSERT INTO actor (project_id, external_id) VALUES ($2, $1)
+         ON CONFLICT (project_id, external_id) DO UPDATE SET external_id = EXCLUDED.external_id
+       RETURNING id, deleted_at`, [externalId, this.project]);
+        const row = rows[0];
+        if (row.deleted_at !== null) {
+            throw new FilelayerError(404, 'not_found', 'deleted_actor');
+        }
+        return row.id;
+    }
+    /** Read-only lookup. Returns null for an unknown id -- callers must fail closed. */
+    async findActor(externalId) {
+        const { rows } = await this.fl.store.db.query(`SELECT id FROM actor
+        WHERE external_id = $1 AND project_id = $2 AND deleted_at IS NULL`, [externalId, this.project]);
+        return rows[0]?.id ?? null;
+    }
+    /**
+     * Ensure a membership exists, WITHOUT ever downgrading an existing one.
+     *
+     * `DO NOTHING` and not `DO UPDATE`: auto-provisioning must never be able to
+     * demote an admin a developer deliberately promoted, nor promote a member.
+     * Deliberate role changes go through `orgs.setRole`, which is authorized.
+     */
+    async membership(orgId, actorId, role, bootstrap = false) {
+        const { rows } = await this.fl.store.db.query(`INSERT INTO membership (org_id, actor_id, role) VALUES ($1,$2,$3)
+         ON CONFLICT (org_id, actor_id) DO NOTHING
+       RETURNING true AS inserted`, [orgId, actorId, role]);
+        // P5: an identity acquiring standing in an org is a privilege change and is
+        // audited like any other, even though it was implicit.
+        if (rows.length > 0) {
+            await this.fl.store.audit({
+                orgId,
+                action: bootstrap ? 'member.bootstrap' : 'member.add',
+                decision: 'allow',
+                actorId,
+                fileId: null,
+                context: { targetActorId: actorId, toRole: role, via: 'auto_provision' },
+            });
+        }
+    }
+}
+// -----------------------------------------------------------------------------
+// files.*
+// -----------------------------------------------------------------------------
+export class FilesApi {
+    fl;
+    ids;
+    constructor(fl) {
+        this.fl = fl;
+        this.ids = new Identities(fl);
+    }
+    /**
+     * TIER 1: `put(bytes, { public: true })`      -> a URL, no other concepts.
+     * TIER 2: `put(bytes, { owner: userId })`     -> adds an owner.
+     * TIER 3: `put(bytes, { org, owner })`        -> adds a tenant.
+     * TIER 4: `+ expiresIn / retainFor / metadata`
+     */
+    async put(body, opts = {}) {
+        const contentType = opts.contentType ?? sniffContentType(body);
+        const name = opts.name ?? 'file';
+        // Resolve the tenant. Naming an org is what promotes you from tier 2 to
+        // tier 3; not naming one puts you in the default workspace, which is a real
+        // org with a real id, not a hole in the model.
+        const isDefaultWorkspace = opts.org === undefined;
+        const system = await this.ids.actor(SYSTEM_ACTOR);
+        const orgId = isDefaultWorkspace
+            ? await this.ids.org(DEFAULT_WORKSPACE, { name: 'workspace', ownerActorId: system })
+            : await this.ids.org(opts.org);
+        // Resolve the owner. `owner:` auto-registers, because the developer is
+        // asserting the identity exists in their system; we are not inventing it.
+        let ownerId;
+        if (opts.owner !== undefined) {
+            ownerId = await this.ids.actor(opts.owner);
+            await this.ids.membership(orgId, ownerId, 'member');
+        }
+        else {
+            ownerId = system;
+            // In a NAMED org the service identity is only a `member`, so an unowned
+            // upload into a customer tenant does not hand us admin read over that
+            // tenant's documents. In the default workspace it is the owner, because
+            // somebody has to be.
+            if (!isDefaultWorkspace)
+                await this.ids.membership(orgId, system, 'member');
+        }
+        // The uploader is a Principal, not a bare id: ownership is derived from the
+        // authorized identity, never supplied beside it. See the note on the
+        // signature of `upload()` in filelayer.ts.
+        const file = await this.fl.upload({ actorId: ownerId }, orgId, {
+            name,
+            contentType,
+            body,
+            ...(opts.visibility ? { visibility: opts.visibility } : {}),
+            ...(opts.expiresIn !== undefined ? { expiresIn: opts.expiresIn } : {}),
+            ...(opts.retainFor !== undefined ? { retainFor: opts.retainFor } : {}),
+            ...(opts.metadata ? { metadata: opts.metadata } : {}),
+        });
+        let url;
+        if (opts.public) {
+            // P1 intact: this is a grant row, not a flag. The uploader mints it, so
+            // it goes through `authorizeShare` and is audited as `grant.create`.
+            await this.fl.share({ actorId: ownerId }, file.id, { subject: { type: 'anonymous' } });
+            url = this.publicUrl(file.id);
+        }
+        return {
+            id: file.id,
+            name: file.name,
+            contentType: file.contentType,
+            size: file.sizeBytes ?? body.byteLength,
+            ...(url ? { url } : {}),
+        };
+    }
+    /**
+     * Read a file as a user (`{ as }`), or anonymously (no options).
+     *
+     * `headers` is carried through from the delivery layer so that the simple
+     * tier is exactly as safe as the full one. A tier-2 app that writes
+     * `res.writeHead(200, { 'content-type': f.contentType })` re-opens the
+     * stored-XSS path; `res.writeHead(200, f.headers)` does not.
+     */
+    async get(fileId, opts = {}) {
+        const principal = await this.principal(opts);
+        const { file, body, headers } = await this.fl.read(principal, fileId);
+        return { id: file.id, name: file.name, contentType: file.contentType, body, headers };
+    }
+    async delete(fileId, opts = {}) {
+        await this.fl.delete(await this.principal(opts), fileId);
+    }
+    /** Make an existing file publicly readable. Same grant row as `put({public:true})`. */
+    async publish(fileId, opts = {}) {
+        const principal = await this.principal(opts, { orSystem: true });
+        const g = await this.fl.share(principal, fileId, { subject: { type: 'anonymous' } });
+        return { url: this.publicUrl(fileId), grantId: g.grantId };
+    }
+    /**
+     * Withdraw public access. Revokes every live anonymous grant on the file.
+     *
+     * This is the operation a public bucket cannot perform: after it returns, a
+     * URL that has been printed, indexed and shared stops working on the very
+     * next request, because delivery re-authorizes every time.
+     */
+    async unpublish(fileId, opts = {}) {
+        const principal = await this.principal(opts, { orSystem: true });
+        const grants = await this.fl.listGrants(principal, fileId);
+        let revoked = 0;
+        for (const g of grants) {
+            if (g.subjectType !== 'anonymous' || !g.live)
+                continue;
+            await this.fl.revoke(principal, g.id);
+            revoked++;
+        }
+        return { revoked };
+    }
+    /**
+     * The delivery URL for a public file. Meaningless without an anonymous grant.
+     *
+     * IT ALWAYS BUILDS ON `/f`, so whatever serves it has to be mounted there.
+     * `deliveryHandler(fl)` is -- its `filePrefix` defaults to `/f`. But
+     * `fileDownloadRoute(fl, { principal })` mounted on its own defaults to a
+     * `prefix` of `/files`, and a URL from here would 404 against it. Either
+     * mount `deliveryHandler`, or pass `prefix: '/f'` to `fileDownloadRoute`.
+     */
+    publicUrl(fileId) {
+        return `${this.fl.baseUrl ?? ''}/f/${fileId}`;
+    }
+    /**
+     * Metadata only, no bytes, authorized identically to `get`.
+     *
+     * This used to call `read()` (fetching the whole object) and then
+     * `getFileRecord()` (unauthorized, and now private). It calls the authorized
+     * `stat()` instead, which means a metadata lookup no longer moves the bytes
+     * and -- since the cap counts bytes leaving (P6) -- no longer spends a
+     * download from a capped grant.
+     */
+    async stat(fileId, opts = {}) {
+        return this.fl.stat(await this.principal(opts), fileId);
+    }
+    /**
+     * External user id -> Principal.
+     *
+     * FAILS CLOSED. An `as:` we cannot resolve is 404, never a silent demotion to
+     * an anonymous principal -- which would turn a typo in a user id into a read
+     * of every public file, and, worse, would make the audit log attribute it to
+     * nobody.
+     */
+    async principal(opts, cfg = {}) {
+        if (opts.as === undefined) {
+            if (!cfg.orSystem)
+                return { actorId: null };
+            // publish/unpublish with no `as` is a server-side administrative action in
+            // the default workspace, performed by the service identity that owns it.
+            return { actorId: await this.ids.actor(SYSTEM_ACTOR) };
+        }
+        const actorId = await this.ids.findActor(opts.as);
+        if (!actorId)
+            throw new FilelayerError(404, 'not_found', 'unknown_actor');
+        return { actorId };
+    }
+}
+// -----------------------------------------------------------------------------
+// orgs.*  -- tier 3
+// -----------------------------------------------------------------------------
+export class OrgsApi {
+    fl;
+    ids;
+    constructor(fl) {
+        this.fl = fl;
+        this.ids = new Identities(fl);
+    }
+    /**
+     * Create a tenant with its first owner. Idempotent.
+     *
+     * The owner is created WITH the org for the same reason `createOrg` does it:
+     * there is never a memberless org for someone to walk into.
+     */
+    async create(externalId, opts) {
+        const ownerActorId = await this.ids.actor(opts.owner);
+        const id = await this.ids.org(externalId, {
+            ...(opts.name ? { name: opts.name } : {}),
+            ownerActorId,
+        });
+        return { id };
+    }
+    /**
+     * Add or change a member's role.
+     *
+     * `as` is REQUIRED and is not defaulted. Membership is the privilege that
+     * confers every other privilege; there is no convenience worth an unauthorized
+     * path to it. This is the one place where the tiered API is deliberately no
+     * shorter than the full API.
+     */
+    async setRole(org, user, role, opts) {
+        const { orgId, actorId, principal } = await this.trio(org, user, opts.as);
+        await this.fl.addMember(principal, orgId, actorId, role);
+    }
+    async removeMember(org, user, opts) {
+        const { orgId, actorId, principal } = await this.trio(org, user, opts.as);
+        await this.fl.removeMember(principal, orgId, actorId);
+    }
+    /** Audit trail for a tenant. Requires `read_audit`, i.e. admin or owner. */
+    async audit(org, opts) {
+        const orgId = await this.requireOrg(org);
+        const principal = await this.requirePrincipal(opts.as);
+        return this.fl.auditLog(principal, orgId, {
+            ...(opts.decision ? { decision: opts.decision } : {}),
+            ...(opts.limit ? { limit: opts.limit } : {}),
+        });
+    }
+    async verifyAudit(org, opts) {
+        const orgId = await this.requireOrg(org);
+        return this.fl.verifyAuditChain(await this.requirePrincipal(opts.as), orgId);
+    }
+    async trio(org, user, as) {
+        const orgId = await this.requireOrg(org);
+        const actorId = await this.ids.actor(user); // the TARGET may be new
+        const principal = await this.requirePrincipal(as); // the CALLER may not
+        return { orgId, actorId, principal };
+    }
+    async requireOrg(externalId) {
+        const { rows } = await this.fl.store.db.query(`SELECT o.id FROM org o
+         JOIN project p ON p.id = o.project_id
+        WHERE o.external_id = $1
+          AND o.project_id = $2
+          AND o.deleted_at IS NULL
+          AND p.deleted_at IS NULL`, [externalId, this.fl.projectId ?? DEFAULT_PROJECT_ID]);
+        if (!rows[0])
+            throw new FilelayerError(404, 'not_found', 'unknown_org');
+        return rows[0].id;
+    }
+    async requirePrincipal(as) {
+        const actorId = await this.ids.findActor(as);
+        if (!actorId)
+            throw new FilelayerError(404, 'not_found', 'unknown_actor');
+        return { actorId };
+    }
+}
+export class SharesApi {
+    fl;
+    ids;
+    constructor(fl) {
+        this.fl = fl;
+        this.ids = new Identities(fl);
+    }
+    async create(fileId, opts) {
+        const actorId = await this.ids.findActor(opts.as);
+        if (!actorId)
+            throw new FilelayerError(404, 'not_found', 'unknown_actor');
+        if (opts.withUser && opts.withOrg) {
+            throw new FilelayerError(400, 'ambiguous_subject', 'withUser_and_withOrg');
+        }
+        if (opts.minRole && !opts.withOrg) {
+            throw new FilelayerError(400, 'ambiguous_subject', 'minRole_without_withOrg');
+        }
+        const subject = opts.withUser
+            ? { type: 'actor', actorId: await this.ids.actor(opts.withUser) }
+            : opts.withOrg
+                ? // The subject org must ALREADY exist. `withOrg` is not a
+                    // get-or-create: auto-provisioning a tenant here would mean a typo in
+                    // an org name silently mints a grant to an empty organization that
+                    // anybody could later be added to, which is a permission granted to a
+                    // population nobody has audited. Unknown org is 404, like `as:`.
+                    opts.minRole
+                        ? { type: 'role', orgId: await this.requireOrgId(opts.withOrg), minRole: opts.minRole }
+                        : { type: 'org', orgId: await this.requireOrgId(opts.withOrg) }
+                : { type: 'link' };
+        return this.fl.share({ actorId }, fileId, {
+            subject,
+            ...(opts.capabilities ? { capabilities: opts.capabilities } : {}),
+            ...(opts.expiresIn !== undefined ? { expiresIn: opts.expiresIn } : {}),
+            ...(opts.maxDownloads !== undefined ? { maxDownloads: opts.maxDownloads } : {}),
+            ...(opts.password !== undefined ? { password: opts.password } : {}),
+        });
+    }
+    async revoke(grantId, opts) {
+        const actorId = await this.ids.findActor(opts.as);
+        if (!actorId)
+            throw new FilelayerError(404, 'not_found', 'unknown_actor');
+        return this.fl.revoke({ actorId }, grantId);
+    }
+    async list(fileId, opts) {
+        const actorId = await this.ids.findActor(opts.as);
+        if (!actorId)
+            throw new FilelayerError(404, 'not_found', 'unknown_actor');
+        return this.fl.listGrants({ actorId }, fileId);
+    }
+    /** Redeem a share link. No identity required -- the secret is the credential. */
+    async redeem(secret, opts = {}) {
+        return this.fl.redeem(secret, opts);
+    }
+    /**
+     * External org id -> internal id, within this project. Read-only and
+     * fail-closed, exactly like `Identities.findActor`.
+     */
+    async requireOrgId(externalId) {
+        const { rows } = await this.fl.store.db.query(`SELECT o.id FROM org o
+         JOIN project p ON p.id = o.project_id
+        WHERE o.external_id = $1
+          AND o.project_id = $2
+          AND o.deleted_at IS NULL
+          AND p.deleted_at IS NULL`, [externalId, this.fl.projectId ?? DEFAULT_PROJECT_ID]);
+        if (!rows[0])
+            throw new FilelayerError(404, 'not_found', 'unknown_org');
+        return rows[0].id;
+    }
+}
+//# sourceMappingURL=simple.js.map

package/dist/simple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple.js","sourceRoot":"","sources":["../src/simple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EACL,cAAc,GAIf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAoEnD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,oEAAoE;AAEpE,MAAM,KAAK,GAA8B;IACvC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IAC/D,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC;IAClC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,WAAW,CAAC;IACvC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC9C,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,eAAe;IACf,IACE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAC5E,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAC9E,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC;AASD,MAAM,UAAU;IACG,EAAE,CAAO;IAE1B,YAAY,EAAQ;QAClB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,4EAA4E;IAC5E,IAAY,OAAO;QACjB,OAAO,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB,EAAE,OAAiD,EAAE;QAC/E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAC3C;;oBAEc,EACd,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CACpD,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAC3C;;gCAE0B,EAC1B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAC3C;0EACoE,EACpE,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,OAAe,EAAE,IAAa,EAAE,SAAS,GAAG,KAAK;QAC/E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAC3C;;kCAE4B,EAC5B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CACvB,CAAC;QACF,4EAA4E;QAC5E,uDAAuD;QACvD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK;gBACL,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY;gBACrD,QAAQ,EAAE,OAAO;gBACjB,OAAO;gBACP,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,OAAO,QAAQ;IACF,EAAE,CAAO;IACT,GAAG,CAAa;IAEjC,YAAY,EAAQ;QAClB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAG,CAAC,IAAgB,EAAE,OAAmB,EAAE;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;QAEjC,wEAAwE;QACxE,4EAA4E;QAC5E,+CAA+C;QAC/C,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,kBAAkB;YAC9B,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACpF,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC;QAElC,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,OAAe,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,CAAC;YACjB,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,sBAAsB;YACtB,IAAI,CAAC,kBAAkB;gBAAE,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9E,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,2CAA2C;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE;YAC7D,IAAI;YACJ,WAAW;YACX,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,GAAuB,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACvF,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU;YACvC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAAiB,EAAE;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAiB,EAAE;QAC9C,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,OAAiB,EAAE;QAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,OAAiB,EAAE;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACvD,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,CAAC,MAAc;QACtB,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,MAAM,MAAM,EAAE,CAAC;IAChD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,OAAiB,EAAE;QAC5C,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,MAA8B,EAAE;QACtE,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC5C,2EAA2E;YAC3E,yEAAyE;YACzE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;CACF;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,OAAO,OAAO;IACD,EAAE,CAAO;IACT,GAAG,CAAa;IAEjC,YAAY,EAAQ;QAClB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,IAAsC;QACrE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE;YACxC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,YAAY;SACb,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,GAAW,EACX,IAAY,EACZ,IAAa,EACb,IAAoB;QAEpB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,IAAoB;QAChE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,KAAK,CACT,GAAW,EACX,IAAiE;QAEjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE;YACxC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,IAAoB;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;QACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB;QACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;QACxE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,UAAkB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAC3C;;;;;mCAK6B,EAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,kBAAkB,CAAC,CACtD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;CACF;AAoCD,MAAM,OAAO,SAAS;IACH,EAAE,CAAO;IACT,GAAG,CAAa;IAEjC,YAAY,EAAQ;QAClB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAkB;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC1E,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAiB,IAAI,CAAC,QAAQ;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACjE,CAAC,CAAC,IAAI,CAAC,OAAO;gBACZ,CAAC,CAAC,yDAAyD;oBACzD,sEAAsE;oBACtE,mEAAmE;oBACnE,sEAAsE;oBACtE,iEAAiE;oBACjE,IAAI,CAAC,OAAO;wBACZ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;wBACvF,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACjE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE;YACxC,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,IAAoB;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAoB;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAA2C,EAAE;QACxE,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAC3C;;;;;mCAK6B,EAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,IAAI,kBAAkB,CAAC,CACtD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpB,CAAC;CACF"}