@isahaq/kosh-server 0.0.0-stage → 0.1.0

package/dist/auth/service.js

@@ -0,0 +1,477 @@
+import { audit } from '../audit.js';
+import { HttpProblem } from '../errors.js';
+import { keepingAdministrator } from './admins.js';
+import { digest, hashPassword, newTotpSecret, otpauthUri, randomToken, verifyPassword, verifyTotp, } from './crypto.js';
+export const SESSION_COOKIE = 'kosh_session';
+const MIN_PASSWORD = 12;
+const model = (env, name) => env.model(name);
+/** Milliseconds of a datetime value as Shutro returns it (`Date`, or an ISO text), or `null`. */
+export function timeOf(value) {
+    if (value === null || value === undefined)
+        return null;
+    const ms = value instanceof Date ? value.getTime() : Date.parse(String(value));
+    return Number.isNaN(ms) ? null : ms;
+}
+const one = (rows) => rows[0];
+/** Loads `keys` (scalar fields) and returns plain rows. */
+async function fetch(records, keys) {
+    const set = await records;
+    return set.length === 0 ? [] : (await set.load(keys)).read(keys);
+}
+function unauthenticated(type, detail, hint = 'Sign in again.') {
+    return new HttpProblem(401, type, 'Not authenticated', detail, hint);
+}
+/** Reads `name` from the Cookie header. */
+export function cookieOf(request, name) {
+    for (const part of String(request.headers.cookie ?? '').split(';')) {
+        const [k, ...v] = part.trim().split('=');
+        if (k === name)
+            return decodeURIComponent(v.join('='));
+    }
+    return undefined;
+}
+const UNSAFE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** The authentication service of one server. */
+export class AuthService {
+    #shutro;
+    #options;
+    #cache = new Map();
+    #dummy = hashPassword(randomToken());
+    constructor(shutro, options = {}) {
+        this.#shutro = shutro;
+        this.#options = {
+            secureCookies: options.secureCookies ?? true,
+            idleMs: options.idleMs ?? 12 * 3_600_000,
+            lifetimeMs: options.lifetimeMs ?? 7 * 86_400_000,
+            cacheMs: options.cacheMs ?? 5_000,
+        };
+    }
+    #system(reason, fn) {
+        return this.#shutro().bootstrap({ reason: `auth: ${reason}` }, fn);
+    }
+    /** The `Set-Cookie` value for a session token (empty token: clears it). */
+    cookie(token) {
+        const parts = [
+            `${SESSION_COOKIE}=${token ?? ''}`,
+            'Path=/',
+            'HttpOnly',
+            'SameSite=Lax',
+            `Max-Age=${token === null ? 0 : Math.floor(this.#options.lifetimeMs / 1000)}`,
+        ];
+        if (this.#options.secureCookies)
+            parts.push('Secure');
+        return parts.join('; ');
+    }
+    /** Hashes and sets a user's password. @throws {HttpProblem} 422 for a too-short password */
+    async setPassword(env, user, password) {
+        if (password.length < MIN_PASSWORD)
+            throw new HttpProblem(422, 'weak-password', 'Weak password', `Passwords have at least ${MIN_PASSWORD} characters.`);
+        const hash = await hashPassword(password);
+        const existing = await model(env, 'auth.credential').search({ where: { user } });
+        if (existing.length === 0)
+            await model(env, 'auth.credential').create([{ user, passwordHash: hash }]);
+        else
+            await existing.write({ passwordHash: hash });
+    }
+    /** Creates a user with a password and group assignments (installation, tests, admin tools). */
+    async createUser(input) {
+        return this.#system(`create user ${input.login}`, async (env) => {
+            const created = await model(env, 'res.users').create([
+                {
+                    login: input.login,
+                    name: input.name,
+                    ...(input.company === undefined ? {} : { company: input.company }),
+                    ...(input.companies === undefined ? {} : { companies: { set: [...input.companies] } }),
+                },
+            ]);
+            const user = created.ids[0];
+            await this.setPassword(env, user, input.password);
+            const assignments = (input.groups ?? []).map((g) => typeof g === 'string' ? { user, group: g } : { user, group: g.group, company: g.company });
+            if (assignments.length > 0)
+                await model(env, 'auth.user_group').create(assignments);
+            return user;
+        });
+    }
+    /** Signs in: a new session (pending second factor when 2FA is on). @throws {HttpProblem} 401 */
+    async login(request, login, password) {
+        const outcome = await this.#system(`login ${login}`, async (env) => {
+            const user = one(await fetch(model(env, 'res.users').search({ where: { login } }), ['login']));
+            const credential = user === undefined
+                ? undefined
+                : one(await fetch(model(env, 'auth.credential').search({ where: { user: user['id'] } }), [
+                    'passwordHash',
+                    'totpEnabled',
+                ]));
+            const hash = typeof credential?.['passwordHash'] === 'string'
+                ? credential['passwordHash']
+                : await this.#dummy;
+            const ok = (await verifyPassword(password, hash)) && user !== undefined && credential !== undefined;
+            if (!ok)
+                return null;
+            const token = randomToken();
+            const csrfToken = randomToken(24);
+            const now = Date.now();
+            const twoFactorRequired = credential?.['totpEnabled'] === true;
+            await model(env, 'auth.session').create([
+                {
+                    tokenHash: digest(token),
+                    csrfHash: digest(csrfToken),
+                    user: user['id'],
+                    twoFactorVerified: !twoFactorRequired,
+                    expiresAt: new Date(now + this.#options.lifetimeMs),
+                    lastSeenAt: new Date(now),
+                    ip: request.ip,
+                    userAgent: String(request.headers['user-agent'] ?? '').slice(0, 300),
+                },
+            ]);
+            await audit(env, {
+                kind: 'auth.login',
+                summary: `${login} signed in${twoFactorRequired ? ' (second factor pending)' : ''}.`,
+                actor: user['id'],
+                company: null,
+                ip: request.ip,
+            });
+            return { token, csrfToken, twoFactorRequired };
+        });
+        if (outcome === null) {
+            // The failed attempt is audited in its own scope (the login scope stored nothing).
+            await this.#system(`failed login ${login}`, (env) => audit(env, {
+                kind: 'auth.login_failed',
+                summary: `Failed sign-in for ${login.slice(0, 100)}.`,
+                details: { login: login.slice(0, 100) },
+                ip: request.ip,
+            }));
+            throw unauthenticated('invalid-credentials', 'The login or password is wrong.', 'Check them and try again.');
+        }
+        return outcome;
+    }
+    /** The request's session, or `null`. Cookie sessions need the CSRF header on unsafe methods. */
+    async session(request) {
+        const header = String(request.headers.authorization ?? '');
+        const bearer = /^Bearer\s+(\S+)$/i.exec(header)?.[1];
+        const token = bearer ?? cookieOf(request, SESSION_COOKIE);
+        if (token === undefined || token === '')
+            return null;
+        const via = bearer === undefined ? 'cookie' : 'bearer';
+        const tokenHash = digest(token);
+        const cached = this.#cache.get(tokenHash);
+        let session = cached !== undefined && Date.now() - cached.at < this.#options.cacheMs
+            ? cached.session
+            : undefined;
+        if (session === undefined) {
+            const found = await this.#system('session', async (env) => {
+                const rows = await fetch(model(env, 'auth.session').search({ where: { tokenHash, revoked: false } }), ['user', 'twoFactorVerified', 'secondFactor', 'expiresAt', 'lastSeenAt', 'csrfHash']);
+                const row = one(rows);
+                if (row === undefined)
+                    return null;
+                const now = Date.now();
+                const lastSeen = new Date(String(row['lastSeenAt'])).getTime();
+                if (new Date(String(row['expiresAt'])).getTime() <= now ||
+                    lastSeen + this.#options.idleMs <= now)
+                    return null;
+                if (now - lastSeen > 5 * 60_000)
+                    await model(env, 'auth.session')
+                        .browse([row['id']])
+                        .write({ lastSeenAt: new Date(now) });
+                const active = (await model(env, 'res.users').search({ where: { id: row['user'] } })).length > 0; // archived users cannot sign in
+                return active ? row : null;
+            });
+            if (found === null) {
+                this.#cache.delete(tokenHash);
+                return null;
+            }
+            session = {
+                id: found['id'],
+                user: found['user'],
+                twoFactorRequired: found['twoFactorVerified'] !== true,
+                secondFactor: found['secondFactor'] === true,
+                via,
+                csrfHash: String(found['csrfHash']),
+            };
+            this.#cache.set(tokenHash, { at: Date.now(), session });
+        }
+        if (via === 'cookie' && UNSAFE.has(request.method)) {
+            const csrf = request.headers['x-csrf-token'];
+            if (typeof csrf !== 'string' || digest(csrf) !== session.csrfHash)
+                throw new HttpProblem(403, 'csrf', 'CSRF check failed', 'Cookie-authenticated requests that change data need the X-CSRF-Token header.', 'Send the csrfToken returned at sign-in.');
+        }
+        return {
+            id: session.id,
+            user: session.user,
+            twoFactorRequired: session.twoFactorRequired,
+            secondFactor: session.secondFactor,
+            via: session.via,
+        };
+    }
+    /** The verified session of a request. @throws {HttpProblem} 401 without one, or before the second factor */
+    async requireSession(request, options = {}) {
+        const session = await this.session(request);
+        if (session === null)
+            throw unauthenticated('unauthenticated', 'This route needs a signed-in user.', 'Sign in first.');
+        if (session.twoFactorRequired && options.allowPending !== true)
+            throw unauthenticated('two-factor-required', 'Enter the code from your authenticator app first.', 'POST /api/v1/auth/2fa/verify.');
+        return session;
+    }
+    /** Authenticator for the server (RFC 0002 §6.2): the session's user, company from `X-Company`, groups for it. */
+    async authenticate(request) {
+        const session = await this.session(request);
+        if (session === null)
+            return null;
+        if (session.twoFactorRequired)
+            throw unauthenticated('two-factor-required', 'Enter the code from your authenticator app first.', 'POST /api/v1/auth/2fa/verify.');
+        const info = await this.#identityOf(session.user);
+        if (info === null)
+            return null;
+        const asked = Number(request.headers['x-company']);
+        const company = Number.isSafeInteger(asked) && info.companies.includes(asked)
+            ? asked
+            : (info.company ?? info.companies[0]);
+        if (company === undefined)
+            throw new HttpProblem(403, 'no-company', 'No company', 'This user is not allowed in any company.', 'An administrator assigns the companies of the user.');
+        // Mandatory 2FA for administrators (RFC 0003 §5.2): their administrator groups count only in sessions that
+        // entered a second factor, while 2FA is on. The user keeps every other group.
+        const elevated = session.secondFactor && info.twoFactorEnabled;
+        const groups = info.assignments
+            .filter((a) => a.company === null || a.company === company)
+            .map((a) => a.group)
+            .filter((g) => elevated || !info.administratorGroups.has(g));
+        const now = Date.now();
+        const grants = info.grants
+            .filter((g) => (g.company === null || g.company === company) &&
+            (g.expiresAt === null || g.expiresAt > now))
+            .map((g) => g.grant);
+        return {
+            user: session.user,
+            company,
+            companies: info.companies,
+            groups: [...new Set(groups)],
+            grants: [...new Set(grants)],
+            lang: info.lang,
+            tz: info.tz,
+        };
+    }
+    /** Identity loader for Shutro (`createShutro({ identity })`): the user is active; companies and groups from the database. */
+    async verify(uid) {
+        const info = await this.#identityOf(uid);
+        if (info === null)
+            return null;
+        const now = Date.now();
+        return {
+            companies: info.companies,
+            groups: [...new Set(info.assignments.map((a) => a.group))],
+            grants: [
+                ...new Set(info.grants.filter((g) => g.expiresAt === null || g.expiresAt > now).map((g) => g.grant)),
+            ],
+        };
+    }
+    async #identityOf(uid) {
+        return this.#system('identity', async (env) => {
+            const users = await model(env, 'res.users').search({ where: { id: uid } });
+            if (users.length === 0)
+                return null; // unknown or archived
+            const loaded = await users.load(['company', 'lang', 'tz']);
+            const withCompanies = await loaded.load({ companies: true });
+            const [row] = withCompanies.read(['company', 'companies', 'lang', 'tz']);
+            const company = typeof row?.['company'] === 'number' ? row['company'] : null;
+            const companies = [
+                ...new Set([
+                    ...(row?.['companies'] ?? []),
+                    ...(company === null ? [] : [company]),
+                ]),
+            ];
+            const assignments = (await fetch(model(env, 'auth.user_group').search({ where: { user: uid } }), [
+                'group',
+                'company',
+            ])).map((a) => ({
+                group: String(a['group']),
+                company: typeof a['company'] === 'number' ? a['company'] : null,
+            }));
+            const grants = (await fetch(model(env, 'auth.user_grant').search({ where: { user: uid } }), [
+                'grant',
+                'company',
+                'expiresAt',
+            ])).map((g) => ({
+                grant: String(g['grant']),
+                company: typeof g['company'] === 'number' ? g['company'] : null,
+                expiresAt: timeOf(g['expiresAt']),
+            }));
+            const [credential] = await fetch(model(env, 'auth.credential').search({ where: { user: uid } }), ['totpEnabled']);
+            return {
+                company,
+                companies,
+                lang: String(row?.['lang'] ?? 'en_US'),
+                tz: String(row?.['tz'] ?? 'UTC'),
+                assignments,
+                grants,
+                administratorGroups: env.access.administratorGroups(),
+                twoFactorEnabled: credential?.['totpEnabled'] === true,
+            };
+        });
+    }
+    /** The signed-in user's state. */
+    async me(session) {
+        return this.#system('me', async (env) => {
+            const [user] = (await (await model(env, 'res.users').browse([session.user]).load(['login', 'name', 'company'])).load({ companies: true })).read(['login', 'name', 'company', 'companies']);
+            const [credential] = await fetch(model(env, 'auth.credential').search({ where: { user: session.user } }), ['totpEnabled']);
+            const administrator = await this.#holdsAdministrator(env, session.user);
+            const twoFactorEnabled = credential?.['totpEnabled'] === true;
+            return {
+                id: session.user,
+                login: String(user?.['login']),
+                name: String(user?.['name']),
+                company: typeof user?.['company'] === 'number' ? user['company'] : null,
+                companies: user?.['companies'] ?? [],
+                twoFactorEnabled,
+                administrator,
+                administratorNeedsSecondFactor: administrator && !(session.secondFactor && twoFactorEnabled),
+            };
+        });
+    }
+    /** Revokes a session. */
+    async logout(session) {
+        await this.#system('logout', async (env) => {
+            await model(env, 'auth.session').browse([session.id]).write({ revoked: true });
+            await audit(env, { kind: 'auth.logout', summary: 'Signed out.', actor: session.user });
+        });
+        this.#forgetUser(session.user, session.id);
+    }
+    #forgetUser(user, onlySession) {
+        for (const [hash, entry] of this.#cache)
+            if (entry.session.user === user &&
+                (onlySession === undefined || entry.session.id === onlySession))
+                this.#cache.delete(hash);
+    }
+    /** Starts 2FA enrolment: a new secret, not active until confirmed with a code. */
+    async setupTwoFactor(session) {
+        return this.#system('2fa setup', async (env) => {
+            const secret = newTotpSecret();
+            const [user] = (await model(env, 'res.users').browse([session.user]).load(['login'])).read([
+                'login',
+            ]);
+            const credentials = await model(env, 'auth.credential').search({
+                where: { user: session.user },
+            });
+            const [current] = await fetch(credentials, ['totpEnabled']);
+            if (current?.['totpEnabled'] === true)
+                throw new HttpProblem(409, 'two-factor-enabled', 'Already enabled', 'Two-factor authentication is already on.', 'Disable it first to enrol a new device.');
+            if (credentials.length === 0)
+                await model(env, 'auth.credential').create([{ user: session.user, totpSecret: secret }]);
+            else
+                await credentials.write({ totpSecret: secret });
+            return { secret, otpauthUri: otpauthUri(secret, String(user?.['login'])) };
+        });
+    }
+    /** Confirms enrolment with a code; returns ten recovery codes (shown once, stored as digests). */
+    async enableTwoFactor(session, code) {
+        return this.#system('2fa enable', async (env) => {
+            const credentials = await model(env, 'auth.credential').search({
+                where: { user: session.user },
+            });
+            const [row] = await fetch(credentials, ['totpSecret', 'totpEnabled']);
+            if (typeof row?.['totpSecret'] !== 'string' || row['totpEnabled'] === true)
+                throw new HttpProblem(409, 'two-factor-not-pending', 'Nothing to confirm', 'Start with POST /api/v1/auth/2fa/setup.');
+            if (!verifyTotp(row['totpSecret'], code))
+                throw new HttpProblem(422, 'invalid-code', 'Invalid code', 'The code does not match.', 'Use the current code of the authenticator app.');
+            const recoveryCodes = Array.from({ length: 10 }, () => randomToken(9));
+            await credentials.write({ totpEnabled: true, recoveryCodes: recoveryCodes.map(digest) });
+            // The code just entered is this session's second factor.
+            await model(env, 'auth.session').browse([session.id]).write({ secondFactor: true });
+            await audit(env, {
+                kind: 'auth.2fa_enabled',
+                summary: 'Two-factor authentication enabled.',
+                actor: session.user,
+            });
+            await this.#auditAdministratorSession(env, session.user);
+            return { recoveryCodes };
+        });
+    }
+    /** Completes a pending sign-in with a TOTP or recovery code (a recovery code works once). */
+    async verifyTwoFactor(session, code) {
+        await this.#system('2fa verify', async (env) => {
+            const credentials = await model(env, 'auth.credential').search({
+                where: { user: session.user },
+            });
+            const [row] = await fetch(credentials, ['totpSecret', 'totpEnabled', 'recoveryCodes']);
+            const secret = row?.['totpSecret'];
+            if (row?.['totpEnabled'] !== true || typeof secret !== 'string')
+                throw new HttpProblem(409, 'two-factor-off', 'Two-factor authentication is off', 'This account does not use a second factor.');
+            const recovery = row['recoveryCodes'] ?? [];
+            const used = recovery.indexOf(digest(code.trim()));
+            if (!verifyTotp(secret, code.trim()) && used < 0)
+                throw new HttpProblem(422, 'invalid-code', 'Invalid code', 'The code does not match.', 'Use the current code of the authenticator app, or a recovery code.');
+            if (used >= 0)
+                await credentials.write({ recoveryCodes: recovery.filter((_, i) => i !== used) });
+            await model(env, 'auth.session')
+                .browse([session.id])
+                .write({ twoFactorVerified: true, secondFactor: true });
+            await audit(env, {
+                kind: 'auth.2fa_verified',
+                summary: used >= 0
+                    ? 'Second factor: a recovery code (now used up).'
+                    : 'Second factor: authenticator code.',
+                actor: session.user,
+            });
+            await this.#auditAdministratorSession(env, session.user);
+        });
+        this.#forgetUser(session.user, session.id);
+    }
+    async #holdsAdministrator(env, user) {
+        const codes = [...env.access.administratorGroups()];
+        return (codes.length > 0 &&
+            (await model(env, 'auth.user_group').search({ where: { user, group: { in: codes } } }))
+                .length > 0);
+    }
+    /** Administrator sessions are audited when they start (when the second factor makes the user an administrator). */
+    async #auditAdministratorSession(env, user) {
+        if (await this.#holdsAdministrator(env, user))
+            await audit(env, {
+                kind: 'admin.session',
+                summary: 'Administrator session started.',
+                actor: user,
+            });
+    }
+    /** Turns 2FA off (password and a current code required). */
+    async disableTwoFactor(session, password, code) {
+        await this.#system('2fa disable', async (env) => {
+            const credentials = await model(env, 'auth.credential').search({
+                where: { user: session.user },
+            });
+            const [row] = await fetch(credentials, ['passwordHash', 'totpSecret', 'totpEnabled']);
+            const ok = typeof row?.['passwordHash'] === 'string' &&
+                (await verifyPassword(password, row['passwordHash'])) &&
+                typeof row['totpSecret'] === 'string' &&
+                verifyTotp(row['totpSecret'], code);
+            if (!ok)
+                throw new HttpProblem(422, 'invalid-credentials', 'Invalid credentials', 'The password or code is wrong.');
+            // Administrators need 2FA: turning it off for the last one is refused (credentials change only here).
+            await keepingAdministrator(env, () => credentials.write({ totpEnabled: false, totpSecret: null, recoveryCodes: null }));
+            await audit(env, {
+                kind: 'auth.2fa_disabled',
+                summary: 'Two-factor authentication disabled.',
+                actor: session.user,
+            });
+        });
+        this.#forgetUser(session.user);
+    }
+    /** Changes the password; every other session of the user is revoked. */
+    async changePassword(session, current, next) {
+        await this.#system('password change', async (env) => {
+            const [row] = await fetch(model(env, 'auth.credential').search({ where: { user: session.user } }), ['passwordHash']);
+            if (typeof row?.['passwordHash'] !== 'string' ||
+                !(await verifyPassword(current, row['passwordHash'])))
+                throw new HttpProblem(422, 'invalid-credentials', 'Invalid credentials', 'The current password is wrong.');
+            await this.setPassword(env, session.user, next);
+            const others = (await model(env, 'auth.session').search({ where: { user: session.user, revoked: false } })).ids.filter((id) => id !== session.id);
+            if (others.length > 0)
+                await model(env, 'auth.session').browse(others).write({ revoked: true });
+            await audit(env, {
+                kind: 'auth.password_changed',
+                summary: `Password changed; ${others.length} other session(s) revoked.`,
+                actor: session.user,
+            });
+        });
+        this.#forgetUser(session.user);
+        this.#cache.clear(); // other sessions of this user, cached by token
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,MAAM,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,UAAU,GACX,MAAM,aAAa,CAAC;AAsCrB,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAC7C,MAAM,YAAY,GAAG,EAAE,CAAC;AAexB,MAAM,KAAK,GAAG,CAAC,GAAQ,EAAE,IAAY,EAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAa,CAAmB,CAAC;AAC1F,iGAAiG;AACjG,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,EAAE,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,IAA+B,EAAuC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,2DAA2D;AAC3D,KAAK,UAAU,KAAK,CAClB,OAAmC,EACnC,IAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;IAC1B,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc,EAAE,IAAI,GAAG,gBAAgB;IAC5E,OAAO,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,QAAQ,CAAC,OAAuB,EAAE,IAAY;IAC5D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3D,gDAAgD;AAChD,MAAM,OAAO,WAAW;IACb,OAAO,CAAe;IACtB,QAAQ,CAAwB;IAChC,MAAM,GAAG,IAAI,GAAG,EAAuE,CAAC;IACxF,MAAM,GAAoB,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/D,YAAY,MAAoB,EAAE,OAAO,GAAgB,EAAE;QACzD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG;YACd,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,SAAS;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,UAAU;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;SAClC,CAAC;IACJ,CAAC;IAED,OAAO,CAAI,MAAc,EAAE,EAA4B;QACrD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,KAAoB;QACzB,MAAM,KAAK,GAAG;YACZ,GAAG,cAAc,IAAI,KAAK,IAAI,EAAE,EAAE;YAClC,QAAQ;YACR,UAAU;YACV,cAAc;YACd,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE;SAC9E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,WAAW,CAAC,GAAQ,EAAE,IAAY,EAAE,QAAgB;QACxD,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY;YAChC,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,eAAe,EACf,eAAe,EACf,2BAA2B,YAAY,cAAc,CACtD,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACvB,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;;YACxE,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,KAQhB;QACC,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC;gBACnD;oBACE,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;oBAClE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;iBACvF;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;YACtC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAC1F,CAAC;YACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,KAAK,CACT,OAAuB,EACvB,KAAa,EACb,QAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,IAAI,GAAG,GAAG,CACd,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAC7E,CAAC;YACF,MAAM,UAAU,GACd,IAAI,KAAK,SAAS;gBAChB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,GAAG,CACD,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE;oBACjF,cAAc;oBACd,aAAa;iBACd,CAAC,CACH,CAAC;YACR,MAAM,IAAI,GACR,OAAO,UAAU,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAC9C,CAAC,CAAE,UAAU,CAAC,cAAc,CAAY;gBACxC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,GACN,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,CAAC;YAC3F,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrB,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC;YAC/D,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC;gBACtC;oBACE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;oBACxB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAChB,iBAAiB,EAAE,CAAC,iBAAiB;oBACrC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACnD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;oBACzB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACrE;aACF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,GAAG,KAAK,aAAa,iBAAiB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,GAAG;gBACpF,KAAK,EAAE,IAAI,CAAC,IAAI,CAAW;gBAC3B,OAAO,EAAE,IAAI;gBACb,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,mFAAmF;YACnF,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,KAAK,CAAC,GAAG,EAAE;gBACT,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,sBAAsB,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG;gBACrD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gBACvC,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,CAAC,CACH,CAAC;YACF,MAAM,eAAe,CACnB,qBAAqB,EACrB,iCAAiC,EACjC,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,GACT,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpE,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACxD,MAAM,IAAI,GAAG,MAAM,KAAK,CACtB,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,EAC3E,CAAC,MAAM,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CACrF,CAAC;gBACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,GAAG,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC/D,IACE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG;oBACnD,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAEtC,OAAO,IAAI,CAAC;gBACd,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC,GAAG,MAAM;oBAC7B,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;yBAC7B,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CAAC;yBAC7B,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1C,MAAM,MAAM,GACV,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,gCAAgC;gBACrH,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG;gBACR,EAAE,EAAE,KAAK,CAAC,IAAI,CAAW;gBACzB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAW;gBAC7B,iBAAiB,EAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK,IAAI;gBACtD,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,IAAI;gBAC5C,GAAG;gBACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;aACpC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ;gBAC/D,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,MAAM,EACN,mBAAmB,EACnB,8EAA8E,EAC9E,yCAAyC,CAC1C,CAAC;QACN,CAAC;QACD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC;IACJ,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,cAAc,CAClB,OAAuB,EACvB,OAAO,GAAwC,EAAE;QAEjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAClB,MAAM,eAAe,CACnB,iBAAiB,EACjB,oCAAoC,EACpC,gBAAgB,CACjB,CAAC;QACJ,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI;YAC5D,MAAM,eAAe,CACnB,qBAAqB,EACrB,mDAAmD,EACnD,+BAA+B,CAChC,CAAC;QACJ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,YAAY,CAAC,OAAuB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,OAAO,CAAC,iBAAiB;YAC3B,MAAM,eAAe,CACnB,qBAAqB,EACrB,mDAAmD,EACnD,+BAA+B,CAChC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC3D,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,SAAS;YACvB,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,YAAY,EACZ,YAAY,EACZ,0CAA0C,EAC1C,qDAAqD,CACtD,CAAC;QACJ,2GAA2G;QAC3G,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;aACvB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;YAC7C,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAC9C;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,6HAA6H;IAC7H,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,MAAM,EAAE;gBACN,GAAG,IAAI,GAAG,CACR,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CACzF;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAU3B,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;YAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,MAAM,SAAS,GAAG;gBAChB,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,CAAE,GAAG,EAAE,CAAC,WAAW,CAA0B,IAAI,EAAE,CAAC;oBACvD,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;iBACvC,CAAC;aACH,CAAC;YACF,MAAM,WAAW,GAAG,CAClB,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE;gBAC1E,OAAO;gBACP,SAAS;aACV,CAAC,CACH,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACZ,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACzB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,IAAI;aAC5E,CAAC,CAAC,CAAC;YACJ,MAAM,MAAM,GAAG,CACb,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE;gBAC1E,OAAO;gBACP,SAAS;gBACT,WAAW;aACZ,CAAC,CACH,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACZ,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACzB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;aAClC,CAAC,CAAC,CAAC;YACJ,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,KAAK,CAC9B,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAC9D,CAAC,aAAa,CAAC,CAChB,CAAC;YACF,OAAO;gBACL,OAAO;gBACP,SAAS;gBACT,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC;gBACtC,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;gBAChC,WAAW;gBACX,MAAM;gBACN,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE;gBACrD,gBAAgB,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI;aACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,EAAE,CAAC,OAAoB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,CAAC,IAAI,CAAC,GAAG,CACb,MAAM,CACJ,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CACxF,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAC5B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,KAAK,CAC9B,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EACvE,CAAC,aAAa,CAAC,CAChB,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,UAAU,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC;YAC9D,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,IAAI;gBAChB,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC5B,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,IAAI;gBACnF,SAAS,EAAG,IAAI,EAAE,CAAC,WAAW,CAA0B,IAAI,EAAE;gBAC9D,gBAAgB;gBAChB,aAAa;gBACb,8BAA8B,EAC5B,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;aAC/D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,MAAM,CAAC,OAAoB;QAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACzC,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,WAAW,CAAC,IAAY,EAAE,WAAoB;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YACrC,IACE,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI;gBAC3B,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,WAAW,CAAC;gBAE/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,cAAc,CAAC,OAAoB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzF,OAAO;aACR,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI;gBACnC,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,oBAAoB,EACpB,iBAAiB,EACjB,0CAA0C,EAC1C,yCAAyC,CAC1C,CAAC;YACJ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC1B,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;;gBACtF,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,eAAe,CAAC,OAAoB,EAAE,IAAY;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;YACtE,IAAI,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI;gBACxE,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,wBAAwB,EACxB,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;gBACtC,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,cAAc,EACd,cAAc,EACd,0BAA0B,EAC1B,gDAAgD,CACjD,CAAC;YACJ,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzF,yDAAyD;YACzD,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,oCAAoC;gBAC7C,KAAK,EAAE,OAAO,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,eAAe,CAAC,OAAoB,EAAE,IAAY;QACtD,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;YACnC,IAAI,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAC7D,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,gBAAgB,EAChB,kCAAkC,EAClC,4CAA4C,CAC7C,CAAC;YACJ,MAAM,QAAQ,GAAI,GAAG,CAAC,eAAe,CAAqB,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;gBAC9C,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,cAAc,EACd,cAAc,EACd,0BAA0B,EAC1B,oEAAoE,CACrE,CAAC;YACJ,IAAI,IAAI,IAAI,CAAC;gBACX,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;iBAC7B,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;iBACpB,KAAK,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,IAAI,IAAI,CAAC;oBACP,CAAC,CAAC,+CAA+C;oBACjD,CAAC,CAAC,oCAAoC;gBAC1C,KAAK,EAAE,OAAO,CAAC,IAAI;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAQ,EAAE,IAAY;QAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACpD,OAAO,CACL,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;iBACpF,MAAM,GAAG,CAAC,CACd,CAAC;IACJ,CAAC;IAED,mHAAmH;IACnH,KAAK,CAAC,0BAA0B,CAAC,GAAQ,EAAE,IAAY;QACrD,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC;YAC3C,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,gCAAgC;gBACzC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;IACP,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,gBAAgB,CAAC,OAAoB,EAAE,QAAgB,EAAE,IAAY;QACzE,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBAC7D,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;YACtF,MAAM,EAAE,GACN,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ;gBACzC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;gBACrC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE;gBACL,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,CACjC,CAAC;YACJ,sGAAsG;YACtG,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,CACnC,WAAW,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CACjF,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,OAAO,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,cAAc,CAAC,OAAoB,EAAE,OAAe,EAAE,IAAY;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CACvB,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EACvE,CAAC,cAAc,CAAC,CACjB,CAAC;YACF,IACE,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,QAAQ;gBACzC,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBAErD,MAAM,IAAI,WAAW,CACnB,GAAG,EACH,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,CACjC,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,CACb,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAC3F,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBACnB,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,GAAG,EAAE;gBACf,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,qBAAqB,MAAM,CAAC,MAAM,4BAA4B;gBACvE,KAAK,EAAE,OAAO,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,+CAA+C;IACtE,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,21 @@
+/** A server set up wrongly (modules, options). The message says what and how to fix it. */
+export declare class ServerConfigError extends Error {
+    readonly hint: string;
+    constructor(problem: string, hint: string);
+}
+/** An RFC 9457 problem document. */
+export interface Problem {
+    readonly type: string;
+    readonly title: string;
+    readonly status: number;
+    readonly detail: string;
+    readonly hint?: string;
+}
+/** A request the server refuses before it reaches the ORM (authentication, headers). */
+export declare class HttpProblem extends Error {
+    readonly problem: Problem;
+    constructor(status: number, type: string, title: string, detail: string, hint?: string);
+}
+/** The problem document for any error; unknown errors are 500 without internals (they are logged instead). */
+export declare function problemOf(error: unknown): Problem;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAMA,2FAA2F;AAC3F,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAIxC;CACF;AAED,oCAAoC;AACpC,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wFAAwF;AACxF,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,YAAY,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAUrF;CACF;AAiBD,8GAA8G;AAC9G,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiCjD"}

package/dist/errors.js

@@ -0,0 +1,78 @@
+/**
+ * Server errors and their HTTP form: RFC 9457 problem details with stable `type` codes (RFC 0002 §6.4). Shutro's typed
+ * errors map to statuses here; the full mapping grows with the generated endpoints (step 3).
+ */
+import { orm } from './orm.js';
+/** A server set up wrongly (modules, options). The message says what and how to fix it. */
+export class ServerConfigError extends Error {
+    hint;
+    constructor(problem, hint) {
+        super(`${problem} ${hint}`);
+        this.name = 'ServerConfigError';
+        this.hint = hint;
+    }
+}
+/** A request the server refuses before it reaches the ORM (authentication, headers). */
+export class HttpProblem extends Error {
+    problem;
+    constructor(status, type, title, detail, hint) {
+        super(detail);
+        this.name = 'HttpProblem';
+        this.problem = {
+            type: `https://kosh.dev/problems/${type}`,
+            title,
+            status,
+            detail,
+            ...(hint === undefined ? {} : { hint }),
+        };
+    }
+}
+const SHUTRO_STATUS = {
+    ACCESS: 403,
+    MISSING_RECORD: 404,
+    STALE_RECORD: 412,
+    VALIDATION: 422,
+    CONSTRAINT: 422,
+    CONSTRAINT_VIOLATION: 422,
+    INVALID_DOMAIN: 400,
+    INVALID_IDENTITY: 400,
+    COMPANY_NOT_ALLOWED: 403,
+    CONCURRENT_UPDATE: 409,
+    INVALID_TRANSITION: 409,
+    TRANSITION_GUARD: 409,
+};
+/** The problem document for any error; unknown errors are 500 without internals (they are logged instead). */
+export function problemOf(error) {
+    if (error instanceof HttpProblem)
+        return error.problem;
+    if (error instanceof orm.ShutroError) {
+        const status = SHUTRO_STATUS[error.code] ?? 500;
+        if (status !== 500)
+            return {
+                type: `https://kosh.dev/problems/${error.code.toLowerCase().replaceAll('_', '-')}`,
+                title: error.name,
+                status,
+                detail: error.message,
+                hint: error.hint,
+            };
+    }
+    const fastify = error;
+    if (typeof fastify.statusCode === 'number' &&
+        fastify.statusCode >= 400 &&
+        fastify.statusCode < 500)
+        return {
+            type: `https://kosh.dev/problems/${String(fastify.code ?? 'bad-request')
+                .toLowerCase()
+                .replaceAll('_', '-')}`,
+            title: 'Bad request',
+            status: fastify.statusCode,
+            detail: String(fastify.message ?? 'The request is invalid.'),
+        };
+    return {
+        type: 'https://kosh.dev/problems/internal',
+        title: 'Internal error',
+        status: 500,
+        detail: 'The server failed to handle the request; the error is logged with the request id.',
+    };
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,2FAA2F;AAC3F,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAWD,wFAAwF;AACxF,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,OAAO,CAAU;IAC1B,YAAY,MAAc,EAAE,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,IAAa;QACpF,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG;YACb,IAAI,EAAE,6BAA6B,IAAI,EAAE;YACzC,KAAK;YACL,MAAM;YACN,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC;CACF;AAED,MAAM,aAAa,GAAqC;IACtD,MAAM,EAAE,GAAG;IACX,cAAc,EAAE,GAAG;IACnB,YAAY,EAAE,GAAG;IACjB,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,GAAG;IACf,oBAAoB,EAAE,GAAG;IACzB,cAAc,EAAE,GAAG;IACnB,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,GAAG;IACtB,kBAAkB,EAAE,GAAG;IACvB,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAEF,8GAA8G;AAC9G,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACvD,IAAI,KAAK,YAAY,GAAG,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAChD,IAAI,MAAM,KAAK,GAAG;YAChB,OAAO;gBACL,IAAI,EAAE,6BAA6B,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;gBAClF,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM;gBACN,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;IACN,CAAC;IACD,MAAM,OAAO,GAAG,KAAoE,CAAC;IACrF,IACE,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;QACtC,OAAO,CAAC,UAAU,IAAI,GAAG;QACzB,OAAO,CAAC,UAAU,GAAG,GAAG;QAExB,OAAO;YACL,IAAI,EAAE,6BAA6B,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;iBACrE,WAAW,EAAE;iBACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;YACzB,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,OAAO,CAAC,UAAU;YAC1B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,yBAAyB,CAAC;SAC7D,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,oCAAoC;QAC1C,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,mFAAmF;KAC5F,CAAC;AACJ,CAAC"}