@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/sharing/access/access-policy.service.js

@@ -0,0 +1,515 @@
+"use strict";
+// =============================================================================
+// AccessPolicy: can(principal, action, resource) (issue #729, PP-7.2)
+// =============================================================================
+//
+// THE ONE DECISION POINT for the app-policy layer above row-level security
+// (spec, "Tenancy and access model", Enforcement: "App policy"): owner, group
+// owner, grant and organization-default rules inside ONE organization. RLS
+// confines every query to the caller's active organization; this decides
+// which of that organization's records the caller may act on.
+//
+// THE DECISION ORDER (tested as a matrix in access-policy.service.spec.ts; the
+// access rules of ./access-rules.ts join at steps 6 and 8):
+//
+//   1. Unknown resource type or action: a PROGRAMMING error (500), not a 404.
+//   2. The record is missing, or in another organization: deny. RLS already
+//      hides other organizations; the check is defence in depth.
+//   3. A required `actionPermissions[action]` the caller lacks: deny, EVEN FOR
+//      THE OWNER. An RBAC failure, so `require()` answers 403 naming the
+//      permission (kvox's `assertWritePermission`), whatever `denyAs` says.
+//   4. A held `bypassPermissions[action]` (or `sharing:admin` for `share`):
+//      allow, `via: 'bypass'`.
+//   5. Owner: role `owner`.
+//   6. App access rules `before-grants`: ANY deny ends it (deny); an allow
+//      offers its role. Not consulted for the record's user owner or a bypass
+//      holder (decided at steps 4 and 5).
+//   7. Member of the owning group: the role `groupRoleMap` gives their group
+//      role; then the strongest ACTIVE, UNEXPIRED grant of every PERSISTED
+//      grantee kind (user, group, ...) that names the caller.
+//   8. App access rules `after-grants` (same contract as step 6).
+//   9. `defaultVisibility: 'org'`: `orgRole`.
+//  10. Otherwise deny.
+//
+// The effective role is the MAXIMUM over the offers of steps 5 to 9 (ties: the
+// earlier step names `via`), compared with `actions[action]`. A rule that
+// fails counts as a deny.
+//
+// BATCHED: `decideMany` reads the owners of a whole batch with ONE
+// `loadOwners` call per resource type and every relevant grant with ONE
+// query, in one transaction scoped to the caller's active organization.
+//
+// MEMOISED PER REQUEST, NEVER ACROSS REQUESTS: decisions are cached on the
+// principal object of one request (the authentication guard builds a new one
+// for every request), so a revoked grant stops working on the very next
+// request with no cache to invalidate.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessPolicy = exports.ACCESS_POLICY_CLOCK = void 0;
+exports.resourceKey = resourceKey;
+exports.accessDenial = accessDenial;
+const common_1 = require("@nestjs/common");
+const api_1 = require("@opentelemetry/api");
+const index_1 = require("../../otel-core/index");
+const sharing_tx_1 = require("../data/sharing-tx");
+const errors_1 = require("../errors");
+const metrics_1 = require("../metrics");
+const permissions_1 = require("../permissions");
+const ports_1 = require("../ports");
+const principal_groups_provider_1 = require("../principal-groups.provider");
+const access_rules_1 = require("./access-rules");
+const grantee_kinds_1 = require("./grantee-kinds");
+const resource_types_1 = require("./resource-types");
+/**
+ * Optional injection token of the policy's clock (ms since epoch); tests
+ * inject one to move expiries.
+ *
+ * @stability experimental
+ */
+exports.ACCESS_POLICY_CLOCK = Symbol.for('@marinoscar/platform/sharing/ACCESS_POLICY_CLOCK');
+/** The memo key of one decision. */
+function memoKey(action, ref) {
+    return `${action ?? '\u0000role'}\u0000${ref.type}\u0000${ref.id}`;
+}
+/**
+ * The map key `decideMany` returns a decision under: `${type}:${id}`.
+ *
+ * @param ref - the record.
+ * @returns the key.
+ *
+ * @stability stable
+ */
+function resourceKey(ref) {
+    return `${ref.type}:${ref.id}`;
+}
+const DENIED = Object.freeze({ allowed: false, role: null, via: null });
+/** A denial because an access rule failed (counted as outcome `rule_error`). */
+const DENIED_RULE_FAILURE = Object.freeze({ allowed: false, role: null, via: null, ruleFailure: true });
+/**
+ * Decides what a principal may do with a record of a registered resource
+ * type. Inject it (the module exports it); never cache a decision beyond the
+ * request.
+ *
+ * @example
+ * ```ts
+ * constructor(private readonly access: AccessPolicy) {}
+ * async get(principal: Principal, id: string) {
+ *   await this.access.require(principal, 'read', { type: 'transcript', id });
+ *   // ... load and return it
+ * }
+ * ```
+ *
+ * @extensionPoint token
+ * @stability stable
+ */
+let AccessPolicy = class AccessPolicy {
+    data;
+    principalGroups;
+    metrics;
+    now;
+    /** Per-request memo: the principal object of one request, mapped to its decisions. */
+    memo = new WeakMap();
+    constructor(data, principalGroups, metrics, now = Date.now) {
+        this.data = data;
+        this.principalGroups = principalGroups;
+        this.metrics = metrics;
+        this.now = now;
+    }
+    /**
+     * Whether `principal` may perform `action` on `ref`.
+     *
+     * @param principal - the caller.
+     * @param action - one of the type's actions (`read`, `write`, `share`, ...).
+     * @param ref - the record.
+     * @returns `true` when allowed.
+     * @throws Error for an unknown resource type or action (a programming error).
+     */
+    async can(principal, action, ref) {
+        return (await this.decide(principal, action, ref)).allowed;
+    }
+    /**
+     * The full decision for one record.
+     *
+     * @param principal - the caller.
+     * @param action - one of the type's actions.
+     * @param ref - the record.
+     * @returns allowed, the effective role and what decided it.
+     * @throws Error for an unknown resource type or action.
+     */
+    async decide(principal, action, ref) {
+        return (await this.decideMany(principal, action, [ref])).get(resourceKey(ref));
+    }
+    /**
+     * The decision, or the HTTP refusal: `404` with the same body as a missing
+     * record for a `denyAs: 'not_found'` type (the default), `403` for a
+     * `'forbidden'` type, and `403` naming the permission when a required
+     * `actionPermissions` entry is missing (step 3). Never leaks which.
+     *
+     * @param principal - the caller.
+     * @param action - one of the type's actions.
+     * @param ref - the record.
+     * @returns the (allowed) decision.
+     * @throws NotFoundException or ForbiddenException on a denial.
+     */
+    async require(principal, action, ref) {
+        const decision = await this.decide(principal, action, ref);
+        if (!decision.allowed)
+            throw denial((0, resource_types_1.requireResourceType)(ref.type), decision);
+        return decision;
+    }
+    /**
+     * The caller's effective role on `ref` (steps 2 and 5 to 8; permissions
+     * and bypasses are about actions, so they do not apply), or `null`.
+     *
+     * @param principal - the caller.
+     * @param ref - the record.
+     * @returns `'owner'`, one of the type's roles, or `null`.
+     */
+    async roleFor(principal, ref) {
+        const decisions = await this.evaluateMemoised(principal, null, [ref]);
+        return decisions.get(resourceKey(ref)).role;
+    }
+    /**
+     * The decisions for a batch: ONE owner query per resource type and ONE
+     * grant query for the whole batch, in one org-scoped transaction.
+     *
+     * @param principal - the caller.
+     * @param action - one action, applied to every record.
+     * @param refs - the records (any mix of registered types).
+     * @returns a decision per record, keyed by {@link resourceKey} (`type:id`).
+     * @throws Error for an unknown resource type or action.
+     */
+    async decideMany(principal, action, refs) {
+        const span = api_1.trace.getActiveSpan();
+        span?.setAttribute('sharing.batch_size', refs.length);
+        if (principal.activeOrgId)
+            span?.setAttribute('org.id', principal.activeOrgId);
+        return this.evaluateMemoised(principal, action, refs);
+    }
+    /**
+     * {@link decideMany} inside a transaction the caller already holds (scoped
+     * to the principal's active organization), so a service that checks and
+     * then writes does both in one transaction. Not memoised.
+     *
+     * @param tx - the org-scoped transaction client.
+     * @param principal - the caller.
+     * @param action - one action.
+     * @param refs - the records.
+     * @returns a decision per record, keyed by {@link resourceKey}.
+     */
+    async decideManyIn(tx, principal, action, refs) {
+        const groups = await this.groupsOf(principal);
+        return this.evaluate(tx, principal, groups, action, refs);
+    }
+    /**
+     * {@link require} inside a transaction the caller already holds. Not memoised.
+     *
+     * @param tx - the org-scoped transaction client.
+     * @param principal - the caller.
+     * @param action - one action.
+     * @param ref - the record.
+     * @returns the (allowed) decision.
+     * @throws NotFoundException or ForbiddenException on a denial.
+     */
+    async requireIn(tx, principal, action, ref) {
+        const decision = (await this.decideManyIn(tx, principal, action, [ref])).get(resourceKey(ref));
+        if (!decision.allowed)
+            throw denial((0, resource_types_1.requireResourceType)(ref.type), decision);
+        return decision;
+    }
+    // ---- internals ----------------------------------------------------------------
+    /** The caller's groups in its active organization: the enriched list, else the provider's. */
+    async groupsOf(principal) {
+        const org = principal.activeOrgId;
+        if (!org)
+            return [];
+        const groups = principal.groups ?? (await this.principalGroups.groupsFor(principal));
+        return groups.filter((group) => group.orgId === org);
+    }
+    async evaluateMemoised(principal, action, refs) {
+        validate(action, refs);
+        let memo = this.memo.get(principal);
+        if (!memo) {
+            memo = new Map();
+            this.memo.set(principal, memo);
+        }
+        const misses = [];
+        const seen = new Set();
+        for (const ref of refs) {
+            const key = memoKey(action, ref);
+            if (memo.has(key) || seen.has(key))
+                continue;
+            seen.add(key);
+            misses.push(ref);
+        }
+        if (misses.length > 0) {
+            const batch = (async () => {
+                const groups = await this.groupsOf(principal);
+                const orgId = principal.activeOrgId;
+                if (!orgId)
+                    return new Map(misses.map((ref) => [resourceKey(ref), DENIED]));
+                return this.data.runInOrg({ orgId, userId: principal.userId }, (tx) => this.evaluate(tx, principal, groups, action, misses));
+            })();
+            for (const ref of misses) {
+                const one = batch.then((decisions) => decisions.get(resourceKey(ref)));
+                one.catch(() => undefined); // awaited below; never an unhandled rejection
+                memo.set(memoKey(action, ref), one);
+            }
+            // A failed batch is not remembered: the next call retries it.
+            batch.catch(() => {
+                for (const ref of misses)
+                    memo.delete(memoKey(action, ref));
+            });
+        }
+        const out = new Map();
+        for (const ref of refs)
+            out.set(resourceKey(ref), await memo.get(memoKey(action, ref)));
+        return out;
+    }
+    /** Steps 2 to 9 for a batch, inside `rawTx`. */
+    async evaluate(rawTx, principal, groups, action, refs) {
+        validate(action, refs);
+        const out = new Map();
+        const orgId = principal.activeOrgId;
+        if (!orgId) {
+            for (const ref of refs)
+                out.set(resourceKey(ref), DENIED);
+            return out;
+        }
+        const tx = (0, sharing_tx_1.asSharingTx)(rawTx);
+        // Owners: one loadOwners call per type.
+        const byType = new Map();
+        for (const ref of refs) {
+            const ids = byType.get(ref.type) ?? [];
+            if (!ids.includes(ref.id))
+                ids.push(ref.id);
+            byType.set(ref.type, ids);
+        }
+        const owners = new Map();
+        for (const [type, ids] of byType) {
+            const rt = (0, resource_types_1.requireResourceType)(type);
+            const found = await rt.def.loadOwners(ids, rawTx);
+            for (const [id, info] of found)
+                owners.set(`${type}:${id}`, info);
+        }
+        // Grants: one query for every record that exists in this organization.
+        const subject = (0, grantee_kinds_1.withGroups)(principal, groups);
+        const groupRole = new Map(groups.map((group) => [group.groupId, group.role]));
+        const present = [...byType].map(([type, ids]) => [type, ids.filter((id) => owners.get(`${type}:${id}`)?.orgId === orgId)]);
+        const wanted = present.filter(([, ids]) => ids.length > 0);
+        const grants = new Map();
+        const grantees = (0, grantee_kinds_1.persistedGranteeKinds)().flatMap((def) => {
+            const where = (0, grantee_kinds_1.granteeWhereFor)(def, subject);
+            return where === null ? [] : [where];
+        });
+        if (wanted.length > 0 && grantees.length > 0) {
+            const rows = await tx.grant.findMany({
+                where: {
+                    orgId,
+                    revokedAt: null,
+                    AND: [
+                        { OR: wanted.map(([type, ids]) => ({ resourceType: type, resourceId: { in: ids } })) },
+                        { OR: [{ expiresAt: null }, { expiresAt: { gt: new Date(this.now()) } }] },
+                        { OR: grantees },
+                    ],
+                },
+                select: { resourceType: true, resourceId: true, granteeKind: true, granteeUserId: true, granteeGroupId: true, granteeRef: true, role: true },
+            });
+            for (const row of rows) {
+                const key = `${row.resourceType}:${row.resourceId}`;
+                grants.set(key, [...(grants.get(key) ?? []), row]);
+            }
+        }
+        // One cache per call: a rule loads what it needs for the whole batch once.
+        const cache = new Map();
+        // A statement that fails inside a rule aborts the shared transaction; a savepoint lets the
+        // rule's failure be a deny of that record instead of poisoning every later query.
+        const rulesApply = refs.some((ref) => (0, access_rules_1.accessRulesFor)(ref.type).length > 0);
+        if (rulesApply)
+            await tx.$executeRaw `SAVEPOINT sharing_access_rules`;
+        const recover = async () => {
+            await tx.$executeRaw `ROLLBACK TO SAVEPOINT sharing_access_rules`;
+        };
+        for (const ref of refs) {
+            const key = resourceKey(ref);
+            const rt = (0, resource_types_1.requireResourceType)(ref.type);
+            const info = owners.get(key);
+            const rules = await this.rulesFor(rt, subject, orgId, action, ref, info, rawTx, cache, recover);
+            const decision = decideOne(rt, subject, orgId, groupRole, action, info, grants.get(key) ?? [], rules);
+            out.set(key, decision);
+            if (action !== null)
+                this.count(rt.type, decision);
+        }
+        if (rulesApply) {
+            try {
+                await tx.$executeRaw `RELEASE SAVEPOINT sharing_access_rules`;
+            }
+            catch {
+                // The transaction is already unusable; the caller's next statement reports it.
+            }
+        }
+        return out;
+    }
+    /** The rules' verdicts for one record, or none when the caller is decided before the rules (steps 2 to 5). */
+    rulesFor(rt, principal, orgId, action, ref, info, tx, cache, recover) {
+        if (!info || info.orgId !== orgId || (0, access_rules_1.accessRulesFor)(rt.type).length === 0 || decidedBeforeRules(rt, principal, action, info)) {
+            return Promise.resolve(access_rules_1.NO_RULE_OUTCOME);
+        }
+        return (0, access_rules_1.evaluateAccessRules)(rt, {
+            principal,
+            action,
+            resource: { type: ref.type, id: ref.id, orgId: info.orgId, owner: info.owner },
+            tx,
+            cache,
+            recover,
+        });
+    }
+    count(type, decision) {
+        try {
+            this.metrics?.add(metrics_1.SHARING_ACCESS_DECISIONS_METRIC, 1, {
+                resource_type: type,
+                outcome: decision.allowed ? 'allowed' : decision.ruleFailure ? 'rule_error' : 'denied',
+                via: decision.via === null ? 'none' : metrics_1.SHARING_DECISION_VIAS.includes(decision.via) ? decision.via : 'app',
+            });
+        }
+        catch {
+            // Metrics never fail a decision.
+        }
+    }
+};
+exports.AccessPolicy = AccessPolicy;
+__decorate([
+    (0, index_1.Trace)('sharing.access.decide_many'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Array]),
+    __metadata("design:returntype", Promise)
+], AccessPolicy.prototype, "decideMany", null);
+exports.AccessPolicy = AccessPolicy = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.SHARING_DATA)),
+    __param(2, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(exports.ACCESS_POLICY_CLOCK)),
+    __metadata("design:paramtypes", [Object, principal_groups_provider_1.PrincipalGroupsProvider,
+        index_1.MetricsHostService, Function])
+], AccessPolicy);
+/** Step 1, before any query: every type registered, the action declared by each. */
+function validate(action, refs) {
+    for (const ref of refs) {
+        const rt = (0, resource_types_1.requireResourceType)(ref.type);
+        if (action !== null && rt.required(action) === undefined) {
+            throw new Error(`Resource type "${rt.type}" declares no action "${action}" (declared: ${Object.keys(rt.def.actions).join(', ')}).`);
+        }
+    }
+}
+/**
+ * Whether the caller is decided BEFORE the access rules: a missing required
+ * permission (step 3), a held bypass (step 4) or the record's user owner
+ * (step 5). A faulty rule can therefore never lock an owner or an
+ * administrator out of the record.
+ */
+function decidedBeforeRules(rt, principal, action, info) {
+    if (info.owner.kind === 'user' && info.owner.userId === principal.userId)
+        return true;
+    if (action === null)
+        return false;
+    const needed = rt.def.actionPermissions?.[action];
+    if (needed !== undefined && !principal.permissions.includes(needed))
+        return true;
+    const bypass = rt.def.bypassPermissions?.[action];
+    return (bypass !== undefined && principal.permissions.includes(bypass)) || (action === 'share' && principal.permissions.includes(permissions_1.SHARING_PERMISSIONS.SHARING_ADMIN));
+}
+/** Steps 2 to 10 for one record. */
+function decideOne(rt, principal, orgId, groupRole, action, info, grants, rules) {
+    // 2. Missing, or in another organization.
+    if (!info || info.orgId !== orgId)
+        return DENIED;
+    // 6 and 8. A deny of any rule wins over every allow below.
+    if (rules.denied)
+        return rules.failed ? DENIED_RULE_FAILURE : DENIED;
+    // 5 to 9: every source of a role, strongest wins (ties: the earlier source).
+    let best = null;
+    const offer = (role, via) => {
+        const rank = rt.rank(role);
+        if (role !== null && rank > 0 && (best === null || rank > best.rank))
+            best = { role, rank, via };
+    };
+    if (info.owner.kind === 'user' && info.owner.userId === principal.userId)
+        offer('owner', 'owner');
+    if (info.owner.kind === 'group' && groupRole.has(info.owner.groupId))
+        offer(rt.groupRole(groupRole.get(info.owner.groupId)), 'group_owner');
+    for (const rule of rules.before)
+        offer(rule.role, rule.via);
+    for (const def of (0, grantee_kinds_1.persistedGranteeKinds)()) {
+        for (const grant of grants) {
+            const kind = (0, grantee_kinds_1.findGranteeKind)(grant.granteeKind);
+            if (kind !== def || !granteeNamesCaller(def, grant, principal))
+                continue;
+            offer(grant.role, (0, grantee_kinds_1.granteeKindVia)(def));
+        }
+    }
+    for (const rule of rules.after)
+        offer(rule.role, rule.via);
+    if (rt.defaultVisibility === 'org')
+        offer(rt.orgRole, 'org_default');
+    const effective = best;
+    if (action === null) {
+        return effective ? { allowed: true, role: effective.role, via: effective.via } : DENIED;
+    }
+    // 3. A required RBAC permission the caller lacks: deny, even for the owner.
+    const needed = rt.def.actionPermissions?.[action];
+    if (needed !== undefined && !principal.permissions.includes(needed)) {
+        return { allowed: false, role: effective?.role ?? null, via: null, missingPermission: needed };
+    }
+    // 4. A bypass permission (and sharing:admin for `share`, on every type).
+    const required = rt.required(action);
+    const bypass = rt.def.bypassPermissions?.[action];
+    if ((bypass !== undefined && principal.permissions.includes(bypass)) || (action === 'share' && principal.permissions.includes(permissions_1.SHARING_PERMISSIONS.SHARING_ADMIN))) {
+        return { allowed: true, role: effective && effective.rank >= rt.rank(required) ? effective.role : required, via: 'bypass' };
+    }
+    // 5 to 10: the effective role against the action's minimum.
+    if (effective && effective.rank >= rt.rank(required))
+        return { allowed: true, role: effective.role, via: effective.via };
+    return { allowed: false, role: effective?.role ?? null, via: null };
+}
+/** Whether a stored grant of `def` names the caller. A kind that throws names nobody (fail closed). */
+function granteeNamesCaller(def, grant, principal) {
+    try {
+        return def.matchesPrincipal({ kind: grant.granteeKind, userId: grant.granteeUserId, groupId: grant.granteeGroupId, ref: grant.granteeRef ?? null }, principal);
+    }
+    catch {
+        return false;
+    }
+}
+/** The HTTP refusal of a denial. */
+function denial(rt, decision) {
+    if (decision.missingPermission)
+        return (0, errors_1.missingPermission)(decision.missingPermission);
+    return rt.denyAs === 'forbidden' ? (0, errors_1.resourceForbidden)() : (0, errors_1.resourceNotFound)();
+}
+/**
+ * The HTTP refusal `AccessPolicy.require` throws for a denial (exported for
+ * services that decide in bulk and refuse one record).
+ *
+ * @param type - the record's resource type.
+ * @param decision - the denial.
+ * @returns the exception to throw.
+ *
+ * @stability experimental
+ */
+function accessDenial(type, decision) {
+    return denial((0, resource_types_1.requireResourceType)(type), decision);
+}
+//# sourceMappingURL=access-policy.service.js.map

package/dist/sharing/access/access-policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.service.js","sourceRoot":"","sources":["../../../src/sharing/access/access-policy.service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,8DAA8D;AAC9D,EAAE;AACF,+EAA+E;AAC/E,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,iEAAiE;AACjE,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,+BAA+B;AAC/B,4BAA4B;AAC5B,2EAA2E;AAC3E,8EAA8E;AAC9E,0CAA0C;AAC1C,6EAA6E;AAC7E,2EAA2E;AAC3E,8DAA8D;AAC9D,kEAAkE;AAClE,8CAA8C;AAC9C,uBAAuB;AACvB,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,0BAA0B;AAC1B,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,uCAAuC;AACvC,gFAAgF;;;;;;;;;;;;;;;AA+FhF,kCAEC;AA0aD,oCAEC;AA3gBD,2CAA8D;AAC9D,4CAA2C;AAG3C,iDAAkE;AAClE,mDAAgE;AAChE,sCAAmF;AACnF,wCAAoF;AACpF,gDAAqD;AACrD,oCAA8D;AAC9D,4EAAuE;AACvE,iDAAwG;AACxG,mDAAsH;AACtH,qDAA0G;AA2D1G;;;;;GAKG;AACU,QAAA,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;AAEjH,oCAAoC;AACpC,SAAS,OAAO,CAAC,MAAqB,EAAE,GAAgB;IACtD,OAAO,GAAG,MAAM,IAAI,YAAY,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,GAAgB;IAC1C,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,MAAM,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AACxF,gFAAgF;AAChF,MAAM,mBAAmB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAa,EAAE,CAAC,CAAC;AAKjI;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAKkB;IACtB;IACY;IAC6B;IAP5D,sFAAsF;IACrE,IAAI,GAAG,IAAI,OAAO,EAAgD,CAAC;IAEpF,YACyC,IAAqB,EAC3C,eAAwC,EAC5B,OAA4B,EACC,MAAoB,IAAI,CAAC,GAAG;QAH/C,SAAI,GAAJ,IAAI,CAAiB;QAC3C,oBAAe,GAAf,eAAe,CAAyB;QAC5B,YAAO,GAAP,OAAO,CAAqB;QACC,QAAG,GAAH,GAAG,CAAyB;IACrF,CAAC;IAEJ;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,SAAoB,EAAE,MAAc,EAAE,GAAgB;QAC9D,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,SAAoB,EAAE,MAAc,EAAE,GAAgB;QACjE,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAE,CAAC;IAClF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,CAAC,SAAoB,EAAE,MAAc,EAAE,GAAgB;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,IAAA,oCAAmB,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,SAAoB,EAAE,GAAgB;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;;;;;;OASG;IAEG,AAAN,KAAK,CAAC,UAAU,CAAC,SAAoB,EAAE,MAAc,EAAE,IAA4B;QACjF,MAAM,IAAI,GAAG,WAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,EAAE,YAAY,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,WAAW;YAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAAC,EAAW,EAAE,SAAoB,EAAE,MAAc,EAAE,IAA4B;QAChG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CAAC,EAAW,EAAE,SAAoB,EAAE,MAAc,EAAE,GAAgB;QACjF,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAE,CAAC;QAChG,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,IAAA,oCAAmB,EAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kFAAkF;IAElF,8FAA8F;IACtF,KAAK,CAAC,QAAQ,CAAC,SAAoB;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAoB,EAAE,MAAqB,EAAE,IAA4B;QACtG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC;gBACpC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5E,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/H,CAAC,CAAC,EAAE,CAAC;YACL,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;gBACxE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C;gBAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;YACD,8DAA8D;YAC9D,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;gBACf,KAAK,MAAM,GAAG,IAAI,MAAM;oBAAE,IAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAE,CAAC,CAAC;QACzF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,QAAQ,CACpB,KAAc,EACd,SAAoB,EACpB,MAAkC,EAClC,MAAqB,EACrB,IAA4B;QAE5B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,KAAK,CAAC,CAAC;QAE9B,wCAAwC;QACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,IAAA,oCAAmB,EAAC,IAAI,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAA,0BAAU,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,CAAU,CAAC,CAAC;QACpI,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAA,qCAAqB,GAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACvD,MAAM,KAAK,GAAG,IAAA,+BAAe,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAoB;gBACtD,KAAK,EAAE;oBACL,KAAK;oBACL,SAAS,EAAE,IAAI;oBACf,GAAG,EAAE;wBACH,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE;wBACtF,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE;wBAC1E,EAAE,EAAE,EAAE,QAAQ,EAAE;qBACjB;iBACF;gBACD,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;aAC7I,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;QACzC,2FAA2F;QAC3F,kFAAkF;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,6BAAc,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,UAAU;YAAE,MAAM,EAAE,CAAC,WAAW,CAAA,gCAAgC,CAAC;QACrE,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;YACxC,MAAM,EAAE,CAAC,WAAW,CAAA,4CAA4C,CAAC;QACnE,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,EAAE,GAAG,IAAA,oCAAmB,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAChG,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YACtG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvB,IAAI,MAAM,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,WAAW,CAAA,wCAAwC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;YACjF,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8GAA8G;IACtG,QAAQ,CACd,EAAwB,EACxB,SAAoB,EACpB,KAAa,EACb,MAAqB,EACrB,GAAgB,EAChB,IAAmC,EACnC,EAAW,EACX,KAA2B,EAC3B,OAA4B;QAE5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAA,6BAAc,EAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7H,OAAO,OAAO,CAAC,OAAO,CAAC,8BAAe,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAA,kCAAmB,EAAC,EAAE,EAAE;YAC7B,SAAS;YACT,MAAM;YACN,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC9E,EAAE;YACF,KAAK;YACL,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,IAAY,EAAE,QAAwB;QAClD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,yCAA+B,EAAE,CAAC,EAAE;gBACpD,aAAa,EAAE,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;gBACtF,GAAG,EAAE,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,+BAA2C,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;aACjI,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;CACF,CAAA;AAjSY,oCAAY;AA+EjB;IADL,IAAA,aAAK,EAAC,4BAA4B,CAAC;;;;8CAMnC;uBApFU,YAAY;IADxB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,2BAAmB,CAAC,CAAA;6CAFN,mDAAuB;QAClB,0BAAkB;GAPhD,YAAY,CAiSxB;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,MAAqB,EAAE,IAA4B;IACnE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAA,oCAAmB,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC,IAAI,yBAAyB,MAAM,gBAAgB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,EAAwB,EAAE,SAAoB,EAAE,MAAqB,EAAE,IAAuB;IACxH,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,iCAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;AACvK,CAAC;AAED,oCAAoC;AACpC,SAAS,SAAS,CAChB,EAAwB,EACxB,SAAoB,EACpB,KAAa,EACb,SAAsC,EACtC,MAAqB,EACrB,IAAmC,EACnC,MAAoC,EACpC,KAAkB;IAElB,0CAA0C;IAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IACjD,2DAA2D;IAC3D,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC;IAErE,6EAA6E;IAC7E,IAAI,IAAI,GAA0D,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAE,GAAc,EAAQ,EAAE;QAC1D,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACnG,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7I,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,IAAA,qCAAqB,GAAE,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAA,+BAAe,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC;gBAAE,SAAS;YACzE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAA,8BAAc,EAAC,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,iBAAiB,KAAK,KAAK;QAAE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAA6D,CAAC;IAEhF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1F,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAE,CAAC;IACtC,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,iCAAmB,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClK,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC9H,CAAC;IAED,4DAA4D;IAC5D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;IACzH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,GAAgD,EAAE,KAAwB,EAAE,SAAoB;IAC1H,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;IACjK,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,oCAAoC;AACpC,SAAS,MAAM,CAAC,EAAwB,EAAE,QAAwB;IAChE,IAAI,QAAQ,CAAC,iBAAiB;QAAE,OAAO,IAAA,0BAAiB,EAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAA,0BAAiB,GAAE,CAAC,CAAC,CAAC,IAAA,yBAAgB,GAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,IAAY,EAAE,QAAwB;IACjE,OAAO,MAAM,CAAC,IAAA,oCAAmB,EAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC"}