@namzu/sandbox 13.0.0 → 15.0.0

package/dist/backends/kubernetes/k8s-client.js

@@ -0,0 +1,553 @@
+/**
+ * Minimal Kubernetes API client: bare fetch/https transport plus in-cluster
+ * ServiceAccount bootstrap.
+ *
+ * Sibling of the ACI and Firecracker control-plane clients: same
+ * dependency-free shape, different API. No `@kubernetes/client-node`, no
+ * kubeconfig parsing, no exec-credential-plugin invocation, no YAML anywhere
+ * — `@namzu/sandbox` still declares zero runtime `dependencies` after this
+ * module.
+ *
+ * ## Auth / SDK-dependency boundary
+ * Two access sources, neither needing a YAML parser:
+ *  - `{ inCluster: true }` reads the projected ServiceAccount volume
+ *    (`token`, `ca.crt`, `namespace`) plus `KUBERNETES_SERVICE_HOST` /
+ *    `KUBERNETES_SERVICE_PORT` — pure file + env reads, the same boundary
+ *    `kubectl` itself uses inside a pod. The token file is re-read on EVERY
+ *    request because kubelet rotates projected tokens under the pod; caching
+ *    it would produce an intermittent 401 hours into a long-lived host
+ *    process.
+ *  - `{ server, ca?, getToken }` supplied by the caller mirrors ACI's
+ *    `ArmTokenProvider` and Firecracker's `OrchestratorTokenProvider`
+ *    (`../aci-standby-pool/index.ts`, `../firecracker/index.ts`). Kubeconfig
+ *    parsing, context merging and exec-credential-plugin invocation
+ *    (kubelogin, gcloud, aws-iam-authenticator, ...) all stay OUTSIDE this
+ *    package; the caller resolves a bearer token however it likes.
+ *
+ * ## Transport
+ * Default path is bare global `fetch`. When a custom CA is present — always
+ * true in-cluster, since the cluster CA is never in the process's system
+ * trust store — the call goes through `node:https.request` with that `ca`
+ * and `rejectUnauthorized: true` instead, exactly as
+ * `../firecracker/index.ts` splits `fetchOrchestratorRequest` from
+ * `httpsOrchestratorRequest` ("the package declares no undici dependency").
+ *
+ * ## Status mapping
+ * 404/410 become an `AlreadyGoneError` sentinel a teardown path can treat as
+ * success (ACI's `armCall(..., [404, 410])` accepts the same pair for
+ * exactly that reason — see `../aci-standby-pool/index.ts`). 409 becomes a
+ * `ConflictError` an adoption/retry path can catch. 401/403 become a
+ * `CredentialError` naming the attempted verb and resource — never the
+ * token, which this module never logs or embeds in any thrown message.
+ *
+ * ## What a failure carries, and what it deliberately does not
+ * Everything else — a connect failure, and every non-2xx status the mapping
+ * above does not name — rejects with {@link KubernetesApiError}, which
+ * carries the verb, the path, the status where there was one, and the
+ * `Retry-After` the server sent with a 429 or a 503. That is METADATA and
+ * nothing more: there is no retry loop and no retry policy in this module.
+ * A retry is a decision about the OPERATION — a GET during a readiness poll
+ * may be repeated, a POST that may already have committed may not — and this
+ * client cannot tell those apart. `backends/kubernetes/index.ts` owns the
+ * policy, beside the acquire it serves and inside that acquire's existing
+ * deadline.
+ *
+ * ## Deadlines
+ * Every request carries its own bound
+ * ({@link KubernetesClientOptions.requestTimeoutMs}, default
+ * {@link DEFAULT_API_REQUEST_TIMEOUT_MS}) on top of whatever signal the
+ * caller passed, because the caller's signal is optional everywhere and
+ * several call sites are SHARED flights that run under whichever caller
+ * arrived first — one signal-less `destroy()` against an API server that
+ * accepted a request and never answered would otherwise pin every later
+ * caller joined to it. The bound covers `getToken()`, the connection and
+ * reading the body, on both transports, and expiry rejects with
+ * {@link KubernetesApiTimeoutError} rather than the generic `failed:` error
+ * so a caller can tell a timeout from a refusal. A caller's own abort still
+ * behaves exactly as it did.
+ *
+ * ## Not in v1
+ * No watch, no informers, no resourceVersion/bookmark tracking. Readiness is
+ * polled by the caller with `../readiness.js`'s `OperationDeadline`, exactly
+ * as ACI polls `provisioningState`.
+ */
+import { readFileSync } from 'node:fs';
+import https from 'node:https';
+/**
+ * Default {@link KubernetesClientOptions.requestTimeoutMs} — 30 s.
+ *
+ * The same cap `lease.ts` already puts on a renewal PATCH, and below the
+ * 60 s `readyTimeoutMs` default, so a request that times out still leaves
+ * the readiness budget something to report with.
+ */
+export const DEFAULT_API_REQUEST_TIMEOUT_MS = 30_000;
+/** Floor for {@link KubernetesClientOptions.requestTimeoutMs} — 1 s. */
+export const MIN_API_REQUEST_TIMEOUT_MS = 1_000;
+const DEFAULT_SERVICE_ACCOUNT_DIR = '/var/run/secrets/kubernetes.io/serviceaccount';
+/** 404/410 → this. A teardown path treats it as "already achieved". */
+export class KubernetesAlreadyGoneError extends Error {
+    method;
+    resource;
+    status;
+    constructor(method, resource, status) {
+        super(`kubernetes ${method} ${resource} -> ${status}: already gone`);
+        this.method = method;
+        this.resource = resource;
+        this.status = status;
+        this.name = 'KubernetesAlreadyGoneError';
+    }
+}
+/** 409 → this. An adoption/retry path can catch it and re-read + retry. */
+export class KubernetesConflictError extends Error {
+    method;
+    resource;
+    constructor(method, resource) {
+        super(`kubernetes ${method} ${resource} -> 409: conflict`);
+        this.method = method;
+        this.resource = resource;
+        this.name = 'KubernetesConflictError';
+    }
+}
+/**
+ * A JSON Patch the API server would not apply: 422 Unprocessable Entity.
+ *
+ * ## What the API server actually says, measured
+ *
+ * Against a real API server (v1.37.0) and the agent-sandbox `Sandbox` CRD, a
+ * JSON Patch whose `test` clause does not hold answers **422** with this
+ * body, byte for byte:
+ *
+ * ```json
+ * {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure",
+ *  "message":"the server rejected our request due to an error in our request",
+ *  "reason":"Invalid","details":{},"code":422}
+ * ```
+ *
+ * A patch that is simply WRONG — a pointer into a member that does not
+ * exist, say — answers with exactly the same status, the same reason and the
+ * same message. The server does not name the operation that failed, so
+ * nothing this class could read off the response would tell a lost race from
+ * a malformed body, and a class that claimed to would be lying.
+ *
+ * So it says what it can honestly say: the patch did not apply and NOTHING
+ * was changed. Deciding which of the two it was belongs to the caller that
+ * knows what it tested — `workspace.ts` re-reads the object and compares the
+ * value it tested against what is stored now: changed ⇒ somebody raced it,
+ * unchanged ⇒ the body is wrong and the error is rethrown rather than
+ * retried forever.
+ *
+ * Not a {@link KubernetesConflictError}: that one is 409, which the same
+ * server returns for a DELETE whose `preconditions.resourceVersion` does not
+ * match (measured on the same cluster, with a message that DOES name the two
+ * versions). The two statuses mean different things and are kept apart.
+ */
+export class KubernetesPatchNotAppliedError extends Error {
+    method;
+    resource;
+    status;
+    constructor(method, resource, status) {
+        super(`kubernetes ${method} ${resource} -> ${status}: the API server did not apply the JSON patch and changed nothing. It does not say which operation failed, so this is either a \`test\` clause that no longer holds — another holder wrote the object first — or a patch body that is wrong.`);
+        this.method = method;
+        this.resource = resource;
+        this.status = status;
+        this.name = 'KubernetesPatchNotAppliedError';
+    }
+}
+/**
+ * 401/403 → this. Names the attempted verb and resource only — never the
+ * token, and never the response body (the API server does not echo the
+ * token back, but the body is untrusted content this module has no reason
+ * to repeat into a thrown message).
+ */
+export class KubernetesCredentialError extends Error {
+    verb;
+    resource;
+    status;
+    constructor(verb, resource, status) {
+        super(`kubernetes API refused ${verb} ${resource}: ${status}`);
+        this.verb = verb;
+        this.resource = resource;
+        this.status = status;
+        this.name = 'KubernetesCredentialError';
+    }
+}
+/**
+ * The request outlived {@link KubernetesClientOptions.requestTimeoutMs}.
+ *
+ * Deliberately NOT the generic `failed:` error: a caller that can tell a
+ * timeout from a refusal can retry an idempotent write, and one that cannot
+ * has to treat every failure alike. Carries the verb, the resource path and
+ * the bound that expired — and, like every other error in this module,
+ * never the bearer token.
+ *
+ * A timeout says nothing about whether the request was APPLIED, which is
+ * why nothing here tries to: a suspend restores the state it saw and sends
+ * its idempotent patch again, a create POST that landed is adopted through
+ * the 409 path, and a DELETE that already applied counts as done.
+ */
+export class KubernetesApiTimeoutError extends Error {
+    verb;
+    resource;
+    timeoutMs;
+    constructor(verb, resource, timeoutMs) {
+        super(`kubernetes ${verb} ${resource} was still unanswered ${timeoutMs}ms after it was sent, and was given up on (apiRequestTimeoutMs). Whether the API server applied it is unknown. Raise apiRequestTimeoutMs if this cluster is genuinely this slow.`);
+        this.verb = verb;
+        this.resource = resource;
+        this.timeoutMs = timeoutMs;
+        this.name = 'KubernetesApiTimeoutError';
+    }
+}
+/**
+ * Every API failure this client does not already name: a connect failure, and
+ * every non-2xx status outside 401/403/404/409/410 (and the 422 a JSON patch
+ * gets).
+ *
+ * It exists because "a burst past node capacity" and "the API server is down"
+ * used to be the same plain `Error`, separable only by matching the message
+ * text a release is free to reword. The fields are the smallest set that
+ * makes the difference decidable by a caller:
+ *
+ *  - `status` — absent for a connect failure, present for every answered one.
+ *  - `retryAfterMs` — the `Retry-After` header the API server sends with a
+ *    429 (its own priority-and-fairness queue shedding load) and sometimes
+ *    with a 503, normalised to milliseconds from either spelling the header
+ *    allows. Absent when the server sent none, which is not the same as zero.
+ *  - `transport` — see {@link KubernetesApiFailureTransport}.
+ *  - `cause` — the underlying error for a connect failure.
+ *
+ * **There is no retry here.** This class is metadata; `index.ts` decides what
+ * is worth repeating, because only the caller knows whether the operation is
+ * idempotent and only the caller owns a clock to repeat it inside.
+ *
+ * The message keeps the exact wording both throw sites used before, so a host
+ * that logs it sees no change and only a host that inspects the type gains
+ * anything.
+ */
+export class KubernetesApiError extends Error {
+    method;
+    path;
+    status;
+    retryAfterMs;
+    transport;
+    constructor(message, details) {
+        super(message, details.cause !== undefined ? { cause: details.cause } : undefined);
+        this.name = 'KubernetesApiError';
+        this.method = details.method;
+        this.path = details.path;
+        if (details.status !== undefined)
+            this.status = details.status;
+        if (details.retryAfterMs !== undefined)
+            this.retryAfterMs = details.retryAfterMs;
+        this.transport = details.transport;
+    }
+}
+/**
+ * `Retry-After`, in milliseconds, or `undefined` when the server sent none or
+ * sent one that cannot be read.
+ *
+ * RFC 9110 allows two spellings and the API server uses the first: a
+ * delta-seconds integer (`Retry-After: 1`), which is what
+ * priority-and-fairness sends with a 429. The HTTP-date spelling is accepted
+ * too, because a proxy in front of the API server may rewrite it. A date in
+ * the past, or a negative delta, reads as `0` — "now" — rather than being
+ * discarded, because the server still said to wait and the answer to "how
+ * long" is "no longer".
+ */
+export function parseRetryAfterMs(header) {
+    if (header === undefined)
+        return undefined;
+    const raw = header.trim();
+    if (raw === '')
+        return undefined;
+    if (/^-?\d+$/.test(raw)) {
+        const seconds = Number(raw);
+        if (!Number.isSafeInteger(seconds))
+            return undefined;
+        return Math.max(0, seconds * 1_000);
+    }
+    const at = Date.parse(raw);
+    if (Number.isNaN(at))
+        return undefined;
+    return Math.max(0, at - Date.now());
+}
+/**
+ * Validate the configured bound, or supply the default.
+ *
+ * There is no disabling value, and `0` is refused rather than read as
+ * "unbounded": an unanswered request is not a supported configuration.
+ * Several call sites are single-flight promises that run under the FIRST
+ * caller's signal and never consult a later one's, so one hung request
+ * does not block one caller — it blocks every caller that joined it, on a
+ * handle whose state already refuses data-plane calls. A cluster with a
+ * genuinely slow API server raises the number.
+ */
+export function resolveRequestTimeoutMs(value) {
+    if (value === undefined)
+        return DEFAULT_API_REQUEST_TIMEOUT_MS;
+    if (!Number.isSafeInteger(value) || value < MIN_API_REQUEST_TIMEOUT_MS) {
+        throw new Error(`kubernetes: apiRequestTimeoutMs must be an integer of at least ${MIN_API_REQUEST_TIMEOUT_MS}ms, got ${JSON.stringify(value)}. No value disables the bound: a request the API server accepted and never answered would hang its caller — and every later caller joined to the same single-flight suspend, delete or verification — until the process was killed. Raise the number instead; the default is ${DEFAULT_API_REQUEST_TIMEOUT_MS}ms.`);
+    }
+    return value;
+}
+/**
+ * Await `promise`, but give up the moment `signal` aborts, rejecting with
+ * that signal's reason.
+ *
+ * `getToken()` is a caller-supplied callback and `res.text()` is a body the
+ * peer may simply stop sending, and neither takes a signal of its own, so
+ * without this the bound would cover only the part of a request this module
+ * happens to hold a socket for. The late settlement is swallowed rather
+ * than left dangling: an unobserved rejection is still a rejection.
+ */
+function settleOnAbort(promise, signal) {
+    if (signal.aborted) {
+        void promise.catch(() => { });
+        return Promise.reject(signal.reason);
+    }
+    return new Promise((resolve, reject) => {
+        let done = false;
+        const onAbort = () => {
+            done = true;
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            if (!done)
+                resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            if (!done)
+                reject(error);
+        });
+    });
+}
+function stripTrailingSlash(url) {
+    return url.endsWith('/') ? url.slice(0, -1) : url;
+}
+/**
+ * Reads `ca.crt` and `namespace` once (they do not rotate for the pod's
+ * lifetime); returns a `getToken` closure that re-reads `token` on every
+ * call, because kubelet DOES rotate the projected token under a live pod.
+ */
+function resolveInCluster(access) {
+    const dir = access.serviceAccountDir ?? DEFAULT_SERVICE_ACCOUNT_DIR;
+    const host = process.env.KUBERNETES_SERVICE_HOST;
+    const port = process.env.KUBERNETES_SERVICE_PORT;
+    if (host === undefined || host === '' || port === undefined || port === '') {
+        throw new Error('kubernetes: in-cluster access requires KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT');
+    }
+    const ca = readFileSync(`${dir}/ca.crt`);
+    const namespace = readFileSync(`${dir}/namespace`, 'utf8').trim();
+    return {
+        baseUrl: `https://${host}:${port}`,
+        ca,
+        namespace,
+        getToken: async () => readFileSync(`${dir}/token`, 'utf8').trim(),
+    };
+}
+function resolveExplicit(access) {
+    return {
+        baseUrl: stripTrailingSlash(access.server),
+        ca: access.ca,
+        namespace: access.namespace,
+        getToken: access.getToken,
+    };
+}
+/** The plain-`fetch` path — the DEFAULT, used whenever no custom CA is set. */
+async function fetchRequest(url, method, headers, payload, signal) {
+    const init = { method, headers };
+    if (payload !== undefined)
+        init.body = payload;
+    if (signal !== undefined)
+        init.signal = signal;
+    const res = await fetch(url, init);
+    return {
+        status: res.status,
+        contentType: res.headers.get('content-type') ?? '',
+        header: (name) => res.headers.get(name) ?? undefined,
+        text: () => res.text(),
+    };
+}
+/**
+ * The custom-CA path: a `node:https` request presenting the injected `ca`
+ * and verifying the API server's cert against it (`rejectUnauthorized:
+ * true`). `node:https` is used rather than fetch+a custom dispatcher because
+ * the package declares no undici dependency — `node:https` is always
+ * importable and needs nothing added (mirrors
+ * `../firecracker/index.ts`'s `httpsOrchestratorRequest`).
+ */
+function httpsRequest(url, method, headers, payload, ca, signal) {
+    const target = new URL(url);
+    return new Promise((resolve, reject) => {
+        const req = https.request({
+            protocol: target.protocol,
+            hostname: target.hostname,
+            port: target.port !== '' ? Number(target.port) : 443,
+            path: `${target.pathname}${target.search}`,
+            method,
+            headers,
+            ca,
+            rejectUnauthorized: true,
+            ...(signal !== undefined ? { signal } : {}),
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                const ct = res.headers['content-type'];
+                resolve({
+                    status: res.statusCode ?? 0,
+                    contentType: Array.isArray(ct) ? (ct[0] ?? '') : (ct ?? ''),
+                    header: (name) => {
+                        const value = res.headers[name];
+                        return Array.isArray(value) ? value[0] : value;
+                    },
+                    text: async () => Buffer.concat(chunks).toString('utf8'),
+                });
+            });
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        if (payload !== undefined)
+            req.write(payload);
+        req.end();
+    });
+}
+/**
+ * `PATCH` carries a JSON MERGE patch body (RFC 7386) unless the caller asked
+ * for `json`, which sends an RFC 6902 operation list instead — never
+ * server-side apply, never YAML. `POST` carries a plain JSON create body.
+ * `GET`/`DELETE` normally carry no body; when a caller does pass one to
+ * `DELETE` — a `DeleteOptions` with `preconditions` — it is sent as plain
+ * JSON, which is what the API server expects there.
+ */
+function contentTypeFor(method, patchType) {
+    if (method !== 'PATCH')
+        return 'application/json';
+    return patchType === 'json' ? 'application/json-patch+json' : 'application/merge-patch+json';
+}
+export function createKubernetesClient(access, options = {}) {
+    const resolved = access.inCluster === true ? resolveInCluster(access) : resolveExplicit(access);
+    // Validated at construction, not at the first request: a configuration
+    // this module will never honour should be refused where the operator can
+    // still see which backend it came from.
+    const requestTimeoutMs = resolveRequestTimeoutMs(options.requestTimeoutMs);
+    async function request(method, path, body, signal, patchType = 'merge') {
+        signal?.throwIfAborted();
+        // The caller's signal is WRAPPED, never replaced: `deadline` aborts
+        // with the caller's own reason when the caller aborts, so every path
+        // below behaves exactly as it did, and with a
+        // KubernetesApiTimeoutError when the bound expires first. Combined by
+        // hand rather than with `AbortSignal.any`, which this package's
+        // declared Node floor (20.0) predates.
+        const deadlineController = new AbortController();
+        const deadline = deadlineController.signal;
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            deadlineController.abort(new KubernetesApiTimeoutError(method, path, requestTimeoutMs));
+        }, requestTimeoutMs);
+        timer.unref?.();
+        const forwardCallerAbort = () => deadlineController.abort(signal?.reason);
+        signal?.addEventListener('abort', forwardCallerAbort, { once: true });
+        /** True while the CALLER is the one who gave up, which wins. */
+        const callerGaveUp = () => signal?.aborted === true;
+        const readBody = async (res) => await settleOnAbort(res.text(), deadline);
+        try {
+            // Covered by the bound at last: `getToken()` is caller code that
+            // takes no signal of its own, and an in-cluster token read that
+            // blocks on a wedged volume used to be unbounded on every request.
+            const token = await settleOnAbort(resolved.getToken(), deadline);
+            deadline.throwIfAborted();
+            const url = `${resolved.baseUrl}${path}`;
+            const payload = body !== undefined ? JSON.stringify(body) : undefined;
+            const headers = {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+            };
+            if (payload !== undefined)
+                headers['content-type'] = contentTypeFor(method, patchType);
+            let res;
+            try {
+                res =
+                    resolved.ca !== undefined
+                        ? await httpsRequest(url, method, headers, payload, resolved.ca, deadline)
+                        : await fetchRequest(url, method, headers, payload, deadline);
+            }
+            catch (err) {
+                if (err instanceof KubernetesApiTimeoutError)
+                    throw err;
+                // A timeout is named rather than folded into `failed:`; a
+                // caller's own abort still produces the wrapped error it
+                // always produced.
+                if (timedOut && !callerGaveUp()) {
+                    throw new KubernetesApiTimeoutError(method, path, requestTimeoutMs);
+                }
+                // Same sentence it has always thrown, on a class that says which
+                // half failed. Nothing here decides whether to try again: see
+                // {@link KubernetesApiError}.
+                throw new KubernetesApiError(`kubernetes ${method} ${path} failed: ${err instanceof Error ? err.message : String(err)}`, { method, path, transport: 'connect', cause: err });
+            }
+            if (res.status === 401 || res.status === 403) {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesCredentialError(method, path, res.status);
+            }
+            if (res.status === 404 || res.status === 410) {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesAlreadyGoneError(method, path, res.status);
+            }
+            if (res.status === 409) {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesConflictError(method, path);
+            }
+            // Before the generic mapping, and only for the dialect that has a
+            // `test` clause to fail: a merge patch has no condition, so a 422
+            // on one is a malformed body and belongs in the generic error
+            // where it always was.
+            if (res.status === 422 && method === 'PATCH' && patchType === 'json') {
+                await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesPatchNotAppliedError(method, path, res.status);
+            }
+            if (res.status < 200 || res.status >= 300) {
+                // Read BEFORE the body, because `readBody` can abort out of this
+                // block and the header is the whole reason a caller can wait the
+                // length the server asked for rather than a length it invented.
+                // Only for the two statuses that mean "later, not never": a 400
+                // carrying one would be the server contradicting itself.
+                const retryAfterMs = res.status === 429 || res.status === 503
+                    ? parseRetryAfterMs(res.header('retry-after'))
+                    : undefined;
+                const text = await readBody(res);
+                deadline.throwIfAborted();
+                throw new KubernetesApiError(`kubernetes ${method} ${path} -> ${res.status}: ${text}`, {
+                    method,
+                    path,
+                    status: res.status,
+                    ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+                    transport: 'status',
+                });
+            }
+            if (res.status === 204)
+                return undefined;
+            if (res.contentType.includes('application/json')) {
+                const text = await readBody(res);
+                deadline.throwIfAborted();
+                return text.length > 0 ? JSON.parse(text) : undefined;
+            }
+            return undefined;
+        }
+        finally {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', forwardCallerAbort);
+        }
+    }
+    return {
+        request,
+        namespace: () => resolved.namespace,
+    };
+}
+//# sourceMappingURL=k8s-client.js.map

package/dist/backends/kubernetes/k8s-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s-client.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/k8s-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,MAAM,YAAY,CAAA;AA8E9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAA;AAEpD,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AA8B/C,MAAM,2BAA2B,GAAG,+CAA+C,CAAA;AAEnF,uEAAuE;AACvE,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAE1C;IACA;IACA;IAHV,YACU,MAA4B,EAC5B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,OAAO,MAAM,gBAAgB,CAAC,CAAA;QAJ3D,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IACzC,CAAC;CACD;AAED,2EAA2E;AAC3E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAEvC;IACA;IAFV,YACU,MAA4B,EAC5B,QAAgB;QAEzB,KAAK,CAAC,cAAc,MAAM,IAAI,QAAQ,mBAAmB,CAAC,CAAA;QAHjD,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAGzB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACtC,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAE9C;IACA;IACA;IAHV,YACU,MAA4B,EAC5B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CACJ,cAAc,MAAM,IAAI,QAAQ,OAAO,MAAM,8OAA8O,CAC3R,CAAA;QANQ,WAAM,GAAN,MAAM,CAAsB;QAC5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAKvB,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;IAC7C,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEzC;IACA;IACA;IAHV,YACU,IAA0B,EAC1B,QAAgB,EAChB,MAAc;QAEvB,KAAK,CAAC,0BAA0B,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAA;QAJrD,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACxC,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEzC;IACA;IACA;IAHV,YACU,IAA0B,EAC1B,QAAgB,EAChB,SAAiB;QAE1B,KAAK,CACJ,cAAc,IAAI,IAAI,QAAQ,yBAAyB,SAAS,kLAAkL,CAClP,CAAA;QANQ,SAAI,GAAJ,IAAI,CAAsB;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAQ;QAK1B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACxC,CAAC;CACD;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACnC,MAAM,CAAsB;IAC5B,IAAI,CAAQ;IACZ,MAAM,CAAS;IACf,YAAY,CAAS;IACrB,SAAS,CAA+B;IAEjD,YACC,OAAe,EACf,OAOC;QAED,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAClF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC9D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;QAChF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,CAAC;CACD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC3D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IACzB,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAChC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,8BAA8B,CAAA;IAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,0BAA0B,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACd,kEAAkE,0BAA0B,WAAW,IAAI,CAAC,SAAS,CACpH,KAAK,CACL,gRAAgR,8BAA8B,KAAK,CACpT,CAAA;IACF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAI,OAAmB,EAAE,MAAmB;IACjE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzC,IAAI,IAAI,GAAG,KAAK,CAAA;QAChB,MAAM,OAAO,GAAG,GAAG,EAAE;YACpB,IAAI,GAAG,IAAI,CAAA;YACX,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC,CAAA;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE;YACT,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC5C,IAAI,CAAC,IAAI;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC,CACD,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;AAClD,CAAC;AASD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAiC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IAChD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACd,4FAA4F,CAC5F,CAAA;IACF,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,GAAG,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACjE,OAAO;QACN,OAAO,EAAE,WAAW,IAAI,IAAI,IAAI,EAAE;QAClC,EAAE;QACF,SAAS;QACT,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE;KACjE,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,MAAgC;IACxD,OAAO;QACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAA;AACF,CAAC;AAmBD,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,MAAoB;IAEpB,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAClD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS;QACpD,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE;KACtB,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACpB,GAAW,EACX,MAA4B,EAC5B,OAA+B,EAC/B,OAA2B,EAC3B,EAAmB,EACnB,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CACxB;YACC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG;YACpD,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM;YACN,OAAO;YACP,EAAE;YACF,kBAAkB,EAAE,IAAI;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,EACD,CAAC,GAAG,EAAE,EAAE;YACP,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;gBACtC,OAAO,CAAC;oBACP,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC3B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC3D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;wBAChB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;wBAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC/C,CAAC;oBACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;iBACxD,CAAC,CAAA;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACxB,CAAC,CACD,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,EAAE,CAAA;IACV,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAA4B,EAAE,SAA8B;IACnF,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,kBAAkB,CAAA;IACjD,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,8BAA8B,CAAA;AAC7F,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,MAAwB,EACxB,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;IAC/F,uEAAuE;IACvE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAE1E,KAAK,UAAU,OAAO,CACrB,MAA4B,EAC5B,IAAY,EACZ,IAAc,EACd,MAAoB,EACpB,YAAiC,OAAO;QAExC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,oEAAoE;QACpE,qEAAqE;QACrE,8CAA8C;QAC9C,sEAAsE;QACtE,gEAAgE;QAChE,uCAAuC;QACvC,MAAM,kBAAkB,GAAG,IAAI,eAAe,EAAE,CAAA;QAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAA;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,QAAQ,GAAG,IAAI,CAAA;YACf,kBAAkB,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACxF,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACpB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACrE,gEAAgE;QAChE,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;QACnD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAgB,EAAmB,EAAE,CAC5D,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAA;QAE1C,IAAI,CAAC;YACJ,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAA;YAChE,QAAQ,CAAC,cAAc,EAAE,CAAA;YACzB,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,IAAI,EAAE,CAAA;YACxC,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACrE,MAAM,OAAO,GAA2B;gBACvC,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,kBAAkB;aAC1B,CAAA;YACD,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAEtF,IAAI,GAAgB,CAAA;YACpB,IAAI,CAAC;gBACJ,GAAG;oBACF,QAAQ,CAAC,EAAE,KAAK,SAAS;wBACxB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;wBAC1E,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,YAAY,yBAAyB;oBAAE,MAAM,GAAG,CAAA;gBACvD,0DAA0D;gBAC1D,yDAAyD;gBACzD,mBAAmB;gBACnB,IAAI,QAAQ,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACjC,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAA;gBACpE,CAAC;gBACD,iEAAiE;gBACjE,8DAA8D;gBAC9D,8BAA8B;gBAC9B,MAAM,IAAI,kBAAkB,CAC3B,cAAc,MAAM,IAAI,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAClD,CAAA;YACF,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9D,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YAC/D,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAChD,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,uBAAuB;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,OAAO,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACtE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBACnB,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,8BAA8B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACnE,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3C,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,yDAAyD;gBACzD,MAAM,YAAY,GACjB,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACvC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;oBAC9C,CAAC,CAAC,SAAS,CAAA;gBACb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,MAAM,IAAI,kBAAkB,CAAC,cAAc,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE;oBACtF,MAAM;oBACN,IAAI;oBACJ,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,SAAS,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAA;YACxC,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBACzB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAC,SAAS,CAAA;YAC7D,CAAC;YACD,OAAO,SAAS,CAAA;QACjB,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QACzD,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO;QACP,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAA;AACF,CAAC"}