@ni-c/mcp-hub 0.10.0 → 0.11.0

package/dist/auth/provider.js

@@ -1,437 +0,0 @@
-import crypto from 'node:crypto';
-import { SignJWT, jwtVerify } from 'jose';
-import { InvalidClientMetadataError, InvalidGrantError, InvalidTargetError, InvalidTokenError, TooManyRequestsError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
-import { redirectUriMatches } from '@modelcontextprotocol/sdk/server/auth/handlers/authorize.js';
-import { isClientIdMetadataUrl } from './cimd.js';
-import { isLoopbackOnly, isSafeRedirectUri } from './redirect-uri.js';
-import { registrationClientUri } from './registration.js';
-import { readSignedPayload, sign, signPayload, signatureMatches } from './signed-token.js';
-import { clampDisplayName, logSafe } from './text.js';
-import { renderLoginPage } from './login-page.js';
-import { renderConsentPage } from './consent-page.js';
-import { allowFormActionTo } from './headers.js';
-const ACCESS_TOKEN_TTL_S = 15 * 60;
-const REFRESH_TOKEN_TTL_S = 30 * 24 * 3600;
-const CODE_TTL_MS = 10 * 60_000;
-export const SESSION_TTL_MS = 30 * 60_000;
-export const SESSION_COOKIE = 'mcp_hub_session';
-/**
- * The `__Host-` prefix pins the cookie to this exact origin, so no neighbouring
- * subdomain can plant one. It requires Secure, which rules it out over plain
- * http (local development and the test suite).
- */
-export function sessionCookieName(externalUrl) {
-    return new URL(externalUrl).protocol === 'https:' ? `__Host-${SESSION_COOKIE}` : SESSION_COOKIE;
-}
-/** Distinguishes admin-minted API tokens from interactive OAuth tokens. */
-export const API_TOKEN_SUBJECT = 'mcp-hub-token';
-/**
- * Mint a long-lived, resource-bound API token for clients that cannot do
- * OAuth (OpenAI Responses API, xAI API, Gemini API, plain-header clients).
- * The JWT is returned exactly once; only its record (jti) is persisted, which
- * is what `tokens list` shows and `tokens revoke` deletes.
- */
-export async function mintApiToken(store, externalUrl, resource, days, label) {
-    const id = crypto.randomBytes(8).toString('base64url');
-    const now = Math.floor(Date.now() / 1000);
-    const expiresAt = now + days * 86_400;
-    const token = await new SignJWT({})
-        .setProtectedHeader({ alg: 'EdDSA' })
-        .setIssuer(new URL(externalUrl).href)
-        .setAudience(resource.href)
-        .setSubject(API_TOKEN_SUBJECT)
-        .setIssuedAt(now)
-        .setExpirationTime(expiresAt)
-        .setJti(id)
-        .sign(store.privateKey);
-    store.saveApiToken(id, { label, resource: resource.href, createdAt: now, expiresAt });
-    return { id, token, expiresAt };
-}
-export class HubOAuthProvider {
-    store;
-    externalUrl;
-    options;
-    /** Short-lived authorization codes; in-memory on purpose (10 min lifetime). */
-    codes = new Map();
-    sessionCookieName;
-    constructor(store, externalUrl, options = {}) {
-        this.store = store;
-        this.externalUrl = externalUrl;
-        this.options = options;
-        this.sessionCookieName = sessionCookieName(externalUrl);
-    }
-    /**
-     * Both registration mechanisms meet here, and this is the only place the SDK
-     * looks a client up — the authorize handler, the token handler's client
-     * authentication and the revocation endpoint all go through it. A client_id
-     * that is an https URL is a Client ID Metadata Document and is fetched from
-     * the client; anything else is a locally registered DCR client.
-     */
-    get clientsStore() {
-        const store = this.store;
-        const cimd = this.options.cimd;
-        const registerClient = (client) => {
-            // The SDK only keeps javascript:, data: and vbscript: out, so without
-            // this a client could register a plaintext http:// callback on a remote
-            // host and have its authorization code delivered in the clear. Metadata
-            // documents have always been held to this; dynamic registration was not.
-            for (const uri of client.redirect_uris ?? []) {
-                if (!isSafeRedirectUri(uri, { allowPrivateUseSchemes: true })) {
-                    throw new InvalidClientMetadataError(`redirect_uri ${uri} must be https, a loopback address or a private-use scheme`);
-                }
-            }
-            const isPublic = client.token_endpoint_auth_method === 'none';
-            const stored = {
-                ...client,
-                // Self-declared and shown on the consent page, so held to one line.
-                client_name: clampDisplayName(client.client_name),
-                client_id: crypto.randomBytes(16).toString('base64url'),
-                client_id_issued_at: Math.floor(Date.now() / 1000),
-                // Secrets never expire: ChatGPT registers once per connector and
-                // never re-registers, so an expiring secret bricks the connector
-                // when it runs out (the SDK default is 30 days).
-                client_secret_expires_at: 0
-            };
-            // A stored secret makes the SDK demand it on every token request, so a
-            // public client must be persisted without one — but ChatGPT expects a
-            // client_secret in the registration response even for "none" and
-            // refuses its own registration otherwise. Hand it one in the response
-            // only; token requests from public clients ignore it.
-            if (isPublic)
-                delete stored.client_secret;
-            // RFC 7592: the credential that later lets this client read, change or
-            // delete its own registration. Only its hash is kept, so this is the one
-            // moment the client can learn it.
-            const registrationToken = crypto.randomBytes(32).toString('base64url');
-            if (!store.addClient(stored, registrationToken)) {
-                console.warn(`mcp-hub: refused a registration: the hub is at its limit of ${store.clientLimits.maxClients} clients`);
-                throw new TooManyRequestsError('This hub is at its client registration limit; ask the operator to remove unused registrations');
-            }
-            console.log(`mcp-hub: registered OAuth client ${stored.client_id} (${logSafe(stored.client_name ?? 'unnamed')})`);
-            // The SDK's type describes RFC 7591 only, but it serializes whatever this
-            // returns — which is how the RFC 7592 fields reach the client. They are
-            // response-only and never stored: the record keeps a hash of the token.
-            return {
-                ...stored,
-                registration_access_token: registrationToken,
-                registration_client_uri: registrationClientUri(this.externalUrl, stored.client_id),
-                ...(isPublic ? { client_secret: crypto.randomBytes(32).toString('hex'), client_secret_expires_at: 0 } : {})
-            };
-        };
-        return {
-            getClient: clientId => (cimd && isClientIdMetadataUrl(clientId) ? cimd.resolve(clientId) : store.getClient(clientId)),
-            // Leaving this undefined is what removes registration_endpoint from the
-            // discovery document and unmounts /register: the SDK derives both from
-            // the presence of this method.
-            ...(this.options.allowDynamicRegistration === false ? {} : { registerClient })
-        };
-    }
-    /** True for a client that proved itself with a metadata document rather than
-     *  a registration. The pages use it to name the origin that vouched. */
-    isMetadataDocumentClient(clientId) {
-        return this.options.cimd !== undefined && isClientIdMetadataUrl(clientId);
-    }
-    /**
-     * What the login and consent pages need to say about who is asking: the
-     * metadata document URL when there is one (draft §6.4 asks for its hostname
-     * to be shown) and whether every redirect URI is local, which the MCP
-     * security considerations single out as impossible to attribute.
-     */
-    clientIdentity(client) {
-        return {
-            clientId: this.isMetadataDocumentClient(client.client_id) ? client.client_id : undefined,
-            loopbackOnly: isLoopbackOnly(client.redirect_uris)
-        };
-    }
-    // --- Authorization endpoint ---------------------------------------------
-    /**
-     * A live session alone must not be enough to hand out a code: the cookie
-     * rides along on cross-site top-level navigations, so any page could walk a
-     * logged-in user through /authorize with a client it registered itself and
-     * collect the code. Only clients the user confirmed once are silent; for
-     * those the code can only ever land on their own registered redirect_uri.
-     *
-     * The SDK re-sends on `res` if this method throws, so nothing may throw
-     * after the response has gone out.
-     */
-    async authorize(client, params, res) {
-        // Asking to authorize is use: it keeps a registration out of the sweep for
-        // never-confirmed clients, so a user who takes their time over the password
-        // does not have the registration deleted underneath them.
-        this.store.touchClient(client.client_id);
-        const resource = this.resolveResource(params.resource);
-        const session = this.readSessionCookie(res.req.headers.cookie);
-        if (session && this.isApproved(client, params.redirectUri)) {
-            this.redirectWithCode(client, { ...params, resource }, res);
-            return;
-        }
-        const request = this.signPending(client, { ...params, resource });
-        // A metadata-document client is identified by a URL nobody can forge, so
-        // the page can show where the self-declared name came from.
-        const identity = { clientName: client.client_name, resource: resource?.href, ...this.clientIdentity(client) };
-        const page = session
-            ? renderConsentPage(request, this.csrfToken(session), params.redirectUri, identity)
-            : renderLoginPage(request, params.redirectUri, identity);
-        // Submitting either form ends in a redirect to this client's redirect_uri,
-        // which the SDK has already matched against its registration.
-        allowFormActionTo(res, params.redirectUri);
-        res.status(200).type('html').send(page);
-    }
-    /** Everything the login/consent form has to carry across, signed so it
-     *  cannot be tampered with while it sits in the browser. */
-    signPending(client, params) {
-        const resource = this.resolveResource(params.resource);
-        const pending = {
-            clientId: client.client_id,
-            redirectUri: params.redirectUri,
-            codeChallenge: params.codeChallenge,
-            state: params.state,
-            scopes: params.scopes ?? [],
-            exp: Date.now() + CODE_TTL_MS,
-            resource: resource?.href
-        };
-        return signPayload(pending, this.store.cookieSecret);
-    }
-    isApproved(client, redirectUri) {
-        const approval = this.store.getApproval(client.client_id);
-        // Same matching the SDK applies at registration, so a loopback client that
-        // picks a fresh port every run stays approved.
-        return approval?.redirectUris.some(uri => redirectUriMatches(redirectUri, uri)) ?? false;
-    }
-    approve(client, redirectUri) {
-        this.store.saveApproval(client.client_id, redirectUri, client.client_name);
-        console.log(`mcp-hub: approved OAuth client ${logSafe(client.client_id)} (${logSafe(client.client_name ?? 'unnamed')}) for ${logSafe(redirectUri)}`);
-    }
-    decodePendingAuthorization(token) {
-        const pending = readSignedPayload(token, this.store.cookieSecret);
-        if (!pending || pending.exp < Date.now())
-            return undefined;
-        return pending;
-    }
-    redirectWithCode(client, params, res) {
-        const resource = typeof params.resource === 'string' ? params.resource : this.resolveResource(params.resource)?.href;
-        const code = crypto.randomBytes(32).toString('base64url');
-        this.sweepExpiredCodes();
-        this.codes.set(code, {
-            clientId: client.client_id,
-            codeChallenge: params.codeChallenge,
-            redirectUri: params.redirectUri,
-            scopes: params.scopes ?? [],
-            expiresAt: Date.now() + CODE_TTL_MS,
-            resource
-        });
-        const target = new URL(params.redirectUri);
-        target.searchParams.set('code', code);
-        if (params.state !== undefined)
-            target.searchParams.set('state', params.state);
-        res.redirect(target.toString());
-    }
-    /** RFC 6749 §4.1.2.1 — tell the client it was turned down instead of
-     *  leaving it to time out. */
-    redirectWithError(redirectUri, state, error, res) {
-        const target = new URL(redirectUri);
-        target.searchParams.set('error', error);
-        if (state !== undefined)
-            target.searchParams.set('state', state);
-        res.redirect(target.toString());
-    }
-    /** Codes are otherwise only dropped on redemption, so unredeemed ones from
-     *  anyone who can register a client would accumulate for the process' life. */
-    sweepExpiredCodes() {
-        const now = Date.now();
-        for (const [code, pending] of this.codes) {
-            if (pending.expiresAt < now)
-                this.codes.delete(code);
-        }
-    }
-    // --- Session cookie ------------------------------------------------------
-    createSessionCookie() {
-        const expires = String(Date.now() + SESSION_TTL_MS);
-        return `${expires}.${sign(expires, this.store.cookieSecret)}`;
-    }
-    /** The verified cookie value, which doubles as the handle the consent
-     *  form's CSRF token is bound to. */
-    readSessionCookie(cookieHeader) {
-        const match = cookieHeader?.match(new RegExp(`(?:^|;\\s*)${this.sessionCookieName}=([^;]+)`));
-        if (!match)
-            return undefined;
-        const value = decodeURIComponent(match[1]);
-        const [expires, signature] = value.split('.');
-        if (!expires || !signature)
-            return undefined;
-        if (!signatureMatches(expires, signature, this.store.cookieSecret))
-            return undefined;
-        return Number(expires) > Date.now() ? value : undefined;
-    }
-    hasValidSession(cookieHeader) {
-        return this.readSessionCookie(cookieHeader) !== undefined;
-    }
-    csrfToken(sessionValue) {
-        return sign(`csrf:${sessionValue}`, this.store.cookieSecret);
-    }
-    verifyCsrfToken(sessionValue, token) {
-        if (typeof token !== 'string')
-            return false;
-        return signatureMatches(`csrf:${sessionValue}`, token, this.store.cookieSecret);
-    }
-    // --- Token endpoint ------------------------------------------------------
-    async challengeForAuthorizationCode(_client, authorizationCode) {
-        const pending = this.codes.get(authorizationCode);
-        if (!pending || pending.expiresAt < Date.now())
-            throw new InvalidGrantError('Invalid or expired authorization code');
-        return pending.codeChallenge;
-    }
-    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
-        const pending = this.codes.get(authorizationCode);
-        if (!pending || pending.expiresAt < Date.now() || pending.clientId !== client.client_id) {
-            throw new InvalidGrantError('Invalid or expired authorization code');
-        }
-        if (redirectUri !== undefined && redirectUri !== pending.redirectUri) {
-            throw new InvalidGrantError('redirect_uri does not match the authorization request');
-        }
-        const requestedResource = resource ? this.resolveResource(resource) : undefined;
-        if (resource && requestedResource?.href !== pending.resource) {
-            throw new InvalidGrantError('resource does not match the authorization request');
-        }
-        this.codes.delete(authorizationCode); // single use
-        this.store.touchClient(client.client_id);
-        return this.issueTokens(client.client_id, pending.scopes, undefined, pending.resource);
-    }
-    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
-        const record = this.store.getRefreshToken(refreshToken);
-        if (!record || record.clientId !== client.client_id) {
-            // Seeing a token that was already rotated away means the chain leaked:
-            // the legitimate holder and someone else both have one. Drop them all.
-            const consumed = this.store.wasConsumed(refreshToken);
-            if (consumed) {
-                const revoked = this.store.revokeFamily(consumed.familyId);
-                console.warn(`mcp-hub: refresh token replay from client ${logSafe(client.client_id)}, revoked ${revoked} token(s)`);
-            }
-            throw new InvalidGrantError('Invalid refresh token');
-        }
-        if (scopes && !scopes.every(scope => record.scopes.includes(scope))) {
-            throw new InvalidGrantError('Requested scopes exceed the original grant');
-        }
-        const requestedResource = resource ? this.resolveResource(resource) : undefined;
-        if (resource && !requestedResource)
-            throw new InvalidTargetError('Unknown or invalid resource');
-        if (record.resource && requestedResource && record.resource !== requestedResource.href) {
-            throw new InvalidGrantError('resource does not match the original grant');
-        }
-        const tokenResource = requestedResource?.href ?? record.resource;
-        if (this.options.requireResource && !tokenResource)
-            throw new InvalidTargetError('A resource indicator is required');
-        // Tokens issued before families existed adopt one on their first rotation.
-        const familyId = record.familyId ?? crypto.randomBytes(16).toString('base64url');
-        this.store.touchClient(client.client_id);
-        this.store.consumeRefreshToken(refreshToken, familyId, record.expiresAt);
-        return this.issueTokens(client.client_id, scopes ?? record.scopes, familyId, tokenResource);
-    }
-    async issueTokens(clientId, scopes, familyId = crypto.randomBytes(16).toString('base64url'), resource) {
-        const issuedMs = Date.now();
-        const accessToken = await new SignJWT({ client_id: clientId, scope: scopes.join(' '), issued_ms: issuedMs })
-            .setProtectedHeader({ alg: 'EdDSA' })
-            .setIssuer(this.externalUrl)
-            .setAudience(resource ?? this.externalUrl)
-            .setSubject('mcp-hub-user')
-            .setIssuedAt()
-            .setExpirationTime(`${ACCESS_TOKEN_TTL_S}s`)
-            .setJti(crypto.randomBytes(8).toString('base64url'))
-            .sign(this.store.privateKey);
-        const refreshToken = `rt_${crypto.randomBytes(32).toString('base64url')}`;
-        this.store.saveRefreshToken(refreshToken, {
-            clientId,
-            scopes,
-            expiresAt: Math.floor(Date.now() / 1000) + REFRESH_TOKEN_TTL_S,
-            familyId,
-            resource
-        });
-        return {
-            access_token: accessToken,
-            token_type: 'Bearer',
-            expires_in: ACCESS_TOKEN_TTL_S,
-            refresh_token: refreshToken,
-            scope: scopes.join(' ') || undefined
-        };
-    }
-    async verifyAccessToken(token) {
-        let payload;
-        try {
-            ({ payload } = await jwtVerify(token, this.store.publicKey, {
-                issuer: this.externalUrl,
-                algorithms: ['EdDSA']
-            }));
-        }
-        catch {
-            throw new InvalidTokenError('Invalid or expired access token');
-        }
-        // Admin-minted API token: same signature and audience rules as an OAuth
-        // access token, but revocation lives in its state record — a jti whose
-        // record is gone (revoked or expired) is refused even though the JWT
-        // itself still verifies.
-        if (payload.sub === API_TOKEN_SUBJECT) {
-            if (typeof payload.jti !== 'string' || !this.store.getApiToken(payload.jti)) {
-                throw new InvalidTokenError('Access token has been revoked');
-            }
-            const audience = typeof payload.aud === 'string' ? payload.aud : undefined;
-            const resource = audience ? this.resolveResourceStrict(audience) : undefined;
-            if (!resource)
-                throw new InvalidTokenError('Invalid token audience');
-            return { token, clientId: `token:${payload.jti}`, scopes: [], expiresAt: payload.exp, resource };
-        }
-        if (payload.sub !== 'mcp-hub-user' || typeof payload.client_id !== 'string') {
-            throw new InvalidTokenError('Invalid access token claims');
-        }
-        const audience = typeof payload.aud === 'string' ? payload.aud : undefined;
-        const resource = audience && audience !== this.externalUrl ? this.resolveResourceStrict(audience) : undefined;
-        if (!audience || (audience !== this.externalUrl && !resource))
-            throw new InvalidTokenError('Invalid token audience');
-        const issuedMs = typeof payload.issued_ms === 'number' ? payload.issued_ms : (payload.iat ?? 0) * 1000;
-        const revokedBefore = this.store.getRevokedBefore(payload.client_id);
-        if (revokedBefore !== undefined && issuedMs <= revokedBefore)
-            throw new InvalidTokenError('Access token has been revoked');
-        return {
-            token,
-            clientId: payload.client_id,
-            scopes: typeof payload.scope === 'string' && payload.scope.length > 0 ? payload.scope.split(' ') : [],
-            expiresAt: payload.exp,
-            resource
-        };
-    }
-    /** Audience check for already-issued tokens: never falls back to a default. */
-    resolveResourceStrict(audience) {
-        let url;
-        try {
-            url = new URL(audience);
-        }
-        catch {
-            return undefined;
-        }
-        return this.options.resolveResource?.(url);
-    }
-    async revokeToken(client, request) {
-        const record = this.store.getRefreshToken(request.token);
-        if (record && record.clientId === client.client_id)
-            this.store.deleteRefreshToken(request.token);
-        // Individual JWTs are not stored; the offline admin command revokes all
-        // access and refresh tokens for a client through the revokedBefore marker.
-    }
-    resolveResource(resource) {
-        if (!resource) {
-            // Real clients omit the RFC 8707 parameter (older Codex logins, Google
-            // ADK, Gemini Enterprise). DEFAULT_RESOURCE lets the operator route
-            // those onto one chosen resource instead of turning them away — the
-            // token is still bound, never global.
-            if (this.options.defaultResource)
-                return this.options.defaultResource;
-            if (this.options.requireResource)
-                throw new InvalidTargetError('A resource indicator is required');
-            return undefined;
-        }
-        const resolved = this.options.resolveResource?.(resource);
-        if (!resolved)
-            throw new InvalidTargetError('Unknown or invalid resource');
-        return resolved;
-    }
-}
-//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAK1C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6DAA6D,CAAC;AAEjG,OAAO,EAAgB,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;AAClG,CAAC;AAiCD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgB,EAChB,WAAmB,EACnB,QAAa,EACb,IAAY,EACZ,KAAa;IAEb,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;SAChC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;SACpC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC1B,UAAU,CAAC,iBAAiB,CAAC;SAC7B,WAAW,CAAC,GAAG,CAAC;SAChB,iBAAiB,CAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,EAAE,CAAC;SACV,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1B,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,OAAO,gBAAgB;IAOR,KAAK;IACL,WAAW;IACX,OAAO;IAR1B,+EAA+E;IAC9D,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE/C,iBAAiB,CAAS;IAEnC,YACmB,KAAgB,EAChB,WAAmB,EACnB,OAAO,GAA4B,EAAE;qBAFrC,KAAK;2BACL,WAAW;uBACX,OAAO;QAExB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,IAAI,YAAY;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,MAAM,cAAc,GAAG,CAAC,MAAkC,EAA8B,EAAE;YACxF,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC9D,MAAM,IAAI,0BAA0B,CAAC,gBAAgB,GAAG,4DAA4D,CAAC,CAAC;gBACxH,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,0BAA0B,KAAK,MAAM,CAAC;YAC9D,MAAM,MAAM,GAA+B;gBACzC,GAAG,MAAM;gBACT,oEAAoE;gBACpE,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC;gBACjD,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACvD,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAClD,iEAAiE;gBACjE,iEAAiE;gBACjE,iDAAiD;gBACjD,wBAAwB,EAAE,CAAC;aAC5B,CAAC;YACF,uEAAuE;YACvE,sEAAsE;YACtE,iEAAiE;YACjE,sEAAsE;YACtE,sDAAsD;YACtD,IAAI,QAAQ;gBAAE,OAAO,MAAM,CAAC,aAAa,CAAC;YAC1C,uEAAuE;YACvE,yEAAyE;YACzE,kCAAkC;YAClC,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,+DAA+D,KAAK,CAAC,YAAY,CAAC,UAAU,UAAU,CAAC,CAAC;gBACrH,MAAM,IAAI,oBAAoB,CAAC,+FAA+F,CAAC,CAAC;YAClI,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;YAClH,0EAA0E;YAC1E,wEAAwE;YACxE,wEAAwE;YACxE,OAAO;gBACL,GAAG,MAAM;gBACT,yBAAyB,EAAE,iBAAiB;gBAC5C,uBAAuB,EAAE,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC;gBAClF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E,CAAC;QAClC,CAAC,CAAC;QACF,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrH,wEAAwE;YACxE,uEAAuE;YACvE,+BAA+B;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED;4EACwE;IACxE,wBAAwB,CAAC,QAAgB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,MAAkC;QACvD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACxF,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,2EAA2E;QAC3E,4EAA4E;QAC5E,0DAA0D;QAC1D,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC;YACnF,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3D,2EAA2E;QAC3E,8DAA8D;QAC9D,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED;gEAC4D;IACpD,WAAW,CAAC,MAAkC,EAAE,MAA2B;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAyB;YACpC,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YAC7B,QAAQ,EAAE,QAAQ,EAAE,IAAI;SACzB,CAAC;QACF,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,UAAU,CAAC,MAAkC,EAAE,WAAmB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,2EAA2E;QAC3E,+CAA+C;QAC/C,OAAO,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3F,CAAC;IAED,OAAO,CAAC,MAAkC,EAAE,WAAmB;QAC7D,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,SAAS,OAAO,CAAC,WAAW,CAAC,EAAE,CACxI,CAAC;IACJ,CAAC;IAED,0BAA0B,CAAC,KAAa;QACtC,MAAM,OAAO,GAAG,iBAAiB,CAAuB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gBAAgB,CACd,MAAkC,EAClC,MAAkH,EAClH,GAAa;QAEb,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;QACrH,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;YACnC,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;kCAC8B;IAC9B,iBAAiB,CAAC,WAAmB,EAAE,KAAyB,EAAE,KAAa,EAAE,GAAa;QAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;mFAC+E;IACvE,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,mBAAmB;QACjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;QACpD,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;yCACqC;IACrC,iBAAiB,CAAC,YAAgC;QAChD,MAAM,KAAK,GAAG,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,iBAAiB,UAAU,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,eAAe,CAAC,YAAgC;QAC9C,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,YAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,YAAY,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,eAAe,CAAC,YAAoB,EAAE,KAAc;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,gBAAgB,CAAC,QAAQ,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,6BAA6B,CAAC,OAAmC,EAAE,iBAAyB;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACrH,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACrE,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,iBAAiB,EAAE,IAAI,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa;QACnD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,6CAA6C,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,OAAO,WAAW,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,QAAQ,IAAI,CAAC,iBAAiB;YAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAChG,IAAI,MAAM,CAAC,QAAQ,IAAI,iBAAiB,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,aAAa,GAAG,iBAAiB,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC;QACjE,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACrH,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC9F,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAAgB,EAChB,MAAgB,EAChB,QAAQ,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/D,QAAiB;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;aACzG,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;aAC3B,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC;aACzC,UAAU,CAAC,cAAc,CAAC;aAC1B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,kBAAkB,GAAG,CAAC;aAC3C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;aACnD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;YACxC,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;YAC9D,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,kBAAkB;YAC9B,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,WAAW;gBACxB,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnG,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5E,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACvG,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,aAAa,KAAK,SAAS,IAAI,QAAQ,IAAI,aAAa;YAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC3H,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACrG,SAAS,EAAE,OAAO,CAAC,GAAG;YACtB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,+EAA+E;IACvE,qBAAqB,CAAC,QAAgB;QAC5C,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAkC,EAAE,OAAoC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjG,wEAAwE;QACxE,2EAA2E;IAC7E,CAAC;IAEO,eAAe,CAAC,QAAyB;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACtE,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;YACnG,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}