@oneuptime/common 12.0.34 → 13.0.1

package/build/dist/Server/Services/UserWebAuthnService.js

@@ -11,13 +11,94 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/UserWebAuthn";
 import UserService from "./UserService";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import Hostname from "../../Types/API/Hostname";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from "@simplewebauthn/server";
 import { Host, HttpProtocol } from "../EnvironmentConfig";
 import ObjectID from "../../Types/ObjectID";
-import OneUptimeDate from "../../Types/Date";
+import Redis from "../Infrastructure/Redis";
+import DatabaseNotConnectedException from "../../Types/Exception/DatabaseNotConnectedException";
+import { randomBytes } from "crypto";
+import { URL } from "url";
 const WEBAUTHN_CHALLENGE_TTL_MINUTES = 5;
+const AUTHENTICATION_CHALLENGE_PREFIX = "webauthn-security-key-login-";
+const REGISTRATION_CHALLENGE_PREFIX = "webauthn-registration-";
+const PASSKEY_CHALLENGE_PREFIX = "webauthn-passkey-login-";
+/*
+ * One answer for both ways of having no security key to offer, because the
+ * route that asks is anonymous.
+ *
+ * `generateAuthenticationOptions` is reached by POSTing an email address and
+ * nothing else. It used to answer "User not found" for an address nobody has
+ * registered and "No WebAuthn credentials found for this user" for one that
+ * exists but has no key -- two distinguishable replies, which together are a
+ * free account-existence oracle for anyone who can send a request, and a
+ * second oracle telling them which of those accounts is protected by hardware.
+ *
+ * Every other door on this surface already refuses to say that much: the login
+ * routes deliberately do not reveal which half of a credential was wrong, and
+ * IdentityRateLimit answers identically for a real address and an invented
+ * one specifically so that being throttled does not give back the enumeration
+ * the handlers withhold. This route was the exception.
+ *
+ * Nothing legitimate is lost. A real user only reaches this after signing in
+ * with their password, from a list of their OWN registered keys returned by
+ * /login -- so they cannot arrive here with an account that has none, and the
+ * message they would never see is not worth an oracle to everyone else.
+ */
+const NO_SECURITY_KEY_AVAILABLE = "No security key is available for this account.";
+const WEBAUTHN_USER_VERIFICATION = "preferred";
+const requiresUserVerification = (policy) => {
+    return policy === "required";
+};
+const WEBAUTHN_REQUIRE_USER_VERIFICATION = requiresUserVerification(WEBAUTHN_USER_VERIFICATION);
+const explainVerificationFailure = async (verify) => {
+    try {
+        return await verify();
+    }
+    catch (err) {
+        if (err instanceof Exception) {
+            throw err;
+        }
+        throw new BadDataException(err instanceof Error && err.message
+            ? err.message
+            : "Could not verify this security key.");
+    }
+};
+const webAuthnRelyingPartyId = () => {
+    return Hostname.fromAuthority(Host.toString()).hostname;
+};
+const KNOWN_WEBAUTHN_TRANSPORTS = [
+    "ble",
+    "cable",
+    "hybrid",
+    "internal",
+    "nfc",
+    "smart-card",
+    "usb",
+];
+const parseStoredTransports = (stored) => {
+    if (!stored) {
+        return undefined;
+    }
+    let parsed = undefined;
+    try {
+        parsed = JSON.parse(stored);
+    }
+    catch (_a) {
+        return undefined;
+    }
+    if (!Array.isArray(parsed)) {
+        return undefined;
+    }
+    const transports = parsed.filter((transport) => {
+        return (typeof transport === "string" &&
+            KNOWN_WEBAUTHN_TRANSPORTS.includes(transport));
+    });
+    return transports.length > 0 ? transports : undefined;
+};
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
@@ -46,6 +127,7 @@ export class Service extends DatabaseService {
             },
             select: {
                 credentialId: true,
+                transports: true,
             },
             limit: LIMIT_PER_PROJECT,
             skip: 0,
@@ -55,7 +137,7 @@ export class Service extends DatabaseService {
         });
         const options = await generateRegistrationOptions({
             rpName: "OneUptime",
-            rpID: Host.toString(),
+            rpID: this.getRelyingParty().rpID,
             userID: new Uint8Array(Buffer.from(data.userId.toString())),
             userName: user.email.toString(),
             userDisplayName: user.name ? user.name.toString() : user.email.toString(),
@@ -65,36 +147,24 @@ export class Service extends DatabaseService {
                 return cred.credentialId;
             })
                 .map((cred) => {
-                return {
-                    id: cred.credentialId,
-                    type: "public-key",
-                };
+                /* Same hint as allowCredentials carries; see the note there. */
+                const transports = parseStoredTransports(cred.transports);
+                return Object.assign({ id: cred.credentialId, type: "public-key" }, (transports ? { transports } : {}));
             }),
             authenticatorSelection: {
-                residentKey: "discouraged",
-                userVerification: "preferred",
-            },
-        });
-        // Convert to JSON serializable format
-        options.challenge = Buffer.from(options.challenge).toString("base64url");
-        if (options.excludeCredentials) {
-            options.excludeCredentials = options.excludeCredentials.map((cred) => {
-                return Object.assign(Object.assign({}, cred), { id: typeof cred.id === "string"
-                        ? cred.id
-                        : Buffer.from(cred.id).toString("base64url") });
-            });
-        }
-        // Store the challenge server-side so verification uses a trusted value
-        await UserService.updateOneById({
-            id: data.userId,
-            data: {
-                webauthnChallenge: options.challenge,
-                webauthnChallengeExpiresAt: OneUptimeDate.addRemoveMinutes(OneUptimeDate.getCurrentDate(), WEBAUTHN_CHALLENGE_TTL_MINUTES),
-            },
-            props: {
-                isRoot: true,
+                residentKey: data.isPasskey === true ? "required" : "discouraged",
+                userVerification: data.isPasskey === true ? "required" : WEBAUTHN_USER_VERIFICATION,
             },
         });
+        /*
+         * SimpleWebAuthn already returns base64url JSON. Preserve the exact
+         * challenge, and bind the verification requirement to server-side state.
+         */
+        await this.storeChallenge(`${REGISTRATION_CHALLENGE_PREFIX}${data.userId.toString()}`, JSON.stringify({
+            challenge: options.challenge,
+            requireUserVerification: data.isPasskey === true || WEBAUTHN_REQUIRE_USER_VERIFICATION,
+            isPasskey: data.isPasskey === true,
+        }));
         return {
             options: options,
             challenge: options.challenge,
@@ -104,14 +174,19 @@ export class Service extends DatabaseService {
         if (!data.props.userId) {
             throw new BadDataException("User ID not found in request");
         }
-        // Retrieve the challenge from the server-side store
-        const storedChallenge = await this.getAndClearStoredChallenge(data.props.userId);
-        const expectedOrigin = `${HttpProtocol}${Host.toString()}`;
-        const verification = await verifyRegistrationResponse({
-            response: data.credential,
-            expectedChallenge: storedChallenge,
-            expectedOrigin: expectedOrigin,
-            expectedRPID: Host.toString(),
+        const storedChallenge = JSON.parse(await this.consumeChallenge(`${REGISTRATION_CHALLENGE_PREFIX}${data.props.userId.toString()}`));
+        if (!storedChallenge.challenge ||
+            typeof storedChallenge.requireUserVerification !== "boolean") {
+            throw new BadDataException("Invalid registration challenge");
+        }
+        const verification = await explainVerificationFailure(() => {
+            return verifyRegistrationResponse({
+                response: data.credential,
+                expectedChallenge: storedChallenge.challenge,
+                expectedOrigin: this.getRelyingParty().origin,
+                expectedRPID: this.getRelyingParty().rpID,
+                requireUserVerification: storedChallenge.requireUserVerification,
+            });
         });
         if (!verification.verified) {
             throw new BadDataException("Registration verification failed");
@@ -120,19 +195,61 @@ export class Service extends DatabaseService {
         if (!registrationInfo) {
             throw new BadDataException("Registration info not found");
         }
+        if (storedChallenge.requireUserVerification &&
+            !registrationInfo.userVerified) {
+            throw new BadDataException("Passkey registration requires user verification");
+        }
         // Save the credential
         const userWebAuthn = Model.fromJSON({
             name: data.name,
             credentialId: registrationInfo.credential.id,
             publicKey: Buffer.from(registrationInfo.credential.publicKey).toString("base64"),
-            counter: "0",
-            transports: JSON.stringify([]),
+            /*
+             * From the authenticator, not hard-coded.
+             *
+             * The counter used to be written as "0" regardless. Most platform
+             * authenticators do report 0 -- a passkey synced between devices
+             * cannot keep a meaningful count -- but a discrete key that has been
+             * used elsewhere arrives with a real one, and pinning it to 0 threw
+             * that away. `verifyAuthenticationResponse` only compares counters
+             * when at least one side is above zero, so the discarded value was
+             * precisely the clone detection this credential was eligible for:
+             * a key registered at count 40 and a clone of it replaying count 12
+             * both looked fine against a stored 0.
+             *
+             * The trade is not free, and the tail is worth naming: an
+             * authenticator that reports the SAME counter at registration and at
+             * its first assertion now fails that comparison, where a stored 0
+             * would have waved it through. A spec-compliant key increments on
+             * every assertion, so this should not happen -- but if it does, the
+             * key is unusable and the way back in is a backup code (minted at
+             * enrolment, see UserWebAuthnAPI) followed by registering it again.
+             * The alternative is to keep discarding the counter and keep the
+             * clone detection permanently off, which is the worse default.
+             *
+             * Transports were likewise always "[]". They are the browser's hint
+             * about HOW to reach this key -- USB, NFC, the platform itself -- and
+             * with none recorded every sign-in prompt has to offer all of them.
+             */
+            counter: typeof registrationInfo.credential.counter === "number"
+                ? registrationInfo.credential.counter.toString()
+                : "0",
+            transports: JSON.stringify(registrationInfo.credential.transports || []),
             isVerified: true,
+            /*
+             * Use only the server-bound ceremony purpose, never a client assertion.
+             * Challenges created just before an upgrade retain the legacy unknown value.
+             */
+            isPasskey: storedChallenge.isPasskey,
             userId: data.props.userId,
         }, Model);
         await this.create({
             data: userWebAuthn,
-            props: data.props,
+            /*
+             * The credential and its purpose have been verified above. The purpose is
+             * read-only through CRUD; only this verified registration path writes it.
+             */
+            props: Object.assign(Object.assign({}, data.props), { isRoot: true }),
         });
     }
     async generateAuthenticationOptions(data) {
@@ -146,7 +263,7 @@ export class Service extends DatabaseService {
             },
         });
         if (!user) {
-            throw new BadDataException("User not found");
+            throw new BadDataException(NO_SECURITY_KEY_AVAILABLE);
         }
         // Get user's WebAuthn credentials
         const credentials = await this.findBy({
@@ -156,6 +273,7 @@ export class Service extends DatabaseService {
             },
             select: {
                 credentialId: true,
+                transports: true,
             },
             limit: LIMIT_PER_PROJECT,
             skip: 0,
@@ -164,41 +282,56 @@ export class Service extends DatabaseService {
             },
         });
         if (credentials.length === 0) {
-            throw new BadDataException("No WebAuthn credentials found for this user");
+            throw new BadDataException(NO_SECURITY_KEY_AVAILABLE);
         }
         const options = await generateAuthenticationOptions({
-            rpID: Host.toString(),
+            rpID: this.getRelyingParty().rpID,
             allowCredentials: credentials.map((cred) => {
-                return {
-                    id: cred.credentialId,
-                    type: "public-key",
-                };
+                /*
+                 * Recording transports at registration buys nothing unless they are
+                 * handed back here: this is the only place the browser reads them.
+                 * With the hint, a key that says "usb" prompts for a USB key rather
+                 * than opening the whole carousel of ways a credential might be
+                 * reachable. `generateAuthenticationOptions` copies unknown fields
+                 * straight through onto the descriptor, and Login.tsx rewrites only
+                 * `id`, so the array survives to navigator.credentials.get().
+                 *
+                 * SPREAD rather than `transports: undefined`, so a credential with no
+                 * hint carries no `transports` member at all. The two are not the
+                 * same to a browser -- an empty array is a hint that excludes every
+                 * transport, and Chromium filters on the hint when it is present, so
+                 * an empty one could hide a key that works perfectly well.
+                 */
+                const transports = parseStoredTransports(cred.transports);
+                return Object.assign({ id: cred.credentialId, type: "public-key" }, (transports ? { transports } : {}));
             }),
-            userVerification: "preferred",
-        });
-        // Convert to JSON serializable format
-        options.challenge = Buffer.from(options.challenge).toString("base64url");
-        // allowCredentials id is already base64url string
-        // Store the challenge server-side so verification uses a trusted value
-        await UserService.updateOneById({
-            id: user.id,
-            data: {
-                webauthnChallenge: options.challenge,
-                webauthnChallengeExpiresAt: OneUptimeDate.addRemoveMinutes(OneUptimeDate.getCurrentDate(), WEBAUTHN_CHALLENGE_TTL_MINUTES),
-            },
-            props: {
-                isRoot: true,
-            },
+            userVerification: WEBAUTHN_USER_VERIFICATION,
         });
+        await this.storeChallenge(`${AUTHENTICATION_CHALLENGE_PREFIX}${user.id.toString()}`, options.challenge);
+        /*
+         * The anonymous caller gets the ceremony and nothing else.
+         *
+         * This used to hand back `userId` too -- the account's real row id, to
+         * anybody who could name an email address with a key on it. Nothing ever
+         * read it: the browser posts the assertion to /verify-webauthn-auth along
+         * with the email and password again, and that route takes the user from
+         * the password it has just verified
+         * (App/FeatureSet/Identity/API/Authentication.ts), never from the body.
+         *
+         * So it was an identifier handed to strangers for free, on the one route
+         * that has just been made careful about what it tells them -- and it would
+         * have undone half of that: unifying the two refusals stops a caller
+         * learning whether an account exists, while a success that carries its
+         * internal id tells them rather more than that.
+         */
         return {
             options: options,
             challenge: options.challenge,
-            userId: user.id.toString(),
         };
     }
     async verifyAuthentication(data) {
         // Retrieve the challenge from the server-side store
-        const storedChallenge = await this.getAndClearStoredChallenge(new ObjectID(data.userId));
+        const storedChallenge = await this.consumeChallenge(`${AUTHENTICATION_CHALLENGE_PREFIX}${new ObjectID(data.userId).toString()}`);
         const user = await UserService.findOneById({
             id: new ObjectID(data.userId),
             select: {
@@ -232,17 +365,19 @@ export class Service extends DatabaseService {
         if (!dbCredential) {
             throw new BadDataException("Credential not found");
         }
-        const expectedOrigin = `${HttpProtocol}${Host.toString()}`;
-        const verification = await verifyAuthenticationResponse({
-            response: data.credential,
-            expectedChallenge: storedChallenge,
-            expectedOrigin: expectedOrigin,
-            expectedRPID: Host.toString(),
-            credential: {
-                id: dbCredential.credentialId,
-                publicKey: Buffer.from(dbCredential.publicKey, "base64"),
-                counter: parseInt(dbCredential.counter),
-            },
+        const verification = await explainVerificationFailure(() => {
+            return verifyAuthenticationResponse({
+                response: data.credential,
+                expectedChallenge: storedChallenge,
+                requireUserVerification: WEBAUTHN_REQUIRE_USER_VERIFICATION,
+                expectedOrigin: this.getRelyingParty().origin,
+                expectedRPID: this.getRelyingParty().rpID,
+                credential: {
+                    id: dbCredential.credentialId,
+                    publicKey: Buffer.from(dbCredential.publicKey, "base64"),
+                    counter: parseInt(dbCredential.counter),
+                },
+            });
         });
         if (!verification.verified) {
             throw new BadDataException("Authentication verification failed");
@@ -259,54 +394,139 @@ export class Service extends DatabaseService {
         });
         return user;
     }
-    /**
-     * Retrieves the stored WebAuthn challenge for the given user,
-     * validates it has not expired, and clears it so it cannot be reused.
-     */
-    async getAndClearStoredChallenge(userId) {
-        const user = await UserService.findOneById({
-            id: userId,
-            select: {
-                webauthnChallenge: true,
-                webauthnChallengeExpiresAt: true,
+    async generatePasskeyAuthenticationOptions() {
+        /*
+         * No email or credential allow-list is needed: the authenticator offers
+         * the discoverable credentials registered for this relying party.
+         */
+        const options = await generateAuthenticationOptions({
+            rpID: this.getRelyingParty().rpID,
+            allowCredentials: [],
+            userVerification: "required",
+        });
+        const challengeId = randomBytes(32).toString("base64url");
+        await this.storeChallenge(`${PASSKEY_CHALLENGE_PREFIX}${challengeId}`, options.challenge);
+        return { options, challengeId };
+    }
+    async verifyPasskeyAuthentication(data) {
+        var _a, _b, _c, _d;
+        if (typeof data.challengeId !== "string" ||
+            !data.challengeId.match(/^[A-Za-z0-9_-]{43}$/)) {
+            throw new BadDataException("Invalid passkey challenge");
+        }
+        /*
+         * Consume before validation. Failed assertions cannot reuse a challenge,
+         * and concurrent requests can never both claim the same ceremony.
+         */
+        const challenge = await this.consumeChallenge(`${PASSKEY_CHALLENGE_PREFIX}${data.challengeId}`);
+        if (typeof ((_a = data.credential) === null || _a === void 0 ? void 0 : _a.id) !== "string" ||
+            !data.credential.id ||
+            data.credential.type !== "public-key" ||
+            data.credential.rawId !== data.credential.id ||
+            typeof ((_c = (_b = data.credential) === null || _b === void 0 ? void 0 : _b.response) === null || _c === void 0 ? void 0 : _c.userHandle) !== "string" ||
+            !data.credential.response.userHandle ||
+            !["clientDataJSON", "authenticatorData", "signature"].every((field) => {
+                return (typeof data.credential.response[field] === "string" &&
+                    data.credential.response[field].length > 0);
+            })) {
+            throw new BadDataException("Invalid passkey credential");
+        }
+        const dbCredential = await this.findOneBy({
+            query: {
+                credentialId: data.credential.id,
+                isVerified: true,
             },
-            props: {
-                isRoot: true,
+            select: {
+                _id: true,
+                userId: true,
+                credentialId: true,
+                publicKey: true,
+                counter: true,
             },
+            props: { isRoot: true },
         });
-        if (!user) {
-            throw new BadDataException("User not found");
+        if (!(dbCredential === null || dbCredential === void 0 ? void 0 : dbCredential.userId) ||
+            !dbCredential.id ||
+            !dbCredential.publicKey ||
+            !dbCredential.credentialId ||
+            data.credential.response.userHandle !==
+                Buffer.from(dbCredential.userId.toString()).toString("base64url")) {
+            throw new BadDataException("Passkey authentication failed");
         }
-        if (!user.webauthnChallenge || !user.webauthnChallengeExpiresAt) {
-            throw new BadDataException("No pending WebAuthn challenge found. Please initiate the WebAuthn flow again.");
+        const counter = Number(dbCredential.counter);
+        if (!dbCredential.counter ||
+            !dbCredential.counter.match(/^\d+$/) ||
+            !Number.isSafeInteger(counter) ||
+            counter < 0) {
+            throw new BadDataException("Invalid passkey counter");
         }
-        // Check expiry
-        if (OneUptimeDate.isBefore(user.webauthnChallengeExpiresAt, OneUptimeDate.getCurrentDate())) {
-            // Clear the expired challenge
-            await UserService.updateOneById({
-                id: userId,
-                data: {
-                    webauthnChallenge: null,
-                    webauthnChallengeExpiresAt: null,
-                },
-                props: {
-                    isRoot: true,
-                },
-            });
-            throw new BadDataException("WebAuthn challenge has expired. Please initiate the WebAuthn flow again.");
+        const verification = await verifyAuthenticationResponse({
+            response: data.credential,
+            expectedChallenge: challenge,
+            expectedOrigin: this.getRelyingParty().origin,
+            expectedRPID: this.getRelyingParty().rpID,
+            requireUserVerification: true,
+            credential: {
+                id: dbCredential.credentialId,
+                publicKey: new Uint8Array(Buffer.from(dbCredential.publicKey, "base64")),
+                counter,
+            },
+        });
+        if (!verification.verified ||
+            !((_d = verification.authenticationInfo) === null || _d === void 0 ? void 0 : _d.userVerified)) {
+            throw new BadDataException("Passkey authentication failed");
         }
-        const challenge = user.webauthnChallenge;
-        // Clear the challenge immediately so it cannot be reused (one-time use)
-        await UserService.updateOneById({
-            id: userId,
+        const updated = await this.updateOneById({
+            id: dbCredential.id,
             data: {
-                webauthnChallenge: null,
-                webauthnChallengeExpiresAt: null,
-            },
-            props: {
-                isRoot: true,
+                counter: verification.authenticationInfo.newCounter.toString(),
             },
+            props: { isRoot: true },
+        });
+        if (updated !== 1) {
+            throw new BadDataException("Passkey authentication failed");
+        }
+        const user = await UserService.findOneById({
+            id: dbCredential.userId,
+            select: { _id: true, email: true },
+            props: { isRoot: true },
         });
+        if (!user) {
+            throw new BadDataException("Passkey authentication failed");
+        }
+        return user;
+    }
+    getRelyingParty() {
+        const origin = new URL(`${HttpProtocol}${Host.toString()}`);
+        /*
+         * Relying party IDs exclude the port; origins include it for installations
+         * hosted on a non-default port.
+         */
+        return { rpID: webAuthnRelyingPartyId(), origin: origin.origin };
+    }
+    getChallengeStore() {
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            throw new DatabaseNotConnectedException("Passkey challenge store is unavailable");
+        }
+        return client;
+    }
+    async storeChallenge(key, value) {
+        const result = await this.getChallengeStore().set(key, value, "EX", WEBAUTHN_CHALLENGE_TTL_MINUTES * 60);
+        if (result !== "OK") {
+            throw new BadDataException("Unable to create a WebAuthn challenge");
+        }
+    }
+    async consumeChallenge(key) {
+        /*
+         * A Lua GET+DEL works on Redis versions before GETDEL was introduced.
+         * Both operations execute atomically and the key remains subject to TTL.
+         */
+        const challenge = await this.getChallengeStore().eval("local value = redis.call('GET', KEYS[1]); " +
+            "if value then redis.call('DEL', KEYS[1]); end; return value", 1, key);
+        if (typeof challenge !== "string" || !challenge) {
+            throw new BadDataException("WebAuthn challenge expired or was already used. Please try again.");
+        }
         return challenge;
     }
     async onBeforeCreate(createBy) {
@@ -361,6 +581,18 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "verifyAuthentication", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "generatePasskeyAuthenticationOptions", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "verifyPasskeyAuthentication", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/UserWebAuthnService.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserWebAuthnService.js","sourceRoot":"","sources":["../../../../Server/Services/UserWebAuthnService.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,0CAA0C,CAAC;AAC7D,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAE7C,MAAM,8BAA8B,GAAW,CAAC,CAAC;AAEjD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGY,AAAN,KAAK,CAAC,2BAA2B,CAAC,IAExC;QACC,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,MAAM,EAAE;gBACN,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,IAAI;aACX;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,yCAAyC;QACzC,MAAM,mBAAmB,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC1D,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;aACnB;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAQ,MAAM,2BAA2B,CAAC;YACrD,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3D,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YACzE,eAAe,EAAE,MAAM;YACvB,kBAAkB,EAAE,mBAAmB;iBACpC,MAAM,CAAC,CAAC,IAAW,EAAE,EAAE;gBACtB,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,IAAW,EAAE,EAAE;gBACnB,OAAO;oBACL,EAAE,EAAE,IAAI,CAAC,YAAa;oBACtB,IAAI,EAAE,YAAY;iBACnB,CAAC;YACJ,CAAC,CAAC;YACJ,sBAAsB,EAAE;gBACtB,WAAW,EAAE,aAAa;gBAC1B,gBAAgB,EAAE,WAAW;aAC9B;SACF,CAAC,CAAC;QAEH,sCAAsC;QACtC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,CACzD,CAAC,IAAS,EAAE,EAAE;gBACZ,uCACK,IAAI,KACP,EAAE,EACA,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;wBACzB,CAAC,CAAC,IAAI,CAAC,EAAE;wBACT,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAChD;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,MAAM,WAAW,CAAC,aAAa,CAAC;YAC9B,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,IAAI,EAAE;gBACJ,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,0BAA0B,EAAE,aAAa,CAAC,gBAAgB,CACxD,aAAa,CAAC,cAAc,EAAE,EAC9B,8BAA8B,CAC/B;aACF;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,OAAc;YACvB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAGY,AAAN,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,GAAW,MAAM,IAAI,CAAC,0BAA0B,CACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAClB,CAAC;QAEF,MAAM,cAAc,GAAW,GAAG,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEnE,MAAM,YAAY,GAAQ,MAAM,0BAA0B,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,iBAAiB,EAAE,eAAe;YAClC,cAAc,EAAE,cAAc;YAC9B,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;SAC9B,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE1C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;QAC5D,CAAC;QAED,sBAAsB;QACtB,MAAM,YAAY,GAAU,KAAK,CAAC,QAAQ,CACxC;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE;YAC5C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CACpE,QAAQ,CACT;YACD,OAAO,EAAE,GAAG;YACZ,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SAC1B,EACD,KAAK,CACG,CAAC;QAEX,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B,CAAC,IAE1C;QACC,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC5B,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAClD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,EAAG;gBAChB,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;aACnB;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,OAAO,GAAQ,MAAM,6BAA6B,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAW,EAAE,EAAE;gBAChD,OAAO;oBACL,EAAE,EAAE,IAAI,CAAC,YAAa;oBACtB,IAAI,EAAE,YAAY;iBACnB,CAAC;YACJ,CAAC,CAAC;YACF,gBAAgB,EAAE,WAAW;SAC9B,CAAC,CAAC;QAEH,sCAAsC;QACtC,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,kDAAkD;QAElD,uEAAuE;QACvE,MAAM,WAAW,CAAC,aAAa,CAAC;YAC9B,EAAE,EAAE,IAAI,CAAC,EAAG;YACZ,IAAI,EAAE;gBACJ,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,0BAA0B,EAAE,aAAa,CAAC,gBAAgB,CACxD,aAAa,CAAC,cAAc,EAAE,EAC9B,8BAA8B,CAC/B;aACF;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,OAAc;YACvB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE;SAC5B,CAAC;IACJ,CAAC;IAGY,AAAN,KAAK,CAAC,oBAAoB,CAAC,IAGjC;QACC,oDAAoD;QACpD,MAAM,eAAe,GAAW,MAAM,IAAI,CAAC,0BAA0B,CACnE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAC1B,CAAC;QAEF,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,IAAI;aACZ;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,mCAAmC;QACnC,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YACtD,KAAK,EAAE;gBACL,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAChC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,cAAc,GAAW,GAAG,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEnE,MAAM,YAAY,GAAQ,MAAM,4BAA4B,CAAC;YAC3D,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,iBAAiB,EAAE,eAAe;YAClC,cAAc,EAAE,cAAc;YAC9B,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC7B,UAAU,EAAE;gBACV,EAAE,EAAE,YAAY,CAAC,YAAa;gBAC9B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAU,EAAE,QAAQ,CAAC;gBACzD,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,OAAQ,CAAC;aAClC;SACT,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;QACnE,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,CAAC,aAAa,CAAC;YACvB,EAAE,EAAE,YAAY,CAAC,EAAG;YACpB,IAAI,EAAE;gBACJ,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE;aAC/D;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,0BAA0B,CAAC,MAAgB;QACvD,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,MAAM;YACV,MAAM,EAAE;gBACN,iBAAiB,EAAE,IAAI;gBACvB,0BAA0B,EAAE,IAAI;aACjC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CACxB,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,eAAe;QACf,IACE,aAAa,CAAC,QAAQ,CACpB,IAAI,CAAC,0BAA0B,EAC/B,aAAa,CAAC,cAAc,EAAE,CAC/B,EACD,CAAC;YACD,8BAA8B;YAC9B,MAAM,WAAW,CAAC,aAAa,CAAC;gBAC9B,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE;oBACJ,iBAAiB,EAAE,IAAW;oBAC9B,0BAA0B,EAAE,IAAW;iBACxC;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,MAAM,IAAI,gBAAgB,CACxB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAW,IAAI,CAAC,iBAAiB,CAAC;QAEjD,wEAAwE;QACxE,MAAM,WAAW,CAAC,aAAa,CAAC;YAC9B,EAAE,EAAE,MAAM;YACV,IAAI,EAAE;gBACJ,iBAAiB,EAAE,IAAW;gBAC9B,0BAA0B,EAAE,IAAW;aACxC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAE7C,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,MAAM,EAAE;gBACN,KAAK,EAAE,IAAI;aACZ;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,0FAA0F;QAE1F,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEhC,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;CA0BF;AApbc;IADZ,WAAW,EAAE;;;;0DAgGb;AAGY;IADZ,WAAW,EAAE;;;;iDAsDb;AAGY;IADZ,WAAW,EAAE;;;;4DAyEb;AAGY;IADZ,WAAW,EAAE;;;;mDA6Eb;AAsEwB;IADxB,WAAW,EAAE;;;;6CAoCb;AA4BH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"UserWebAuthnService.js","sourceRoot":"","sources":["../../../../Server/Services/UserWebAuthnService.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,0CAA0C,CAAC;AAC7D,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,SAAS,MAAM,iCAAiC,CAAC;AACxD,OAAO,QAAQ,MAAM,0BAA0B,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,OAAO,KAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,6BAA6B,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE1B,MAAM,8BAA8B,GAAW,CAAC,CAAC;AACjD,MAAM,+BAA+B,GAAW,8BAA8B,CAAC;AAC/E,MAAM,6BAA6B,GAAW,wBAAwB,CAAC;AACvE,MAAM,wBAAwB,GAAW,yBAAyB,CAAC;AAQnE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,yBAAyB,GAC7B,gDAAgD,CAAC;AAoBnD,MAAM,0BAA0B,GAA6B,WAAW,CAAC;AAmCzE,MAAM,wBAAwB,GAAqC,CACjE,MAAgC,EACvB,EAAE;IACX,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,kCAAkC,GAAY,wBAAwB,CAC1E,0BAA0B,CAC3B,CAAC;AA8BF,MAAM,0BAA0B,GAAmC,KAAK,EACtE,MAA0B,EACZ,EAAE;IAChB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,gBAAgB,CACxB,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO;YACjC,CAAC,CAAC,GAAG,CAAC,OAAO;YACb,CAAC,CAAC,qCAAqC,CAC1C,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AA4BF,MAAM,sBAAsB,GAAmC,GAAW,EAAE;IAC1E,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;AAC1D,CAAC,CAAC;AAgCF,MAAM,yBAAyB,GAAkB;IAC/C,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,KAAK;IACL,YAAY;IACZ,KAAK;CACN,CAAC;AAMF,MAAM,qBAAqB,GAA4B,CACrD,MAA0B,EACY,EAAE;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,GAAY,SAAS,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAA6B,MAAM,CAAC,MAAM,CACxD,CAAC,SAAkB,EAAE,EAAE;QACrB,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;YAC7B,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9C,CAAC;IACJ,CAAC,CAC0B,CAAC;IAE9B,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC,CAAC;AAEF,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGY,AAAN,KAAK,CAAC,2BAA2B,CAAC,IAGxC;QACC,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,MAAM,EAAE;gBACN,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,IAAI;aACX;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,yCAAyC;QACzC,MAAM,mBAAmB,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC1D,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;aACjB;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAQ,MAAM,2BAA2B,CAAC;YACrD,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI;YACjC,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3D,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YACzE,eAAe,EAAE,MAAM;YACvB,kBAAkB,EAAE,mBAAmB;iBACpC,MAAM,CAAC,CAAC,IAAW,EAAE,EAAE;gBACtB,OAAO,IAAI,CAAC,YAAY,CAAC;YAC3B,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,IAAW,EAAE,EAAE;gBACnB,gEAAgE;gBAChE,MAAM,UAAU,GACd,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzC,uBACE,EAAE,EAAE,IAAI,CAAC,YAAa,EACtB,IAAI,EAAE,YAAY,IACf,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrC;YACJ,CAAC,CAAC;YACJ,sBAAsB,EAAE;gBACtB,WAAW,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa;gBACjE,gBAAgB,EACd,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,0BAA0B;aACpE;SACF,CAAC,CAAC;QAEH;;;WAGG;QACH,MAAM,IAAI,CAAC,cAAc,CACvB,GAAG,6BAA6B,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAC3D,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,uBAAuB,EACrB,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,kCAAkC;YAC/D,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI;SACnC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,OAAc;YACvB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAGY,AAAN,KAAK,CAAC,kBAAkB,CAAC,IAI/B;QACC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,eAAe,GAA0B,IAAI,CAAC,KAAK,CACvD,MAAM,IAAI,CAAC,gBAAgB,CACzB,GAAG,6BAA6B,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAClE,CACuB,CAAC;QAE3B,IACE,CAAC,eAAe,CAAC,SAAS;YAC1B,OAAO,eAAe,CAAC,uBAAuB,KAAK,SAAS,EAC5D,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,gCAAgC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,YAAY,GAAQ,MAAM,0BAA0B,CAAC,GAAG,EAAE;YAC9D,OAAO,0BAA0B,CAAC;gBAChC,QAAQ,EAAE,IAAI,CAAC,UAAU;gBACzB,iBAAiB,EAAE,eAAe,CAAC,SAAS;gBAC5C,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM;gBAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI;gBACzC,uBAAuB,EAAE,eAAe,CAAC,uBAAuB;aACjE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAC;QAE1C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;QAC5D,CAAC;QAED,IACE,eAAe,CAAC,uBAAuB;YACvC,CAAC,gBAAgB,CAAC,YAAY,EAC9B,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,YAAY,GAAU,KAAK,CAAC,QAAQ,CACxC;YACE,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE;YAC5C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CACpE,QAAQ,CACT;YACD;;;;;;;;;;;;;;;;;;;;;;;;;;eA0BG;YACH,OAAO,EACL,OAAO,gBAAgB,CAAC,UAAU,CAAC,OAAO,KAAK,QAAQ;gBACrD,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAChD,CAAC,CAAC,GAAG;YACT,UAAU,EAAE,IAAI,CAAC,SAAS,CACxB,gBAAgB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAC7C;YACD,UAAU,EAAE,IAAI;YAChB;;;eAGG;YACH,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;SAC1B,EACD,KAAK,CACG,CAAC;QAEX,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,YAAY;YAClB;;;eAGG;YACH,KAAK,kCAAO,IAAI,CAAC,KAAK,KAAE,MAAM,EAAE,IAAI,GAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B,CAAC,IAE1C;QACC,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC5B,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAClD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,EAAG;gBAChB,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;aACjB;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAQ,MAAM,6BAA6B,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI;YACjC,gBAAgB,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAW,EAAE,EAAE;gBAChD;;;;;;;;;;;;;;mBAcG;gBACH,MAAM,UAAU,GACd,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzC,uBACE,EAAE,EAAE,IAAI,CAAC,YAAa,EACtB,IAAI,EAAE,YAAY,IACf,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrC;YACJ,CAAC,CAAC;YACF,gBAAgB,EAAE,0BAA0B;SAC7C,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,cAAc,CACvB,GAAG,+BAA+B,GAAG,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,EAAE,EAC1D,OAAO,CAAC,SAAS,CAClB,CAAC;QAEF;;;;;;;;;;;;;;;WAeG;QACH,OAAO;YACL,OAAO,EAAE,OAAc;YACvB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAGY,AAAN,KAAK,CAAC,oBAAoB,CAAC,IAGjC;QACC,oDAAoD;QACpD,MAAM,eAAe,GAAW,MAAM,IAAI,CAAC,gBAAgB,CACzD,GAAG,+BAA+B,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC5E,CAAC;QAEF,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,IAAI;aACZ;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,mCAAmC;QACnC,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YACtD,KAAK,EAAE;gBACL,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAChC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,YAAY,GAAQ,MAAM,0BAA0B,CAAC,GAAG,EAAE;YAC9D,OAAO,4BAA4B,CAAC;gBAClC,QAAQ,EAAE,IAAI,CAAC,UAAU;gBACzB,iBAAiB,EAAE,eAAe;gBAClC,uBAAuB,EAAE,kCAAkC;gBAC3D,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM;gBAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI;gBACzC,UAAU,EAAE;oBACV,EAAE,EAAE,YAAY,CAAC,YAAa;oBAC9B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAU,EAAE,QAAQ,CAAC;oBACzD,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,OAAQ,CAAC;iBAClC;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;QACnE,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,CAAC,aAAa,CAAC;YACvB,EAAE,EAAE,YAAY,CAAC,EAAG;YACpB,IAAI,EAAE;gBACJ,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE;aAC/D;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAGY,AAAN,KAAK,CAAC,oCAAoC;QAI/C;;;WAGG;QACH,MAAM,OAAO,GAAQ,MAAM,6BAA6B,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI;YACjC,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,WAAW,GAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElE,MAAM,IAAI,CAAC,cAAc,CACvB,GAAG,wBAAwB,GAAG,WAAW,EAAE,EAC3C,OAAO,CAAC,SAAS,CAClB,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAClC,CAAC;IAGY,AAAN,KAAK,CAAC,2BAA2B,CAAC,IAGxC;;QACC,IACE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YACpC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC;QAED;;;WAGG;QACH,MAAM,SAAS,GAAW,MAAM,IAAI,CAAC,gBAAgB,CACnD,GAAG,wBAAwB,GAAG,IAAI,CAAC,WAAW,EAAE,CACjD,CAAC;QAEF,IACE,OAAO,CAAA,MAAA,IAAI,CAAC,UAAU,0CAAE,EAAE,CAAA,KAAK,QAAQ;YACvC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACnB,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY;YACrC,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE;YAC5C,OAAO,CAAA,MAAA,MAAA,IAAI,CAAC,UAAU,0CAAE,QAAQ,0CAAE,UAAU,CAAA,KAAK,QAAQ;YACzD,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU;YACpC,CAAC,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC,KAAK,CACzD,CAAC,KAAa,EAAE,EAAE;gBAChB,OAAO,CACL,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,QAAQ;oBACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAC3C,CAAC;YACJ,CAAC,CACF,EACD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YACtD,KAAK,EAAE;gBACL,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAChC,UAAU,EAAE,IAAI;aACjB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,IAAI;aACd;YACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,IACE,CAAC,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,MAAM,CAAA;YACrB,CAAC,YAAY,CAAC,EAAE;YAChB,CAAC,YAAY,CAAC,SAAS;YACvB,CAAC,YAAY,CAAC,YAAY;YAC1B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU;gBACjC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EACnE,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAW,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAErD,IACE,CAAC,YAAY,CAAC,OAAO;YACrB,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YACpC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAC9B,OAAO,GAAG,CAAC,EACX,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAQ,MAAM,4BAA4B,CAAC;YAC3D,QAAQ,EAAE,IAAI,CAAC,UAAU;YACzB,iBAAiB,EAAE,SAAS;YAC5B,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM;YAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI;YACzC,uBAAuB,EAAE,IAAI;YAC7B,UAAU,EAAE;gBACV,EAAE,EAAE,YAAY,CAAC,YAAY;gBAC7B,SAAS,EAAE,IAAI,UAAU,CACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC9C;gBACD,OAAO;aACR;SACF,CAAC,CAAC;QAEH,IACE,CAAC,YAAY,CAAC,QAAQ;YACtB,CAAC,CAAA,MAAA,YAAY,CAAC,kBAAkB,0CAAE,YAAY,CAAA,EAC9C,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAW,MAAM,IAAI,CAAC,aAAa,CAAC;YAC/C,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE;gBACJ,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE;aAC/D;YACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,YAAY,CAAC,MAAM;YACvB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,eAAe;QACrB,MAAM,MAAM,GAAQ,IAAI,GAAG,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEjE;;;WAGG;QACH,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACnE,CAAC;IAEO,iBAAiB;QACvB,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,6BAA6B,CACrC,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,KAAa;QACrD,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAC9D,GAAG,EACH,KAAK,EACL,IAAI,EACJ,8BAA8B,GAAG,EAAE,CACpC,CAAC;QAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAW;QACxC;;;WAGG;QACH,MAAM,SAAS,GAAY,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAC5D,4CAA4C;YAC1C,6DAA6D,EAC/D,CAAC,EACD,GAAG,CACJ,CAAC;QAEF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,gBAAgB,CACxB,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAE7C,MAAM,IAAI,GAAgB,MAAM,WAAW,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;YACD,MAAM,EAAE;gBACN,KAAK,EAAE,IAAI;aACZ;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,0FAA0F;QAE1F,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAEhC,OAAO;YACL,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;CA0BF;AAloBc;IADZ,WAAW,EAAE;;;;0DAsFb;AAGY;IADZ,WAAW,EAAE;;;;iDAiHb;AAGY;IADZ,WAAW,EAAE;;;;4DA6Fb;AAGY;IADZ,WAAW,EAAE;;;;mDA8Eb;AAGY;IADZ,WAAW,EAAE;;;;mEAsBb;AAGY;IADZ,WAAW,EAAE;;;;0DAyHb;AA2DwB;IADxB,WAAW,EAAE;;;;6CAoCb;AA4BH,eAAe,IAAI,OAAO,EAAE,CAAC"}