@oneuptime/common 13.0.3 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/Okta/OktaConnector.js

@@ -0,0 +1,494 @@
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import SecurityEventConnectorProvider from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
+import { getSecurityEventConnectorDefinition, } from "../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import OktaNormalizer from "../../../../../Utils/SecurityEvent/Connectors/OktaNormalizer";
+import DataSourceHttpFetch from "../../../DataSource/HttpFetch";
+import { redactLogString } from "../../../LogRedaction";
+import ConnectorErrorMessage from "../../ConnectorErrorMessage";
+import { makeCheck, readSettingString, } from "../Types";
+import OktaClient, { OKTA_DEFAULT_EVENT_FILTER, OKTA_MAX_PAGE_SIZE, OktaHttpError, } from "./OktaClient";
+/*
+ * The Admin Console is served from a `-admin` host; the API is not. A
+ * pasted admin URL answers with a redirect (refused) or a 404, neither of
+ * which says why.
+ */
+const ADMIN_HOST_REGEX = /-admin\.[^.]+\.[^.]+$/i;
+// The header scheme pasted along with the token.
+const TOKEN_SCHEME_PREFIX_REGEX = /^ssws\s/i;
+const WHITESPACE_REGEX = /\s/;
+// Okta rejects filters on `published`; it would only surface as a 400 later.
+const PUBLISHED_ATTRIBUTE_REGEX = /(^|[^A-Za-z0-9_.])published\s*[A-Za-z]{2}\s/i;
+/*
+ * A filter is one line of printable text. Control characters (newlines,
+ * tabs, NUL, DEL) can only come from a paste gone wrong, and Okta would
+ * answer 400 to them anyway. Checked by code point because the lint rule
+ * no-control-regex forbids spelling the range in a regular expression.
+ */
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code < 0x20 || code === 0x7f) {
+            return true;
+        }
+    }
+    return false;
+}
+const MAX_FILTER_LENGTH = 2000;
+const DAY_IN_MS = 24 * 60 * 60 * 1000;
+// Normalization failures quoted into warnings before the rest are counted only.
+const MAX_NORMALIZATION_WARNINGS = 5;
+export default class OktaConnector {
+    constructor(transport) {
+        this.provider = SecurityEventConnectorProvider.OktaSystemLog;
+        this.transport =
+            transport ||
+                ((request) => {
+                    return DataSourceHttpFetch.fetch(request);
+                });
+    }
+    static getDefinition() {
+        const definition = getSecurityEventConnectorDefinition(SecurityEventConnectorProvider.OktaSystemLog);
+        if (!definition) {
+            throw new BadDataException("Okta System Log is missing from the connector catalog.");
+        }
+        return definition;
+    }
+    /*
+     * Validation messages name the field by the title the form shows, read
+     * from the catalog so a retitled field cannot leave a stale name here.
+     */
+    static fieldTitle(key) {
+        const definition = this.getDefinition();
+        const field = [
+            ...definition.configFields,
+            ...definition.secretFields,
+        ].find((candidate) => {
+            return candidate.key === key;
+        });
+        return (field === null || field === void 0 ? void 0 : field.title) || key;
+    }
+    static parseSettings(settings) {
+        const orgUrl = readSettingString(settings.config, "orgUrl");
+        const filter = readSettingString(settings.config, "filter");
+        const apiToken = readSettingString(settings.secrets, "apiToken");
+        if (!orgUrl) {
+            throw new BadDataException(`${this.fieldTitle("orgUrl")} is required.`);
+        }
+        let parsed;
+        try {
+            parsed = new URL(orgUrl);
+        }
+        catch (_a) {
+            throw new BadDataException(`${this.fieldTitle("orgUrl")} must be an absolute URL such as https://acme.okta.com.`);
+        }
+        /*
+         * Okta orgs are only ever served over TLS; an http URL means the
+         * token would be sent in clear text to whatever answers there.
+         */
+        if (parsed.protocol !== "https:") {
+            throw new BadDataException(`${this.fieldTitle("orgUrl")} must use https.`);
+        }
+        if (parsed.search || parsed.hash) {
+            throw new BadDataException(`${this.fieldTitle("orgUrl")} must not contain a query string or fragment.`);
+        }
+        if (parsed.pathname !== "/" && parsed.pathname !== "") {
+            throw new BadDataException(`${this.fieldTitle("orgUrl")} must be the org's base URL without a path (for example https://acme.okta.com, not https://acme.okta.com/api/v1/logs).`);
+        }
+        if (ADMIN_HOST_REGEX.test(parsed.hostname)) {
+            throw new BadDataException(`${this.fieldTitle("orgUrl")} must be the org URL users sign in to (for example https://acme.okta.com), not the Admin Console's -admin URL.`);
+        }
+        if (filter.length > MAX_FILTER_LENGTH) {
+            throw new BadDataException(`${this.fieldTitle("filter")} must be at most ${MAX_FILTER_LENGTH} characters.`);
+        }
+        if (hasControlCharacter(filter)) {
+            throw new BadDataException(`${this.fieldTitle("filter")} must be a single-line filter expression.`);
+        }
+        if (PUBLISHED_ATTRIBUTE_REGEX.test(filter)) {
+            throw new BadDataException(`${this.fieldTitle("filter")} must not filter on the published attribute; the connector sets the time range itself.`);
+        }
+        if (!apiToken) {
+            throw new BadDataException(`${this.fieldTitle("apiToken")} is required.`);
+        }
+        if (TOKEN_SCHEME_PREFIX_REGEX.test(apiToken)) {
+            throw new BadDataException(`${this.fieldTitle("apiToken")} must be pasted without the 'SSWS' prefix.`);
+        }
+        if (WHITESPACE_REGEX.test(apiToken)) {
+            throw new BadDataException(`${this.fieldTitle("apiToken")} must be the token value alone, without spaces.`);
+        }
+        return { orgUrl: parsed.origin, filter, apiToken };
+    }
+    validateSettings(settings) {
+        OktaConnector.parseSettings(settings);
+    }
+    buildClient(parsed, requestTimeoutInMs) {
+        return new OktaClient({
+            orgUrl: parsed.orgUrl,
+            apiToken: parsed.apiToken,
+            transport: this.transport,
+            requestTimeoutInMs,
+        });
+    }
+    /*
+     * The filter sent with every listing: the tenant's own expression when
+     * it set one, otherwise the connector's default event families.
+     */
+    static effectiveFilter(filter) {
+        return filter.trim() || OKTA_DEFAULT_EVENT_FILTER;
+    }
+    /*
+     * Three provider checks, in dependency order. Each later check is
+     * skipped rather than failed when an earlier one fails, so the report
+     * names one root cause instead of three symptoms of it.
+     */
+    async testConnection(settings, options) {
+        const checks = [];
+        let parsed;
+        let startedAtMs = Date.now();
+        try {
+            parsed = OktaConnector.parseSettings(settings);
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Okta",
+                status: "fail",
+                startedAtMs,
+                message: redactLogString(ConnectorErrorMessage.toMessage(error)),
+                remediation: "Correct the highlighted setting and test again. Nothing was contacted.",
+            }));
+            checks.push(OktaConnector.skipped("read-permission", "Read System Log events", "Skipped because the configuration is invalid."));
+            checks.push(OktaConnector.skipped("detections-available", "Events available to import", "Skipped because the configuration is invalid."));
+            return checks;
+        }
+        const client = this.buildClient(parsed, options.requestTimeoutInMs);
+        const hostLabel = new URL(parsed.orgUrl).host;
+        const filter = OktaConnector.effectiveFilter(parsed.filter);
+        const usingDefaultFilter = !parsed.filter.trim();
+        // 1. Authentication: one event, no bounds, no filter.
+        let authenticated = false;
+        try {
+            const page = await client.probe();
+            authenticated = true;
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Okta",
+                status: "pass",
+                startedAtMs,
+                message: `Okta at ${hostLabel} accepted the API token for the System Log.`,
+                details: { probeReturnedEvents: page.events.length },
+            }));
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "authentication",
+                name: "Authenticate with Okta",
+                status: "fail",
+                startedAtMs,
+                message: OktaConnector.errorMessage(error),
+                remediation: OktaConnector.remediationFor(error, "authentication"),
+            }));
+        }
+        if (!authenticated) {
+            checks.push(OktaConnector.skipped("read-permission", "Read System Log events", "Skipped because authentication did not succeed."));
+            checks.push(OktaConnector.skipped("detections-available", "Events available to import", "Skipped because authentication did not succeed."));
+            return checks;
+        }
+        const now = new Date();
+        const dayAgo = new Date(now.getTime() - DAY_IN_MS);
+        const weekAgo = new Date(now.getTime() - 7 * DAY_IN_MS);
+        /*
+         * 2. Read permission: one event from the last 24 hours through the
+         * filter polling will use, so an invalid custom filter fails here
+         * (HTTP 400) with its own remediation instead of on the first poll.
+         */
+        startedAtMs = Date.now();
+        let readable = false;
+        try {
+            const page = await client.listLogEvents({
+                startTime: dayAgo,
+                endTime: now,
+                limit: 1,
+                filter,
+            });
+            readable = true;
+            const first = page.events[0];
+            const filterLabel = usingDefaultFilter
+                ? "the default event filter"
+                : "the connection's Event filter";
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Read System Log events",
+                status: "pass",
+                startedAtMs,
+                message: first
+                    ? `The System Log is readable through ${filterLabel}; the one-record probe over the last 24 hours returned a "${OktaConnector.describeEvent(first)}" event.`
+                    : `The System Log is readable through ${filterLabel}. No matching event was published in the last 24 hours.`,
+                details: { usingDefaultFilter },
+            }));
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "read-permission",
+                name: "Read System Log events",
+                status: "fail",
+                startedAtMs,
+                message: OktaConnector.errorMessage(error),
+                remediation: OktaConnector.remediationFor(error, "read-permission"),
+            }));
+        }
+        if (!readable) {
+            checks.push(OktaConnector.skipped("detections-available", "Events available to import", "Skipped because System Log events could not be read."));
+            return checks;
+        }
+        // 3. Availability: counts over the last 24 hours and 7 days.
+        startedAtMs = Date.now();
+        try {
+            const last24h = await client.countLogEvents({
+                startTime: dayAgo,
+                endTime: now,
+                filter,
+            });
+            const last7d = await client.countLogEvents({
+                startTime: weekAgo,
+                endTime: now,
+                filter,
+            });
+            const label24h = OktaConnector.countLabel(last24h);
+            const label7d = OktaConnector.countLabel(last7d);
+            const nothing = last24h.count === 0 && last7d.count === 0;
+            const details = {
+                createdLast24h: last24h.count,
+                createdLast7d: last7d.count,
+                hasMoreLast24h: last24h.hasMore,
+                hasMoreLast7d: last7d.hasMore,
+                usingDefaultFilter,
+            };
+            checks.push(makeCheck(Object.assign(Object.assign({ key: "detections-available", name: "Events available to import", status: nothing ? "warn" : "pass", startedAtMs, message: nothing
+                    ? "No matching events were published in the last 7 days. Polling will import new events as Okta publishes them."
+                    : `${label24h} event${label24h === "1" ? "" : "s"} published in the last 24 hours and ${label7d} in the last 7 days.` }, (nothing
+                ? {
+                    remediation: usingDefaultFilter
+                        ? "An active Okta org publishes sign-in events constantly, so an empty week usually means the org URL points at a sandbox or an unused org. Check the Okta organization URL."
+                        : "The connection's Event filter matched nothing in seven days. Check the expression against the event types in Okta's System Log, or clear it to use the default event families.",
+                }
+                : {})), { details })));
+        }
+        catch (error) {
+            checks.push(makeCheck({
+                key: "detections-available",
+                name: "Events available to import",
+                status: "fail",
+                startedAtMs,
+                message: OktaConnector.errorMessage(error),
+                remediation: OktaConnector.remediationFor(error, "detections-available"),
+            }));
+        }
+        return checks;
+    }
+    /*
+     * Read every event published in the window, page by page, within the
+     * request and event budgets. A budget hit returns complete=false with a
+     * warning and resumeAfter set to the `published` time of the last event
+     * read, so the poller moves on from there instead of re-reading the
+     * same oldest events forever.
+     */
+    async fetchEvents(settings, window, options) {
+        const parsed = OktaConnector.parseSettings(settings);
+        const client = this.buildClient(parsed, options.requestTimeoutInMs);
+        const result = {
+            events: [],
+            fetchedCount: 0,
+            rejectedCount: 0,
+            failedCount: 0,
+            complete: true,
+            requestCount: 0,
+            warnings: [],
+            samples: [],
+        };
+        const pageSize = Math.max(1, Math.min(OKTA_MAX_PAGE_SIZE, Math.trunc(options.maxEvents)));
+        const startIso = window.startTime.toISOString();
+        const endIso = window.endTime.toISOString();
+        const seenIds = new Set();
+        let nextUrl = null;
+        /*
+         * `published` of the last event read. Bounded requests are ordered by
+         * `published`, so this is also the latest one read. Events the
+         * normalizer rejects still count: this measures how far the read got.
+         */
+        let lastPublished = undefined;
+        for (;;) {
+            if (result.requestCount >= options.maxRequests) {
+                result.complete = false;
+                result.resumeAfter = lastPublished;
+                result.warnings.push(`Stopped after ${options.maxRequests} requests with events still unread in the window ${startIso} to ${endIso}. ${OktaConnector.progressSentence(lastPublished)}`);
+                break;
+            }
+            const page = nextUrl
+                ? await client.listNextPage(nextUrl)
+                : await client.listLogEvents({
+                    startTime: startIso,
+                    endTime: endIso,
+                    limit: pageSize,
+                    filter: OktaConnector.effectiveFilter(parsed.filter),
+                });
+            result.requestCount += 1;
+            let reachedEventBound = false;
+            for (const event of page.events) {
+                /*
+                 * `uuid` is the event's own identifier. An event without one is
+                 * keyed by its content, so an identical copy on a later page is
+                 * still recognized as the same event.
+                 */
+                const key = OktaConnector.readText(event["uuid"]) || JSON.stringify(event);
+                if (seenIds.has(key)) {
+                    continue;
+                }
+                if (result.fetchedCount >= options.maxEvents) {
+                    reachedEventBound = true;
+                    break;
+                }
+                seenIds.add(key);
+                result.fetchedCount += 1;
+                const published = OktaConnector.readPublished(event);
+                if (published) {
+                    lastPublished = published;
+                }
+                this.collect(event, result, options.sampleLimit);
+            }
+            if (reachedEventBound) {
+                result.complete = false;
+                result.resumeAfter = lastPublished;
+                result.warnings.push(`Stopped after collecting ${options.maxEvents} events; the window holds more. ${OktaConnector.progressSentence(lastPublished)}`);
+                break;
+            }
+            /*
+             * A bounded request's last page carries no next link; an empty page
+             * is also the end (Okta's own guidance for consumers). Both stop
+             * the loop cleanly.
+             */
+            if (!page.nextUrl || page.events.length === 0) {
+                break;
+            }
+            nextUrl = page.nextUrl;
+        }
+        return result;
+    }
+    collect(raw, result, sampleLimit) {
+        if (!OktaNormalizer.isRecognized(raw)) {
+            result.rejectedCount += 1;
+            return;
+        }
+        let normalized;
+        try {
+            normalized = OktaNormalizer.normalize(raw);
+        }
+        catch (error) {
+            result.failedCount += 1;
+            if (result.warnings.length < MAX_NORMALIZATION_WARNINGS) {
+                result.warnings.push(`Event ${OktaConnector.readText(raw["uuid"]) || "(no uuid)"} could not be normalized: ${redactLogString(ConnectorErrorMessage.toMessage(error))}`);
+            }
+            return;
+        }
+        result.events.push(normalized);
+        if (result.samples.length < sampleLimit) {
+            const published = OktaConnector.readText(raw["published"]);
+            const sample = Object.assign(Object.assign({ id: normalized.eventUid, title: normalized.message, severity: normalized.severityName }, (published ? { createdTime: published } : {})), { eventTime: normalized.time.toISOString() });
+            result.samples.push(sample);
+        }
+    }
+    /*
+     * The event type for the read-permission message. A record the
+     * normalizer cannot read must not turn a successful read into a failed
+     * check, so this never throws.
+     */
+    static describeEvent(raw) {
+        try {
+            if (!OktaNormalizer.isRecognized(raw)) {
+                return "unrecognized record";
+            }
+            return redactLogString(OktaConnector.readText(raw["eventType"]) || "unnamed");
+        }
+        catch (_a) {
+            return "unreadable record";
+        }
+    }
+    /*
+     * An event's `published` time as a Date, or undefined when it is
+     * missing or unparseable (such an event does not move the resume point).
+     */
+    static readPublished(event) {
+        const value = OktaConnector.readText(event["published"]).trim();
+        if (!value) {
+            return undefined;
+        }
+        const parsed = new Date(value);
+        return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+    }
+    /*
+     * How far a stopped read got, in the warning the run records. The
+     * poller decides what the next poll does with it and says so itself.
+     */
+    static progressSentence(lastPublished) {
+        return lastPublished
+            ? `The last event read was published at ${lastPublished.toISOString()}.`
+            : "No event read carried a readable published time, so no resume point is reported.";
+    }
+    static readText(value) {
+        if (value === null || value === undefined || typeof value === "object") {
+            return "";
+        }
+        return String(value);
+    }
+    static skipped(key, name, message) {
+        return makeCheck({
+            key,
+            name,
+            status: "skip",
+            startedAtMs: Date.now(),
+            message,
+        });
+    }
+    static countLabel(count) {
+        return count.hasMore ? `${count.count}+` : String(count.count);
+    }
+    static errorMessage(error) {
+        return redactLogString(ConnectorErrorMessage.toMessage(error, { truncate: false }));
+    }
+    /*
+     * Remediation is chosen by HTTP status when the failure carried one,
+     * and by the step otherwise (a timeout or a non-JSON body means the URL
+     * is not reaching Okta at all).
+     */
+    static remediationFor(error, step) {
+        const status = error instanceof OktaHttpError ? error.statusCode : null;
+        if (status === 400) {
+            if (step === "authentication") {
+                return "Okta rejected the probe request. Check the Okta organization URL points at an Okta org and test again.";
+            }
+            return "Okta rejected the request parameters, which after a successful authentication almost always means the Event filter is not a valid System Log filter expression. Compare it with the examples in the Okta System Log documentation (operators eq, ne, co, sw, ew, pr, gt, ge, lt, le joined with and/or, string values in double quotes, no published attribute), or clear it to use the default event families.";
+        }
+        if (status === 401) {
+            return "Create a new API token in the Okta Admin Console (Security > API > Tokens) as a Read-only Administrator and paste it with Update credentials. SSWS tokens expire after 30 days without use and are deprovisioned when their creator is deactivated.";
+        }
+        if (status === 403) {
+            return "The token's admin cannot read the System Log. Create the token as a Read-only Administrator or Super Administrator (API tokens inherit the privileges of the admin who created them), and if the token has a network zone restriction, allow the addresses OneUptime calls from.";
+        }
+        if (status === 404) {
+            return "Check the Okta organization URL. It must be the org's base URL such as https://acme.okta.com or https://acme.oktapreview.com, without a path, and not the -admin URL of the Admin Console.";
+        }
+        if (status === 429) {
+            return "Okta is rate limiting this token. Wait for the limit to reset and test again; raise the token's rate limit percentage in the Admin Console (Security > API > Tokens) or use a longer poll interval.";
+        }
+        if (status !== null && status >= 500) {
+            return "Okta failed internally or the query timed out on Okta's side. Test again; if it persists, check status.okta.com.";
+        }
+        if (step === "authentication") {
+            return "OneUptime could not get an answer from Okta. Check that the Okta organization URL is reachable from the OneUptime API and worker processes, uses https, and is not behind a proxy that rewrites responses.";
+        }
+        if (step === "read-permission") {
+            return "Okta answered the probe but not the filtered read over the last 24 hours. Test again; if it persists, simplify the Event filter.";
+        }
+        return "The event count request failed after a successful read. Test again; if it persists, the org may be rate limiting the token.";
+    }
+}
+//# sourceMappingURL=OktaConnector.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/Okta/OktaConnector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OktaConnector.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/Okta/OktaConnector.ts"],"names":[],"mappings":"AAAA,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAO/E,OAAO,8BAA8B,MAAM,8EAA8E,CAAC;AAC1H,OAAO,EAEL,mCAAmC,GACpC,MAAM,6EAA6E,CAAC;AACrF,OAAO,cAAc,MAAM,8DAA8D,CAAC;AAC1F,OAAO,mBAGN,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,qBAAqB,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAQL,SAAS,EACT,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAClB,OAAO,UAAU,EAAE,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,aAAa,GAGd,MAAM,cAAc,CAAC;AA+BtB;;;;GAIG;AACH,MAAM,gBAAgB,GAAW,wBAAwB,CAAC;AAC1D,iDAAiD;AACjD,MAAM,yBAAyB,GAAW,UAAU,CAAC;AACrD,MAAM,gBAAgB,GAAW,IAAI,CAAC;AACtC,6EAA6E;AAC7E,MAAM,yBAAyB,GAC7B,8CAA8C,CAAC;AACjD;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAW,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,iBAAiB,GAAW,IAAI,CAAC;AACvC,MAAM,SAAS,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,gFAAgF;AAChF,MAAM,0BAA0B,GAAW,CAAC,CAAC;AAO7C,MAAM,CAAC,OAAO,OAAO,aAAa;IAMhC,YAAmB,SAA0C;QALtD,aAAQ,GACb,8BAA8B,CAAC,aAAa,CAAC;QAK7C,IAAI,CAAC,SAAS;YACZ,SAAS;gBACT,CAAC,CAAC,OAA8B,EAAmC,EAAE;oBACnE,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,MAAM,CAAC,aAAa;QAC1B,MAAM,UAAU,GACd,mCAAmC,CACjC,8BAA8B,CAAC,aAAa,CAC7C,CAAC;QAEJ,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,UAAU,CAAC,GAAW;QACnC,MAAM,UAAU,GAAqC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAkC;YAC3C,GAAG,UAAU,CAAC,YAAY;YAC1B,GAAG,UAAU,CAAC,YAAY;SAC3B,CAAC,IAAI,CAAC,CAAC,SAA0B,EAAW,EAAE;YAC7C,OAAO,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,KAAI,GAAG,CAAC;IAC7B,CAAC;IAEO,MAAM,CAAC,aAAa,CAC1B,QAAmC;QAEnC,MAAM,MAAM,GAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,MAAM,GAAW,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAW,iBAAiB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yDAAyD,CACtF,CAAC;QACJ,CAAC;QAED;;;WAGG;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAC/C,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,+CAA+C,CAC5E,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,wHAAwH,CACrJ,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,gHAAgH,CAC7I,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,iBAAiB,cAAc,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,2CAA2C,CACxE,CAAC;QACJ,CAAC;QAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,wFAAwF,CACrH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,4CAA4C,CAC3E,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iDAAiD,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrD,CAAC;IAEM,gBAAgB,CAAC,QAAmC;QACzD,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAEO,WAAW,CACjB,MAAsB,EACtB,kBAA0B;QAE1B,OAAO,IAAI,UAAU,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,eAAe,CAAC,MAAc;QAC1C,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,yBAAyB,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,cAAc,CACzB,QAAmC,EACnC,OAA6B;QAE7B,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,IAAI,MAAsB,CAAC;QAC3B,IAAI,WAAW,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,eAAe,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChE,WAAW,EACT,wEAAwE;aAC3E,CAAC,CACH,CAAC;YACF,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,OAAO,CACnB,iBAAiB,EACjB,wBAAwB,EACxB,+CAA+C,CAChD,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,OAAO,CACnB,sBAAsB,EACtB,4BAA4B,EAC5B,+CAA+C,CAChD,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAe,IAAI,CAAC,WAAW,CACzC,MAAM,EACN,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QACF,MAAM,SAAS,GAAW,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACtD,MAAM,MAAM,GAAW,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,kBAAkB,GAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAE1D,sDAAsD;QACtD,IAAI,aAAa,GAAY,KAAK,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAsB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrD,aAAa,GAAG,IAAI,CAAC;YAErB,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,WAAW,SAAS,6CAA6C;gBAC1E,OAAO,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;aACrD,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,gBAAgB;gBACrB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1C,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC;aACnE,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,OAAO,CACnB,iBAAiB,EACjB,wBAAwB,EACxB,iDAAiD,CAClD,CACF,CAAC;YACF,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,OAAO,CACnB,sBAAsB,EACtB,4BAA4B,EAC5B,iDAAiD,CAClD,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;QACzD,MAAM,OAAO,GAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAE9D;;;;WAIG;QACH,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAY,KAAK,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAsB,MAAM,MAAM,CAAC,aAAa,CAAC;gBACzD,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;gBACZ,KAAK,EAAE,CAAC;gBACR,MAAM;aACP,CAAC,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC;YAEhB,MAAM,KAAK,GAA2B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,WAAW,GAAW,kBAAkB;gBAC5C,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,+BAA+B,CAAC;YAEpC,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,KAAK;oBACZ,CAAC,CAAC,sCAAsC,WAAW,6DAA6D,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU;oBAC5J,CAAC,CAAC,sCAAsC,WAAW,yDAAyD;gBAC9G,OAAO,EAAE,EAAE,kBAAkB,EAAE;aAChC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,iBAAiB;gBACtB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1C,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,OAAO,CACnB,sBAAsB,EACtB,4BAA4B,EAC5B,sDAAsD,CACvD,CACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,6DAA6D;QAC7D,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAsB,MAAM,MAAM,CAAC,cAAc,CAAC;gBAC7D,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG;gBACZ,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,GAAsB,MAAM,MAAM,CAAC,cAAc,CAAC;gBAC5D,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,GAAG;gBACZ,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAW,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAW,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,OAAO,GAAY,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC;YAEnE,MAAM,OAAO,GAAe;gBAC1B,cAAc,EAAE,OAAO,CAAC,KAAK;gBAC7B,aAAa,EAAE,MAAM,CAAC,KAAK;gBAC3B,cAAc,EAAE,OAAO,CAAC,OAAO;gBAC/B,aAAa,EAAE,MAAM,CAAC,OAAO;gBAC7B,kBAAkB;aACnB,CAAC;YAEF,MAAM,CAAC,IAAI,CACT,SAAS,+BACP,GAAG,EAAE,sBAAsB,EAC3B,IAAI,EAAE,4BAA4B,EAClC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EACjC,WAAW,EACX,OAAO,EAAE,OAAO;oBACd,CAAC,CAAC,8GAA8G;oBAChH,CAAC,CAAC,GAAG,QAAQ,SAAS,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uCAAuC,OAAO,sBAAsB,IACpH,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,WAAW,EAAE,kBAAkB;wBAC7B,CAAC,CAAC,2KAA2K;wBAC7K,CAAC,CAAC,gLAAgL;iBACrL;gBACH,CAAC,CAAC,EAAE,CAAC,KACP,OAAO,IACP,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,SAAS,CAAC;gBACR,GAAG,EAAE,sBAAsB;gBAC3B,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,MAAM;gBACd,WAAW;gBACX,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1C,WAAW,EAAE,aAAa,CAAC,cAAc,CACvC,KAAK,EACL,sBAAsB,CACvB;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,WAAW,CACtB,QAAmC,EACnC,MAA4B,EAC5B,OAA8B;QAE9B,MAAM,MAAM,GAAmB,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAe,IAAI,CAAC,WAAW,CACzC,MAAM,EACN,OAAO,CAAC,kBAAkB,CAC3B,CAAC;QAEF,MAAM,MAAM,GAAyB;YACnC,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,CAAC;YACf,aAAa,EAAE,CAAC;YAChB,WAAW,EAAE,CAAC;YACd,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,MAAM,QAAQ,GAAW,IAAI,CAAC,GAAG,CAC/B,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAC5D,CAAC;QACF,MAAM,QAAQ,GAAW,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,MAAM,GAAW,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,OAAO,GAAgB,IAAI,GAAG,EAAU,CAAC;QAC/C,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC;;;;WAIG;QACH,IAAI,aAAa,GAAqB,SAAS,CAAC;QAEhD,SAAS,CAAC;YACR,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC/C,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACxB,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC;gBACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,iBAAiB,OAAO,CAAC,WAAW,oDAAoD,QAAQ,OAAO,MAAM,KAAK,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAClK,CAAC;gBACF,MAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAsB,OAAO;gBACrC,CAAC,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC;gBACpC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC;oBACzB,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,MAAM;oBACf,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;iBACrD,CAAC,CAAC;YACP,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;YAEzB,IAAI,iBAAiB,GAAY,KAAK,CAAC;YAEvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC;;;;mBAIG;gBACH,MAAM,GAAG,GACP,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAEjE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrB,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7C,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM;gBACR,CAAC;gBAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjB,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;gBAEzB,MAAM,SAAS,GAAqB,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAEvE,IAAI,SAAS,EAAE,CAAC;oBACd,aAAa,GAAG,SAAS,CAAC;gBAC5B,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACnD,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACxB,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC;gBACnC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,4BAA4B,OAAO,CAAC,SAAS,mCAAmC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAChI,CAAC;gBACF,MAAM;YACR,CAAC;YAED;;;;eAIG;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM;YACR,CAAC;YAED,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CACb,GAAe,EACf,MAA4B,EAC5B,WAAmB;QAEnB,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,UAAmC,CAAC;QAExC,IAAI,CAAC;YACH,UAAU,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;YAExB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;gBACxD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,WAAW,6BAA6B,eAAe,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAClJ,CAAC;YACJ,CAAC;YAED,OAAO;QACT,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE/B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACxC,MAAM,SAAS,GAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;YACnE,MAAM,MAAM,iCACV,EAAE,EAAE,UAAU,CAAC,QAAQ,EACvB,KAAK,EAAE,UAAU,CAAC,OAAO,EACzB,QAAQ,EAAE,UAAU,CAAC,YAAY,IAC9B,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAChD,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,GACzC,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,aAAa,CAAC,GAAe;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,OAAO,qBAAqB,CAAC;YAC/B,CAAC;YAED,OAAO,eAAe,CACpB,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,SAAS,CACtD,CAAC;QACJ,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,mBAAmB,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,aAAa,CAAC,KAAiB;QAC5C,MAAM,KAAK,GAAW,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAErC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,gBAAgB,CAAC,aAA+B;QAC7D,OAAO,aAAa;YAClB,CAAC,CAAC,wCAAwC,aAAa,CAAC,WAAW,EAAE,GAAG;YACxE,CAAC,CAAC,kFAAkF,CAAC;IACzF,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAAc;QACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,MAAM,CAAC,OAAO,CACpB,GAAW,EACX,IAAY,EACZ,OAAe;QAEf,OAAO,SAAS,CAAC;YACf,GAAG;YACH,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,KAAwB;QAChD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,KAAc;QACxC,OAAO,eAAe,CACpB,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,cAAc,CAC3B,KAAc,EACd,IAAuB;QAEvB,MAAM,MAAM,GACV,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC9B,OAAO,wGAAwG,CAAC;YAClH,CAAC;YAED,OAAO,iZAAiZ,CAAC;QAC3Z,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,qPAAqP,CAAC;QAC/P,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,kRAAkR,CAAC;QAC5R,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,4LAA4L,CAAC;QACtM,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,qMAAqM,CAAC;QAC/M,CAAC;QAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACrC,OAAO,kHAAkH,CAAC;QAC5H,CAAC;QAED,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,OAAO,4MAA4M,CAAC;QACtN,CAAC;QAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,OAAO,kIAAkI,CAAC;QAC5I,CAAC;QAED,OAAO,6HAA6H,CAAC;IACvI,CAAC;CACF"}