@oneuptime/common 13.0.4 → 13.0.5

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftSentinel/MicrosoftSentinelClient.js

@@ -0,0 +1,474 @@
+import APIException from "../../../../../Types/Exception/ApiException";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import { redactLogString, redactLogValue } from "../../../LogRedaction";
+export const MICROSOFT_SENTINEL_CLOUD_ENDPOINTS = {
+    public: {
+        loginBaseUrl: "https://login.microsoftonline.com",
+        managementBaseUrl: "https://management.azure.com",
+        portalHost: "portal.azure.com",
+    },
+    usgov: {
+        loginBaseUrl: "https://login.microsoftonline.us",
+        managementBaseUrl: "https://management.usgovcloudapi.net",
+        portalHost: "portal.azure.us",
+    },
+};
+export const MICROSOFT_SENTINEL_API_VERSION = "2024-03-01";
+/*
+ * Page size for polling. The API allows up to 1000, but each incident is a
+ * few kilobytes and the transport caps response size; 50 keeps a page
+ * comfortably inside that cap while a 20-request budget still covers a
+ * thousand incidents per poll.
+ */
+export const MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE = 50;
+export const MICROSOFT_SENTINEL_MAX_PAGE_SIZE = 1000;
+export const MICROSOFT_SENTINEL_DEFAULT_REQUEST_TIMEOUT_IN_MS = 60 * 1000;
+// Refresh a cached token this long before Entra says it expires.
+const TOKEN_EXPIRY_SKEW_IN_MS = 60 * 1000;
+const TOKEN_STEP = "token request";
+const INCIDENTS_STEP = "incidents list";
+const GUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+/*
+ * Entra accepts the tenant as a GUID or as a verified domain name
+ * (contoso.onmicrosoft.com). Anything with a slash, a space or a query
+ * character is refused because the value is interpolated into a URL path.
+ */
+const TENANT_DOMAIN_REGEX = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/;
+/*
+ * Azure resource group names: 1-90 characters of letters, digits,
+ * underscores, hyphens, periods and parentheses, not ending in a period.
+ * https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules
+ */
+const RESOURCE_GROUP_REGEX = /^[-\w._()]{1,90}$/;
+/*
+ * Workspace name pattern from the incidents API's URI parameter table:
+ * ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$, 1-90 characters.
+ */
+const WORKSPACE_NAME_REGEX = /^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$/;
+// The shape DataSourceHttpFetch throws for a non-2xx answer.
+const TRANSPORT_HTTP_ERROR_REGEX = /^Data source responded with HTTP (\d{3}):\s*([\s\S]*)$/;
+export default class MicrosoftSentinelClient {
+    constructor(options) {
+        this.cachedToken = null;
+        this.requestCount = 0;
+        MicrosoftSentinelClient.validateTenantId(options.tenantId);
+        MicrosoftSentinelClient.validateGuid(options.clientId, "Application (client) ID");
+        MicrosoftSentinelClient.validateGuid(options.subscriptionId, "Subscription ID");
+        MicrosoftSentinelClient.validateResourceGroup(options.resourceGroup);
+        MicrosoftSentinelClient.validateWorkspaceName(options.workspaceName);
+        if (!options.clientSecret) {
+            throw new BadDataException("Client secret is required.");
+        }
+        this.options = options;
+        this.endpoints = MicrosoftSentinelClient.resolveCloud(options.cloud);
+        this.requestTimeoutInMs =
+            options.requestTimeoutInMs && options.requestTimeoutInMs > 0
+                ? options.requestTimeoutInMs
+                : MICROSOFT_SENTINEL_DEFAULT_REQUEST_TIMEOUT_IN_MS;
+    }
+    // Every outbound request this instance made, token requests included.
+    getRequestCount() {
+        return this.requestCount;
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * Validation (shared with the connector's validateSettings)
+     * ---------------------------------------------------------------------
+     */
+    static isCloud(value) {
+        return value === "public" || value === "usgov";
+    }
+    static resolveCloud(cloud) {
+        const normalized = (cloud || "public").trim().toLowerCase();
+        if (!MicrosoftSentinelClient.isCloud(normalized)) {
+            throw new BadDataException(`Cloud must be "public" or "usgov"; received "${normalized}".`);
+        }
+        return MICROSOFT_SENTINEL_CLOUD_ENDPOINTS[normalized];
+    }
+    static validateGuid(value, label) {
+        if (!value || !GUID_REGEX.test(value.trim())) {
+            throw new BadDataException(`${label} must be a GUID such as 00000000-0000-0000-0000-000000000000.`);
+        }
+    }
+    static validateTenantId(value) {
+        const trimmed = (value || "").trim();
+        if (!trimmed ||
+            (!GUID_REGEX.test(trimmed) && !TENANT_DOMAIN_REGEX.test(trimmed))) {
+            throw new BadDataException("Directory (tenant) ID must be the tenant GUID or a verified tenant domain such as contoso.onmicrosoft.com.");
+        }
+    }
+    static validateResourceGroup(value) {
+        const trimmed = (value || "").trim();
+        if (!trimmed ||
+            !RESOURCE_GROUP_REGEX.test(trimmed) ||
+            trimmed.endsWith(".")) {
+            throw new BadDataException("Resource group must be 1-90 characters of letters, digits, underscores, hyphens, periods or parentheses and must not end with a period.");
+        }
+    }
+    static validateWorkspaceName(value) {
+        const trimmed = (value || "").trim();
+        if (!trimmed ||
+            trimmed.length > 90 ||
+            !WORKSPACE_NAME_REGEX.test(trimmed)) {
+            throw new BadDataException("Workspace name must be 3-90 letters, digits or hyphens, starting and ending with a letter or digit.");
+        }
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * URLs
+     * ---------------------------------------------------------------------
+     */
+    getTokenUrl() {
+        return `${this.endpoints.loginBaseUrl}/${encodeURIComponent(this.options.tenantId.trim())}/oauth2/v2.0/token`;
+    }
+    /*
+     * The ARM resource for the token: the management host with the ".default"
+     * suffix, so the same client works in Azure Government where ARM is a
+     * different resource (https://management.usgovcloudapi.net/.default).
+     */
+    getTokenScope() {
+        return `${this.endpoints.managementBaseUrl}/.default`;
+    }
+    getIncidentsBaseUrl() {
+        return (`${this.endpoints.managementBaseUrl}/subscriptions/${encodeURIComponent(this.options.subscriptionId.trim())}` +
+            `/resourceGroups/${encodeURIComponent(this.options.resourceGroup.trim())}` +
+            `/providers/Microsoft.OperationalInsights/workspaces/${encodeURIComponent(this.options.workspaceName.trim())}` +
+            `/providers/Microsoft.SecurityInsights/incidents`);
+    }
+    /*
+     * First-page URL for incidents CREATED in [startTime, endTime), oldest
+     * first. Creation time is the poll basis (see Connectors/Types.ts): a
+     * cursor over createdTimeUtc never skips an incident whose alerts
+     * describe activity from hours earlier.
+     */
+    buildIncidentsUrl(data) {
+        const top = MicrosoftSentinelClient.clampPageSize(data.top);
+        const url = new URL(this.getIncidentsBaseUrl());
+        url.searchParams.set("api-version", MICROSOFT_SENTINEL_API_VERSION);
+        url.searchParams.set("$filter", `(properties/createdTimeUtc ge ${data.startTime.toISOString()}) and (properties/createdTimeUtc lt ${data.endTime.toISOString()})`);
+        url.searchParams.set("$orderby", "properties/createdTimeUtc asc");
+        url.searchParams.set("$top", String(top));
+        return url.toString();
+    }
+    static clampPageSize(value) {
+        if (!value || !Number.isFinite(value)) {
+            return MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE;
+        }
+        return Math.min(MICROSOFT_SENTINEL_MAX_PAGE_SIZE, Math.max(1, Math.floor(value)));
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * Token
+     * ---------------------------------------------------------------------
+     */
+    async getAccessToken() {
+        return (await this.acquireToken()).accessToken;
+    }
+    async acquireToken() {
+        if (this.cachedToken &&
+            this.cachedToken.expiresAtMs - TOKEN_EXPIRY_SKEW_IN_MS > Date.now()) {
+            return { accessToken: this.cachedToken.accessToken, fromCache: true };
+        }
+        const response = await this.send({
+            method: "POST",
+            url: this.getTokenUrl(),
+            headers: { Accept: "application/json" },
+            formUrlEncoded: true,
+            body: {
+                grant_type: "client_credentials",
+                client_id: this.options.clientId.trim(),
+                client_secret: this.options.clientSecret,
+                scope: this.getTokenScope(),
+            },
+        }, TOKEN_STEP);
+        const body = this.requireJsonObject(response, TOKEN_STEP);
+        const accessToken = body["access_token"];
+        if (typeof accessToken !== "string" || !accessToken) {
+            throw new APIException(`Microsoft Sentinel ${TOKEN_STEP} returned no access_token: ${MicrosoftSentinelClient.describeBody(response)}`);
+        }
+        const expiresInRaw = body["expires_in"];
+        const expiresInSeconds = typeof expiresInRaw === "number"
+            ? expiresInRaw
+            : Number(expiresInRaw || 0);
+        this.cachedToken = {
+            accessToken,
+            expiresAtMs: Date.now() +
+                (Number.isFinite(expiresInSeconds) && expiresInSeconds > 0
+                    ? expiresInSeconds * 1000
+                    : 5 * 60 * 1000),
+        };
+        return { accessToken, fromCache: false };
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * Incidents
+     * ---------------------------------------------------------------------
+     */
+    /*
+     * One page of incidents. Pass `nextLink` from the previous page to
+     * continue; the window parameters are ignored then because ARM encodes
+     * the whole query (filter, order, skip token) inside the link.
+     */
+    async listIncidents(data) {
+        const url = data.nextLink
+            ? this.assertNextLink(data.nextLink)
+            : this.buildIncidentsUrl({
+                startTime: data.startTime,
+                endTime: data.endTime,
+                top: data.top || MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE,
+            });
+        let token = await this.acquireToken();
+        let response = await this.sendRaw(MicrosoftSentinelClient.incidentsRequest(url, token.accessToken), INCIDENTS_STEP);
+        /*
+         * A cached token can be revoked (secret rotated, app registration
+         * removed) or expire between pages of one run. One retry with a
+         * freshly minted token separates "the token went stale" from "ARM does
+         * not accept tokens from this app" without ever looping: a fresh
+         * token that is refused fails below like any other 401.
+         */
+        if (response.statusCode === 401 && token.fromCache) {
+            this.cachedToken = null;
+            token = await this.acquireToken();
+            response = await this.sendRaw(MicrosoftSentinelClient.incidentsRequest(url, token.accessToken), INCIDENTS_STEP);
+        }
+        this.assertOk(response, INCIDENTS_STEP);
+        const body = this.requireJsonObject(response, INCIDENTS_STEP);
+        const value = body["value"];
+        if (!Array.isArray(value)) {
+            throw new APIException(`Microsoft Sentinel ${INCIDENTS_STEP} returned an unrecognized response shape: expected a "value" array, received keys ${MicrosoftSentinelClient.describeKeys(body)}.`);
+        }
+        const incidents = value.filter((item) => {
+            return Boolean(item && typeof item === "object" && !Array.isArray(item));
+        });
+        const nextLinkRaw = body["nextLink"];
+        const nextLink = typeof nextLinkRaw === "string" && nextLinkRaw.trim()
+            ? nextLinkRaw.trim()
+            : null;
+        return { incidents, nextLink };
+    }
+    /*
+     * Bounded availability count: one page of `top` incidents created in the
+     * window plus whether a further page exists. Never walks the pages — a
+     * count is for the test checklist, not for import.
+     */
+    async countIncidentsCreated(data) {
+        const page = await this.listIncidents({
+            startTime: data.startTime,
+            endTime: data.endTime,
+            top: data.top || MICROSOFT_SENTINEL_DEFAULT_PAGE_SIZE,
+        });
+        return {
+            count: page.incidents.length,
+            hasMore: page.nextLink !== null,
+        };
+    }
+    /*
+     * ---------------------------------------------------------------------
+     * Transport plumbing
+     * ---------------------------------------------------------------------
+     */
+    static incidentsRequest(url, accessToken) {
+        return {
+            method: "GET",
+            url,
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json",
+            },
+        };
+    }
+    /*
+     * nextLink is server-supplied. It is followed only when it stays on the
+     * configured ARM host over https: a link elsewhere would let a
+     * compromised or misconfigured endpoint steer the bearer token to a
+     * host of its choosing. The egress guard would still vet the host, but
+     * the token must not leave ARM regardless.
+     */
+    assertNextLink(nextLink) {
+        let parsed;
+        try {
+            parsed = new URL(nextLink);
+        }
+        catch (_a) {
+            throw new APIException(`Microsoft Sentinel ${INCIDENTS_STEP} returned an unusable nextLink: ${redactLogString(nextLink.substring(0, 200))}`);
+        }
+        const expected = new URL(this.endpoints.managementBaseUrl);
+        if (parsed.protocol !== "https:" || parsed.host !== expected.host) {
+            throw new APIException(`Microsoft Sentinel ${INCIDENTS_STEP} returned a nextLink on an unexpected host: ${redactLogString(parsed.host)} (expected ${expected.host}).`);
+        }
+        return parsed.toString();
+    }
+    // Send and require a 2xx answer.
+    async send(request, stepLabel) {
+        const response = await this.sendRaw(request, stepLabel);
+        this.assertOk(response, stepLabel);
+        return response;
+    }
+    /*
+     * Send and return whatever status came back, so a caller can react to a
+     * 401 before the status is turned into an error. Transport failures
+     * that carry an HTTP status are folded into a response; everything else
+     * (connection refused, the transport's own timeout, the local deadline)
+     * throws with the step in the prefix.
+     */
+    async sendRaw(request, stepLabel) {
+        this.requestCount++;
+        const timeoutSeconds = Math.max(1, Math.round(this.requestTimeoutInMs / 1000));
+        let timer = undefined;
+        const deadline = new Promise((_resolve, reject) => {
+            timer = setTimeout(() => {
+                reject(new APIException(`Microsoft Sentinel ${stepLabel} timed out after ${timeoutSeconds} seconds with no response.`));
+            }, this.requestTimeoutInMs);
+        });
+        try {
+            return await Promise.race([
+                this.options.transport(Object.assign(Object.assign({}, request), { timeoutInMs: this.requestTimeoutInMs })),
+                deadline,
+            ]);
+        }
+        catch (error) {
+            return this.recoverResponse(error, stepLabel);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    assertOk(response, stepLabel) {
+        if (response.statusCode >= 200 && response.statusCode < 300) {
+            return;
+        }
+        throw new APIException(`Microsoft Sentinel ${stepLabel} failed (HTTP ${response.statusCode}): ${MicrosoftSentinelClient.describeBody(response)}${MicrosoftSentinelClient.hintForFailure(stepLabel, response.statusCode, response.bodyJson)}`);
+    }
+    /*
+     * The production transport does not return error statuses — it throws
+     * `Data source responded with HTTP <status>: <body>`. Recover the status
+     * so the operator sees the same "(HTTP 403)" prefix whichever transport
+     * is behind the client, and the docs' troubleshooting keys stay true.
+     */
+    recoverResponse(error, stepLabel) {
+        if (error instanceof APIException) {
+            throw error;
+        }
+        const message = error instanceof Error ? error.message : String(error || "");
+        const match = message.match(TRANSPORT_HTTP_ERROR_REGEX);
+        if (match) {
+            const bodyText = match[2] || "";
+            let bodyJson = undefined;
+            try {
+                bodyJson = JSON.parse(bodyText);
+            }
+            catch (_a) {
+                bodyJson = undefined;
+            }
+            return { statusCode: Number(match[1]), bodyText, bodyJson };
+        }
+        throw new APIException(`Microsoft Sentinel ${stepLabel} failed: ${redactLogString(message || "unknown transport error").substring(0, 500)}`);
+    }
+    requireJsonObject(response, stepLabel) {
+        const body = response.bodyJson;
+        if (body === undefined || body === null) {
+            throw new APIException(`Microsoft Sentinel ${stepLabel} returned a non-JSON body: ${redactLogString((response.bodyText || "").substring(0, 200))}`);
+        }
+        if (typeof body !== "object" || Array.isArray(body)) {
+            throw new APIException(`Microsoft Sentinel ${stepLabel} returned an unrecognized response shape: expected a JSON object, received ${Array.isArray(body) ? "an array" : typeof body}.`);
+        }
+        return body;
+    }
+    /*
+     * A body excerpt safe to store: structurally redacted when it parsed as
+     * JSON (so any `access_token`/`client_secret` key is masked whatever its
+     * value looks like), textually redacted otherwise, and clipped.
+     */
+    static describeBody(response) {
+        if (response.bodyJson !== undefined && response.bodyJson !== null) {
+            const redacted = redactLogValue(response.bodyJson);
+            let serialized = "";
+            try {
+                serialized = JSON.stringify(redacted);
+            }
+            catch (_a) {
+                serialized = "[unserializable body]";
+            }
+            return serialized.substring(0, 500);
+        }
+        const text = (response.bodyText || "").trim();
+        return text
+            ? redactLogString(text).substring(0, 500)
+            : "(empty response body)";
+    }
+    static describeKeys(body) {
+        const keys = Object.keys(body).slice(0, 10);
+        return keys.length ? keys.join(", ") : "(none)";
+    }
+    /*
+     * What the status most likely means, in the operator's terms. Entra
+     * returns an `error` code with an AADSTS-prefixed description; ARM
+     * returns { error: { code, message } }. The hint never repeats the body.
+     */
+    static hintForFailure(stepLabel, status, bodyJson) {
+        const hint = MicrosoftSentinelClient.hintText(stepLabel, status, bodyJson);
+        return hint ? ` — ${hint}` : "";
+    }
+    static hintText(stepLabel, status, bodyJson) {
+        const body = bodyJson && typeof bodyJson === "object" && !Array.isArray(bodyJson)
+            ? bodyJson
+            : null;
+        if (stepLabel === TOKEN_STEP) {
+            const errorCode = body ? String(body["error"] || "") : "";
+            const description = body
+                ? String(body["error_description"] || "")
+                : "";
+            /*
+             * AADSTS7000215 is "invalid client secret provided", AADSTS7000216 is
+             * "client secret is required" — both mean the secret, not the ids.
+             */
+            if (errorCode === "invalid_client" ||
+                description.includes("AADSTS7000215") ||
+                description.includes("AADSTS7000216")) {
+                return "Microsoft Entra rejected the client secret. It is wrong, expired, or belongs to a different app registration; create a new secret under Certificates & secrets and update the connection.";
+            }
+            // AADSTS700016: application with identifier ... was not found in the directory.
+            if (errorCode === "unauthorized_client" ||
+                description.includes("AADSTS700016")) {
+                return "The Application (client) ID was not found in this tenant. Check the Directory (tenant) ID and Application (client) ID on the app registration's Overview page.";
+            }
+            // AADSTS90002: tenant not found.
+            if (description.includes("AADSTS90002") || status === 404) {
+                return "The Directory (tenant) ID does not name an existing tenant. Copy it from the app registration's Overview page.";
+            }
+            if (status === 400 || status === 401) {
+                return "Microsoft Entra refused the client-credentials request. Check the Directory (tenant) ID, Application (client) ID and client secret.";
+            }
+            if (status === 429) {
+                return "Microsoft Entra is throttling token requests; the next poll retries.";
+            }
+            if (status >= 500) {
+                return "Microsoft Entra reported a server-side problem; the next poll retries.";
+            }
+            return "";
+        }
+        const armCode = body
+            ? String((body["error"] || {})["code"] || "")
+            : "";
+        if (status === 401) {
+            return "Azure Resource Manager rejected the access token. The token was issued for the wrong cloud or the app registration was removed; confirm the Cloud setting matches where the workspace lives.";
+        }
+        if (status === 403 || armCode === "AuthorizationFailed") {
+            return "The app registration is not allowed to read incidents. Assign it the Microsoft Sentinel Reader role on the resource group that contains the workspace (Access control (IAM) > Add role assignment) and wait a few minutes for the assignment to propagate.";
+        }
+        if (status === 404) {
+            return "No workspace matched Subscription ID, Resource group and Workspace name, or Microsoft Sentinel is not enabled on it. Copy the values from the workspace's Overview page in the Azure portal.";
+        }
+        if (status === 429) {
+            return "Azure Resource Manager is throttling requests for this subscription; the next poll retries.";
+        }
+        if (status >= 500) {
+            return "Azure Resource Manager reported a server-side problem; the next poll retries.";
+        }
+        if (status === 400) {
+            return "Azure Resource Manager rejected the query. Report this message to OneUptime support; the incidents request is built by the connector, not from your settings.";
+        }
+        return "";
+    }
+}
+//# sourceMappingURL=MicrosoftSentinelClient.js.map

package/build/dist/Server/Utils/SecurityEvent/Connectors/MicrosoftSentinel/MicrosoftSentinelClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MicrosoftSentinelClient.js","sourceRoot":"","sources":["../../../../../../../Server/Utils/SecurityEvent/Connectors/MicrosoftSentinel/MicrosoftSentinelClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,6CAA6C,CAAC;AACvE,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAM/E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA4CxE,MAAM,CAAC,MAAM,kCAAkC,GAG3C;IACF,MAAM,EAAE;QACN,YAAY,EAAE,mCAAmC;QACjD,iBAAiB,EAAE,8BAA8B;QACjD,UAAU,EAAE,kBAAkB;KAC/B;IACD,KAAK,EAAE;QACL,YAAY,EAAE,kCAAkC;QAChD,iBAAiB,EAAE,sCAAsC;QACzD,UAAU,EAAE,iBAAiB;KAC9B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAW,YAAY,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAW,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,gCAAgC,GAAW,IAAI,CAAC;AAE7D,MAAM,CAAC,MAAM,gDAAgD,GAC3D,EAAE,GAAG,IAAI,CAAC;AAEZ,iEAAiE;AACjE,MAAM,uBAAuB,GAAW,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,UAAU,GAAW,eAAe,CAAC;AAC3C,MAAM,cAAc,GAAW,gBAAgB,CAAC;AAEhD,MAAM,UAAU,GACd,+EAA+E,CAAC;AAElF;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,qGAAqG,CAAC;AAExG;;;;GAIG;AACH,MAAM,oBAAoB,GAAW,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,MAAM,oBAAoB,GAAW,uCAAuC,CAAC;AAE7E,6DAA6D;AAC7D,MAAM,0BAA0B,GAC9B,wDAAwD,CAAC;AAsC3D,MAAM,CAAC,OAAO,OAAO,uBAAuB;IAO1C,YAAmB,OAAuC;QAHlD,gBAAW,GAAuB,IAAI,CAAC;QACvC,iBAAY,GAAW,CAAC,CAAC;QAG/B,uBAAuB,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3D,uBAAuB,CAAC,YAAY,CAClC,OAAO,CAAC,QAAQ,EAChB,yBAAyB,CAC1B,CAAC;QACF,uBAAuB,CAAC,YAAY,CAClC,OAAO,CAAC,cAAc,EACtB,iBAAiB,CAClB,CAAC;QACF,uBAAuB,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACrE,uBAAuB,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAErE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,GAAG,CAAC;gBAC1D,CAAC,CAAC,OAAO,CAAC,kBAAkB;gBAC5B,CAAC,CAAC,gDAAgD,CAAC;IACzD,CAAC;IAED,sEAAsE;IAC/D,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IAEI,MAAM,CAAC,OAAO,CAAC,KAAa;QACjC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,CAAC;IACjD,CAAC;IAEM,MAAM,CAAC,YAAY,CACxB,KAAyB;QAEzB,MAAM,UAAU,GAAW,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEpE,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,UAAU,IAAI,CAC/D,CAAC;QACJ,CAAC;QAED,OAAO,kCAAkC,CAAC,UAAU,CAAC,CAAC;IACxD,CAAC;IAEM,MAAM,CAAC,YAAY,CAAC,KAAa,EAAE,KAAa;QACrD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,+DAA+D,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,gBAAgB,CAAC,KAAa;QAC1C,MAAM,OAAO,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,IACE,CAAC,OAAO;YACR,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,4GAA4G,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,qBAAqB,CAAC,KAAa;QAC/C,MAAM,OAAO,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,IACE,CAAC,OAAO;YACR,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,yIAAyI,CAC1I,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,qBAAqB,CAAC,KAAa;QAC/C,MAAM,OAAO,GAAW,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE7C,IACE,CAAC,OAAO;YACR,OAAO,CAAC,MAAM,GAAG,EAAE;YACnB,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EACnC,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,qGAAqG,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IAEI,WAAW;QAChB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,kBAAkB,CACzD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAC7B,oBAAoB,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACI,aAAa;QAClB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,WAAW,CAAC;IACxD,CAAC;IAEM,mBAAmB;QACxB,OAAO,CACL,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,kBAAkB,kBAAkB,CACrE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CACnC,EAAE;YACH,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE;YAC1E,uDAAuD,kBAAkB,CACvE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAClC,EAAE;YACH,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,iBAAiB,CAAC,IAIxB;QACC,MAAM,GAAG,GAAW,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;QACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,SAAS,EACT,iCAAiC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,uCAAuC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAClI,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;QAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAE1C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEM,MAAM,CAAC,aAAa,CAAC,KAAyB;QACnD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,oCAAoC,CAAC;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CACb,gCAAgC,EAChC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IAEI,KAAK,CAAC,cAAc;QACzB,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IACE,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,WAAW,CAAC,WAAW,GAAG,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,EACnE,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,IAAI,CACtD;YACE,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE;YACvB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,cAAc,EAAE,IAAI;YACpB,IAAI,EAAE;gBACJ,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;gBACvC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;gBACxC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE;aAC5B;SACF,EACD,UAAU,CACX,CAAC;QAEF,MAAM,IAAI,GAAe,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtE,MAAM,WAAW,GAAY,IAAI,CAAC,cAAc,CAAC,CAAC;QAElD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YACpD,MAAM,IAAI,YAAY,CACpB,sBAAsB,UAAU,8BAA8B,uBAAuB,CAAC,YAAY,CAChG,QAAQ,CACT,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAY,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,gBAAgB,GACpB,OAAO,YAAY,KAAK,QAAQ;YAC9B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;QAEhC,IAAI,CAAC,WAAW,GAAG;YACjB,WAAW;YACX,WAAW,EACT,IAAI,CAAC,GAAG,EAAE;gBACV,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC;oBACxD,CAAC,CAAC,gBAAgB,GAAG,IAAI;oBACzB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACrB,CAAC;QAEF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IAEH;;;;OAIG;IACI,KAAK,CAAC,aAAa,CAAC,IAK1B;QACC,MAAM,GAAG,GAAW,IAAI,CAAC,QAAQ;YAC/B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,oCAAoC;aACtD,CAAC,CAAC;QAEP,IAAI,KAAK,GAAkB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACrD,IAAI,QAAQ,GAA2B,MAAM,IAAI,CAAC,OAAO,CACvD,uBAAuB,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,EAChE,cAAc,CACf,CAAC;QAEF;;;;;;WAMG;QACH,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAC3B,uBAAuB,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,EAChE,cAAc,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAExC,MAAM,IAAI,GAAe,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAY,IAAI,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CACpB,sBAAsB,cAAc,qFAAqF,uBAAuB,CAAC,YAAY,CAC3J,IAAI,CACL,GAAG,CACL,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAuB,KAA0B,CAAC,MAAM,CACrE,CAAC,IAAe,EAAW,EAAE;YAC3B,OAAO,OAAO,CACZ,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CACzD,CAAC;QACJ,CAAC,CACmB,CAAC;QAEvB,MAAM,WAAW,GAAY,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GACZ,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE;YACnD,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;YACpB,CAAC,CAAC,IAAI,CAAC;QAEX,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAIlC;QACC,MAAM,IAAI,GAAmC,MAAM,IAAI,CAAC,aAAa,CAAC;YACpE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,oCAAoC;SACtD,CAAC,CAAC;QAEH,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;SAChC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IAEK,MAAM,CAAC,gBAAgB,CAC7B,GAAW,EACX,WAAmB;QAEnB,OAAO;YACL,MAAM,EAAE,KAAK;YACb,GAAG;YACH,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,QAAgB;QACrC,IAAI,MAAW,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,sBAAsB,cAAc,mCAAmC,eAAe,CACpF,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAC3B,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,YAAY,CACpB,sBAAsB,cAAc,+CAA+C,eAAe,CAChG,MAAM,CAAC,IAAI,CACZ,cAAc,QAAQ,CAAC,IAAI,IAAI,CACjC,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED,iCAAiC;IACzB,KAAK,CAAC,IAAI,CAChB,OAA8B,EAC9B,SAAiB;QAEjB,MAAM,QAAQ,GAA2B,MAAM,IAAI,CAAC,OAAO,CACzD,OAAO,EACP,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,OAAO,CACnB,OAA8B,EAC9B,SAAiB;QAEjB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,cAAc,GAAW,IAAI,CAAC,GAAG,CACrC,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAC3C,CAAC;QACF,IAAI,KAAK,GAA8C,SAAS,CAAC;QAEjE,MAAM,QAAQ,GAAmB,IAAI,OAAO,CAC1C,CACE,QAAqD,EACrD,MAAkC,EAC5B,EAAE;YACR,KAAK,GAAG,UAAU,CAAC,GAAS,EAAE;gBAC5B,MAAM,CACJ,IAAI,YAAY,CACd,sBAAsB,SAAS,oBAAoB,cAAc,4BAA4B,CAC9F,CACF,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9B,CAAC,CACF,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,OAAO,CAAC,SAAS,iCACjB,OAAO,KACV,WAAW,EAAE,IAAI,CAAC,kBAAkB,IACpC;gBACF,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,QAAgC,EAAE,SAAiB;QAClE,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,YAAY,CACpB,sBAAsB,SAAS,iBAAiB,QAAQ,CAAC,UAAU,MAAM,uBAAuB,CAAC,YAAY,CAC3G,QAAQ,CACT,GAAG,uBAAuB,CAAC,cAAc,CACxC,SAAS,EACT,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,QAAQ,CAClB,EAAE,CACJ,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,eAAe,CACrB,KAAc,EACd,SAAiB;QAEjB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,0BAA0B,CAC3B,CAAC;QAEF,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,QAAQ,GAAY,SAAS,CAAC;YAElC,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YAAC,WAAM,CAAC;gBACP,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;YAED,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,YAAY,CACpB,sBAAsB,SAAS,YAAY,eAAe,CACxD,OAAO,IAAI,yBAAyB,CACrC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACtB,CAAC;IACJ,CAAC;IAEO,iBAAiB,CACvB,QAAgC,EAChC,SAAiB;QAEjB,MAAM,IAAI,GAAY,QAAQ,CAAC,QAAQ,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CACpB,sBAAsB,SAAS,8BAA8B,eAAe,CAC1E,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAC5C,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,YAAY,CACpB,sBAAsB,SAAS,8EAA8E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAC/J,CAAC;QACJ,CAAC;QAED,OAAO,IAAkB,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,YAAY,CAAC,QAI3B;QACC,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAY,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,UAAU,GAAW,EAAE,CAAC;YAE5B,IAAI,CAAC;gBACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;YAAC,WAAM,CAAC;gBACP,UAAU,GAAG,uBAAuB,CAAC;YACvC,CAAC;YAED,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,GAAW,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtD,OAAO,IAAI;YACT,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACzC,CAAC,CAAC,uBAAuB,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,IAAgB;QAC1C,MAAM,IAAI,GAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAE3D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,cAAc,CAC1B,SAAiB,EACjB,MAAc,EACd,QAAiB;QAEjB,MAAM,IAAI,GAAW,uBAAuB,CAAC,QAAQ,CACnD,SAAS,EACT,MAAM,EACN,QAAQ,CACT,CAAC;QAEF,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAEO,MAAM,CAAC,QAAQ,CACrB,SAAiB,EACjB,MAAc,EACd,QAAiB;QAEjB,MAAM,IAAI,GACR,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAClE,CAAC,CAAE,QAAuB;YAC1B,CAAC,CAAC,IAAI,CAAC;QAEX,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAW,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,WAAW,GAAW,IAAI;gBAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;gBACzC,CAAC,CAAC,EAAE,CAAC;YAEP;;;eAGG;YACH,IACE,SAAS,KAAK,gBAAgB;gBAC9B,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACrC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EACrC,CAAC;gBACD,OAAO,2LAA2L,CAAC;YACrM,CAAC;YAED,gFAAgF;YAChF,IACE,SAAS,KAAK,qBAAqB;gBACnC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,EACpC,CAAC;gBACD,OAAO,gKAAgK,CAAC;YAC1K,CAAC;YAED,iCAAiC;YACjC,IAAI,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1D,OAAO,gHAAgH,CAAC;YAC1H,CAAC;YAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrC,OAAO,qIAAqI,CAAC;YAC/I,CAAC;YAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,sEAAsE,CAAC;YAChF,CAAC;YAED,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAClB,OAAO,wEAAwE,CAAC;YAClF,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAW,IAAI;YAC1B,CAAC,CAAC,MAAM,CAAC,CAAE,IAAI,CAAC,OAAO,CAA4B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,8LAA8L,CAAC;QACxM,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;YACxD,OAAO,4PAA4P,CAAC;QACtQ,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,8LAA8L,CAAC;QACxM,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,6FAA6F,CAAC;QACvG,CAAC;QAED,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,OAAO,+EAA+E,CAAC;QACzF,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,+JAA+J,CAAC;QACzK,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}