@opendatalabs/personal-server-ts-core 1.33.8 → 1.34.1

package/dist/pdpp/selection.js

@@ -0,0 +1,442 @@
+/**
+ * PDPP Core §6 selection-request validation.
+ *
+ * This is the shape gate that runs before consent. It answers one question:
+ * is this request expressible against the retained declaration snapshot? It
+ * does not resolve anything — `resolve.ts` does that, and only against the
+ * same snapshot this module validated against.
+ *
+ * "Fails neutrally" in §6 means the both/neither `streams`/`selection_preset`
+ * failure is a Source validation failure the binding maps to an error code; it
+ * must not leak which of the two the client got wrong, and it must not depend
+ * on any owner-specific state. We return a binding-neutral failure and let the
+ * OAuth/RAR layer map it to RFC 9396 `invalid_authorization_details`.
+ */
+import { PDPP_DATA_ACCESS_TYPE, PDPP_DATA_ACCESS_TYPE_V02, } from "./types.js";
+function fail(code, message) {
+    return { ok: false, failure: { code, message } };
+}
+/**
+ * Canonical key strings: a plain string for a simple key, a minified JSON
+ * array for a compound key (§6 `resources`). We validate arity and type
+ * against the declaration's `primary_key` here so an unsatisfiable resource
+ * list is rejected at issuance rather than silently matching nothing at the RS.
+ */
+function validateResourceKey(raw, primaryKey) {
+    if (primaryKey.length <= 1) {
+        // A simple key is a plain string. A JSON array here is an arity error.
+        if (raw.startsWith("[")) {
+            return "expected a simple key string, got a compound key array";
+        }
+        return raw.length > 0 ? null : "resource key must not be empty";
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return "compound resource key must be a minified JSON array";
+    }
+    if (!Array.isArray(parsed)) {
+        return "compound resource key must be a JSON array";
+    }
+    if (parsed.length !== primaryKey.length) {
+        return `compound resource key has ${parsed.length} parts, declaration primary_key has ${primaryKey.length}`;
+    }
+    if (!parsed.every((part) => typeof part === "string")) {
+        return "compound resource key parts must be strings";
+    }
+    return null;
+}
+/**
+ * The field set a `minimum.fields` member must be drawn from: the *expanded
+ * request*, not the declaration.
+ *
+ * v0.2 requires rejecting fields "outside the expanded request", which is a
+ * stricter gate than the declared schema. A floor naming a field the client
+ * did not request is incoherent — the upper limit already excludes it, so the
+ * minimum could never be met and the request could never succeed. Catching it
+ * here turns a guaranteed `access_denied` at issuance into a fixable shape
+ * error before a human is asked to decide anything.
+ */
+function expandedRequestFields(stream, declared, snapshot) {
+    if (stream.view !== undefined) {
+        const view = snapshot.views?.find((v) => v.name === stream.view);
+        // An unresolvable view already failed above; treat it as empty here.
+        return view ? view.fields.filter((f) => declared.fields.includes(f)) : [];
+    }
+    if (stream.fields !== undefined) {
+        return stream.fields.filter((f) => declared.fields.includes(f));
+    }
+    // Omitting both asks for all permitted fields, so the whole declared set is
+    // in the expanded request.
+    return declared.fields;
+}
+/**
+ * Validate a request `time_range`'s own shape, independent of which stream
+ * carries it.
+ *
+ * Shared by the named-stream path and the wildcard path so the two cannot
+ * disagree about what a well-formed window is. Before this was factored out,
+ * a wildcard's window skipped every check here — unparseable bounds, an
+ * inverted `since`/`until`, and an empty `{}` were all accepted, while the
+ * same values written longhand were rejected. A shorthand that validates less
+ * than the form it stands for is a hole, not a convenience.
+ *
+ * `value` is untrusted JSON, so the object and string types are checked
+ * rather than assumed: a `null` or a number here must be a validation failure,
+ * not a `TypeError` that the binding turns into a 500.
+ */
+function validateTimeRangeBounds(value, subject) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return fail("invalid_request", `${subject} time_range must be an object`);
+    }
+    const { since, until } = value;
+    if (since === undefined && until === undefined) {
+        return fail("invalid_request", `${subject} has an empty time_range`);
+    }
+    for (const [label, bound] of [
+        ["since", since],
+        ["until", until],
+    ]) {
+        if (bound === undefined)
+            continue;
+        if (typeof bound !== "string" || Number.isNaN(Date.parse(bound))) {
+            return fail("invalid_request", `${subject} time_range.${label} is not a valid ISO 8601 instant`);
+        }
+    }
+    if (typeof since === "string" && typeof until === "string") {
+        if (Date.parse(since) >= Date.parse(until)) {
+            return fail("invalid_request", `${subject} time_range.since must precede time_range.until`);
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Validate one v0.2 `minimum` against the request that carries it.
+ *
+ * Everything here is a shape question answerable without the owner, the
+ * inventory, or any record. Whether the *owner's* narrowing then satisfies a
+ * well-formed minimum is an issuance question, handled in `resolve.ts`.
+ */
+function validateMinimum(stream, declared, snapshot) {
+    const minimum = stream.minimum;
+    if (minimum === undefined)
+        return { ok: true };
+    const bad = (message) => fail("invalid_minimum", `stream '${stream.name}' minimum: ${message}`);
+    if (typeof minimum !== "object" || minimum === null) {
+        return bad("must be an object");
+    }
+    // Only `fields` and `time_range` are recognized. An unknown member must not
+    // pass silently: the client would believe it imposed a condition the AS
+    // never evaluates.
+    const unknown = Object.keys(minimum).filter((key) => key !== "fields" && key !== "time_range");
+    if (unknown.length > 0) {
+        return bad(`unknown member(s) ${unknown.join(", ")}`);
+    }
+    if (minimum.fields === undefined && minimum.time_range === undefined) {
+        return bad("must specify at least one of fields or time_range");
+    }
+    if (minimum.fields !== undefined) {
+        const fields = minimum.fields;
+        if (!Array.isArray(fields) || fields.length === 0) {
+            return bad("fields must be a non-empty array");
+        }
+        if (!fields.every((f) => typeof f === "string" && f.length > 0)) {
+            return bad("fields must contain non-empty strings");
+        }
+        if (new Set(fields).size !== fields.length) {
+            return bad("fields must not contain duplicates");
+        }
+        const permitted = expandedRequestFields(stream, declared, snapshot);
+        const outside = fields.filter((f) => !permitted.includes(f));
+        if (outside.length > 0) {
+            return bad(`fields outside the expanded request: ${outside.join(", ")}`);
+        }
+    }
+    if (minimum.time_range !== undefined) {
+        const range = minimum.time_range;
+        if (typeof range !== "object" || range === null || Array.isArray(range)) {
+            return bad("time_range must be an object");
+        }
+        const { since, until } = range;
+        // Unlike a request `time_range`, a minimum window must be closed: an open
+        // floor would mean "at least everything", which no narrowing can satisfy
+        // and which the request's own upper limit already bounds.
+        if (typeof since !== "string" || typeof until !== "string") {
+            return bad("time_range must contain both since and until");
+        }
+        const from = Date.parse(since);
+        const to = Date.parse(until);
+        if (Number.isNaN(from) || Number.isNaN(to)) {
+            return bad("time_range bounds must be valid ISO 8601 instants");
+        }
+        if (from >= to) {
+            return bad("time_range.since must precede time_range.until");
+        }
+        if (!declared.consent_time_field) {
+            return bad("stream declares no consent_time_field and cannot carry a time minimum");
+        }
+        // The floor must sit inside the ceiling. Comparisons are on instants, so
+        // an offset-bearing timestamp is ordered by the moment it names rather
+        // than by its string form.
+        const requested = stream.time_range;
+        const ceilingSince = requested?.since !== undefined ? Date.parse(requested.since) : -Infinity;
+        const ceilingUntil = requested?.until !== undefined ? Date.parse(requested.until) : Infinity;
+        if (from < ceilingSince || to > ceilingUntil) {
+            return bad("time_range falls outside the requested time_range");
+        }
+    }
+    return { ok: true };
+}
+function validateStreamRequest(stream, snapshot, revision) {
+    // The entry is untrusted JSON: `streams: [null]` and `streams: ["name"]`
+    // both reach here. Every check below reads a member off it, so the shape
+    // gate comes first or the first read throws.
+    if (typeof stream !== "object" || stream === null || Array.isArray(stream)) {
+        return fail("invalid_request", "each stream entry must be an object");
+    }
+    if (typeof stream.name !== "string" || stream.name.length === 0) {
+        return fail("invalid_request", "each stream entry must carry a non-empty name");
+    }
+    if (stream.necessity !== undefined) {
+        if (stream.necessity !== "required" && stream.necessity !== "optional") {
+            return fail("invalid_request", `stream '${stream.name}' necessity must be required or optional`);
+        }
+    }
+    if (stream.minimum !== undefined && revision === "0.1") {
+        // v0.1 has no `minimum`. Accepting and ignoring it is the one outcome
+        // worse than rejecting: the client would ship believing a floor is
+        // enforced. A client that wants minima moves to the v0.2 type.
+        return fail("unsupported_selection_parameter", `stream '${stream.name}' carries minimum, which requires the ${PDPP_DATA_ACCESS_TYPE_V02} detail type`);
+    }
+    // A wildcard is checked by the caller (it must be the sole entry) and
+    // expands during resolution, so there is no declared stream to match yet.
+    if (stream.name === "*") {
+        if (stream.view !== undefined) {
+            return fail("unsupported_selection_parameter", "view cannot be combined with a wildcard stream selection");
+        }
+        if (stream.minimum !== undefined) {
+            // A wildcard minimum would be one floor asserted over every stream the
+            // declaration happens to contain, including streams whose schema has no
+            // such field and streams that cannot carry a time window at all. v0.2
+            // defines a minimum per named stream; it says nothing about what a
+            // fanned-out one would mean, so we do not invent semantics for it.
+            return fail("unsupported_selection_parameter", "minimum cannot be combined with a wildcard stream selection");
+        }
+        if (stream.time_range !== undefined) {
+            // A wildcard is shorthand for naming every declared stream, so it
+            // cannot mean something weaker than naming them. §6's rule for a named
+            // stream — "no consent_time_field, no time_range" — therefore applies
+            // to every stream the wildcard expands to.
+            //
+            // The alternative was to keep accepting this and let resolution drop
+            // the window for time-incapable streams, which is what the code did.
+            // That silently issued unbounded access to those streams from a request
+            // whose own words asked for a bounded one: the owner approved, and the
+            // client received, more than either had read. A request that cannot be
+            // carried out as written is refused, not quietly reinterpreted.
+            const incapable = snapshot.streams
+                .filter((s) => !s.consent_time_field)
+                .map((s) => s.name);
+            if (incapable.length > 0) {
+                return fail("unsupported_selection_parameter", `wildcard time_range expands to stream(s) that declare no consent_time_field and cannot accept it: ${incapable.join(", ")}`);
+            }
+            // The window's own shape is checked by the same rule a named stream's
+            // is; a wildcard must not be the weaker form.
+            const bounds = validateTimeRangeBounds(stream.time_range, "wildcard stream selection");
+            if (!bounds.ok)
+                return bounds;
+        }
+        return { ok: true };
+    }
+    const declared = snapshot.streams.find((s) => s.name === stream.name);
+    if (!declared) {
+        return fail("unknown_stream", `stream '${stream.name}' is not declared by the retained snapshot`);
+    }
+    if (stream.view !== undefined && stream.fields !== undefined) {
+        return fail("invalid_request", `stream '${stream.name}' specifies both view and fields, which are mutually exclusive`);
+    }
+    if (stream.view !== undefined) {
+        const view = snapshot.views?.find((v) => v.name === stream.view);
+        if (!view) {
+            return fail("unknown_view", `view '${stream.view}' is not defined for this source`);
+        }
+        // §9 AS item 12: a view naming a field absent from the retained schema is
+        // not resolvable, and we reject rather than silently dropping the field.
+        const absent = view.fields.filter((f) => !declared.fields.includes(f));
+        if (absent.length > 0) {
+            return fail("unknown_field", `view '${stream.view}' names fields absent from stream '${stream.name}': ${absent.join(", ")}`);
+        }
+    }
+    if (stream.fields !== undefined) {
+        if (!Array.isArray(stream.fields)) {
+            return fail("invalid_request", `stream '${stream.name}' fields must be an array`);
+        }
+        if (stream.fields.length === 0) {
+            return fail("invalid_request", `stream '${stream.name}' specifies an empty fields list`);
+        }
+        if (!stream.fields.every((f) => typeof f === "string" && f.length > 0)) {
+            return fail("invalid_request", `stream '${stream.name}' fields must contain non-empty strings`);
+        }
+        const absent = stream.fields.filter((f) => !declared.fields.includes(f));
+        if (absent.length > 0) {
+            return fail("unknown_field", `stream '${stream.name}' requests fields absent from the retained schema: ${absent.join(", ")}`);
+        }
+    }
+    if (stream.time_range !== undefined) {
+        // §6: the declaration's consent_time_field is the authoritative signal
+        // that a stream is time-range-capable. No field, no time_range.
+        if (!declared.consent_time_field) {
+            return fail("unsupported_selection_parameter", `stream '${stream.name}' declares no consent_time_field and cannot accept time_range`);
+        }
+        const bounds = validateTimeRangeBounds(stream.time_range, `stream '${stream.name}'`);
+        if (!bounds.ok)
+            return bounds;
+    }
+    if (stream.resources !== undefined) {
+        if (!Array.isArray(stream.resources)) {
+            return fail("invalid_request", `stream '${stream.name}' resources must be an array`);
+        }
+        if (stream.resources.length === 0) {
+            return fail("invalid_request", `stream '${stream.name}' specifies an empty resources list`);
+        }
+        for (const raw of stream.resources) {
+            if (typeof raw !== "string") {
+                return fail("invalid_resource_key", `stream '${stream.name}' resources must contain strings`);
+            }
+            const problem = validateResourceKey(raw, declared.primary_key);
+            if (problem) {
+                return fail("invalid_resource_key", `stream '${stream.name}' resource '${raw}': ${problem}`);
+            }
+        }
+    }
+    // Last, so a minimum naming a field that is itself undeclared reports the
+    // undeclared field rather than the floor built on it.
+    return validateMinimum(stream, declared, snapshot);
+}
+/**
+ * Validate one selection request against the retained declaration snapshot.
+ *
+ * The caller must have already retrieved and pinned `snapshot`; this function
+ * never fetches. §9 AS item 16 requires that the same snapshot carry through
+ * consent and issuance, so passing a freshly fetched declaration here and a
+ * different one to `resolveGrant` would defeat the whole guarantee.
+ */
+export function validateSelectionRequest(request, snapshot) {
+    // Exactly two types are recognized, each resolved under its own revision.
+    // Anything else is rejected rather than processed as the nearest PDPP type:
+    // a type URI the AS does not implement carries rules it does not apply.
+    const revision = request.type === PDPP_DATA_ACCESS_TYPE_V02
+        ? "0.2"
+        : request.type === PDPP_DATA_ACCESS_TYPE
+            ? "0.1"
+            : null;
+    if (revision === null) {
+        return fail("invalid_request", `authorization detail type must be ${PDPP_DATA_ACCESS_TYPE} or ${PDPP_DATA_ACCESS_TYPE_V02}`);
+    }
+    if (typeof request.source !== "object" ||
+        request.source === null ||
+        Array.isArray(request.source)) {
+        return fail("invalid_request", "source must be an object");
+    }
+    if (request.source.id !== snapshot.source_id) {
+        return fail("invalid_request", "request source.id does not match the retained declaration snapshot");
+    }
+    // §6: the purpose code must be a syntactically valid absolute URI, and that
+    // is the only syntactic gate. §9 AS item 6 forbids rejecting a code merely
+    // for being absent from the registry — an unregistered code renders from its
+    // description or raw URI instead.
+    if (!isAbsoluteUri(request.purpose_code)) {
+        return fail("invalid_request", "purpose_code must be an absolute URI");
+    }
+    if (request.access_mode !== "single_use" &&
+        request.access_mode !== "continuous") {
+        return fail("invalid_request", "access_mode must be single_use or continuous");
+    }
+    if (request.retention !== undefined) {
+        const retention = request.retention;
+        if (typeof retention !== "object" ||
+            retention === null ||
+            Array.isArray(retention)) {
+            return fail("invalid_request", "retention must be an object");
+        }
+        const { on_expiry } = retention;
+        if (on_expiry !== "delete" && on_expiry !== "anonymize") {
+            // `archive` was dropped in v0.1 and is the likely wrong value here.
+            return fail("invalid_request", "retention.on_expiry must be delete or anonymize");
+        }
+    }
+    const hasStreams = request.streams !== undefined;
+    const hasPreset = request.selection_preset !== undefined;
+    if (hasStreams === hasPreset) {
+        // Both or neither. Deliberately one message for both cases: the failure
+        // is about the pair, and distinguishing them tells a probing client which
+        // half the server accepted.
+        return fail("source_validation_failed", "exactly one of streams or selection_preset is required");
+    }
+    if (hasPreset) {
+        const preset = snapshot.selection_presets?.find((p) => p.name === request.selection_preset);
+        if (!preset) {
+            return fail("unknown_preset", `selection preset '${request.selection_preset}' is not defined by the retained snapshot`);
+        }
+        // The preset's own streams still have to be expressible against the
+        // snapshot; a declaration that ships a preset naming a dropped stream is
+        // invalid and we would rather fail here than resolve an empty grant.
+        for (const stream of preset.streams) {
+            const result = validateStreamRequest(stream, snapshot, revision);
+            if (!result.ok)
+                return result;
+        }
+        return { ok: true };
+    }
+    const streams = request.streams ?? [];
+    if (!Array.isArray(streams)) {
+        return fail("invalid_request", "streams must be an array");
+    }
+    if (streams.length === 0) {
+        return fail("invalid_request", "streams must not be empty");
+    }
+    // Every check from here down reads `.name` off an entry — the wildcard
+    // scan, the uniqueness scan, and the per-stream validation — so the entry
+    // shapes are gated once, first, rather than at each read.
+    for (const entry of streams) {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+            return fail("invalid_request", "each stream entry must be an object");
+        }
+        if (typeof entry.name !== "string" || entry.name.length === 0) {
+            return fail("invalid_request", "each stream entry must carry a non-empty name");
+        }
+    }
+    const wildcards = streams.filter((s) => s.name === "*");
+    if (wildcards.length > 0 && streams.length > 1) {
+        // §6 clause 6.8-3: a wildcard entry must be the only entry. Like the
+        // streams/preset exactly-one check above, this is a Source validation
+        // failure and must map to the same RFC 9396 code.
+        return fail("source_validation_failed", "a wildcard stream entry must be the only entry in streams");
+    }
+    const seen = new Set();
+    for (const stream of streams) {
+        if (seen.has(stream.name)) {
+            // §6 clause 6.8-3: stream names must be unique — also a Source
+            // validation failure.
+            return fail("source_validation_failed", `stream '${stream.name}' appears more than once`);
+        }
+        seen.add(stream.name);
+        const result = validateStreamRequest(stream, snapshot, revision);
+        if (!result.ok)
+            return result;
+    }
+    return { ok: true };
+}
+function isAbsoluteUri(value) {
+    try {
+        // URL rejects relative references, which is exactly the check we want.
+        new URL(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=selection.js.map

package/dist/pdpp/selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection.js","sourceRoot":"","sources":["../../src/pdpp/selection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAK1B,MAAM,YAAY,CAAC;AAiCpB,SAAS,IAAI,CACX,IAA0B,EAC1B,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,UAAoB;IAC5D,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC3B,uEAAuE;QACvE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,wDAAwD,CAAC;QAClE,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC,CAAC;IAClE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qDAAqD,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,4CAA4C,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,6BAA6B,MAAM,CAAC,MAAM,uCAAuC,UAAU,CAAC,MAAM,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtD,OAAO,6CAA6C,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAC5B,MAAqB,EACrB,QAAwB,EACxB,QAA6B;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,qEAAqE;QACrE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,4EAA4E;IAC5E,2BAA2B;IAC3B,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,OAAe;IAEf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,OAAO,+BAA+B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAA6C,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,OAAO,0BAA0B,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,OAAO,EAAE,KAAK,CAAC;KACR,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,OAAO,eAAe,KAAK,kCAAkC,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CACT,iBAAiB,EACjB,GAAG,OAAO,iDAAiD,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,MAAqB,EACrB,QAAwB,EACxB,QAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE/C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAC9B,IAAI,CAAC,iBAAiB,EAAE,WAAW,MAAM,CAAC,IAAI,cAAc,OAAO,EAAE,CAAC,CAAC;IAEzE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,YAAY,CAClD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrE,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,GAAY,OAAO,CAAC,UAAU,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAA6C,CAAC;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,0DAA0D;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,GAAG,CACR,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,uEAAuE;QACvE,2BAA2B;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,MAAM,YAAY,GAChB,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,MAAM,YAAY,GAChB,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,IAAI,IAAI,GAAG,YAAY,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAqB,EACrB,QAA6B,EAC7B,QAAuB;IAEvB,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CACT,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,0CAA0C,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvD,sEAAsE;QACtE,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,IAAI,CACT,iCAAiC,EACjC,WAAW,MAAM,CAAC,IAAI,yCAAyC,yBAAyB,cAAc,CACvG,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CACT,iCAAiC,EACjC,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,OAAO,IAAI,CACT,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,kEAAkE;YAClE,uEAAuE;YACvE,sEAAsE;YACtE,2CAA2C;YAC3C,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO;iBAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;iBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CACT,iCAAiC,EACjC,qGAAqG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5H,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,8CAA8C;YAC9C,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,CAAC,UAAU,EACjB,2BAA2B,CAC5B,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CACT,gBAAgB,EAChB,WAAW,MAAM,CAAC,IAAI,4CAA4C,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,gEAAgE,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CACT,cAAc,EACd,SAAS,MAAM,CAAC,IAAI,kCAAkC,CACvD,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,eAAe,EACf,SAAS,MAAM,CAAC,IAAI,sCAAsC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,2BAA2B,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,kCAAkC,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,yCAAyC,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,eAAe,EACf,WAAW,MAAM,CAAC,IAAI,sDAAsD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;YACjC,OAAO,IAAI,CACT,iCAAiC,EACjC,WAAW,MAAM,CAAC,IAAI,+DAA+D,CACtF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,CAAC,UAAU,EACjB,WAAW,MAAM,CAAC,IAAI,GAAG,CAC1B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,8BAA8B,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CACT,iBAAiB,EACjB,WAAW,MAAM,CAAC,IAAI,qCAAqC,CAC5D,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CACT,sBAAsB,EACtB,WAAW,MAAM,CAAC,IAAI,kCAAkC,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,CACT,sBAAsB,EACtB,WAAW,MAAM,CAAC,IAAI,eAAe,GAAG,MAAM,OAAO,EAAE,CACxD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,sDAAsD;IACtD,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAyB,EACzB,QAA6B;IAE7B,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,QAAQ,GACZ,OAAO,CAAC,IAAI,KAAK,yBAAyB;QACxC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CACT,iBAAiB,EACjB,qCAAqC,qBAAqB,OAAO,yBAAyB,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,IACE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClC,OAAO,CAAC,MAAM,KAAK,IAAI;QACvB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,IAAI,CACT,iBAAiB,EACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,kCAAkC;IAClC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;IACzE,CAAC;IAED,IACE,OAAO,CAAC,WAAW,KAAK,YAAY;QACpC,OAAO,CAAC,WAAW,KAAK,YAAY,EACpC,CAAC;QACD,OAAO,IAAI,CACT,iBAAiB,EACjB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,SAAS,GAAY,OAAO,CAAC,SAAS,CAAC;QAC7C,IACE,OAAO,SAAS,KAAK,QAAQ;YAC7B,SAAS,KAAK,IAAI;YAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;YACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,SAAoC,CAAC;QAC3D,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;YACxD,oEAAoE;YACpE,OAAO,IAAI,CACT,iBAAiB,EACjB,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC;IACzD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,wEAAwE;QACxE,0EAA0E;QAC1E,4BAA4B;QAC5B,OAAO,IAAI,CACT,0BAA0B,EAC1B,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAC3C,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CACT,gBAAgB,EAChB,qBAAqB,OAAO,CAAC,gBAAgB,2CAA2C,CACzF,CAAC;QACJ,CAAC;QACD,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC;QAChC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,0DAA0D;IAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CACT,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,qEAAqE;QACrE,sEAAsE;QACtE,kDAAkD;QAClD,OAAO,IAAI,CACT,0BAA0B,EAC1B,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,+DAA+D;YAC/D,sBAAsB;YACtB,OAAO,IAAI,CACT,0BAA0B,EAC1B,WAAW,MAAM,CAAC,IAAI,0BAA0B,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,uEAAuE;QACvE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}