@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/dist/src/slack/origin.js

@@ -0,0 +1,550 @@
+// The ORIGIN RECORD — the sole authority on what a Slack-driven overseer turn
+// is allowed to do.
+//
+// The overseer reads a Slack message as *text*, and text is attacker-controlled:
+// nothing the model repeats back to the daemon can be trusted to carry rights.
+// So the router writes the rights DOWN, next to the inject file it just dropped.
+// The inject body's `tier` line is decoration for the model; the record is what
+// the gate consults.
+//
+// PROVENANCE: the gate consults the record THIS PROCESS wrote, held in memory —
+// never whatever parses in the directory. The daemon runs as the same uid as
+// every pi session, so `state/slack/origin/` is session-writable: a persuaded
+// overseer could otherwise drop a far-future `source: "local", tier: "system"`
+// file and sort itself to the top. The operator command channel answers the
+// same problem with a root seal; here the daemon itself is the writer, so the
+// seal is its own memory. The files are the AUDIT trail — forensically joined
+// to the inject they sit beside, read back by `onDisk()` — and grant nothing.
+// Across a restart the memory is empty: the Slack dir fails closed (no live
+// origin), and disk seeds only what can RESTRICT. Two kinds of record are read
+// back: the last accepted wake (or newest record when none is proven accepted)
+// as `bootCause`, and every
+// one bound to a wake still pending in the inject dir (`bootQueued`) — pending
+// wakes survive a restart and the bridge serves them first, so a guest's
+// queued message is a guest's turn after the restart too. Either is kept only
+// when it is a Slack record from a non-owner, so a planted record can switch
+// the belt on, or narrow the rights of a turn this process recorded, and
+// nothing more. What disk cannot do is grant: a planted local/owner record
+// reads as no record, and a disk record alone never opens the Slack dir. Both
+// kinds stop counting only when a wake THIS process recorded is accepted after
+// them; a wake from the previous run never lifts them, so its turn stays under
+// the belt (fail closed).
+//
+// Attribution follows the turn being SERVED, never the newest record. The
+// overseer runs one wake at a time: the inject bridge offers a wake only
+// while pi is idle, takes pending wakes in FILE-NAME order, and moves a file
+// to `.done/` when pi accepts it, so a wake written while another turn runs
+// waits behind it. A record is bound to the wake file it was written for, and
+// the order that matters is the bridge's: the record whose wake comes LAST in
+// name order among the accepted ones is the running turn's. Write order is
+// not that order — a writer records first and names its wake file only after
+// an await, so two writers can finish in either order. Every record not yet
+// accepted (unbound, or bound to a wake still pending) describes a turn still
+// to come. The rights a command gets are the MOST RESTRICTIVE of the running
+// record and every one still to come: a queued owner message or daemon wake
+// never lends its rights to the guest turn still running, and a queued guest
+// message restricts a running owner turn (fail closed). A record whose wake
+// left the queue without being accepted, before the running one, describes no
+// turn and drops out. Acceptance is read from disk only as "the wake left
+// the pending queue AND landed in `.done/`": both live in the overseer's
+// inject dir, which the bash guard refuses every session's write to, and a
+// session has no program that removes or moves a file. Built without the
+// delivery directory, the store sees no acceptance and the newest record is
+// in force at once. A command file names no wake, so a command is judged by
+// the turn being served when the watcher reads it: one written at the very
+// end of a turn and read after the next wake is accepted gets that turn's
+// rights.
+//
+// A command in `commands/slack/` is attributed to an UNEXPIRED origin. The
+// window is short by design — an origin is a "a human is mid-conversation
+// with you right now" marker, not a session-long grant, and no origin means
+// no rights (fail closed).
+//
+// The legacy `commands/` belt asks a DIFFERENT question — "who caused the turn
+// I am serving?" — and answers it from `latestAny()`, ignoring expiry: waiting
+// out a TTL must never turn a guest's turn into an owner-tier one. Only a
+// daemon wake (`writeLocal`) that pi has accepted supersedes a Slack origin
+// there.
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { foldSlackTier } from "../state.js";
+/**
+ * How long an origin authorises commands. 15 minutes: long enough for the
+ * overseer to think, run a couple of tool calls and answer; short enough that a
+ * later autonomous wake (EOD sweep, anomaly) is never mistaken for the Slack
+ * user's turn. Deliberately a module constant — it is a safety parameter, not a
+ * knob a config file (or a prompt) may widen.
+ */
+export const ORIGIN_TTL_MS = 15 * 60 * 1000;
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** Parse + shape-check a record read off disk; unknown shapes are ignored. */
+export function parseOriginRecord(raw) {
+    if (!isRecord(raw))
+        return null;
+    const { source, event_id, slack_user, tier, authorized_prs, expires_at } = raw;
+    if (typeof event_id !== "string" || typeof slack_user !== "string")
+        return null;
+    // `foldSlackTier` accepts a legacy spelling of the owner tier (older records
+    // on disk still carry it) and folds it to "owner" — accepted on input, never
+    // emitted; everything unknown still grants nothing.
+    const foldedTier = foldSlackTier(tier);
+    if (foldedTier === null)
+        return null;
+    if (typeof expires_at !== "string" || Number.isNaN(Date.parse(expires_at)))
+        return null;
+    const prs = Array.isArray(authorized_prs)
+        ? authorized_prs.filter((n) => typeof n === "number" && Number.isInteger(n) && n > 0)
+        : [];
+    // Anything that is not literally "local" — missing, misspelled, non-string —
+    // reads as a Slack-caused turn, i.e. the restricting value.
+    return {
+        source: source === "local" ? "local" : "slack",
+        event_id,
+        slack_user,
+        tier: foldedTier,
+        authorized_prs: prs,
+        expires_at,
+    };
+}
+/** Rights order, least first: the most restrictive record wins a tie-break. */
+const TIER_RANK = {
+    ignored: 0,
+    anyone: 1,
+    author: 2,
+    owner: 3,
+    system: 4,
+};
+/**
+ * The rights several candidate records leave: the lowest tier among them, and
+ * for `author` only the PRs every author-tier candidate is authorised on.
+ * `cands` comes latest first; the audit fields are those of the lowest-tier
+ * record nearest the running turn.
+ */
+/**
+ * The legacy `commands/` belt's question about a turn's origin: a Slack turn
+ * from anyone but the owner restricts it. The same predicate decides which
+ * records are read back off disk at boot, since those may only restrict.
+ */
+export function beltRestricts(rec) {
+    return rec.source === "slack" && rec.tier !== "owner";
+}
+function mostRestrictive(cands) {
+    if (cands.length === 0)
+        return null;
+    const low = Math.min(...cands.map((c) => TIER_RANK[c.tier]));
+    const lowest = cands.filter((c) => TIER_RANK[c.tier] === low);
+    const pick = lowest[lowest.length - 1];
+    if (pick.tier !== "author")
+        return pick;
+    const prs = pick.authorized_prs.filter((n) => lowest.every((c) => c.authorized_prs.includes(n)));
+    return { ...pick, authorized_prs: prs };
+}
+/**
+ * The bridge's delivery order, latest first: unbound records (their wake
+ * files will be named after every existing one), newest write first; then
+ * bound ones by wake name, descending — the reverse of the bridge's own
+ * `sort()`.
+ */
+function byDeliveryDesc(a, b) {
+    if (a.stem === null || b.stem === null) {
+        if (a.stem === null && b.stem === null)
+            return b.seq - a.seq;
+        return a.stem === null ? -1 : 1;
+    }
+    return a.stem < b.stem ? 1 : a.stem > b.stem ? -1 : b.seq - a.seq;
+}
+/**
+ * Delete every record under an origin directory (and its torn tmp files).
+ * Best effort and never throws: with no Slack turn left to describe, a record
+ * is only a stale restriction.
+ */
+export function clearOriginRecords(dir) {
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (!name.endsWith(".json") && !name.includes(".tmp"))
+            continue;
+        try {
+            rmSync(join(dir, name), { force: true });
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+export class OriginStore {
+    dir;
+    now;
+    seq = 0;
+    /** The records THIS process wrote, keyed by file path — the only authority. */
+    authority = new Map();
+    /** Where the bridge moves an accepted wake (`<inject dir>/.done`); null when
+     * this store sees no delivery, and every record is in force at once. */
+    deliveredDir;
+    /** The bridge's pending queue — the directory `.done/` sits in. */
+    pendingDir;
+    /**
+     * The belt's answer before this process has written anything: the newest
+     * record left on disk by a previous run, kept ONLY when it restricts (a
+     * Slack-caused turn from a non-owner). Anything that would lift the belt is
+     * already what "no record" means, so it is never trusted from disk.
+     */
+    bootCause;
+    /**
+     * The restricting records a previous run left bound to a wake still pending
+     * at boot: turns the bridge has yet to serve. Each counts until a wake this
+     * process recorded, named after its own, is accepted.
+     */
+    bootQueued;
+    constructor(dir, now = () => new Date(), opts = {}) {
+        this.dir = dir;
+        this.now = now;
+        this.deliveredDir = opts.deliveredDir ?? null;
+        this.pendingDir = this.deliveredDir === null ? null : dirname(this.deliveredDir);
+        const onDisk = this.scan();
+        const accepted = this.acceptedDiskName(onDisk.map((entry) => entry.name));
+        const newest = (onDisk.find((entry) => entry.name === accepted) ?? onDisk[0])?.rec ?? null;
+        this.bootCause = newest && beltRestricts(newest) ? newest : null;
+        this.bootQueued = [];
+        for (const { rec, name } of onDisk) {
+            const stem = name.replace(/\.json$/, "");
+            if (beltRestricts(rec) && this.isPending(stem))
+                this.bootQueued.push({ rec, stem });
+        }
+    }
+    /** The bridge's last accepted wake, independent of later queued writes. */
+    acceptedDiskName(names) {
+        if (this.deliveredDir === null)
+            return undefined;
+        return names
+            .filter((name) => {
+            const stem = name.replace(/\.json$/, "");
+            return !this.isPending(stem) && existsSync(join(this.deliveredDir, `${stem}.md`));
+        })
+            .sort()
+            .at(-1);
+    }
+    /** A wake named `<stem>.md` is still in the bridge's pending queue. */
+    isPending(stem) {
+        return this.pendingDir !== null && existsSync(join(this.pendingDir, `${stem}.md`));
+    }
+    /** Absolute path of the record for an inject basename. */
+    path(injectBasename) {
+        return join(this.dir, `${injectBasename.replace(/\.md$/, "")}.json`);
+    }
+    /**
+     * Record the rights of the turn just injected. `expires_at` is stamped here
+     * (never taken from a caller) so the TTL cannot be widened from outside, and
+     * `source` is stamped `slack` — this method exists for exactly one caller,
+     * the inbound router, and a Slack turn is what it records.
+     */
+    write(injectBasename, rec) {
+        return this.put(injectBasename, { ...rec, source: "slack" });
+    }
+    /**
+     * Stamp a DAEMON-caused turn (EOD sweep, anomaly wake, connections signal).
+     *
+     * This is the other half of "who caused this turn": without it, a daemon wake
+     * during a stale Slack origin would still look like the Slack user's turn, so
+     * the legacy-dir belt would refuse the daemon's own commands (one guest
+     * message every 15 minutes would block the EOD pipeline indefinitely).
+     * Tier `system` with no user: the daemon keeps the autonomy it always had —
+     * this is the stamped, auditable form of the same authority a missing origin
+     * record grants (`authorizeCommand(_, null)` ⇒ ok).
+     */
+    writeLocal(reason) {
+        const slug = (reason || "wake")
+            .replace(/[^a-zA-Z0-9._-]+/g, "-")
+            .slice(0, 48)
+            .replace(/^-+|-+$/g, "") || "wake";
+        const stamp = this.now().toISOString().replace(/[:.]/g, "-");
+        return this.put(`local-${stamp}-${this.seq}-${slug}`, {
+            source: "local",
+            event_id: `local:${slug}`,
+            slack_user: "",
+            tier: "system",
+            authorized_prs: [],
+        });
+    }
+    put(basename, rec) {
+        const full = {
+            ...rec,
+            expires_at: new Date(this.now().getTime() + ORIGIN_TTL_MS).toISOString(),
+        };
+        const path = this.path(basename);
+        mkdirSync(this.dir, { recursive: true });
+        const seq = this.seq++;
+        const tmp = `${path}.tmp-${process.pid}-${seq}`;
+        writeFileSync(tmp, `${JSON.stringify(full, null, 2)}\n`);
+        renameSync(tmp, path);
+        this.authority.set(path, { rec: full, seq, stem: null, accepted: this.deliveredDir === null });
+        this.prune();
+        return full;
+    }
+    /**
+     * Bind a record to the wake file written for it, and move the audit file to
+     * that name (the router and the daemon's own wakes bind once the file
+     * exists). Until it is bound, and until pi accepts that wake, the record
+     * describes a queued turn: it restricts the running one, and lends it
+     * nothing. The binding is held in memory, so a failed file move still binds.
+     */
+    rename(fromBasename, toBasename) {
+        const from = this.path(fromBasename);
+        const to = this.path(toBasename);
+        const held = this.authority.get(from);
+        if (held)
+            held.stem = toBasename.replace(/\.md$/, "");
+        if (from === to || !existsSync(from))
+            return;
+        try {
+            renameSync(from, to);
+        }
+        catch {
+            /* best effort — the binding above is what counts */
+            return;
+        }
+        if (held) {
+            this.authority.delete(from);
+            this.authority.set(to, held);
+        }
+    }
+    /** Bind a record `writeLocal` returned to the wake file written for it. */
+    bind(rec, injectPath) {
+        const basename = this.basenameOf(rec);
+        if (basename !== null)
+            this.rename(basename, injectPath.split("/").pop() ?? injectPath);
+    }
+    /** Drop a record `writeLocal` returned (the wake it was written for never
+     * landed). */
+    forget(rec) {
+        const basename = this.basenameOf(rec);
+        if (basename !== null)
+            this.remove(basename);
+    }
+    /** The basename a held record is filed under, or null if not held. */
+    basenameOf(rec) {
+        for (const [path, h] of this.authority) {
+            if (h.rec === rec)
+                return path.slice(this.dir.length + 1).replace(/\.json$/, "");
+        }
+        return null;
+    }
+    /** Drop a record (the inject it was written for never landed). */
+    remove(basename) {
+        const path = this.path(basename);
+        this.authority.delete(path);
+        rmSync(path, { force: true });
+    }
+    /** Every unexpired record this process wrote, newest first. */
+    all() {
+        const now = this.now().getTime();
+        return this.held()
+            .map((h) => h.rec)
+            .filter((rec) => Date.parse(rec.expires_at) > now);
+    }
+    /**
+     * The origin of the turn being served, while it is live: the most
+     * restrictive of the accepted wake's record and every record queued behind
+     * it. Null when any of them has expired — the running turn's origin then
+     * has, and an expired turn authorises nothing — or when no record exists.
+     */
+    latest() {
+        const now = this.now().getTime();
+        const serving = this.serving();
+        // A record read off disk only narrows a turn this process recorded.
+        if (serving.length === 0)
+            return null;
+        const cands = [...serving.map((h) => h.rec), ...this.bootQueuedLive(serving)];
+        if (cands.some((rec) => Date.parse(rec.expires_at) <= now))
+            return null;
+        return mostRestrictive(cands);
+    }
+    /**
+     * The same origin REGARDLESS OF AGE — "what caused the turn being served",
+     * not "is a turn live". The legacy-dir belt reads this one: expiry must not
+     * be an escalation, so an old Slack origin keeps the belt on until a daemon
+     * wake (a `local` record) pi has accepted supersedes it. Before this process
+     * has seen any wake accepted, the restricting record a previous run left
+     * (`bootCause`) is a candidate too, and so is every restricting record of
+     * the previous run whose wake is still to be served (`bootQueued`).
+     */
+    latestAny() {
+        const serving = this.serving();
+        const cands = serving.map((h) => h.rec);
+        if (this.bootCause && !serving.some((h) => this.isAccepted(h)))
+            cands.push(this.bootCause);
+        cands.push(...this.bootQueuedLive(serving));
+        return mostRestrictive(cands);
+    }
+    /**
+     * The previous run's queued restricting records whose turn may still be
+     * served: no wake this process recorded and named after theirs is accepted
+     * yet. The bridge takes wakes in name order, so once one is, theirs is over.
+     */
+    bootQueuedLive(serving) {
+        if (this.bootQueued.length === 0)
+            return [];
+        const running = serving.find((h) => this.isAccepted(h));
+        const over = (stem) => running !== undefined && running.stem > stem;
+        return this.bootQueued.filter((b) => !over(b.stem)).map((b) => b.rec);
+    }
+    /**
+     * pi accepted the wake this record is bound to (always, with no delivery
+     * view): the wake file is in `.done/` AND no longer pending. The bridge
+     * moves it with one rename, so a real acceptance shows both; a file planted
+     * in `.done/` beside a wake still queued is not an acceptance. Sticky once
+     * seen.
+     */
+    isAccepted(h) {
+        if (h.accepted)
+            return true;
+        if (this.deliveredDir === null || h.stem === null)
+            return false;
+        const name = `${h.stem}.md`;
+        if (existsSync(join(this.deliveredDir, name)) && !existsSync(join(this.pendingDir, name))) {
+            h.accepted = true;
+        }
+        return h.accepted;
+    }
+    /**
+     * The records that may describe the turn being served, latest in the
+     * bridge's delivery order first: every record not yet accepted (the unbound
+     * ones ahead of the rest — their wake files do not exist yet), then the
+     * running turn's — the accepted record whose wake comes last in name order.
+     * Every record when none was accepted yet. Without a delivery view, the
+     * newest record alone.
+     */
+    serving() {
+        const held = this.held();
+        if (this.deliveredDir === null)
+            return held.slice(0, 1);
+        let running = null;
+        for (const h of held) {
+            if (this.isAccepted(h) && (running === null || h.stem > running.stem))
+                running = h;
+        }
+        const cands = running === null
+            ? held
+            : held.filter((h) => h === running || (!this.isAccepted(h) && this.toCome(h, running)));
+        return cands.sort(byDeliveryDesc);
+    }
+    /**
+     * A record not accepted is still to come unless its wake already left the
+     * queue unaccepted ahead of the running one — the bridge takes wakes in
+     * name order, so such a wake is never served.
+     */
+    toCome(h, running) {
+        if (h.stem === null || h.stem > running.stem)
+            return true;
+        return existsSync(join(this.pendingDir, `${h.stem}.md`));
+    }
+    /**
+     * Every parseable record in the directory, newest first — the AUDIT view.
+     * It includes whatever a session may have planted there, which is exactly
+     * why nothing that authorises reads it.
+     */
+    onDisk() {
+        return this.scan().map((o) => o.rec);
+    }
+    /** The in-memory records, newest first (expiry, then write order). */
+    held() {
+        return [...this.authority.values()].sort((a, b) => {
+            const e = Date.parse(b.rec.expires_at) - Date.parse(a.rec.expires_at);
+            return e !== 0 ? e : b.seq - a.seq;
+        });
+    }
+    /** Newest-first scan of every parseable record on disk. */
+    scan() {
+        if (!existsSync(this.dir))
+            return [];
+        const out = [];
+        for (const entry of readdirSync(this.dir, { withFileTypes: true })) {
+            if (!entry.isFile() || !entry.name.endsWith(".json"))
+                continue;
+            const path = join(this.dir, entry.name);
+            let rec = null;
+            try {
+                rec = parseOriginRecord(JSON.parse(readFileSync(path, "utf8")));
+            }
+            catch {
+                rec = null; // unreadable/garbage grants authorise nothing
+            }
+            if (!rec)
+                continue;
+            let mtime = 0;
+            try {
+                mtime = statSync(path).mtimeMs;
+            }
+            catch {
+                /* raced deletion — fall back to the name ordering */
+            }
+            out.push({ rec, mtime, name: entry.name });
+        }
+        // expires_at is the primary clock (TTL is constant, so it orders writes);
+        // mtime then the name break ties inside the same millisecond.
+        out.sort((a, b) => {
+            const e = Date.parse(b.rec.expires_at) - Date.parse(a.rec.expires_at);
+            if (e !== 0)
+                return e;
+            if (b.mtime !== a.mtime)
+                return b.mtime - a.mtime;
+            return b.name.localeCompare(a.name);
+        });
+        return out;
+    }
+    /**
+     * Best-effort removal of expired records (opportunistic, never throws).
+     *
+     * Every record that may describe the turn being served is kept, expired or
+     * not — the accepted one and those queued behind it: `latestAny()` is what
+     * the legacy-dir belt consults, and deleting the last expired Slack origin
+     * would silently release the belt — waiting would buy rights.
+     */
+    prune() {
+        const now = this.now().getTime();
+        // Memory first: the records the belt answers from stay.
+        const keepHeld = new Set(this.serving());
+        for (const [path, h] of [...this.authority]) {
+            if (!keepHeld.has(h) && Date.parse(h.rec.expires_at) <= now)
+                this.authority.delete(path);
+        }
+        if (!existsSync(this.dir))
+            return;
+        const disk = this.scan();
+        const keep = new Set([disk[0]?.name, this.acceptedDiskName(disk.map((entry) => entry.name))]);
+        for (const entry of readdirSync(this.dir, { withFileTypes: true })) {
+            if (!entry.isFile())
+                continue;
+            const path = join(this.dir, entry.name);
+            try {
+                if (entry.name.endsWith(".tmp") || /\.tmp-\d+-\d+$/.test(entry.name)) {
+                    if (now - statSync(path).mtimeMs > ORIGIN_TTL_MS)
+                        rmSync(path, { force: true });
+                    continue;
+                }
+                if (!entry.name.endsWith(".json"))
+                    continue;
+                if (keep.has(entry.name))
+                    continue;
+                // A record bound to a wake still pending describes a turn to come,
+                // which a restart before it is served must still find.
+                if (this.isPending(entry.name.replace(/\.json$/, "")))
+                    continue;
+                const rec = parseOriginRecord(JSON.parse(readFileSync(path, "utf8")));
+                if (!rec || Date.parse(rec.expires_at) <= now)
+                    rmSync(path, { force: true });
+            }
+            catch {
+                /* best effort */
+            }
+        }
+    }
+}
+//# sourceMappingURL=origin.js.map

package/dist/src/slack/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin.js","sourceRoot":"","sources":["../../../src/slack/origin.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,qBAAqB;AACrB,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAC/E,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,0BAA0B;AAC1B,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,UAAU;AACV,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,SAAS;AACT,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAkB,MAAM,aAAa,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA4B5C,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;IAC/E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChF,6EAA6E;IAC7E,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,CAAC,CAAC,cAAc,CAAC,MAAM,CACnB,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1E;QACH,CAAC,CAAC,EAAE,CAAC;IACP,6EAA6E;IAC7E,4DAA4D;IAC5D,OAAO;QACL,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC9C,QAAQ;QACR,UAAU;QACV,IAAI,EAAE,UAAU;QAChB,cAAc,EAAE,GAAG;QACnB,UAAU;KACX,CAAC;AACJ,CAAC;AAwBD,+EAA+E;AAC/E,MAAM,SAAS,GAA8B;IAC3C,OAAO,EAAE,CAAC;IACV,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;CACV,CAAC;AAEF;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAiB;IAC7C,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,CAAO,EAAE,CAAO;IACtC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAC7D,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QAChE,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,OAAO,WAAW;IAwBH;IACA;IAxBX,GAAG,GAAG,CAAC,CAAC;IAChB,+EAA+E;IAC9D,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IACrD;4EACwE;IACvD,YAAY,CAAgB;IAC7C,mEAAmE;IAClD,UAAU,CAAgB;IAC3C;;;;;OAKG;IACc,SAAS,CAAsB;IAChD;;;;OAIG;IACc,UAAU,CAA6C;IAExE,YACmB,GAAW,EACX,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EACnD,OAAkC,EAAE;QAFnB,QAAG,GAAH,GAAG,CAAQ;QACX,QAAG,GAAH,GAAG,CAA+B;QAGnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAC3F,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,gBAAgB,CAAC,KAAwB;QAC/C,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAa,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;QACrF,CAAC,CAAC;aACD,IAAI,EAAE;aACN,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,uEAAuE;IAC/D,SAAS,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,cAAsB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAsB,EAAE,GAAgD;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,UAAU,CAAC,MAAc;QACvB,MAAM,IAAI,GACR,CAAC,MAAM,IAAI,MAAM,CAAC;aACf,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;aACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACZ,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE;YACpD,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,SAAS,IAAI,EAAE;YACzB,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAEO,GAAG,CAAC,QAAgB,EAAE,GAAqC;QACjE,MAAM,IAAI,GAAiB;YACzB,GAAG,GAAG;YACN,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;SACzE,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QAChD,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,YAAoB,EAAE,UAAkB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;YACpD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,GAAiB,EAAE,UAAkB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,CAAC;IAC1F,CAAC;IAED;kBACc;IACd,MAAM,CAAC,GAAiB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,sEAAsE;IAC9D,UAAU,CAAC,GAAiB;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,QAAgB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,+DAA+D;IAC/D,GAAG;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,EAAE;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,oEAAoE;QACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS;QACP,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,OAAwB;QAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAK,GAAG,IAAI,CAAC;QAC7E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,CAAO;QACxB,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAW,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3F,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACK,OAAO;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,GAAgB,IAAI,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,IAAK,GAAG,OAAO,CAAC,IAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GACT,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,CAAO,EAAE,OAAa;QACnC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAK;YAAE,OAAO,IAAI,CAAC;QAC3D,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,sEAAsE;IAC9D,IAAI;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IACnD,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,GAA8D,EAAE,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,GAAwB,IAAI,CAAC;YACpC,IAAI,CAAC;gBACH,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,GAAG,IAAI,CAAC,CAAC,8CAA8C;YAC5D,CAAC;YACD,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,CAAC;gBACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,0EAA0E;QAC1E,8DAA8D;QAC9D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACjC,wDAAwD;QACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,aAAa;wBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnC,mEAAmE;gBACnE,uDAAuD;gBACvD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBAAE,SAAS;gBAChE,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC,CAAC;gBACjF,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}