@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/esm/permissions/manual-approval.js

@@ -0,0 +1,503 @@
+import * as crypto from 'crypto';
+import { createMessage } from '../protocol/envelope';
+import { APPROVAL_TIMEOUT_ENV_VAR, DEFAULTS, LIMITS } from '../protocol/constants';
+import { previewStatement } from '../audit/redact';
+import { hasCapability } from './role-policy';
+/**
+ * Resolve the manual-approval window: the single source of truth is
+ * DEFAULTS.APPROVAL_TIMEOUT_MS, with an optional operator override read from
+ * APPROVAL_TIMEOUT_ENV_VAR and clamped into
+ * [LIMITS.APPROVAL_TIMEOUT_MIN_MS, LIMITS.APPROVAL_TIMEOUT_MAX_MS].
+ *
+ * Audit L-03. The window existed in three places with three different
+ * fallbacks (the dead constant, a hardcoded 60_000 in the value advertised to the
+ * browser, and `opts ?? env ?? 60_000` in this module), and an override set to
+ * something absurd was honoured verbatim. Export this so every caller resolves
+ * the same number instead of re-deriving it: `new ManualApprovalHandler({ … })`
+ * with no `timeoutMs` already does, so passing `timeoutMs: DEFAULTS.…` at a call
+ * site is unnecessary and would *bypass* the env override.
+ */
+export function resolveApprovalTimeoutMs(env = process.env) {
+    const constant = DEFAULTS.APPROVAL_TIMEOUT_MS;
+    const raw = env[APPROVAL_TIMEOUT_ENV_VAR];
+    if (raw === undefined || raw.trim() === '') {
+        return { timeoutMs: constant, source: 'constant' };
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || !Number.isInteger(parsed) || parsed <= 0) {
+        return { timeoutMs: constant, source: 'invalid' };
+    }
+    const clamped = Math.min(Math.max(parsed, LIMITS.APPROVAL_TIMEOUT_MIN_MS), LIMITS.APPROVAL_TIMEOUT_MAX_MS);
+    return { timeoutMs: clamped, source: clamped === parsed ? 'env' : 'clamped' };
+}
+/**
+ * Extra slack on top of the approval window before the independent reaper fires.
+ *
+ * The approval timer settles the promise; the reaper is what guarantees the
+ * permit is released and the trail records that it had to be. It must be strictly
+ * later than the approval timer so the ordinary expiry path never looks like a
+ * stranding.
+ */
+export const APPROVAL_STRANDED_SLACK_MS = 5_000;
+/** Bounds on the reaper slack, so it can be tuned for tests but not disabled. */
+const MIN_STRANDED_SLACK_MS = 100;
+const MAX_STRANDED_SLACK_MS = 60_000;
+export class ManualApprovalHandler {
+    /**
+     * Pending approvals, keyed by a **server-minted** id.
+     *
+     * The key is `randomUUID()` — not the caller-supplied `request_id`.
+     * The request id is still recorded on the entry and is still what the map is
+     * *searched* by (`findByRequestId`), but it can no longer *address* an entry, so
+     * a second frame reusing someone else's id cannot overwrite, expire or resolve
+     * their approval. Two requests that both claim id `X` now occupy two distinct
+     * keys and neither can reach the other.
+     */
+    pending = new Map();
+    timeoutMs;
+    send;
+    onPending;
+    onResolved;
+    onStranded;
+    auditSink;
+    now;
+    strandedSlackMs;
+    constructor(opts) {
+        const resolved = resolveApprovalTimeoutMs();
+        const requested = opts.timeoutMs ?? resolved.timeoutMs;
+        // Clamp unconditionally: an explicit caller-supplied value must not be able
+        // to create an approval window that never expires.
+        this.timeoutMs = Math.min(Math.max(Math.trunc(requested), LIMITS.APPROVAL_TIMEOUT_MIN_MS), LIMITS.APPROVAL_TIMEOUT_MAX_MS);
+        if (opts.timeoutMs !== undefined &&
+            Number.isFinite(opts.timeoutMs) &&
+            opts.timeoutMs !== this.timeoutMs) {
+            console.warn(`[approval] requested timeout ${opts.timeoutMs}ms clamped to ${this.timeoutMs}ms ` +
+                `(allowed ${LIMITS.APPROVAL_TIMEOUT_MIN_MS}..${LIMITS.APPROVAL_TIMEOUT_MAX_MS}ms)`);
+        }
+        else if (resolved.source !== 'constant') {
+            console.warn(`[approval] ${APPROVAL_TIMEOUT_ENV_VAR}=${process.env[APPROVAL_TIMEOUT_ENV_VAR]} resolved to ` +
+                `${this.timeoutMs}ms (${resolved.source}); the value advertised to the browser and the value ` +
+                'enforced are the same number.');
+        }
+        this.strandedSlackMs = Math.min(Math.max(Math.trunc(opts.strandedSlackMs ?? APPROVAL_STRANDED_SLACK_MS), MIN_STRANDED_SLACK_MS), MAX_STRANDED_SLACK_MS);
+        this.now = opts.now ?? Date.now;
+        this.send = opts.send;
+        this.onPending = opts.onPending;
+        this.onResolved = opts.onResolved;
+        this.onStranded = opts.onStranded;
+        this.auditSink = opts.auditSink;
+    }
+    /** The window this handler enforces, in ms. */
+    getTimeoutMs() {
+        return this.timeoutMs;
+    }
+    /**
+     * When the independent reaper for a request parked *now* would fire.
+     *
+     * The dispatcher arms its own watchdog at this deadline so it can release a
+     * concurrency permit even if the approval promise never settles.
+     */
+    getStrandedReaperMs() {
+        return this.timeoutMs + this.strandedSlackMs;
+    }
+    /**
+     * Whether an approval is pending for exactly this `(request_id, requester)`
+     * pair, addressed by SEARCH rather than by key.
+     *
+     * The dispatcher's watchdog uses this to tell a stranded approval from a
+     * merely slow one: a request that is not parked is not waiting for a human.
+     */
+    isPending(requestId, requesterId) {
+        for (const entry of this.pending.values()) {
+            if (entry.requestId === requestId && entry.requesterId === requesterId)
+                return true;
+        }
+        return false;
+    }
+    /**
+     * Request approval for a query.
+     *
+     * The pending approval is bound to a **server-minted** key and carries a
+     * cryptographically random nonce that only this process knows. `handleResponse`
+     * requires the nonce and the requesting user id to match; the key is not
+     * derivable from anything the sender controls, so a duplicate `request_id`
+     * cannot reach, overwrite or expire another approval.
+     *
+     * A second request that reuses an id that is already pending for the same
+     * requester is REFUSED with `duplicate_request_id` — it does not overwrite the
+     * first entry, and the first promise stays reachable. The caller is expected to
+     * release the resources it acquired for the refused request.
+     *
+     * Only a redacted, length-capped preview of the statement is transmitted. The
+     * full SQL can carry PII literals (`INSERT INTO users(email) VALUES
+     * ('alice@corp.com')`) and this event crosses the cloud boundary.
+     */
+    requestApproval(params) {
+        // Refuse a duplicate BEFORE anything is minted or sent. Overwriting the
+        // entry is what orphaned the first promise and leaked its permit; the
+        // second caller must learn nothing about the pending approval beyond the
+        // fact that its own id is taken.
+        if (this.isPending(params.request_id, params.user.id)) {
+            const reason = `An approval is already pending for request id '${params.request_id}'`;
+            if (this.auditSink) {
+                this.auditSink.log({
+                    id: params.request_id,
+                    project: params.project,
+                    user_id: params.user.id,
+                    role: params.user.role,
+                    action: 'manual_approval',
+                    decision: 'deny',
+                    outcome: 'n/a',
+                    permission_level: 'manual',
+                    denial_reason: 'duplicate_request_id',
+                });
+            }
+            return refusedDuplicate(reason);
+        }
+        const nonce = crypto.randomBytes(32).toString('hex');
+        // The deadline is computed ONCE, from the same clock, and both the advertised
+        // `expires_at` and the enforcing timer derive from it. Previously the
+        // advertised value and the timer were two independent `Date.now()` reads a
+        // few microseconds apart, so a browser could be shown a window that had
+        // already started closing — and a caller-supplied `expires_at` would have
+        // been able to claim more time than was enforced.
+        const expiresAt = this.now() + this.timeoutMs;
+        const requesterRole = params.user.role;
+        const preview = approvalPreview(params.sql, params.sql_preview);
+        // Server-minted, so the caller cannot address another principal's approval.
+        const approvalId = crypto.randomUUID();
+        // `ApprovalRequiredEvent` still declares the full `sql` field for wire
+        // compatibility with older browsers. It is deliberately NOT populated: the
+        // statement text is not required for a human to approve a statement, and
+        // transmitting it is the leak this replaces.
+        const eventData = {
+            request_id: params.request_id,
+            sql_preview: preview,
+            intent: params.intent,
+            db_alias: params.db_alias,
+            approval_nonce: nonce,
+            expires_at: expiresAt,
+        };
+        const eventMsg = createMessage('event', {
+            project: params.project,
+            user: { id: params.user.id, role: requesterRole },
+            db_alias: params.db_alias,
+            payload: {
+                kind: 'approval_required',
+                data: eventData,
+            },
+        });
+        if (this.auditSink) {
+            this.auditSink.log({
+                id: params.request_id,
+                project: params.project,
+                user_id: params.user.id,
+                role: requesterRole,
+                action: 'manual_approval',
+                decision: 'pending',
+                outcome: 'n/a',
+                permission_level: 'manual',
+            });
+        }
+        const promise = new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(result);
+            };
+            const timer = setTimeout(() => {
+                const entry = this.pending.get(approvalId);
+                if (!entry)
+                    return;
+                this.pending.delete(approvalId);
+                const result = { approved: false, reason: 'timeout' };
+                settle(result);
+                this.onResolved?.(params.request_id, result);
+                if (this.auditSink) {
+                    this.auditSink.log({
+                        id: params.request_id,
+                        project: params.project,
+                        user_id: params.user.id,
+                        role: requesterRole,
+                        action: 'manual_approval',
+                        decision: 'expired',
+                        outcome: 'n/a',
+                        permission_level: 'manual',
+                    });
+                }
+            }, this.timeoutMs);
+            // The independent reaper. It does not consult the approval timer
+            // and does not wait for anybody to settle the promise: whatever has
+            // happened by `timeoutMs + slack`, this entry is closed, the stranding is
+            // recorded, the release hook runs, and the promise settles so the caller's
+            // `finally` — and with it the concurrency permit — completes.
+            const reaper = setTimeout(() => {
+                const entry = this.pending.get(approvalId);
+                // Already resolved, expired or cancelled: nothing is stranded.
+                if (!entry || settled)
+                    return;
+                this.pending.delete(approvalId);
+                if (this.auditSink) {
+                    this.auditSink.log({
+                        id: params.request_id,
+                        project: params.project,
+                        user_id: params.user.id,
+                        role: requesterRole,
+                        action: 'manual_approval',
+                        decision: 'deny',
+                        outcome: 'n/a',
+                        permission_level: 'manual',
+                        denial_reason: 'approval_promise_stranded',
+                    });
+                }
+                // Release the caller's permit first, so the resource is back even if the
+                // settlement below is delayed.
+                try {
+                    this.onStranded?.({
+                        request_id: params.request_id,
+                        project: params.project,
+                        user_id: params.user.id,
+                    });
+                }
+                catch (err) {
+                    console.error('[approval] stranded-release hook failed:', err);
+                }
+                const result = { approved: false, reason: 'timeout' };
+                settle(result);
+                this.onResolved?.(params.request_id, result);
+            }, this.getStrandedReaperMs());
+            this.pending.set(approvalId, {
+                key: approvalId,
+                requestId: params.request_id,
+                requesterId: params.user.id,
+                requesterRole,
+                project: params.project,
+                nonce,
+                resolve: settle,
+                timer,
+                reaper,
+                expiresAt,
+            });
+            this.send(eventMsg)
+                .then(() => {
+                this.onPending?.(params.request_id, expiresAt);
+            })
+                .catch((err) => {
+                const entry = this.pending.get(approvalId);
+                if (entry) {
+                    clearTimeout(entry.timer);
+                    clearTimeout(entry.reaper);
+                    this.pending.delete(approvalId);
+                }
+                reject(err);
+            });
+        });
+        return granted(promise, approvalId);
+    }
+    /**
+     * Resolve a pending approval from a browser response.
+     *
+     * All of the following must hold, or the pending approval is left untouched:
+     *   - a pending approval exists for `(request_id, requesting_user_id)`
+     *   - `actorId` (falling back to `user_id`) equals the requesting user
+     *   - the actor's role holds the `approve_ddl` capability, so a `viewer` can
+     *     never approve a pending write/DDL
+     *   - `approval_nonce` matches the value this process minted
+     *
+     * A nonce is consumed exactly once: the entry is removed as it resolves, so a
+     * replayed frame finds nothing.
+     *
+     * `params` carries the *envelope* identity, which is the only identity the
+     * dispatcher has verified. The payload's own `approved_by` string is treated
+     * as untrusted display data and is deliberately ignored — the audit record
+     * takes the approver from `params`.
+     */
+    handleResponse(event, params) {
+        // Addressed by SEARCH, never by a caller-derived key: two pending approvals
+        // may share a `request_id`, and the responder must reach exactly the one
+        // that belongs to them. `findByRequestId` prefers the requesting user's own
+        // entry so a legitimate approver resolves theirs.
+        const pendingApproval = this.findPending(event.request_id, params.actorId);
+        if (!pendingApproval) {
+            // Do not tell a different principal that an approval is pending for
+            // someone else, but do distinguish the two failures for the audit trail.
+            const belongsToAnotherUser = this.findByRequestId(event.request_id) !== undefined;
+            return {
+                handled: false,
+                reason: belongsToAnotherUser
+                    ? 'approver is not the requesting user'
+                    : 'no pending approval for this request_id',
+            };
+        }
+        // Expiry is checked against the handler's ACTUAL deadline, which is the same
+        // value advertised in `expires_at` — including when the caller supplies no
+        // `now`, in which case the handler's own clock is used rather than skipping
+        // the check entirely.
+        const evaluatedAt = params.now ?? this.now();
+        if (evaluatedAt > pendingApproval.expiresAt) {
+            this.forget(pendingApproval);
+            const result = { approved: false, reason: 'timeout' };
+            pendingApproval.resolve(result);
+            this.onResolved?.(event.request_id, result);
+            if (this.auditSink) {
+                this.auditSink.log({
+                    id: event.request_id,
+                    project: pendingApproval.project,
+                    user_id: params.actorId,
+                    role: params.actorRole,
+                    action: 'manual_approval',
+                    decision: 'expired',
+                    outcome: 'n/a',
+                    permission_level: 'manual',
+                });
+            }
+            return { handled: false, reason: 'approval window expired' };
+        }
+        if (params.actorId !== pendingApproval.requesterId) {
+            return { handled: false, reason: 'approver is not the requesting user' };
+        }
+        if (!hasCapability(params.actorRole, 'approve_ddl')) {
+            return {
+                handled: false,
+                reason: `role '${params.actorRole}' may not approve a pending write (requires 'approve_ddl')`,
+            };
+        }
+        if (typeof event.approval_nonce !== 'string' ||
+            event.approval_nonce.length !== pendingApproval.nonce.length ||
+            !timingSafeEqualStrings(event.approval_nonce, pendingApproval.nonce)) {
+            return { handled: false, reason: 'approval nonce mismatch' };
+        }
+        this.forget(pendingApproval);
+        const result = {
+            approved: event.approved,
+            approved_by: params.actorId,
+            reason: event.approved ? undefined : 'denied',
+        };
+        pendingApproval.resolve(result);
+        this.onResolved?.(event.request_id, result);
+        if (this.auditSink) {
+            this.auditSink.log({
+                id: event.request_id,
+                project: pendingApproval.project,
+                user_id: params.actorId,
+                role: params.actorRole,
+                action: 'manual_approval',
+                decision: event.approved ? 'approved' : 'rejected',
+                outcome: 'n/a',
+                permission_level: 'manual',
+            });
+        }
+        return { handled: true };
+    }
+    /** Cancel all pending approvals (e.g. on shutdown). */
+    cancelAll(reason = 'cancelled') {
+        for (const [, pendingApproval] of this.pending.entries()) {
+            this.forget(pendingApproval);
+            const result = { approved: false, reason };
+            pendingApproval.resolve(result);
+            this.onResolved?.(pendingApproval.requestId, result);
+        }
+        this.pending.clear();
+    }
+    /** Get count of pending approvals. */
+    get pendingCount() {
+        return this.pending.size;
+    }
+    /**
+     * Drop an entry and disarm both of its timers.
+     *
+     * Both timers, always: leaving the reaper armed after a legitimate resolution
+     * would have it fire against a settled promise and record a stranding that
+     * never happened.
+     */
+    forget(pendingApproval) {
+        clearTimeout(pendingApproval.timer);
+        clearTimeout(pendingApproval.reaper);
+        this.pending.delete(pendingApproval.key);
+    }
+    /**
+     * The pending approval `(requestId, requesterId)` may address.
+     *
+     * The requester's own entry wins, so a duplicate id cannot make one of two
+     * requests unreachable to its own requester; the other entry is only reachable
+     * by its own requester too.
+     */
+    findPending(requestId, requesterId) {
+        let foreignMatch;
+        for (const pendingApproval of this.pending.values()) {
+            if (pendingApproval.requestId !== requestId)
+                continue;
+            if (pendingApproval.requesterId === requesterId)
+                return pendingApproval;
+            foreignMatch ??= pendingApproval;
+        }
+        return foreignMatch;
+    }
+    /** Pending approvals are few; a scan keeps the failure messages precise. */
+    findByRequestId(requestId) {
+        for (const pendingApproval of this.pending.values()) {
+            if (pendingApproval.requestId === requestId)
+                return pendingApproval;
+        }
+        return undefined;
+    }
+}
+/**
+ * The preview transmitted on the `approval_required` event.
+ *
+ * Both inputs are redacted here rather than trusted: the full statement when
+ * the caller supplies it, and otherwise the caller's own preview, which has not
+ * been through the redactor from this module's point of view. `previewStatement`
+ * is idempotent over already-redacted text, so redacting a preview that was
+ * produced by the same function costs nothing and removes the case where a
+ * caller passes raw SQL in `sql_preview`.
+ */
+function approvalPreview(sql, suppliedPreview) {
+    return previewStatement(typeof sql === 'string' ? sql : suppliedPreview);
+}
+/** Constant-time string comparison that does not leak length via early exit. */
+function timingSafeEqualStrings(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length) {
+        // Still perform a comparison so the timing does not depend on the branch.
+        crypto.timingSafeEqual(bufA, bufA);
+        return false;
+    }
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/**
+ * An accepted approval: the promise, plus the codes a caller can branch on.
+ *
+ * The extra members hang off the promise object rather than replacing it, so
+ * `await requestApproval(...)` yields `ManualApprovalResult` exactly as before.
+ */
+function granted(promise, approvalId) {
+    return Object.assign(promise, {
+        ok: true,
+        promise,
+        approval_id: approvalId,
+    });
+}
+/**
+ * A refused request. The promise resolves to a non-approval carrying the reason,
+ * so a caller that only awaits it (the permission checker) denies the request and
+ * releases its resources on the normal path, and a caller that inspects `ok` sees
+ * the distinct `duplicate_request_id` code.
+ */
+function refusedDuplicate(reason) {
+    const promise = Promise.resolve({
+        approved: false,
+        reason: 'duplicate_request_id',
+    });
+    return Object.assign(promise, {
+        ok: false,
+        code: 'duplicate_request_id',
+        reason,
+        promise: null,
+        approval_id: null,
+    });
+}
+//# sourceMappingURL=manual-approval.js.map

package/dist/esm/permissions/manual-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manual-approval.js","sourceRoot":"","sources":["../../../src/permissions/manual-approval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAsB,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAInF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAI3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,mBAAmB,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,uBAAuB,CAAC,EAChD,MAAM,CAAC,uBAAuB,CAC/B,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAChF,CAAC;AAyFD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAEhD,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,MAAM,OAAO,qBAAqB;IAChC;;;;;;;;;OASG;IACK,OAAO,GAAiC,IAAI,GAAG,EAAE,CAAC;IACzC,SAAS,CAAS;IAClB,IAAI,CAAuC;IAC3C,SAAS,CAAkD;IAC3D,UAAU,CAA6D;IACvE,UAAU,CAA4E;IACtF,SAAS,CAAa;IACtB,GAAG,CAAe;IAClB,eAAe,CAAS;IAEzC,YAAY,IAA2B;QACrC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC;QACvD,4EAA4E;QAC5E,mDAAmD;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,uBAAuB,CAAC,EAC/D,MAAM,CAAC,uBAAuB,CAC/B,CAAC;QACF,IACE,IAAI,CAAC,SAAS,KAAK,SAAS;YAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/B,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EACjC,CAAC;YACD,OAAO,CAAC,IAAI,CACV,gCAAgC,IAAI,CAAC,SAAS,iBAAiB,IAAI,CAAC,SAAS,KAAK;gBAChF,YAAY,MAAM,CAAC,uBAAuB,KAAK,MAAM,CAAC,uBAAuB,KAAK,CACrF,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CACV,cAAc,wBAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,eAAe;gBAC5F,GAAG,IAAI,CAAC,SAAS,OAAO,QAAQ,CAAC,MAAM,uDAAuD;gBAC9F,+BAA+B,CAClC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAC7B,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,0BAA0B,CAAC,EAC9D,qBAAqB,CACtB,EACD,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,+CAA+C;IAC/C,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,SAAiB,EAAE,WAAmB;QAC9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;QACtF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,MASf;QACC,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,iCAAiC;QACjC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,kDAAkD,MAAM,CAAC,UAAU,GAAG,CAAC;YACtF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;oBACjB,EAAE,EAAE,MAAM,CAAC,UAAU;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;oBACtB,MAAM,EAAE,iBAAiB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,QAAQ;oBAC1B,aAAa,EAAE,sBAAsB;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,8EAA8E;QAC9E,sEAAsE;QACtE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAChE,4EAA4E;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEvC,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,OAAO;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,KAAK;YACrB,UAAU,EAAE,SAAS;SACc,CAAC;QAEtC,MAAM,QAAQ,GAAG,aAAa,CAAe,OAAO,EAAE;YACpD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;YACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE;gBACP,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,SAAS;aAChB;SACF,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;gBACjB,EAAE,EAAE,MAAM,CAAC,UAAU;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBACvB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpE,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,MAA4B,EAAQ,EAAE;gBACpD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3C,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC5E,MAAM,CAAC,MAAM,CAAC,CAAC;gBACf,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;wBACjB,EAAE,EAAE,MAAM,CAAC,UAAU;wBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBACvB,IAAI,EAAE,aAAa;wBACnB,MAAM,EAAE,iBAAiB;wBACzB,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,KAAK;wBACd,gBAAgB,EAAE,QAAQ;qBAC3B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,iEAAiE;YACjE,oEAAoE;YACpE,0EAA0E;YAC1E,2EAA2E;YAC3E,8DAA8D;YAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3C,+DAA+D;gBAC/D,IAAI,CAAC,KAAK,IAAI,OAAO;oBAAE,OAAO;gBAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;wBACjB,EAAE,EAAE,MAAM,CAAC,UAAU;wBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBACvB,IAAI,EAAE,aAAa;wBACnB,MAAM,EAAE,iBAAiB;wBACzB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,KAAK;wBACd,gBAAgB,EAAE,QAAQ;wBAC1B,aAAa,EAAE,2BAA2B;qBAC3C,CAAC,CAAC;gBACL,CAAC;gBACD,yEAAyE;gBACzE,+BAA+B;gBAC/B,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;qBACxB,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,MAAM,GAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC5E,MAAM,CAAC,MAAM,CAAC,CAAC;gBACf,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAE/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE;gBAC3B,GAAG,EAAE,UAAU;gBACf,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC3B,aAAa;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,OAAO,EAAE,MAAM;gBACf,KAAK;gBACL,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YAEH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;iBAChB,IAAI,CAAC,GAAG,EAAE;gBACT,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACjD,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACV,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,cAAc,CACZ,KAA4B,EAC5B,MAA0D;QAE1D,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,oEAAoE;YACpE,yEAAyE;YACzE,MAAM,oBAAoB,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,oBAAoB;oBAC1B,CAAC,CAAC,qCAAqC;oBACvC,CAAC,CAAC,yCAAyC;aAC9C,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,sBAAsB;QACtB,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7C,IAAI,WAAW,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5E,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;oBACjB,EAAE,EAAE,KAAK,CAAC,UAAU;oBACpB,OAAO,EAAE,eAAe,CAAC,OAAO;oBAChC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,SAAS;oBACtB,MAAM,EAAE,iBAAiB;oBACzB,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,QAAQ;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC/D,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,CAAC,WAAW,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,MAAM,CAAC,SAAS,4DAA4D;aAC9F,CAAC;QACJ,CAAC;QAED,IACE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;YACxC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,MAAM;YAC5D,CAAC,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,EACpE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAyB;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SAC9C,CAAC;QAEF,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;gBACjB,EAAE,EAAE,KAAK,CAAC,UAAU;gBACpB,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,SAAS;gBACtB,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;gBAClD,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,SAAS,CAAC,SAAiB,WAAW;QACpC,KAAK,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACjE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,UAAU,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,sCAAsC;IACtC,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,eAAgC;QAC7C,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,SAAiB,EAAE,WAAmB;QACxD,IAAI,YAAyC,CAAC;QAC9C,KAAK,MAAM,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACpD,IAAI,eAAe,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACtD,IAAI,eAAe,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,eAAe,CAAC;YACxE,YAAY,KAAK,eAAe,CAAC;QACnC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,eAAe,CAAC,SAAiB;QACvC,KAAK,MAAM,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACpD,IAAI,eAAe,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,eAAe,CAAC;QACtE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,GAAuB,EAAE,eAAuB;IACvE,OAAO,gBAAgB,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,0EAA0E;QAC1E,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CACd,OAAsC,EACtC,UAAkB;IAElB,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,EAAE,EAAE,IAAI;QACR,OAAO;QACP,WAAW,EAAE,UAAU;KACxB,CAAgC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAuB;QACpD,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,sBAAsB;KAC/B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,sBAAsB;QAC5B,MAAM;QACN,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;KAClB,CAAgC,CAAC;AACpC,CAAC"}