@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/esm/audit/verify-cache.js

@@ -0,0 +1,628 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as readline from 'readline';
+import { AUDIT_FLOOR_SUFFIX, AUDIT_HEAD_FILENAME, ChainVerifier, GENESIS_HASH, loadAuditKey, makeHead, readHead, readHeadFloor, requireKeyBytes, resolveAnchor, } from './chain';
+import { getAuditFilesChronological } from './files';
+/**
+ * Incremental whole-log verification (audit finding M-06).
+ *
+ * `verifyAuditLog` already streams the log in O(1) memory and early-exits on the
+ * first bad record, but it re-reads and re-verifies every rotated archive on
+ * every call. This module adds the missing half: a per-file cache of the chain
+ * head each file left behind, so a file that has not changed since a previous
+ * successful verification is not read again, and the chain resumes from the
+ * cached head of the last unchanged file.
+ *
+ * The record-level rules live in `chain.ts` (`ChainVerifier`) and are not
+ * reimplemented here: this is a file-walk policy around the single
+ * implementation, which is exactly the split that keeps the two from drifting.
+ *
+ * The cache is per process, in memory, and is never written next to the log. A
+ * cache file in the audit directory would live wherever the log-writer can
+ * reach, so a poisoned entry would turn "not re-verified" into "verified"; a
+ * skip is therefore only ever a skip, and the result always says which files
+ * were read and which were not.
+ *
+ * ## When a skipped file's verdict may be reused
+ *
+ * A cache hit is only allowed to stand in for a re-read when *all* of these
+ * hold, and every one of them is checked on the path that uses the entry:
+ *
+ *  1. **The file is the same file.** `dev`/`ino`/`size` plus `mtime_ns` *and*
+ *     `ctime_ns`. `size`+`mtime` alone was the original key and it is not
+ *     enough: `utimensat` can put `mtime` back after a rewrite, so a same-size
+ *     edit with a restored `mtime` reused a stale "intact" verdict and masked
+ *     the tamper. `ctime` cannot be set from userspace, and the nanosecond
+ *     fields come from a `bigint` stat, so a write that keeps the file's
+ *     identity has to preserve all five values. A file whose timestamps the
+ *     filesystem only records to the second is never cached at all: two writes
+ *     inside one second cannot be told apart there, which is precisely the
+ *     window such a tamper would aim for.
+ *  2. **The chain state the file was verified from is the chain state we are
+ *     resuming into.** The entry records the `seq` and `prev_hash` its *first*
+ *     record had to chain from; a hit is refused unless those equal the
+ *     verifier's current `expectedSeq`/`prev`. Without this, a modified earlier
+ *     file followed by a cached later file would "verify": the cached head would
+ *     paper over the gap instead of exposing it.
+ *  3. **The signing key is the key the entry was verified with.** A fingerprint
+ *     of the key bytes is part of every entry, so a rotated/replaced key file
+ *     invalidates the whole cache even when no anchor names the chain.
+ *  4. **The entry belongs to the chain the caller is verifying.** A constrained
+ *     lookup never reuses an entry from another `chain_id`.
+ *  5. **A reused tail is re-anchored to the bytes on disk.** When the last file
+ *     walked came from the cache, the final record of the log is re-read (a
+ *     bounded tail peek, never a whole file) and must still be the record the
+ *     cache says was verified. Truncating the log and rewriting both anchors to
+ *     match is otherwise invisible to a remembered verdict.
+ *  6. **The anchors are read fresh on every call** and the cached end head is
+ *     compared against them (`compareWithAnchor`), exactly as
+ *     `ChainVerifier.result` compares the freshly observed head.
+ *
+ * Anything else fails closed: a file that cannot be stat'ed is reported as
+ * unreadable *and* disables every later skip in the same run, a file that could
+ * not be read to its end is never cached, and a run that skipped nothing still
+ * has to produce a real verdict from the verifier.
+ *
+ * What this cannot do: it does not protect against an attacker who can write the
+ * audit files *and* forge inode metadata (root/`CAP_FOWNER`) or land on a
+ * filesystem with coarse timestamps. Such an attacker can also rewrite both
+ * anchors, which the uncached verifier already cannot defend against. The
+ * interactive `sw-agent audit verify` therefore never consults this cache at
+ * all — see `src/cli/commands/audit-verify.ts`.
+ */
+/** Bytes read from the end of the newest non-empty file to re-anchor a skip. */
+const TAIL_PEEK_BYTES = 64 * 1024;
+/** Reads a file's identity, or null when it cannot be stat'ed. */
+export async function statAuditFileIdentity(file) {
+    try {
+        const st = await fs.promises.stat(file, { bigint: true });
+        return {
+            size: Number(st.size),
+            mtime_ns: st.mtimeNs.toString(),
+            ctime_ns: st.ctimeNs.toString(),
+            ino: st.ino.toString(),
+            dev: st.dev.toString(),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function sameIdentity(a, b) {
+    return (a.size === b.size &&
+        a.mtime_ns === b.mtime_ns &&
+        a.ctime_ns === b.ctime_ns &&
+        a.ino === b.ino &&
+        a.dev === b.dev);
+}
+const NS_PER_SECOND = 1000000000n;
+/**
+ * True when both timestamps carry a sub-second component, i.e. the filesystem
+ * that produced them records times finer than a second.
+ */
+function hasSubSecondResolution(identity) {
+    try {
+        return (BigInt(identity.mtime_ns) % NS_PER_SECOND !== 0n &&
+            BigInt(identity.ctime_ns) % NS_PER_SECOND !== 0n);
+    }
+    catch {
+        return false;
+    }
+}
+export class AuditVerifyCache {
+    entries = new Map();
+    /**
+     * A usable entry for this exact file revision and this exact resumption point,
+     * or null. Every field is load-bearing: see the trust model at the top of this
+     * module.
+     */
+    get(file, identity, expect) {
+        const hit = this.entries.get(file);
+        if (!hit)
+            return null;
+        if (hit.records <= 0)
+            return null;
+        if (!sameIdentity(hit.identity, identity))
+            return null;
+        if (hit.key_fingerprint !== expect.keyFingerprint)
+            return null;
+        if (expect.chainId !== null && hit.chain_id !== expect.chainId)
+            return null;
+        if (hit.first_seq !== expect.seq)
+            return null;
+        if (hit.first_prev_hash !== expect.prevHash)
+            return null;
+        return hit;
+    }
+    set(file, entry) {
+        // A file whose timestamps are stored at whole-second resolution cannot be
+        // reused: two writes inside one second are indistinguishable there, which is
+        // exactly the window a tamper aims for (same size, mtime put back). Losing
+        // the skip is the cheap outcome; trusting it would not be.
+        if (entry.records <= 0)
+            return;
+        if (!hasSubSecondResolution(entry.identity))
+            return;
+        this.entries.set(file, entry);
+    }
+    /**
+     * Copy of the stored entries. Read-only: nothing can be invalidated through
+     * it, so a caller reporting on the cache cannot weaken it by accident.
+     */
+    snapshot() {
+        return new Map(this.entries);
+    }
+    /** Drops entries for files that no longer exist (rotated out of retention). */
+    prune(liveFiles) {
+        const live = new Set(liveFiles);
+        for (const file of [...this.entries.keys()]) {
+            if (!live.has(file))
+                this.entries.delete(file);
+        }
+    }
+    clear() {
+        this.entries.clear();
+    }
+    get size() {
+        return this.entries.size;
+    }
+}
+const sharedCache = new AuditVerifyCache();
+/**
+ * The process-wide cache. Exposed so a caller that verifies the same directory
+ * repeatedly (an interactive shell running `doctor` over and over) shares one
+ * set of entries, and so a test can observe that production code used it.
+ */
+export function getSharedAuditVerifyCache() {
+    return sharedCache;
+}
+/**
+ * Verifies the log chronologically across rotated files, reusing verified files
+ * that have not changed. Fails closed: no key, no verdict.
+ *
+ * The verdict is identical to {@link verifyAuditLog}'s for any input the cache
+ * did not serve; `verify-streaming.test.ts` pins both against the same logs.
+ */
+export async function verifyAuditDirCached(dir, opts = {}) {
+    const files = await getAuditFilesChronological(dir);
+    const head = opts.head === undefined ? readHead(dir) : opts.head;
+    const { anchor, anchorSource, conflict, sources } = resolveAnchor([
+        { head, source: opts.head === undefined ? AUDIT_HEAD_FILENAME : 'supplied head anchor' },
+        { head: readHeadFloor(dir), source: `head${AUDIT_FLOOR_SUFFIX}` },
+    ]);
+    const cache = opts.useCache === false ? null : (opts.cache ?? sharedCache);
+    cache?.prune(files);
+    const base = {
+        files,
+        malformed_lines: 0,
+        unreadable_files: [],
+        head_present: head !== null,
+        anchor_sources: sources,
+        anchor_source: anchorSource,
+        cached_files: [],
+        verified_files: [],
+        skipped_bytes: 0,
+        verified_bytes: 0,
+        cache_hit: false,
+    };
+    if (files.length === 0) {
+        // Same shape as `verifyAuditLog`: a directory that used to hold an anchored
+        // chain and no longer holds a log file has had the log *deleted*, which is a
+        // different failure from "no records have ever been written".
+        const state = await auditDirState(dir);
+        const deleted = state === 'missing' || (anchor !== null && anchor.seq > 0);
+        return {
+            ...base,
+            intact: false,
+            events: 0,
+            reason: deleted ? 'log_missing' : 'empty',
+            detail: deleted
+                ? `no audit log files in ${dir}` +
+                    (anchor && anchor.seq > 0
+                        ? `, but an anchor claims seq ${anchor.seq} — the log was deleted`
+                        : '')
+                : `no audit records in ${dir} — an empty log is never verified`,
+            chain_id: anchor?.chain_id ?? head?.chain_id ?? null,
+        };
+    }
+    let key;
+    try {
+        key =
+            opts.key !== undefined
+                ? requireKeyBytes(opts.key)
+                : loadAuditKey({ dir: opts.keyDir ?? dir, create: false }).key;
+    }
+    catch (err) {
+        return {
+            ...base,
+            intact: false,
+            events: 0,
+            reason: 'key_unavailable',
+            detail: err instanceof Error ? err.message : String(err),
+            chain_id: anchor?.chain_id ?? head?.chain_id ?? null,
+        };
+    }
+    if (conflict) {
+        return {
+            ...base,
+            intact: false,
+            events: 0,
+            reason: 'head_mismatch',
+            detail: conflict,
+            chain_id: anchor?.chain_id ?? head?.chain_id ?? null,
+        };
+    }
+    const keyFingerprint = crypto.createHash('sha256').update(key).digest('hex').slice(0, 32);
+    // The chain state the next file must resume from. Tracked here rather than
+    // read back off the verifier, because a cache hit replaces the verifier and
+    // the state has to survive that.
+    let resumeChainId = anchor?.chain_id ?? head?.chain_id ?? null;
+    let resumeSeq = opts.expectedSeq ?? anchor?.retained_from_seq ?? 1;
+    /** null means "adopt the first record's prev_hash" (a retention window). */
+    let resumePrev = resumeSeq > 1 ? null : GENESIS_HASH;
+    let verifier = new ChainVerifier(key, {
+        chainId: resumeChainId ?? undefined,
+        expectedSeq: resumeSeq,
+        expectedPrevHash: resumePrev ?? undefined,
+    });
+    /** Records already examined when the current verifier was built. */
+    let verifierBase = 0;
+    let chainId = resumeChainId;
+    let records = 0;
+    let malformed = 0;
+    let fromSeq = null;
+    let toSeq = null;
+    let lastCachedHead = null;
+    /** Newest verified-at among reused entries. */
+    let cachedSince;
+    /** Head of the log's last file, when that file came from the cache. */
+    let reusedTail = null;
+    /** Set once a file is skipped over rather than read; blocks every later skip. */
+    let cacheBlocked = false;
+    for (const file of files) {
+        if (verifier.failed)
+            break;
+        const identity = await statAuditFileIdentity(file);
+        if (!identity) {
+            base.unreadable_files.push(file);
+            // A file the walk could not even stat is a hole in the sequence. Letting a
+            // later cache hit bridge it would report "intact" for a chain with a
+            // missing link, so no further skip is allowed in this run.
+            cacheBlocked = true;
+            continue;
+        }
+        const hit = cacheBlocked
+            ? null
+            : (cache?.get(file, identity, {
+                chainId: resumeChainId,
+                seq: resumeSeq,
+                prevHash: resumePrev ?? GENESIS_HASH,
+                keyFingerprint,
+            }) ?? null);
+        if (hit) {
+            // Resuming is exact: the cached head *is* the state the verifier would be
+            // in after reading this file, and the entry's `first_seq`/`first_prev_hash`
+            // proved it was reached from the state we are in now.
+            resumeChainId = hit.chain_id;
+            resumeSeq = hit.seq + 1;
+            resumePrev = hit.last_hash;
+            verifier = new ChainVerifier(key, {
+                chainId: hit.chain_id,
+                expectedSeq: resumeSeq,
+                expectedPrevHash: hit.last_hash,
+            });
+            verifierBase = records;
+            chainId = hit.chain_id;
+            records += hit.records;
+            malformed += hit.malformed_lines;
+            if (fromSeq === null)
+                fromSeq = hit.first_seq;
+            toSeq = hit.seq;
+            base.cached_files.push(file);
+            base.skipped_bytes += identity.size;
+            lastCachedHead = makeHead(hit.seq, hit.last_hash, hit.chain_id);
+            reusedTail = { seq: hit.seq, last_hash: hit.last_hash, chain_id: hit.chain_id };
+            if (cachedSince === undefined || hit.verified_at > cachedSince) {
+                cachedSince = hit.verified_at;
+            }
+            continue;
+        }
+        base.verified_files.push(file);
+        base.verified_bytes += identity.size;
+        const startSeq = resumeSeq;
+        const startPrev = resumePrev ?? GENESIS_HASH;
+        verifierBase = records;
+        verifier = new ChainVerifier(key, {
+            chainId: resumeChainId ?? undefined,
+            expectedSeq: startSeq,
+            expectedPrevHash: resumePrev ?? undefined,
+        });
+        let fileRecords = 0;
+        let fileMalformed = 0;
+        let fileFailed = false;
+        /** False when the file was not read to its end (a `maxRecords` cut-off). */
+        let readToEnd = true;
+        try {
+            for await (const line of readLines(file)) {
+                const event = parseLine(line);
+                if (!event) {
+                    // A line that is not a record is corruption, not a gap to skip past.
+                    fileMalformed++;
+                    verifier.push(null);
+                    fileFailed = true;
+                    break;
+                }
+                verifier.push(event);
+                fileRecords++;
+                if (verifier.failed) {
+                    fileFailed = true;
+                    break;
+                }
+                if (opts.maxRecords !== undefined && records + fileRecords >= opts.maxRecords) {
+                    readToEnd = false;
+                    break;
+                }
+            }
+        }
+        catch {
+            base.unreadable_files.push(file);
+            cacheBlocked = true;
+            readToEnd = false;
+        }
+        records += fileRecords;
+        malformed += fileMalformed;
+        const observed = fileRecords > 0 ? verifier.observedHead() : null;
+        if (fileRecords > 0) {
+            // This file, not an earlier reused one, now holds the end of the log. An
+            // empty file (a fresh active file right after a rotation) does not, so a
+            // reused tail behind it still needs re-anchoring.
+            reusedTail = null;
+            if (fromSeq === null)
+                fromSeq = startSeq;
+            if (observed) {
+                toSeq = observed.seq;
+                chainId = chainId ?? observed.chain_id;
+                resumeChainId = observed.chain_id;
+                resumeSeq = observed.seq + 1;
+                resumePrev = observed.last_hash;
+            }
+        }
+        // Only a file that was read to its end and verified end to end may be
+        // remembered: a partial read (maxRecords) or a mid-file failure would cache
+        // a truncated head and the next run would resume from the wrong place.
+        if (!fileFailed && readToEnd && observed) {
+            cache?.set(file, {
+                identity,
+                records: fileRecords,
+                malformed_lines: fileMalformed,
+                first_seq: startSeq,
+                first_prev_hash: startPrev,
+                seq: observed.seq,
+                last_hash: observed.last_hash,
+                chain_id: observed.chain_id,
+                key_fingerprint: keyFingerprint,
+                verified_at: new Date().toISOString(),
+            });
+        }
+    }
+    const coverage = fromSeq !== null && toSeq !== null ? { from_seq: fromSeq, to_seq: toSeq, records } : undefined;
+    const tail = reusedTail === null ? null : await reanchorTail(files, reusedTail);
+    const tailMismatch = tail === null ? null : tail.error;
+    if (tailMismatch !== null || cacheBlocked) {
+        const detail = tailMismatch ??
+            `a log file could not be read, so the chain has an unverified gap; ${base.cached_files.length} file(s) were skipped and the result is not a verdict`;
+        return {
+            ...base,
+            intact: false,
+            events: records,
+            reason: tailMismatch === null ? 'unreadable' : 'head_mismatch',
+            detail,
+            chain_id: chainId ?? anchor?.chain_id ?? head?.chain_id ?? null,
+            observed: lastCachedHead ?? undefined,
+            verified_from_seq: coverage && coverage.from_seq > 1 ? coverage.from_seq : undefined,
+            coverage,
+            cached_since: cachedSince,
+        };
+    }
+    if (base.verified_files.length === 0 && base.cached_files.length > 0) {
+        // Every file was skipped, so the verifier has read nothing and cannot
+        // produce a verdict (an empty window is never "verified"). The cached heads
+        // are the log's own verified heads, so the verdict is: unchanged since the
+        // verification that produced them, still consistent with the tail record
+        // just re-read, and still consistent with the anchor that was just read from
+        // disk.
+        const observed = lastCachedHead;
+        const mismatch = observed
+            ? (compareWithAnchor(observed, anchor) ?? undefined)
+            : 'no cached head to compare';
+        if (observed && !mismatch) {
+            return {
+                intact: true,
+                events: records,
+                observed,
+                files: base.files,
+                malformed_lines: malformed,
+                unreadable_files: base.unreadable_files,
+                head_present: head !== null,
+                chain_id: observed.chain_id,
+                verified_from_seq: coverage && coverage.from_seq > 1 ? coverage.from_seq : undefined,
+                coverage,
+                cached_files: base.cached_files,
+                verified_files: base.verified_files,
+                skipped_bytes: base.skipped_bytes,
+                verified_bytes: base.verified_bytes,
+                cache_hit: true,
+                cached_since: cachedSince,
+            };
+        }
+        return {
+            intact: false,
+            events: records,
+            reason: 'head_mismatch',
+            detail: mismatch,
+            files: base.files,
+            malformed_lines: malformed,
+            unreadable_files: base.unreadable_files,
+            head_present: head !== null,
+            chain_id: observed?.chain_id ?? anchor?.chain_id ?? head?.chain_id ?? null,
+            coverage,
+            cached_files: base.cached_files,
+            verified_files: base.verified_files,
+            skipped_bytes: base.skipped_bytes,
+            verified_bytes: base.verified_bytes,
+            cache_hit: true,
+            cached_since: cachedSince,
+        };
+    }
+    const result = verifier.result(anchor);
+    const brokenAt = result.brokenAt === undefined ? undefined : result.brokenAt + verifierBase;
+    return {
+        ...result,
+        ...base,
+        brokenAt,
+        malformed_lines: malformed,
+        events: records,
+        chain_id: result.observed?.chain_id ?? chainId ?? anchor?.chain_id ?? head?.chain_id ?? null,
+        coverage,
+        cached_since: cachedSince,
+    };
+}
+/**
+ * Anchor comparison for the fully-cached path. Mirrors the anchor rules in
+ * `ChainVerifier.result`, which cannot be reused here because it only knows the
+ * records it was actually handed. `head` is re-read from disk on every call, so
+ * it is never stale.
+ */
+function compareWithAnchor(observed, head) {
+    if (!head)
+        return null;
+    if (head.chain_id !== observed.chain_id) {
+        return `head belongs to chain ${head.chain_id}, the verified log is chain ${observed.chain_id}`;
+    }
+    if (head.seq > observed.seq) {
+        return `head expects at least seq ${head.seq} but the verified log ends at seq ${observed.seq}`;
+    }
+    if (head.seq < observed.seq) {
+        return `log ends at seq ${observed.seq}, ahead of the anchored head at ${head.seq}`;
+    }
+    if (head.last_hash !== observed.last_hash) {
+        return `record at seq ${observed.seq} does not match the anchored head`;
+    }
+    return null;
+}
+/**
+ * Re-anchors a remembered tail head to the bytes that are on disk right now.
+ *
+ * Bounded by construction: only the last {@link TAIL_PEEK_BYTES} of the newest
+ * non-empty file are read, whatever the size of the log. `null` means the tail
+ * still is the record that was verified.
+ */
+async function reanchorTail(files, expected) {
+    for (let i = files.length - 1; i >= 0; i--) {
+        const file = files[i];
+        const event = await readTailRecord(file);
+        if (event === 'empty')
+            continue;
+        if (event === 'unreadable') {
+            return {
+                error: `the tail of ${file} is not a readable record, so its cached verdict cannot be trusted`,
+            };
+        }
+        if (event.seq !== expected.seq ||
+            event.mac !== expected.last_hash ||
+            event.chain_id !== expected.chain_id) {
+            return {
+                error: `the last record on disk is ${describeEvent(event)}, not the ${describeEvent(expected)} ` +
+                    'that was verified earlier; the log changed while the cached head still claimed otherwise',
+            };
+        }
+        return null;
+    }
+    return {
+        error: 'no log file holds a readable record, so the cached tail head cannot be trusted',
+    };
+}
+function describeEvent(event) {
+    return `seq ${event.seq} of chain ${event.chain_id}`;
+}
+/** Last complete non-empty line of a file, read from its tail. */
+async function readTailRecord(file) {
+    let handle = null;
+    try {
+        handle = await fs.promises.open(file, 'r');
+        const st = await handle.stat();
+        if (st.size === 0)
+            return 'empty';
+        const length = Math.min(TAIL_PEEK_BYTES, st.size);
+        const buffer = Buffer.alloc(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, st.size - length);
+        let text = buffer.subarray(0, bytesRead).toString('utf8');
+        // The first fragment may be a partial record; the last line is never one.
+        if (st.size > length) {
+            const newlineAt = text.indexOf('\n');
+            if (newlineAt < 0)
+                return 'empty';
+            text = text.slice(newlineAt + 1);
+        }
+        const lines = text.split('\n');
+        while (lines.length > 0 && lines[lines.length - 1].trim().length === 0)
+            lines.pop();
+        const last = lines[lines.length - 1];
+        if (last === undefined)
+            return 'empty';
+        return parseLine(last) ?? 'unreadable';
+    }
+    catch {
+        return 'unreadable';
+    }
+    finally {
+        if (handle)
+            await handle.close().catch(() => undefined);
+    }
+}
+function parseLine(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+        return null;
+    const raw = trimmed.charCodeAt(0) === 0xfeff ? trimmed.slice(1) : trimmed;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Yields non-empty lines with bounded memory. Mirrors the reader in
+ * `local-writer.ts`; kept local so this module does not widen that file's API.
+ */
+async function* readLines(file) {
+    const stream = fs.createReadStream(file, { encoding: 'utf8' });
+    const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+        for await (const line of rl) {
+            if (line.trim().length > 0)
+                yield line;
+        }
+    }
+    finally {
+        rl.close();
+        stream.destroy();
+    }
+}
+async function auditDirState(dir) {
+    let entries;
+    try {
+        entries = await fs.promises.readdir(dir);
+    }
+    catch {
+        return 'missing';
+    }
+    return entries.some((e) => e === 'audit.jsonl' || /^audit-\d+\.jsonl$/.test(e))
+        ? 'present'
+        : 'empty';
+}
+//# sourceMappingURL=verify-cache.js.map

package/dist/esm/audit/verify-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-cache.js","sourceRoot":"","sources":["../../../src/audit/verify-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,eAAe,EACf,aAAa,GAEd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,gFAAgF;AAChF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAiBlC,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC/B,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE;YACtB,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE;SACvB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAoB,EAAE,CAAoB;IAC9D,OAAO,CACL,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QACjB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;QACf,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,WAAc,CAAC;AAErC;;;GAGG;AACH,SAAS,sBAAsB,CAAC,QAA2B;IACzD,IAAI,CAAC;QACH,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,KAAK,EAAE;YAChD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,KAAK,EAAE,CACjD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAqCD,MAAM,OAAO,gBAAgB;IACV,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE9D;;;;OAIG;IACH,GAAG,CAAC,IAAY,EAAE,QAA2B,EAAE,MAAuB;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC5E,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,KAAsB;QACtC,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;YAAE,OAAO;QAC/B,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,SAA2B;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,WAAW,CAAC;AACrB,CAAC;AA0CD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,OAA4B,EAAE;IAE9B,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;QAChE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,EAAE;QACxF,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,kBAAkB,EAAE,EAAE;KAClE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;IAC3E,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAEpB,MAAM,IAAI,GAAG;QACX,KAAK;QACL,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,EAAc;QAChC,YAAY,EAAE,IAAI,KAAK,IAAI;QAC3B,cAAc,EAAE,OAAO;QACvB,aAAa,EAAE,YAAY;QAC3B,YAAY,EAAE,EAAc;QAC5B,cAAc,EAAE,EAAc;QAC9B,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,SAAS,EAAE,KAAK;KACjB,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,4EAA4E;QAC5E,6EAA6E;QAC7E,8DAA8D;QAC9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;YACzC,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,yBAAyB,GAAG,EAAE;oBAC9B,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC;wBACvB,CAAC,CAAC,8BAA8B,MAAM,CAAC,GAAG,wBAAwB;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACT,CAAC,CAAC,uBAAuB,GAAG,mCAAmC;YACjE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG;YACD,IAAI,CAAC,GAAG,KAAK,SAAS;gBACpB,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC3B,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;IACrE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE1F,2EAA2E;IAC3E,4EAA4E;IAC5E,iCAAiC;IACjC,IAAI,aAAa,GAAG,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC/D,IAAI,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,EAAE,iBAAiB,IAAI,CAAC,CAAC;IACnE,4EAA4E;IAC5E,IAAI,UAAU,GAAkB,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IAEpE,IAAI,QAAQ,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE;QACpC,OAAO,EAAE,aAAa,IAAI,SAAS;QACnC,WAAW,EAAE,SAAS;QACtB,gBAAgB,EAAE,UAAU,IAAI,SAAS;KAC1C,CAAC,CAAC;IACH,oEAAoE;IACpE,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,aAAa,CAAC;IAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,cAAc,GAAqB,IAAI,CAAC;IAC5C,+CAA+C;IAC/C,IAAI,WAA+B,CAAC;IACpC,uEAAuE;IACvE,IAAI,UAAU,GAAgE,IAAI,CAAC;IACnF,iFAAiF;IACjF,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM;QAE3B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,2EAA2E;YAC3E,qEAAqE;YACrE,2DAA2D;YAC3D,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,YAAY;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE;gBAC1B,OAAO,EAAE,aAAa;gBACtB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU,IAAI,YAAY;gBACpC,cAAc;aACf,CAAC,IAAI,IAAI,CAAC,CAAC;QAEhB,IAAI,GAAG,EAAE,CAAC;YACR,0EAA0E;YAC1E,4EAA4E;YAC5E,sDAAsD;YACtD,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC7B,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YACxB,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC;YAC3B,QAAQ,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,WAAW,EAAE,SAAS;gBACtB,gBAAgB,EAAE,GAAG,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,YAAY,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;YACvB,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;YACvB,SAAS,IAAI,GAAG,CAAC,eAAe,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC;YAC9C,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,IAAI,CAAC;YACpC,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChE,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChF,IAAI,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,GAAG,WAAW,EAAE,CAAC;gBAC/D,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YAChC,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,CAAC;QAErC,MAAM,QAAQ,GAAG,SAAS,CAAC;QAC3B,MAAM,SAAS,GAAG,UAAU,IAAI,YAAY,CAAC;QAC7C,YAAY,GAAG,OAAO,CAAC;QACvB,QAAQ,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,aAAa,IAAI,SAAS;YACnC,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,UAAU,IAAI,SAAS;SAC1C,CAAC,CAAC;QAEH,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,4EAA4E;QAC5E,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,qEAAqE;oBACrE,aAAa,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpB,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,WAAW,EAAE,CAAC;gBACd,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACpB,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,GAAG,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC9E,SAAS,GAAG,KAAK,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,WAAW,CAAC;QACvB,SAAS,IAAI,aAAa,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,yEAAyE;YACzE,yEAAyE;YACzE,kDAAkD;YAClD,UAAU,GAAG,IAAI,CAAC;YAClB,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,GAAG,QAAQ,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC;gBACrB,OAAO,GAAG,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC;gBACvC,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBAClC,SAAS,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;gBAC7B,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC;YAClC,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,CAAC,UAAU,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YACzC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;gBACf,QAAQ;gBACR,OAAO,EAAE,WAAW;gBACpB,eAAe,EAAE,aAAa;gBAC9B,SAAS,EAAE,QAAQ;gBACnB,eAAe,EAAE,SAAS;gBAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,eAAe,EAAE,cAAc;gBAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;IAEvD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,MAAM,GACV,YAAY;YACZ,qEAAqE,IAAI,CAAC,YAAY,CAAC,MAAM,uDAAuD,CAAC;QACvJ,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe;YAC9D,MAAM;YACN,QAAQ,EAAE,OAAO,IAAI,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI;YAC/D,QAAQ,EAAE,cAAc,IAAI,SAAS;YACrC,iBAAiB,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACpF,QAAQ;YACR,YAAY,EAAE,WAAW;SAC1B,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,sEAAsE;QACtE,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,QAAQ;QACR,MAAM,QAAQ,GAAG,cAAc,CAAC;QAChC,MAAM,QAAQ,GAAuB,QAAQ;YAC3C,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC;YACpD,CAAC,CAAC,2BAA2B,CAAC;QAChC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,OAAO;gBACf,QAAQ;gBACR,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,eAAe,EAAE,SAAS;gBAC1B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,YAAY,EAAE,IAAI,KAAK,IAAI;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,iBAAiB,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACpF,QAAQ;gBACR,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,WAAW;aAC1B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,SAAS;YAC1B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,KAAK,IAAI;YAC3B,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI;YAC1E,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,WAAW;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC;IAE5F,OAAO;QACL,GAAG,MAAM;QACT,GAAG,IAAI;QACP,QAAQ;QACR,eAAe,EAAE,SAAS;QAC1B,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,IAAI,OAAO,IAAI,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI;QAC5F,QAAQ;QACR,YAAY,EAAE,WAAW;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,QAAmB,EAAE,IAAsB;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,yBAAyB,IAAI,CAAC,QAAQ,+BAA+B,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,6BAA6B,IAAI,CAAC,GAAG,qCAAqC,QAAQ,CAAC,GAAG,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,mBAAmB,QAAQ,CAAC,GAAG,mCAAmC,IAAI,CAAC,GAAG,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,iBAAiB,QAAQ,CAAC,GAAG,mCAAmC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,KAAe,EACf,QAA8D;IAE9D,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,OAAO;YAAE,SAAS;QAChC,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,eAAe,IAAI,oEAAoE;aAC/F,CAAC;QACJ,CAAC;QACD,IACE,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;YAC1B,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS;YAChC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EACpC,CAAC;YACD,OAAO;gBACL,KAAK,EACH,8BAA8B,aAAa,CAAC,KAAK,CAAC,aAAa,aAAa,CAAC,QAAQ,CAAC,GAAG;oBACzF,0FAA0F;aAC7F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK,EAAE,gFAAgF;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAwC;IAC7D,OAAO,OAAO,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,QAAQ,EAAE,CAAC;AACvD,CAAC;AAID,kEAAkE;AAClE,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,MAAM,GAAkC,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;QAC7E,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,0EAA0E;QAC1E,IAAI,EAAE,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,SAAS,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QACvC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,OAAO,MAAoB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAID,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC;AACd,CAAC"}