@serfab/cadre-core 1.13.0 → 1.14.0

package/dist/control-protocol-guard.js

@@ -0,0 +1,293 @@
+/**
+ * The per-stream protocol guard on the control node: ONE declaration of what a peer must be to
+ * open a stream on each protocol the control node serves ({@link controlProtocolClasses}), and
+ * ONE place that enforces it for every handler, whoever registered it — Sereus, Optimystic,
+ * FRET or libp2p ({@link installControlProtocolGuard}).
+ *
+ * It is the fail-closed layer behind the fail-open connection gate
+ * (`membership-connection-gater.ts`). That gate decides per CONNECTION and must admit strangers
+ * in several windows (an open formation invitation, a live cadre invitation, relay-only
+ * admission on a node running the relay server, a delegate grant); this guard is what keeps a
+ * stranger on such a connection to the protocols declared open to it. A handler therefore never
+ * checks membership itself, and a handler added later cannot open a hole by forgetting to: a
+ * protocol missing from the table is guarded as members-only (see "Unclassified protocols").
+ *
+ * ## The classes
+ *
+ *  - `stranger-open` — seed delivery, strand formation, cadre-invitation redemption. Any peer;
+ *    each handler makes its own trust decision in-protocol (a seed signature against the
+ *    anchored trust policy, a formation token, an invitation's possession proof).
+ *  - `transport` — libp2p plumbing (identify, ping, hole punching, AutoNAT, the circuit-relay
+ *    stop and hop protocols, WebRTC signaling). Every connection runs these, the redeeming
+ *    device's own included: refusing identify would make that device treat the member as
+ *    off-network. What they expose is the node's listen and observed addresses, its protocol
+ *    list (whose `/optimystic/control-<partyId>` prefix names the party id, which an invitation
+ *    bundle already carries) and its public key. AutoNAT v1 (`@libp2p/autonat` 3.0.28) dials
+ *    back only public addresses on the requester's own observed host, and refuses a request made
+ *    on another peer's behalf, so it cannot be pointed at a third machine. Relay reservations
+ *    are decided separately, at the connection gate's reservation hook.
+ *  - `members` — wake and strand-addr. Authorized members by the voucher-anchored LIVE read
+ *    (`CadreNode.isAuthorizedMember`), the check those handlers made themselves before this
+ *    guard existed, so moving it here changes nobody's admission. That matters most for
+ *    strand-addr's delegate grant, which hands out connection and relay admission. The live read
+ *    also has no window during `start()` where it admits everyone, which the snapshot does.
+ *  - `members-snapshot` — the four Optimystic control-database protocols and the five FRET
+ *    protocols. Authorized members by the in-memory snapshot
+ *    (`CadreNode.authorizeInboundControlStream`). These serve the reads a live membership check
+ *    would itself make, so a live read from inside their guard would deadlock two machines into
+ *    refusing each other; the snapshot is synchronous and reads nothing.
+ *
+ * ## Mechanism: the registrar's handler lookup
+ *
+ * libp2p dispatches every inbound stream through `components.registrar.getHandler(protocol)`
+ * (`libp2p/dist/src/connection.js`, `onIncomingStream`). The guard replaces `getHandler` on the
+ * control node's registrar instance with one that returns the registered record with its
+ * handler wrapped for the protocol's class. A handler registered at any time, before or after
+ * the guard, is therefore guarded at dispatch, with no sweep over registrations and no race
+ * against a late one (the seed listener, a replaced formation handler).
+ *
+ * The record's `options` object is passed through unchanged: libp2p also reads it through
+ * `getHandler` for stream limits (`findIncomingStreamLimit`, `findOutgoingStreamLimit`) and for
+ * `runOnLimitedConnection`.
+ *
+ * NOTE: a libp2p that stopped dispatching through `getHandler` would leave this guard installed
+ * and inert, and the class-completeness spec would still pass. Only the stranger probe in
+ * `control-stream-authz.integration.ts` (step 5) observes dispatch, so run it on every libp2p
+ * upgrade.
+ *
+ * libp2p's own stream middleware (`libp2p.use`) is NOT used. In libp2p 3.3.11 `onIncomingStream`
+ * pushes the handler call onto the very array `registrar.getMiddleware` returns, so every inbound
+ * stream appends another handler call to the stored chain and outbound streams then run those
+ * too (read from the source, not run). Revisit if a libp2p upgrade stops mutating that array.
+ *
+ * ## Denial
+ *
+ * A refused stream is aborted with {@link ControlStreamRefusedError} before its handler runs, so
+ * nothing is decoded and nothing goes on the wire: telling a stranger "you are not a member"
+ * would confirm membership state to it. The refusal is logged on this node with peer, protocol
+ * and reason. The live read fails closed: a false result, a throw and a read slower than
+ * {@link ControlProtocolGuardOptions.liveDecisionTimeoutMs} all refuse.
+ *
+ * ## Unclassified protocols
+ *
+ * A protocol missing from the table is guarded as `members-snapshot`, with one `console.warn` per
+ * protocol: it works for members and refuses strangers until someone classes it.
+ * `control-protocol-guard.spec.ts` starts a node with every conditional protocol on and fails
+ * when any protocol it serves is unclassified, so an upgrade that adds one fails CI.
+ */
+import debug from 'debug';
+import { SEED_PROTOCOL } from './seed-bootstrap.js';
+import { FORMATION_PROTOCOL } from './strand-formation-protocol.js';
+import { CADRE_INVITE_PROTOCOL } from './cadre-invite-protocol.js';
+import { WAKE_PROTOCOL } from './strand-wake-protocol.js';
+import { STRAND_ADDR_PROTOCOL } from './strand-addr-protocol.js';
+import { withTimeout } from './control-stream.js';
+const log = debug('sereus:cadre:control-protocol-guard');
+/** The class a protocol missing from {@link controlProtocolClasses} is guarded as. */
+export const UNCLASSIFIED_PROTOCOL_CLASS = 'members-snapshot';
+/** Stable error code carried by {@link ControlStreamRefusedError}. */
+export const CONTROL_STREAM_REFUSED_CODE = 'ERR_CONTROL_STREAM_REFUSED';
+/**
+ * The reason a control-node stream was aborted by the guard, so this node's logs can tell a
+ * refusal from a transport fault. The remote only ever sees the stream reset.
+ */
+export class ControlStreamRefusedError extends Error {
+    constructor(remotePeerId, protocol, reason) {
+        super(`control stream refused: peer=${remotePeerId} protocol=${protocol} reason=${reason}`);
+        this.code = CONTROL_STREAM_REFUSED_CODE;
+        this.name = 'ControlStreamRefusedError';
+    }
+}
+/**
+ * The control libp2p node's Optimystic network name. `db-p2p` namespaces the node's protocol ids
+ * as `/optimystic/<networkName>/...`, so this is the one binding every control-network derivation
+ * starts from: the node options, the block-transfer prefix the control backfill dials, and the
+ * class table below.
+ *
+ * NOTE: the party id goes in UNENCODED here, unlike in `controlStorageScope`. Safe today because a
+ * party id is locally configured rather than replicated in, and both ends of a connection derive
+ * this string identically: an odd party id yields an odd but consistent protocol id, not a
+ * mismatch or an escaped name. If a party id ever arrives from the network, encode it here as the
+ * storage scope key already does.
+ */
+export function controlNetworkName(partyId) {
+    return `control-${partyId}`;
+}
+/**
+ * The class of every protocol a control node serves, by exact protocol id: the single
+ * declaration the guard enforces. See the module doc for what each class admits and why each
+ * protocol is in it.
+ */
+export function controlProtocolClasses(partyId) {
+    const prefix = `/optimystic/${controlNetworkName(partyId)}`;
+    const fret = `${prefix}/fret/1.0.0`;
+    return new Map([
+        [SEED_PROTOCOL, 'stranger-open'],
+        [FORMATION_PROTOCOL, 'stranger-open'],
+        [CADRE_INVITE_PROTOCOL, 'stranger-open'],
+        [WAKE_PROTOCOL, 'members'],
+        [STRAND_ADDR_PROTOCOL, 'members'],
+        [`${prefix}/repo/1.0.0`, 'members-snapshot'],
+        [`${prefix}/cluster/1.0.0`, 'members-snapshot'],
+        [`${prefix}/db-p2p/sync/1.0.0`, 'members-snapshot'],
+        [`${prefix}/db-p2p/block-transfer/1.0.0`, 'members-snapshot'],
+        [`${fret}/neighbors`, 'members-snapshot'],
+        [`${fret}/neighbors/announce`, 'members-snapshot'],
+        [`${fret}/maybeAct`, 'members-snapshot'],
+        [`${fret}/leave`, 'members-snapshot'],
+        [`${fret}/ping`, 'members-snapshot'],
+        [`${prefix}/id/1.0.0`, 'transport'],
+        [`${prefix}/id/push/1.0.0`, 'transport'],
+        ['/ipfs/ping/1.0.0', 'transport'],
+        ['/libp2p/dcutr', 'transport'],
+        ['/libp2p/autonat/1.0.0', 'transport'],
+        ['/libp2p/circuit/relay/0.2.0/stop', 'transport'],
+        // Registered only while the relay server runs (the storage profile's default).
+        ['/libp2p/circuit/relay/0.2.0/hop', 'transport'],
+        // Registered only when an embedder's `network.transports` includes WebRTC.
+        ['/webrtc-signaling/0.0.1', 'transport'],
+    ]);
+}
+function isGuardableRegistrar(value) {
+    return typeof value === 'object' && value !== null
+        && typeof value.getHandler === 'function';
+}
+/**
+ * The control node's registrar, which is not on libp2p's public `Libp2p` type. Throws when the
+ * shape is absent (a libp2p upgrade that moved it), which fails `CadreNode.start()`: a control
+ * node without the guard must not run.
+ */
+function controlRegistrar(node) {
+    let registrar;
+    try {
+        // libp2p's components object is a Proxy that throws for a component it does not hold.
+        registrar = node.components?.registrar;
+    }
+    catch (error) {
+        throw new Error('control-protocol guard: the control node exposes no registrar component; refusing to run unguarded', { cause: error });
+    }
+    if (!isGuardableRegistrar(registrar)) {
+        throw new Error('control-protocol guard: the control node\'s registrar has no getHandler; refusing to run unguarded');
+    }
+    return registrar;
+}
+/**
+ * Guard every inbound stream on `node` by its protocol's class (see the module doc). Call once,
+ * on the control node, before it holds any connection: `CadreNode.start()` calls it right after
+ * the node is built, inside the bring-up quiet period. Throws when the node's registrar is not
+ * the shape the guard replaces.
+ */
+export function installControlProtocolGuard(node, options) {
+    const registrar = controlRegistrar(node);
+    const guard = new ControlProtocolGuard(options);
+    const lookup = registrar.getHandler.bind(registrar);
+    // An unregistered protocol still throws libp2p's own UnhandledProtocolError, from `lookup`.
+    registrar.getHandler = (protocol) => guard.recordFor(protocol, lookup(protocol));
+    log('Guarding the control node\'s inbound streams for party %s', options.partyId);
+}
+/** The per-node state behind {@link installControlProtocolGuard}. */
+class ControlProtocolGuard {
+    constructor(options) {
+        this.options = options;
+        /**
+         * The guarded copy of each registered record, so the lookups libp2p makes per stream (the
+         * stream-limit read, then the dispatch) allocate nothing. Keyed on the registrar's own record,
+         * which a re-registration replaces, so a replaced handler gets a fresh wrapper.
+         */
+        this.guarded = new WeakMap();
+        this.warnedUnclassified = new Set();
+        this.classes = controlProtocolClasses(options.partyId);
+    }
+    recordFor(protocol, record) {
+        const protocolClass = this.classOf(protocol);
+        if (protocolClass === 'stranger-open' || protocolClass === 'transport') {
+            return record;
+        }
+        let guarded = this.guarded.get(record);
+        if (!guarded) {
+            guarded = { ...record, handler: this.wrap(protocol, protocolClass, record.handler) };
+            this.guarded.set(record, guarded);
+        }
+        return guarded;
+    }
+    classOf(protocol) {
+        const declared = this.classes.get(protocol);
+        if (declared) {
+            return declared;
+        }
+        if (!this.warnedUnclassified.has(protocol)) {
+            this.warnedUnclassified.add(protocol);
+            console.warn(`Control node serves ${protocol}, which has no class in controlProtocolClasses ` +
+                `(control-protocol-guard.ts); guarding it as ${UNCLASSIFIED_PROTOCOL_CLASS}, so strangers are refused on it. ` +
+                'Declare its class.');
+        }
+        return UNCLASSIFIED_PROTOCOL_CLASS;
+    }
+    wrap(protocol, protocolClass, handler) {
+        if (protocolClass === 'members') {
+            // NOTE: the handler starts reading only once the live read settles, usually after the
+            // asker has half-closed, and a plain `for await` over a libp2p 3.3.11 stream never ends
+            // there (see `collect` in control-stream.ts). Wake and strand-addr read through
+            // `readStreamToEnd`, which handles it; a handler added to this class must too.
+            return async (stream, connection) => {
+                const remotePeerId = connection.remotePeer.toString();
+                const refusal = await this.liveRefusal(remotePeerId);
+                if (refusal !== undefined) {
+                    refuse(stream, remotePeerId, protocol, refusal);
+                    return;
+                }
+                await handler(stream, connection);
+            };
+        }
+        return (stream, connection) => {
+            const remotePeerId = connection.remotePeer.toString();
+            const refusal = this.snapshotRefusal(remotePeerId, protocol);
+            if (refusal !== undefined) {
+                refuse(stream, remotePeerId, protocol, refusal);
+                return;
+            }
+            return handler(stream, connection);
+        };
+    }
+    /**
+     * Why the live read refuses `remotePeerId`, or undefined when it admits.
+     *
+     * NOTE: a stranger's stream now costs one live membership read before it is refused, and the
+     * handlers' concurrency caps no longer bound those reads; libp2p's per-connection
+     * `maxInboundStreams` (32 per protocol) does. Fine while that read touches only held blocks.
+     * If refused strangers ever show up as load, refuse a peer absent from the snapshot before the
+     * live read.
+     */
+    async liveRefusal(remotePeerId) {
+        try {
+            const member = await withTimeout(this.options.liveDecisionTimeoutMs, `membership check for ${remotePeerId}`, () => this.options.isMemberLive(remotePeerId));
+            return member === true ? undefined : 'not an authorized member';
+        }
+        catch (error) {
+            return `membership check failed: ${error instanceof Error ? error.message : String(error)}`;
+        }
+    }
+    /** Why the snapshot refuses `remotePeerId` on `protocol`, or undefined when it admits. */
+    snapshotRefusal(remotePeerId, protocol) {
+        try {
+            return this.options.isMemberSnapshot(remotePeerId, protocol) === true
+                ? undefined
+                : 'not in the authorized-member snapshot';
+        }
+        catch (error) {
+            return `snapshot check threw: ${error instanceof Error ? error.message : String(error)}`;
+        }
+    }
+}
+/** Log a refusal and reset the stream before its handler runs. */
+function refuse(stream, remotePeerId, protocol, reason) {
+    log('Refusing %s on %s: %s', remotePeerId, protocol, reason);
+    try {
+        stream.abort(new ControlStreamRefusedError(remotePeerId, protocol, reason));
+    }
+    catch (error) {
+        // The stream may already be gone; the refusal stands either way.
+        log('Aborting the refused stream from %s on %s failed: %o', remotePeerId, protocol, error);
+    }
+}
+//# sourceMappingURL=control-protocol-guard.js.map

package/dist/control-protocol-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-protocol-guard.js","sourceRoot":"","sources":["../src/control-protocol-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,GAAG,GAAG,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAazD,sFAAsF;AACtF,MAAM,CAAC,MAAM,2BAA2B,GAAyB,kBAAkB,CAAC;AAEpF,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AAExE;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAGnD,YAAY,YAAoB,EAAE,QAAgB,EAAE,MAAc;QACjE,KAAK,CAAC,gCAAgC,YAAY,aAAa,QAAQ,WAAW,MAAM,EAAE,CAAC,CAAC;QAHpF,SAAI,GAAG,2BAA2B,CAAC;QAI3C,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,OAAO,WAAW,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,MAAM,MAAM,GAAG,eAAe,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC;IACpC,OAAO,IAAI,GAAG,CAA+B;QAC5C,CAAC,aAAa,EAAE,eAAe,CAAC;QAChC,CAAC,kBAAkB,EAAE,eAAe,CAAC;QACrC,CAAC,qBAAqB,EAAE,eAAe,CAAC;QAExC,CAAC,aAAa,EAAE,SAAS,CAAC;QAC1B,CAAC,oBAAoB,EAAE,SAAS,CAAC;QAEjC,CAAC,GAAG,MAAM,aAAa,EAAE,kBAAkB,CAAC;QAC5C,CAAC,GAAG,MAAM,gBAAgB,EAAE,kBAAkB,CAAC;QAC/C,CAAC,GAAG,MAAM,oBAAoB,EAAE,kBAAkB,CAAC;QACnD,CAAC,GAAG,MAAM,8BAA8B,EAAE,kBAAkB,CAAC;QAC7D,CAAC,GAAG,IAAI,YAAY,EAAE,kBAAkB,CAAC;QACzC,CAAC,GAAG,IAAI,qBAAqB,EAAE,kBAAkB,CAAC;QAClD,CAAC,GAAG,IAAI,WAAW,EAAE,kBAAkB,CAAC;QACxC,CAAC,GAAG,IAAI,QAAQ,EAAE,kBAAkB,CAAC;QACrC,CAAC,GAAG,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAEpC,CAAC,GAAG,MAAM,WAAW,EAAE,WAAW,CAAC;QACnC,CAAC,GAAG,MAAM,gBAAgB,EAAE,WAAW,CAAC;QACxC,CAAC,kBAAkB,EAAE,WAAW,CAAC;QACjC,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,uBAAuB,EAAE,WAAW,CAAC;QACtC,CAAC,kCAAkC,EAAE,WAAW,CAAC;QACjD,+EAA+E;QAC/E,CAAC,iCAAiC,EAAE,WAAW,CAAC;QAChD,2EAA2E;QAC3E,CAAC,yBAAyB,EAAE,WAAW,CAAC;KACxC,CAAC,CAAC;AACJ,CAAC;AAwBD,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;WAC9C,OAAQ,KAAkC,CAAC,UAAU,KAAK,UAAU,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,sFAAsF;QACtF,SAAS,GAAI,IAA4D,CAAC,UAAU,EAAE,SAAS,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oGAAoG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,OAAoC;IAC7F,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,4FAA4F;IAC5F,SAAS,CAAC,UAAU,GAAG,CAAC,QAAgB,EAAuB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,2DAA2D,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,qEAAqE;AACrE,MAAM,oBAAoB;IAUzB,YAA6B,OAAoC;QAApC,YAAO,GAAP,OAAO,CAA6B;QARjE;;;;WAIG;QACc,YAAO,GAAG,IAAI,OAAO,EAA4C,CAAC;QAClE,uBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAGvD,IAAI,CAAC,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,MAA2B;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,aAAa,KAAK,eAAe,IAAI,aAAa,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QACf,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,QAAgB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,uBAAuB,QAAQ,iDAAiD;gBAC5F,+CAA+C,2BAA2B,oCAAoC;gBAC9G,oBAAoB,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,2BAA2B,CAAC;IACpC,CAAC;IAEO,IAAI,CAAC,QAAgB,EAAE,aAA6C,EAAE,OAAsB;QACnG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YACjC,sFAAsF;YACtF,wFAAwF;YACxF,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,KAAK,EAAE,MAAc,EAAE,UAAsB,EAAiB,EAAE;gBACtE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAChD,OAAO;gBACR,CAAC;gBACD,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnC,CAAC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAc,EAAE,UAAsB,EAAwB,EAAE;YACvE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChD,OAAO;YACR,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,WAAW,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAClC,wBAAwB,YAAY,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAC7C,CAAC;YACF,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,CAAC;IACF,CAAC;IAED,0FAA0F;IAClF,eAAe,CAAC,YAAoB,EAAE,QAAgB;QAC7D,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,IAAI;gBACpE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,uCAAuC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;IACF,CAAC;CACD;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,QAAgB,EAAE,MAAc;IACrF,GAAG,CAAC,uBAAuB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC;QACJ,MAAM,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,iEAAiE;QACjE,GAAG,CAAC,sDAAsD,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5F,CAAC;AACF,CAAC"}