@synoi/sraid 0.3.0 → 0.4.0

package/dist/authority.js

@@ -1,563 +0,0 @@
-/**
- * @synoi/sraid — authority.ts
- *
- * L4 authority VERIFIER for CDRO objects (the authorized axis).
- *
- * This is deliberately more than a shape check. Per the Adversary review
- * (panel A6: "ship a verifier, not just a schema"), an attacker who can
- * attach any well-shaped `authority` block to an object would otherwise
- * forge authorization for free. So this module verifies, locally and
- * offline, the parts of authorization that ARE locally checkable:
- *
- *   1. STRUCTURE  — the object carries a present, well-formed authority
- *      block (grant reference present; decision verb, if any, is a valid
- *      GAP verb; intent ref well-formed).
- *   2. BINDING    — the object's authority block actually references the
- *      supplied grant (the grant's OID matches `authority.grant_oid`),
- *      AND the grant is itself a hash-honest CDRO whose recomputed OID
- *      equals its claimed OID (so the grant body cannot be swapped under
- *      a fixed OID reference).
- *   3. SIGNATURE  — the grant carries a valid hybrid (Ed25519 + ML-DSA-65)
- *      signature over its own content core, when grant signing material
- *      and verifier public keys are supplied. A grant with no/invalid
- *      signature does not authorize.
- *   4. COVERAGE   — the grant's capability scopes cover the requested
- *      object type / action (dotted-taxonomy match with segment-boundary
- *      wildcards), and the grant has not expired relative to the object's
- *      creation time. Both are computable from the bytes in hand.
- *
- * What this module does NOT and CANNOT do offline — stated honestly,
- * never silently assumed (CLAIMS_DISCIPLINE):
- *
- *   - LIVE REVOCATION  — whether the grant has since been revoked.
- *   - EXISTENCE        — whether the grant OID actually resolves to a
- *                        published, retrievable grant at all (when the
- *                        caller did not supply the grant material).
- *
- * Both require the OID Resolver, which is presently undeployed
- * (SRAID_FOUNDATION_PUNCHLIST C). This module DEFINES the resolver
- * interface (`AuthorityResolver`) and, when a resolver is supplied, calls
- * it and folds its answer into the result — but when no resolver is
- * supplied, the result is explicitly marked `revocation_checked: false`
- * and `existence_checked: false` so a caller can never mistake a
- * locally-passing verification for a live one.
- *
- * DELEGATION CHAINS (`verifyDelegationChain`, K2) — VERIFY-ONLY. This module
- * also carries a synchronous, offline delegation-chain verifier. It is
- * deliberately scoped to verification with NO enforcement wiring and NO
- * resolver: the caller supplies the ordered ancestors and the per-link
- * verifier keys, and the function makes NO live claim. It ALWAYS returns
- * `revocation_checked: false`, `not_revoked: false`, and
- * `existence_checked: false` — those fields are LITERAL-TYPED `false` so the
- * type system itself forbids a future edit from quietly asserting a live,
- * resolver-backed claim from an offline function (CLAIMS_DISCIPLINE made
- * structural). Synchronicity is intentional: with no Promise overload there is
- * no place for a resolver call, which is what makes the no-live-claim
- * guarantee structural rather than merely documented.
- */
-import { cdroOid, cdroContentCore } from './oid.js';
-import { verifySignature } from './signature.js';
-import { verifyAttestation } from './attestation.js';
-// ── Valid verb set (mirrors AuthorityDecision in types.ts) ────────────────────
-const VALID_DECISIONS = new Set([
-    'allow',
-    'deny',
-    'defer',
-    'step_up',
-    'delegate',
-    'revoke',
-]);
-// ── Capability pattern matching ───────────────────────────────────────────────
-/**
- * Match a capability `target` against a grant `pattern`. Pure string logic,
- * re-stated here so L0 stays dependency-free (the same rule lives in
- * `@synoi/gap-types` `capabilityMatches`; L0 must not depend on L3).
- *
- *   - exact match → true
- *   - '*' → match-all
- *   - 'skill.*' matches 'skill.create' and deeper (segment-boundary only).
- *     A non-boundary 'admin.us*' must NOT match 'admin.users.delete'
- *     (privilege-escalation footgun) — only a '.'-anchored '*' is a wildcard.
- */
-export function capabilityCovers(pattern, target) {
-    if (pattern === target)
-        return true;
-    if (pattern === '*')
-        return true;
-    if (pattern.endsWith('.*')) {
-        const prefix = pattern.slice(0, -1); // keep trailing '.', e.g. 'skill.'
-        return target.startsWith(prefix);
-    }
-    return false;
-}
-const DEFAULT_GRANT_PAYLOAD_TYPE = 'application/vnd.synoi.sraid+json';
-export function verifyAuthority(input) {
-    const reasons = [];
-    const auth = input.object?.authority;
-    // ── 1. STRUCTURE ──────────────────────────────────────────────────────────
-    let structure_ok = true;
-    if (auth === undefined || auth === null || typeof auth !== 'object') {
-        structure_ok = false;
-        reasons.push('authority block absent — object asserts no authority');
-    }
-    else {
-        if (auth.grant_oid !== undefined) {
-            if (typeof auth.grant_oid !== 'string' || !auth.grant_oid.startsWith('sha256:')) {
-                structure_ok = false;
-                reasons.push('authority.grant_oid must be a "sha256:" OID');
-            }
-        }
-        else {
-            // grant_oid is the only thing that ties an object to an authorizer.
-            // Its absence is allowed ONLY for an uncorrelated state-change event,
-            // which is the orphan case — not "authorized".
-            structure_ok = false;
-            reasons.push('authority.grant_oid absent — orphaned / uncorrelated authority');
-        }
-        if (auth.decision !== undefined &&
-            auth.decision !== null &&
-            !VALID_DECISIONS.has(auth.decision)) {
-            structure_ok = false;
-            reasons.push(`authority.decision "${String(auth.decision)}" is not a valid GAP verb`);
-        }
-        if (auth.intent_oid !== undefined &&
-            (typeof auth.intent_oid !== 'string' || !auth.intent_oid.startsWith('sha256:'))) {
-            structure_ok = false;
-            reasons.push('authority.intent_oid, if present, must be a "sha256:" OID');
-        }
-    }
-    // ── 2-4. BINDING / SIGNATURE / COVERAGE (need the grant) ─────────────────────
-    const grant = input.grant;
-    const grant_supplied = grant !== undefined && grant !== null;
-    let binding_ok = false;
-    let signature_ok = false;
-    let signature_checked = false;
-    let coverage_ok = false;
-    if (structure_ok && grant_supplied) {
-        // BINDING — recompute the grant's OID over its content core and require it
-        // to equal both the grant's own claimed OID and the object's reference.
-        // This defeats "swap the grant body under a fixed OID reference".
-        let recomputed = null;
-        try {
-            recomputed = cdroOid(grant);
-        }
-        catch {
-            recomputed = null;
-        }
-        const claimedOid = grant.oid;
-        const referenced = auth?.grant_oid;
-        if (recomputed === null) {
-            reasons.push('grant content core not hashable');
-        }
-        else if (recomputed !== claimedOid) {
-            reasons.push('grant OID does not match its content (tampered grant body)');
-        }
-        else if (recomputed !== referenced) {
-            reasons.push('object.authority.grant_oid does not reference the supplied grant');
-        }
-        else {
-            binding_ok = true;
-        }
-        // SIGNATURE — verify the grant's hybrid signature over its content core.
-        // BINDING and SIGNATURE must hash identical bytes: both route through
-        // cdroContentCore (strips oid, signature, attestation) so they are
-        // provably the same bytes.
-        if (input.grant_ed25519_pub !== undefined &&
-            input.grant_ml_dsa_pub !== undefined) {
-            signature_checked = true;
-            const att = grant.attestation;
-            const sig = grant.signature;
-            // Compute the canonical content core once — shared by both paths.
-            let canonical = null;
-            try {
-                canonical = canonicalize(cdroContentCore(grant));
-            }
-            catch {
-                canonical = null;
-            }
-            if (canonical === null) {
-                reasons.push('grant content core not canonicalizable for signature check');
-            }
-            else if (att) {
-                // DSSE attestation path — prefer when present.
-                // payload-swap guard: the signed payload MUST equal this grant's content core.
-                if (att.payload !== canonical) {
-                    signature_ok = false;
-                    reasons.push('grant attestation payload does not match its content core (payload swap)');
-                }
-                else {
-                    const expectedPayloadType = input.grant_payload_type ?? DEFAULT_GRANT_PAYLOAD_TYPE;
-                    const r = verifyAttestation({
-                        envelope: att,
-                        ed25519_pub: input.grant_ed25519_pub,
-                        ml_dsa_pub: input.grant_ml_dsa_pub,
-                        expectedPayloadType,
-                    });
-                    signature_ok = r.valid;
-                    if (!r.valid)
-                        reasons.push(`grant attestation invalid: ${r.reasons.join(',')}`);
-                }
-            }
-            else if (sig) {
-                // Legacy signature envelope path.
-                const r = verifySignature({
-                    canonical,
-                    envelope: sig,
-                    ed25519_pub: input.grant_ed25519_pub,
-                    ml_dsa_pub: input.grant_ml_dsa_pub,
-                });
-                signature_ok = r.valid;
-                if (!r.valid)
-                    reasons.push(`grant signature invalid: ${r.reasons.join(',')}`);
-            }
-            else {
-                reasons.push('grant carries no signature or attestation');
-            }
-        }
-        // COVERAGE — scope covers the action, and grant not expired at object time.
-        const action = input.action ?? input.object.type;
-        const scopes = grant.body?.capability_scopes;
-        let covered = false;
-        if (Array.isArray(scopes)) {
-            for (const s of scopes) {
-                if (s && typeof s.capability === 'string' && capabilityCovers(s.capability, action)) {
-                    covered = true;
-                    break;
-                }
-            }
-        }
-        if (!covered) {
-            reasons.push(`grant scope does not cover action "${action}"`);
-        }
-        const expires = grant.body?.expires_at_ms;
-        let notExpired = true;
-        if (typeof expires === 'number') {
-            if (input.object.created_at_ms > expires) {
-                notExpired = false;
-                reasons.push('grant had expired at the object creation time');
-            }
-        }
-        coverage_ok = covered && notExpired;
-    }
-    else if (structure_ok && !grant_supplied) {
-        reasons.push('grant not supplied — binding/signature/coverage not checked');
-    }
-    // Local verdict: every attempted local check passed. Signature counts only
-    // if it was checked; resolver checks are handled below.
-    const localAuthorized = structure_ok &&
-        grant_supplied &&
-        binding_ok &&
-        coverage_ok &&
-        (!signature_checked || signature_ok);
-    const base = {
-        authorized: localAuthorized,
-        structure_ok,
-        grant_supplied,
-        binding_ok,
-        signature_ok,
-        signature_checked,
-        coverage_ok,
-        existence_checked: false,
-        existence_ok: false,
-        revocation_checked: false,
-        not_revoked: false,
-        reasons,
-    };
-    // ── 5. RESOLVER (live revocation + existence) — resolver-dependent ──────────
-    if (input.resolver && auth?.grant_oid) {
-        const grantOid = auth.grant_oid;
-        return Promise.resolve(input.resolver.resolveGrantStatus(grantOid)).then((status) => {
-            const existence_ok = status.exists === true;
-            const not_revoked = existence_ok && status.revoked !== true;
-            if (!existence_ok)
-                base.reasons.push('resolver: grant does not exist');
-            if (existence_ok && status.revoked === true) {
-                base.reasons.push('resolver: grant has been revoked');
-            }
-            return {
-                ...base,
-                existence_checked: true,
-                existence_ok,
-                revocation_checked: true,
-                not_revoked,
-                authorized: localAuthorized && existence_ok && not_revoked,
-            };
-        });
-    }
-    return base;
-}
-// ── verifyDelegationChain (K2) — VERIFY-ONLY delegation-chain verifier ────────
-/**
- * Hard cap on delegation depth. Checked BEFORE any hashing or signature work,
- * so an over-long chain is a cheap rejection (DoS guard) and never triggers
- * crypto. A chain of `links.length > MAX_DELEGATION_DEPTH` fails closed.
- */
-export const MAX_DELEGATION_DEPTH = 8;
-function bytesEqual(a, b) {
-    if (a.length !== b.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < a.length; i++)
-        diff |= a[i] ^ b[i];
-    return diff === 0;
-}
-/** Extract string capabilities from a grant body's scope array. */
-function scopeCaps(grant) {
-    const scopes = grant?.body?.capability_scopes;
-    if (!Array.isArray(scopes))
-        return [];
-    const out = [];
-    for (const s of scopes) {
-        if (s && typeof s.capability === 'string')
-            out.push(s.capability);
-    }
-    return out;
-}
-/**
- * Verify a delegation chain OFFLINE (K2). VERIFY-ONLY: there is no enforcement
- * wiring and no resolver — the caller supplies the ordered ancestors and the
- * per-link verifier keys, and this function makes NO live claim. It ALWAYS
- * returns `revocation_checked: false` and `existence_checked: false`; those
- * remain RESOLVER-DEPENDENT (SRAID_FOUNDATION_PUNCHLIST C) and are explicitly
- * out of scope here. The function is synchronous (no Promise overload), which
- * is what makes "no live claim" structural rather than merely documented.
- *
- * The gate runs in this fixed order; DEPTH is checked BEFORE any crypto:
- *
- *   GATE 0  DEPTH CAP    — depth in [1, MAX_DELEGATION_DEPTH]; else return with
- *                          NO hashing or signature work (cheap DoS guard).
- *   GATE 1  OID HONESTY  — every link's recomputed content-core OID equals its
- *                          claimed `oid` (rejects a body swapped under a fixed
- *                          OID reference).
- *   GATE 2  PER-HOP      — for each child links[i] under parent links[i+1]:
- *                          (a) granted_by linkage, (b) scope attenuation (every
- *                          child scope covered by some parent scope; empty
- *                          child scopes = FAIL — a grant of nothing is not
- *                          vacuously attenuated), (c) expiry monotone narrowing
- *                          (null parent = unbounded; null child under a bounded
- *                          parent = widening = FAIL).
- *   GATE 3  SIGNATURES   — every link carries a hybrid DSSE attestation
- *                          (ed25519 AND ml-dsa-65) over PAE(payloadType,
- *                          payload), and the attestation payload equals
- *                          canonicalize(cdroContentCore(link)) (payload-swap
- *                          guard). A missing attestation sets signatures_checked
- *                          false for that link and fails.
- *   GATE 4  ROOT ANCHOR  — the terminal link's issuer key deep-equals
- *                          rootPubkeys.
- *
- * `authorized` is the AND of every gate.
- */
-export function verifyDelegationChain(input) {
-    const reasons = [];
-    const links = [input.leaf, ...input.ancestors];
-    const depth = links.length;
-    const expectedPayloadType = input.attestationPayloadType ?? DEFAULT_GRANT_PAYLOAD_TYPE;
-    const fail = (over) => ({
-        authorized: false,
-        depth,
-        depth_ok: false,
-        links_ok: false,
-        attenuation_ok: false,
-        expiry_ok: false,
-        signatures_ok: false,
-        signatures_checked: false,
-        oids_ok: false,
-        root_ok: false,
-        action_ok: false,
-        action_checked: false,
-        revocation_checked: false,
-        not_revoked: false,
-        existence_checked: false,
-        per_hop: [],
-        reasons,
-        ...over,
-    });
-    // ── GATE 0 — DEPTH CAP (before any hashing or signature work) ──────────────
-    const depth_ok = depth >= 1 && depth <= MAX_DELEGATION_DEPTH;
-    if (!depth_ok) {
-        if (depth < 1)
-            reasons.push('empty chain — no leaf grant supplied');
-        else
-            reasons.push(`chain depth ${depth} exceeds cap ${MAX_DELEGATION_DEPTH}`);
-        // RETURN with no crypto run: signatures_checked stays false.
-        return fail({ depth_ok: false });
-    }
-    if (input.linkPubkeys.length !== depth) {
-        reasons.push(`linkPubkeys length ${input.linkPubkeys.length} does not match chain depth ${depth}`);
-        return fail({ depth_ok });
-    }
-    // ── GATE 1 — OID HASH-HONESTY, every link ──────────────────────────────────
-    let oids_ok = true;
-    for (let i = 0; i < depth; i++) {
-        const link = links[i];
-        let recomputed = null;
-        try {
-            recomputed = cdroOid(link);
-        }
-        catch {
-            recomputed = null;
-        }
-        if (recomputed === null || recomputed !== link.oid) {
-            oids_ok = false;
-            reasons.push(`link ${i} OID does not match its content (tampered grant body)`);
-        }
-    }
-    // ── GATE 2 — PER-HOP STRUCTURE (child links[i] under parent links[i+1]) ─────
-    let links_ok = true;
-    let attenuation_ok = true;
-    let expiry_ok = true;
-    const per_hop = [];
-    for (let i = 0; i < depth - 1; i++) {
-        const child = links[i];
-        const parent = links[i + 1];
-        // (a) GRANTED_BY linkage
-        const childGrantedBy = child.body?.granted_by;
-        const parentGrantee = parent.body?.grantee?.actor_oid;
-        const granted_by_ok = typeof childGrantedBy === 'string' &&
-            typeof parentGrantee === 'string' &&
-            childGrantedBy === parentGrantee;
-        if (!granted_by_ok) {
-            links_ok = false;
-            reasons.push(`hop ${i}: child.granted_by does not equal parent.grantee.actor_oid (broken signer link)`);
-        }
-        // (b) ATTENUATION — every child scope covered by some parent scope.
-        const childCaps = scopeCaps(child);
-        const parentCaps = scopeCaps(parent);
-        let hopAtten = true;
-        if (childCaps.length === 0) {
-            // A grant that grants nothing is REJECTED (conservative default), not
-            // treated as vacuously attenuated. (Flagged for founder review.)
-            hopAtten = false;
-            reasons.push(`hop ${i}: child grant has no capability scopes (rejected)`);
-        }
-        else {
-            for (const c of childCaps) {
-                const covered = parentCaps.some((p) => capabilityCovers(p, c));
-                if (!covered) {
-                    hopAtten = false;
-                    reasons.push(`hop ${i}: child scope "${c}" widens parent (not attenuated)`);
-                }
-            }
-        }
-        if (!hopAtten)
-            attenuation_ok = false;
-        // (c) EXPIRY MONOTONE-NARROWING
-        const pe = parent.body?.expires_at_ms;
-        const ce = child.body?.expires_at_ms;
-        let hopExpiry = true;
-        if (pe === null || pe === undefined) {
-            // unbounded parent: any child OK
-            hopExpiry = true;
-        }
-        else if (typeof pe === 'number') {
-            if (ce === null || ce === undefined) {
-                hopExpiry = false;
-                reasons.push(`hop ${i}: child expiry is unbounded under a bounded parent (widening)`);
-            }
-            else if (typeof ce === 'number') {
-                if (ce > pe) {
-                    hopExpiry = false;
-                    reasons.push(`hop ${i}: child expiry ${ce} is later than parent ${pe} (widening)`);
-                }
-            }
-        }
-        if (!hopExpiry)
-            expiry_ok = false;
-        per_hop.push({
-            child_index: i,
-            granted_by_ok,
-            attenuation_ok: hopAtten,
-            expiry_ok: hopExpiry,
-        });
-    }
-    // ── GATE 3 — HYBRID DSSE SIGNATURE, every link ─────────────────────────────
-    let signatures_ok = true;
-    let signatures_checked = true;
-    for (let i = 0; i < depth; i++) {
-        const link = links[i];
-        const att = link.attestation;
-        if (!att) {
-            signatures_checked = false;
-            signatures_ok = false;
-            reasons.push(`link ${i} carries no DSSE attestation`);
-            continue;
-        }
-        // payload-swap guard: the signed payload MUST equal this link's content core.
-        let expectedPayload = null;
-        try {
-            expectedPayload = canonicalize(cdroContentCore(link));
-        }
-        catch {
-            expectedPayload = null;
-        }
-        if (expectedPayload === null || att.payload !== expectedPayload) {
-            signatures_ok = false;
-            reasons.push(`link ${i} attestation payload does not match its content core (payload swap)`);
-            continue;
-        }
-        const keys = input.linkPubkeys[i];
-        const r = verifyAttestation({
-            envelope: att,
-            ed25519_pub: keys.ed25519,
-            ml_dsa_pub: keys.ml_dsa,
-            expectedPayloadType,
-        });
-        if (!r.valid) {
-            signatures_ok = false;
-            reasons.push(`link ${i} hybrid signature invalid: ${r.reasons.join(',')}`);
-        }
-    }
-    // ── GATE 4 — ROOT ANCHOR ───────────────────────────────────────────────────
-    const terminalKeys = input.linkPubkeys[depth - 1];
-    const root_ok = bytesEqual(terminalKeys.ed25519, input.rootPubkeys.ed25519) &&
-        bytesEqual(terminalKeys.ml_dsa, input.rootPubkeys.ml_dsa);
-    if (!root_ok) {
-        reasons.push('terminal link signer key does not equal rootPubkeys (forged/unknown root)');
-    }
-    // ── GATE 5 — ACTION COVERAGE (optional) ────────────────────────────────────
-    // When the caller supplies `action`, the leaf's capability scopes MUST cover
-    // it. Leaf = links[0]. Attenuation (GATE 2) already proved every ancestor
-    // covers the leaf, so leaf coverage + attenuation transitively proves the
-    // whole chain covers the action. Checking every hop would be redundant.
-    let action_ok = true;
-    let action_checked = false;
-    if (input.action !== undefined) {
-        action_checked = true;
-        const leafCaps = scopeCaps(input.leaf);
-        const covered = leafCaps.some((s) => capabilityCovers(s, input.action));
-        if (!covered) {
-            action_ok = false;
-            reasons.push(`requested action "${input.action}" not covered by leaf grant`);
-        }
-    }
-    const authorized = depth_ok &&
-        oids_ok &&
-        links_ok &&
-        attenuation_ok &&
-        expiry_ok &&
-        signatures_ok &&
-        signatures_checked &&
-        root_ok &&
-        action_ok;
-    return {
-        authorized,
-        depth,
-        depth_ok,
-        links_ok,
-        attenuation_ok,
-        expiry_ok,
-        signatures_ok,
-        signatures_checked,
-        oids_ok,
-        root_ok,
-        action_ok,
-        action_checked,
-        revocation_checked: false,
-        not_revoked: false,
-        existence_checked: false,
-        per_hop,
-        reasons,
-    };
-}
-import { canonicalize } from './canonicalize.js';
-//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAQpD,iFAAiF;AAEjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAoB;IACtE,OAAO;IACP,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,QAAQ;CACT,CAAC,CAAA;AAEF,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC9D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,mCAAmC;QACvE,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAmID,MAAM,0BAA0B,GAAG,kCAAkC,CAAA;AAarE,MAAM,UAAU,eAAe,CAC7B,KAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,IAAI,GAA+B,KAAK,CAAC,MAAM,EAAE,SAAS,CAAA;IAEhE,6EAA6E;IAC7E,IAAI,YAAY,GAAG,IAAI,CAAA;IACvB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,YAAY,GAAG,KAAK,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAA;IACtE,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChF,YAAY,GAAG,KAAK,CAAA;gBACpB,OAAO,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,sEAAsE;YACtE,+CAA+C;YAC/C,YAAY,GAAG,KAAK,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAA;QAChF,CAAC;QACD,IACE,IAAI,CAAC,QAAQ,KAAK,SAAS;YAC3B,IAAI,CAAC,QAAQ,KAAK,IAAI;YACtB,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EACnC,CAAC;YACD,YAAY,GAAG,KAAK,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;QACvF,CAAC;QACD,IACE,IAAI,CAAC,UAAU,KAAK,SAAS;YAC7B,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAC/E,CAAC;YACD,YAAY,GAAG,KAAK,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,MAAM,cAAc,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAA;IAC5D,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;QACnC,2EAA2E;QAC3E,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,UAAU,GAAkB,IAAI,CAAA;QACpC,IAAI,CAAC;YACH,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,MAAM,UAAU,GAAI,KAAc,CAAC,GAAG,CAAA;QACtC,MAAM,UAAU,GAAG,IAAI,EAAE,SAAS,CAAA;QAClC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,2BAA2B;QAC3B,IACE,KAAK,CAAC,iBAAiB,KAAK,SAAS;YACrC,KAAK,CAAC,gBAAgB,KAAK,SAAS,EACpC,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAA;YACxB,MAAM,GAAG,GAAI,KAAc,CAAC,WAAW,CAAA;YACvC,MAAM,GAAG,GAAmC,KAAc,CAAC,SAAS,CAAA;YAEpE,kEAAkE;YAClE,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,CAAC;gBACH,SAAS,GAAG,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,IAAI,CAAA;YAClB,CAAC;YAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAA;YAC5E,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,+CAA+C;gBAC/C,+EAA+E;gBAC/E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC9B,YAAY,GAAG,KAAK,CAAA;oBACpB,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,CAAC;qBAAM,CAAC;oBACN,MAAM,mBAAmB,GAAG,KAAK,CAAC,kBAAkB,IAAI,0BAA0B,CAAA;oBAClF,MAAM,CAAC,GAAG,iBAAiB,CAAC;wBAC1B,QAAQ,EAAE,GAAG;wBACb,WAAW,EAAE,KAAK,CAAC,iBAAiB;wBACpC,UAAU,EAAE,KAAK,CAAC,gBAAgB;wBAClC,mBAAmB;qBACpB,CAAC,CAAA;oBACF,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;oBACtB,IAAI,CAAC,CAAC,CAAC,KAAK;wBAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACjF,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,kCAAkC;gBAClC,MAAM,CAAC,GAAG,eAAe,CAAC;oBACxB,SAAS;oBACT,QAAQ,EAAE,GAAG;oBACb,WAAW,EAAE,KAAK,CAAC,iBAAiB;oBACpC,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC,CAAA;gBACF,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;gBACtB,IAAI,CAAC,CAAC,CAAC,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;YAC3D,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAA;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAA;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;oBACpF,OAAO,GAAG,IAAI,CAAA;oBACd,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAA;QACzC,IAAI,UAAU,GAAG,IAAI,CAAA;QACrB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,OAAO,EAAE,CAAC;gBACzC,UAAU,GAAG,KAAK,CAAA;gBAClB,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,WAAW,GAAG,OAAO,IAAI,UAAU,CAAA;IACrC,CAAC;SAAM,IAAI,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;IAC7E,CAAC;IAED,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,eAAe,GACnB,YAAY;QACZ,cAAc;QACd,UAAU;QACV,WAAW;QACX,CAAC,CAAC,iBAAiB,IAAI,YAAY,CAAC,CAAA;IAEtC,MAAM,IAAI,GAA0B;QAClC,UAAU,EAAE,eAAe;QAC3B,YAAY;QACZ,cAAc;QACd,UAAU;QACV,YAAY;QACZ,iBAAiB;QACjB,WAAW;QACX,iBAAiB,EAAE,KAAK;QACxB,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,KAAK;QAClB,OAAO;KACR,CAAA;IAED,+EAA+E;IAC/E,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACtE,CAAC,MAAM,EAAyB,EAAE;YAChC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAA;YAC3C,MAAM,WAAW,GAAG,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;YAC3D,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;YACtE,IAAI,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;YACvD,CAAC;YACD,OAAO;gBACL,GAAG,IAAI;gBACP,iBAAiB,EAAE,IAAI;gBACvB,YAAY;gBACZ,kBAAkB,EAAE,IAAI;gBACxB,WAAW;gBACX,UAAU,EAAE,eAAe,IAAI,YAAY,IAAI,WAAW;aAC3D,CAAA;QACH,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AA8GrC,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAK,CAAC,CAAC,CAAC,CAAY,GAAI,CAAC,CAAC,CAAC,CAAY,CAAA;IAC9E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,mEAAmE;AACnE,SAAS,SAAS,CAAC,KAAuC;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAiC;IAEjC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;IAC1B,MAAM,mBAAmB,GAAG,KAAK,CAAC,sBAAsB,IAAI,0BAA0B,CAAA;IAEtF,MAAM,IAAI,GAAG,CACX,IAA0C,EACb,EAAE,CAAC,CAAC;QACjC,UAAU,EAAE,KAAK;QACjB,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,KAAK;QACrB,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,KAAK;QACzB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,KAAK;QACrB,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;QACxB,OAAO,EAAE,EAAE;QACX,OAAO;QACP,GAAG,IAAI;KACR,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,oBAAoB,CAAA;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;;YAC9D,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,gBAAgB,oBAAoB,EAAE,CAAC,CAAA;QAC7E,6DAA6D;QAC7D,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,sBAAsB,KAAK,CAAC,WAAW,CAAC,MAAM,+BAA+B,KAAK,EAAE,CACrF,CAAA;QACD,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3B,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAyB,CAAA;QAC7C,IAAI,UAAU,GAAkB,IAAI,CAAA;QACpC,IAAI,CAAC;YACH,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACnD,OAAO,GAAG,KAAK,CAAA;YACf,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,IAAI,cAAc,GAAG,IAAI,CAAA;IACzB,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAyB,CAAA;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAyB,CAAA;QAEnD,yBAAyB;QACzB,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAA;QAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAA;QACrD,MAAM,aAAa,GACjB,OAAO,cAAc,KAAK,QAAQ;YAClC,OAAO,aAAa,KAAK,QAAQ;YACjC,cAAc,KAAK,aAAa,CAAA;QAClC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,QAAQ,GAAG,KAAK,CAAA;YAChB,OAAO,CAAC,IAAI,CACV,OAAO,CAAC,iFAAiF,CAC1F,CAAA;QACH,CAAC;QAED,oEAAoE;QACpE,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,QAAQ,GAAG,IAAI,CAAA;QACnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,sEAAsE;YACtE,iEAAiE;YACjE,QAAQ,GAAG,KAAK,CAAA;YAChB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAA;QAC3E,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,QAAQ,GAAG,KAAK,CAAA;oBAChB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,cAAc,GAAG,KAAK,CAAA;QAErC,gCAAgC;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAA;QACrC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAA;QACpC,IAAI,SAAS,GAAG,IAAI,CAAA;QACpB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACpC,iCAAiC;YACjC,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC;aAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACpC,SAAS,GAAG,KAAK,CAAA;gBACjB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAA;YACvF,CAAC;iBAAM,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;oBACZ,SAAS,GAAG,KAAK,CAAA;oBACjB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,yBAAyB,EAAE,aAAa,CAAC,CAAA;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS,GAAG,KAAK,CAAA;QAEjC,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,CAAC;YACd,aAAa;YACb,cAAc,EAAE,QAAQ;YACxB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAA;IACJ,CAAC;IAED,8EAA8E;IAC9E,IAAI,aAAa,GAAG,IAAI,CAAA;IACxB,IAAI,kBAAkB,GAAG,IAAI,CAAA;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAyB,CAAA;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAA;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,kBAAkB,GAAG,KAAK,CAAA;YAC1B,aAAa,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAA;YACrD,SAAQ;QACV,CAAC;QACD,8EAA8E;QAC9E,IAAI,eAAe,GAAkB,IAAI,CAAA;QACzC,IAAI,CAAC;YACH,eAAe,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,eAAe,GAAG,IAAI,CAAA;QACxB,CAAC;QACD,IAAI,eAAe,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YAChE,aAAa,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,qEAAqE,CAAC,CAAA;YAC5F,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAgB,CAAA;QAChD,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,QAAQ,EAAE,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,OAAO;YACzB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,mBAAmB;SACpB,CAAC,CAAA;QACF,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,aAAa,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,CAAgB,CAAA;IAChE,MAAM,OAAO,GACX,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC;QAC3D,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAA;IAC3F,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,cAAc,GAAG,IAAI,CAAA;QACrB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,MAAgB,CAAC,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,CAAA;YACjB,OAAO,CAAC,IAAI,CACV,qBAAqB,KAAK,CAAC,MAAM,6BAA6B,CAC/D,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACd,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,cAAc;QACd,SAAS;QACT,aAAa;QACb,kBAAkB;QAClB,OAAO;QACP,SAAS,CAAA;IAEX,OAAO;QACL,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,SAAS;QACT,aAAa;QACb,kBAAkB;QAClB,OAAO;QACP,OAAO;QACP,SAAS;QACT,cAAc;QACd,kBAAkB,EAAE,KAAK;QACzB,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;QACxB,OAAO;QACP,OAAO;KACR,CAAA;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA"}