@taliesinb/mash 0.0.0-stage → 0.1.0

package/dist/src/policy/policy.js

@@ -0,0 +1,532 @@
+/**
+ * Sandbox policy and effect checking.
+ *
+ * The file vocabulary mirrors the DeepSea harness (`SandboxExecutionPolicy`
+ * in dsh-sandbox): `read-only`, `workspace-write` (workspace root, extra
+ * roots, temp areas) and `danger-full-access`. mash adds optional network,
+ * command and read restrictions that the OS sandbox cannot express.
+ *
+ * Checking works on abstract paths: a verdict is `deny` only when EVERY
+ * possible concretisation violates the policy, `allow` only when every one is
+ * permitted, and `unknown` otherwise. Unknown substrings that may contain
+ * `/` or `..` therefore never produce a definite verdict — the runtime check
+ * on the concrete value decides.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { describe, isHole, isNameLike, isSlashFree } from "../analysis/value.js";
+import { describeEffect } from "./effects.js";
+/**
+ * Where credentials live: private keys, cloud and CLI tokens, keychains and
+ * password stores. Files and directories, relative to `home` unless absolute.
+ */
+export const CREDENTIAL_LOCATIONS = [
+    '.ssh', '.gnupg', '.aws', '.azure', '.config/gcloud', '.config/gh', '.config/hub', '.config/op', '.config/doctl',
+    '.kube', '.docker/config.json', '.netrc', '.git-credentials', '.npmrc', '.yarnrc.yml', '.pypirc', '.gem/credentials',
+    '.cargo/credentials', '.cargo/credentials.toml', '.terraform.d/credentials.tfrc.json', '.vault-token', '.password-store',
+    '.local/share/keyrings', 'Library/Keychains', '/Library/Keychains', '/etc/shadow', '/etc/gshadow', '/private/etc/master.passwd',
+];
+/**
+ * Non-secret files inside credential locations that stay readable (agents
+ * debug ssh setups): public keys, `config`, `known_hosts`, `authorized_keys`.
+ * Listing a credential directory (`ls ~/.ssh`) is allowed too.
+ */
+export const CREDENTIAL_READ_EXCEPTIONS = ['.ssh/*.pub', '.ssh/config', '.ssh/known_hosts', '.ssh/known_hosts.old', '.ssh/authorized_keys'];
+/** Is every concretisation of `alt` one of the non-secret files (`dir/*.pub` or an exact name)? */
+function isCredentialException(alt, home) {
+    for (const ex of CREDENTIAL_READ_EXCEPTIONS) {
+        const full = path.join(home, ex);
+        const star = full.indexOf('*');
+        if (star === -1) {
+            if (alt.length === 1 && typeof alt[0] === 'string' && path.normalize(alt[0]) === full)
+                return true;
+            continue;
+        }
+        // `dir/*suffix`: a literal `dir/`, then name-like holes and literals without `/`, ending in `suffix`
+        const dir = full.slice(0, star);
+        const suffix = full.slice(star + 1);
+        const first = alt[0];
+        if (typeof first !== 'string' || !first.startsWith(dir))
+            continue;
+        const rest = [first.slice(dir.length), ...alt.slice(1)];
+        if (rest.some((s) => (typeof s === 'string' ? s.includes('/') : !isNameLike(s.type))))
+            continue;
+        const last = rest[rest.length - 1];
+        const holes = rest.some((s) => typeof s !== 'string');
+        // a literal ending (with something before it), or a glob match whose pattern has the ending
+        if (typeof last === 'string' ? last.endsWith(suffix) && (holes || last.length > suffix.length) : last.pattern?.endsWith(suffix) === true)
+            return true;
+    }
+    return false;
+}
+/** {@link CREDENTIAL_LOCATIONS} resolved against a home directory. */
+export function credentialReadRoots(home = os.homedir()) {
+    return CREDENTIAL_LOCATIONS.map((p) => (p.startsWith('/') ? p : path.join(home, p)));
+}
+/** Every read-denied root of a policy (explicit ones, plus credential stores when enabled), with realpaths. */
+export function readDeniedRoots(policy) {
+    const roots = [...(policy.readDeniedRoots ?? [])];
+    if (policy.readDenyCredentials)
+        roots.push(...credentialReadRoots(policy.home ?? os.homedir()));
+    return withRealpaths(roots);
+}
+/** Paths every mode may write: sinks and terminals. */
+const ALWAYS_WRITABLE = ['/dev/null', '/dev/stdout', '/dev/stderr', '/dev/tty', '/dev/fd', '/dev/zero'];
+function tempRoots() {
+    const roots = new Set(['/tmp', '/private/tmp', '/var/tmp', '/private/var/tmp']);
+    const t = os.tmpdir();
+    roots.add(t);
+    try {
+        roots.add(fs.realpathSync(t));
+    }
+    catch {
+        // ignore
+    }
+    if (process.env.TMPDIR)
+        roots.add(process.env.TMPDIR.replace(/\/+$/, ''));
+    return [...roots];
+}
+function withRealpaths(roots) {
+    const out = new Set();
+    for (const r of roots) {
+        const n = path.resolve(r);
+        out.add(n);
+        try {
+            out.add(fs.realpathSync(n));
+        }
+        catch {
+            // ignore
+        }
+    }
+    return [...out];
+}
+export function writableRoots(policy) {
+    if (policy.mode !== 'workspace-write')
+        return [];
+    const roots = [policy.workspaceRoot, ...(policy.additionalWritableRoots ?? [])];
+    if (policy.writableTemp !== false)
+        roots.push(...tempRoots());
+    return withRealpaths(roots);
+}
+const MAX_SHAPE_BRANCHES = 64;
+/**
+ * Shapes of one alternative of an absolute (or cwd-relative already joined)
+ * path. Usually one shape; a component that may be `..` (a `segment` hole on
+ * its own) branches into the possible resolutions.
+ */
+export function altShapes(alt) {
+    const hint = alt.map((s) => (typeof s === 'string' ? s : `⟨${s.origin}⟩`)).join('');
+    const unknown = [{ kind: 'unknown', hint }];
+    if (alt.length === 0)
+        return unknown;
+    let start = [];
+    let i = 0;
+    const first = alt[0];
+    if (isHole(first)) {
+        if (first.type === 'path' && first.under) {
+            start = path.resolve(first.under).split('/').filter(Boolean);
+            start.push({ pattern: true, deep: true });
+            i = 1;
+        }
+        else {
+            return unknown;
+        }
+    }
+    else if (!first.startsWith('/')) {
+        return unknown;
+    }
+    // split into raw components
+    const raws = [];
+    let text = '';
+    let holes = false;
+    let nameLike = false;
+    const flush = () => {
+        if (!holes)
+            raws.push({ kind: 'lit', text });
+        else if (nameLike || /[^.]/.test(text))
+            raws.push({ kind: 'name' });
+        else
+            raws.push({ kind: 'ambiguous' });
+        text = '';
+        holes = false;
+        nameLike = false;
+    };
+    for (; i < alt.length; i++) {
+        const s = alt[i];
+        if (typeof s === 'string') {
+            for (const ch of s) {
+                if (ch === '/')
+                    flush();
+                else
+                    text += ch;
+            }
+        }
+        else if (isSlashFree(s.type)) {
+            holes = true;
+            if (isNameLike(s.type))
+                nameLike = true;
+        }
+        else {
+            return unknown;
+        }
+    }
+    flush();
+    // resolve `.`/`..`, branching on ambiguous components
+    const out = [];
+    let branches = 0;
+    const walk = (k, comps) => {
+        if (k === raws.length) {
+            if (++branches > MAX_SHAPE_BRANCHES)
+                return false;
+            out.push(finish(comps));
+            return true;
+        }
+        const r = raws[k];
+        const pop = () => {
+            const top = comps[comps.length - 1];
+            if (top !== undefined && typeof top !== 'string' && top.deep)
+                return null; // may escape the anchor
+            return comps.slice(0, -1);
+        };
+        if (r.kind === 'lit') {
+            if (r.text === '' || r.text === '.')
+                return walk(k + 1, comps);
+            if (r.text === '..') {
+                const next = pop();
+                return next !== null && walk(k + 1, next);
+            }
+            return walk(k + 1, [...comps, r.text]);
+        }
+        if (r.kind === 'name')
+            return walk(k + 1, [...comps, { pattern: true }]);
+        // ambiguous: a name, `.`/empty, or `..`
+        const next = pop();
+        return next !== null && walk(k + 1, [...comps, { pattern: true }]) && walk(k + 1, comps) && walk(k + 1, next);
+    };
+    if (!walk(0, start))
+        return unknown;
+    return out;
+}
+/** All-literal components are an exact path; otherwise the literal prefix up to the first pattern is a `below` directory. */
+function finish(comps) {
+    const prefix = [];
+    for (const c of comps) {
+        if (typeof c !== 'string')
+            break;
+        prefix.push(c);
+    }
+    const dir = '/' + prefix.join('/');
+    return prefix.length === comps.length ? { kind: 'exact', path: dir } : { kind: 'below', dir };
+}
+/** The first shape of one alternative (see {@link altShapes}). */
+export function altShape(alt) {
+    return altShapes(alt)[0];
+}
+export function shapesOf(v) {
+    return v.alts.flatMap(altShapes);
+}
+function isInside(p, root) {
+    return p === root || p.startsWith(root.endsWith('/') ? root : root + '/');
+}
+/** Is a shape inside `root`? */
+function shapeInside(shape, root) {
+    switch (shape.kind) {
+        case 'exact':
+            return isInside(shape.path, root) ? 'yes' : 'no';
+        case 'below':
+            if (isInside(shape.dir, root))
+                return 'yes';
+            if (isInside(root, shape.dir))
+                return 'maybe';
+            return 'no';
+        case 'unknown':
+            return 'maybe';
+    }
+}
+function insideAny(shape, roots) {
+    let maybe = false;
+    for (const r of roots) {
+        const v = shapeInside(shape, r);
+        if (v === 'yes')
+            return 'yes';
+        if (v === 'maybe')
+            maybe = true;
+    }
+    return maybe ? 'maybe' : 'no';
+}
+function lexists(p) {
+    try {
+        fs.lstatSync(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isFile(p) {
+    try {
+        return fs.statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve symlinks of the deepest existing ancestor of a concrete path. */
+export function realpathLoose(p) {
+    let cur = p;
+    const tail = [];
+    for (;;) {
+        try {
+            const real = fs.realpathSync(cur);
+            return tail.length === 0 ? real : path.join(real, ...tail.reverse());
+        }
+        catch {
+            const parent = path.dirname(cur);
+            if (parent === cur)
+                return p;
+            tail.push(path.basename(cur));
+            cur = parent;
+        }
+    }
+}
+function checkWritePath(p, policy, opts) {
+    if (policy.mode === 'danger-full-access')
+        return { verdict: 'allow', reason: 'danger-full-access' };
+    const shapes = shapesOf(p);
+    const roots = [...writableRoots(policy), ...ALWAYS_WRITABLE];
+    let allYes = true;
+    let allNo = true;
+    for (const s of shapes) {
+        let v = insideAny(s, roots);
+        if (opts.runtime && s.kind === 'exact' && v === 'yes' && !ALWAYS_WRITABLE.some((r) => isInside(s.path, r))) {
+            // a symlink inside the workspace may point outside it
+            const real = realpathLoose(s.path);
+            if (real !== s.path)
+                v = insideAny({ kind: 'exact', path: real }, roots);
+        }
+        if (v !== 'yes')
+            allYes = false;
+        if (v !== 'no')
+            allNo = false;
+    }
+    const where = policy.mode === 'read-only' ? 'the policy is read-only' : `outside the writable roots (${[policy.workspaceRoot, ...(policy.additionalWritableRoots ?? [])].join(', ')}${policy.writableTemp !== false ? ', temp' : ''})`;
+    if (allYes)
+        return { verdict: 'allow', reason: 'inside a writable root' };
+    if (allNo)
+        return { verdict: 'deny', reason: `${describe(p)} is ${where}` };
+    return { verdict: 'unknown', reason: `${describe(p)} may be ${where}` };
+}
+/**
+ * Reads are denied inside read-denied roots. A recursive read (`grep -r`,
+ * `tar c`, `cp -r`) of a directory that contains a denied root reads into it,
+ * so it is denied too (`grep -r token ~`); when the directory is only possibly
+ * such a parent (an unknown path), it is `unknown`.
+ */
+function checkReadPath(p, policy, recursive, opts, names = false) {
+    const denied = readDeniedRoots(policy);
+    if (denied.length === 0)
+        return { verdict: 'allow', reason: 'reads are unrestricted' };
+    // listing names and metadata (find, ls -R, du) reveals no file contents
+    if (names)
+        return { verdict: 'allow', reason: 'lists names only' };
+    let anyMaybe = false;
+    let allYes = true;
+    const home = policy.home ?? os.homedir();
+    const shapes = p.alts.flatMap((alt) => (policy.readDenyCredentials && isCredentialException(alt, home) ? [] : altShapes(alt)));
+    if (shapes.length === 0)
+        return { verdict: 'allow', reason: 'a non-secret file in a credential location' };
+    for (const s of shapes) {
+        let v = insideAny(s, denied);
+        // listing a denied directory itself (`ls ~/.ssh`) reads names, not contents
+        if (v === 'yes' && !recursive && s.kind === 'exact' && denied.includes(s.path) && !isFile(s.path))
+            v = 'no';
+        // at runtime, a symlink may lead into a denied root
+        if (opts.runtime && s.kind === 'exact' && v === 'no') {
+            const real = realpathLoose(s.path);
+            if (real !== s.path) {
+                v = insideAny({ kind: 'exact', path: real }, denied);
+                if (v === 'no' && recursive && denied.some((r) => isInside(r, real)))
+                    v = 'yes';
+            }
+        }
+        if (v === 'no' && recursive && s.kind === 'exact' && denied.some((r) => isInside(r, s.path)))
+            v = 'yes';
+        if (v !== 'yes')
+            allYes = false;
+        if (v !== 'no')
+            anyMaybe = true;
+    }
+    const what = 'a read-denied location';
+    if (allYes)
+        return { verdict: 'deny', reason: recursive ? `${describe(p)} is or contains ${what}` : `${describe(p)} is in ${what}` };
+    if (anyMaybe)
+        return { verdict: 'unknown', reason: `${describe(p)} may be in or contain ${what}` };
+    return { verdict: 'allow', reason: 'not in a read-denied location' };
+}
+// ---------------------------------------------------------------------------
+// Network hosts
+// ---------------------------------------------------------------------------
+/**
+ * The host a network target names, when it is determined by the literal text
+ * of the value: `https://user@Host:8080/x` → `host`, `git@github.com:o/r` →
+ * `github.com`, `user@example.com` → `example.com`.
+ * Undefined when the host depends on an unknown part (`https://$H/x`), when
+ * there is none (`file:///x`), and for a bare word (`example.com`,
+ * `example.com/x`, `localhost:3000`): behaviors cannot always tell a host operand from an
+ * option's value (`ssh -i key host`, `git clone --depth 1 url`), so a bare
+ * word is never trusted for a definite verdict. Neither is anything that is
+ * not a host name or IP address (`BatchMode=yes`, `+short`, `8080`).
+ */
+export function targetHost(alt) {
+    const complete = alt.every((s) => typeof s === 'string');
+    const lit = typeof alt[0] === 'string' ? alt[0] : '';
+    const text = complete ? alt.join('') : lit;
+    // the literal part must reach past the end of the host (or be the whole value)
+    const upTo = (s, stops) => {
+        const m = stops.exec(s);
+        if (m)
+            return s.slice(0, m.index);
+        return complete ? s : undefined;
+    };
+    const scheme = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//.exec(text);
+    let authority;
+    if (scheme) {
+        if (scheme[1].toLowerCase() === 'file')
+            return undefined;
+        authority = upTo(text.slice(scheme[0].length), /[/?#]/);
+    }
+    else {
+        // scp-like `user@host:path` (a `:` before any `/`), or `user@host`; without
+        // the `user@` it may be an option value (`ssh -L localhost:80:x:80 h`)
+        const scp = /^([^/:]*):(?!\/\/)/.exec(text);
+        authority = scp && !/^\[/.test(text) ? scp[1] : upTo(text, /[/?#]/);
+        if (authority !== undefined && !authority.includes('@'))
+            return undefined;
+    }
+    if (authority === undefined)
+        return undefined;
+    let host = authority.slice(authority.lastIndexOf('@') + 1);
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        if (end === -1)
+            return undefined;
+        host = host.slice(1, end);
+    }
+    else
+        host = host.replace(/:\d*$/, '');
+    host = host.toLowerCase().replace(/\.$/, '');
+    const ipv6 = host.includes(':');
+    if (ipv6 ? !/^[0-9a-f:.]+$/.test(host) : !/^[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?(\.[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?)*$/.test(host) || /^\d+$/.test(host))
+        return undefined;
+    return host;
+}
+/** Does an allow-list entry match a host? */
+export function hostMatches(host, entry) {
+    const e = entry.toLowerCase().replace(/\.$/, '');
+    if (e === '*')
+        return true;
+    if (e.startsWith('*.'))
+        return host.endsWith(e.slice(1)) && host.length > e.length - 1;
+    return host === e;
+}
+function checkHosts(target, allow) {
+    const list = allow.join(', ');
+    if (!target)
+        return { verdict: 'unknown', reason: `network access to hosts not known statically (allowed: ${list})` };
+    let allYes = true;
+    let allNo = true;
+    const bad = [];
+    for (const alt of target.alts) {
+        const host = targetHost(alt);
+        if (host === undefined) {
+            allYes = false;
+            allNo = false;
+            continue;
+        }
+        if (allow.some((e) => hostMatches(host, e)))
+            allNo = false;
+        else {
+            allYes = false;
+            bad.push(host);
+        }
+    }
+    if (allYes)
+        return { verdict: 'allow', reason: 'host allowed' };
+    if (allNo)
+        return { verdict: 'deny', reason: `network access to ${[...new Set(bad)].join(', ')} is not allowed (allowed: ${list})` };
+    return { verdict: 'unknown', reason: `network access to ${describe(target)} may not be allowed (allowed: ${list})` };
+}
+export function checkEffect(effect, policy, opts = {}) {
+    const f = (verdict, reason) => ({ effect, verdict, reason });
+    switch (effect.kind) {
+        case 'read': {
+            const r = checkReadPath(effect.path, policy, effect.recursive === true, opts, effect.names === true);
+            return f(effect.maybe && r.verdict === 'deny' ? 'unknown' : r.verdict, r.reason);
+        }
+        case 'write':
+        case 'delete': {
+            // `rm -f` of a path that does not exist does nothing
+            if (opts.runtime && effect.kind === 'delete' && effect.ifExists && policy.missingDeletes === 'allow' && effect.path.alts.every((a) => a.length === 1 && typeof a[0] === 'string' && !lexists(a[0]))) {
+                return f('allow', 'delete: nothing to delete (missing path, -f)');
+            }
+            const r = checkWritePath(effect.path, policy, opts);
+            const verb = effect.kind === 'delete' ? 'delete' : 'write';
+            if (effect.maybe && r.verdict === 'deny')
+                return f('unknown', `may ${verb}: ${r.reason}`);
+            return f(r.verdict, `${verb}: ${r.reason}`);
+        }
+        case 'network': {
+            if (policy.network === 'deny')
+                return f(effect.maybe ? 'unknown' : 'deny', `network access is denied (${describeEffect(effect)})`);
+            if (policy.network === undefined || policy.network === 'allow')
+                return f('allow', 'network allowed');
+            const r = checkHosts(effect.target, policy.network.allow);
+            return f(effect.maybe && r.verdict === 'deny' ? 'unknown' : r.verdict, r.reason);
+        }
+        case 'exec':
+        case 'chdir':
+        case 'process':
+            return f('allow', '');
+        case 'unknown':
+            if (policy.unknownCommands === 'deny' && policy.mode !== 'danger-full-access')
+                return f(effect.maybe ? 'unknown' : 'deny', `effects unknown: ${effect.detail}`);
+            return f('unknown', effect.detail);
+    }
+}
+export function checkCommandName(name, policy) {
+    const base = name.split('/').pop() ?? name;
+    if (policy.deniedCommands?.includes(base)) {
+        return { effect: { kind: 'exec', argv: [{ alts: [[name]] }] }, verdict: 'deny', reason: `command '${base}' is denied by policy` };
+    }
+    return null;
+}
+export function checkEffects(effects, policy, opts = {}) {
+    return effects.map((e) => checkEffect(e, policy, opts));
+}
+/** Denied command names among nested `exec` effects (a possible exec is only `unknown`). */
+export function checkExecEffects(effects, policy) {
+    const out = [];
+    for (const e of effects) {
+        if (e.kind !== 'exec')
+            continue;
+        const first = e.argv[0];
+        const n = first && first.alts.length === 1 && first.alts[0].length === 1 && typeof first.alts[0][0] === 'string' ? first.alts[0][0] : undefined;
+        const f = n ? checkCommandName(n, policy) : null;
+        if (f)
+            out.push(e.maybe ? { effect: e, verdict: 'unknown', reason: `may run: ${f.reason}` } : { ...f, effect: e });
+    }
+    return out;
+}
+/** The most severe verdict. */
+export function worstVerdict(findings) {
+    if (findings.some((f) => f.verdict === 'deny'))
+        return 'deny';
+    if (findings.some((f) => f.verdict === 'unknown'))
+        return 'unknown';
+    return 'allow';
+}
+export function defaultPolicy(workspaceRoot) {
+    return { mode: 'workspace-write', workspaceRoot, writableTemp: true, network: 'allow', unknownCommands: 'allow' };
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/policy/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/policy/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAwC7C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe;IAChH,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB;IACpH,oBAAoB,EAAE,yBAAyB,EAAE,oCAAoC,EAAE,cAAc,EAAE,iBAAiB;IACxH,uBAAuB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,4BAA4B;CAChI,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB,CAAC,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,sBAAsB,CAAC,CAAA;AAE9J,mGAAmG;AACnG,SAAS,qBAAqB,CAAC,GAAU,EAAE,IAAY;IACrD,KAAK,MAAM,EAAE,IAAI,0BAA0B,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAClG,SAAQ;QACV,CAAC;QACD,qGAAqG;QACrG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjE,MAAM,IAAI,GAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9D,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAQ;QAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;QACrD,4FAA4F;QAC5F,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;IACvJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,CAAC,OAAO,EAAE;IAC7D,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAA;IACjD,IAAI,MAAM,CAAC,mBAAmB;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC/F,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAUD,uDAAuD;AACvD,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;AAEvG,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACvF,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAA;IACrB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACZ,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IACzE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACV,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,EAAE,CAAA;IAChD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/E,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,CAAA;IAC7D,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAiCD,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAU;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnF,MAAM,OAAO,GAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IACpC,IAAI,KAAK,GAAW,EAAE,CAAA;IACtB,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACpB,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACzC,CAAC,GAAG,CAAC,CAAA;QACP,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,4BAA4B;IAC5B,MAAM,IAAI,GAAc,EAAE,CAAA;IAC1B,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;aACvC,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;;YAC9D,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;QACrC,IAAI,GAAG,EAAE,CAAA;QACT,KAAK,GAAG,KAAK,CAAA;QACb,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC,CAAA;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAChB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBACnB,IAAI,EAAE,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAA;;oBAClB,IAAI,IAAI,EAAE,CAAA;YACjB,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,GAAG,IAAI,CAAA;YACZ,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAA;QACzC,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAA;IACP,sDAAsD;IACtD,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,KAAa,EAAW,EAAE;QACjD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,EAAE,QAAQ,GAAG,kBAAkB;gBAAE,OAAO,KAAK,CAAA;YACjD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,GAAkB,EAAE;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACnC,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA,CAAC,wBAAwB;YAClG,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC,CAAA;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;YAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAA;gBAClB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QACxC,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;QACxE,wCAAwC;QACxC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAA;QAClB,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/G,CAAC,CAAA;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,OAAO,CAAA;IACnC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,6HAA6H;AAC7H,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAK;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AAC/F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,GAAU;IACjC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,IAAY;IACvC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;AAC3E,CAAC;AAED,gCAAgC;AAChC,SAAS,WAAW,CAAC,KAAgB,EAAE,IAAY;IACjD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;QAClD,KAAK,OAAO;YACV,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAA;YAC3C,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAA;YAC7C,OAAO,IAAI,CAAA;QACb,KAAK,SAAS;YACZ,OAAO,OAAO,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAgB,EAAE,KAAe;IAClD,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QAC/B,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAC7B,IAAI,CAAC,KAAK,OAAO;YAAE,KAAK,GAAG,IAAI,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;YACjC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,CAAA;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YAC7B,GAAG,GAAG,MAAM,CAAA;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAWD,SAAS,cAAc,CAAC,CAAS,EAAE,MAAc,EAAE,IAAkB;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,GAAG,eAAe,CAAC,CAAA;IAC5D,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3B,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3G,sDAAsD;YACtD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,CAAC,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,CAAC,KAAK,KAAK;YAAE,MAAM,GAAG,KAAK,CAAA;QAC/B,IAAI,CAAC,KAAK,IAAI;YAAE,KAAK,GAAG,KAAK,CAAA;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;IACtO,IAAI,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IACzE,IAAI,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,EAAE,CAAA;IAC3E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,CAAS,EAAE,MAAc,EAAE,SAAkB,EAAE,IAAkB,EAAE,KAAK,GAAG,KAAK;IACrG,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IACtF,wEAAwE;IACxE,IAAI,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IAClE,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9H,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAA;IAC1G,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAC5B,4EAA4E;QAC5E,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,CAAC,GAAG,IAAI,CAAA;QAC3G,oDAAoD;QACpD,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpB,CAAC,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;gBACpD,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAAE,CAAC,GAAG,KAAK,CAAA;YACjF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,CAAC,GAAG,KAAK,CAAA;QACvG,IAAI,CAAC,KAAK,KAAK;YAAE,MAAM,GAAG,KAAK,CAAA;QAC/B,IAAI,CAAC,KAAK,IAAI;YAAE,QAAQ,GAAG,IAAI,CAAA;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAA;IACrC,IAAI,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAA;IACpI,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,yBAAyB,IAAI,EAAE,EAAE,CAAA;IAClG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;AACtE,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAU;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;IACxD,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC1C,+EAA+E;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,KAAa,EAAsB,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;QACjC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjC,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,SAA6B,CAAA;IACjC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,SAAS,CAAA;QACxD,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;IACzD,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACnE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;IAC3E,CAAC;IACD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC7C,IAAI,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAChC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;;QAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACvC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACtK,OAAO,IAAI,CAAA;AACb,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAChD,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC1B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACtF,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAwB;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,0DAA0D,IAAI,GAAG,EAAE,CAAA;IACrH,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,GAAG,KAAK,CAAA;YACd,KAAK,GAAG,KAAK,CAAA;YACb,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,KAAK,GAAG,KAAK,CAAA;aACrD,CAAC;YACJ,MAAM,GAAG,KAAK,CAAA;YACd,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IAC/D,IAAI,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,IAAI,GAAG,EAAE,CAAA;IACpI,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,QAAQ,CAAC,MAAM,CAAC,iCAAiC,IAAI,GAAG,EAAE,CAAA;AACtH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,OAAqB,EAAE;IACjF,MAAM,CAAC,GAAG,CAAC,OAAgB,EAAE,MAAc,EAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;YACpG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,qDAAqD;YACrD,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpM,OAAO,CAAC,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAA;YACnE,CAAC;YACD,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAC1D,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM;gBAAE,OAAO,CAAC,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;YACzF,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,6BAA6B,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAClI,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,CAAC,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;YACpG,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACzD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACvB,KAAK,SAAS;YACZ,IAAI,MAAM,CAAC,eAAe,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/J,OAAO,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAA;IAC1C,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,IAAI,uBAAuB,EAAE,CAAA;IACnI,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAiB,EAAE,MAAc,EAAE,OAAqB,EAAE;IACrF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,OAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAoB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAQ;QAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/I,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAChD,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACpH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,YAAY,CAAC,QAAyB;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACnE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAAqB;IACjD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAA;AACnH,CAAC"}