@tetrascience-npm/ts-connectors-sdk 4.0.0-beta.185.1 → 4.0.0-beta.187.1

package/README.md

@@ -104,6 +104,37 @@ const s3 = client.createAwsClient(S3Client);
 const s3WithOverrides = client.createAwsClient(S3Client, { region: 'us-west-2' });
 ```
 
+All clients created this way use a **generic request handler with a 120-second
+timeout**, which is suitable for most AWS services.
+
+**For S3 specifically**, the SDK already manages an internal `S3Client` tuned
+with socket idle timeouts instead of a fixed request timeout — a better fit for
+large or slow file transfers. If you need S3 access with that tuning, prefer
+either of these over `createAwsClient(S3Client)`:
+
+- **`uploadFile()`** — the primary way to upload files to the TDP datalake.
+  Handles credentials, metadata, checksums, and multipart uploads automatically.
+- **`assertAwsInitialized().s3Client`** — returns the SDK-managed `S3Client`
+  directly, for cases where you need to make S3 calls beyond what `uploadFile()`
+  covers:
+
+  ```ts
+  const { s3Client } = await client.assertAwsInitialized();
+  ```
+
+If you have a specific reason to create your own `S3Client` via `createAwsClient`
+and still want the S3-tuned handler, you can pass it as an override:
+
+```ts
+const s3 = client.createAwsClient(S3Client, {
+  requestHandler: client.createProxyAWSNodeHttpHandlers().s3Handler,
+});
+```
+
+Note that this creates new handler instances rather than sharing the SDK's
+internal ones, so the simpler `assertAwsInitialized().s3Client` is preferred
+when possible.
+
 #### tdpDeploymentCertificates
 
 A read-only getter that returns the TDP deployment certificates loaded during

package/dist/api-tests/fixture/test-https-server.d.ts

@@ -0,0 +1,37 @@
+export interface SelfSignedCert {
+    cert: string;
+    key: string;
+}
+/**
+ * A minimal HTTPS server that uses a freshly generated self-signed certificate.
+ *
+ * Purpose: provide a real TLS endpoint for testing that TDPClient.createAxiosInstance()
+ * correctly wires TDP deployment certificates into the httpsAgent CA bundle.
+ *
+ * The server always responds 200 OK — tests only care about whether the TLS handshake
+ * succeeds or fails, not the response body.
+ *
+ * Usage:
+ *   const server = new TestHttpsServer();
+ *   const port = await server.start();
+ *   // ... test against https://127.0.0.1:{port} ...
+ *   await server.stop();
+ */
+export declare class TestHttpsServer {
+    private server;
+    private port;
+    /** PEM-encoded certificate used by this server (also the CA cert for trusting it). */
+    readonly cert: string;
+    private readonly key;
+    constructor();
+    /**
+     * Start the server on a random available port on 127.0.0.1.
+     * @returns the port number the server is listening on
+     */
+    start(): Promise<number>;
+    /** Stop the server and wait for all connections to close. */
+    stop(): Promise<void>;
+    /** Base URL of the running server (e.g. https://127.0.0.1:54321) */
+    get url(): string;
+}
+//# sourceMappingURL=test-https-server.d.ts.map

package/dist/api-tests/fixture/test-https-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-https-server.d.ts","sourceRoot":"","sources":["../../../api-tests/fixture/test-https-server.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAkDD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,IAAI,CAAa;IAEzB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;;IAa7B;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAW9B,6DAA6D;IACvD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,oEAAoE;IACpE,IAAI,GAAG,IAAI,MAAM,CAEhB;CACF"}

package/dist/api-tests/fixture/test-https-server.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TestHttpsServer = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const https = __importStar(require("https"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * Generates a self-signed certificate for 127.0.0.1 / localhost using openssl.
+ *
+ * A temporary openssl config file is written so that the certificate includes a
+ * Subject Alternative Name (SAN) for both IP 127.0.0.1 and DNS localhost.
+ * Modern Node.js TLS validation checks the SAN — without it the handshake fails
+ * with an IP-mismatch error even when the CA is trusted.
+ */
+function generateSelfSignedCert() {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tdp-tls-test-'));
+    try {
+        const opensslCnf = [
+            '[req]',
+            'distinguished_name = req_distinguished_name',
+            'x509_extensions = v3_req',
+            'prompt = no',
+            '',
+            '[req_distinguished_name]',
+            'CN = localhost',
+            '',
+            '[v3_req]',
+            'subjectAltName = @alt_names',
+            '',
+            '[alt_names]',
+            'IP.1 = 127.0.0.1',
+            'DNS.1 = localhost',
+        ].join('\n');
+        const configFile = path.join(tmpDir, 'openssl.cnf');
+        const certFile = path.join(tmpDir, 'cert.pem');
+        const keyFile = path.join(tmpDir, 'key.pem');
+        fs.writeFileSync(configFile, opensslCnf);
+        (0, child_process_1.execSync)(`openssl req -x509 -newkey rsa:2048 -keyout "${keyFile}" -out "${certFile}" -days 1 -nodes -config "${configFile}"`, { stdio: 'pipe' });
+        return {
+            cert: fs.readFileSync(certFile, 'utf-8'),
+            key: fs.readFileSync(keyFile, 'utf-8'),
+        };
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
+/**
+ * A minimal HTTPS server that uses a freshly generated self-signed certificate.
+ *
+ * Purpose: provide a real TLS endpoint for testing that TDPClient.createAxiosInstance()
+ * correctly wires TDP deployment certificates into the httpsAgent CA bundle.
+ *
+ * The server always responds 200 OK — tests only care about whether the TLS handshake
+ * succeeds or fails, not the response body.
+ *
+ * Usage:
+ *   const server = new TestHttpsServer();
+ *   const port = await server.start();
+ *   // ... test against https://127.0.0.1:{port} ...
+ *   await server.stop();
+ */
+class TestHttpsServer {
+    constructor() {
+        this.port = 0;
+        const { cert, key } = generateSelfSignedCert();
+        this.cert = cert;
+        this.key = key;
+        this.server = https.createServer({ key: this.key, cert: this.cert }, (_req, res) => {
+            res.writeHead(200, { 'Content-Type': 'text/plain' });
+            res.end('ok');
+        });
+    }
+    /**
+     * Start the server on a random available port on 127.0.0.1.
+     * @returns the port number the server is listening on
+     */
+    start() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return new Promise((resolve, reject) => {
+                this.server.listen(0, '127.0.0.1', () => {
+                    const address = this.server.address();
+                    this.port = address.port;
+                    resolve(this.port);
+                });
+                this.server.once('error', reject);
+            });
+        });
+    }
+    /** Stop the server and wait for all connections to close. */
+    stop() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return new Promise((resolve, reject) => {
+                this.server.close((err) => {
+                    if (err)
+                        reject(err);
+                    else
+                        resolve();
+                });
+            });
+        });
+    }
+    /** Base URL of the running server (e.g. https://127.0.0.1:54321) */
+    get url() {
+        return `https://127.0.0.1:${this.port}`;
+    }
+}
+exports.TestHttpsServer = TestHttpsServer;
+//# sourceMappingURL=test-https-server.js.map

package/dist/api-tests/fixture/test-https-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-https-server.js","sourceRoot":"","sources":["../../../api-tests/fixture/test-https-server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iDAAyC;AACzC,uCAAyB;AACzB,6CAA+B;AAE/B,uCAAyB;AACzB,2CAA6B;AAO7B;;;;;;;GAOG;AACH,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG;YACjB,OAAO;YACP,6CAA6C;YAC7C,0BAA0B;YAC1B,aAAa;YACb,EAAE;YACF,0BAA0B;YAC1B,gBAAgB;YAChB,EAAE;YACF,UAAU;YACV,6BAA6B;YAC7B,EAAE;YACF,aAAa;YACb,kBAAkB;YAClB,mBAAmB;SACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEb,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE7C,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEzC,IAAA,wBAAQ,EACN,+CAA+C,OAAO,WAAW,QAAQ,6BAA6B,UAAU,GAAG,EACnH,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;YACxC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;SACvC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAa,eAAe;IAS1B;QAPQ,SAAI,GAAW,CAAC,CAAC;QAQvB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,sBAAsB,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QAEf,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACG,KAAK;;YACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;oBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAqB,CAAC;oBACzD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC;KAAA;IAED,6DAA6D;IACvD,IAAI;;YACR,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACxB,IAAI,GAAG;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;wBAChB,OAAO,EAAE,CAAC;gBACjB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KAAA;IAED,oEAAoE;IACpE,IAAI,GAAG;QACL,OAAO,qBAAqB,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAjDD,0CAiDC"}

package/dist/api-tests/tls-cert.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tls-cert.test.d.ts.map

package/dist/api-tests/tls-cert.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-cert.test.d.ts","sourceRoot":"","sources":["../../api-tests/tls-cert.test.ts"],"names":[],"mappings":""}

package/dist/api-tests/tls-cert.test.js

@@ -0,0 +1,129 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const fixture_1 = require("./fixture/fixture");
+const test_https_server_1 = require("./fixture/test-https-server");
+const test_proxy_server_1 = require("./fixture/test-proxy-server");
+/**
+ * TDP Deployment Certificate — createAxiosInstance CA-bundle Tests
+ *
+ * PR #125 (WA-1335) changed how TDP deployment certificates flow through TDPClient:
+ *   Before: certs were local variables inside init(), threaded explicitly into one axios
+ *           instance, then discarded — external callers got nothing.
+ *   After:  certs are stored on the instance (_tdpDeploymentCertificates) and
+ *           automatically injected into the CA bundle of every axios instance created
+ *           by any consumer via createAxiosInstance().
+ *
+ * Unit tests (test/tdp-client.test.ts) verify the wiring with mocks.
+ * These api-tests verify the actual TLS handshake with a real HTTPS server —
+ * something mocks cannot exercise.
+ *
+ * Test design:
+ *   - A real HTTPS server (TestHttpsServer) uses a freshly generated self-signed cert.
+ *   - The cert is injected directly into _tdpDeploymentCertificates, simulating what
+ *     init() does after loadCertificatesFromLocalVolume reads the localCertificateFile.
+ *   - We use standaloneConnector for a fully initialised TDPClient (jwt, proxy, etc.)
+ *     so that assertInitialized() / assertProxyInitialized() pass without a real cert
+ *     file on disk.
+ */
+(0, vitest_1.describe)('TDP Deployment Certificate CA-bundle Tests', () => {
+    (0, fixture_1.connectorTest)('DAM-T193: createAxiosInstance trusts self-signed cert when stored in _tdpDeploymentCertificates', { timeout: 2 * 60 * 1000 }, (_a) => __awaiter(void 0, [_a], void 0, function* ({ standaloneConnector, expect }) {
+        const httpsServer = new test_https_server_1.TestHttpsServer();
+        yield httpsServer.start();
+        try {
+            yield standaloneConnector.start();
+            const tdpClient = standaloneConnector.tdpClient;
+            // Simulate what init() does when it reads the cert from localCertificateFile.
+            // The unit tests already cover the file → instance path; here we exercise the
+            // instance → CA bundle → real TLS handshake path.
+            tdpClient._tdpDeploymentCertificates = [httpsServer.cert];
+            // Consumer creates an axios instance — deployment certs included automatically
+            // because includeAdditionalCertificates defaults to true.
+            const axiosInstance = tdpClient.createAxiosInstance({
+                baseUrl: httpsServer.url,
+            });
+            const response = yield axiosInstance.get('/');
+            expect(response.status).toBe(200);
+        }
+        finally {
+            yield standaloneConnector.shutdown();
+            yield httpsServer.stop();
+        }
+    }));
+    (0, fixture_1.connectorTest)('DAM-T194: createAxiosInstance rejects self-signed cert when includeAdditionalCertificates is false', { timeout: 2 * 60 * 1000 }, (_a) => __awaiter(void 0, [_a], void 0, function* ({ standaloneConnector, expect }) {
+        const httpsServer = new test_https_server_1.TestHttpsServer();
+        yield httpsServer.start();
+        try {
+            yield standaloneConnector.start();
+            const tdpClient = standaloneConnector.tdpClient;
+            // Same cert injected — but the consumer explicitly opts out of deployment certs.
+            tdpClient._tdpDeploymentCertificates = [httpsServer.cert];
+            // With deployment certs excluded, the self-signed cert is not in the CA bundle
+            // and Node.js TLS rejects the handshake.
+            const axiosInstance = tdpClient.createAxiosInstance({
+                baseUrl: httpsServer.url,
+                includeAdditionalCertificates: false,
+            });
+            yield expect(axiosInstance.get('/')).rejects.toThrow(/self.signed certificate|certificate verify failed/i);
+        }
+        finally {
+            yield standaloneConnector.shutdown();
+            yield httpsServer.stop();
+        }
+    }));
+    (0, fixture_1.connectorTest)('DAM-T195: createAxiosInstance trusts self-signed cert via PatchedHttpsProxyAgent when stored in _tdpDeploymentCertificates', { timeout: 2 * 60 * 1000 }, (_a) => __awaiter(void 0, [_a], void 0, function* ({ standaloneConnector, expect }) {
+        const httpsServer = new test_https_server_1.TestHttpsServer();
+        const proxyServer = new test_proxy_server_1.TestProxyServer();
+        yield Promise.all([httpsServer.start(), proxyServer.start()]);
+        // Start the connector before setting proxy env vars so that TDP init calls
+        // (auth, org certs, etc.) are not routed through the test proxy.
+        // isProxyInitialized is set during init(), so createAxiosInstance will work.
+        yield standaloneConnector.start();
+        const tdpClient = standaloneConnector.tdpClient;
+        // Save and override proxy env vars.
+        // Clear no_proxy so proxy-from-env doesn't exclude 127.0.0.1.
+        const savedHttpsProxy = process.env.HTTPS_PROXY;
+        const savedNoProxy = process.env.no_proxy;
+        process.env.HTTPS_PROXY = proxyServer.getProxyUrl();
+        delete process.env.no_proxy;
+        try {
+            tdpClient._tdpDeploymentCertificates = [httpsServer.cert];
+            const axiosInstance = tdpClient.createAxiosInstance({
+                baseUrl: httpsServer.url,
+            });
+            const response = yield axiosInstance.get('/');
+            expect(response.status).toBe(200);
+        }
+        finally {
+            if (savedHttpsProxy === undefined) {
+                delete process.env.HTTPS_PROXY;
+            }
+            else {
+                process.env.HTTPS_PROXY = savedHttpsProxy;
+            }
+            if (savedNoProxy === undefined) {
+                delete process.env.no_proxy;
+            }
+            else {
+                process.env.no_proxy = savedNoProxy;
+            }
+            yield standaloneConnector.shutdown();
+            yield Promise.all([httpsServer.stop(), proxyServer.stop()]);
+        }
+    }));
+    // The hpagent HttpsProxyAgent path (HTTPS_AGENT=hpagent) is intentionally not tested here.
+    // It is a legacy escape hatch kept from before PatchedHttpsProxyAgent was introduced (CON-2178),
+    // requiring explicit opt-in via an env var. Its CA wiring (proxyRequestOptions: { ca }) is
+    // internal to the hpagent library — not our code. PatchedHttpsProxyAgent is the default and
+    // the only path that warrants a real TLS handshake test.
+});
+//# sourceMappingURL=tls-cert.test.js.map

package/dist/api-tests/tls-cert.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-cert.test.js","sourceRoot":"","sources":["../../api-tests/tls-cert.test.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,mCAAkC;AAElC,+CAAkD;AAClD,mEAA8D;AAC9D,mEAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,IAAA,iBAAQ,EAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,IAAA,uBAAa,EACX,iGAAiG,EACjG,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAC1B,KAAwC,EAAE,4CAAnC,EAAE,mBAAmB,EAAE,MAAM,EAAE;QACpC,MAAM,WAAW,GAAG,IAAI,mCAAe,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,SAAS,GAAI,mBAA2B,CAAC,SAAS,CAAC;YAEzD,8EAA8E;YAC9E,8EAA8E;YAC9E,kDAAkD;YACjD,SAAiB,CAAC,0BAA0B,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAEnE,+EAA+E;YAC/E,0DAA0D;YAC1D,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC;gBAClD,OAAO,EAAE,WAAW,CAAC,GAAG;aACzB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,MAAM,mBAAmB,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAA,CACF,CAAC;IAEF,IAAA,uBAAa,EACX,oGAAoG,EACpG,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAC1B,KAAwC,EAAE,4CAAnC,EAAE,mBAAmB,EAAE,MAAM,EAAE;QACpC,MAAM,WAAW,GAAG,IAAI,mCAAe,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,SAAS,GAAI,mBAA2B,CAAC,SAAS,CAAC;YAEzD,iFAAiF;YAChF,SAAiB,CAAC,0BAA0B,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAEnE,+EAA+E;YAC/E,yCAAyC;YACzC,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC;gBAClD,OAAO,EAAE,WAAW,CAAC,GAAG;gBACxB,6BAA6B,EAAE,KAAK;aACrC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC;QAC7G,CAAC;gBAAS,CAAC;YACT,MAAM,mBAAmB,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAA,CACF,CAAC;IAEF,IAAA,uBAAa,EACX,4HAA4H,EAC5H,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAC1B,KAAwC,EAAE,4CAAnC,EAAE,mBAAmB,EAAE,MAAM,EAAE;QACpC,MAAM,WAAW,GAAG,IAAI,mCAAe,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,mCAAe,EAAE,CAAC;QAE1C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE9D,2EAA2E;QAC3E,iEAAiE;QACjE,6EAA6E;QAC7E,MAAM,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,SAAS,GAAI,mBAA2B,CAAC,SAAS,CAAC;QAEzD,oCAAoC;QACpC,8DAA8D;QAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAE5B,IAAI,CAAC;YACF,SAAiB,CAAC,0BAA0B,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAEnE,MAAM,aAAa,GAAG,SAAS,CAAC,mBAAmB,CAAC;gBAClD,OAAO,EAAE,WAAW,CAAC,GAAG;aACzB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,eAAe,CAAC;YAC5C,CAAC;YACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;YACtC,CAAC;YACD,MAAM,mBAAmB,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAA,CACF,CAAC;IAEF,2FAA2F;IAC3F,iGAAiG;IACjG,2FAA2F;IAC3F,4FAA4F;IAC5F,yDAAyD;AAC3D,CAAC,CAAC,CAAC"}