@vorionsys/platform-core 0.1.0

package/dist/security/request-integrity.js

@@ -0,0 +1,663 @@
+/**
+ * Request Integrity Verification Module
+ *
+ * Implements HMAC-SHA256 request signing with replay attack prevention.
+ * Features include:
+ * - HMAC-SHA256 signature generation and verification
+ * - Nonce tracking using Redis or in-memory storage
+ * - Timestamp validation to reject stale requests
+ * - Fastify middleware integration
+ * - Configurable path exclusions
+ *
+ * @packageDocumentation
+ * @module security/request-integrity
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createLogger } from '../common/logger.js';
+import { getRedis } from '../common/redis.js';
+const logger = createLogger({ component: 'request-integrity' });
+// =============================================================================
+// Constants
+// =============================================================================
+/** Redis key prefix for nonce storage */
+const NONCE_PREFIX = 'vorion:request_integrity:nonce:';
+/** Default maximum age for requests in milliseconds (5 minutes) */
+const DEFAULT_MAX_AGE_MS = 300000;
+/** Default nonce TTL in milliseconds (10 minutes) */
+const DEFAULT_NONCE_TTL_MS = 600000;
+/** Header name for the signature */
+const SIGNATURE_HEADER = 'x-vorion-signature';
+/** Header name for the timestamp */
+const TIMESTAMP_HEADER = 'x-vorion-timestamp';
+/** Header name for the nonce */
+const NONCE_HEADER = 'x-vorion-nonce';
+/** Header name for the algorithm */
+const ALGORITHM_HEADER = 'x-vorion-algorithm';
+// =============================================================================
+// Default Configuration
+// =============================================================================
+/**
+ * Default configuration for request integrity
+ */
+export const DEFAULT_REQUEST_INTEGRITY_CONFIG = {
+    enabled: true,
+    secretKey: '',
+    maxAgeMs: DEFAULT_MAX_AGE_MS,
+    nonceStore: 'redis',
+    nonceTTLMs: DEFAULT_NONCE_TTL_MS,
+    excludePaths: [
+        '/api/health',
+        '/api/readiness',
+        '/api/metrics',
+        '/api/webhooks/*',
+    ],
+    clockSkewMs: 60000,
+};
+// =============================================================================
+// In-Memory Nonce Store
+// =============================================================================
+/**
+ * Simple in-memory nonce store for development/testing
+ */
+class MemoryNonceStore {
+    nonces = new Map();
+    cleanupInterval = null;
+    constructor(cleanupIntervalMs = 60000) {
+        // Start periodic cleanup
+        this.cleanupInterval = setInterval(() => {
+            this.cleanup();
+        }, cleanupIntervalMs);
+        // Prevent the interval from keeping the process alive
+        if (this.cleanupInterval.unref) {
+            this.cleanupInterval.unref();
+        }
+    }
+    /**
+     * Check if a nonce exists (has been used)
+     */
+    has(nonce) {
+        const expiry = this.nonces.get(nonce);
+        if (expiry === undefined) {
+            return false;
+        }
+        if (Date.now() > expiry) {
+            this.nonces.delete(nonce);
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Record a nonce with its expiry time
+     */
+    set(nonce, ttlMs) {
+        this.nonces.set(nonce, Date.now() + ttlMs);
+    }
+    /**
+     * Remove expired nonces
+     */
+    cleanup() {
+        const now = Date.now();
+        const entries = Array.from(this.nonces.entries());
+        for (const [nonce, expiry] of entries) {
+            if (now > expiry) {
+                this.nonces.delete(nonce);
+            }
+        }
+    }
+    /**
+     * Clear all nonces and stop cleanup
+     */
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+        this.nonces.clear();
+    }
+    /**
+     * Get the number of stored nonces (for testing/debugging)
+     */
+    size() {
+        return this.nonces.size;
+    }
+}
+// =============================================================================
+// RequestIntegrity Class
+// =============================================================================
+/**
+ * Request Integrity Service
+ *
+ * Provides HMAC-SHA256 request signing and verification with replay attack
+ * prevention using nonce tracking.
+ *
+ * @example
+ * ```typescript
+ * const integrity = new RequestIntegrity({
+ *   secretKey: process.env.REQUEST_SIGNING_KEY,
+ *   maxAgeMs: 300000,
+ *   nonceStore: 'redis',
+ * });
+ *
+ * // Sign a request
+ * const signed = integrity.signRequest({
+ *   method: 'POST',
+ *   path: '/api/sensitive-action',
+ *   body: { action: 'transfer', amount: 1000 },
+ * });
+ *
+ * // Verify a request in middleware
+ * fastify.addHook('preHandler', integrity.middleware());
+ * ```
+ */
+export class RequestIntegrity {
+    config;
+    redis;
+    memoryStore;
+    /**
+     * Creates a new RequestIntegrity instance
+     *
+     * @param config - Configuration options
+     * @param redis - Optional Redis instance (uses shared instance if not provided)
+     * @throws {Error} If secret key is not provided or too short
+     */
+    constructor(config = {}, redis) {
+        this.config = { ...DEFAULT_REQUEST_INTEGRITY_CONFIG, ...config };
+        // Validate secret key
+        if (!this.config.secretKey || this.config.secretKey.length < 32) {
+            throw new Error('Request integrity secret key must be provided and at least 32 characters long');
+        }
+        // Initialize nonce store
+        if (this.config.nonceStore === 'redis') {
+            this.redis = redis ?? getRedis();
+            this.memoryStore = null;
+        }
+        else {
+            this.redis = null;
+            this.memoryStore = new MemoryNonceStore();
+        }
+        logger.info({
+            enabled: this.config.enabled,
+            maxAgeMs: this.config.maxAgeMs,
+            nonceStore: this.config.nonceStore,
+            nonceTTLMs: this.config.nonceTTLMs,
+            excludePaths: this.config.excludePaths.length,
+        }, 'RequestIntegrity initialized');
+    }
+    /**
+     * Signs a request and returns the signature metadata
+     *
+     * The signature is computed as:
+     * HMAC-SHA256(method + path + body + timestamp + nonce, secretKey)
+     *
+     * @param input - Request data to sign
+     * @returns Signed request metadata
+     */
+    signRequest(input) {
+        const timestamp = input.timestamp ?? Date.now();
+        const nonce = this.generateNonce();
+        const bodyString = this.normalizeBody(input.body);
+        // Create signature data
+        const signatureData = this.createSignatureData(input.method.toUpperCase(), input.path, bodyString, timestamp, nonce);
+        // Generate signature
+        const signature = this.createSignature(signatureData);
+        logger.debug({
+            method: input.method,
+            path: input.path,
+            timestamp,
+            noncePrefix: nonce.substring(0, 8),
+        }, 'Request signed');
+        return {
+            timestamp,
+            nonce,
+            signature,
+            algorithm: 'HMAC-SHA256',
+        };
+    }
+    /**
+     * Verifies request integrity and checks for replay attacks
+     *
+     * Performs the following checks:
+     * 1. Required headers are present
+     * 2. Timestamp is within acceptable range
+     * 3. Signature is valid
+     * 4. Nonce has not been used before
+     *
+     * @param request - Fastify request object
+     * @param signature - Signature metadata from headers
+     * @returns Verification result
+     */
+    async verifyRequest(request, signature) {
+        // Check if enabled
+        if (!this.config.enabled) {
+            return { valid: false, error: 'Request integrity disabled', errorCode: 'DISABLED' };
+        }
+        // Validate timestamp
+        const timestampResult = this.validateTimestamp(signature.timestamp);
+        if (!timestampResult.valid) {
+            logger.warn({
+                timestamp: signature.timestamp,
+                error: timestampResult.error,
+                ip: request.ip,
+                path: request.url,
+            }, 'Request integrity failed: timestamp validation');
+            return timestampResult;
+        }
+        // Check for replay attack
+        const isReplay = await this.isReplay(signature.nonce);
+        if (isReplay) {
+            logger.warn({
+                noncePrefix: signature.nonce.substring(0, 8),
+                ip: request.ip,
+                path: request.url,
+            }, 'Request integrity failed: replay detected');
+            return {
+                valid: false,
+                error: 'Replay attack detected: nonce already used',
+                errorCode: 'REPLAY_DETECTED',
+            };
+        }
+        // Verify signature
+        const method = request.method.toUpperCase();
+        const path = request.url;
+        const bodyString = this.normalizeBody(request.body);
+        const expectedData = this.createSignatureData(method, path, bodyString, signature.timestamp, signature.nonce);
+        const expectedSignature = this.createSignature(expectedData);
+        const signatureValid = this.constantTimeCompare(signature.signature, expectedSignature);
+        if (!signatureValid) {
+            logger.warn({
+                method,
+                path,
+                ip: request.ip,
+            }, 'Request integrity failed: invalid signature');
+            return {
+                valid: false,
+                error: 'Invalid request signature',
+                errorCode: 'INVALID_SIGNATURE',
+            };
+        }
+        // Record nonce to prevent replay
+        await this.recordNonce(signature.nonce);
+        logger.debug({
+            method,
+            path,
+            timestamp: signature.timestamp,
+        }, 'Request integrity verified');
+        return { valid: true };
+    }
+    /**
+     * Creates Fastify middleware for request integrity verification
+     *
+     * @returns Fastify preHandler hook function
+     */
+    middleware() {
+        return async (request, reply) => {
+            // Skip if disabled
+            if (!this.config.enabled) {
+                return;
+            }
+            // Check excluded paths
+            if (this.isPathExcluded(request.url)) {
+                logger.debug({ path: request.url }, 'Request integrity skipped: excluded path');
+                return;
+            }
+            // Extract signature headers
+            const signatureHeader = request.headers[SIGNATURE_HEADER];
+            const timestampHeader = request.headers[TIMESTAMP_HEADER];
+            const nonceHeader = request.headers[NONCE_HEADER];
+            const algorithmHeader = request.headers[ALGORITHM_HEADER];
+            // Validate required headers
+            if (!signatureHeader || typeof signatureHeader !== 'string') {
+                logger.warn({ path: request.url, ip: request.ip }, 'Missing signature header');
+                reply.code(401).send({
+                    error: 'Unauthorized',
+                    message: 'Missing request signature',
+                    code: 'MISSING_SIGNATURE',
+                });
+                return;
+            }
+            if (!timestampHeader || typeof timestampHeader !== 'string') {
+                logger.warn({ path: request.url, ip: request.ip }, 'Missing timestamp header');
+                reply.code(401).send({
+                    error: 'Unauthorized',
+                    message: 'Missing request timestamp',
+                    code: 'MISSING_TIMESTAMP',
+                });
+                return;
+            }
+            if (!nonceHeader || typeof nonceHeader !== 'string') {
+                logger.warn({ path: request.url, ip: request.ip }, 'Missing nonce header');
+                reply.code(401).send({
+                    error: 'Unauthorized',
+                    message: 'Missing request nonce',
+                    code: 'MISSING_NONCE',
+                });
+                return;
+            }
+            // Parse timestamp
+            const timestamp = parseInt(timestampHeader, 10);
+            if (isNaN(timestamp)) {
+                logger.warn({ path: request.url, ip: request.ip, timestampHeader }, 'Invalid timestamp');
+                reply.code(401).send({
+                    error: 'Unauthorized',
+                    message: 'Invalid request timestamp',
+                    code: 'INVALID_TIMESTAMP',
+                });
+                return;
+            }
+            // Build signature object
+            const signedRequest = {
+                timestamp,
+                nonce: nonceHeader,
+                signature: signatureHeader,
+                algorithm: algorithmHeader || 'HMAC-SHA256',
+            };
+            // Verify request
+            const result = await this.verifyRequest(request, signedRequest);
+            if (!result.valid) {
+                const statusCode = result.errorCode === 'REPLAY_DETECTED' ? 409 : 401;
+                reply.code(statusCode).send({
+                    error: statusCode === 409 ? 'Conflict' : 'Unauthorized',
+                    message: result.error,
+                    code: result.errorCode,
+                });
+                return;
+            }
+            // Mark request as verified
+            request.integrityVerified = true;
+        };
+    }
+    /**
+     * Checks if a nonce has already been used
+     *
+     * @param nonce - The nonce to check
+     * @returns True if the nonce has been used (replay attack)
+     */
+    async isReplay(nonce) {
+        if (this.redis) {
+            const key = `${NONCE_PREFIX}${nonce}`;
+            const exists = await this.redis.exists(key);
+            return exists === 1;
+        }
+        if (this.memoryStore) {
+            return this.memoryStore.has(nonce);
+        }
+        return false;
+    }
+    /**
+     * Records a nonce to prevent replay attacks
+     *
+     * @param nonce - The nonce to record
+     */
+    async recordNonce(nonce) {
+        const ttlSeconds = Math.ceil(this.config.nonceTTLMs / 1000);
+        if (this.redis) {
+            const key = `${NONCE_PREFIX}${nonce}`;
+            await this.redis.setex(key, ttlSeconds, '1');
+            return;
+        }
+        if (this.memoryStore) {
+            this.memoryStore.set(nonce, this.config.nonceTTLMs);
+            return;
+        }
+    }
+    /**
+     * Gets the current configuration
+     *
+     * @returns A copy of the current configuration (with secret redacted)
+     */
+    getConfig() {
+        return {
+            ...this.config,
+            secretKey: this.config.secretKey ? '[REDACTED]' : '',
+        };
+    }
+    /**
+     * Checks if the service is enabled
+     */
+    isEnabled() {
+        return this.config.enabled;
+    }
+    /**
+     * Cleans up resources (call when shutting down)
+     */
+    destroy() {
+        if (this.memoryStore) {
+            this.memoryStore.destroy();
+        }
+        logger.debug('RequestIntegrity destroyed');
+    }
+    // ===========================================================================
+    // Private Methods
+    // ===========================================================================
+    /**
+     * Generates a cryptographically secure nonce
+     */
+    generateNonce() {
+        return randomBytes(32).toString('hex');
+    }
+    /**
+     * Normalizes request body for signing
+     */
+    normalizeBody(body) {
+        if (!body) {
+            return '';
+        }
+        if (typeof body === 'string') {
+            return body;
+        }
+        // Canonical JSON serialization (sorted keys)
+        return JSON.stringify(body, Object.keys(body).sort());
+    }
+    /**
+     * Creates the data string for signing
+     */
+    createSignatureData(method, path, body, timestamp, nonce) {
+        return `${method}\n${path}\n${body}\n${timestamp}\n${nonce}`;
+    }
+    /**
+     * Creates an HMAC-SHA256 signature
+     */
+    createSignature(data) {
+        return createHmac('sha256', this.config.secretKey)
+            .update(data)
+            .digest('hex');
+    }
+    /**
+     * Validates request timestamp
+     */
+    validateTimestamp(timestamp) {
+        const now = Date.now();
+        const clockSkew = this.config.clockSkewMs ?? 60000;
+        // Check if timestamp is valid
+        if (isNaN(timestamp) || timestamp <= 0) {
+            return {
+                valid: false,
+                error: 'Invalid timestamp format',
+                errorCode: 'INVALID_TIMESTAMP',
+            };
+        }
+        // Check if request is too old
+        const age = now - timestamp;
+        if (age > this.config.maxAgeMs) {
+            return {
+                valid: false,
+                error: `Request too old: ${Math.round(age / 1000)}s (max: ${Math.round(this.config.maxAgeMs / 1000)}s)`,
+                errorCode: 'REQUEST_TOO_OLD',
+            };
+        }
+        // Check for future timestamp (with clock skew tolerance)
+        if (timestamp > now + clockSkew) {
+            return {
+                valid: false,
+                error: 'Request timestamp is in the future',
+                errorCode: 'REQUEST_FROM_FUTURE',
+            };
+        }
+        return { valid: true };
+    }
+    /**
+     * Performs constant-time string comparison to prevent timing attacks
+     */
+    constantTimeCompare(a, b) {
+        try {
+            const bufferA = Buffer.from(a);
+            const bufferB = Buffer.from(b);
+            if (bufferA.length !== bufferB.length) {
+                return false;
+            }
+            return timingSafeEqual(bufferA, bufferB);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Checks if a path should be excluded from verification
+     */
+    isPathExcluded(url) {
+        // Extract path without query string
+        const path = url.split('?')[0];
+        return this.config.excludePaths.some((excludePath) => {
+            // Support glob-like patterns with *
+            if (excludePath.includes('*')) {
+                const regex = new RegExp('^' + excludePath.replace(/\*/g, '.*') + '$');
+                return regex.test(path);
+            }
+            // Exact match or prefix match (for paths ending with /)
+            return path === excludePath || path.startsWith(excludePath + '/');
+        });
+    }
+}
+// =============================================================================
+// Singleton Instance
+// =============================================================================
+let requestIntegrityInstance = null;
+/**
+ * Gets or creates the singleton RequestIntegrity instance
+ *
+ * Creates the instance on first call using configuration from environment.
+ * Subsequent calls return the same instance.
+ *
+ * @param config - Optional configuration (only used on first call)
+ * @returns The RequestIntegrity singleton instance
+ * @throws {Error} If secret key is not configured
+ *
+ * @example
+ * ```typescript
+ * // Initialize with custom config
+ * const integrity = getRequestIntegrity({
+ *   secretKey: process.env.REQUEST_SIGNING_KEY,
+ *   maxAgeMs: 300000,
+ * });
+ *
+ * // Register middleware
+ * fastify.addHook('preHandler', integrity.middleware());
+ *
+ * // Later, get the same instance
+ * const sameIntegrity = getRequestIntegrity();
+ * ```
+ */
+export function getRequestIntegrity(config) {
+    if (!requestIntegrityInstance) {
+        const secretKey = config?.secretKey ??
+            process.env['VORION_REQUEST_SIGNING_KEY'] ??
+            process.env['REQUEST_SIGNING_KEY'] ??
+            '';
+        const integrityConfig = {
+            ...config,
+            secretKey,
+            enabled: config?.enabled ?? process.env['VORION_REQUEST_INTEGRITY_ENABLED'] !== 'false',
+        };
+        requestIntegrityInstance = new RequestIntegrity(integrityConfig);
+        logger.info('RequestIntegrity singleton initialized');
+    }
+    return requestIntegrityInstance;
+}
+/**
+ * Resets the singleton instance (useful for testing)
+ *
+ * @internal
+ */
+export function resetRequestIntegrity() {
+    if (requestIntegrityInstance) {
+        requestIntegrityInstance.destroy();
+        requestIntegrityInstance = null;
+    }
+    logger.debug('RequestIntegrity singleton reset');
+}
+// =============================================================================
+// Helper Functions
+// =============================================================================
+/**
+ * Creates request signing headers from a SignedRequest
+ *
+ * @param signed - The signed request metadata
+ * @returns Headers object to add to the request
+ *
+ * @example
+ * ```typescript
+ * const integrity = getRequestIntegrity();
+ * const signed = integrity.signRequest({
+ *   method: 'POST',
+ *   path: '/api/transfer',
+ *   body: { amount: 1000 },
+ * });
+ *
+ * const headers = createSignatureHeaders(signed);
+ * // Use headers in fetch or HTTP client
+ * fetch('/api/transfer', {
+ *   method: 'POST',
+ *   headers: {
+ *     ...headers,
+ *     'Content-Type': 'application/json',
+ *   },
+ *   body: JSON.stringify({ amount: 1000 }),
+ * });
+ * ```
+ */
+export function createSignatureHeaders(signed) {
+    return {
+        [SIGNATURE_HEADER]: signed.signature,
+        [TIMESTAMP_HEADER]: signed.timestamp.toString(),
+        [NONCE_HEADER]: signed.nonce,
+        [ALGORITHM_HEADER]: signed.algorithm,
+    };
+}
+/**
+ * Extracts signature metadata from request headers
+ *
+ * @param headers - Request headers object
+ * @returns SignedRequest or null if headers are missing/invalid
+ */
+export function extractSignatureFromHeaders(headers) {
+    const signature = headers[SIGNATURE_HEADER];
+    const timestamp = headers[TIMESTAMP_HEADER];
+    const nonce = headers[NONCE_HEADER];
+    const algorithm = headers[ALGORITHM_HEADER];
+    if (typeof signature !== 'string' ||
+        typeof timestamp !== 'string' ||
+        typeof nonce !== 'string') {
+        return null;
+    }
+    const timestampNum = parseInt(timestamp, 10);
+    if (isNaN(timestampNum)) {
+        return null;
+    }
+    return {
+        signature,
+        timestamp: timestampNum,
+        nonce,
+        algorithm: algorithm || 'HMAC-SHA256',
+    };
+}
+/**
+ * Header names used for request signing
+ */
+export const INTEGRITY_HEADERS = {
+    SIGNATURE: SIGNATURE_HEADER,
+    TIMESTAMP: TIMESTAMP_HEADER,
+    NONCE: NONCE_HEADER,
+    ALGORITHM: ALGORITHM_HEADER,
+};
+export default RequestIntegrity;
+//# sourceMappingURL=request-integrity.js.map

package/dist/security/request-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-integrity.js","sourceRoot":"","sources":["../../src/security/request-integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEhE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,yCAAyC;AACzC,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAEvD,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,qDAAqD;AACrD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,gCAAgC;AAChC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAgF9C,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA2B;IACtE,OAAO,EAAE,IAAI;IACb,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,kBAAkB;IAC5B,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,oBAAoB;IAChC,YAAY,EAAE;QACZ,aAAa;QACb,gBAAgB;QAChB,cAAc;QACd,iBAAiB;KAClB;IACD,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,gBAAgB;IACZ,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IACxC,eAAe,GAA0B,IAAI,CAAC;IAEtD,YAAY,oBAA4B,KAAK;QAC3C,yBAAyB;QACzB,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEtB,sDAAsD;QACtD,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAa,EAAE,KAAa;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAyB;IAC/B,KAAK,CAAe;IACpB,WAAW,CAA0B;IAEtD;;;;;;OAMG;IACH,YAAY,SAA0C,EAAE,EAAE,KAAa;QACrE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,gCAAgC,EAAE,GAAG,MAAM,EAAE,CAAC;QAEjE,sBAAsB;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,WAAW,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM;SAC9C,EACD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,KAAuB;QACjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAElD,wBAAwB;QACxB,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAC5C,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,EAC1B,KAAK,CAAC,IAAI,EACV,UAAU,EACV,SAAS,EACT,KAAK,CACN,CAAC;QAEF,qBAAqB;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAEtD,MAAM,CAAC,KAAK,CACV;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS;YACT,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;SACnC,EACD,gBAAgB,CACjB,CAAC;QAEF,OAAO;YACL,SAAS;YACT,KAAK;YACL,SAAS;YACT,SAAS,EAAE,aAAa;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,OAAuB,EACvB,SAAwB;QAExB,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACtF,CAAC;QAED,qBAAqB;QACrB,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT;gBACE,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,GAAG;aAClB,EACD,gDAAgD,CACjD,CAAC;YACF,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT;gBACE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5C,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,GAAG;aAClB,EACD,2CAA2C,CAC5C,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,4CAA4C;gBACnD,SAAS,EAAE,iBAAiB;aAC7B,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAmC,CAAC,CAAC;QAEnF,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAC3C,MAAM,EACN,IAAI,EACJ,UAAU,EACV,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,KAAK,CAChB,CAAC;QACF,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAE7D,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAC7C,SAAS,CAAC,SAAS,EACnB,iBAAiB,CAClB,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM;gBACN,IAAI;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,EACD,6CAA6C,CAC9C,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,2BAA2B;gBAClC,SAAS,EAAE,mBAAmB;aAC/B,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,CAAC,KAAK,CACV;YACE,MAAM;YACN,IAAI;YACJ,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,EACD,4BAA4B,CAC7B,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,KAAK,EACV,OAAuB,EACvB,KAAmB,EACJ,EAAE;YACjB,mBAAmB;YACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,uBAAuB;YACvB,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,4BAA4B;YAC5B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAE1D,4BAA4B;YAC5B,IAAI,CAAC,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,2BAA2B;oBACpC,IAAI,EAAE,mBAAmB;iBAC1B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,2BAA2B;oBACpC,IAAI,EAAE,mBAAmB;iBAC1B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,sBAAsB,CAAC,CAAC;gBAC3E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,uBAAuB;oBAChC,IAAI,EAAE,eAAe;iBACtB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,kBAAkB;YAClB,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,mBAAmB,CAAC,CAAC;gBACzF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,2BAA2B;oBACpC,IAAI,EAAE,mBAAmB;iBAC1B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,yBAAyB;YACzB,MAAM,aAAa,GAAkB;gBACnC,SAAS;gBACT,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAG,eAAiC,IAAI,aAAa;aAC/D,CAAC;YAEF,iBAAiB;YACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAEhE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc;oBACvD,OAAO,EAAE,MAAM,CAAC,KAAK;oBACrB,IAAI,EAAE,MAAM,CAAC,SAAS;iBACvB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2BAA2B;YAC1B,OAA4D,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACzF,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,GAAG,YAAY,GAAG,KAAK,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,OAAO,MAAM,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAE5D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,GAAG,YAAY,GAAG,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO;YACL,GAAG,IAAI,CAAC,MAAM;YACd,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;SACrD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;OAEG;IACK,aAAa;QACnB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,IAAiC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,6CAA6C;QAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,SAAiB,EACjB,KAAa;QAEb,OAAO,GAAG,MAAM,KAAK,IAAI,KAAK,IAAI,KAAK,SAAS,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,IAAY;QAClC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;aAC/C,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,SAAiB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC;QAEnD,8BAA8B;QAC9B,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,mBAAmB;aAC/B,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC;QAC5B,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,oBAAoB,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI;gBACvG,SAAS,EAAE,iBAAiB;aAC7B,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,IAAI,SAAS,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,oCAAoC;gBAC3C,SAAS,EAAE,qBAAqB;aACjC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,CAAS,EAAE,CAAS;QAC9C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAW;QAChC,oCAAoC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;YACnD,oCAAoC;YACpC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAC7C,CAAC;gBACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,wDAAwD;YACxD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAaD,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,IAAI,wBAAwB,GAA4B,IAAI,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAwC;IAExC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,SAAS,GACb,MAAM,EAAE,SAAS;YACjB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAClC,EAAE,CAAC;QAEL,MAAM,eAAe,GAAoC;YACvD,GAAG,MAAM;YACT,SAAS;YACT,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,KAAK,OAAO;SACxF,CAAC;QAEF,wBAAwB,GAAG,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,wBAAwB,EAAE,CAAC;QAC7B,wBAAwB,CAAC,OAAO,EAAE,CAAC;QACnC,wBAAwB,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAqB;IAErB,OAAO;QACL,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,SAAS;QACpC,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;QAC/C,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK;QAC5B,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,SAAS;KACrC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAsD;IAEtD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE5C,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS,EAAE,YAAY;QACvB,KAAK;QACL,SAAS,EAAG,SAA2B,IAAI,aAAa;KACzD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,gBAAgB;IAC3B,KAAK,EAAE,YAAY;IACnB,SAAS,EAAE,gBAAgB;CACnB,CAAC;AAEX,eAAe,gBAAgB,CAAC"}