@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js

@@ -0,0 +1,406 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import crypto from 'crypto';
+import { inject, injectable } from 'inversify';
+import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
+import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import { RedisService } from '../../../databases/services/redis.service.js';
+import { JwtBackendService } from '../../../security/jwt/services/jwt.backend.service.js';
+import { AuthExecutionContextFactoryBackendService } from '../../../security/authentications/services/auth-execution-context-factory.backend.service.js';
+import { ExecutionContext_ExecutionType, SessionType, ErrorType, ErrorCustomMessageReference, CoreResourceType, UserStatus } from '@wildo-ai/saas-models';
+import { JwtClaim_App_Auth_UserRequest_Schema, JwtClaim_App_RefreshToken_Schema, } from '../../../security/authentications/models/authentications.backend.schemas.js';
+import { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason } from '../../../security/authentications/models/auth-constants.backend.js';
+/** L3: Default max concurrent refresh tokens per user. */
+const DEFAULT_MAX_CONCURRENT_SESSIONS = 10;
+/**
+ * AuthTokenIssuerBackendService
+ *
+ * Responsibilities:
+ * - Issue access tokens (delegates to JwtBackendService)
+ * - Issue refresh tokens (delegates to JwtBackendService)
+ *
+ * This service does NOT:
+ * - Manage sessions (that's AuthSessionStore)
+ * - Verify credentials (that's AuthCredentialVerifier)
+ * - Audit log (TRAP 13: callers decide what to audit based on full context)
+ */
+let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
+    logger;
+    appConfigService;
+    jwtService;
+    errorBuilder;
+    redisService;
+    servicesRegistryHandler;
+    authEcFactory;
+    logDebug;
+    constructor(logger, appConfigService, jwtService, errorBuilder, redisService, servicesRegistryHandler, authEcFactory) {
+        this.logger = logger;
+        this.appConfigService = appConfigService;
+        this.jwtService = jwtService;
+        this.errorBuilder = errorBuilder;
+        this.redisService = redisService;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.authEcFactory = authEcFactory;
+        this.logDebug = this.logger.debugByType('AuthTokenIssuer');
+        this.logger.setDebugTypeLogging('AuthTokenIssuer', false);
+    }
+    /**
+     * Issue access + refresh tokens for a completed authentication session.
+     */
+    async issueTokens(session, options = {}) {
+        const userId = session.userId;
+        if (!userId) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND,
+                context: { missingField: 'userId' },
+            });
+        }
+        return this._issueTokensForUser(userId, session.sessionId, options.includeRefreshToken ?? true, {
+            lastAuthenticatedAt: options.lastAuthenticatedAt,
+            activeUserType: options.activeUserType ?? session.activeUserType ?? undefined,
+        });
+    }
+    /**
+     * Issue tokens for an user directly (without a full session).
+     * Used by OAuth2/SAML/registration callback flows (TRAP 12) which bypass the session state machine.
+     * `activeUserType` is resolved internally from the user record when not provided.
+     */
+    async issueTokensForUser(userId, sessionId, stepUpClaims, options) {
+        return this._issueTokensForUser(userId, sessionId, true, stepUpClaims, options);
+    }
+    /**
+     * Internal implementation for token issuance.
+     * Resolves `activeUserType` from the user DB record when not provided by the caller (N-2).
+     */
+    async _issueTokensForUser(userId, sessionId, includeRefreshToken = true, stepUpClaims, options) {
+        let emailVerified;
+        let resolvedActiveUserType = stepUpClaims?.activeUserType;
+        try {
+            const tokenEc = await this.authEcFactory.createForAuthenticatedAuthOperation(userId, this.authEcFactory.getUsersReadOperationPath());
+            const user = await this.servicesRegistryHandler.read(CoreResourceType.USERS, tokenEc, { _id: userId });
+            if (user && user.status === UserStatus.ACTIVE) {
+                emailVerified = true;
+            }
+            else if (user && user.status === UserStatus.PENDING_VERIFICATION) {
+                emailVerified = false;
+            }
+            if (!resolvedActiveUserType && user?.userTypes?.length) {
+                resolvedActiveUserType = user.userTypes[0];
+            }
+        }
+        catch {
+            // Non-fatal — if we can't determine, omit the claims
+        }
+        const lastAuthenticatedAt = stepUpClaims?.lastAuthenticatedAt;
+        const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({
+            type: ExecutionContext_ExecutionType.USER_REQUEST,
+            userId,
+            sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,
+            ...(emailVerified !== undefined ? { emailVerified } : {}),
+            ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),
+            ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),
+        });
+        const accessToken = await this.jwtService.createJwtForAppAuth(accessClaim);
+        const accessTokenMinutes = this.appConfigService.config.jwt.accessTokenExpirationMinutes ?? 15;
+        const accessTokenExpiresInSeconds = accessTokenMinutes * 60;
+        this.logDebug('Access token issued', { userId, expiresIn: accessTokenExpiresInSeconds });
+        let refreshToken;
+        if (includeRefreshToken) {
+            const jti = crypto.randomUUID();
+            const refreshClaim = {
+                type: ExecutionContext_ExecutionType.USER_REQUEST,
+                userId,
+                jti,
+                sessionId: sessionId,
+                sessionType: stepUpClaims?.sessionType ?? SessionType.PERSISTENT,
+                ...(lastAuthenticatedAt !== undefined ? { lastAuthenticatedAt } : {}),
+                ...(resolvedActiveUserType ? { activeUserType: resolvedActiveUserType } : {}),
+                ...(options?.refreshTokenExpiresAt ? { refreshTokenExpiresAt: Math.floor(options.refreshTokenExpiresAt.getTime() / 1000) } : {}),
+            };
+            refreshToken = await this.jwtService.createRefreshToken(refreshClaim, options?.refreshTokenExpiresAt
+                ? { expiresInSeconds: Math.max(1, Math.floor((options.refreshTokenExpiresAt.getTime() - Date.now()) / 1000)) }
+                : undefined);
+            if (!options?.skipSessionTracking) {
+                await this._trackAndEnforceSessionLimit(userId, jti, resolvedActiveUserType);
+            }
+            this.logDebug('Refresh token issued', { userId, sessionType: stepUpClaims?.sessionType });
+        }
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: accessTokenExpiresInSeconds,
+        };
+    }
+    /**
+     * Refresh an access token using a valid refresh token.
+     *
+     * Flow:
+     * 1. Verify the refresh token JWT signature + expiration
+     * 2. Parse claims using JwtClaim_App_RefreshToken_Schema (discriminated union)
+     * 3. Issue a fresh access token for the same user
+     * 4. Optionally rotate the refresh token (always rotate for security)
+     *
+     * @param refreshToken - The JWT refresh token string
+     * @returns Fresh access + refresh tokens
+     * @throws AUTHENTICATION error if the refresh token is invalid/expired
+     */
+    async refreshAccessToken(refreshToken) {
+        // Step 1: Verify the refresh token JWT (signature + expiry + audience=REFRESH_TOKEN)
+        let decoded;
+        try {
+            decoded = await this.jwtService.verifyRefreshToken(refreshToken);
+        }
+        catch (error) {
+            this.logger.warn('Refresh token verification failed', { error });
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Invalid or expired refresh token' },
+            });
+        }
+        // Step 2: Parse claims using the discriminated union schema
+        const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);
+        if (!parseResult.success) {
+            this.logger.warn('Refresh token claims failed validation', { issues: parseResult.error.issues });
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Refresh token claims are malformed' },
+            });
+        }
+        const claims = parseResult.data;
+        // Step 2b: Check JTI blacklist (revoked tokens) with reuse detection
+        const blacklistValue = await this.redisService.get(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`);
+        if (blacklistValue) {
+            if (blacklistValue === RefreshTokenBlacklistReason.ROTATED) {
+                // REUSE DETECTED: A previously rotated JTI is being reused.
+                // This means the old refresh token was stolen — revoke ALL tokens for this user.
+                this.logger.warn('REFRESH TOKEN REUSE DETECTED — possible token theft, revoking all tokens for user', {
+                    jti: claims.jti,
+                    userId: claims.userId,
+                    type: claims.type,
+                });
+                const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays ?? 30;
+                await this.redisService.set(`${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${claims.userId}`, Math.floor(Date.now() / 1000), { ttl: refreshTokenDays * 86400 });
+            }
+            else {
+                this.logger.warn('Refresh token has been revoked', { jti: claims.jti });
+            }
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Refresh token has been revoked' },
+            });
+        }
+        // Step 2c: Check per-user invalidation timestamp (set by reuse detection or password change)
+        const invalidBefore = await this.redisService.get(`${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${claims.userId}`);
+        if (invalidBefore && claims.iat && claims.iat < invalidBefore) {
+            this.logger.warn('Refresh token issued before user-level invalidation', {
+                jti: claims.jti,
+                userId: claims.userId,
+                tokenIat: claims.iat,
+                invalidBefore,
+            });
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'All sessions have been invalidated. Please re-authenticate.' },
+            });
+        }
+        // Step 2d: Verify user is still active (W2-SEC-4)
+        const ec = await this.authEcFactory.createForAuthenticatedAuthOperation(claims.userId, this.authEcFactory.getUsersReadOperationPath());
+        const currentUser = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { _id: claims.userId });
+        if (!currentUser || currentUser.status !== UserStatus.ACTIVE) {
+            this.logger.warn('Refresh token for non-active user', {
+                jti: claims.jti,
+                userId: claims.userId,
+                userStatus: currentUser?.status ?? 'NOT_FOUND',
+            });
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,
+                context: { userStatus: currentUser?.status ?? 'NOT_FOUND', source: 'token_refresh' },
+            });
+        }
+        // Step 3: Issue new tokens — carry forward all session-scoped claims from the refresh token
+        this.logDebug('Refresh token validated, issuing new tokens', { userId: claims.userId, jti: claims.jti });
+        const refreshLastAuthAt = claims.lastAuthenticatedAt;
+        const refreshActiveUserType = claims.activeUserType;
+        const refreshSessionType = claims.sessionType;
+        const refreshTokenExpiresAtClaim = claims.refreshTokenExpiresAt;
+        const newTokens = await this._issueTokensForUser(claims.userId, claims.sessionId, true, {
+            lastAuthenticatedAt: refreshLastAuthAt,
+            activeUserType: refreshActiveUserType,
+            sessionType: refreshSessionType ?? SessionType.PERSISTENT,
+        }, {
+            ...(refreshSessionType === SessionType.ONE_OFF ? { skipSessionTracking: true } : {}),
+            ...(refreshTokenExpiresAtClaim ? { refreshTokenExpiresAt: new Date(refreshTokenExpiresAtClaim * 1000) } : {}),
+        });
+        // Step 4: Blacklist the consumed refresh token JTI as 'rotated'
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const ttl = claims.exp ? claims.exp - nowSeconds : 86400;
+        if (ttl > 0 && claims.jti) {
+            await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${claims.jti}`, RefreshTokenBlacklistReason.ROTATED, { ttl });
+            this.logDebug('Old refresh token JTI blacklisted after rotation', { jti: claims.jti, ttl });
+        }
+        return newTokens;
+    }
+    /**
+     * Revoke a refresh token by adding its JTI to the Redis blacklist.
+     * TTL matches the token's remaining lifetime so the entry auto-expires.
+     *
+     * Called from the logout route handler.
+     */
+    async revokeRefreshToken(refreshToken) {
+        // Decode the token to extract JTI and exp. We verify the signature
+        // so that arbitrary strings can't pollute the blacklist.
+        let decoded;
+        try {
+            decoded = await this.jwtService.verifyRefreshToken(refreshToken);
+        }
+        catch {
+            // Token is already invalid/expired — nothing to revoke
+            this.logDebug('Refresh token revocation skipped — token is invalid or expired');
+            return;
+        }
+        const parseResult = JwtClaim_App_RefreshToken_Schema.safeParse(decoded);
+        if (!parseResult.success) {
+            this.logDebug('Refresh token revocation skipped — claims are malformed');
+            return;
+        }
+        const { jti, exp } = parseResult.data;
+        if (!jti) {
+            this.logDebug('Refresh token revocation skipped — no JTI');
+            return;
+        }
+        // TTL = remaining seconds until token naturally expires
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const ttl = exp ? exp - nowSeconds : 86400; // fallback 24h
+        if (ttl <= 0) {
+            this.logDebug('Refresh token already expired — no blacklist needed', { jti });
+            return;
+        }
+        await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`, RefreshTokenBlacklistReason.REVOKED, { ttl });
+        // L3: Remove from active refresh tokens set
+        const claims = parseResult.data;
+        const userId = claims.userId;
+        try {
+            const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);
+            await this.redisService.eval('redis.call("ZREM", KEYS[1], ARGV[1]); return 1', [setKey], [jti]);
+        }
+        catch {
+            // Non-fatal
+        }
+        this.logDebug('Refresh token revoked', { jti, ttlSeconds: ttl });
+    }
+    /**
+     * Invalidate all refresh tokens for an user by setting a per-user
+     * "invalid before" timestamp in Redis. All refresh tokens with `iat` before
+     * this timestamp will be rejected on next use.
+     *
+     * Used on password change/reset (C4) and token reuse detection (H3).
+     * TTL matches max refresh token lifetime (30 days).
+     */
+    async invalidateAllTokensForUser(userId) {
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays ?? 30;
+        await this.redisService.set(`${AUTH_REDIS_KEYS.TOKEN_INVALID_BEFORE}${userId}`, nowSeconds, { ttl: refreshTokenDays * 86400 });
+        this.logDebug('All tokens invalidated for user', { userId, invalidBefore: nowSeconds });
+    }
+    /**
+     * L3: Track an active refresh token JTI for an user and enforce the concurrent session limit.
+     *
+     * Uses a Redis sorted set per user where:
+     * - Members = JTI strings
+     * - Scores = issuedAt timestamp (for FIFO eviction)
+     *
+     * When the set exceeds the max size (default 10), the oldest JTI(s) are evicted
+     * and blacklisted so they can't be used anymore.
+     */
+    async _trackAndEnforceSessionLimit(userId, newJti, activeUserType) {
+        const userTypeConfig = activeUserType
+            ? this.appConfigService.config.userTypes?.[activeUserType]
+            : undefined;
+        const configuredMax = userTypeConfig?.auth?.maxConcurrentSessions;
+        const maxSessions = (configuredMax && configuredMax > 0) ? configuredMax : DEFAULT_MAX_CONCURRENT_SESSIONS;
+        const refreshTokenDays = this.appConfigService.config.jwt.refreshTokenExpirationDays ?? 30;
+        const setTtl = refreshTokenDays * 86400;
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const setKey = this.redisService.buildKey(`${AUTH_REDIS_KEYS.ACTIVE_REFRESH_JTIS}${userId}`);
+        // Lua script: atomically add JTI, enforce max cardinality, return evicted JTIs with scores
+        const luaScript = `
+      local setKey = KEYS[1]
+      local newJti = ARGV[1]
+      local score = tonumber(ARGV[2])
+      local maxSize = tonumber(ARGV[3])
+      local setTtl = tonumber(ARGV[4])
+
+      -- Add the new JTI
+      redis.call('ZADD', setKey, score, newJti)
+      redis.call('EXPIRE', setKey, setTtl)
+
+      -- Check cardinality
+      local size = redis.call('ZCARD', setKey)
+      if size <= maxSize then
+        return {}
+      end
+
+      -- Evict oldest (lowest score) entries — return [jti, score, jti, score, ...]
+      local evictCount = size - maxSize
+      local evicted = redis.call('ZRANGE', setKey, 0, evictCount - 1, 'WITHSCORES')
+      redis.call('ZREMRANGEBYRANK', setKey, 0, evictCount - 1)
+      return evicted
+    `;
+        try {
+            const evictedPairs = await this.redisService.eval(luaScript, [setKey], [newJti, String(nowSeconds), String(maxSessions), String(setTtl)]);
+            if (evictedPairs && evictedPairs.length > 0) {
+                // evictedPairs is [jti, score, jti, score, ...] — blacklist each with its actual remaining TTL
+                for (let i = 0; i < evictedPairs.length; i += 2) {
+                    const jti = evictedPairs[i];
+                    const issuedAt = parseInt(evictedPairs[i + 1], 10);
+                    // Token expires at issuedAt + maxTTL; blacklist only needs to live until then
+                    const expiresAt = issuedAt + setTtl;
+                    const remainingTtl = Math.max(expiresAt - nowSeconds, 60); // floor at 60s
+                    await this.redisService.set(`${AUTH_REDIS_KEYS.REFRESH_BLACKLIST}${jti}`, RefreshTokenBlacklistReason.EVICTED, { ttl: remainingTtl });
+                }
+                this.logDebug('Concurrent session limit enforced — evicted oldest tokens', {
+                    userId,
+                    evictedCount: evictedPairs.length / 2,
+                    maxSessions,
+                });
+            }
+        }
+        catch (error) {
+            // Non-fatal: don't block token issuance if tracking fails
+            this.logger.warn('Failed to track/enforce concurrent session limit', {
+                userId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+};
+AuthTokenIssuerBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.JwtBackendService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.RedisService)),
+    __param(5, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory)),
+    __metadata("design:paramtypes", [LoggerService,
+        AppConfigurationService,
+        JwtBackendService,
+        ErrorBuilderBackendService,
+        RedisService, Function, AuthExecutionContextFactoryBackendService])
+], AuthTokenIssuerBackendService);
+export { AuthTokenIssuerBackendService };
+//# sourceMappingURL=auth-token-issuer.backend.service.js.map

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token-issuer.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AAEjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAyB,8BAA8B,EAAE,WAAW,EAAE,SAAS,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEjL,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GAEjC,MAAM,oFAAoF,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,2EAA2E,CAAC;AAEzI,0DAA0D;AAC1D,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAW3C;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIc;IACU;IACC;IACE;IACP;IACkB;IACH;IAT1D,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACxC,UAA6B,EAC3B,YAAwC,EAC/C,YAA0B,EACR,uBAA8D,EACjE,aAAwD;QAN7E,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACxC,eAAU,GAAV,UAAU,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,iBAAY,GAAZ,YAAY,CAAc;QACR,4BAAuB,GAAvB,uBAAuB,CAAuC;QACjE,kBAAa,GAAb,aAAa,CAA2C;QAEjI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,WAAW,CACtB,OAA8B,EAC9B,UAAoG,EAAE;QAEtG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,yCAAyC;gBAC7F,OAAO,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,IAAI,IAAI,EAAE;YAC9F,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,SAAS;SAC9E,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAC7B,MAAc,EACd,SAAkB,EAClB,YAIC,EACD,OAGC;QAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,SAAkB,EAClB,sBAA+B,IAAI,EACnC,YAIC,EACD,OAGC;QAED,IAAI,aAAkC,CAAC;QACvC,IAAI,sBAAsB,GAAG,YAAY,EAAE,cAAc,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;YACrI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2C,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YACjJ,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC9C,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,oBAAoB,EAAE,CAAC;gBACnE,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,sBAAsB,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvD,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;QAED,MAAM,mBAAmB,GAAG,YAAY,EAAE,mBAAmB,CAAC;QAE9D,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM;YACN,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;YAChE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3E,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;QAC/F,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAEzF,IAAI,YAAgC,CAAC;QACrC,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,GAAuC;gBACvD,IAAI,EAAE,8BAA8B,CAAC,YAAY;gBACjD,MAAM;gBACN,GAAG;gBACH,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,WAAW,CAAC,UAAU;gBAChE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjI,CAAC;YAEF,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrD,YAAY,EACZ,OAAO,EAAE,qBAAqB;gBAC5B,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE;gBAC9G,CAAC,CAAC,SAAS,CACd,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,2BAA2B;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,qFAAqF;QACrF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE;aACzD,CACF,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;aAC3D,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAEhC,qEAAqE;QACrE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,cAAc,KAAK,2BAA2B,CAAC,OAAO,EAAE,CAAC;gBAC3D,4DAA4D;gBAC5D,iFAAiF;gBACjF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mFAAmF,EAAE;oBACpG,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAG,MAAM,CAAC,MAAM;oBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;gBACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;gBAC3F,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,EACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE;aACvD,CACF,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrH,IAAI,aAAa,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBACtE,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAG,MAAM,CAAC,MAAM;gBACtB,QAAQ,EAAE,MAAM,CAAC,GAAG;gBACpB,aAAa;aACd,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;gBAChF,OAAO,EAAE,EAAE,OAAO,EAAE,6DAA6D,EAAE;aACpF,CACF,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,mCAAmC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,CAAC,CAAC;QACvI,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtH,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW;aAC/C,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAChC,SAAS,CAAC,cAAc,EACxB,SAAS,EACT;gBACE,sBAAsB,EAAE,2BAA2B,CAAC,6BAA6B;gBACjF,OAAO,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE;aACrF,CACF,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,IAAI,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC,cAAc,CAAC;QACpD,MAAM,kBAAkB,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ;YACE,mBAAmB,EAAE,iBAAiB;YACtC,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,kBAAkB,IAAI,WAAW,CAAC,UAAU;SAC1D,EACD;YACE,GAAG,CAAC,kBAAkB,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9G,CACF,CAAC;QAEF,gEAAgE;QAChE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,MAAM,CAAC,GAAG,EAAE,EACnD,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,CACR,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,IAAI,CAAC,QAAQ,CAAC,gEAAgE,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,GAAc,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe;QACvE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAAE,2BAA2B,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAExH,4CAA4C;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gDAAgD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAAc;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC3F,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,oBAAoB,GAAG,MAAM,EAAE,EAClD,UAAU,EACV,EAAE,GAAG,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAClC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,4BAA4B,CAAC,MAAc,EAAE,MAAc,EAAE,cAAuB;QAChG,MAAM,cAAc,GAAG,cAAc;YACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,aAAa,GAAG,cAAc,EAAE,IAAI,EAAE,qBAAqB,CAAC;QAClE,MAAM,WAAW,GAAG,CAAC,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,+BAA+B,CAAC;QAC3G,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,gBAAgB,GAAG,KAAK,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,mBAAmB,GAAG,MAAM,EAAE,CAAC,CAAC;QAE7F,2FAA2F;QAC3F,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;KAsBjB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAC/C,SAAS,EACT,CAAC,MAAM,CAAC,EACR,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAC;YAErB,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,+FAA+F;gBAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnD,8EAA8E;oBAC9E,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;oBACpC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe;oBAC1E,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACzB,GAAG,eAAe,CAAC,iBAAiB,GAAG,GAAG,EAAE,EAC5C,2BAA2B,CAAC,OAAO,EACnC,EAAE,GAAG,EAAE,YAAY,EAAE,CACtB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,2DAA2D,EAAE;oBACzE,MAAM;oBACN,YAAY,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;oBACrC,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0DAA0D;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,MAAM;gBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAlcY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;IAC5C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,CAAA;qCANK,aAAa;QACO,uBAAuB;QAC5B,iBAAiB;QACb,0BAA0B;QACjC,YAAY,YAEI,yCAAyC;GAVxH,6BAA6B,CAkczC"}