@withbuddi/buddi 0.1.0-pre.36 → 0.1.0-pre.38

package/packages/runtime/dist/plugin-sign-in.js

@@ -0,0 +1,397 @@
+/**
+ * A plugin's OAuth sign-in, run by core on its behalf (host API 1.28,
+ * docs/plugin-host-api.md, `secrets.signIn` and `auth: { as: 'bearer' }`).
+ *
+ * The flow is the one an installed app runs (RFC 8252): PKCE and a state, the
+ * provider's consent page opened by the owner, and the answer caught on a
+ * loopback port this process listens on for as long as the sign-in waits —
+ * `http://127.0.0.1:<port>/`. When the owner's browser is on another computer
+ * (a buddi on a home server, the dashboard over the tailnet) that page cannot
+ * load there, and the owner pastes the address it ended on instead: the same
+ * state check, the same exchange.
+ *
+ * The tokens go one way: into `save`, which is core writing the owner secret.
+ * `fresh` keeps them alive: a refresh at the provider that issued them when
+ * the access token is about to expire, or when a 401 answered it. A provider
+ * that refuses the refresh (revoked, Google's seven-day testing-mode limit)
+ * marks the envelope signed out and throws `SignInExpiredError`, so later
+ * requests fail at once, in words, without asking the provider again. Any other
+ * failure leaves the envelope as it was: Google does not rotate refresh
+ * tokens, so trying again later is safe.
+ *
+ * Nothing here puts a token, a code or a response body in an error.
+ */
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { SignInExpiredError } from '@buddi/core';
+import { OAuthCallbackError, authorizeUrl, oauthState, parseCallback, pkcePair, validToken } from './oauth.js';
+import { defaultHttpTransport } from './transport.js';
+/** How long a sign-in waits for the owner. */
+export const SIGN_IN_TTL_MS = 10 * 60_000;
+/** How long a finished sign-in's outcome stays readable. */
+const KEEP_DONE_MS = 30 * 60_000;
+/** Refresh this long before the access token expires. */
+const SKEW_MS = 5 * 60_000;
+const page = (title, text) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">` +
+    `<title>${title}</title><style>body{font:16px/1.5 system-ui,-apple-system,sans-serif;margin:0;display:grid;place-items:center;min-height:100vh;` +
+    `background:#faf9f7;color:#1f1d1a}@media (prefers-color-scheme:dark){body{background:#1b1a18;color:#ecebe8}}main{max-width:28rem;padding:1.5rem}` +
+    `h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:0}</style></head><body><main><h1>${title}</h1><p>${text}</p></main></body></html>`;
+function sendPage(res, status, title, text) {
+    res.writeHead(status, {
+        'content-type': 'text/html; charset=utf-8',
+        'cache-control': 'no-store',
+        'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'",
+        'referrer-policy': 'no-referrer',
+        connection: 'close',
+    });
+    res.end(page(title, text));
+}
+/** The provider's `error` code from a token endpoint's JSON answer, if it gave one. */
+async function errorCode(res) {
+    try {
+        const data = (await res.json());
+        return typeof data?.error === 'string' ? data.error : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A token endpoint's answer as an envelope's fields, or undefined when it is not one. */
+async function tokensOf(res, now) {
+    let data;
+    try {
+        data = (await res.json());
+    }
+    catch {
+        return undefined;
+    }
+    if (!data || typeof data !== 'object' || !validToken(data.access_token))
+        return undefined;
+    if (data.token_type !== undefined && String(data.token_type).toLowerCase() !== 'bearer')
+        return undefined;
+    const refresh = data.refresh_token;
+    if (refresh !== undefined && refresh !== null && refresh !== '' && !validToken(refresh))
+        return undefined;
+    const seconds = Number(data.expires_in);
+    const expiresAt = now + (Number.isFinite(seconds) && seconds > 0 && seconds <= 366 * 86400 ? seconds : 3600) * 1000;
+    const scopes = typeof data.scope === 'string' ? data.scope.split(/\s+/).filter(Boolean) : undefined;
+    return {
+        accessToken: data.access_token,
+        ...(typeof refresh === 'string' && refresh !== '' ? { refreshToken: refresh } : {}),
+        expiresAt,
+        ...(scopes ? { scopes } : {}),
+    };
+}
+function readEnvelope(raw, secret) {
+    if (raw === null || raw === '')
+        throw new SignInExpiredError(secret, `"${secret}" holds no sign-in; the owner signs in again`);
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        throw new SignInExpiredError(secret, `"${secret}" is not a sign-in buddi can read; the owner signs in again`);
+    }
+    if (!data || data.version !== 1 || !validToken(data.accessToken) || typeof data.expiresAt !== 'number') {
+        throw new SignInExpiredError(secret, `"${secret}" is not a sign-in buddi can read; the owner signs in again`);
+    }
+    return data;
+}
+export function createPluginSignInService(options = {}) {
+    const transport = options.transport ?? defaultHttpTransport;
+    const now = options.now ?? Date.now;
+    const hostname = options.hostname ?? '127.0.0.1';
+    const pending = new Map();
+    /** One refresh at a time per vault entry: a second caller waits and reads what the first saved. */
+    const refreshing = new Map();
+    /** Stop listening; the answer being written still goes out (every answer closes its connection). */
+    const close = (entry) => {
+        const server = entry.server;
+        if (server === undefined)
+            return;
+        delete entry.server;
+        server.close();
+        setTimeout(() => server.closeAllConnections?.(), 2_000).unref();
+    };
+    const end = (entry, status) => {
+        entry.status = status;
+        close(entry);
+        if (entry.timer)
+            clearTimeout(entry.timer);
+        entry.timer = setTimeout(() => pending.delete(entry.id), KEEP_DONE_MS);
+        entry.timer.unref();
+        return status;
+    };
+    /** The code for tokens, once per sign-in: the loopback and a paste racing get the same answer. */
+    const exchange = (entry, code) => {
+        if (entry.status.state !== 'waiting')
+            return Promise.resolve(entry.status);
+        entry.exchanging ??= (async () => {
+            // Cancelled or replaced while this waited: whatever the provider said is
+            // not this sign-in's to keep, and the status it was ended with stands.
+            const obsolete = () => entry.abort.signal.aborted;
+            let res;
+            try {
+                res = await transport(entry.tokenEndpoint, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                    body: new URLSearchParams({
+                        grant_type: 'authorization_code',
+                        code,
+                        code_verifier: entry.verifier,
+                        redirect_uri: entry.redirectUri,
+                        client_id: entry.clientId,
+                        ...(entry.clientSecret ? { client_secret: entry.clientSecret } : {}),
+                    }).toString(),
+                    signal: AbortSignal.any([AbortSignal.timeout(20_000), entry.abort.signal]),
+                    maxBytes: 65_536,
+                });
+            }
+            catch {
+                if (obsolete())
+                    return { ...entry.status };
+                return end(entry, { state: 'failed', problem: `${entry.label} did not answer the sign-in. Start again.` });
+            }
+            if (obsolete())
+                return { ...entry.status };
+            if (!res.ok) {
+                const why = await errorCode(res);
+                return end(entry, {
+                    state: 'failed',
+                    problem: why === 'invalid_grant'
+                        ? `${entry.label} refused the code: it works once and only for a few minutes. Start again.`
+                        : why === 'invalid_client' || why === 'unauthorized_client'
+                            ? `${entry.label} turned down the plugin's OAuth client (${why}): its client id or secret is wrong or missing. Update the plugin.`
+                            : `${entry.label} refused the sign-in (${res.status}). Start again.`,
+                });
+            }
+            const tokens = await tokensOf(res, now());
+            if (obsolete())
+                return { ...entry.status };
+            if (tokens === undefined)
+                return end(entry, { state: 'failed', problem: `${entry.label} answered the sign-in with something buddi cannot read. Start again.` });
+            if (tokens.refreshToken === undefined) {
+                return end(entry, { state: 'failed', problem: `${entry.label} gave buddi no lasting access. Start again, and allow it on ${entry.label}'s page.` });
+            }
+            const granted = tokens.scopes ?? [...entry.scopes];
+            if (entry.scopes.some((scope) => !granted.includes(scope))) {
+                return end(entry, {
+                    state: 'failed',
+                    problem: `${entry.label} did not give buddi everything it asks for. Start again and tick every box on ${entry.label}'s page.`,
+                });
+            }
+            const envelope = {
+                version: 1,
+                state: 'ready',
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                expiresAt: tokens.expiresAt,
+                scopes: granted,
+                clientId: entry.clientId,
+                extra: { tokenEndpoint: entry.tokenEndpoint, ...(entry.clientSecret ? { clientSecret: entry.clientSecret } : {}) },
+            };
+            try {
+                await entry.save(JSON.stringify(envelope));
+            }
+            catch (err) {
+                return end(entry, { state: 'failed', problem: `buddi signed in but could not keep the sign-in: ${err instanceof Error ? err.message : String(err)}` });
+            }
+            return end(entry, { state: 'signed-in', scopes: granted });
+        })();
+        return entry.exchanging;
+    };
+    async function onCallback(entry, req, res) {
+        if (req.method !== 'GET')
+            return sendPage(res, 405, 'Not here', 'This address only takes the sign-in answer.');
+        const url = new URL(req.url ?? '/', entry.redirectUri);
+        if (url.pathname !== new URL(entry.redirectUri).pathname || (!url.searchParams.has('code') && !url.searchParams.has('error'))) {
+            return sendPage(res, 404, 'Not here', 'This address only takes the sign-in answer.');
+        }
+        let code;
+        try {
+            ({ code } = parseCallback(url, entry.state, { redirectUri: entry.redirectUri }));
+        }
+        catch (err) {
+            if (err instanceof OAuthCallbackError && err.reason === 'denied') {
+                end(entry, { state: 'failed', problem: `You did not allow buddi on ${entry.label}'s page. Start again to sign in.` });
+                return sendPage(res, 200, 'Not signed in', `You did not allow buddi. Go back to buddi to start again.`);
+            }
+            return sendPage(res, 400, 'Not this sign-in', 'This answer is not for the sign-in buddi started. Go back to buddi and start again.');
+        }
+        const status = await exchange(entry, code);
+        if (status.state === 'signed-in') {
+            return sendPage(res, 200, `Signed in to ${entry.label}`, 'buddi has the sign-in. Close this tab and go back to buddi to finish.');
+        }
+        return sendPage(res, 200, 'Not signed in', `${status.problem ?? 'The sign-in did not finish.'}`);
+    }
+    return {
+        async begin(input) {
+            // One waiting sign-in per plugin: a second press replaces the first.
+            for (const other of pending.values()) {
+                if (other.plugin === input.plugin && other.status.state === 'waiting') {
+                    other.abort.abort();
+                    end(other, { state: 'expired', problem: 'A newer sign-in replaced this one.' });
+                }
+            }
+            const pkce = pkcePair();
+            const entry = {
+                plugin: input.plugin,
+                id: randomBytes(12).toString('base64url'),
+                state: oauthState(),
+                verifier: pkce.verifier,
+                redirectUri: '',
+                tokenEndpoint: input.provider.tokenEndpoint,
+                label: input.provider.label,
+                clientId: input.clientId,
+                ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+                scopes: [...input.scopes],
+                save: input.save,
+                status: { state: 'waiting' },
+                abort: new AbortController(),
+            };
+            const server = createServer((req, res) => {
+                onCallback(entry, req, res).catch(() => sendPage(res, 500, 'Not signed in', 'Something went wrong. Go back to buddi and start again.'));
+            });
+            await new Promise((resolve, reject) => {
+                server.once('error', reject);
+                server.listen(0, hostname, () => resolve());
+            });
+            server.unref();
+            const address = server.address();
+            if (address === null || typeof address === 'string') {
+                server.close();
+                throw new Error('buddi could not listen for the sign-in answer.');
+            }
+            entry.server = server;
+            entry.redirectUri = `http://${hostname}:${address.port}/`;
+            entry.timer = setTimeout(() => {
+                if (entry.status.state === 'waiting')
+                    end(entry, { state: 'expired', problem: 'The sign-in waited too long. Start again.' });
+            }, SIGN_IN_TTL_MS);
+            entry.timer.unref();
+            pending.set(entry.id, entry);
+            const consent = authorizeUrl({
+                authorizationEndpoint: input.provider.authorizationEndpoint,
+                clientId: input.clientId,
+                redirectUri: entry.redirectUri,
+                state: entry.state,
+                challenge: pkce.challenge,
+                scopes: input.scopes,
+                extra: { ...input.provider.authorizeExtra },
+            });
+            return { id: entry.id, authorizeUrl: consent, redirectUri: entry.redirectUri, expiresAt: now() + SIGN_IN_TTL_MS };
+        },
+        status(plugin, id) {
+            const entry = pending.get(id);
+            return entry && entry.plugin === plugin ? { ...entry.status } : undefined;
+        },
+        async finish(plugin, id, pasted) {
+            const entry = pending.get(id);
+            if (!entry || entry.plugin !== plugin)
+                return { state: 'expired', problem: 'That sign-in is over. Start again.' };
+            if (entry.status.state !== 'waiting')
+                return { ...entry.status };
+            const text = pasted.trim();
+            let code;
+            if (/^https?:\/\//i.test(text)) {
+                try {
+                    ({ code } = parseCallback(text, entry.state, { redirectUri: entry.redirectUri }));
+                }
+                catch (err) {
+                    if (err instanceof OAuthCallbackError && err.reason === 'denied') {
+                        return end(entry, { state: 'failed', problem: `You did not allow buddi on ${entry.label}'s page. Start again to sign in.` });
+                    }
+                    if (err instanceof OAuthCallbackError && (err.reason === 'state' || err.reason === 'foreign')) {
+                        throw new Error('That address is from another sign-in. Paste the one from the tab this sign-in opened.');
+                    }
+                    throw new Error('That address has no sign-in code in it. Paste the whole address from the tab, as it is.');
+                }
+            }
+            else {
+                if (!/^[\x21-\x7e]{10,4096}$/.test(text))
+                    throw new Error('Paste the whole address the browser ended on.');
+                code = text;
+            }
+            return exchange(entry, code);
+        },
+        cancel(plugin, id) {
+            const entry = pending.get(id);
+            if (!entry || entry.plugin !== plugin)
+                return;
+            entry.abort.abort();
+            if (entry.status.state === 'waiting')
+                entry.status = { state: 'expired', problem: 'The sign-in was cancelled.' };
+            close(entry);
+            if (entry.timer)
+                clearTimeout(entry.timer);
+            pending.delete(id);
+        },
+        async fresh(vault, ref, secret, opts = {}) {
+            const before = refreshing.get(ref);
+            const run = (async () => {
+                if (before)
+                    await before.catch(() => undefined);
+                const tokens = readEnvelope(await vault.get(ref), secret);
+                if (tokens.extra?.signedOut)
+                    throw new SignInExpiredError(secret);
+                const stale = opts.rejected !== undefined && opts.rejected === tokens.accessToken;
+                if (!stale && (opts.rejected !== undefined || tokens.expiresAt > now() + SKEW_MS)) {
+                    // Fresh enough, or another request already replaced the token a 401 answered.
+                    return { accessToken: tokens.accessToken, refreshed: false };
+                }
+                const tokenEndpoint = tokens.extra?.tokenEndpoint;
+                if (!tokens.refreshToken || !tokenEndpoint || !tokens.clientId) {
+                    throw new SignInExpiredError(secret, `"${secret}" cannot be renewed; the owner signs in again`);
+                }
+                let res;
+                try {
+                    res = await transport(tokenEndpoint, {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                        body: new URLSearchParams({
+                            grant_type: 'refresh_token',
+                            refresh_token: tokens.refreshToken,
+                            client_id: tokens.clientId,
+                            ...(tokens.extra?.clientSecret ? { client_secret: tokens.extra.clientSecret } : {}),
+                        }).toString(),
+                        signal: AbortSignal.timeout(20_000),
+                        maxBytes: 65_536,
+                    });
+                }
+                catch {
+                    throw new Error(`the sign-in "${secret}" could not be renewed just now (no answer); buddi tries again on the next request`);
+                }
+                if (!res.ok) {
+                    const why = await errorCode(res);
+                    if (why === 'invalid_grant' || why === 'invalid_client' || why === 'unauthorized_client' || res.status === 401) {
+                        await vault.set(ref, JSON.stringify({ ...tokens, state: 'ready', extra: { ...(tokens.extra ?? {}), signedOut: why ?? String(res.status) } }));
+                        throw new SignInExpiredError(secret);
+                    }
+                    throw new Error(`the sign-in "${secret}" could not be renewed just now (${res.status}); buddi tries again on the next request`);
+                }
+                const next = await tokensOf(res, now());
+                if (next === undefined)
+                    throw new Error(`the sign-in "${secret}" was renewed with an answer buddi cannot read; buddi tries again on the next request`);
+                const rotated = {
+                    ...tokens,
+                    state: 'ready',
+                    accessToken: next.accessToken,
+                    refreshToken: next.refreshToken ?? tokens.refreshToken,
+                    expiresAt: next.expiresAt,
+                    ...(next.scopes ? { scopes: next.scopes } : {}),
+                };
+                await vault.set(ref, JSON.stringify(rotated));
+                return { accessToken: rotated.accessToken, refreshed: true };
+            })();
+            refreshing.set(ref, run);
+            try {
+                return await run;
+            }
+            finally {
+                if (refreshing.get(ref) === run)
+                    refreshing.delete(ref);
+            }
+        },
+    };
+}
+//# sourceMappingURL=plugin-sign-in.js.map

package/packages/runtime/dist/plugin-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-sign-in.js","sourceRoot":"","sources":["../src/plugin-sign-in.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAgE,MAAM,aAAa,CAAC;AAC/G,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAsB,MAAM,gBAAgB,CAAC;AAE1E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,4DAA4D;AAC5D,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,yDAAyD;AACzD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC;AAyC3B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CACnD,iIAAiI;IACjI,UAAU,KAAK,iIAAiI;IAChJ,iJAAiJ;IACjJ,mFAAmF,KAAK,WAAW,IAAI,2BAA2B,CAAC;AAErI,SAAS,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAa,EAAE,IAAY;IAChF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,0BAA0B;QAC1C,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EAAE,+CAA+C;QAC1E,iBAAiB,EAAE,aAAa;QAChC,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,SAAS,CAAC,GAAiC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,QAAQ,CAAC,GAAiC,EAAE,GAAW;IACpE,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1G,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpH,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAsB;QACxC,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB,EAAE,MAAc;IACtD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,MAAM,8CAA8C,CAAC,CAAC;IAC/H,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,MAAM,6DAA6D,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,MAAM,6DAA6D,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAA+B,EAAE;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,mGAAmG;IACnG,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEvD,oGAAoG;IACpG,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,OAAO,KAAK,CAAC,MAAM,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,MAAyB,EAAqB,EAAE;QAC3E,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtB,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,IAAI,KAAK,CAAC,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;QACvE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,kGAAkG;IAClG,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,IAAY,EAA8B,EAAE;QAC5E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3E,KAAK,CAAC,UAAU,KAAK,CAAC,KAAK,IAAgC,EAAE;YAC3D,yEAAyE;YACzE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,GAAY,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3D,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE;oBACzC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;oBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,UAAU,EAAE,oBAAoB;wBAChC,IAAI;wBACJ,aAAa,EAAE,KAAK,CAAC,QAAQ;wBAC7B,YAAY,EAAE,KAAK,CAAC,WAAW;wBAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;wBACzB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrE,CAAC,CAAC,QAAQ,EAAE;oBACb,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC1E,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,QAAQ,EAAE;oBAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3C,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,2CAA2C,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,IAAI,QAAQ,EAAE;gBAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACjC,OAAO,GAAG,CAAC,KAAK,EAAE;oBAChB,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,GAAG,KAAK,eAAe;wBAC9B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,2EAA2E;wBAC3F,CAAC,CAAC,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,qBAAqB;4BACzD,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,2CAA2C,GAAG,oEAAoE;4BAClI,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,yBAAyB,GAAG,CAAC,MAAM,iBAAiB;iBACzE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1C,IAAI,QAAQ,EAAE;gBAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,sEAAsE,EAAE,CAAC,CAAC;YAChK,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,+DAA+D,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC;YACtJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,GAAG,CAAC,KAAK,EAAE;oBAChB,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,iFAAiF,KAAK,CAAC,KAAK,UAAU;iBAC9H,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAa;gBACzB,OAAO,EAAE,CAAC;gBACV,KAAK,EAAE,OAAO;gBACd,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnH,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,mDAAmD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACzJ,CAAC;YACD,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,KAAK,UAAU,UAAU,CAAC,KAAc,EAAE,GAAoB,EAAE,GAAmB;QACjF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,6CAA6C,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC9H,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,CAAC,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjE,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,8BAA8B,KAAK,CAAC,KAAK,kCAAkC,EAAE,CAAC,CAAC;gBACtH,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,2DAA2D,CAAC,CAAC;YAC1G,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,qFAAqF,CAAC,CAAC;QACvI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC,KAAK,EAAE,EAAE,uEAAuE,CAAC,CAAC;QACpI,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,6BAA6B,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,qEAAqE;YACrE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBACpB,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;YACxB,MAAM,KAAK,GAAY;gBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzC,KAAK,EAAE,UAAU,EAAE;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,EAAE;gBACf,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;gBAC3C,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;gBACzB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;gBAC5B,KAAK,EAAE,IAAI,eAAe,EAAE;aAC7B,CAAC;YACF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACvC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,yDAAyD,CAAC,CAAC,CAAC;YAC1I,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,CAAC,WAAW,GAAG,UAAU,QAAQ,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;YAC1D,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC/H,CAAC,EAAE,cAAc,CAAC,CAAC;YACnB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC;gBAC3B,qBAAqB,EAAE,KAAK,CAAC,QAAQ,CAAC,qBAAqB;gBAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;aAC5C,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;QACpH,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;YAClH,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,IAAY,CAAC;YACjB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,CAAC,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACpF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACjE,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,8BAA8B,KAAK,CAAC,KAAK,kCAAkC,EAAE,CAAC,CAAC;oBAC/H,CAAC;oBACD,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;wBAC9F,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;oBAC3G,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;gBAC7G,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBAC3G,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO;YAC9C,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;YACjH,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,IAAI,KAAK,CAAC,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAiC,EAAE,GAAW,EAAE,MAAc,EAAE,OAA8B,EAAE;YAC1G,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,IAAI,MAAM;oBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC1D,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS;oBAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,CAAC;gBAClF,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;oBAClF,8EAA8E;oBAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBAC/D,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC/D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,IAAI,MAAM,+CAA+C,CAAC,CAAC;gBAClG,CAAC;gBACD,IAAI,GAAG,CAAC;gBACR,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;wBACnC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;wBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;4BACxB,UAAU,EAAE,eAAe;4BAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;4BAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;4BAC1B,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACpF,CAAC,CAAC,QAAQ,EAAE;wBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;wBACnC,QAAQ,EAAE,MAAM;qBACjB,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,oFAAoF,CAAC,CAAC;gBAC9H,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;oBACjC,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,qBAAqB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBAC/G,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;wBAC9I,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBACvC,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,oCAAoC,GAAG,CAAC,MAAM,0CAA0C,CAAC,CAAC;gBAClI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxC,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,uFAAuF,CAAC,CAAC;gBACvJ,MAAM,OAAO,GAAa;oBACxB,GAAG,MAAM;oBACT,KAAK,EAAE,OAAO;oBACd,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY;oBACtD,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAC;gBACF,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9C,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC/D,CAAC,CAAC,EAAE,CAAC;YACL,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG;oBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}