approval-md 0.0.1 → 0.2.0

package/dist/src/core/verified-snapshot.js

@@ -0,0 +1,506 @@
+/**
+ * The verified-head snapshot (APRV-188): what a process that already walked the
+ * log publishes, so the next process does not have to walk it again.
+ *
+ * ## The cost this removes
+ *
+ * Every hook-gated tool call is a fresh process with an empty
+ * {@link VerifiedReadCache}, so it verifies the log from genesis before it may
+ * decide anything. APRV-186 and APRV-206 made that walk as cheap as a walk can
+ * be; what they could not change is that it is O(records) per gated command.
+ * Measured on this repository's shape at 10k records: 65 ms of the 371 ms a
+ * gated invocation costs, growing at 6.5 ms per thousand records, which is the
+ * term that turns into seconds as a log grows. The daemon, meanwhile, holds a
+ * warm cache and re-verifies only the tail on every tick. This module is how
+ * what it verified reaches the next hook process.
+ *
+ * ## Why a file and not a socket
+ *
+ * The hook's request path is synchronous end to end — `commandHook` returns an
+ * exit code, and the wait loop sleeps synchronously — so a `node:net` client
+ * could not be awaited from it, and a `spawnSync` helper to do the awaiting
+ * would cost more node startup (20-40 ms) than the walk it saves. A published
+ * file needs one `readFileSync`. It also spawns no child and opens no socket,
+ * so there is no environment to scrub (APRV-205) and no fd to leak.
+ *
+ * ## What a snapshot is, and what it is emphatically not
+ *
+ * It is an **endorsement of bytes**. It says: *the first `byte_length` bytes of
+ * this log, whose SHA-256 is this, verified clean, and they end at this head.*
+ * It carries no records, and a reader never learns anything from it that it
+ * cannot check against the log file in its own hands. A reader that cannot
+ * re-prove every one of those claims ignores the file and walks the log, which
+ * is the behaviour with no snapshot at all.
+ *
+ * ## Global invariant 1, "enforcement paths read only verified records"
+ *
+ * This is the invariant the module touches, so the argument is written out
+ * rather than assumed. The structure is APRV-43's, with the verifier in another
+ * process:
+ *
+ *  - {@link admitSnapshot} hashes the prefix bytes **it read itself** and
+ *    requires the digest the snapshot names. That is what makes "the bytes the
+ *    publisher verified" and "the bytes on disk now" the same bytes; it is the
+ *    identical proof the in-process cache pays on every cached read, and no
+ *    amount of `stat` substitutes for it.
+ *  - The reader parses the prefix lines itself and re-derives the head and the
+ *    line count from its own parse. A snapshot naming a different head, or a
+ *    different number of lines, is rejected by the reader's own arithmetic.
+ *  - The reader then re-checks the chain links (`alg`, `seq` succession, `prev`
+ *    linkage, hash shape) over those parsed records. This is a deliberate
+ *    SUBSET of `core/verify.ts`'s ladder and never a replacement for it: it can
+ *    only reject. `core/verify.ts` remains the one implementation of the
+ *    verdict, and the appended tail beyond the prefix is walked by it in full.
+ *  - What is therefore taken on the publisher's word is exactly two checks over
+ *    bytes already proved identical: the `event` schema validation and the
+ *    per-record hash recompute.
+ *
+ * **Why that residue is not a new capability.** A snapshot can only endorse
+ * bytes that are already in the log file. To exploit the residue an attacker
+ * must write `verified-head.json`, which sits in the same directory as
+ * `events.jsonl` under the same permissions — and the chain is unkeyed, so an
+ * attacker who can write that directory can simply recompute a self-consistent
+ * forged log, which passes a *cold* walk too. The snapshot grants nothing that
+ * write access to the log directory did not already grant. The ownership and
+ * permission checks in {@link readSnapshot} are what keep that sentence true
+ * under a loose umask: a snapshot any other user could have written is refused
+ * before it is read.
+ *
+ * Fail closed throughout. Every check here can only reject, every rejection
+ * falls back to the cold walk, and nothing in this module can turn a log that
+ * does not verify into a verdict — the reader either proves the prefix or walks
+ * it.
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, openSync, readFileSync, readSync, realpathSync, renameSync, fstatSync, closeSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+/** The snapshot format version. A reader admits exactly this one. */
+export const SNAPSHOT_VERSION = 1;
+/** The hash scheme every record declares; a link check rejects anything else. */
+const ALG = "sha256/jcs";
+const NEWLINE = 0x0a;
+const HEX64 = /^[0-9a-f]{64}$/u;
+/**
+ * Where the snapshot for `logPath` lives: beside the log, named for what it is.
+ *
+ * Derived, never configured. One log has one snapshot, and a reader that had to
+ * be *told* where to look could be pointed at a snapshot for another log — a
+ * mistake the `log` field would catch and that this removes entirely.
+ */
+export function snapshotPathFor(logPath) {
+    return join(dirname(resolve(logPath)), "verified-head.json");
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * The identity of a path, for the "is this the same log" comparison.
+ *
+ * `realpath`, because the publisher and the reader routinely reach one log by
+ * two spellings: a daemon started in `/var/folders/...` and a hook whose `cwd`
+ * Node has already resolved to `/private/var/folders/...` are the same file, and
+ * comparing the spellings would refuse every snapshot on macOS's aliased temp
+ * directories, and anywhere a checkout sits behind a symlink. Both sides call
+ * this, so the aliases collapse together or not at all.
+ *
+ * A path that cannot be resolved (the file is gone) falls back to `resolve`,
+ * which can only make the comparison stricter.
+ */
+function pathIdentity(path) {
+    try {
+        return realpathSync(resolve(path));
+    }
+    catch {
+        return resolve(path);
+    }
+}
+// ---------------------------------------------------------------------------
+// Publishing
+// ---------------------------------------------------------------------------
+/**
+ * What this process last published for a log: the endorsement, not the file.
+ *
+ * A clean read of an unchanged log endorses the same bytes it endorsed last
+ * time, and writing that fact again is a rename into a directory the daemon
+ * itself watches — which schedules a tick, which reads, which publishes
+ * (APRV-211: measured at 18 ticks in 45 seconds with a ten-minute interval and
+ * no external writer). The memo is a **write suppressor and never an admission
+ * rule**: nothing is read from it, no reader is affected by it, and the worst a
+ * stale entry can do is leave a correct snapshot on disk unrewritten.
+ */
+const published = new Map();
+/** Forget what this process published. For tests, and for {@link clearSnapshot}. */
+export function forgetPublishedSnapshots(logPath) {
+    if (logPath === undefined)
+        published.clear();
+    else
+        published.delete(pathIdentity(logPath));
+}
+/**
+ * Publish a snapshot for a log the caller has just verified clean.
+ *
+ * `raw` must be the exact bytes the caller verified, `sha256` their digest,
+ * `head` the head that walk produced and `lines` its record count: this function
+ * checks none of that and cannot — it is the caller's own verification being
+ * published. Every caller is therefore immediately after a `clean` verdict over
+ * these bytes. The digest is a parameter rather than a recomputation because the
+ * caller has just proved it (APRV-206's argument, and APRV-211's measurement:
+ * hashing megabytes twice per read was 45% of a tick).
+ *
+ * The write is atomic (a temp file in the same directory, then `rename`) so a
+ * reader never sees half a snapshot, and mode 0600 so the ownership argument in
+ * the module header holds. Any failure is swallowed: a snapshot is an
+ * optimization, and a daemon must not die because a cache file could not be
+ * written. The return value says whether it landed, for the tests and the
+ * doctor row; `false` also covers "these exact bytes are already published",
+ * which is a write skipped rather than a write that failed.
+ */
+export function publishSnapshot(logPath, raw, digest, lines, head, schemaDir, now = () => new Date().toISOString()) {
+    return publishVerifiedPrefix(logPath, raw.length, raw.length > 0 && raw[raw.length - 1] === NEWLINE, digest, lines, head, schemaDir, now);
+}
+/**
+ * {@link publishSnapshot} for a caller that never held the whole file.
+ *
+ * The incremental read (APRV-217) reads the head line and the appended bytes
+ * and proves the digest from a carried hash state, so it has the two facts this
+ * function needs — how long the verified prefix is and whether it ends at a
+ * line boundary — without a buffer of the log to derive them from. Nothing else
+ * differs: the same suppression memo, the same atomic 0600 write, the same
+ * snapshot fields. `publishSnapshot` is this function with those two facts read
+ * off a buffer.
+ */
+export function publishVerifiedPrefix(logPath, byteLength, endsWithNewline, digest, lines, head, schemaDir, now = () => new Date().toISOString()) {
+    // A prefix that does not end at a line boundary cannot be resumed from, so it
+    // is never published. In practice a clean log always ends with a newline.
+    if (byteLength === 0 || !endsWithNewline)
+        return false;
+    const identity = pathIdentity(logPath);
+    const last = published.get(identity);
+    if (last !== undefined && last.byteLength === byteLength && last.sha256 === digest)
+        return false;
+    const snapshot = {
+        v: SNAPSHOT_VERSION,
+        log: identity,
+        schema_dir: schemaDir === undefined ? "" : pathIdentity(schemaDir),
+        byte_length: byteLength,
+        sha256: digest,
+        lines,
+        head,
+        verified_at: now(),
+        pid: process.pid,
+    };
+    const target = snapshotPathFor(logPath);
+    const temp = `${target}.${String(process.pid)}.tmp`;
+    try {
+        writeFileSync(temp, `${JSON.stringify(snapshot)}\n`, { mode: 0o600 });
+        // Explicit, because `mode` on writeFileSync is masked by the umask and only
+        // applies when the file is created: a temp file left by a previous crash
+        // would otherwise keep whatever mode it had.
+        chmodSync(temp, 0o600);
+        renameSync(temp, target);
+        published.set(identity, { byteLength, sha256: digest });
+        return true;
+    }
+    catch {
+        try {
+            unlinkSync(temp);
+        }
+        catch {
+            // Nothing to clean up, or nothing we may clean up. Either way the
+            // snapshot simply does not exist, which every reader handles.
+        }
+        return false;
+    }
+}
+function reject(reason, detail) {
+    return { ok: false, reason, detail };
+}
+function isPositiveInt(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+/** Strict field-by-field validation. Anything unexpected is a rejection. */
+function parseSnapshot(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (cause) {
+        return reject("malformed", cause instanceof Error ? cause.message : String(cause));
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return reject("malformed", "the snapshot is not a JSON object");
+    }
+    const raw = parsed;
+    if (raw["v"] !== SNAPSHOT_VERSION) {
+        return reject("version", `snapshot version ${JSON.stringify(raw["v"])} is not ${String(SNAPSHOT_VERSION)}`);
+    }
+    if (typeof raw["log"] !== "string" || raw["log"].length === 0) {
+        return reject("malformed", "log is missing or not a string");
+    }
+    if (typeof raw["schema_dir"] !== "string") {
+        return reject("malformed", "schema_dir is missing or not a string");
+    }
+    if (!isPositiveInt(raw["byte_length"])) {
+        return reject("malformed", "byte_length is missing or not a positive integer");
+    }
+    if (typeof raw["sha256"] !== "string" || !HEX64.test(raw["sha256"])) {
+        return reject("malformed", "sha256 is missing or not a 64-character hex digest");
+    }
+    if (!isPositiveInt(raw["lines"])) {
+        return reject("malformed", "lines is missing or not a positive integer");
+    }
+    const head = raw["head"];
+    if (typeof head !== "object" || head === null || Array.isArray(head)) {
+        return reject("malformed", "head is missing or not an object");
+    }
+    const headRecord = head;
+    if (!isPositiveInt(headRecord["seq"])) {
+        return reject("malformed", "head.seq is missing or not a positive integer");
+    }
+    if (typeof headRecord["hash"] !== "string" || !HEX64.test(headRecord["hash"])) {
+        return reject("malformed", "head.hash is missing or not a 64-character hex digest");
+    }
+    return {
+        ok: true,
+        snapshot: {
+            v: SNAPSHOT_VERSION,
+            log: raw["log"],
+            schema_dir: raw["schema_dir"],
+            byte_length: raw["byte_length"],
+            sha256: raw["sha256"],
+            lines: raw["lines"],
+            head: { seq: headRecord["seq"], hash: headRecord["hash"] },
+            verified_at: typeof raw["verified_at"] === "string" ? raw["verified_at"] : "",
+            pid: typeof raw["pid"] === "number" ? raw["pid"] : 0,
+        },
+    };
+}
+/**
+ * Read the snapshot for `logPath`, refusing one this user did not write.
+ *
+ * The ownership and permission checks are taken from the open file descriptor
+ * rather than from the path, so what is checked and what is read are the same
+ * inode: a snapshot swapped between the `stat` and the read cannot be admitted
+ * on the strength of the file that used to be there.
+ */
+export function readSnapshot(logPath) {
+    const path = snapshotPathFor(logPath);
+    let fd;
+    try {
+        fd = openSync(path, "r");
+    }
+    catch (cause) {
+        const code = cause.code;
+        if (code === "ENOENT")
+            return reject("absent", `no snapshot at ${path}`);
+        return reject("unreadable", `snapshot ${path} could not be opened: ${String(code)}`);
+    }
+    try {
+        const stats = fstatSync(fd);
+        if (!stats.isFile())
+            return reject("not-a-file", `${path} is not a regular file`);
+        // Who wrote it. `process.geteuid` is absent on Windows, where the check
+        // cannot be made and the file is refused rather than trusted.
+        const euid = typeof process.geteuid === "function" ? process.geteuid() : null;
+        if (euid === null) {
+            return reject("foreign-owner", "file ownership cannot be established on this platform");
+        }
+        if (stats.uid !== euid) {
+            return reject("foreign-owner", `${path} is owned by uid ${String(stats.uid)}, not by this user (${String(euid)})`);
+        }
+        if ((stats.mode & 0o022) !== 0) {
+            return reject("loose-permissions", `${path} is writable by group or other (mode ${(stats.mode & 0o777).toString(8)})`);
+        }
+        // A snapshot is a few hundred bytes; a huge file here is not one.
+        if (stats.size > 64 * 1024) {
+            return reject("malformed", `${path} is ${String(stats.size)} bytes, far larger than a snapshot`);
+        }
+        const buffer = Buffer.allocUnsafe(stats.size);
+        let read = 0;
+        while (read < stats.size) {
+            const got = readSync(fd, buffer, read, stats.size - read, read);
+            if (got === 0)
+                break;
+            read += got;
+        }
+        if (read !== stats.size)
+            return reject("unreadable", `${path} ended early`);
+        return parseSnapshot(buffer.toString("utf8"));
+    }
+    catch (cause) {
+        return reject("unreadable", cause instanceof Error ? cause.message : String(cause));
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch {
+            // Already closed; nothing to release.
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Admission
+// ---------------------------------------------------------------------------
+/**
+ * The chain links, re-checked over records the reader parsed itself.
+ *
+ * A SUBSET of `core/verify.ts`'s ladder — `alg`, the shape of `hash`, `seq`
+ * succession from 1, and `prev` linkage — and never a substitute for it. It can
+ * only reject, it is not consulted for any verdict, and everything it does not
+ * check (the `event` schema, the per-record hash recompute) is the residue the
+ * module header accounts for. It costs about a millisecond at ten thousand
+ * records and turns a buggy or stale publisher into a fallback rather than into
+ * a bad read.
+ */
+function linksHold(records, expected) {
+    let previousHash = null;
+    for (const [index, record] of records.entries()) {
+        const seq = index + 1;
+        const raw = record;
+        if (raw["alg"] !== ALG) {
+            return `record ${String(seq)} declares alg ${JSON.stringify(raw["alg"])}, not ${ALG}`;
+        }
+        if (typeof raw["hash"] !== "string" || !HEX64.test(raw["hash"])) {
+            return `record ${String(seq)} has no 64-character hex hash`;
+        }
+        if (raw["seq"] !== seq) {
+            return `record at position ${String(seq)} declares seq ${JSON.stringify(raw["seq"])}`;
+        }
+        const prev = raw["prev"];
+        if (previousHash === null) {
+            if (prev !== null)
+                return "the first record does not have a null prev";
+        }
+        else if (prev !== previousHash) {
+            return `record ${String(seq)} prev does not link to record ${String(seq - 1)}`;
+        }
+        previousHash = raw["hash"];
+    }
+    const last = records[records.length - 1];
+    if (last === undefined)
+        return "the prefix holds no records";
+    if (last.seq !== expected.seq || last.hash !== expected.hash) {
+        return `the prefix ends at seq ${String(last.seq)}, not at the claimed head seq ${String(expected.seq)}`;
+    }
+    return null;
+}
+/**
+ * Decide whether `snapshot` may stand for the first bytes of `raw`, and return
+ * the {@link VerifiedPrefix} a resumed walk chains onto when it may.
+ *
+ * `raw` is the caller's own read of the whole log. Every check below is made
+ * against those bytes; nothing is re-`stat`ed, re-read, or taken from the
+ * snapshot without being re-derived. The order is cheapest-first, but only the
+ * digest is load-bearing — everything before it rejects an obviously
+ * inapplicable snapshot without hashing megabytes, and everything after it
+ * re-derives from the reader's own parse what the snapshot merely claimed.
+ */
+export function admitSnapshot(logPath, raw, snapshot, schemaDir) {
+    const identity = pathIdentity(logPath);
+    if (snapshot.log !== identity) {
+        return reject("other-log", `the snapshot describes ${snapshot.log}, not ${identity}`);
+    }
+    const schemaKey = schemaDir === undefined ? "" : pathIdentity(schemaDir);
+    if (snapshot.schema_dir !== schemaKey) {
+        return reject("other-schema-dir", `the snapshot was verified against schemas in ${JSON.stringify(snapshot.schema_dir)}, this read uses ${JSON.stringify(schemaKey)}`);
+    }
+    // The log is append-only: a file shorter than the endorsed prefix cannot
+    // contain it, and must be walked cold so the head reported is the file's own.
+    if (raw.length < snapshot.byte_length) {
+        return reject("shorter-file", `the log is ${String(raw.length)} bytes, shorter than the endorsed prefix of ${String(snapshot.byte_length)}`);
+    }
+    if (raw[snapshot.byte_length - 1] !== NEWLINE) {
+        return reject("not-line-aligned", "the endorsed prefix does not end at a line boundary");
+    }
+    // The proof.
+    const digest = sha256(raw.subarray(0, snapshot.byte_length));
+    if (digest !== snapshot.sha256) {
+        return reject("digest-mismatch", "the log's first bytes are not the bytes the snapshot endorses");
+    }
+    // Everything from here is re-derived from the reader's own parse of those
+    // bytes. A snapshot that lied about the head or the record count is caught
+    // here, by arithmetic, not by trust.
+    const text = Buffer.from(raw.buffer, raw.byteOffset, snapshot.byte_length).toString("utf8");
+    const records = [];
+    let start = 0;
+    for (;;) {
+        const newline = text.indexOf("\n", start);
+        if (newline < 0)
+            break;
+        const line = text.slice(start, newline);
+        start = newline + 1;
+        if (line.trim().length === 0)
+            return reject("malformed", "the endorsed prefix holds a blank line");
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch (cause) {
+            return reject("malformed", `line ${String(records.length + 1)} of the endorsed prefix is not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            return reject("malformed", `line ${String(records.length + 1)} of the endorsed prefix is not a JSON object`);
+        }
+        records.push(value);
+    }
+    if (records.length !== snapshot.lines) {
+        return reject("line-count-mismatch", `the endorsed prefix holds ${String(records.length)} lines, not the ${String(snapshot.lines)} claimed`);
+    }
+    const broken = linksHold(records, snapshot.head);
+    if (broken !== null) {
+        // A head that does not match what the bytes say is the signature of a
+        // publisher serving something other than what it verified.
+        const reason = broken.includes("claimed head") ? "head-mismatch" : "chain-broken";
+        return reject(reason, broken);
+    }
+    return {
+        ok: true,
+        digest,
+        prefix: {
+            byteLength: snapshot.byte_length,
+            lines: snapshot.lines,
+            head: snapshot.head,
+            records,
+        },
+    };
+}
+/**
+ * {@link readSnapshot} then {@link admitSnapshot}: the whole path a reader takes.
+ *
+ * Returns the prefix to resume behind, or the reason there is none. Every reason
+ * means "walk the log", which is what the caller does with no snapshot at all.
+ */
+export function snapshotPrefix(logPath, raw, schemaDir) {
+    const read = readSnapshot(logPath);
+    if (!read.ok)
+        return read;
+    return admitSnapshot(logPath, raw, read.snapshot, schemaDir);
+}
+/** Read the snapshot's own text, for the doctor row. Never throws. */
+export function snapshotSummary(logPath) {
+    return readSnapshot(logPath);
+}
+/** Remove a snapshot. Used by tests and by anything that invalidates one. */
+export function clearSnapshot(logPath) {
+    // The memo describes a file; removing the file removes what it described, and
+    // the next clean read must publish again rather than believe this process's
+    // own bookkeeping.
+    forgetPublishedSnapshots(logPath);
+    try {
+        unlinkSync(snapshotPathFor(logPath));
+    }
+    catch {
+        // Absent is the desired state.
+    }
+}
+/** Read the log's bytes, for callers that want the same view a reader admits. */
+export function logBytes(logPath) {
+    try {
+        return readFileSync(logPath);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=verified-snapshot.js.map

package/dist/src/core/verified-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-snapshot.js","sourceRoot":"","sources":["../../../src/core/verified-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKnD,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,iFAAiF;AACjF,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,MAAM,KAAK,GAAG,iBAAiB,CAAC;AA8BhC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkD,CAAC;AAE5E,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,SAAS,CAAC,KAAK,EAAE,CAAC;;QACxC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,GAAe,EACf,MAAc,EACd,KAAa,EACb,IAAa,EACb,SAA6B,EAC7B,GAAG,GAAiB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,OAAO,qBAAqB,CAC1B,OAAO,EACP,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,EACjD,MAAM,EACN,KAAK,EACL,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,UAAkB,EAClB,eAAwB,EACxB,MAAc,EACd,KAAa,EACb,IAAa,EACb,SAA6B,EAC7B,GAAG,GAAiB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,UAAU,KAAK,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEjG,MAAM,QAAQ,GAAqB;QACjC,CAAC,EAAE,gBAAgB;QACnB,GAAG,EAAE,QAAQ;QACb,UAAU,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC;QAClE,WAAW,EAAE,UAAU;QACvB,MAAM,EAAE,MAAM;QACd,KAAK;QACL,IAAI;QACJ,WAAW,EAAE,GAAG,EAAE;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;IAEF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,4EAA4E;QAC5E,yEAAyE;QACzE,6CAA6C;QAC7C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,8DAA8D;QAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoCD,SAAS,MAAM,CAAC,MAAuB,EAAE,MAAc;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,SAAS,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,EAAE,kDAAkD,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,WAAW,EAAE,oDAAoD,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,UAAU,GAAG,IAA+B,CAAC;IACnD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,WAAW,EAAE,uDAAuD,CAAC,CAAC;IACtF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,CAAC,EAAE,gBAAgB;YACnB,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;YACf,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC;YAC7B,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;YAC/B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;YACrB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC;YACnB,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;YAC1D,WAAW,EAAE,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;YAC7E,GAAG,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,YAAY,EAAE,YAAY,IAAI,yBAAyB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,OAAO,MAAM,CAAC,YAAY,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;QAElF,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,MAAM,CACX,eAAe,EACf,GAAG,IAAI,oBAAoB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,MAAM,CACX,mBAAmB,EACnB,GAAG,IAAI,wCAAwC,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CACnF,CAAC;QACJ,CAAC;QACD,kEAAkE;QAClE,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,WAAW,EAAE,GAAG,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,CAAC;gBAAE,MAAM;YACrB,IAAI,IAAI,GAAG,CAAC;QACd,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,YAAY,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;QAC5E,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,OAA+B,EAAE,QAAiB;IACnE,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAA4C,CAAC;QACzD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,UAAU,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,UAAU,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC;QAC9D,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,sBAAsB,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,4CAA4C,CAAC;QACzE,CAAC;aAAM,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,MAAM,CAAC,GAAG,CAAC,iCAAiC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QACjF,CAAC;QACD,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,6BAA6B,CAAC;IAC7D,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7D,OAAO,0BAA0B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAcD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,GAAe,EACf,QAA0B,EAC1B,SAA6B;IAE7B,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,EAAE,0BAA0B,QAAQ,CAAC,GAAG,SAAS,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CACX,kBAAkB,EAClB,gDAAgD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACnI,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,MAAM,CACX,cAAc,EACd,cAAc,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,+CAA+C,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAC9G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,kBAAkB,EAAE,qDAAqD,CAAC,CAAC;IAC3F,CAAC;IAED,aAAa;IACb,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,iBAAiB,EAAE,+DAA+D,CAAC,CAAC;IACpG,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,GAAG,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;QACnG,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CACX,WAAW,EACX,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,8CAChC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,WAAW,EAAE,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,8CAA8C,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAoB,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtC,OAAO,MAAM,CACX,qBAAqB,EACrB,6BAA6B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAoB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QACnG,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,MAAM,EAAE;YACN,UAAU,EAAE,QAAQ,CAAC,WAAW;YAChC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO;SACR;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,GAAe,EACf,SAA6B;IAE7B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,8EAA8E;IAC9E,4EAA4E;IAC5E,mBAAmB;IACnB,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}