approval-md 0.3.0 → 0.4.1

package/dist/src/channels/telegram-webhook.js

@@ -0,0 +1,536 @@
+/**
+ * The Telegram webhook receiver (SPEC.md §10.3, APRV-424).
+ *
+ * §10.3 has always written the channel interface as `notify(request) ->
+ * delivery_id`, `poll()/webhook() -> decision`. Until this task only the first
+ * half of the second clause existed: the Telegram channel long-polled
+ * `getUpdates`, which needs one always-running process per bot and forbids a
+ * second poller on the same token. This is the other half. Telegram posts each
+ * update to a URL the runtime registered, and a host that sleeps between
+ * requests can therefore serve a gate.
+ *
+ * ## It decides nothing, and it barely reads
+ *
+ * This file checks one header, one path, one method and one body size, parses
+ * JSON, and hands the object to {@link TelegramChannel.deliverUpdate}. Which
+ * account the Bot API attributed the tap to, which approver the attested
+ * policy maps that account to, whether the gate will take the answer, and what
+ * the message is edited to say afterwards are all decided exactly where they
+ * were decided before this task existed — in `channels/telegram.ts`'s
+ * `handleUpdate` and in `channels/contract.ts`'s `recordChannelDecision`,
+ * reached by the same call the poll loop makes. An update that arrives here is
+ * an update; it is not evidence about itself.
+ *
+ * ## The secret is the whole of the authentication
+ *
+ * A webhook URL is a public endpoint. Anyone who can route to it can POST a
+ * JSON object that LOOKS like a tap from the approver's chat, and nothing in
+ * the body could tell the difference: SPEC.md §11.1 invariant 4 — a
+ * self-reported field never reduces scrutiny — is exactly the rule that makes
+ * a body-only check worthless here. So Telegram's own `secret_token` is
+ * REQUIRED rather than optional. It is set on `setWebhook`, echoed on every
+ * delivery in `X-Telegram-Bot-Api-Secret-Token`, compared here in constant
+ * time, and a post without the matching value is refused before its path, its
+ * method or its body is looked at.
+ *
+ * Three consequences, each deliberate:
+ *
+ * - **The comparison is over SHA-256 digests under `timingSafeEqual`**, which
+ *   is constant-time AND length-independent (`timingSafeEqual` throws on a
+ *   length mismatch, which would itself be an oracle for the secret's length).
+ *   `serve/credentials.ts` states the same argument for the same reason.
+ * - **Duplicate headers are refused rather than resolved.** Node joins
+ *   repeated headers, so two of them would make the value this server compares
+ *   differ from the one a reader of the request would name. There is no
+ *   correct choice; the request is malformed.
+ * - **A refusal appends NOTHING to the log.** It is counted, complained about
+ *   on the runner's stderr and answered with its own machine-readable code,
+ *   and it never reaches the decision path. This is `TELEGRAM_ANOMALY_KINDS`'s
+ *   rule, and it matters more here than it does there: writing "somebody
+ *   posted a forgery" into an append-only approval log would let anyone who
+ *   can reach this URL grow the record a human is asked to trust. A refusal is
+ *   a fact about this transport, and this transport reports it where facts
+ *   about transports belong.
+ *
+ * ## What is reused from `approval serve`, and what could not be
+ *
+ * The shape is APRV-421's, deliberately: loopback bind by default with the
+ * operator's proxy terminating TLS, the credential checked before the URL is
+ * parsed, a refusal carried as a body with a frozen code rather than as a bare
+ * status, an oversized body drained before the refusal is written (a response
+ * written while the client is still uploading closes the socket under it), and
+ * no state a restart loses.
+ *
+ * Its CODE could not be reused, and the reason is structural rather than
+ * stylistic. `src/serve/` imports `src/cli/`, which imports `src/channels/`;
+ * an import from here back into `src/serve/` would close an ESM cycle, which
+ * is not a compile error but a binding that is `undefined` in one direction on
+ * the day module initialisation order changes. `tests/layering.test.ts` pins
+ * that direction. The two servers are also different surfaces: that one
+ * answers two bearer credentials for two parties across six routes, this one
+ * answers Telegram's echoed secret on one.
+ *
+ * ## One update at a time
+ *
+ * Deliveries are serialized through a promise chain. `handleUpdate` keeps a
+ * single callback-query ack slot and the delivery maps are plain `Map`s, so
+ * two updates handled concurrently would interleave in ways nobody ordered.
+ * The poll loop gets this for free by awaiting each update in turn; an HTTP
+ * server has to say it.
+ *
+ * ## Stopping waits for the update it is holding
+ *
+ * A stop closes the listener, drains what is in flight, and only then drops
+ * the sockets. The first version of this file did the opposite — it destroyed
+ * every socket synchronously and resolved in about a millisecond — so
+ * `deleteWebhook`, the "stopped" line and the process's exit all ran while an
+ * update was still being handled: an append in progress, a dispatch cycle
+ * halfway through a send, and a caller whose response never arrived. The order
+ * is now stop accepting, drain, drop, and the verb's own stop path does its
+ * `deleteWebhook` after this resolves rather than beside it.
+ *
+ * ## Redelivery is safe because the gate is
+ *
+ * Telegram retries a delivery it did not get a 2xx for, so the same tap can
+ * arrive twice. Nothing here deduplicates, and nothing needs to: the second
+ * one reaches `decide()` through the same path as the first and is refused
+ * `already-decided` with the first human answer standing. That is the same
+ * property a button pressed twice has had since APRV-26.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+/**
+ * The header Telegram echoes the `secret_token` in, lowercased as Node
+ * presents it.
+ */
+export const TELEGRAM_SECRET_HEADER = "x-telegram-bot-api-secret-token";
+/** The path this server answers when the operator names none. */
+export const TELEGRAM_WEBHOOK_DEFAULT_PATH = "/telegram/webhook";
+/** The interface it binds when the operator names none. Loopback, always. */
+export const TELEGRAM_WEBHOOK_DEFAULT_HOST = "127.0.0.1";
+/** The port it binds when the operator names none. */
+export const TELEGRAM_WEBHOOK_DEFAULT_PORT = 4683;
+/**
+ * Largest body accepted. A Telegram update is a small JSON object; the
+ * largest thing one can carry is a message's 4096-character text.
+ */
+export const TELEGRAM_WEBHOOK_MAX_BODY_BYTES = 256 * 1024;
+/**
+ * How much of an oversized body is read and thrown away before the socket is
+ * dropped. `serve/server.ts` carries the argument: the refusal cannot be
+ * written until the client stops writing, or the response closes the socket
+ * under it and the caller sees a transport error instead of a refusal.
+ */
+export const TELEGRAM_WEBHOOK_DRAIN_LIMIT_BYTES = 4 * 1024 * 1024;
+/**
+ * How long {@link TelegramWebhookHandle.close} waits for requests already in
+ * flight before it destroys their sockets (APRV-424, review finding 2).
+ *
+ * A stop has to end. What this bounds is the pathological case — a client that
+ * opened a request and stopped writing, a handler that will never return — and
+ * not the ordinary one, which is an update whose decision is being appended
+ * and takes milliseconds. The ordinary one is what the drain exists for: the
+ * first version of this file destroyed every socket synchronously and
+ * resolved in about a millisecond, so `deleteWebhook`, the "stopped" line and
+ * the process's exit all happened while an append and a dispatch were still
+ * running.
+ */
+export const TELEGRAM_WEBHOOK_CLOSE_TIMEOUT_MS = 10_000;
+/** How long the close drain waits between checks of the in-flight count. */
+export const TELEGRAM_WEBHOOK_DRAIN_POLL_MS = 5;
+/**
+ * Everything this receiver refuses, and nothing else. Frozen, per SPEC.md
+ * §11.1 invariant 6: a refusal is machine-readable and distinct.
+ *
+ * Distinct because the repairs are distinct. A secret mismatch is a forgery or
+ * a rotation the registration did not follow; an unknown path is a URL that
+ * does not match the one registered; a body too large is a caller that is not
+ * Telegram. None of them is a decision, and none of them is the same fact.
+ */
+export const TELEGRAM_WEBHOOK_REFUSAL_CODES = [
+    /** No `X-Telegram-Bot-Api-Secret-Token`, or one that is not the registered value. */
+    "webhook-secret-mismatch",
+    /** More than one secret header. Malformed, and not resolvable by choosing. */
+    "webhook-duplicate-secret-header",
+    /**
+     * The request line and the `Host` header do not form a URL (400).
+     *
+     * Split from `webhook-unknown-path` in the review of this task: one code for
+     * both collapsed "what arrived is not a request this server can parse" into
+     * "you are posting to a path this server does not serve", and those two
+     * share nothing but a status family — the first is a broken proxy or a
+     * hand-written client, the second is a registration that does not match the
+     * bind. `src/serve/server.ts` makes the same split, between
+     * `serve-malformed-url` and `serve-unknown-path`.
+     */
+    "webhook-malformed-request",
+    /** A path this server does not serve (404). */
+    "webhook-unknown-path",
+    /** The right path, the wrong method. Telegram POSTs. */
+    "webhook-method-not-allowed",
+    /** Larger than {@link TELEGRAM_WEBHOOK_MAX_BODY_BYTES}. */
+    "webhook-body-too-large",
+    /** The body could not be read off the socket, or is not JSON. */
+    "webhook-body-unreadable",
+    /** JSON that is not an Update object. */
+    "webhook-not-an-update",
+    /** The channel is already receiving updates by the other transport. */
+    "webhook-transport-conflict",
+    /** The channel threw while handling the update. Nothing is claimed about the log. */
+    "webhook-handler-failed",
+];
+function emptyRefusals() {
+    return {
+        "webhook-secret-mismatch": 0,
+        "webhook-duplicate-secret-header": 0,
+        "webhook-malformed-request": 0,
+        "webhook-unknown-path": 0,
+        "webhook-method-not-allowed": 0,
+        "webhook-body-too-large": 0,
+        "webhook-body-unreadable": 0,
+        "webhook-not-an-update": 0,
+        "webhook-transport-conflict": 0,
+        "webhook-handler-failed": 0,
+    };
+}
+function digest(value) {
+    return createHash("sha256").update(value, "utf8").digest();
+}
+/**
+ * Is `offered` the registered secret?
+ *
+ * Both sides are hashed first, so the comparison is over two equal-length
+ * buffers and `timingSafeEqual` can never throw — which is what keeps the
+ * length of the real secret out of the answer.
+ */
+export function secretMatches(expected, offered) {
+    if (offered === null)
+        return false;
+    return timingSafeEqual(digest(expected), digest(offered));
+}
+/**
+ * The one secret header a request offered, `null` for none, and `"duplicate"`
+ * for more than one.
+ *
+ * Read off `rawHeaders` rather than `headers`, because Node joins repeats of a
+ * non-special header into one comma-separated value and the join is exactly
+ * what hides the second one.
+ */
+export function secretHeaderOf(rawHeaders) {
+    const values = [];
+    for (let index = 0; index + 1 < rawHeaders.length; index += 2) {
+        const name = rawHeaders[index];
+        if (name !== undefined && name.toLowerCase() === TELEGRAM_SECRET_HEADER) {
+            values.push(rawHeaders[index + 1] ?? "");
+        }
+    }
+    if (values.length === 0)
+        return null;
+    if (values.length > 1)
+        return "duplicate";
+    return values[0] ?? "";
+}
+/** Read one request body, bounded, draining an oversized one before refusing. */
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    let oversized = false;
+    const tooLarge = {
+        ok: false,
+        code: "webhook-body-too-large",
+        message: `request body exceeds ${String(TELEGRAM_WEBHOOK_MAX_BODY_BYTES)} bytes`,
+    };
+    try {
+        for await (const chunk of req) {
+            const buffer = chunk;
+            size += buffer.length;
+            if (size > TELEGRAM_WEBHOOK_MAX_BODY_BYTES) {
+                // Discarded as it arrives rather than returned here: a response
+                // written while the client is still uploading closes the socket under
+                // it, and a caller that got a transport error has no refusal to read.
+                // Bounded twice over — past the drain limit the socket is simply
+                // dropped, because a caller that streams forever is not owed a polite
+                // answer.
+                oversized = true;
+                chunks.length = 0;
+                if (size > TELEGRAM_WEBHOOK_DRAIN_LIMIT_BYTES) {
+                    req.destroy();
+                    break;
+                }
+                continue;
+            }
+            chunks.push(buffer);
+        }
+        if (oversized)
+            return tooLarge;
+    }
+    catch (cause) {
+        if (oversized)
+            return tooLarge;
+        return {
+            ok: false,
+            code: "webhook-body-unreadable",
+            message: cause instanceof Error ? cause.message : String(cause),
+        };
+    }
+    return { ok: true, text: Buffer.concat(chunks).toString("utf8") };
+}
+/**
+ * Start the receiver. Resolves once it is bound and its real port is known;
+ * rejects when the bind fails, so the verb can report it and exit.
+ *
+ * The channel's transport is claimed BEFORE the listener exists, for the
+ * reason `approval serve` settles its credentials first: a server that bound
+ * and then discovered it could not receive would be a server Telegram had
+ * already posted to.
+ */
+export async function serveTelegramWebhook(options) {
+    const claim = options.channel.claimTransport("webhook");
+    if (!claim.ok)
+        throw new Error(claim.message);
+    const path = options.path ?? TELEGRAM_WEBHOOK_DEFAULT_PATH;
+    const host = options.host ?? TELEGRAM_WEBHOOK_DEFAULT_HOST;
+    const complain = options.log ??
+        ((message) => {
+            process.stderr.write(`${message}\n`);
+        });
+    const stats = { requests: 0, updates: 0, refusals: emptyRefusals() };
+    const sockets = new Set();
+    /**
+     * Requests accepted and not yet answered.
+     *
+     * The serialize queue alone is not the whole of "busy": a request that is
+     * still having its body read off the socket, or one whose refusal has been
+     * decided and not yet written, is on no queue and would be torn off by a
+     * socket destroy. So the drain waits for this to reach zero as well.
+     */
+    let inFlight = 0;
+    let closed = null;
+    // One update at a time, for the reason the module doc gives: `handleUpdate`
+    // holds a single ack slot and the delivery maps are not reentrant. A plain
+    // promise chain, because the ordering wanted is arrival order and nothing
+    // cleverer.
+    let queue = Promise.resolve();
+    function serialize(work) {
+        const next = queue.then(work, work);
+        queue = next.then(() => undefined, () => undefined);
+        return next;
+    }
+    function send(res, status, body) {
+        const bytes = Buffer.from(JSON.stringify(body), "utf8");
+        res.writeHead(status, { "content-type": "application/json", "content-length": bytes.length });
+        res.end(bytes);
+    }
+    /**
+     * A refusal: counted, said on stderr, and answered with its code.
+     *
+     * Never an event. See the module doc: an unauthenticated endpoint that could
+     * append would be an endpoint anybody could use to pad the log.
+     */
+    function refuse(res, status, code, message) {
+        stats.refusals[code] += 1;
+        complain(`approval: telegram webhook refused a post (${code}): ${message}`);
+        send(res, status, { error: { code, message } });
+    }
+    const http = createServer((req, res) => {
+        void (async () => {
+            stats.requests += 1;
+            inFlight += 1;
+            try {
+                // THE SECRET FIRST, before the path, the method or the body. A caller
+                // without it learns only that something refused: no path is confirmed
+                // to exist, no method is named, and no body is read off the socket.
+                const offered = secretHeaderOf(req.rawHeaders);
+                if (offered === "duplicate") {
+                    refuse(res, 401, "webhook-duplicate-secret-header", `this request carries more than one ${TELEGRAM_SECRET_HEADER} header. Exactly one is accepted: where there are several, the one this server would check is not the one a reader of the request would name`);
+                    return;
+                }
+                if (!secretMatches(options.secret, offered)) {
+                    refuse(res, 401, "webhook-secret-mismatch", offered === null
+                        ? `no ${TELEGRAM_SECRET_HEADER} header. Every delivery Telegram makes to this URL carries the secret_token the runtime registered; a post without it decides nothing, and is counted and reported here as a refusal rather than written to the log`
+                        : `the ${TELEGRAM_SECRET_HEADER} header is not the registered secret_token. No decision reached the gate, and nothing was appended`);
+                    return;
+                }
+                let url;
+                try {
+                    url = new URL(req.url ?? "/", `http://${req.headers.host ?? host}`);
+                }
+                catch {
+                    refuse(res, 400, "webhook-malformed-request", "the request line and Host header do not form a URL this server can parse");
+                    return;
+                }
+                if (url.pathname !== path) {
+                    refuse(res, 404, "webhook-unknown-path", `no endpoint at ${url.pathname}`);
+                    return;
+                }
+                const method = req.method ?? "GET";
+                if (method !== "POST") {
+                    refuse(res, 405, "webhook-method-not-allowed", `${path} answers POST, not ${method}`);
+                    return;
+                }
+                const body = await readBody(req);
+                if (!body.ok) {
+                    refuse(res, body.code === "webhook-body-too-large" ? 413 : 400, body.code, body.message);
+                    return;
+                }
+                let parsed;
+                try {
+                    parsed = JSON.parse(body.text);
+                }
+                catch (cause) {
+                    refuse(res, 400, "webhook-body-unreadable", `request body is not JSON: ${cause instanceof Error ? cause.message : String(cause)}`);
+                    return;
+                }
+                if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+                    refuse(res, 400, "webhook-not-an-update", "request body is not a Telegram Update object");
+                    return;
+                }
+                // Handled BEFORE the response, deliberately. Telegram retries a
+                // delivery it got no 2xx for, and answering first would mean the retry
+                // raced the gate rather than finding a decided request; the redelivery
+                // that does happen is refused `already-decided` with the first human
+                // answer standing.
+                let result;
+                try {
+                    result = await serialize(async () => {
+                        const handled = await options.channel.deliverUpdate(parsed);
+                        stats.updates += handled.updates;
+                        if (options.afterUpdate !== undefined) {
+                            try {
+                                await options.afterUpdate(handled);
+                            }
+                            catch (cause) {
+                                complain(`approval: telegram webhook: the dispatch cycle after an update failed (${cause instanceof Error ? cause.message : String(cause)}); the update was handled and the listener is still up`);
+                            }
+                        }
+                        return handled;
+                    });
+                }
+                catch (cause) {
+                    // The channel threw. Whatever the gate appended has already
+                    // happened, so this says where to look rather than what happened —
+                    // the wording `TELEGRAM_HANDLER_FAILED` uses, for the same reason.
+                    const message = cause instanceof Error ? cause.message : String(cause);
+                    // `in` rather than a property read, so a thrown null or a thrown
+                    // string cannot turn this diagnostic into a second failure.
+                    const conflict = typeof cause === "object" &&
+                        cause !== null &&
+                        "code" in cause &&
+                        cause.code === "transport-conflict";
+                    refuse(res, conflict ? 409 : 500, conflict ? "webhook-transport-conflict" : "webhook-handler-failed", message);
+                    return;
+                }
+                send(res, 200, {
+                    ok: true,
+                    updates: result.updates,
+                    decisions: result.outcomes.length,
+                    ignored: result.ignored.length,
+                });
+            }
+            catch (cause) {
+                if (!res.headersSent) {
+                    refuse(res, 500, "webhook-handler-failed", `the request failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+                }
+                else {
+                    res.end();
+                }
+            }
+            finally {
+                inFlight -= 1;
+            }
+        })();
+    });
+    http.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+    });
+    await new Promise((settle, fail) => {
+        const onError = (cause) => fail(cause);
+        http.once("error", onError);
+        http.listen(options.port ?? TELEGRAM_WEBHOOK_DEFAULT_PORT, host, () => {
+            http.off("error", onError);
+            settle();
+        });
+    });
+    const address = http.address();
+    const boundPort = typeof address === "object" && address !== null
+        ? address.port
+        : (options.port ?? TELEGRAM_WEBHOOK_DEFAULT_PORT);
+    const boundHost = typeof address === "object" && address !== null ? address.address : host;
+    /**
+     * Wait for the work already accepted, bounded.
+     *
+     * Two things are waited on, and both are needed. `serialize` empties the
+     * update queue, which is where a `deliverUpdate` and the dispatch cycle that
+     * follows it run; `inFlight` covers the rest of a request's life, from the
+     * body read to the byte the response ends with. A request that never
+     * finishes is what the deadline is for: past it the sockets go, because a
+     * stop that could be held open forever is not a stop.
+     */
+    async function drain(timeoutMs) {
+        const deadline = Date.now() + timeoutMs;
+        const giveUp = () => {
+            complain(`approval: telegram webhook: ${String(inFlight)} request(s) were still in flight after ${String(timeoutMs)}ms; closing anyway`);
+        };
+        for (;;) {
+            const remaining = deadline - Date.now();
+            // Giving up leaves a pending handler where it is. Nothing holds the
+            // event loop open for it (the sockets are destroyed below, and both
+            // timers here are unref'd), and `cli.js` sets `process.exitCode` rather
+            // than calling `process.exit()`, so the process ends by the normal path
+            // once the loop drains rather than being cut off mid-write.
+            if (remaining <= 0)
+                return giveUp();
+            // The deadline covers the QUEUE WAIT as well, and that is not a detail:
+            // a handler that never returns leaves work on the serialize chain
+            // forever, so a drain that simply awaited the chain would be the hang it
+            // was meant to bound.
+            const quiet = await Promise.race([
+                serialize(async () => true),
+                new Promise((settle) => {
+                    setTimeout(() => settle(false), remaining).unref?.();
+                }),
+            ]);
+            if (!quiet)
+                return giveUp();
+            if (inFlight === 0)
+                return;
+            await new Promise((settle) => {
+                setTimeout(settle, TELEGRAM_WEBHOOK_DRAIN_POLL_MS).unref?.();
+            });
+        }
+    }
+    async function stop() {
+        // 1. Stop accepting. `close` refuses new connections at once and calls
+        //    back only once every existing one is gone, so the callback is the
+        //    thing to await and not the thing to race.
+        const accepted = new Promise((settle) => {
+            http.close(() => settle());
+        });
+        // 2. Let what is in flight finish. This is the whole of the fix: an update
+        //    mid-append keeps its socket, writes its response, and only then is
+        //    anything torn down — so `deleteWebhook` and the "stopped" line, which
+        //    the caller runs after this resolves, cannot land inside an append.
+        await drain(options.closeTimeoutMs ?? TELEGRAM_WEBHOOK_CLOSE_TIMEOUT_MS);
+        // 3. Now the idle ones. A keep-alive socket with nothing on it would hold
+        //    the callback above open until its own timeout, which is a stop that
+        //    looks like a hang.
+        for (const socket of sockets)
+            socket.destroy();
+        sockets.clear();
+        await accepted;
+    }
+    return {
+        host: boundHost,
+        port: boundPort,
+        path,
+        stats: () => ({ ...stats, refusals: { ...stats.refusals } }),
+        serialize,
+        inFlight: () => inFlight,
+        close: () => {
+            closed ??= stop();
+            return closed;
+        },
+    };
+}
+//# sourceMappingURL=telegram-webhook.js.map

package/dist/src/channels/telegram-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-webhook.js","sourceRoot":"","sources":["../../../src/channels/telegram-webhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAKjG;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AAExE,iEAAiE;AACjE,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,WAAW,CAAC;AAEzD,sDAAsD;AACtD,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAExD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,qFAAqF;IACrF,yBAAyB;IACzB,8EAA8E;IAC9E,iCAAiC;IACjC;;;;;;;;;;OAUG;IACH,2BAA2B;IAC3B,+CAA+C;IAC/C,sBAAsB;IACtB,wDAAwD;IACxD,4BAA4B;IAC5B,2DAA2D;IAC3D,wBAAwB;IACxB,iEAAiE;IACjE,yBAAyB;IACzB,yCAAyC;IACzC,uBAAuB;IACvB,uEAAuE;IACvE,4BAA4B;IAC5B,qFAAqF;IACrF,wBAAwB;CAChB,CAAC;AAyEX,SAAS,aAAa;IACpB,OAAO;QACL,yBAAyB,EAAE,CAAC;QAC5B,iCAAiC,EAAE,CAAC;QACpC,2BAA2B,EAAE,CAAC;QAC9B,sBAAsB,EAAE,CAAC;QACzB,4BAA4B,EAAE,CAAC;QAC/B,wBAAwB,EAAE,CAAC;QAC3B,yBAAyB,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;QAC1B,4BAA4B,EAAE,CAAC;QAC/B,wBAAwB,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAsB;IACpE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,UAA6B;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,sBAAsB,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAMD,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,QAAQ,GAAa;QACzB,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,wBAAwB,MAAM,CAAC,+BAA+B,CAAC,QAAQ;KACjF,CAAC;IACF,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAe,CAAC;YAC/B,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;YACtB,IAAI,IAAI,GAAG,+BAA+B,EAAE,CAAC;gBAC3C,gEAAgE;gBAChE,sEAAsE;gBACtE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,UAAU;gBACV,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClB,IAAI,IAAI,GAAG,kCAAkC,EAAE,CAAC;oBAC9C,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM;gBACR,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,SAAS;YAAE,OAAO,QAAQ,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,6BAA6B,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,6BAA6B,CAAC;IAC3D,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG;QACX,CAAC,CAAC,OAAe,EAAQ,EAAE;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IAEL,MAAM,KAAK,GAAyB,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC;;;;;;;OAOG;IACH,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAyB,IAAI,CAAC;IAExC,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,YAAY;IACZ,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,SAAS,SAAS,CAAI,IAAsB;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,GAAG,IAAI,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,SAAS,MAAM,CACb,GAAmB,EACnB,MAAc,EACd,IAAgC,EAChC,OAAe;QAEf,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,QAAQ,CAAC,8CAA8C,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,CAAC;gBACH,sEAAsE;gBACtE,sEAAsE;gBACtE,oEAAoE;gBACpE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC/C,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;oBAC5B,MAAM,CACJ,GAAG,EACH,GAAG,EACH,iCAAiC,EACjC,sCAAsC,sBAAsB,8IAA8I,CAC3M,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC5C,MAAM,CACJ,GAAG,EACH,GAAG,EACH,yBAAyB,EACzB,OAAO,KAAK,IAAI;wBACd,CAAC,CAAC,MAAM,sBAAsB,qNAAqN;wBACnP,CAAC,CAAC,OAAO,sBAAsB,oGAAoG,CACtI,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,IAAI,GAAQ,CAAC;gBACb,IAAI,CAAC;oBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CACJ,GAAG,EACH,GAAG,EACH,2BAA2B,EAC3B,0EAA0E,CAC3E,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,kBAAkB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;gBACnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,MAAM,CACJ,GAAG,EACH,GAAG,EACH,4BAA4B,EAC5B,GAAG,IAAI,sBAAsB,MAAM,EAAE,CACtC,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBACzF,OAAO;gBACT,CAAC;gBAED,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CACJ,GAAG,EACH,GAAG,EACH,yBAAyB,EACzB,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3E,MAAM,CACJ,GAAG,EACH,GAAG,EACH,uBAAuB,EACvB,8CAA8C,CAC/C,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,gEAAgE;gBAChE,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,mBAAmB;gBACnB,IAAI,MAA0B,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;wBAClC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;wBAC5D,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;wBACjC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;4BACtC,IAAI,CAAC;gCACH,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;4BACrC,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,QAAQ,CACN,0EACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,wDAAwD,CACzD,CAAC;4BACJ,CAAC;wBACH,CAAC;wBACD,OAAO,OAAO,CAAC;oBACjB,CAAC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,4DAA4D;oBAC5D,mEAAmE;oBACnE,mEAAmE;oBACnE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvE,iEAAiE;oBACjE,4DAA4D;oBAC5D,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,QAAQ;wBACzB,KAAK,KAAK,IAAI;wBACd,MAAM,IAAI,KAAK;wBACd,KAA2B,CAAC,IAAI,KAAK,oBAAoB,CAAC;oBAC7D,MAAM,CACJ,GAAG,EACH,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EACpB,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,EAClE,OAAO,CACR,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACb,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;oBACjC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,MAAM,CACJ,GAAG,EACH,GAAG,EACH,wBAAwB,EACxB,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;QACvC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,6BAA6B,EAAE,IAAI,EAAE,GAAG,EAAE;YACpE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/B,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC7C,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,6BAA6B,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F;;;;;;;;;OASG;IACH,KAAK,UAAU,KAAK,CAAC,SAAiB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,QAAQ,CACN,+BAA+B,MAAM,CAAC,QAAQ,CAAC,0CAA0C,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAC/H,CAAC;QACJ,CAAC,CAAC;QACF,SAAS,CAAC;YACR,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,oEAAoE;YACpE,oEAAoE;YACpE,wEAAwE;YACxE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,SAAS,IAAI,CAAC;gBAAE,OAAO,MAAM,EAAE,CAAC;YACpC,wEAAwE;YACxE,kEAAkE;YAClE,yEAAyE;YACzE,sBAAsB;YACtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAC/B,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;gBAC3B,IAAI,OAAO,CAAU,CAAC,MAAM,EAAE,EAAE;oBAC9B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACvD,CAAC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,EAAE,CAAC;YAC5B,IAAI,QAAQ,KAAK,CAAC;gBAAE,OAAO;YAC3B,MAAM,IAAI,OAAO,CAAO,CAAC,MAAM,EAAE,EAAE;gBACjC,UAAU,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,UAAU,IAAI;QACjB,uEAAuE;QACvE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,MAAM,EAAE,EAAE;YAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,IAAI,iCAAiC,CAAC,CAAC;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,wBAAwB;QACxB,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5D,SAAS;QACT,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}