botmux 3.15.0 → 3.16.0

package/dist/adapters/backend/mojo-process-tree.js

@@ -0,0 +1,486 @@
+/**
+ * Which processes still belong to a mojo turn, and are they gone yet?
+ *
+ * Why a PGID is not enough
+ * ------------------------
+ * Signalling `-pgid` looked sufficient, but a descendant can call `setsid()` (or
+ * be spawned with `detached: true`) and become the leader of a NEW group and
+ * session. It then survives every `kill(-pgid)` aimed at the original group while
+ * still holding the inherited `X_JWT_TOKEN`. Reparenting to init also destroys the
+ * PPID chain once the direct child exits, so neither PGID nor parentage alone can
+ * enumerate the subtree.
+ *
+ * The three signals below are therefore unioned, because each covers the others'
+ * blind spot:
+ *   - PGID           the common case, and the only one that works before /proc
+ *                    has been read
+ *   - env nonce      a unique value injected into the turn's environment. It is
+ *                    inherited by every descendant and survives setsid, a new
+ *                    session, and reparenting to init
+ *   - PPID chain     catches a descendant that scrubbed its own environ but is
+ *                    still parented inside the tree
+ *
+ * Trust domain: this is a DIAGNOSTIC SIGNAL, not a boundary
+ * --------------------------------------------------------
+ * A hijacked child runs as the same user, so a descendant that both setsids AND
+ * overwrites its own environ area can still evade enumeration. Reading a clean
+ * scan as "the credential is now unreachable" is therefore unsound, and the type
+ * system now says so: a successful scan is stamped `evidence: 'diagnostic'`, and
+ * `quiescenceFromScan()` maps even an EMPTY member list to
+ * `{ kind: 'diagnostic-clean', boundaryProof: false }`. Only a kernel-level
+ * container (per-session cgroup v2 / pid namespace, see mojo-containment) can
+ * produce `boundaryProof: true`. Callers must keep the session's
+ * device-isolation blocker whenever `boundaryProof` is false — including the
+ * clean-scan case.
+ *
+ * Fail-closed
+ * -----------
+ * Only ENOENT means "this pid exited between readdir and read", which is a
+ * genuine non-member and safe to skip. EVERY other read or parse error means the
+ * table we built is incomplete, and an incomplete table can hide a survivor, so
+ * it fails the WHOLE scan instead of silently shrinking the result. The one
+ * documented exception is EACCES/EPERM on `environ` (see readEnviron).
+ */
+import { readFileSync, readdirSync } from 'node:fs';
+/**
+ * The invariants that make `boundaryProven` trustworthy, asserted at the single
+ * construction point rather than documented and hoped for.
+ *
+ * Throwing is deliberate: a violated invariant here means some future edit has
+ * re-created the exact fail-open this type exists to prevent (a clean scan
+ * laundered into a boundary proof, or an unproven boundary with nothing left
+ * behind to hold the blocker). Failing loudly at the source beats publishing a
+ * closed row for a session whose credential may still be reachable.
+ */
+function assertTerminationInvariants(outcome) {
+    if (outcome.evidence === 'diagnostic-clean' && outcome.boundaryProven) {
+        throw new Error('termination invariant: diagnostic-clean can never be a boundary proof');
+    }
+    if (outcome.evidence === 'diagnostic-clean' && outcome.residual === null) {
+        throw new Error('termination invariant: diagnostic-clean must leave a residual');
+    }
+    if (!outcome.boundaryProven && outcome.residual === null) {
+        throw new Error('termination invariant: an unproven boundary must leave a residual');
+    }
+    if (outcome.boundaryProven && outcome.residual !== null) {
+        throw new Error('termination invariant: a proven boundary must not leave a residual');
+    }
+    return outcome;
+}
+/**
+ * Project a scan/containment verdict onto the termination contract.
+ *
+ * This is the ONLY place a `TerminationOutcome` is constructed, so the
+ * invariants above cannot be bypassed by a caller assembling the object by
+ * hand.
+ */
+export function terminationOutcomeFromQuiescence(q) {
+    switch (q.kind) {
+        case 'contained-proven':
+            // A kernel-level container reported no members. This is the only branch
+            // that may authorise dropping the blocker.
+            return assertTerminationInvariants({
+                ok: true,
+                boundaryProven: true,
+                evidence: 'members-empty',
+                residual: null,
+                signalsStopped: true,
+            });
+        case 'diagnostic-clean':
+            // Enumeration found nothing, which is worth stopping the signalling for
+            // and worth NOTHING else: a descendant that setsid'd and scrubbed its own
+            // environ is invisible to exactly this scan. The residual is what keeps
+            // the device-isolation blocker alive while the session row closes.
+            return assertTerminationInvariants({
+                ok: true,
+                boundaryProven: false,
+                evidence: 'diagnostic-clean',
+                residual: {
+                    deviceIsolation: true,
+                    reason: 'clean scan is a diagnostic signal only; no unforgeable boundary proof was obtained',
+                },
+                signalsStopped: true,
+            });
+        case 'alive':
+            return assertTerminationInvariants({
+                ok: false,
+                boundaryProven: false,
+                evidence: 'timeout',
+                residual: { deviceIsolation: true, pids: [...q.pids], reason: 'members still executing after escalation' },
+                signalsStopped: false,
+            });
+        case 'unscannable':
+            // "Cannot enumerate" must never read as "nothing is running".
+            return assertTerminationInvariants({
+                ok: false,
+                boundaryProven: false,
+                evidence: 'unknown',
+                residual: { deviceIsolation: true, reason: q.reason },
+                signalsStopped: false,
+            });
+        case 'unsupported-platform':
+            return assertTerminationInvariants({
+                ok: false,
+                boundaryProven: false,
+                evidence: 'unknown',
+                residual: { deviceIsolation: true, reason: `cannot enumerate on ${q.platform}: /proc is Linux-only` },
+                signalsStopped: false,
+            });
+    }
+}
+/** Injected into every turn child; inherited by the whole subtree. */
+export const MOJO_TREE_NONCE_ENV = 'BOTMUX_MOJO_TREE_NONCE';
+function errnoOf(err) {
+    const code = err?.code;
+    return typeof code === 'string' ? code : undefined;
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * `/proc/<pid>/stat`: field 2 (comm) is parenthesised and may itself contain
+ * spaces or ')', so the numeric tail must be cut at the LAST ')' rather than
+ * split naively. After that cut, rest[0] is field 3 (state), so field N is
+ * rest[N - 3]: ppid=4, pgid=5, starttime=22.
+ */
+function parseStat(text) {
+    const close = text.lastIndexOf(')');
+    if (close < 0)
+        return null;
+    const rest = text.slice(close + 1).trim().split(/\s+/);
+    const state = rest[0] ?? '';
+    const ppid = Number(rest[1]);
+    const pgid = Number(rest[2]);
+    if (!Number.isInteger(ppid) || !Number.isInteger(pgid))
+        return null;
+    // starttime is only needed for identity checks; a stat line truncated before
+    // field 22 still yields a usable tree member, so it degrades to NaN here and
+    // is rejected by readProcessIdentity instead of failing enumeration.
+    const starttime = Number(rest[19]);
+    return { ppid, pgid, starttime, state };
+}
+/** Boot id, so a persisted (pid, starttime) pair cannot survive a reboot. */
+function readBootId(procRoot) {
+    try {
+        const raw = readFileSync(`${procRoot}/sys/kernel/random/boot_id`, 'utf-8').trim();
+        if (raw.length === 0)
+            return { ok: false, detail: 'boot_id is empty' };
+        return { ok: true, bootId: raw };
+    }
+    catch (err) {
+        return { ok: false, detail: `cannot read boot_id: ${messageOf(err)}` };
+    }
+}
+/** The real kernel interface. Anything else is, by definition, an override. */
+export const DEFAULT_PROC_ROOT = '/proc';
+/**
+ * Is this `procRoot` a SUBSTITUTE for the kernel's own /proc?
+ *
+ * The distinction is the whole gate. The previous test was
+ * `procRoot !== undefined`, and every production caller passes a procRoot -- the
+ * backend's getter returns the string '/proc' -- so the override branch was
+ * unconditionally taken and the non-Linux refusal below could never fire in
+ * production. Passing the real path is not an override; only pointing the scanner
+ * somewhere else is.
+ */
+export function isProcRootOverridden(procRoot) {
+    return procRoot !== undefined && procRoot !== DEFAULT_PROC_ROOT;
+}
+/**
+ * `/proc` is a Linux interface. On any other platform the layout either does not
+ * exist or does not mean the same thing, so enumeration is refused OUTRIGHT
+ * rather than allowed to fail its way into a misleading "nothing is running".
+ *
+ * Refusing OUTRIGHT is not pedantry, it is the difference between two very
+ * different closes. `unsupported-platform` routes to a residual close, which
+ * publishes the row, keeps the device-isolation blocker on the durable handle and
+ * lets the remote cancel proceed. Any other failure -- including `unscannable` --
+ * routes to a fence, which latches write admission and returns a failed close.
+ * A fence is right when a retry might yet produce proof; on a host that can NEVER
+ * enumerate, it is a permanent wedge, which is exactly the behaviour this module
+ * was fixed not to have.
+ *
+ * A synthetic `procRoot` opts back in: that is how a test points the scanner at a
+ * fake tree. The previous version of this comment claimed such an override "is
+ * never set in production", which was the reverse of the truth -- production
+ * always sets it, to the real /proc, which is why the gate was dead. See
+ * `isProcRootOverridden`.
+ */
+export function mojoTreeScanSupported(opts = {}) {
+    if (opts.procRootOverridden)
+        return true;
+    return (opts.platform ?? process.platform) === 'linux';
+}
+function unsupportedScan(platform) {
+    return {
+        ok: false,
+        failure: { kind: 'unsupported-platform', platform },
+        reason: `process-tree enumeration needs Linux /proc; platform is ${platform}. `
+            + 'Quiescence cannot be established, so the caller must keep the blocker.',
+    };
+}
+/**
+ * `environ` is the one place a non-ENOENT error is tolerated.
+ *
+ * Scanning all of `/proc` necessarily touches OTHER users' processes, whose
+ * environ is 0400 root-or-owner; EACCES there is the normal case, not a fault,
+ * and failing the scan on it would make every multi-tenant host permanently
+ * unscannable. It is not a blind spot that matters either: our descendants
+ * inherit our uid, so a process we cannot read cannot be one of them. It is
+ * still reported via `envBlindSpots` instead of being silently dropped.
+ */
+function readEnviron(procRoot, name) {
+    try {
+        return { state: 'read', text: readFileSync(`${procRoot}/${name}/environ`, 'utf-8') };
+    }
+    catch (err) {
+        const code = errnoOf(err);
+        if (code === 'ENOENT')
+            return { state: 'gone' };
+        if (code === 'EACCES' || code === 'EPERM')
+            return { state: 'blind' };
+        return { state: 'error', detail: messageOf(err) };
+    }
+}
+function readProcTable(procRoot, nonce) {
+    let names;
+    try {
+        names = readdirSync(procRoot);
+    }
+    catch (err) {
+        // No /proc (or unreadable) means the tree cannot be enumerated at all. The
+        // caller must NOT read that as "nothing is running".
+        return {
+            ok: false,
+            failure: { kind: 'proc-unreadable', detail: messageOf(err) },
+            reason: `cannot read ${procRoot}: ${messageOf(err)}`,
+        };
+    }
+    const table = [];
+    const envBlindSpots = [];
+    for (const name of names) {
+        if (!/^\d+$/.test(name))
+            continue;
+        const pid = Number(name);
+        let parsed;
+        try {
+            parsed = parseStat(readFileSync(`${procRoot}/${name}/stat`, 'utf-8'));
+        }
+        catch (err) {
+            // ENOENT: exited between readdir and read. A vanished process is genuinely
+            // not a member, so skipping it is correct and is not a scan failure.
+            if (errnoOf(err) === 'ENOENT')
+                continue;
+            // Anything else (EACCES, EIO, ...) means we cannot account for this pid.
+            // An unaccounted pid could be the survivor we are looking for, so the whole
+            // scan fails rather than quietly omitting it.
+            return {
+                ok: false,
+                failure: { kind: 'proc-entry-unreadable', pid, detail: messageOf(err) },
+                reason: `cannot read ${procRoot}/${name}/stat: ${messageOf(err)}`,
+            };
+        }
+        if (parsed === null) {
+            // A stat line we cannot parse is NOT an absent process. Skipping it used to
+            // hide a live member behind a formatting surprise; fail instead.
+            return {
+                ok: false,
+                failure: { kind: 'proc-entry-unparsable', pid, detail: 'unparsable stat line' },
+                reason: `cannot parse ${procRoot}/${name}/stat`,
+            };
+        }
+        const environ = readEnviron(procRoot, name);
+        if (environ.state === 'gone')
+            continue; // raced us after stat; not a member
+        if (environ.state === 'error') {
+            return {
+                ok: false,
+                failure: { kind: 'proc-entry-unreadable', pid, detail: environ.detail },
+                reason: `cannot read ${procRoot}/${name}/environ: ${environ.detail}`,
+            };
+        }
+        if (environ.state === 'blind')
+            envBlindSpots.push(pid);
+        table.push({
+            pid,
+            ppid: parsed.ppid,
+            pgid: parsed.pgid,
+            // Only a definite 'Z' counts; an unreadable or surprising state must not
+            // become an excuse to discount a live process.
+            zombie: parsed.state === 'Z',
+            // Zero-separated; a substring test is enough for a unique nonce.
+            hasNonce: environ.state === 'read' && environ.text.includes(nonce),
+        });
+    }
+    return { ok: true, table, envBlindSpots };
+}
+/**
+ * Every live process still belonging to the turn rooted at `rootPid`.
+ *
+ * `excludePids` MUST contain the current process (and anything else that must
+ * never be signalled): the daemon shares neither the nonce nor the group, but an
+ * explicit guard is cheaper than trusting that invariant while sending SIGKILL.
+ *
+ * PGID membership (`p.pid === rootPid || p.pgid === rootPid`) is a bare numeric
+ * comparison against a remembered pid, and this module's own identity primitive
+ * exists because bare pids are not stable handles: once the root is reaped, a
+ * recycled pid that becomes a new group leader wears the same number, and the
+ * ppid closure would then claim that stranger's whole subtree — consumers
+ * SIGKILL every claimed member. PGID claiming therefore requires
+ * `opts.rootIdentity` (the identity recorded when the root was spawned) to
+ * still verify against the live process. Without it — not passed, root gone, or
+ * recycled — only the env nonce plus its ppid closure claim members, both of
+ * which are positive evidence of THIS turn's membership.
+ *
+ * A successful result is a diagnostic signal only; see `quiescenceFromScan`.
+ */
+export function scanMojoTree(rootPid, nonce, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    if (!mojoTreeScanSupported({ platform, procRootOverridden: isProcRootOverridden(opts.procRoot) })) {
+        return unsupportedScan(platform);
+    }
+    const procRoot = opts.procRoot ?? '/proc';
+    const read = readProcTable(procRoot, nonce);
+    if (!read.ok)
+        return read;
+    // Verified means: the caller recorded the root's identity at spawn, the pid it
+    // names is the pid being scanned, and the LIVE process still carries that
+    // identity. Anything less and group membership proves nothing.
+    const recorded = opts.rootIdentity;
+    let rootVerified = false;
+    if (recorded && recorded.pid === rootPid) {
+        const live = readProcessIdentity(rootPid, { procRoot, platform });
+        rootVerified = live.ok && sameProcessIdentity(recorded, live.identity);
+    }
+    const excluded = new Set(opts.excludePids ?? []);
+    const members = new Map();
+    const claim = (p, via) => {
+        if (excluded.has(p.pid) || members.has(p.pid))
+            return;
+        members.set(p.pid, { pid: p.pid, ppid: p.ppid, pgid: p.pgid, via, zombie: p.zombie });
+    };
+    for (const p of read.table) {
+        if (rootVerified && (p.pid === rootPid || p.pgid === rootPid))
+            claim(p, 'pgid');
+        else if (p.hasNonce)
+            claim(p, 'env');
+    }
+    // Transitive closure over parentage, so an env-scrubbed child of a known member
+    // is still claimed. Bounded by the table size, so it cannot loop on a cycle.
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const p of read.table) {
+            if (members.has(p.pid) || excluded.has(p.pid))
+                continue;
+            if (!members.has(p.ppid))
+                continue;
+            // Never walk up into init/the daemon: only DOWN from a known member.
+            claim(p, 'ppid');
+            changed = true;
+        }
+    }
+    return {
+        ok: true,
+        evidence: 'diagnostic',
+        members: [...members.values()],
+        envBlindSpots: read.envBlindSpots,
+    };
+}
+/**
+ * Map a scan onto a quiescence verdict — WITHOUT ever minting boundary proof.
+ *
+ * An empty member list becomes `diagnostic-clean`, whose `boundaryProof` is
+ * false, because enumeration cannot see a descendant that setsid'd and scrubbed
+ * its environ. Callers keep the blocker unless `boundaryProof` is true.
+ */
+export function quiescenceFromScan(scan) {
+    if (!scan.ok) {
+        if (scan.failure.kind === 'unsupported-platform') {
+            return { kind: 'unsupported-platform', boundaryProof: false, platform: scan.failure.platform };
+        }
+        return { kind: 'unscannable', boundaryProof: false, reason: scan.reason };
+    }
+    // Zombies are discounted: already reaped, executing nothing, incapable of using
+    // the credential. Keeping them would block the close forever on a process that
+    // cannot act — safe in direction but impossible to recover from. Only a definite
+    // 'Z' is discounted (see MojoTreeMember.zombie), so an unreadable state still
+    // counts as executing.
+    const executing = scan.members.filter(m => !m.zombie);
+    if (executing.length > 0) {
+        return { kind: 'alive', boundaryProof: false, pids: executing.map(m => m.pid) };
+    }
+    return { kind: 'diagnostic-clean', boundaryProof: false };
+}
+/** Read the recycle-proof identity of a pid. */
+export function readProcessIdentity(pid, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    if (!mojoTreeScanSupported({ platform, procRootOverridden: isProcRootOverridden(opts.procRoot) })) {
+        const failed = unsupportedScan(platform);
+        return { ok: false, failure: failed.failure, reason: failed.reason };
+    }
+    const procRoot = opts.procRoot ?? '/proc';
+    const boot = readBootId(procRoot);
+    if (!boot.ok) {
+        return { ok: false, failure: { kind: 'proc-unreadable', detail: boot.detail }, reason: boot.detail };
+    }
+    let text;
+    try {
+        text = readFileSync(`${procRoot}/${pid}/stat`, 'utf-8');
+    }
+    catch (err) {
+        return {
+            ok: false,
+            failure: { kind: 'proc-entry-unreadable', pid, detail: messageOf(err) },
+            reason: `cannot read ${procRoot}/${pid}/stat: ${errnoOf(err) ?? messageOf(err)}`,
+        };
+    }
+    const parsed = parseStat(text);
+    if (parsed === null || !Number.isInteger(parsed.starttime)) {
+        return {
+            ok: false,
+            failure: { kind: 'proc-entry-unparsable', pid, detail: 'no usable starttime in stat' },
+            reason: `cannot parse starttime from ${procRoot}/${pid}/stat`,
+        };
+    }
+    return { ok: true, identity: { pid, bootId: boot.bootId, starttime: parsed.starttime } };
+}
+/** Same process, or a recycled pid wearing its number? */
+export function sameProcessIdentity(a, b) {
+    return a.pid === b.pid && a.bootId === b.bootId && a.starttime === b.starttime;
+}
+/**
+ * `kill(-rootPid, signal)` — but ONLY after proving the pid is still the process
+ * we spawned.
+ *
+ * A bare group kill on a remembered pid is a footgun: pids recycle, so after the
+ * turn root exits the number can name an unrelated process, and negating it
+ * signals THAT process's whole group. Everything except a verified match
+ * therefore signals nothing at all; refusing to kill is always recoverable,
+ * killing the wrong group is not.
+ */
+export function signalTurnTreeGroup(expected, signal, opts = {}) {
+    const read = readProcessIdentity(expected.pid, opts);
+    if (!read.ok) {
+        if (read.failure.kind === 'unsupported-platform') {
+            return { kind: 'unsupported-platform', platform: read.failure.platform };
+        }
+        // A vanished root is the expected happy path late in teardown.
+        if (read.failure.kind === 'proc-entry-unreadable' && /ENOENT|no such file/i.test(read.reason)) {
+            return { kind: 'gone' };
+        }
+        return { kind: 'unverifiable', reason: read.reason };
+    }
+    if (!sameProcessIdentity(expected, read.identity)) {
+        return { kind: 'identity-mismatch', expected, actual: read.identity };
+    }
+    const kill = opts.kill ?? ((target, sig) => { process.kill(target, sig); });
+    try {
+        kill(-expected.pid, signal);
+    }
+    catch {
+        // Raced us between the identity read and the signal: the group is gone.
+        return { kind: 'gone' };
+    }
+    return { kind: 'signalled' };
+}
+//# sourceMappingURL=mojo-process-tree.js.map

package/dist/adapters/backend/mojo-process-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mojo-process-tree.js","sourceRoot":"","sources":["../../../src/adapters/backend/mojo-process-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAmIpD;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAAC,OAA2B;IAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,CAAiB;IAChE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,kBAAkB;YACrB,wEAAwE;YACxE,2CAA2C;YAC3C,OAAO,2BAA2B,CAAC;gBACjC,EAAE,EAAE,IAAI;gBACR,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,IAAI;gBACd,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,KAAK,kBAAkB;YACrB,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,2BAA2B,CAAC;gBACjC,EAAE,EAAE,IAAI;gBACR,cAAc,EAAE,KAAK;gBACrB,QAAQ,EAAE,kBAAkB;gBAC5B,QAAQ,EAAE;oBACR,eAAe,EAAE,IAAI;oBACrB,MAAM,EAAE,oFAAoF;iBAC7F;gBACD,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,KAAK,OAAO;YACV,OAAO,2BAA2B,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,cAAc,EAAE,KAAK;gBACrB,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0CAA0C,EAAE;gBAC1G,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;QACL,KAAK,aAAa;YAChB,8DAA8D;YAC9D,OAAO,2BAA2B,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,cAAc,EAAE,KAAK;gBACrB,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;gBACrD,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;QACL,KAAK,sBAAsB;YACzB,OAAO,2BAA2B,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,cAAc,EAAE,KAAK;gBACrB,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,QAAQ,uBAAuB,EAAE;gBACrG,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAuBD,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAM5D,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,QAAQ,4BAA4B,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACzE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC/D,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,iBAAiB,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA4D,EAAE;IAE9D,IAAI,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE;QACnD,MAAM,EACJ,2DAA2D,QAAQ,IAAI;cACrE,wEAAwE;KAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAClB,QAAgB,EAChB,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,QAAQ,IAAI,IAAI,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;IACvF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAChD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACrE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,QAAgB,EAChB,KAAa;IAIb,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,qDAAqD;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;YAC5D,MAAM,EAAE,eAAe,QAAQ,KAAK,SAAS,CAAC,GAAG,CAAC,EAAE;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAEzB,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,QAAQ,IAAI,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2EAA2E;YAC3E,qEAAqE;YACrE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,SAAS;YACxC,yEAAyE;YACzE,4EAA4E;YAC5E,8CAA8C;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;gBACvE,MAAM,EAAE,eAAe,QAAQ,IAAI,IAAI,UAAU,SAAS,CAAC,GAAG,CAAC,EAAE;aAClE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,4EAA4E;YAC5E,iEAAiE;YACjE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,EAAE,sBAAsB,EAAE;gBAC/E,MAAM,EAAE,gBAAgB,QAAQ,IAAI,IAAI,OAAO;aAChD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS,CAAU,oCAAoC;QACrF,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBACvE,MAAM,EAAE,eAAe,QAAQ,IAAI,IAAI,aAAa,OAAO,CAAC,MAAM,EAAE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvD,KAAK,CAAC,IAAI,CAAC;YACT,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,GAAG;YAC5B,iEAAiE;YACjE,QAAQ,EAAE,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAa,EACb,OAMI,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,IAAI,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC1C,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,+EAA+E;IAC/E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC;IACnC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,YAAY,GAAG,IAAI,CAAC,EAAE,IAAI,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,GAA0B,EAAQ,EAAE;QAC7D,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO;QACtD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;aAC3E,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,IAAI,OAAO,GAAG,IAAI,EAAE,OAAO,GAAG,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,SAAS;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,qEAAqE;YACrE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5E,CAAC;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,iFAAiF;IACjF,8EAA8E;IAC9E,uBAAuB;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,OAAiD,EAAE;IAEnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,IAAI,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACvG,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,GAAG,QAAQ,IAAI,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;YACvE,MAAM,EAAE,eAAe,QAAQ,IAAI,GAAG,UAAU,OAAO,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,EAAE,6BAA6B,EAAE;YACtF,MAAM,EAAE,+BAA+B,QAAQ,IAAI,GAAG,OAAO;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,CAAsB,EAAE,CAAsB;IAChF,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA6B,EAC7B,MAAsB,EACtB,OAAuG,EAAE;IAEzG,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3E,CAAC;QACD,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,uBAAuB,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC"}