comber 0.1.0

package/action.yml

@@ -0,0 +1,279 @@
+# Comber — reusable GitHub Action.
+#
+# Drop Comber into any repo's CI to crawl a preview-deploy URL (web target) or check an
+# OpenAPI surface (api target), upload the report, post a non-blocking PR comment, and
+# optionally gate the job on fail-severity findings.
+#
+# Script-injection defense: every consumer-supplied value (url, openapi, api-base, …) is
+# passed to the run step via `env:` and read inside a quoted bash array as "$VAR" — it is
+# NEVER interpolated into a `run:` script with ${{ … }}. That is the GitHub Actions
+# untrusted-input rule (a `url` of `"; rm -rf / #` can't break out of an env var). This
+# mirrors the pattern already used in .github/workflows/comber.yml.
+name: "Comber"
+description: "Every-click AI QA checker — crawl a web preview deploy or check an OpenAPI surface in CI."
+author: "RADLAB"
+branding:
+  icon: "check-circle"
+  color: "red"
+
+inputs:
+  # -- target selection: provide `url` (web) OR `openapi` + `api-base` (api) ---------------
+  url:
+    description: "Web target URL to crawl (the preview-deploy URL). Use this OR `openapi`."
+    required: false
+    default: ""
+  openapi:
+    description: "OpenAPI 3.x document source (file path or http(s) URL). Selects the API driver."
+    required: false
+    default: ""
+  api-base:
+    description: "API base URL (required when `openapi` is set; point Comber at a base you own)."
+    required: false
+    default: ""
+  seed:
+    description: "Optional API seed-data JSON path (per-operation request overrides)."
+    required: false
+    default: ""
+
+  # -- crawl knobs ------------------------------------------------------------------------
+  max-states:
+    description: "Max distinct states to exercise (the runaway-cost backstop). Blank = Comber default."
+    required: false
+    default: ""
+  llm:
+    description: "Use the Claude action-picker + judge (requires anthropic-api-key)."
+    required: false
+    default: "false"
+  external-links:
+    description: "Check external links (opt-in; egress to private/metadata hosts stays blocked)."
+    required: false
+    default: "false"
+  allow-writes:
+    description: "Allow mutating HTTP methods — SYNTHETIC environments only. Default blocks writes."
+    required: false
+    default: "false"
+  strict:
+    description: "Gate the job: exit non-zero when fail-severity findings are present."
+    required: false
+    default: "false"
+  pr-comment:
+    description: "Post a non-blocking Comber comment on the PR (when run on a pull_request)."
+    required: false
+    default: "true"
+  baseline:
+    description: "Optional prior result.json path for baseline diffing."
+    required: false
+    default: ""
+  config:
+    description: "Optional comber.config.json path."
+    required: false
+    default: ""
+  profile:
+    description: "Optional profile name from the config."
+    required: false
+    default: ""
+
+  # -- how to install comber (see the publish gate in the README) -------------------------
+  install-spec:
+    # Packaging is ready: the package ships a prebuilt dist/ in its tarball AND builds dist/ on
+    # a git install via its `prepare` script, so both forms below work.
+    #   - Published (default): install-spec: comber  (resolves from npm once a v* tag is pushed
+    #     with the NPM_TOKEN secret set — see .github/workflows/release.yml).
+    #   - Same-org / private today: install-spec: github:RADLABtech/comber#<ref>  (tag/branch/SHA).
+    description: "Spec passed to `bun add` to install comber (default: the published package name)."
+    required: false
+    default: "comber"
+  comber-version:
+    description: "Convenience version pin used only when install-spec is the default (resolves to comber@<version>)."
+    required: false
+    default: ""
+  bun-version:
+    description: "Bun version for oven-sh/setup-bun."
+    required: false
+    default: "latest"
+
+  # -- secrets / pass-through env ---------------------------------------------------------
+  anthropic-api-key:
+    description: "ANTHROPIC_API_KEY — enables the LLM action-picker + judge when `llm` is true."
+    required: false
+    default: ""
+  storage-state:
+    description: "Absolute path to a Playwright storageState JSON for a SYNTHETIC session (COMBER_STORAGE_STATE). Materialize it from a secret in a prior step."
+    required: false
+    default: ""
+  api-token:
+    description: "Bearer credential for the API target (COMBER_API_TOKEN). Never logged; redacted in artifacts."
+    required: false
+    default: ""
+  sink-file:
+    description: "COMBER_SINK_FILE — append one redacted run-summary JSON line per run to this JSONL file."
+    required: false
+    default: ""
+  sink-dir:
+    description: "COMBER_SINK_DIR — copy each run's screenshots into this directory."
+    required: false
+    default: ""
+  sink-url:
+    description: "COMBER_SINK_URL — POST the redacted run record to this webhook/collector URL."
+    required: false
+    default: ""
+  sink-token:
+    description: "COMBER_SINK_TOKEN — optional Bearer token for the webhook (Authorization header only)."
+    required: false
+    default: ""
+
+  # -- PR comment wiring ------------------------------------------------------------------
+  github-token:
+    description: "Token used by `gh pr comment`. Needs pull-requests: write."
+    required: false
+    default: ${{ github.token }}
+  pr-number:
+    description: "PR number to comment on. Defaults to the triggering pull_request when blank."
+    required: false
+    default: ""
+
+outputs:
+  exit-code:
+    description: "Comber's process exit code (0 = clean / soft, 1 = strict + fails, 2 = crashed)."
+    value: ${{ steps.run.outputs.exit-code }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Setup bun
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      with:
+        bun-version: ${{ inputs.bun-version }}
+
+    - name: Install comber
+      id: install
+      shell: bash
+      env:
+        # Passed via env (never interpolated into the script) — consumer-controlled, still
+        # treated as the script-injection rule demands.
+        INSTALL_SPEC: ${{ inputs.install-spec }}
+        COMBER_VERSION: ${{ inputs.comber-version }}
+      run: |
+        # Install into an isolated dir under the runner temp so we never touch the caller's
+        # package.json / lockfile. Comber's bin is invoked by absolute path from the run step.
+        APP_DIR="$RUNNER_TEMP/comber-app"
+        mkdir -p "$APP_DIR"
+        if [ ! -f "$APP_DIR/package.json" ]; then
+          echo '{"name":"comber-ci-host","private":true}' > "$APP_DIR/package.json"
+        fi
+        spec="$INSTALL_SPEC"
+        # `comber-version` is a convenience pin that only applies to the default spec.
+        if [ "$spec" = "comber" ] && [ -n "$COMBER_VERSION" ]; then
+          spec="comber@$COMBER_VERSION"
+        fi
+        echo "Installing comber from: $spec"
+        # The default `comber` resolves from npm once a v* tag is published (release.yml +
+        # NPM_TOKEN). Pre-publish / private: install-spec: github:RADLABtech/comber#<ref>
+        # (its `prepare` script builds dist/ on install).
+        ( cd "$APP_DIR" && bun add "$spec" )
+        echo "app-dir=$APP_DIR" >> "$GITHUB_OUTPUT"
+
+    - name: Install Playwright Chromium
+      # Web target only — the API driver needs no browser.
+      if: ${{ inputs.openapi == '' }}
+      shell: bash
+      env:
+        APP_DIR: ${{ steps.install.outputs.app-dir }}
+      run: |
+        ( cd "$APP_DIR" && bunx playwright install --with-deps chromium )
+
+    - name: Run comber
+      id: run
+      shell: bash
+      env:
+        APP_DIR: ${{ steps.install.outputs.app-dir }}
+        OUT_DIR: ${{ github.workspace }}/runs
+        # ---- consumer-supplied values: env only, NEVER inlined into run: via ${{ }} -------
+        TARGET_URL: ${{ inputs.url }}
+        OPENAPI: ${{ inputs.openapi }}
+        API_BASE: ${{ inputs.api-base }}
+        SEED: ${{ inputs.seed }}
+        MAX_STATES: ${{ inputs.max-states }}
+        USE_LLM: ${{ inputs.llm }}
+        CHECK_EXTERNAL_LINKS: ${{ inputs.external-links }}
+        ALLOW_WRITES: ${{ inputs.allow-writes }}
+        STRICT: ${{ inputs.strict }}
+        PR_COMMENT: ${{ inputs.pr-comment }}
+        BASELINE: ${{ inputs.baseline }}
+        CONFIG_PATH: ${{ inputs.config }}
+        PROFILE_NAME: ${{ inputs.profile }}
+        # ---- pass-through env consumed directly by comber ---------------------------------
+        ANTHROPIC_API_KEY: ${{ inputs.anthropic-api-key }}
+        COMBER_STORAGE_STATE: ${{ inputs.storage-state }}
+        COMBER_API_TOKEN: ${{ inputs.api-token }}
+        COMBER_SINK_FILE: ${{ inputs.sink-file }}
+        COMBER_SINK_DIR: ${{ inputs.sink-dir }}
+        COMBER_SINK_URL: ${{ inputs.sink-url }}
+        COMBER_SINK_TOKEN: ${{ inputs.sink-token }}
+      run: |
+        # Build the arg array from env vars only — quoted expansion, no interpolation of
+        # untrusted input into the script text (script-injection defense).
+        args=()
+        if [[ -n "$OPENAPI" ]]; then
+          # API target: comber api --openapi <src> --api-base <url>
+          args+=(api --openapi "$OPENAPI")
+          if [[ -n "$API_BASE" ]]; then args+=(--api-base "$API_BASE"); fi
+          if [[ -n "$SEED" ]]; then args+=(--seed "$SEED"); fi
+        else
+          # Web target: positional URL first.
+          if [[ -n "$TARGET_URL" ]]; then args+=("$TARGET_URL"); fi
+        fi
+        if [[ -n "$CONFIG_PATH" ]]; then args+=(--config "$CONFIG_PATH"); fi
+        if [[ -n "$PROFILE_NAME" ]]; then args+=(--profile "$PROFILE_NAME"); fi
+        if [[ -n "$MAX_STATES" ]]; then args+=(--max-states "$MAX_STATES"); fi
+        if [[ -n "$BASELINE" ]]; then args+=(--baseline "$BASELINE"); fi
+        if [[ "$USE_LLM" == "true" ]]; then args+=(--llm); else args+=(--no-llm); fi
+        if [[ "$CHECK_EXTERNAL_LINKS" == "true" ]]; then args+=(--external-links); else args+=(--no-external-links); fi
+        if [[ "$ALLOW_WRITES" == "true" ]]; then args+=(--allow-writes); else args+=(--block-writes); fi
+        if [[ "$STRICT" == "true" ]]; then args+=(--strict); fi
+        if [[ "$PR_COMMENT" == "true" ]]; then args+=(--pr-comment "$OUT_DIR/pr-comment.md"); fi
+        args+=(--out "$OUT_DIR")
+
+        # Don't fail the step here — capture the code so the artifact + PR comment still run.
+        # The Gate step re-exits with this code (0 clean/soft · 1 strict+fails · 2 crash).
+        set +e
+        "$APP_DIR/node_modules/.bin/comber" "${args[@]}"
+        code=$?
+        set -e
+        echo "exit-code=$code" >> "$GITHUB_OUTPUT"
+        echo "comber exited with $code"
+
+    - name: Upload report artifact
+      if: ${{ always() }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      with:
+        name: comber-report
+        path: runs/
+        retention-days: 7
+        if-no-files-found: warn
+
+    - name: Comment on PR
+      # Non-blocking by design: a comment failure must never fail the run.
+      if: ${{ always() && inputs.pr-comment == 'true' && hashFiles('runs/pr-comment.md') != '' }}
+      continue-on-error: true
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        PR_NUMBER: ${{ inputs.pr-number != '' && inputs.pr-number || github.event.pull_request.number }}
+        COMMENT_FILE: ${{ github.workspace }}/runs/pr-comment.md
+      run: |
+        if [[ -z "$PR_NUMBER" ]]; then
+          echo "No PR number resolved (not a pull_request and no pr-number input) — skipping comment."
+          exit 0
+        fi
+        gh pr comment "$PR_NUMBER" --body-file "$COMMENT_FILE"
+
+    - name: Gate
+      # Final gate: re-exit with comber's code. Job fails only on strict+fails (1) or crash (2).
+      if: ${{ always() }}
+      shell: bash
+      env:
+        CODE: ${{ steps.run.outputs.exit-code }}
+      run: |
+        echo "Comber exit code: ${CODE:-<none>}"
+        exit "${CODE:-0}"

package/comber.config.example.json

@@ -0,0 +1,64 @@
+{
+  "defaultProfile": "local",
+  "profiles": {
+    "local": {
+      "url": "https://example.com",
+      "maxStates": 20,
+      "maxPerState": 20,
+      "maxMs": 180000,
+      "externalLinks": false,
+      "llm": false,
+      "allowWrites": false,
+      "baseline": "baselines/local-result.json",
+      "prComment": "runs/pr-comment.md"
+    },
+    "preview": {
+      "url": "https://preview.example.com",
+      "allowedOrigins": ["https://assets.example.com"],
+      "maxStates": 40,
+      "maxPerState": 40,
+      "maxVisitsPerRoute": 3,
+      "nearDup": 0.92,
+      "externalLinks": true,
+      "maxExternalLinks": 300,
+      "linkTimeoutMs": 10000,
+      "linkConcurrency": 8,
+      "llm": true,
+      "allowWrites": false,
+      "storageState": "./auth/synthetic-user.json",
+      "baseline": "baselines/preview-result.json",
+      "prComment": "runs/pr-comment.md",
+      "connectors": [
+        { "use": "slack", "on": "fail", "mentionOnFail": "<!here>" },
+        { "use": "junit", "outFile": "runs/comber-junit.xml" },
+        { "use": "webhook", "on": "warn" }
+      ]
+    },
+    "mobile": {
+      "target": "native",
+      "app": "com.example.app",
+      "platform": "android",
+      "device": "emulator-5554",
+      "deeplinks": ["myapp://settings", "myapp://profile"],
+      "maxStates": 10
+    },
+    "api": {
+      "target": "api",
+      "openapi": "./openapi.yaml",
+      "apiBase": "https://api-sandbox.example.com",
+      "seed": "./api-seed.json",
+      "allowWrites": false,
+      "apiAuthProfiles": { "alice": "", "bob": "" },
+      "ownerScoped": ["GET /users/{id}", "GET /orders/{id}"],
+      "roleSeed": "./role-seed.json"
+    },
+    "graphql": {
+      "target": "api",
+      "graphql": "https://api-sandbox.example.com/graphql"
+    },
+    "har": {
+      "target": "api",
+      "har": "./recorded-traffic.har"
+    }
+  }
+}

package/dist/api/classify.js

@@ -0,0 +1,99 @@
+import { documentedStatusList, isDocumented, operationLabel, responseFor } from "./openapi.js";
+import { formatViolations } from "./schema.js";
+/** Dedupe key — keyed on the route template + signal kind, per the API design. The same
+ *  broken operation re-seen collapses to one finding (core dedupes on `signature`). */
+export function signatureOf(op, kind) {
+    return `${kind}|${op.method} ${op.path}`.slice(0, 80);
+}
+/** Construct a BreakageSignal for an operation. `url` is the concrete request URL (a real
+ *  URL so the core's redactor scrubs query/userinfo); the message carries METHOD + template. */
+export function apiSignal(op, kind, severity, message, where) {
+    return {
+        kind,
+        severity,
+        message,
+        url: where,
+        signature: signatureOf(op, kind),
+        action: operationLabel(op),
+    };
+}
+/** A documented media type matches the actual base type, honoring `*` wildcards. */
+function mediaMatches(declared, actual) {
+    if (declared === "*/*" || declared === actual)
+        return true;
+    const [dType, dSub] = declared.split("/");
+    const [aType] = actual.split("/");
+    return dSub === "*" && dType === aType;
+}
+function jsonSchemaOf(resp, resolver) {
+    const media = resp.content["application/json"] ?? Object.entries(resp.content).find(([mt]) => /\bjson\b/i.test(mt))?.[1];
+    return media ? resolver.deref(media.schema) : undefined;
+}
+/** Light structural check: which top-level required properties the body is missing. An
+ *  object schema whose body isn't a JSON object reports ALL required keys as missing. */
+function missingRequired(schema, bodyText, resolver) {
+    const s = resolver.deref(schema);
+    if (!s)
+        return [];
+    const required = Array.isArray(s.required) ? s.required.filter((k) => typeof k === "string") : [];
+    if (required.length === 0)
+        return [];
+    let body;
+    try {
+        body = JSON.parse(bodyText);
+    }
+    catch {
+        return []; // non-JSON body is a content-type concern, not a shape one
+    }
+    if (body === null || typeof body !== "object" || Array.isArray(body))
+        return required;
+    return required.filter((k) => !(k in body));
+}
+/**
+ * Classify a response into zero or more breakage signals. A 5xx short-circuits (the body is
+ * an error page, not the documented shape). Otherwise: undocumented-status, then — against
+ * the best-matching documented response — content-type-mismatch and (for 2xx) full JSON-Schema
+ * validation (ajv) when a `validator` + schema are present, else the light required-prop check.
+ */
+export function classifyResponse(op, res, where, resolver, validator) {
+    const out = [];
+    const label = operationLabel(op);
+    if (res.status >= 500) {
+        out.push(apiSignal(op, "http-5xx", "fail", `${label} → HTTP ${res.status} (server error)`, where));
+        return out;
+    }
+    if (!isDocumented(op, res.status)) {
+        out.push(apiSignal(op, "undocumented-status", "warn", `${label} → HTTP ${res.status} is not among documented responses [${documentedStatusList(op)}]`, where));
+    }
+    const matched = responseFor(op, res.status);
+    if (!matched)
+        return out;
+    const declared = Object.keys(matched.content);
+    if (declared.length > 0 && res.contentType) {
+        const actual = res.contentType.split(";")[0].trim().toLowerCase();
+        if (actual && !declared.some((d) => mediaMatches(d.toLowerCase(), actual))) {
+            out.push(apiSignal(op, "content-type-mismatch", "warn", `${label} → Content-Type "${actual}" is not among documented [${declared.join(", ")}]`, where));
+        }
+    }
+    if (res.status >= 200 && res.status < 300) {
+        const schema = jsonSchemaOf(matched, resolver);
+        if (schema) {
+            // PRIMARY: full JSON-Schema validation via ajv (resolves $refs). Emits the offending
+            // PATHS only (redaction-safe — schema-derived messages, never body values).
+            const result = validator?.validate(schema, res.bodyText);
+            if (result?.validated) {
+                if (!result.ok) {
+                    out.push(apiSignal(op, "response-schema-violation", "fail", `${label} → response body violates schema: ${formatViolations(result.violations)}`, where));
+                }
+            }
+            else {
+                // FALLBACK (no validator, or schema didn't compile): the light required-prop check.
+                const missing = missingRequired(schema, res.bodyText, resolver);
+                if (missing.length > 0) {
+                    out.push(apiSignal(op, "response-shape-mismatch", "fail", `${label} → response is missing required propert${missing.length > 1 ? "ies" : "y"}: ${missing.join(", ")}`, where));
+                }
+            }
+        }
+    }
+    return out;
+}

package/dist/api/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/api/classify.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/F,OAAO,EAA0B,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAqBvE;uFACuF;AACvF,MAAM,UAAU,WAAW,CAAC,EAAgB,EAAE,IAAmB;IAC/D,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,SAAS,CACvB,EAAgB,EAChB,IAAmB,EACnB,QAAyB,EACzB,OAAe,EACf,KAAa;IAEb,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,OAAO;QACP,GAAG,EAAE,KAAK;QACV,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC;QAChC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAc;IACpD,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB,EAAE,QAAsB;IACjE,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAyB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED;yFACyF;AACzF,SAAS,eAAe,CAAC,MAAkB,EAAE,QAAgB,EAAE,QAAsB;IACnF,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAyB,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,2DAA2D;IACxE,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAK,IAAgC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAAgB,EAChB,GAAgB,EAChB,KAAa,EACb,QAAsB,EACtB,SAA6B;IAE7B,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAEjC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,WAAW,GAAG,CAAC,MAAM,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CACN,SAAS,CACP,EAAE,EACF,qBAAqB,EACrB,MAAM,EACN,GAAG,KAAK,WAAW,GAAG,CAAC,MAAM,uCAAuC,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAC/F,KAAK,CACN,CACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CACN,SAAS,CACP,EAAE,EACF,uBAAuB,EACvB,MAAM,EACN,GAAG,KAAK,oBAAoB,MAAM,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACtF,KAAK,CACN,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,qFAAqF;YACrF,4EAA4E;YAC5E,MAAM,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,GAAG,CAAC,IAAI,CACN,SAAS,CACP,EAAE,EACF,2BAA2B,EAC3B,MAAM,EACN,GAAG,KAAK,qCAAqC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAClF,KAAK,CACN,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,oFAAoF;gBACpF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,GAAG,CAAC,IAAI,CACN,SAAS,CACP,EAAE,EACF,yBAAyB,EACzB,MAAM,EACN,GAAG,KAAK,0CAA0C,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3G,KAAK,CACN,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}