dsh-zen-remote 1.1.16 → 2.0.0

package/lib/admin-routes.js

@@ -0,0 +1,526 @@
+/**
+ * Admin routes for the 2.0.0 settings surface (T14): pairing, device
+ * management and a push test, driven from the DSH plugin page's settings
+ * block (the T15 client half) instead of the gateway's own admin page.
+ *
+ * Why these live in the HOST process rather than the gateway: the gateway's
+ * admin API is loopback-only by design (isLocalDirect — loopback peer, no
+ * X-Forwarded-* headers), while a browser page runs on DSH's origin, never
+ * on the gateway's. So the browser talks to THESE same-origin routes and
+ * this module then calls the gateway AS the local machine — a bare
+ * `http://127.0.0.1:<port>` request with hand-built headers (no cookies, no
+ * Origin, no forwarded anything) that `isLocalDirect` admits.
+ *
+ * Two walls every route applies, in order:
+ *
+ *   1. `admit` — routes registered via webServer.register do NOT pass
+ *      through DSH's `/api` authentication, so each request must ask the
+ *      connection service itself; its rejection is relayed verbatim.
+ *   2. The gateway marker. A request wearing `x-zen-remote-via` arrived
+ *      THROUGH the gateway from a remote device (the gateway strips
+ *      client-forged copies before stamping its own). POSTs are refused —
+ *      pairing and device management are server-side acts. GET status is
+ *      answered, but with the live pairing code stripped. The marker wall
+ *      runs BEFORE same-origin because a forwarded request presents as
+ *      same-origin (the gateway rewrites Origin/Host), so the marker is the
+ *      only thing identifying it.
+ *
+ * The ONE deliberate exception is the shares route (T33a): toggling session
+ * sharing is exactly what the spec grants the Web application端 (devices
+ * behind the gateway have full server permissions), so there the marker wall
+ * is skipped and a forwarded POST passes once it clears admit and
+ * same-origin. Desktop application clients can never reach any admin route —
+ * the gateway only forwards them into the relay prefix.
+ *
+ * Every POST additionally passes sameOriginPost, and bodies are capped at
+ * 16 KiB of JSON object. The handler is built by a factory so the tests can
+ * drive it over a real socket with a mock gateway and a mock admit.
+ */
+import { request as httpRequest } from 'node:http';
+import { responseJson, sameOriginPost } from './http.js';
+import { restoreBusy } from './share-ops.js';
+/** Prefix all admin routes live under (one webServer prefix registration). */
+export const ADMIN_ROUTE_PREFIX = '/_dsh/zen-remote/admin';
+/** GET: the gateway's status verbatim plus the effective config; remote
+ * callers get the live pairing code stripped. */
+export const ADMIN_STATUS_ROUTE = `${ADMIN_ROUTE_PREFIX}/status`;
+/** POST `{role}`: mint a pairing code. */
+export const ADMIN_PAIR_ROUTE = `${ADMIN_ROUTE_PREFIX}/pair`;
+/** POST `{action, id?, role?, kind?, name?}`: device management, whitelist below. */
+export const ADMIN_ACTION_ROUTE = `${ADMIN_ROUTE_PREFIX}/action`;
+/** POST: fire one fixed test notification through the gateway. */
+export const ADMIN_PUSH_TEST_ROUTE = `${ADMIN_ROUTE_PREFIX}/push-test`;
+/** GET: every shared session with its clocks, viewers and titles.
+ * POST `{action, sessionId?}`: share / unshare / unshare-all (T33a). */
+export const ADMIN_SHARES_ROUTE = `${ADMIN_ROUTE_PREFIX}/shares`;
+/** Longest wait for one gateway round-trip. */
+const GATEWAY_TIMEOUT_MS = 5000;
+/** Inbound admin body cap — the settings forms send a few hundred bytes. */
+const MAX_BODY_BYTES = 16 * 1024;
+/** Tag every test notification carries, so the phone can spot and sweep them. */
+const TEST_PUSH_TAG = 'dsh-zen-remote-test';
+/** The device-management verbs this surface forwards. `new-code` is
+ * deliberately absent: minting codes is the pair route's job, and forwarding
+ * it twice would only blur which surface created the live code. */
+const FORWARDABLE_ACTIONS = new Set(['set-role', 'set-kind', 'rename', 'revoke', 'revoke-all']);
+/** The share-toggle verbs POST shares understands (T33a). */
+const SHARE_ACTIONS = new Set(['share', 'unshare', 'unshare-all']);
+/** Longest wait for one session/projections call (titles, share existence).
+ * A hung typert gateway must not hold a route open forever. */
+const PROJECTION_TIMEOUT_MS = 5000;
+/** Fixed test-push copy — Chinese by default, English for `lang: 'en'`
+ * (`'auto'` has no requester signal here, so it falls to Chinese). */
+const TEST_PUSH_COPY = {
+    zh: { title: 'DSH 测试推送', body: '这是一条来自 dsh-zen-remote 设置页的测试通知' },
+    en: { title: 'DSH Test Push', body: 'This is a test notification from the dsh-zen-remote settings page' },
+};
+/**
+ * One rejection carrying the status the client should see.
+ *
+ * Fields are assigned in the body rather than declared as constructor
+ * parameter properties: check scripts import these modules through Node's
+ * strip-only type stripping, which rejects that syntax (same reason as
+ * UploadError in index.ts).
+ */
+class AdminError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'AdminError';
+        this.status = status;
+        this.code = code;
+    }
+}
+/**
+ * Read the whole body under the cap and demand one JSON object. An empty
+ * body counts as `{}` — the gateway's own reader treats absence the same
+ * way, and the push-test button posts no body at all.
+ */
+async function readJsonBody(req) {
+    // A declared oversized body is refused before a byte is read, so the client
+    // gets its 400 without the server (or the phone) spending the whole body on
+    // the wire. The streaming cap below remains as the chunked-body guard.
+    const declared = req.headers['content-length'];
+    const expected = declared === undefined ? undefined : Number(declared);
+    if (expected !== undefined && Number.isSafeInteger(expected) && expected > MAX_BODY_BYTES) {
+        throw new AdminError(400, 'bad-request', `request body exceeds the ${MAX_BODY_BYTES}-byte limit`);
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += bytes.length;
+        if (size > MAX_BODY_BYTES) {
+            throw new AdminError(400, 'bad-request', `request body exceeds the ${MAX_BODY_BYTES}-byte limit`);
+        }
+        chunks.push(bytes);
+    }
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text.trim() === '')
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new AdminError(400, 'bad-request', 'request body must be valid JSON');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new AdminError(400, 'bad-request', 'request body must be a JSON object');
+    }
+    return parsed;
+}
+/**
+ * One call to the gateway AS the local machine: a fresh loopback connection
+ * with only the headers this call needs. No cookie, no Origin, and above all
+ * no X-Forwarded-* — any of those would make the gateway's isLocalDirect
+ * classify the call as proxied/remote and refuse the local-only surface.
+ * Resolves with whatever parsable JSON the gateway returned, at any status;
+ * deciding what that means for the route is the caller's job.
+ */
+async function callGateway(options, method, path, payload) {
+    const body = payload === undefined ? undefined : JSON.stringify(payload);
+    return await new Promise((resolve, reject) => {
+        const request = httpRequest(new URL(path, options.gatewayBase), {
+            method,
+            headers: body === undefined
+                ? undefined
+                : { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': String(Buffer.byteLength(body)) },
+            signal: AbortSignal.timeout(options.timeoutMs ?? GATEWAY_TIMEOUT_MS),
+        }, (response) => {
+            const chunks = [];
+            response.on('data', (chunk) => {
+                chunks.push(chunk);
+            });
+            response.on('error', () => {
+                reject(new AdminError(502, 'gateway-unreachable', 'The gateway response failed'));
+            });
+            response.on('end', () => {
+                try {
+                    resolve({ status: response.statusCode ?? 0, body: JSON.parse(Buffer.concat(chunks).toString('utf8')) });
+                }
+                catch {
+                    reject(new AdminError(502, 'gateway-unreachable', 'The gateway returned an unparsable response'));
+                }
+            });
+        });
+        request.on('error', () => {
+            reject(new AdminError(502, 'gateway-unreachable', 'The gateway did not answer'));
+        });
+        request.end(body);
+    });
+}
+/**
+ * One gateway round-trip for a state-changing route. A 2xx reply relays to
+ * the browser verbatim; anything else becomes a 502 error envelope — the
+ * gateway DID answer, but with a refusal the settings page must not mistake
+ * for success (and must not see raw, since the envelope shape is ours).
+ */
+async function relay(options, method, path, payload, res) {
+    const reply = await callGateway(options, method, path, payload);
+    if (reply.status < 200 || reply.status >= 300) {
+        responseJson(res, 502, { ok: false, error: { code: 'gateway-error', status: reply.status } });
+        return;
+    }
+    responseJson(res, reply.status, reply.body);
+}
+function testPushPayload(lang) {
+    return { ...(lang === 'en' ? TEST_PUSH_COPY.en : TEST_PUSH_COPY.zh), tag: TEST_PUSH_TAG };
+}
+/** GET status: the gateway payload plus the live config. Recomputed per
+ * request — volatile row fields (serverName, idleHours, …) change without a
+ * plugin restart, so an apply-time snapshot would go stale. */
+async function respondStatus(options, req, res) {
+    const viaGateway = req.headers['x-zen-remote-via'] !== undefined;
+    const config = options.getConfig();
+    let gateway = null;
+    let gatewayStatus = null;
+    let gatewayReachable = false;
+    try {
+        const reply = await callGateway(options, 'GET', '/lan-gate/status');
+        gatewayStatus = reply.status;
+        // A parsable JSON reply is not automatically a healthy gateway: an error
+        // envelope (403, 500) must not surface as "reachable".
+        if (reply.status >= 200 && reply.status < 300) {
+            gateway = reply.body;
+            gatewayReachable = true;
+        }
+    }
+    catch {
+        // No answer at all (refused, reset, timeout, non-JSON): gatewayStatus
+        // stays null and the settings page renders from config alone.
+    }
+    // A remote device may see the device list but never the live pairing code.
+    if (viaGateway && gateway !== null && typeof gateway === 'object') {
+        ;
+        gateway.pairing = null;
+    }
+    responseJson(res, 200, { ok: true, gateway, gatewayReachable, gatewayStatus, config, viaGateway });
+}
+/**
+ * One call to the typert gateway's `session/projections`, under the per-call
+ * timeout. Every failure mode the route can survive is a VALUE here — only
+ * a transport failure or a timeout throws, and the caller decides what those
+ * mean (titles: null; existence: 502). The typert lookup runs INSIDE the
+ * guard: a throwing lookup is a degraded composition, not a route failure.
+ * The timeout rides the call's cancellation signal (`AbortSignal.timeout`,
+ * the same shape the relay passes into gateway calls), so a timed-out
+ * invocation is actually STOPPED, not merely abandoned by the waiter.
+ */
+async function projectionOf(options, sessionId) {
+    let gateway;
+    try {
+        gateway = options.typert?.();
+    }
+    catch {
+        return { kind: 'no-gateway' };
+    }
+    if (gateway === undefined)
+        return { kind: 'no-gateway' };
+    const value = await gateway.invoke({
+        namespace: 'session',
+        method: 'projections',
+        args: { request: { sessionId } },
+        signal: AbortSignal.timeout(options.projectionTimeoutMs ?? PROJECTION_TIMEOUT_MS),
+    });
+    if (value === null || value === undefined)
+        return { kind: 'no-session' };
+    const values = value.values;
+    return {
+        kind: 'values',
+        values: values !== null && typeof values === 'object' ? values : {},
+    };
+}
+/**
+ * One session title through `session/projections`. Anything other than a
+ * string answer — a null projection (session gone), a service-less or
+ * degraded composition, a transport failure, a timeout — is `null`, and one
+ * failed title must never fail the listing around it.
+ */
+async function titleOf(options, sessionId) {
+    try {
+        const outcome = await projectionOf(options, sessionId);
+        if (outcome.kind !== 'values')
+            return null;
+        const title = outcome.values.title;
+        return typeof title === 'string' ? title : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Prove a session exists before `share` enters it into the table, and hand
+ * back its projection values for the caller's follow-up checks. The same
+ * `session/projections` call the titles use, where a `null` projection IS
+ * the "no such live session" answer. A transport failure or timeout is NOT
+ * a null — it refuses with 502 rather than quietly sharing a session nobody
+ * could see. Without a typert gateway there is nothing to ask, and the table
+ * alone is the truth available (empty values, no objection).
+ */
+async function requireSession(options, sessionId) {
+    let outcome;
+    try {
+        outcome = await projectionOf(options, sessionId);
+    }
+    catch {
+        throw new AdminError(502, 'gateway-unreachable', 'The session lookup failed');
+    }
+    if (outcome.kind === 'no-gateway')
+        return {};
+    if (outcome.kind === 'no-session')
+        throw new AdminError(404, 'no-session', `no live session "${sessionId}"`);
+    return outcome.values;
+}
+/** Release one sessionQuery lease: the observation is a plain
+ * `Symbol.dispose` carrier (RT dsh-session-query SessionObservationReader —
+ * every lease pins a cold-cache entry until released). */
+function releaseObservation(observation) {
+    const disposable = observation;
+    disposable[Symbol.dispose]?.();
+}
+/**
+ * Whether the session is a subagent child, judged off the DURABLE HEADER
+ * first: `sessionQuery.observeSession` reads the live-or-persisted session's
+ * immutable header (released immediately), and `origin === 'subagent'` is
+ * authoritative — per dsh-session's `validateSessionHeader` that marker is
+ * the one subagent signal, and a header WITHOUT it is an ordinary session
+ * (top-level or fork), full stop.
+ *
+ * Why the header wins over the projection's `subagent` identity: a fork of a
+ * subagent session REPLAYS the source's `subagent/descriptor` events, so the
+ * projection would wrongly condemn an ordinary fork — while a child whose
+ * descriptor turned corrupt projects null and would slip through.
+ *
+ * The projection identity stays as the fallback for compositions without
+ * sessionQuery and for reads that fail (session gone between the two
+ * lookups, unreadable log) — degraded knowledge beats none.
+ */
+async function isSubagentSession(options, sessionId, projectionValues) {
+    let query;
+    try {
+        query = options.sessionQuery?.();
+    }
+    catch {
+        query = undefined;
+    }
+    if (query !== undefined) {
+        let observation;
+        try {
+            observation = await query.observeSession(sessionId);
+        }
+        catch {
+            observation = undefined;
+        }
+        if (observation !== undefined) {
+            try {
+                return observation.header?.origin === 'subagent';
+            }
+            finally {
+                releaseObservation(observation);
+            }
+        }
+    }
+    return projectionValues.subagent !== null && typeof projectionValues.subagent === 'object';
+}
+/** GET shares: the table verbatim, plus the derived fields the settings page
+ * renders — the idle countdown (busy reads `Infinity` from the store, `null`
+ * on the wire), the current viewer count, and the session titles, fetched
+ * concurrently so one slow or failing lookup delays nobody else. */
+async function respondShares(options, res) {
+    const store = options.store;
+    const viewerCount = options.viewerCount ?? (() => 0);
+    const shares = store.list().map((entry) => {
+        const remaining = store.remainingMs(entry.sessionId);
+        return {
+            sessionId: entry.sessionId,
+            sharedAt: entry.sharedAt,
+            lastActivityAt: entry.lastActivityAt,
+            busy: entry.busy,
+            remainingMs: remaining === Infinity ? null : remaining,
+            viewers: viewerCount(entry.sessionId),
+            title: null,
+        };
+    });
+    await Promise.all(shares.map(async (row) => {
+        row.title = await titleOf(options, row.sessionId);
+    }));
+    responseJson(res, 200, { ok: true, shares });
+}
+/**
+ * Build the admin route handler for one plugin row. The returned handler
+ * owns the full response lifecycle of every request under
+ * {@link ADMIN_ROUTE_PREFIX} and never throws.
+ */
+export function createAdminHandler(options) {
+    return async (req, res) => {
+        // Wall 1 first: DSH's own admission (webServer routes skip /api auth).
+        const admission = options.admit(req);
+        if ('rejection' in admission) {
+            responseJson(res, admission.rejection, {
+                ok: false,
+                error: { code: admission.rejection === 401 ? 'unauthorized' : 'forbidden' },
+            });
+            return;
+        }
+        const url = new URL(req.url ?? '/', 'http://dsh.internal');
+        const route = url.pathname;
+        const method = req.method ?? 'GET';
+        try {
+            if (route === ADMIN_STATUS_ROUTE) {
+                if (method !== 'GET') {
+                    res.setHeader('Allow', 'GET');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET' } });
+                    return;
+                }
+                await respondStatus(options, req, res);
+                return;
+            }
+            if (route === ADMIN_SHARES_ROUTE) {
+                // No table, no route: a composition that never built the share store
+                // answers like any unknown admin path.
+                if (options.store === undefined) {
+                    responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown admin route' } });
+                    return;
+                }
+                if (method === 'GET') {
+                    await respondShares(options, res);
+                    return;
+                }
+                if (method === 'POST') {
+                    // The deliberate exception to the marker wall (see the module
+                    // comment): the Web application端 behind the gateway may toggle
+                    // sharing, so a via-gateway POST is NOT refused here. Same-origin
+                    // still applies — a forwarded request passes it because the
+                    // gateway rewrites Origin/Host onto the upstream origin.
+                    if (!sameOriginPost(req)) {
+                        responseJson(res, 403, {
+                            ok: false,
+                            error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                        });
+                        return;
+                    }
+                    const body = await readJsonBody(req);
+                    const action = body.action;
+                    if (typeof action !== 'string' || !SHARE_ACTIONS.has(action)) {
+                        responseJson(res, 400, {
+                            ok: false,
+                            error: { code: 'bad-action', message: `action must be one of ${[...SHARE_ACTIONS].join(', ')}` },
+                        });
+                        return;
+                    }
+                    const store = options.store;
+                    if (action === 'unshare-all') {
+                        for (const entry of store.list())
+                            store.unshare(entry.sessionId, 'manual');
+                        responseJson(res, 200, { ok: true });
+                        return;
+                    }
+                    const sessionId = body.sessionId;
+                    if (typeof sessionId !== 'string' || sessionId === '') {
+                        responseJson(res, 400, { ok: false, error: { code: 'bad-request', message: 'sessionId is required' } });
+                        return;
+                    }
+                    if (action === 'share') {
+                        const values = await requireSession(options, sessionId);
+                        // Subagent children never enter the table — they inherit
+                        // reachability through the parent chain. Judged off the durable
+                        // header when sessionQuery is reachable (a fork of a subagent
+                        // replays the descriptor events, so the projection alone would
+                        // both over- and under-reject — see isSubagentSession).
+                        if (await isSubagentSession(options, sessionId, values)) {
+                            responseJson(res, 400, {
+                                ok: false,
+                                error: { code: 'subagent-session', message: 'subagent sessions are reachable through their parent and cannot be shared alone' },
+                            });
+                            return;
+                        }
+                        store.share(sessionId);
+                        // A session whose agent is mid-turn must not look idle: the same
+                        // restore a restart runs, scoped to whatever runs right now.
+                        restoreBusy(store, options.listAgents ?? (() => []));
+                        responseJson(res, 200, { ok: true });
+                        return;
+                    }
+                    store.unshare(sessionId, 'manual');
+                    responseJson(res, 200, { ok: true });
+                    return;
+                }
+                res.setHeader('Allow', 'GET, POST');
+                responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET or POST' } });
+                return;
+            }
+            if (route === ADMIN_PAIR_ROUTE || route === ADMIN_ACTION_ROUTE || route === ADMIN_PUSH_TEST_ROUTE) {
+                if (method !== 'POST') {
+                    res.setHeader('Allow', 'POST');
+                    responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use POST' } });
+                    return;
+                }
+                // Wall 2, BEFORE same-origin: a forwarded remote request presents as
+                // same-origin (the gateway rewrites Origin/Host), so the marker is
+                // the only signal that says "this did not start on this machine".
+                if (req.headers['x-zen-remote-via'] !== undefined) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'via-gateway', message: '配对与设备管理只能在服务端本机操作' },
+                    });
+                    return;
+                }
+                if (!sameOriginPost(req)) {
+                    responseJson(res, 403, {
+                        ok: false,
+                        error: { code: 'origin-rejected', message: 'The request must originate from this DSH Web application' },
+                    });
+                    return;
+                }
+                if (route === ADMIN_PUSH_TEST_ROUTE) {
+                    await readJsonBody(req); // drained and validated; the copy is fixed
+                    // The copy language is read HERE, not at apply time: a lang edit on
+                    // the row applies live, and getConfig() re-resolves per request.
+                    await relay(options, 'POST', '/pwa/push/send', testPushPayload(options.getConfig().values.lang), res);
+                    return;
+                }
+                const body = await readJsonBody(req);
+                if (route === ADMIN_ACTION_ROUTE && (typeof body.action !== 'string' || !FORWARDABLE_ACTIONS.has(body.action))) {
+                    responseJson(res, 400, {
+                        ok: false,
+                        error: { code: 'bad-action', message: `action must be one of ${[...FORWARDABLE_ACTIONS].join(', ')}` },
+                    });
+                    return;
+                }
+                await relay(options, 'POST', route === ADMIN_PAIR_ROUTE ? '/lan-gate/pair' : '/lan-gate/action', body, res);
+                return;
+            }
+            responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown admin route' } });
+        }
+        catch (error) {
+            if (error instanceof AdminError) {
+                responseJson(res, error.status, { ok: false, error: { code: error.code, message: error.message } });
+                return;
+            }
+            responseJson(res, 500, { ok: false, error: { code: 'internal', message: 'The admin route failed' } });
+        }
+    };
+}
+//# sourceMappingURL=admin-routes.js.map

package/lib/admin-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-routes.js","sourceRoot":"","sources":["../src/admin-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAGlD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAI5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAA;AAE1D;iDACiD;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,kBAAkB,SAAS,CAAA;AAEhE,0CAA0C;AAC1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,kBAAkB,OAAO,CAAA;AAE5D,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,kBAAkB,SAAS,CAAA;AAEhE,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,kBAAkB,YAAY,CAAA;AAEtE;wEACwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,kBAAkB,SAAS,CAAA;AAEhE,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B,4EAA4E;AAC5E,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhC,iFAAiF;AACjF,MAAM,aAAa,GAAG,qBAAqB,CAAA;AAE3C;;mEAEmE;AACnE,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;AAEpH,6DAA6D;AAC7D,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;AAEvF;+DAC+D;AAC/D,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC;sEACsE;AACtE,MAAM,cAAc,GAAG;IACrB,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,gCAAgC,EAAE;IACjE,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,mEAAmE,EAAE;CACjG,CAAA;AAEV;;;;;;;GAOG;AACH,MAAM,UAAW,SAAQ,KAAK;IACnB,MAAM,CAAQ;IACd,IAAI,CAAQ;IAErB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAmED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC9C,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC1F,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,4BAA4B,cAAc,aAAa,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;QAC/E,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;QACpB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,4BAA4B,cAAc,aAAa,CAAC,CAAA;QACnG,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,iCAAiC,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,oCAAoC,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,MAAiC,CAAA;AAC1C,CAAC;AAOD;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,OAA4B,EAAE,MAAsB,EAAE,IAAY,EAAE,OAAiB;IAC9G,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACxE,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,WAAW,CACzB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,EAClC;YACE,MAAM;YACN,OAAO,EAAE,IAAI,KAAK,SAAS;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,cAAc,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE;YAC5G,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACrE,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC,CAAC,CAAA;YACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,6BAA6B,CAAC,CAAC,CAAA;YACnF,CAAC,CAAC,CAAA;YACF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC;oBACH,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAA;gBACzG,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,6CAA6C,CAAC,CAAC,CAAA;gBACnG,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAA;QAClF,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAAC,OAA4B,EAAE,MAAsB,EAAE,IAAY,EAAE,OAAgB,EAAE,GAAmB;IAC5H,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC9C,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC7F,OAAM;IACR,CAAC;IACD,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,IAA6B;IACpD,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAA;AAC3F,CAAC;AAED;;+DAE+D;AAC/D,KAAK,UAAU,aAAa,CAAC,OAA4B,EAAE,GAAoB,EAAE,GAAmB;IAClG,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAAA;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;IAClC,IAAI,OAAO,GAAY,IAAI,CAAA;IAC3B,IAAI,aAAa,GAAkB,IAAI,CAAA;IACvC,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAA;QACnE,aAAa,GAAG,KAAK,CAAC,MAAM,CAAA;QAC5B,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC9C,OAAO,GAAG,KAAK,CAAC,IAAI,CAAA;YACpB,gBAAgB,GAAG,IAAI,CAAA;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,8DAA8D;IAChE,CAAC;IACD,2EAA2E;IAC3E,IAAI,UAAU,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClE,CAAC;QAAC,OAAiC,CAAC,OAAO,GAAG,IAAI,CAAA;IACpD,CAAC;IACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AACpG,CAAC;AAWD;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE,SAAiB;IACzE,IAAI,OAAiC,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IACxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACjC,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE;QAChC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CAAC;KAClF,CAAC,CAAA;IACF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IACxE,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAA;IACrD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE;KACjG,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,OAA4B,EAAE,SAAiB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACtD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;QAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,OAA4B,EAAE,SAAiB;IAC3E,IAAI,OAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,CAAA;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,SAAS,GAAG,CAAC,CAAA;IAC5G,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED;;0DAE0D;AAC1D,SAAS,kBAAkB,CAAC,WAAmC;IAC7D,MAAM,UAAU,GAAG,WAAkD,CAAA;IACrE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,iBAAiB,CAC9B,OAA4B,EAC5B,SAAiB,EACjB,gBAAyC;IAEzC,IAAI,KAAmC,CAAA;IACvC,IAAI,CAAC;QACH,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,SAAS,CAAA;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,WAA+C,CAAA;QACnD,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,SAAS,CAAA;QACzB,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAA;YAClD,CAAC;oBAAS,CAAC;gBACT,kBAAkB,CAAC,WAAW,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,CAAA;AAC5F,CAAC;AAED;;;oEAGoE;AACpE,KAAK,UAAU,aAAa,CAAC,OAA4B,EAAE,GAAmB;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAmB,CAAA;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACpD,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACtD,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;YACrC,KAAK,EAAE,IAAqB;SAC7B,CAAA;IACH,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IACnD,CAAC,CAAC,CAAC,CAAA;IACH,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,uEAAuE;QACvE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;YAC7B,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,EAAE;gBACrC,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE;aAC5E,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,qBAAqB,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;oBAC7B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;oBAChG,OAAM;gBACR,CAAC;gBACD,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;gBACjC,qEAAqE;gBACrE,uCAAuC;gBACvC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAChC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;oBACnG,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;oBACjC,OAAM;gBACR,CAAC;gBACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,8DAA8D;oBAC9D,+DAA+D;oBAC/D,kEAAkE;oBAClE,4DAA4D;oBAC5D,yDAAyD;oBACzD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;4BACrB,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;yBACxG,CAAC,CAAA;wBACF,OAAM;oBACR,CAAC;oBACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;oBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;oBAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC7D,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;4BACrB,EAAE,EAAE,KAAK;4BACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,yBAAyB,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;yBACjG,CAAC,CAAA;wBACF,OAAM;oBACR,CAAC;oBACD,MAAM,KAAK,GAAe,OAAO,CAAC,KAAK,CAAA;oBACvC,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;wBAC7B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE;4BAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;wBAC1E,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;wBACpC,OAAM;oBACR,CAAC;oBACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;oBAChC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;wBACtD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAA;wBACvG,OAAM;oBACR,CAAC;oBACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;wBACvB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;wBACvD,yDAAyD;wBACzD,gEAAgE;wBAChE,8DAA8D;wBAC9D,+DAA+D;wBAC/D,wDAAwD;wBACxD,IAAI,MAAM,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;4BACxD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;gCACrB,EAAE,EAAE,KAAK;gCACT,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iFAAiF,EAAE;6BAChI,CAAC,CAAA;4BACF,OAAM;wBACR,CAAC;wBACD,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;wBACtB,iEAAiE;wBACjE,6DAA6D;wBAC7D,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;wBACpD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;wBACpC,OAAM;oBACR,CAAC;oBACD,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBAClC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;oBACpC,OAAM;gBACR,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;gBACnC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAA;gBACxG,OAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,kBAAkB,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;gBAClG,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;oBACjG,OAAM;gBACR,CAAC;gBACD,qEAAqE;gBACrE,mEAAmE;gBACnE,kEAAkE;gBAClE,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;oBAClD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE;qBAC7D,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0DAA0D,EAAE;qBACxG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;oBACpC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA,CAAC,2CAA2C;oBACnE,oEAAoE;oBACpE,iEAAiE;oBACjE,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;oBACrG,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;gBACpC,IAAI,KAAK,KAAK,kBAAkB,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBAC/G,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE;wBACrB,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,yBAAyB,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;qBACvG,CAAC,CAAA;oBACF,OAAM;gBACR,CAAC;gBACD,MAAM,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;gBAC3G,OAAM;YACR,CAAC;YACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAA;QACvG,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}