pi-codex-auto-review 0.1.2 → 0.1.3

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/tls-terminate-proxy.js

@@ -1,546 +0,0 @@
-/**
- * In-process TLS termination for HTTPS traffic through the forward proxy.
- *
- * When a MitmCA is configured, the forward proxy hands CONNECT requests here
- * instead of opening an opaque byte tunnel. We terminate the client's TLS
- * with a per-host leaf cert (see mitm-leaf.ts), parse the decrypted stream
- * as HTTP/1.1, and re-issue each request upstream over a real TLS
- * connection. The optional `filterRequest` callback runs on each parsed
- * request before it is forwarded.
- */
-import { Agent as HttpsAgent, createServer as createHttpsServer, request as httpsRequest, } from 'node:https';
-import { connect } from 'node:net';
-import { checkServerIdentity } from 'node:tls';
-import { unlink } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { logForDebugging } from '../utils/debug.js';
-import { decideAndRespond, respondDenied, respondUpstreamError, } from './request-filter.js';
-import { prepareBodySubstitution, } from './body-substitution.js';
-import { mintLeafCert, secureContextFor } from './mitm-leaf.js';
-import { directRequestOptions, formatAuthority, stripHopByHop, } from './parent-proxy.js';
-import { sha256Hex } from './aws-sigv4.js';
-/**
- * Upper bound on the request body the proxy will buffer to recompute a
- * literal SigV4 body hash. The signature must cover the exact bytes sent
- * upstream, so buffering is unavoidable for that shape — but without a
- * cap a sandboxed client could pin arbitrary host memory with one large
- * signed upload (awslabs/aws-sigv4-proxy buffers with no limit; we fail
- * closed instead). Bodies over the cap are denied with a 403; clients
- * with larger payloads should sign UNSIGNED-PAYLOAD, which streams.
- */
-export const MAX_SIGV4_RESIGN_BODY_BYTES = 64 * 1024 * 1024;
-/** Rejection cause when a body exceeds {@link MAX_SIGV4_RESIGN_BODY_BYTES}. */
-class BodyTooLargeError extends Error {
-}
-/**
- * True if `buf` starts with a TLS Handshake record header.
- *
- * Three bytes: content type 0x16 (Handshake) + legacy_record_version
- * 0x03,0x00–0x03. RFC 8446 §5.1 froze the record-layer version (TLS 1.3+
- * negotiate via the supported_versions extension, the wire header stays
- * ≤0x0303), so this holds for current and future TLS. Same predicate as
- * mitmproxy `starts_like_tls_record`; nginx `ssl_preread` routes on byte 0
- * alone and HAProxy `req.ssl_hello_type` reads 9 bytes to also extract the
- * handshake type — 3 is the established middle ground for "is this TLS".
- *
- * Routing heuristic, not a security check: a non-TLS stream that happens to
- * start 16 03 0x is handed to the TLS server, which then rejects it properly.
- */
-export function looksLikeClientHello(buf) {
-    return (buf.length >= 3 && buf[0] === 0x16 && buf[1] === 0x03 && buf[2] <= 0x03);
-}
-/**
- * Wait for the client's first post-CONNECT bytes and report whether they look
- * like a TLS ClientHello. The caller must already have written the
- * `200 Connection Established` line — clients don't send until they see it.
- *
- * Any bytes consumed here are returned in `.head` so the caller can forward
- * them to whichever downstream (terminate or opaque tunnel) it picks. The
- * socket is left paused so further bytes buffer until the downstream
- * `pipe()` resumes it.
- */
-export function peekForClientHello(socket, head) {
-    if (head.length >= 3) {
-        return Promise.resolve({ isTLS: looksLikeClientHello(head), head });
-    }
-    return new Promise(resolve => {
-        let buf = head;
-        const done = () => {
-            socket.removeListener('data', onData);
-            socket.removeListener('close', done);
-            resolve({ isTLS: looksLikeClientHello(buf), head: buf });
-        };
-        const onData = (chunk) => {
-            // Pause synchronously so anything after this chunk buffers for the
-            // downstream pipe() rather than being dropped in flowing mode.
-            socket.pause();
-            buf = buf.length ? Buffer.concat([buf, chunk]) : chunk;
-            if (buf.length >= 3)
-                return done();
-            socket.resume();
-        };
-        socket.on('data', onData);
-        socket.once('close', done);
-    });
-}
-/**
- * Relay `src` into `dst` with paused-mode reads (`'readable'` + `read()`)
- * instead of `src.pipe(dst)`.
- *
- * `pipe()` throttles a flowing source with `pause()`/`resume()`, and under
- * Bun a socket delivered by an http server's `'connect'` event corrupts its
- * byte stream across those pause/resume cycles once writes queue (reliably
- * reproducible with multi-megabyte uploads; the TLS server behind the relay
- * then fails record MAC verification and the client sees `bad_record_mac` /
- * a mid-upload reset). Pull-mode reads never call `pause()` and provide the
- * same flow control: `read()` is only called while `dst` has buffer space,
- * so the kernel backpressures the peer identically. Do not replace this
- * with `pipe()` — under Node both are equivalent, but under Bun only this
- * form is safe for CONNECT-upgraded sockets.
- */
-function relayPullMode(src, dst) {
-    const pump = () => {
-        let chunk;
-        while ((chunk = src.read()) !== null) {
-            if (!dst.write(chunk)) {
-                dst.once('drain', pump);
-                return;
-            }
-        }
-        src.once('readable', pump);
-    };
-    pump();
-    src.once('end', () => dst.end());
-}
-/**
- * Terminate the client's TLS on `socket`, parse the decrypted HTTP/1.1
- * stream, and forward each request to `target` over an upstream TLS
- * connection kept alive for the life of the client's connection (see
- * {@link createUpstreamLeg}).
- *
- * Preconditions: the caller has already validated `target` against the
- * domain allowlist; this function does not re-check it.
- *
- * Implementation: we stand up a short-lived https.Server on a unix socket
- * and pipe the client socket through it. The Node-idiomatic alternative —
- * feeding the raw socket to a non-listening server via
- * `emit('connection', socket)` — is not implemented by Bun's https.Server,
- * and SRT runs under both runtimes. A per-connection server lets the
- * request handler close over `target` (which carries the originally-
- * requested host:port) without socket-keyed lookups.
- */
-export function terminateAndForward(ca, filterRequest, mutateHeaders, getBodySubstitutions, socket, head, target, planSigv4, maxSigv4BodyBytes = MAX_SIGV4_RESIGN_BODY_BYTES) {
-    // ALPN advertises HTTP/1.1 only — terminating HTTP/2 would require a frame
-    // parser; clients negotiate down. The base secureContext covers clients
-    // that don't send SNI; SNICallback covers everyone else.
-    const baseLeaf = mintLeafCert(ca, target.hostname);
-    const inner = createHttpsServer({
-        ALPNProtocols: ['http/1.1'],
-        cert: baseLeaf.certPem,
-        key: baseLeaf.keyPem,
-        SNICallback: (servername, cb) => {
-            try {
-                cb(null, secureContextFor(ca, servername || target.hostname));
-            }
-            catch (err) {
-                cb(err);
-            }
-        },
-    });
-    const leg = createUpstreamLeg(target);
-    inner.on('request', (req, res) => {
-        // A client abort mid-request destroys req/res with an error; with no
-        // listener it escapes as an uncaughtException (the runtime emits it
-        // from node:_http_server).
-        req.on('error', err => {
-            logForDebugging(`[tls-terminate] client request error: ${err.message}`, {
-                level: 'error',
-            });
-        });
-        res.on('error', err => {
-            logForDebugging(`[tls-terminate] client response error: ${err.message}`, {
-                level: 'error',
-            });
-        });
-        forwardUpstreamGuarded(filterRequest, mutateHeaders, getBodySubstitutions, req, res, target, leg, planSigv4, maxSigv4BodyBytes);
-    });
-    inner.on('clientError', (err, sock) => {
-        // Post-handshake parse errors / resets on the loopback leg would
-        // otherwise escalate to an uncaughtException, same class as the
-        // request-stream errors handled above.
-        logForDebugging(`[tls-terminate] client connection error for ${target.hostname}: ${err.message}`, { level: 'error' });
-        sock.destroy();
-    });
-    inner.on('tlsClientError', (err, sock) => {
-        logForDebugging(`[tls-terminate] client TLS error for ${target.hostname}: ${err.message}`, { level: 'error' });
-        sock.destroy();
-    });
-    inner.on('upgrade', (_req, sock) => {
-        // WebSocket / non-HTTP over TLS — out of scope for now.
-        logForDebugging('[tls-terminate] upgrade request refused', {
-            level: 'warn',
-        });
-        sock.destroy();
-    });
-    const sockPath = innerSocketPath();
-    const cleanup = () => {
-        inner.close();
-        leg.agent.destroy();
-        unlink(sockPath, () => { });
-    };
-    inner.on('error', err => {
-        logForDebugging(`[tls-terminate] inner server listen failed: ${err.message}`, { level: 'error' });
-        socket.destroy();
-        cleanup();
-    });
-    inner.listen(sockPath, () => {
-        const loop = connect({ path: sockPath });
-        loop.on('error', err => {
-            logForDebugging(`[tls-terminate] inner loopback failed: ${err.message}`, {
-                level: 'error',
-            });
-            socket.destroy();
-            cleanup();
-        });
-        loop.once('connect', () => {
-            // The caller wrote `200 Connection Established` before sniffing for the
-            // ClientHello; `head` holds whatever the sniff consumed.
-            if (head.length)
-                loop.write(head);
-            relayPullMode(socket, loop);
-            loop.pipe(socket);
-        });
-        socket.on('error', () => loop.destroy());
-        socket.once('close', () => {
-            loop.destroy();
-            cleanup();
-        });
-        loop.once('close', () => socket.destroy());
-    });
-    inner.unref();
-}
-function createUpstreamLeg(target) {
-    const agent = new HttpsAgent({
-        keepAlive: true,
-        maxSockets: 1,
-        // We're a TLS-terminating proxy, not a trust boundary for the upstream
-        // server's identity — the runtime verifies it normally (system roots and
-        // NODE_EXTRA_CA_CERTS). Pin the identity to the tunnel's target so the
-        // check does not depend on how a runtime derives it from the Host header
-        // (some verify against `Host` verbatim, so a non-default port would
-        // never match a SAN); `servername` still carries the name for SNI.
-        checkServerIdentity: (_host, cert) => checkServerIdentity(target.hostname, cert),
-        ...(target.upstreamCA ? { ca: target.upstreamCA } : {}),
-    });
-    let vetted;
-    return {
-        agent,
-        address() {
-            if (!vetted) {
-                const probe = directRequestOptions(target.hostname, target.port, target.lookup, true);
-                vetted = probe;
-                probe.catch(() => {
-                    if (vetted === probe)
-                        vetted = undefined;
-                });
-            }
-            return vetted;
-        },
-        forgetAddress() {
-            vetted = undefined;
-        },
-    };
-}
-/**
- * True for the failure a reused keep-alive socket produces when the upstream
- * closed it while the request was on its way.
- */
-function isStaleSocketError(err) {
-    const code = err.code;
-    return code === 'ECONNRESET' || code === 'EPIPE';
-}
-/**
- * Destroy a denied client's request only after the 403 has flushed —
- * destroying the shared socket in the same tick can RST the response away.
- */
-function destroyAfterDenial(req, res) {
-    if (res.writableFinished || res.destroyed) {
-        req.destroy();
-        return;
-    }
-    res.once('finish', () => req.destroy());
-    res.once('close', () => req.destroy());
-}
-function forwardUpstreamGuarded(...args) {
-    // Fire-and-forget from the request handler: a rejection (e.g. a
-    // synchronous throw writing a denial to a client that already reset)
-    // must not become an unhandledRejection.
-    forwardUpstream(...args).catch(err => {
-        logForDebugging(`[tls-terminate] forwardUpstream failed: ${err.message}`, { level: 'error' });
-    });
-}
-async function forwardUpstream(filterRequest, mutateHeaders, getBodySubstitutions, req, res, target, leg, planSigv4, maxSigv4BodyBytes = MAX_SIGV4_RESIGN_BODY_BYTES) {
-    // req.url is the request-target verbatim. Inside a CONNECT tunnel almost
-    // every client sends origin-form (`/path?q`), but RFC 7230 §5.3.2 also
-    // permits absolute-form (`https://host/path`) and servers MUST accept it.
-    // Normalize to origin-form so concatenating onto `https://${host}` below
-    // yields a well-formed URL, and discard any client-supplied authority so
-    // the CONNECT-verified target stays authoritative (same rationale as the
-    // Host-header note below).
-    const path = originFormPath(req.url);
-    // The tunnel target as it goes on the wire: filterRequest URL, Host, SigV4.
-    const authority = formatAuthority(target.hostname, target.port, 443);
-    let body = req;
-    if (filterRequest) {
-        const ac = new AbortController();
-        res.once('close', () => ac.abort());
-        // Build the URL passed to filterRequest from the CONNECT target,
-        // NOT from `req.headers.host`. The Host header is supplied by the
-        // sandboxed client and can be spoofed: a sandboxed process can
-        // CONNECT to allowlisted host A and then send a decrypted request
-        // with `Host: B` (where B is some other allowlisted host). If we
-        // built the filterRequest URL from req.headers.host the callback
-        // would see "host=B" while the request is actually delivered to A.
-        // A consumer using filterRequest for per-host method gating (e.g.
-        // "POST allowed only to inference endpoints") would be bypassed —
-        // the agent could spoof Host: api.example.com on a CONNECT to a
-        // different allowlisted host, get the POST allowed, and have it
-        // delivered to the CONNECT target instead.
-        //
-        // Always derive the URL from the verified CONNECT target so
-        // filterRequest sees the actual upstream destination.
-        const out = await decideAndRespond(filterRequest, req, res, `https://${authority}${path}`, ac.signal, target.onFilterRequestDeny);
-        if (out === null)
-            return;
-        body = out;
-        // The client may have aborted during the filterRequest await — the tee
-        // branch is already destroyed and res 'close' already fired, so the
-        // teardown listeners attached below would never run. Don't dial an
-        // upstream for a dead client. A COMPLETED request is also
-        // destroyed=true (normal stream lifecycle after 'end'); only a
-        // destroy without a clean end is an abort.
-        if ((req.destroyed && !req.readableEnded) ||
-            res.destroyed ||
-            req.socket.destroyed ||
-            body.destroyed) {
-            body.destroy();
-            return;
-        }
-    }
-    // The upstream is dialed by vetted address (below), so Host and SNI are
-    // what carry the name: rebuild Host from the tunnel's target — the name the
-    // allowlist saw — rather than forwarding the client's spelling.
-    const fwdHeaders = stripHopByHop(req.headers);
-    fwdHeaders.host = authority;
-    // SigV4 planning runs on the PRE-substitution headers (the trigger is
-    // the fake access key id in the credential scope, which the header
-    // substitution below replaces) but on the POST-strip view: the plan's
-    // signed-header presence check must see exactly the set that will be
-    // signed and forwarded, or a signed hop-by-hop header would pass the
-    // check and then blow up inside the signer.
-    const sigv4Plan = planSigv4?.(req.method ?? 'GET', path, fwdHeaders, target.hostname);
-    // Header mutation runs after the allow decision and before httpsRequest.
-    // The upstream TLS handshake (rejectUnauthorized defaults to true)
-    // completes before any HTTP bytes are written, so mutated headers never
-    // reach an unverified server.
-    mutateHeaders?.(fwdHeaders, target.hostname);
-    // Masked-credential substitution in the request body, mirroring the
-    // header substitution above. undefined → the bare pipe below, exactly as
-    // before. May delete content-length from fwdHeaders (chunked fallback).
-    const bodyTransform = prepareBodySubstitution(getBodySubstitutions, req, fwdHeaders, target.hostname);
-    // SigV4 re-signing runs after substitution so the new signature covers
-    // the headers as they actually go upstream (real access key id, real
-    // session token). Same denial surface as filterRequest.
-    let bufferedBody;
-    if (sigv4Plan?.action === 'deny') {
-        respondDenied(res, sigv4Plan.reason);
-        body.destroy();
-        if (body !== req)
-            destroyAfterDenial(req, res);
-        return;
-    }
-    if (sigv4Plan?.action === 'resign') {
-        let payloadHash = sigv4Plan.payloadHash;
-        if (payloadHash === undefined) {
-            // The client signed a literal body hash: buffer the body and
-            // recompute so the signature covers the bytes actually sent. Body
-            // substitution runs FIRST — the buffered bytes (and therefore the
-            // hash and signature) must be the substituted body, not the
-            // sentinel-bearing one the client wrote.
-            const bodySource = bodyTransform ? body.pipe(bodyTransform) : body;
-            if (bodyTransform) {
-                body.on('error', err => bodyTransform.destroy(err));
-            }
-            try {
-                bufferedBody = await collectBody(bodySource, maxSigv4BodyBytes);
-            }
-            catch (err) {
-                if (err instanceof BodyTooLargeError) {
-                    respondDenied(res, `AWS SigV4 request uses a masked credential and signs a ` +
-                        `literal body hash, so the proxy must buffer the body to ` +
-                        `re-sign it, but the body exceeds the ` +
-                        `${maxSigv4BodyBytes}-byte buffering limit; denied. Sign ` +
-                        `the payload as UNSIGNED-PAYLOAD to stream it without ` +
-                        `buffering, or use an unmasked credential to have the ` +
-                        `request forwarded untouched.`);
-                    // Drain (discarding) whatever the client is still sending so it
-                    // can read the 403 instead of seeing a reset mid-upload.
-                    bodySource.resume();
-                    return;
-                }
-                logForDebugging(`[tls-terminate] failed to buffer body for SigV4 re-sign: ${err.message}`, { level: 'error' });
-                res.destroy();
-                return;
-            }
-            payloadHash = sha256Hex(bufferedBody);
-            // The body is fully buffered so its exact length is known — set the
-            // header unconditionally. end(Buffer) only auto-computes a
-            // content-length for methods that default to chunked encoding; on
-            // bodyless-default methods it would raw-append the buffer unframed.
-            fwdHeaders['content-length'] = String(bufferedBody.length);
-        }
-        try {
-            sigv4Plan.apply(fwdHeaders, authority, payloadHash);
-        }
-        catch (err) {
-            // Fail closed on any signer error — a request the proxy claimed to
-            // handle must not go upstream half-rewritten, and a client-crafted
-            // header set must not become an unhandled rejection.
-            respondDenied(res, `AWS SigV4 re-signing failed: ${err.message}`);
-            body.destroy();
-            if (body !== req)
-                destroyAfterDenial(req, res);
-            return;
-        }
-    }
-    // When the client declared a body but the forwarded headers carry no
-    // framing (chunked TE stripped as hop-by-hop, or a body transform
-    // deleted content-length), the upstream leg must re-frame explicitly:
-    // for bodyless-method requests the runtime would otherwise write the
-    // piped body bytes raw after complete-framed headers — a
-    // request-smuggling primitive. The SigV4 buffered path is exempt:
-    // end(bufferedBody) computes its own content-length.
-    const clientDeclaredBody = Boolean(req.headers['content-length'] || req.headers['transfer-encoding']);
-    if (clientDeclaredBody &&
-        bufferedBody === undefined &&
-        fwdHeaders['content-length'] === undefined &&
-        fwdHeaders['transfer-encoding'] === undefined) {
-        fwdHeaders['transfer-encoding'] = 'chunked';
-    }
-    const failUpstream = (err, sent) => {
-        logForDebugging(`[tls-terminate] upstream ${target.hostname}:${target.port} failed: ${err.message}`, { level: 'error' });
-        leg.forgetAddress();
-        if (sent?.reusedSocket && !res.headersSent && isStaleSocketError(err)) {
-            // The upstream closed the kept-alive socket as this request went out.
-            // Close the client's connection rather than answer 502: that is what
-            // the client would see on a direct keep-alive connection, and what its
-            // own retry policy is written for. Destroy the socket, not `res`: with
-            // no headers sent yet, Bun's res.destroy() answers `200 OK` with an
-            // empty body before closing, which would hand the client a fabricated
-            // success.
-            req.socket.destroy();
-            return;
-        }
-        respondUpstreamError(res, err);
-    };
-    // Vet and pick the upstream address first (see createUpstreamLeg); the
-    // name stays in Host and SNI.
-    let direct;
-    try {
-        direct = await leg.address();
-    }
-    catch (err) {
-        failUpstream(err);
-        return;
-    }
-    if (res.destroyed || req.socket.destroyed) {
-        // Client went away during the dial.
-        body.destroy();
-        return;
-    }
-    // TODO(terminating-tls): honour parentProxy for the upstream leg.
-    const upstream = httpsRequest({
-        ...direct,
-        agent: leg.agent,
-        path,
-        method: req.method,
-        headers: fwdHeaders,
-    }, upRes => {
-        // The response stream errors independently of the ClientRequest;
-        // pipe() does not handle source errors.
-        upRes.on('error', err => {
-            logForDebugging(`[tls-terminate] upstream response error: ${err.message}`, { level: 'error' });
-            res.destroy();
-        });
-        res.writeHead(upRes.statusCode ?? 502, stripHopByHop(upRes.headers));
-        upRes.pipe(res);
-    });
-    upstream.on('error', err => failUpstream(err, upstream));
-    res.on('close', () => upstream.destroy());
-    if (bufferedBody !== undefined) {
-        // SigV4 literal-hash path: the buffered body already went through
-        // bodyTransform above (when one applied), so send it verbatim.
-        upstream.end(bufferedBody);
-    }
-    else if (bodyTransform) {
-        // Errors on either side of the extra pipe stage tear the chain down —
-        // a stalled half-open upstream would otherwise wait for the client.
-        bodyTransform.on('error', err => upstream.destroy(err));
-        body.on('error', err => bodyTransform.destroy(err));
-        res.on('close', () => bodyTransform.destroy());
-        body.pipe(bodyTransform).pipe(upstream);
-    }
-    else {
-        // pipe() does not handle source errors. `body` may be a tee branch
-        // from decideAndRespond (not `req` itself), so a client abort surfaces
-        // here as an 'error' that would otherwise escape as an
-        // uncaughtException.
-        body.on('error', err => upstream.destroy(err));
-        body.pipe(upstream);
-    }
-}
-/**
- * Read a request body fully into memory (for SigV4 body-hash re-signing).
- * Rejects with {@link BodyTooLargeError} once more than `maxBytes` have
- * arrived, discarding everything buffered so far — the caller denies the
- * request, so holding the partial body would defeat the cap.
- */
-function collectBody(body, maxBytes) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let total = 0;
-        const onData = (c) => {
-            total += c.length;
-            if (total > maxBytes) {
-                chunks.length = 0;
-                body.removeListener('data', onData);
-                reject(new BodyTooLargeError(`request body exceeds ${maxBytes} bytes`));
-                return;
-            }
-            chunks.push(c);
-        };
-        body.on('data', onData);
-        body.once('end', () => resolve(Buffer.concat(chunks)));
-        body.once('error', reject);
-    });
-}
-function originFormPath(reqUrl) {
-    const raw = reqUrl ?? '/';
-    if (raw.startsWith('/'))
-        return raw;
-    try {
-        const u = new URL(raw);
-        return `${u.pathname}${u.search}` || '/';
-    }
-    catch {
-        // asterisk-form (`OPTIONS *`) or anything else non-absolute — pass through.
-        return raw;
-    }
-}
-let sockSeq = 0;
-function innerSocketPath() {
-    // Keep it short — macOS sun_path is 104 bytes.
-    return join(tmpdir(), `srt-tt-${process.pid}-${(sockSeq++).toString(36)}.sock`);
-}
-//# sourceMappingURL=tls-terminate-proxy.js.map

package/node_modules/@anthropic-ai/sandbox-runtime/dist/sandbox/tls-terminate-proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,KAAK,IAAI,UAAU,EACnB,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAElC,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,oBAAoB,GAGrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,oBAAoB,EAEpB,eAAe,EACf,aAAa,GACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAE3D,+EAA+E;AAC/E,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACL,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAE,IAAI,IAAI,CACzE,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY;IAEZ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAA;QACd,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YAClC,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,IAAI,KAA6B,CAAA;QACjC,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,EAA4B,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,IAAI,EAAE,CAAA;IACN,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAA;AAClC,CAAC;AA6BD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,aAAgD,EAChD,aAAiD,EACjD,oBAAsD,EACtD,MAAc,EACd,IAAY,EACZ,MAAuB,EACvB,SAAqB,EACrB,oBAA4B,2BAA2B;IAEvD,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAY,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAErC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,qEAAqE;QACrE,oEAAoE;QACpE,2BAA2B;QAC3B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACpB,eAAe,CAAC,yCAAyC,GAAG,CAAC,OAAO,EAAE,EAAE;gBACtE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACpB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,sBAAsB,CACpB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,GAAG,EACH,GAAG,EACH,MAAM,EACN,GAAG,EACH,SAAS,EACT,iBAAiB,CAClB,CAAA;IACH,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACpC,iEAAiE;QACjE,gEAAgE;QAChE,uCAAuC;QACvC,eAAe,CACb,+CAA+C,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EAChF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,eAAe,CACb,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,wDAAwD;QACxD,eAAe,CAAC,yCAAyC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QACnB,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,eAAe,CACb,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,wEAAwE;YACxE,yDAAyD;YACzD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AA4BD,SAAS,iBAAiB,CAAC,MAAuB;IAChD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC;QAC3B,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC;QACb,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,mEAAmE;QACnE,mBAAmB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACnC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAA;IACF,IAAI,MAAiD,CAAA;IACrD,OAAO;QACL,KAAK;QACL,OAAO;YACL,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,oBAAoB,CAChC,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,MAAM,EACb,IAAI,CACL,CAAA;gBACD,MAAM,GAAG,KAAK,CAAA;gBACd,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;oBACf,IAAI,MAAM,KAAK,KAAK;wBAAE,MAAM,GAAG,SAAS,CAAA;gBAC1C,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QACD,aAAa;YACX,MAAM,GAAG,SAAS,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAU;IACpC,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAA;IAChD,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO,CAAA;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;IACnE,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,OAAO,EAAE,CAAA;QACb,OAAM;IACR,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACvC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAAG,IAAwC;IAE3C,gEAAgE;IAChE,qEAAqE;IACrE,yCAAyC;IACzC,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACnC,eAAe,CACb,2CAA4C,GAAa,CAAC,OAAO,EAAE,EACnE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAgD,EAChD,aAAiD,EACjD,oBAAsD,EACtD,GAAoB,EACpB,GAAmB,EACnB,MAAuB,EACvB,GAAgB,EAChB,SAAqB,EACrB,oBAA4B,2BAA2B;IAEvD,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,2BAA2B;IAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACpE,IAAI,IAAI,GAAa,GAAG,CAAA;IACxB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;QACnC,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gEAAgE;QAChE,2CAA2C;QAC3C,EAAE;QACF,4DAA4D;QAC5D,sDAAsD;QACtD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,aAAa,EACb,GAAG,EACH,GAAG,EACH,WAAW,SAAS,GAAG,IAAI,EAAE,EAC7B,EAAE,CAAC,MAAM,EACT,MAAM,CAAC,mBAAmB,CAC3B,CAAA;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAM;QACxB,IAAI,GAAG,GAAG,CAAA;QACV,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,0DAA0D;QAC1D,+DAA+D;QAC/D,2CAA2C;QAC3C,IACE,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACrC,GAAG,CAAC,SAAS;YACb,GAAG,CAAC,MAAM,CAAC,SAAS;YACpB,IAAI,CAAC,SAAS,EACd,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAM;QACR,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,UAAU,CAAC,IAAI,GAAG,SAAS,CAAA;IAC3B,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,qEAAqE;IACrE,qEAAqE;IACrE,4CAA4C;IAC5C,MAAM,SAAS,GAAG,SAAS,EAAE,CAC3B,GAAG,CAAC,MAAM,IAAI,KAAK,EACnB,IAAI,EACJ,UAAU,EACV,MAAM,CAAC,QAAQ,CAChB,CAAA;IACD,yEAAyE;IACzE,mEAAmE;IACnE,wEAAwE;IACxE,8BAA8B;IAC9B,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5C,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,aAAa,GAAG,uBAAuB,CAC3C,oBAAoB,EACpB,GAAG,EACH,UAAU,EACV,MAAM,CAAC,QAAQ,CAChB,CAAA;IAED,uEAAuE;IACvE,qEAAqE;IACrE,wDAAwD;IACxD,IAAI,YAAgC,CAAA;IACpC,IAAI,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,IAAI,IAAI,KAAK,GAAG;YAAE,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAM;IACR,CAAC;IACD,IAAI,SAAS,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,WAAW,GAAG,SAAS,CAAC,WAAW,CAAA;QACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,6DAA6D;YAC7D,kEAAkE;YAClE,kEAAkE;YAClE,4DAA4D;YAC5D,yCAAyC;YACzC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAClE,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;YACD,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,aAAa,CACX,GAAG,EACH,yDAAyD;wBACvD,0DAA0D;wBAC1D,uCAAuC;wBACvC,GAAG,iBAAiB,sCAAsC;wBAC1D,uDAAuD;wBACvD,uDAAuD;wBACvD,8BAA8B,CACjC,CAAA;oBACD,gEAAgE;oBAChE,yDAAyD;oBACzD,UAAU,CAAC,MAAM,EAAE,CAAA;oBACnB,OAAM;gBACR,CAAC;gBACD,eAAe,CACb,4DAA6D,GAAa,CAAC,OAAO,EAAE,EACpF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;gBACD,GAAG,CAAC,OAAO,EAAE,CAAA;gBACb,OAAM;YACR,CAAC;YACD,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,CAAA;YACrC,oEAAoE;YACpE,2DAA2D;YAC3D,kEAAkE;YAClE,oEAAoE;YACpE,UAAU,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,mEAAmE;YACnE,qDAAqD;YACrD,aAAa,CACX,GAAG,EACH,gCAAiC,GAAa,CAAC,OAAO,EAAE,CACzD,CAAA;YACD,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,IAAI,IAAI,KAAK,GAAG;gBAAE,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC9C,OAAM;QACR,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,yDAAyD;IACzD,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,kBAAkB,GAAG,OAAO,CAChC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAClE,CAAA;IACD,IACE,kBAAkB;QAClB,YAAY,KAAK,SAAS;QAC1B,UAAU,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAC1C,UAAU,CAAC,mBAAmB,CAAC,KAAK,SAAS,EAC7C,CAAC;QACD,UAAU,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;IAC7C,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAU,EAAE,IAAoB,EAAE,EAAE;QACxD,eAAe,CACb,4BAA4B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,GAAG,CAAC,aAAa,EAAE,CAAA;QACnB,IAAI,IAAI,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,WAAW;YACX,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;YACpB,OAAM;QACR,CAAC;QACD,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAA;IACD,uEAAuE;IACvE,8BAA8B;IAC9B,IAAI,MAA4B,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,GAAY,CAAC,CAAA;QAC1B,OAAM;IACR,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,oCAAoC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,OAAM;IACR,CAAC;IAED,kEAAkE;IAClE,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,GAAG,MAAM;QACT,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI;QACJ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,UAAU;KACpB,EACD,KAAK,CAAC,EAAE;QACN,iEAAiE;QACjE,wCAAwC;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACtB,eAAe,CACb,4CAA4C,GAAG,CAAC,OAAO,EAAE,EACzD,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,GAAG,CAAC,OAAO,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC,CACF,CAAA;IAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IAExD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,kEAAkE;QAClE,+DAA+D;QAC/D,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC5B,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,sEAAsE;QACtE,oEAAoE;QACpE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QACvD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,uEAAuE;QACvE,uDAAuD;QACvD,qBAAqB;QACrB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAc,EAAE,QAAgB;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE;YAC3B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAA;YACjB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;gBACjB,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBACnC,MAAM,CAAC,IAAI,iBAAiB,CAAC,wBAAwB,QAAQ,QAAQ,CAAC,CAAC,CAAA;gBACvE,OAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC,CAAA;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,GAAG,GAAG,MAAM,IAAI,GAAG,CAAA;IACzB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,OAAO,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,GAAG,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,SAAS,eAAe;IACtB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CACzD,CAAA;AACH,CAAC"}