ysk-server-core 1.0.0

package/dist/hosting/ssl-certs.js

@@ -0,0 +1,462 @@
+/**
+ * Real SSL certificate management: disk files under dataDir/certs + single registry row per domain.
+ */
+import { existsSync, mkdirSync, writeFileSync, readdirSync, readFileSync, statSync, rmSync, } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID, X509Certificate } from 'node:crypto';
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+const PEM_CERT = /-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----/;
+const PEM_KEY = /-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]+-----END (RSA |EC |OPENSSH )?PRIVATE KEY-----/;
+export function validatePemBundle(fullchain, privkey) {
+    if (!PEM_CERT.test(fullchain)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0295'), {
+            httpStatus: 400,
+        });
+    }
+    if (!PEM_KEY.test(privkey)) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0389'), {
+            httpStatus: 400,
+        });
+    }
+}
+export function normalizeDomain(domain) {
+    const d = domain.trim().toLowerCase().replace(/\.$/, '');
+    // Allow single-label wildcard: *.example.com
+    if (d.startsWith('*.')) {
+        const base = d.slice(2);
+        if (!/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(base) || base.length < 3 || base.includes('..')) {
+            throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1346'), { httpStatus: 400 });
+        }
+        return d;
+    }
+    if (!/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/.test(d) || d.length < 3 || d.includes('..')) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n0629'), { httpStatus: 400 });
+    }
+    return d;
+}
+/** Parse leaf cert expiry; returns ISO or null if unreadable */
+export function parseCertExpiryFromPem(pem) {
+    try {
+        const block = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/);
+        if (!block)
+            return null;
+        const x509 = new X509Certificate(block[0]);
+        const d = new Date(x509.validTo);
+        return Number.isNaN(d.getTime()) ? null : d.toISOString();
+    }
+    catch {
+        return null;
+    }
+}
+export function parseCertExpiryFromPath(path) {
+    if (!existsSync(path))
+        return null;
+    try {
+        return parseCertExpiryFromPem(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Keep at most one certificate row per domain (newest wins). */
+export function upsertCertificateRow(db, row) {
+    const domain = row.domain.toLowerCase();
+    const others = db.snapshot.certificates.filter((c) => String(c.domain).toLowerCase() !== domain);
+    db.snapshot.certificates = [row, ...others].slice(0, 100);
+    db.persist();
+    return row;
+}
+/**
+ * Write cert files under dataDir/certs/<domain>/ and register in store (1 row / domain).
+ */
+export function uploadCertificate(input) {
+    const domain = normalizeDomain(input.domain);
+    validatePemBundle(input.fullchainPem, input.privkeyPem);
+    const dir = join(input.dataDir, 'certs', domain);
+    mkdirSync(dir, { recursive: true });
+    const fullchain_path = join(dir, 'fullchain.pem');
+    const privkey_path = join(dir, 'privkey.pem');
+    writeFileSync(fullchain_path, input.fullchainPem.trim() + '\n', { mode: 0o644 });
+    writeFileSync(privkey_path, input.privkeyPem.trim() + '\n', { mode: 0o600 });
+    const now = new Date().toISOString();
+    const expires = parseCertExpiryFromPem(input.fullchainPem);
+    const existing = findCertForDomain(input.db, domain);
+    const row = {
+        id: existing?.id ?? randomUUID(),
+        domain,
+        provider: 'upload',
+        fullchain_path,
+        privkey_path,
+        apply_status: 'uploaded',
+        ok: true,
+        notes: [tl('notes.auto.t0412', { v0: (dir) })],
+        created_at: existing?.created_at ?? now,
+        updated_at: now,
+        actor: input.actor,
+        expires_at: expires ?? undefined,
+    };
+    return upsertCertificateRow(input.db, row);
+}
+/** Upsert LE plan / result without inventing a second row for the same domain. */
+export function upsertLetsEncryptRecord(input) {
+    const domain = normalizeDomain(input.domain);
+    const now = new Date().toISOString();
+    const existing = findCertForDomain(input.db, domain);
+    const lePaths = {
+        fullchain_path: `/etc/letsencrypt/live/${domain}/fullchain.pem`,
+        privkey_path: `/etc/letsencrypt/live/${domain}/privkey.pem`,
+    };
+    let apply_status = 'planned';
+    if (input.run && input.executed && input.ok)
+        apply_status = 'issued';
+    else if (input.run && !input.ok)
+        apply_status = 'failed';
+    else if (!input.run)
+        apply_status = 'planned';
+    const live = resolveLetsEncryptLivePaths(domain);
+    const expires = live.exists ? parseCertExpiryFromPath(live.fullchain) : existing?.expires_at;
+    const row = {
+        id: existing?.id ?? randomUUID(),
+        domain,
+        provider: 'letsencrypt',
+        fullchain_path: live.exists
+            ? live.fullchain
+            : existing?.fullchain_path ?? lePaths.fullchain_path,
+        privkey_path: live.exists
+            ? live.privkey
+            : existing?.privkey_path ?? lePaths.privkey_path,
+        apply_status,
+        ok: input.ok,
+        notes: input.notes,
+        commands: input.commands,
+        email: input.email,
+        created_at: existing?.created_at ?? now,
+        updated_at: now,
+        actor: input.actor,
+        expires_at: expires ?? undefined,
+    };
+    return upsertCertificateRow(input.db, row);
+}
+export function findCertForDomain(db, domain) {
+    const d = domain.trim().toLowerCase();
+    const row = db.snapshot.certificates.find((c) => String(c.domain).toLowerCase() === d);
+    return row;
+}
+export function resolveManagedCertPaths(dataDir, domain) {
+    const fullchain = join(dataDir, 'certs', domain, 'fullchain.pem');
+    const privkey = join(dataDir, 'certs', domain, 'privkey.pem');
+    return {
+        fullchain,
+        privkey,
+        exists: existsSync(fullchain) && existsSync(privkey),
+    };
+}
+/** Host path used by certbot --nginx / certonly (not under dataDir). */
+export function resolveLetsEncryptLivePaths(domain) {
+    const d = domain.trim().toLowerCase().replace(/\.$/, '');
+    const fullchain = `/etc/letsencrypt/live/${d}/fullchain.pem`;
+    const privkey = `/etc/letsencrypt/live/${d}/privkey.pem`;
+    return {
+        fullchain,
+        privkey,
+        exists: existsSync(fullchain) && existsSync(privkey),
+    };
+}
+/**
+ * Prefer managed dataDir certs, then Let's Encrypt live/, then stored paths.
+ * Used so UI can show expiry for LE-issued certs outside dataDir.
+ */
+export function resolveBestCertPaths(dataDir, domain, stored) {
+    const managed = resolveManagedCertPaths(dataDir, domain);
+    if (managed.exists) {
+        return {
+            fullchain: managed.fullchain,
+            privkey: managed.privkey,
+            exists: true,
+            location: 'managed',
+        };
+    }
+    const le = resolveLetsEncryptLivePaths(domain);
+    if (le.exists) {
+        return {
+            fullchain: le.fullchain,
+            privkey: le.privkey,
+            exists: true,
+            location: 'letsencrypt',
+        };
+    }
+    const fc = stored?.fullchain_path ? String(stored.fullchain_path) : '';
+    const pk = stored?.privkey_path ? String(stored.privkey_path) : '';
+    if (fc && pk && existsSync(fc) && existsSync(pk)) {
+        return { fullchain: fc, privkey: pk, exists: true, location: 'stored' };
+    }
+    return {
+        fullchain: fc || le.fullchain || managed.fullchain,
+        privkey: pk || le.privkey || managed.privkey,
+        exists: false,
+        location: 'none',
+    };
+}
+/** Detect certbot.timer unit files (sync — no systemctl). */
+export function probeCertbotTimerUnitFiles() {
+    const candidates = [
+        { path: '/lib/systemd/system/certbot.timer', unit: 'certbot.timer' },
+        { path: '/usr/lib/systemd/system/certbot.timer', unit: 'certbot.timer' },
+        { path: '/etc/systemd/system/certbot.timer', unit: 'certbot.timer' },
+        {
+            path: '/lib/systemd/system/snap.certbot.renew.timer',
+            unit: 'snap.certbot.renew.timer',
+        },
+        {
+            path: '/etc/systemd/system/snap.certbot.renew.timer',
+            unit: 'snap.certbot.renew.timer',
+        },
+    ];
+    for (const c of candidates) {
+        if (existsSync(c.path)) {
+            return { unitFound: true, path: c.path, unitName: c.unit };
+        }
+    }
+    return { unitFound: false };
+}
+/**
+ * Probe auto-renew: systemd timer preferred, panel/system cron as secondary signal.
+ */
+export async function probeSslAutoRenewal(input) {
+    const files = probeCertbotTimerUnitFiles();
+    const cronJobCount = (input.cronJobs ?? []).filter((j) => {
+        const c = String(j.command ?? '');
+        return /certbot|letsencrypt|ssl.?renew/i.test(c);
+    }).length;
+    let enabled;
+    let active;
+    const unitName = files.unitName ?? 'certbot.timer';
+    if (input.host && files.unitFound && files.unitName) {
+        try {
+            const en = await input.host.runCommand(['systemctl', 'is-enabled', files.unitName], { timeoutMs: 4_000 });
+            enabled = en.exitCode === 0 || /enabled/i.test(`${en.stdout || ''}`);
+        }
+        catch {
+            enabled = undefined;
+        }
+        try {
+            const act = await input.host.runCommand(['systemctl', 'is-active', files.unitName], { timeoutMs: 4_000 });
+            active = act.exitCode === 0 || /active/i.test(`${act.stdout || ''}`);
+        }
+        catch {
+            active = undefined;
+        }
+    }
+    const notes = [];
+    let autoRenew = false;
+    let source = 'none';
+    const isSnap = Boolean(files.unitName?.includes('snap'));
+    if (files.unitFound) {
+        source = isSnap ? 'snap.certbot.renew.timer' : 'certbot.timer';
+        if (enabled === true) {
+            autoRenew = true;
+            notes.push(tl('ssl.renewTimerEnabled', { unit: unitName }));
+        }
+        else if (enabled === false) {
+            autoRenew = false;
+            notes.push(tl('ssl.renewTimerDisabled', { unit: unitName }));
+        }
+        else {
+            // Timer unit present but systemctl not queried / unknown
+            autoRenew = false;
+            notes.push(tl('ssl.renewTimerInstalledUnknown', { unit: unitName }));
+        }
+        if (active === true) {
+            notes.push(tl('ssl.renewTimerActive', { unit: unitName }));
+        }
+    }
+    else if (cronJobCount > 0) {
+        autoRenew = true;
+        source = 'cron';
+        notes.push(tl('ssl.renewViaCron', { count: cronJobCount }));
+    }
+    else {
+        autoRenew = false;
+        source = 'none';
+        notes.push(tl('ssl.renewNone'));
+    }
+    return {
+        autoRenew,
+        source,
+        unitFound: files.unitFound,
+        enabled,
+        active,
+        unitName: files.unitName,
+        cronJobCount,
+        notes,
+    };
+}
+export function listUploadedCertFiles(dataDir) {
+    const root = join(dataDir, 'certs');
+    if (!existsSync(root))
+        return [];
+    const out = [];
+    for (const domain of readdirSync(root)) {
+        const fullchain = join(root, domain, 'fullchain.pem');
+        const privkey = join(root, domain, 'privkey.pem');
+        if (existsSync(fullchain) && existsSync(privkey)) {
+            out.push({
+                domain,
+                fullchain,
+                privkey,
+                bytes: statSync(fullchain).size + statSync(privkey).size,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * One row per domain: merge registry + on-disk certs. Disk existence drives "files_exist".
+ */
+export function listCertificatesView(db, dataDir) {
+    const byDomain = new Map();
+    // Prefer store rows first
+    for (const raw of db.snapshot.certificates) {
+        const domain = String(raw.domain ?? '').toLowerCase();
+        if (!domain)
+            continue;
+        const best = resolveBestCertPaths(dataDir, domain, {
+            fullchain_path: raw.fullchain_path ? String(raw.fullchain_path) : undefined,
+            privkey_path: raw.privkey_path ? String(raw.privkey_path) : undefined,
+        });
+        const expiresFromDisk = best.exists && best.fullchain
+            ? parseCertExpiryFromPath(best.fullchain)
+            : null;
+        const expires = expiresFromDisk ??
+            (raw.expires_at ? String(raw.expires_at) : null);
+        const provider = (raw.provider === 'letsencrypt' ? 'letsencrypt' : 'upload');
+        // Honest status: never show "applied" without local files (unless LE issued on host paths)
+        let status = String(raw.apply_status ?? 'planned').toLowerCase();
+        if (status === 'applied' || status === 'issued_or_planned') {
+            status = best.exists
+                ? provider === 'letsencrypt'
+                    ? 'issued'
+                    : 'uploaded'
+                : provider === 'letsencrypt'
+                    ? 'planned'
+                    : 'missing';
+        }
+        if (best.exists && (status === 'planned' || status === 'draft' || status === 'missing')) {
+            status = provider === 'letsencrypt' ? 'issued' : 'uploaded';
+        }
+        if (best.exists && status === 'failed' && provider === 'letsencrypt') {
+            // Cert material exists on disk — treat as issued even if last attempt was marked failed
+            status = 'issued';
+        }
+        if (!best.exists && status === 'uploaded')
+            status = 'missing';
+        if (!best.exists && provider === 'letsencrypt' && status === 'issued') {
+            status = 'issued'; // may exist but unreadable by panel user
+        }
+        byDomain.set(domain, {
+            id: String(raw.id ?? domain),
+            domain,
+            provider,
+            status,
+            files_exist: best.exists,
+            fullchain_path: best.fullchain,
+            privkey_path: best.privkey,
+            expires_at: expires,
+            bytes: best.exists && best.fullchain && best.privkey
+                ? statSync(best.fullchain).size + statSync(best.privkey).size
+                : undefined,
+            notes: Array.isArray(raw.notes) ? raw.notes : [],
+            updated_at: raw.updated_at ? String(raw.updated_at) : undefined,
+            created_at: raw.created_at ? String(raw.created_at) : undefined,
+            email: raw.email ? String(raw.email) : undefined,
+        });
+    }
+    // Disk-only domains
+    for (const f of listUploadedCertFiles(dataDir)) {
+        if (byDomain.has(f.domain)) {
+            const cur = byDomain.get(f.domain);
+            cur.files_exist = true;
+            cur.fullchain_path = f.fullchain;
+            cur.privkey_path = f.privkey;
+            cur.bytes = f.bytes;
+            cur.expires_at = cur.expires_at ?? parseCertExpiryFromPath(f.fullchain);
+            if (cur.status === 'planned' || cur.status === 'missing' || cur.status === 'draft') {
+                cur.status = 'uploaded';
+            }
+            continue;
+        }
+        byDomain.set(f.domain, {
+            id: `disk-${f.domain}`,
+            domain: f.domain,
+            provider: 'upload',
+            status: 'uploaded',
+            files_exist: true,
+            fullchain_path: f.fullchain,
+            privkey_path: f.privkey,
+            expires_at: parseCertExpiryFromPath(f.fullchain),
+            bytes: f.bytes,
+            notes: [],
+        });
+    }
+    return [...byDomain.values()].sort((a, b) => a.domain.localeCompare(b.domain));
+}
+/**
+ * Delete managed cert files + all store rows for that domain (or by id).
+ */
+export function deleteCertificate(db, dataDir, idOrDomain) {
+    const notes = [];
+    let domain = idOrDomain.trim().toLowerCase();
+    const byId = db.snapshot.certificates.find((c) => String(c.id) === idOrDomain);
+    if (byId)
+        domain = String(byId.domain).toLowerCase();
+    else if (domain.startsWith('disk-'))
+        domain = domain.slice(5);
+    if (!domain) {
+        return { ok: false, domain: '', notes: [tl('notes.auto.n0260')] };
+    }
+    const certDir = join(dataDir, 'certs', domain);
+    if (existsSync(certDir)) {
+        rmSync(certDir, { recursive: true, force: true });
+        notes.push(tl('notes.tpl.deleted', { name: certDir }));
+    }
+    else {
+        notes.push(tl('notes.auto.n0992'));
+    }
+    const before = db.snapshot.certificates.length;
+    db.snapshot.certificates = db.snapshot.certificates.filter((c) => String(c.domain).toLowerCase() !== domain);
+    const removed = before - db.snapshot.certificates.length;
+    notes.push(removed > 0 ? tl('notes.auto.t0413', { v0: (removed) }) : tl('notes.auto.n1196'));
+    db.persist();
+    return { ok: true, domain, notes };
+}
+/** Dedupe existing polluted store (same domain many rows). */
+export function dedupeCertificatesInStore(db) {
+    const best = new Map();
+    for (const c of db.snapshot.certificates) {
+        const d = String(c.domain ?? '').toLowerCase();
+        if (!d)
+            continue;
+        const prev = best.get(d);
+        if (!prev) {
+            best.set(d, c);
+            continue;
+        }
+        const prevT = String(prev.updated_at ?? prev.created_at ?? '');
+        const curT = String(c.updated_at ?? c.created_at ?? '');
+        if (curT >= prevT)
+            best.set(d, c);
+    }
+    const next = [...best.values()];
+    const removed = db.snapshot.certificates.length - next.length;
+    db.snapshot.certificates = next;
+    if (removed > 0)
+        db.persist();
+    return removed;
+}
+/** Read PEM for tests / verification without exposing in API by default */
+export function readCertSnippet(path, max = 80) {
+    if (!existsSync(path))
+        return '';
+    return readFileSync(path, 'utf8').slice(0, max);
+}
+//# sourceMappingURL=ssl-certs.js.map

package/dist/hosting/ssl-certs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-certs.js","sourceRoot":"","sources":["../../src/hosting/ssl-certs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,aAAa,EACb,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAuC5D,MAAM,QAAQ,GAAG,6DAA6D,CAAC;AAC/E,MAAM,OAAO,GACX,qGAAqG,CAAC;AAExG,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,OAAe;IAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,6CAA6C;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB,CAClC,EAAe,EACf,GAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IACjG,EAAE,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,GAAyC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChG,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAOjC;IACC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC9C,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,GAAG,GAAsB;QAC7B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,UAAU,EAAE;QAChC,MAAM;QACN,QAAQ,EAAE,QAAQ;QAClB,cAAc;QACd,YAAY;QACZ,YAAY,EAAE,UAAU;QACxB,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9C,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG;QACvC,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,OAAO,IAAI,SAAS;KACjC,CAAC;IAEF,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,KAUvC;IACC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,yBAAyB,MAAM,gBAAgB;QAC/D,YAAY,EAAE,yBAAyB,MAAM,cAAc;KAC5D,CAAC;IACF,IAAI,YAAY,GAAG,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE;QAAE,YAAY,GAAG,QAAQ,CAAC;SAChE,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,YAAY,GAAG,QAAQ,CAAC;SACpD,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,YAAY,GAAG,SAAS,CAAC;IAE9C,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC/E,MAAM,GAAG,GAAsB;QAC7B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,UAAU,EAAE;QAChC,MAAM;QACN,QAAQ,EAAE,aAAa;QACvB,cAAc,EAAE,IAAI,CAAC,MAAM;YACzB,CAAC,CAAC,IAAI,CAAC,SAAS;YAChB,CAAC,CAAC,QAAQ,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc;QACtD,YAAY,EAAE,IAAI,CAAC,MAAM;YACvB,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,QAAQ,EAAE,YAAY,IAAI,OAAO,CAAC,YAAY;QAClD,YAAY;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG;QACvC,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,OAAO,IAAI,SAAS;KACjC,CAAC;IACF,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAe,EACf,MAAc;IAEd,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IACvF,OAAO,GAA+C,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,MAAc;IAEd,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO;QACL,SAAS;QACT,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,2BAA2B,CAAC,MAAc;IAKxD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,yBAAyB,CAAC,gBAAgB,CAAC;IAC7D,MAAM,OAAO,GAAG,yBAAyB,CAAC,cAAc,CAAC;IACzD,OAAO;QACL,SAAS;QACT,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;KACrD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,MAAc,EACd,MAA2D;IAO3D,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,OAAO;YACL,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,aAAa;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QAClD,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;QAC5C,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,MAAM;KACjB,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,0BAA0B;IAKxC,MAAM,UAAU,GAA0C;QACxD,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,eAAe,EAAE;QACpE,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,eAAe,EAAE;QACxE,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,eAAe,EAAE;QACpE;YACE,IAAI,EAAE,8CAA8C;YACpD,IAAI,EAAE,0BAA0B;SACjC;QACD;YACE,IAAI,EAAE,8CAA8C;YACpD,IAAI,EAAE,0BAA0B;SACjC;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAeD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAGzC;IACC,MAAM,KAAK,GAAG,0BAA0B,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC,MAAM,CAAC;IAEV,IAAI,OAA4B,CAAC;IACjC,IAAI,MAA2B,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,eAAe,CAAC;IAEnD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACpC,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC3C,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;YACF,OAAO,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CACrC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC1C,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAA+B,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,eAAe,CAAC;QAC/D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YAC7B,SAAS,GAAG,KAAK,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,SAAS,GAAG,KAAK,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5B,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,GAAG,MAAM,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,GAAG,MAAM,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;QACL,SAAS;QACT,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY;QACZ,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IAMnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAiF,EAAE,CAAC;IAC7F,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM;gBACN,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAe,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEpD,0BAA0B;IAC1B,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE;YACjD,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3E,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;SACtE,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS;YACnD,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,OAAO,GACX,eAAe;YACf,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAE1D,CAAC;QAClB,2FAA2F;QAC3F,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,GAAG,IAAI,CAAC,MAAM;gBAClB,CAAC,CAAC,QAAQ,KAAK,aAAa;oBAC1B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,QAAQ,KAAK,aAAa;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,GAAG,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACrE,wFAAwF;YACxF,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,UAAU;YAAE,MAAM,GAAG,SAAS,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,aAAa,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,GAAG,QAAQ,CAAC,CAAC,yCAAyC;QAC9D,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC;YAC5B,MAAM;YACN,QAAQ;YACR,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,cAAc,EAAE,IAAI,CAAC,SAAS;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO;YAC1B,UAAU,EAAE,OAAO;YACnB,KAAK,EACH,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO;gBAC3C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI;gBAC7D,CAAC,CAAC,SAAS;YACf,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE;YAC9D,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/D,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/D,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SACjD,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC;YACpC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;YACvB,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,SAAS,CAAC;YACjC,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC;YAC7B,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACpB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACnF,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;YAC1B,CAAC;YACD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE;YACrB,EAAE,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,CAAC,CAAC,SAAS;YAC3B,YAAY,EAAE,CAAC,CAAC,OAAO;YACvB,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAe,EACf,OAAe,EACf,UAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,UAAU,CAAC,CAAC;IAC/E,IAAI,IAAI;QAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;SAChD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;IAC/C,EAAE,CAAC,QAAQ,CAAC,YAAY,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CACxD,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC7F,EAAE,CAAC,OAAO,EAAE,CAAC;IACb,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB,CAAC,EAAe;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9D,EAAE,CAAC,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC;QAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/hosting/ssl-le-errors.d.ts

@@ -0,0 +1,19 @@
+export type LeFailureKind = 'nxdomain' | 'dns' | 'connection' | 'http01' | 'rate_limit' | 'caa' | 'challenge' | 'unknown';
+export type LeFailureExplain = {
+    kind: LeFailureKind;
+    domain?: string;
+    /** Primary human sentence for UI alert */
+    summary: string;
+    /** Short next-step line */
+    hint: string;
+};
+/** Extract a domain-looking token from certbot / ACME text. */
+export declare function extractDomainFromLeOutput(raw: string): string | undefined;
+/**
+ * Classify LE failure and return localized summary + hint.
+ * Prefers actionable DNS/HTTP reasons over raw certbot dump.
+ */
+export declare function explainLetsEncryptFailure(raw: string, fallbackDomain?: string): LeFailureExplain;
+/** Notes array: human reason first, then short raw tail for support. */
+export declare function notesForLetsEncryptFailure(raw: string, fallbackDomain?: string): string[];
+//# sourceMappingURL=ssl-le-errors.d.ts.map

package/dist/hosting/ssl-le-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-le-errors.d.ts","sourceRoot":"","sources":["../../src/hosting/ssl-le-errors.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,KAAK,GACL,YAAY,GACZ,QAAQ,GACR,YAAY,GACZ,KAAK,GACL,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAczE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,cAAc,CAAC,EAAE,MAAM,GACtB,gBAAgB,CAqElB;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,EACX,cAAc,CAAC,EAAE,MAAM,GACtB,MAAM,EAAE,CAgBV"}

package/dist/hosting/ssl-le-errors.js

@@ -0,0 +1,105 @@
+/**
+ * Turn certbot / ACME stderr into an operator-facing reason (i18n keys under ssl.*).
+ */
+import { tl } from 'ysk-server-shared';
+/** Extract a domain-looking token from certbot / ACME text. */
+export function extractDomainFromLeOutput(raw) {
+    const text = raw || '';
+    const patterns = [
+        /NXDOMAIN looking up A(?:AAA)? for ([a-z0-9*.-]+)/i,
+        /Challenge failed for domain ([a-z0-9*.-]+)/i,
+        /Domain:\s*([a-z0-9*.-]+)/i,
+        /http-01 challenge for ([a-z0-9*.-]+)/i,
+        /for domain ([a-z0-9*.-]+)/i,
+    ];
+    for (const re of patterns) {
+        const m = text.match(re);
+        if (m?.[1] && m[1].includes('.'))
+            return m[1].toLowerCase().replace(/\.$/, '');
+    }
+    return undefined;
+}
+/**
+ * Classify LE failure and return localized summary + hint.
+ * Prefers actionable DNS/HTTP reasons over raw certbot dump.
+ */
+export function explainLetsEncryptFailure(raw, fallbackDomain) {
+    const text = raw || '';
+    const domain = extractDomainFromLeOutput(text) ||
+        (fallbackDomain ? fallbackDomain.trim().toLowerCase().replace(/\.$/, '') : undefined);
+    const d = domain || '—';
+    if (/NXDOMAIN|no such host|NXDOMAIN looking up/i.test(text)) {
+        return {
+            kind: 'nxdomain',
+            domain,
+            summary: tl('ssl.leFailNxdomain', { domain: d }),
+            hint: tl('ssl.leFailNxdomainHint', { domain: d }),
+        };
+    }
+    if (/DNS problem|SERVFAIL|dnssec|no valid A records|incorrect name servers/i.test(text)) {
+        return {
+            kind: 'dns',
+            domain,
+            summary: tl('ssl.leFailDns', { domain: d }),
+            hint: tl('ssl.leFailDnsHint', { domain: d }),
+        };
+    }
+    if (/rate.?Limited|too many certificates|too many failed authorizations/i.test(text)) {
+        return {
+            kind: 'rate_limit',
+            domain,
+            summary: tl('ssl.leFailRateLimit'),
+            hint: tl('ssl.leFailRateLimitHint'),
+        };
+    }
+    if (/\bCAA\b|caa record/i.test(text)) {
+        return {
+            kind: 'caa',
+            domain,
+            summary: tl('ssl.leFailCaa', { domain: d }),
+            hint: tl('ssl.leFailCaaHint'),
+        };
+    }
+    if (/Invalid response|404|connection refused|Timeout during connect|Connection timed out|network unreachable/i.test(text)) {
+        return {
+            kind: 'http01',
+            domain,
+            summary: tl('ssl.leFailHttp01', { domain: d }),
+            hint: tl('ssl.leFailHttp01Hint', { domain: d }),
+        };
+    }
+    if (/Some challenges have failed|Challenge failed|AuthorizationError/i.test(text)) {
+        return {
+            kind: 'challenge',
+            domain,
+            summary: tl('ssl.leFailChallenge', { domain: d }),
+            hint: tl('ssl.leFailChallengeHint', { domain: d }),
+        };
+    }
+    return {
+        kind: 'unknown',
+        domain,
+        summary: tl('ssl.leFailUnknown', { domain: d }),
+        hint: tl('ssl.leFailUnknownHint'),
+    };
+}
+/** Notes array: human reason first, then short raw tail for support. */
+export function notesForLetsEncryptFailure(raw, fallbackDomain) {
+    const ex = explainLetsEncryptFailure(raw, fallbackDomain);
+    const notes = [ex.summary, ex.hint];
+    const compact = (raw || '').replace(/\s+/g, ' ').trim().slice(0, 280);
+    if (compact && !/Saving debug log/i.test(compact.slice(0, 40))) {
+        notes.push(tl('ssl.leFailRawTail', { snippet: compact }));
+    }
+    else if (compact) {
+        // Drop the useless "Saving debug log to ..." prefix if that's all we have
+        const withoutNoise = compact
+            .replace(/^Saving debug log to \S+\s*/i, '')
+            .slice(0, 280);
+        if (withoutNoise.length > 20) {
+            notes.push(tl('ssl.leFailRawTail', { snippet: withoutNoise }));
+        }
+    }
+    return notes;
+}
+//# sourceMappingURL=ssl-le-errors.js.map

package/dist/hosting/ssl-le-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-le-errors.js","sourceRoot":"","sources":["../../src/hosting/ssl-le-errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAqBvC,+DAA+D;AAC/D,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG;QACf,mDAAmD;QACnD,6CAA6C;QAC7C,2BAA2B;QAC3B,uCAAuC;QACvC,4BAA4B;KAC7B,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAW,EACX,cAAuB;IAEvB,MAAM,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GACV,yBAAyB,CAAC,IAAI,CAAC;QAC/B,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC;IAExB,IAAI,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM;YACN,OAAO,EAAE,EAAE,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChD,IAAI,EAAE,EAAE,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IACD,IACE,wEAAwE,CAAC,IAAI,CAC3E,IAAI,CACL,EACD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM;YACN,OAAO,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,EAAE,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,qEAAqE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM;YACN,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC;YAClC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM;YACN,OAAO,EAAE,EAAE,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC;SAC9B,CAAC;IACJ,CAAC;IACD,IACE,0GAA0G,CAAC,IAAI,CAC7G,IAAI,CACL,EACD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM;YACN,OAAO,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC9C,IAAI,EAAE,EAAE,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,kEAAkE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM;YACN,OAAO,EAAE,EAAE,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACjD,IAAI,EAAE,EAAE,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM;QACN,OAAO,EAAE,EAAE,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC/C,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CACxC,GAAW,EACX,cAAuB;IAEvB,MAAM,EAAE,GAAG,yBAAyB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,0EAA0E;QAC1E,MAAM,YAAY,GAAG,OAAO;aACzB,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC;aAC3C,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjB,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}