@alchemy.run/kubernetes 0.0.0 → 2.0.0-beta.85

package/lib/Job.js

@@ -0,0 +1,443 @@
+import { isResolved } from "alchemy/Diff";
+import * as Output from "alchemy/Output";
+import { createPhysicalName } from "alchemy/PhysicalName";
+import { Platform } from "alchemy/Platform";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import { packEnvValue, unpackEnvValue, RuntimeContext } from "alchemy/RuntimeContext";
+import { Stack } from "alchemy/Stack";
+import { createInternalTags } from "alchemy/Tags";
+import { unwrapRedacted } from "alchemy/Util/data";
+import { sha256Object } from "alchemy/Util/sha256";
+import * as Effect from "effect/Effect";
+import { connectCluster, deleteObjects, ifClusterExists, readObject, reconcileObjects, } from "./Client.js";
+import { findClusterAdapter, } from "./ClusterAdapter.js";
+import { toConnection } from "./Connection.js";
+import { makeConnectionRegistry } from "./internal/registry.js";
+import { collectBindingEnv, containerEnvValue, connectionIdentity, connectionOfOutput, deepMerge, imagePlatformOf, makeJobBootstrap, resolveWorkloadImage, tryConnectionOf, workloadImageHash, } from "./internal/workload.js";
+export const isJob = (value) => typeof value === "object" && value !== null && "Type" in value && value.Type === "Kubernetes.Job";
+/**
+ * Run-to-completion work on any Kubernetes cluster, as a container image
+ * or an Effect program.
+ *
+ * `Job` provisions a Kubernetes `Job` (or `CronJob` when `schedule` is
+ * set) via server-side apply and a ServiceAccount, plus — through the
+ * target cluster's platform adapter — workload identity and a container
+ * image from exactly one of three sources flat on props: `main` (bundle an
+ * inline Effect program whose impl returns `{ run }`), `context` (build
+ * your own Dockerfile), or `image` (a pre-built registry reference).
+ * `main` and `context` images are built on the deploying machine and
+ * pushed to the connection's registry (`Kubernetes.LocalCluster` includes
+ * one; EKS uses ECR; GKE uses Artifact Registry). On `AWS.EKS.Cluster`
+ * targets, bindings attach IAM policy statements to a generated
+ * pod-identity role; on `GCP.Container.Cluster` targets, GCP bindings grant
+ * their IAM roles to the Kubernetes ServiceAccount's Workload Identity
+ * Federation principal — exactly like `Kubernetes.Deployment`.
+ * ### Creating a Job
+ * **Example:** Remote image (external — no Effect runtime in the container)
+ * ```typescript
+ * const migrate = yield* Kubernetes.Job("DbMigrate", {
+ *   cluster,
+ *   image: "ghcr.io/acme/migrator:v3",
+ *   backoffLimit: 2,
+ * });
+ * ```
+ *
+ * **Example:** Your own Dockerfile with build args and secrets
+ * ```typescript
+ * // Dockerfile:
+ * //   ARG NODE_ENV
+ * //   RUN --mount=type=secret,id=NPM_TOKEN,env=NPM_TOKEN npm ci
+ * const migrate = yield* Kubernetes.Job("DbMigrate", {
+ *   cluster,
+ *   context: "./migrator",
+ *   build: {
+ *     args: { NODE_ENV: "production" },
+ *     // Mounted only into the RUN step that asks for it; never in the image.
+ *     secrets: { NPM_TOKEN: Config.Redacted("NPM_TOKEN") },
+ *   },
+ *   backoffLimit: 2,
+ * });
+ * ```
+ *
+ * **Example:** Inline Effect program
+ * ```typescript
+ * const cluster = yield* Kubernetes.LocalCluster("Cluster", {
+ *   name: "alchemy",
+ * });
+ *
+ * const hello = yield* Kubernetes.Job(
+ *   "Hello",
+ *   { cluster, main: import.meta.url, backoffLimit: 2 },
+ *   Effect.gen(function* () {
+ *     return {
+ *       run: Effect.log("hello from a Job"),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
+ * **Example:** Inline Effect program with a DynamoDB binding (EKS)
+ * ```typescript
+ * const seed = yield* Kubernetes.Job(
+ *   "SeedData",
+ *   { cluster, main: import.meta.url },
+ *   Effect.gen(function* () {
+ *     const putItem = yield* AWS.DynamoDB.PutItem(table);
+ *     return {
+ *       run: Effect.gen(function* () {
+ *         yield* putItem({ Item: { id: { S: "seed" } } });
+ *       }),
+ *     };
+ *   }).pipe(Effect.provide(AWS.DynamoDB.PutItemHttp)),
+ * );
+ * ```
+ *
+ * **Example:** Tagged Effect program
+ * ```typescript
+ * export class Backfill extends Kubernetes.Job<Backfill, {
+ *   progress: () => Effect.Effect<number>;
+ * }>()("Backfill") {}
+ *
+ * export default Backfill.make(
+ *   { cluster, main: import.meta.url, backoffLimit: 1 },
+ *   Effect.gen(function* () {
+ *     return {
+ *       run: Effect.gen(function* () { }),
+ *       progress: () => Effect.succeed(0),
+ *     };
+ *   }),
+ * );
+ * ```
+ *
+ * ### Bundling & Tree-shaking
+ * `main` is bundled with rolldown at deploy time. Unused code is
+ * tree-shaken. `effect`, alchemy, and `@distilled.cloud` are marked
+ * pure so unused parts prune more aggressively. Your app is not
+ * marked pure.
+ *
+ * **Example:** Mark additional packages as pure
+ * Only list packages with no top-level side effects.
+ * ```typescript
+ * {
+ *   main: import.meta.url,
+ *   build: {
+ *     pure: { packages: ["my-lib", "@my-scope/*"] },
+ *   },
+ * }
+ * ```
+ *
+ * **Example:** Turn it off
+ * ```typescript
+ * {
+ *   main: import.meta.url,
+ *   build: { pure: false },
+ * }
+ * ```
+ *
+ * ### Scheduling
+ * **Example:** Nightly CronJob
+ * ```typescript
+ * const nightly = yield* Kubernetes.Job("NightlyBackfill", {
+ *   cluster,
+ *   main: import.meta.url,
+ *   schedule: "0 3 * * *",
+ * });
+ * ```
+ *
+ * @resource
+ * @product Workloads
+ */
+export const Job = Platform("Kubernetes.Job", {
+    aliases: ["AWS.EKS.Job"],
+    createRuntimeContext: (id) => {
+        // A one-shot host context: `serve` (invoked by the Platform machinery
+        // with the impl shape) registers the shape's `run` effect as the
+        // program instead of an HTTP server, so the generated entry executes
+        // it to completion and exits.
+        const runners = [];
+        const env = {};
+        const context = {
+            Type: "Kubernetes.Job",
+            id,
+            env,
+            set: (bindingId, output) => Effect.sync(() => {
+                const key = bindingId.replaceAll(/[^a-zA-Z0-9]/g, "_");
+                env[key] = output.pipe(Output.map(packEnvValue));
+                return key;
+            }),
+            get: (key) => Effect.sync(() => unpackEnvValue(process.env[key])),
+            run: (effect) => Effect.sync(() => {
+                runners.push(effect);
+            }),
+            serve: ((_handler, options) => Effect.sync(() => {
+                const run = options?.shape?.run;
+                if (Effect.isEffect(run)) {
+                    // oxlint-disable-next-line effecttsgo/unsafe-effect-type-assertion -- `run` is a user program; the host runner surfaces its failures
+                    runners.push(run);
+                }
+            })),
+            exports: Effect.sync(() => ({
+                program: Effect.all(runners, { concurrency: "unbounded" }).pipe(Effect.asVoid),
+            })),
+        };
+        return context;
+    },
+});
+export const JobProvider = () => Provider.effect(Job, Effect.gen(function* () {
+    const stack = yield* Stack;
+    const connectionRegistry = yield* makeConnectionRegistry;
+    const alchemyEnv = {
+        ALCHEMY_STACK_NAME: stack.name,
+        ALCHEMY_STAGE: stack.stage,
+        ALCHEMY_PHASE: "runtime",
+    };
+    // The base name doubles as the `app.kubernetes.io/name` label value
+    // (and the Service name), both capped at 63 characters.
+    const toBaseName = (id, props = {}) => props.name
+        ? Effect.succeed(props.name)
+        : createPhysicalName({ id, maxLength: 63, lowercase: true }).pipe(Effect.map((name) => name.replaceAll(/[^a-z0-9-]/g, "-")));
+    return {
+        stables: ["connection", "namespace", "serviceAccountName", "identity", "registry"],
+        // A Job's identity spans in-cluster Kubernetes objects plus
+        // adapter-owned cloud resources — no single enumeration
+        // reconstructs the composite, so enumeration is empty; `read`
+        // refreshes known instances.
+        list: () => Effect.succeed([]),
+        diff: Effect.fn(function* ({ olds = {}, news: input, output }) {
+            // `exports` carries the program's runtime Effects (never plain
+            // data); everything else must be resolved to diff.
+            const { exports: _exports, ...declared } = input;
+            if (!isResolved(declared))
+                return;
+            const news = input;
+            const oldCluster = connectionIdentity(tryConnectionOf(olds.cluster));
+            const newCluster = connectionIdentity(tryConnectionOf(news.cluster));
+            if (oldCluster !== undefined && newCluster !== undefined && oldCluster !== newCluster) {
+                return { action: "replace" };
+            }
+            if (oldCluster !== undefined &&
+                (olds.namespace ?? "default") !== (news.namespace ?? "default")) {
+                return { action: "replace" };
+            }
+            // Content drift (see Deployment).
+            const connection = tryConnectionOf(news.cluster);
+            if (output && connection) {
+                const adapter = yield* findClusterAdapter(connection.auth.kind);
+                const source = news;
+                const hash = yield* workloadImageHash({
+                    adapter,
+                    connection,
+                    connectionRegistry,
+                    source,
+                    platform: imagePlatformOf(news.architecture, connection),
+                    isExternal: news.isExternal,
+                    bootstrap: (adapter.bootstrap?.job ?? makeJobBootstrap)(source.handler ?? "default"),
+                });
+                if (hash !== undefined && hash !== output.code.hash) {
+                    return { action: "update" };
+                }
+            }
+        }),
+        read: Effect.fn(function* ({ output }) {
+            if (!output)
+                return undefined;
+            const connection = connectionOfOutput(output);
+            if (!connection)
+                return undefined;
+            const transport = yield* connectCluster(connection);
+            // The ServiceAccount is the stable existence anchor: one-shot Job
+            // objects are content-addressed and may have been TTL-collected.
+            const anchor = (output.kubernetesObjects ?? [])[0];
+            if (!anchor)
+                return output;
+            const observed = yield* readObject({
+                transport,
+                object: anchor,
+            }).pipe(Effect.catchTag("KubernetesNotFound", () => Effect.undefined));
+            if (observed === undefined)
+                return undefined;
+            return output;
+        }),
+        reconcile: Effect.fn(function* ({ id, news, bindings, output, session }) {
+            const connection = toConnection(news.cluster);
+            const adapter = yield* findClusterAdapter(connection.auth.kind);
+            const transport = yield* adapter.connect(connection);
+            const namespace = news.namespace ?? "default";
+            const baseName = yield* toBaseName(id, news);
+            const serviceAccountName = output?.serviceAccountName ?? baseName;
+            const tags = {
+                ...(yield* createInternalTags(id)),
+                ...news.tags,
+            };
+            const { env: bindingEnv, grantKeys } = collectBindingEnv(bindings);
+            if (grantKeys.length > 0 && adapter.identity === undefined) {
+                return yield* Effect.die(new Error(`'${id}': bindings carry cloud credential grants ` +
+                    `(${grantKeys.join(", ")}) but this cluster's platform ` +
+                    "has no workload-identity adapter. Target a managed " +
+                    "cluster (e.g. AWS.EKS.Cluster) or bind through " +
+                    "environment variables instead."));
+            }
+            const identity = adapter.identity
+                ? yield* adapter.identity.reconcile({
+                    id,
+                    connection,
+                    namespace,
+                    serviceAccount: serviceAccountName,
+                    bindings,
+                    options: news.identity,
+                    state: output?.identity ??
+                        output,
+                    tags,
+                })
+                : undefined;
+            // Resolve the container image (`main` | `context` | `image`).
+            const source = news;
+            const resolved = yield* resolveWorkloadImage({
+                adapter,
+                connection,
+                connectionRegistry,
+                id,
+                source,
+                platform: imagePlatformOf(news.architecture, connection),
+                isExternal: news.isExternal,
+                bootstrap: (adapter.bootstrap?.job ?? makeJobBootstrap)(source.handler ?? "default"),
+                tags,
+                state: output?.registry ??
+                    output,
+                session,
+            });
+            // Synthesize the Kubernetes objects. The generated name label is
+            // always present so selectors and Kueue-style extra labels
+            // compose without erasing the workload's identity label.
+            const labels = {
+                "app.kubernetes.io/name": baseName,
+                ...news.labels,
+            };
+            const containerEnv = {
+                ...bindingEnv,
+                ...identity?.env,
+                ...alchemyEnv,
+                ...news.env,
+            };
+            const serviceAccountObject = {
+                apiVersion: "v1",
+                kind: "ServiceAccount",
+                metadata: {
+                    name: serviceAccountName,
+                    namespace,
+                    labels,
+                    ...(identity?.serviceAccountAnnotations
+                        ? { annotations: identity.serviceAccountAnnotations }
+                        : {}),
+                },
+            };
+            const podTemplate = deepMerge({
+                metadata: { labels },
+                spec: {
+                    serviceAccountName,
+                    restartPolicy: news.restartPolicy ?? "Never",
+                    containers: [
+                        {
+                            name: baseName,
+                            image: resolved.imageUri,
+                            command: news.command,
+                            args: news.args,
+                            env: Object.entries(containerEnv).map(([name, value]) => ({
+                                name,
+                                value: containerEnvValue(value),
+                            })),
+                            resources: news.resources,
+                        },
+                    ],
+                },
+            }, news.podTemplate);
+            const jobSpec = {
+                backoffLimit: news.backoffLimit,
+                ttlSecondsAfterFinished: news.ttlSecondsAfterFinished,
+                template: podTemplate,
+            };
+            const kind = news.schedule ? "CronJob" : "Job";
+            // A Kubernetes Job's pod template is immutable after creation, so
+            // one-shot Jobs are content-addressed: the object name embeds a
+            // hash of the spec, and a spec change applies a NEW Job (which
+            // runs) while `reconcileObjects` deletes the previous one.
+            // CronJobs are mutable and keep the stable base name.
+            // Kubernetes rejects Job names over 63 characters (the API
+            // stamps the name into the batch.kubernetes.io/job-name pod
+            // label, and label values cap at 63) — truncate the base so the
+            // content-address suffix always fits.
+            const jobName = news.schedule
+                ? baseName.slice(0, 52).replace(/-+$/, "")
+                : `${baseName.slice(0, 54).replace(/-+$/, "")}-${(yield* sha256Object(unwrapRedacted(jobSpec))).slice(0, 8)}`;
+            const workloadObject = news.schedule
+                ? {
+                    apiVersion: "batch/v1",
+                    kind: "CronJob",
+                    metadata: { name: jobName, namespace, labels },
+                    spec: {
+                        schedule: news.schedule,
+                        jobTemplate: {
+                            metadata: { labels },
+                            spec: jobSpec,
+                        },
+                    },
+                }
+                : {
+                    apiVersion: "batch/v1",
+                    kind: "Job",
+                    metadata: { name: jobName, namespace, labels },
+                    spec: jobSpec,
+                };
+            const desiredObjects = [serviceAccountObject, workloadObject];
+            const kubernetesObjects = yield* reconcileObjects({
+                transport,
+                previousObjects: output?.kubernetesObjects ?? [],
+                desiredObjects,
+            });
+            yield* session.note(`Applied Kubernetes ${kind} ${namespace}/${jobName}`);
+            return {
+                connection,
+                namespace,
+                kind,
+                jobName,
+                schedule: news.schedule,
+                serviceAccountName,
+                imageUri: resolved.imageUri,
+                identity: identity?.state,
+                registry: resolved.state,
+                kubernetesObjects,
+                code: { hash: resolved.codeHash },
+            };
+        }),
+        delete: Effect.fn(function* ({ output }) {
+            const connection = connectionOfOutput(output);
+            if (!connection)
+                return;
+            const adapter = yield* findClusterAdapter(connection.auth.kind);
+            // Skip only a missing cluster, then still clean up adapter-owned
+            // cloud resources (image repository, identity role).
+            const transport = yield* ifClusterExists(adapter.connect(connection));
+            if (transport && (output.kubernetesObjects ?? []).length > 0) {
+                yield* deleteObjects({
+                    transport,
+                    objects: output.kubernetesObjects ?? [],
+                });
+            }
+            if (adapter.identity) {
+                yield* adapter.identity.delete({
+                    connection,
+                    state: output.identity ??
+                        output,
+                });
+            }
+            if (adapter.registry) {
+                yield* adapter.registry.delete({
+                    state: output.registry ??
+                        output,
+                });
+            }
+        }),
+    };
+}));
+//# sourceMappingURL=Job.js.map

package/lib/Job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Job.js","sourceRoot":"","sources":["../src/Job.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAA6C,MAAM,kBAAkB,CAAC;AACvF,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,UAAU,EACV,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,GAOnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAqC,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAIhC,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAU,EAAgB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC;AAmMpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmIG;AACH,MAAM,CAAC,MAAM,GAAG,GAA4D,QAAQ,CAClF,gBAAgB,EAChB;IACE,OAAO,EAAE,CAAC,aAAa,CAAC;IACxB,oBAAoB,EAAE,CAAC,EAAU,EAAqB,EAAE;QACtD,sEAAsE;QACtE,iEAAiE;QACjE,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,OAAO,GAAsC,EAAE,CAAC;QACtD,MAAM,GAAG,GAAwB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,gBAAgB;YACtB,EAAE;YACF,GAAG;YACH,GAAG,EAAE,CAAC,SAAiB,EAAE,MAAqB,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;gBACvD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBACjD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;YACJ,GAAG,EAAE,CAAI,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,CAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAM,CAAC;YACpF,GAAG,EAAE,CAAC,MAAuC,EAAE,EAAE,CAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC,CAAC;YACJ,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;gBACf,MAAM,GAAG,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;gBAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,qIAAqI;oBACrI,OAAO,CAAC,IAAI,CAAC,GAAsC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,CAAC,CAAgC;YACpC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;aAC/E,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAC9B,QAAQ,CAAC,MAAM,CACb,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC;IAC3B,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;IAEzD,MAAM,UAAU,GAAG;QACjB,kBAAkB,EAAE,KAAK,CAAC,IAAI;QAC9B,aAAa,EAAE,KAAK,CAAC,KAAK;QAC1B,aAAa,EAAE,SAAS;KACzB,CAAC;IAEF,oEAAoE;IACpE,wDAAwD;IACxD,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAAK,GAAsB,EAAE,EAAE,EAAE,CAC/D,KAAK,CAAC,IAAI;QACR,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAC1D,CAAC;IAER,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,CAAC;QAClF,4DAA4D;QAC5D,wDAAwD;QACxD,8DAA8D;QAC9D,6BAA6B;QAC7B,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAyB,CAAC;QACrD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,GAAG,EAAc,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;YACvE,+DAA+D;YAC/D,mDAAmD;YACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,KAE1C,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAClC,MAAM,IAAI,GAAG,KAA4B,CAAC;YAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;gBACtF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,IACE,UAAU,KAAK,SAAS;gBACxB,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAC/D,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAW,CAAC;YACxC,CAAC;YACD,kCAAkC;YAClC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,IAA2B,CAAC;gBAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;oBACpC,OAAO;oBACP,UAAU;oBACV,kBAAkB;oBAClB,MAAM;oBACN,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC;oBACxD,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;iBACrF,CAAC,CAAC;gBACH,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAW,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACnC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACpD,kEAAkE;YAClE,iEAAiE;YACjE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;gBACjC,SAAS;gBACT,MAAM,EAAE,MAAM;aACf,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACvE,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;YACrE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;YAE9C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,kBAAkB,GAAG,MAAM,EAAE,kBAAkB,IAAI,QAAQ,CAAC;YAClE,MAAM,IAAI,GAAG;gBACX,GAAG,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClC,GAAG,IAAI,CAAC,IAAI;aACb,CAAC;YAEF,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACtB,IAAI,KAAK,CACP,IAAI,EAAE,4CAA4C;oBAChD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;oBACxD,qDAAqD;oBACrD,iDAAiD;oBACjD,gCAAgC,CACnC,CACF,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ;gBAC/B,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;oBAChC,EAAE;oBACF,UAAU;oBACV,SAAS;oBACT,cAAc,EAAE,kBAAkB;oBAClC,QAAQ;oBACR,OAAO,EAAE,IAAI,CAAC,QAAQ;oBACtB,KAAK,EACF,MAAM,EAAE,QAAgD;wBACxD,MAA8C;oBACjD,IAAI;iBACL,CAAC;gBACJ,CAAC,CAAC,SAAS,CAAC;YAEd,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAA2B,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC;gBAC3C,OAAO;gBACP,UAAU;gBACV,kBAAkB;gBAClB,EAAE;gBACF,MAAM;gBACN,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC;gBACxD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,gBAAgB,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;gBACpF,IAAI;gBACJ,KAAK,EACF,MAAM,EAAE,QAAgD;oBACxD,MAA8C;gBACjD,OAAO;aACR,CAAC,CAAC;YAEH,iEAAiE;YACjE,2DAA2D;YAC3D,yDAAyD;YACzD,MAAM,MAAM,GAAG;gBACb,wBAAwB,EAAE,QAAQ;gBAClC,GAAG,IAAI,CAAC,MAAM;aACf,CAAC;YACF,MAAM,YAAY,GAAG;gBACnB,GAAG,UAAU;gBACb,GAAG,QAAQ,EAAE,GAAG;gBAChB,GAAG,UAAU;gBACb,GAAG,IAAI,CAAC,GAAG;aACZ,CAAC;YAEF,MAAM,oBAAoB,GAA+B;gBACvD,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE;oBACR,IAAI,EAAE,kBAAkB;oBACxB,SAAS;oBACT,MAAM;oBACN,GAAG,CAAC,QAAQ,EAAE,yBAAyB;wBACrC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,yBAAyB,EAAE;wBACrD,CAAC,CAAC,EAAE,CAAC;iBACR;aACF,CAAC;YACF,MAAM,WAAW,GAAG,SAAS,CAC3B;gBACE,QAAQ,EAAE,EAAE,MAAM,EAAE;gBACpB,IAAI,EAAE;oBACJ,kBAAkB;oBAClB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO;oBAC5C,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,QAAQ,CAAC,QAAQ;4BACxB,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gCACxD,IAAI;gCACJ,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC;6BAChC,CAAC,CAAC;4BACH,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC1B;qBACF;iBACF;aACF,EACD,IAAI,CAAC,WAAW,CACjB,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,QAAQ,EAAE,WAAW;aACtB,CAAC;YAEF,MAAM,IAAI,GAAsB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YAElE,kEAAkE;YAClE,gEAAgE;YAChE,+DAA+D;YAC/D,2DAA2D;YAC3D,sDAAsD;YACtD,2DAA2D;YAC3D,4DAA4D;YAC5D,gEAAgE;YAChE,sCAAsC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ;gBAC3B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC1C,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAEhH,MAAM,cAAc,GAA+B,IAAI,CAAC,QAAQ;gBAC9D,CAAC,CAAC;oBACE,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;oBAC9C,IAAI,EAAE;wBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,WAAW,EAAE;4BACX,QAAQ,EAAE,EAAE,MAAM,EAAE;4BACpB,IAAI,EAAE,OAAO;yBACd;qBACF;iBACF;gBACH,CAAC,CAAC;oBACE,UAAU,EAAE,UAAU;oBACtB,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;oBAC9C,IAAI,EAAE,OAAO;iBACd,CAAC;YAEN,MAAM,cAAc,GAAG,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;YAE9D,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;gBAChD,SAAS;gBACT,eAAe,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE;gBAChD,cAAc;aACf,CAAC,CAAC;YAEH,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;YAE1E,OAAO;gBACL,UAAU;gBACV,SAAS;gBACT,IAAI;gBACJ,OAAO;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,kBAAkB;gBAClB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,EAAE,KAAK;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;gBACxB,iBAAiB;gBACjB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE;aAClC,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;YACrC,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU;gBAAE,OAAO;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEhE,iEAAiE;YACjE,qDAAqD;YACrD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACtE,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7D,KAAK,CAAC,CAAC,aAAa,CAAC;oBACnB,SAAS;oBACT,OAAO,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC7B,UAAU;oBACV,KAAK,EACF,MAAM,CAAC,QAAgD;wBACvD,MAAkC;iBACtC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC7B,KAAK,EACF,MAAM,CAAC,QAAgD;wBACvD,MAAkC;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC"}