@aws-blocks/core 0.1.0

package/dist/scripts/external-migrations-step.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Invoke `bb-data migrate` for a stage. The connection string is passed via the
+ * BLOCKS_MIGRATE_URL env var rather than argv, so the credential is not visible
+ * in the process list. Arg-array exec (no shell). `--no-install` keeps npx from
+ * reaching the public registry for the private bin (already an app dependency).
+ */
+/**
+ * Build the argv for the `bb-data migrate` subprocess. Extracted as a pure
+ * function so the dev-vs-deploy difference is unit-testable. When
+ * `regenerateTypesDir` is set (dev loop only), append `--regenerate-types=<dir>`
+ * so a successful apply also refreshes generated types. Sandbox/production
+ * deploys omit it — they apply the committed schema and must never rewrite
+ * source files on a CI/deploy host.
+ */
+export declare function buildMigrateArgs(stage: string, migrationsDir: string, regenerateTypesDir?: string): string[];
+export interface ApplyExternalMigrationsOptions {
+    stage: 'sandbox' | 'production';
+    /** Override the migrations directory (default ./migrations). */
+    migrationsDir?: string;
+}
+/**
+ * Which apply stages get the production guard. **Security-relevant:** `sandbox`
+ * resolves its connection from the same `.env.local` as the dev loop, so it must
+ * be guarded against accidentally pointing at production. `production` deploys
+ * intentionally target the production database and must NOT be guarded. Keep this
+ * as the single source of truth for the decision.
+ */
+export declare function shouldGuardAgainstProduction(stage: 'sandbox' | 'production'): boolean;
+/**
+ * Apply pending external-DB migrations for the given stage. Returns true if a
+ * migration step ran, false if it was skipped (no external DB / no migrations).
+ *
+ * For `stage: 'sandbox'` it refuses if the resolved connection (`.env.local`)
+ * points at a production database — the same guard as the dev loop. `stage:
+ * 'production'` is intentionally unguarded (deploy is meant to target prod).
+ */
+export declare function applyExternalMigrations(opts: ApplyExternalMigrationsOptions): Promise<boolean>;
+/** Extract production DB identity refs from `.env`-style content (pure/testable). */
+export declare function parseProductionRefsFromEnvContent(content: string): string[];
+/** True when the dev database is one of the known production databases. */
+export declare function isProductionTarget(devRef: string | null, prodRefs: Set<string>): boolean;
+/**
+ * Apply pending external-database migrations during `npm run dev`, against the
+ * dev database, so the schema change is live locally without a sandbox round-trip.
+ * (A successful apply also refreshes the generated TypeScript types from the new
+ * schema — `database.types.ts` + `database.meta.ts` — so code type-checks against
+ * it locally before deploy. To refresh by hand at any time, run `npx bb-data pull`.)
+ *
+ * Only acts for external (`fromExisting`) apps — the managed/Aurora path uses a
+ * local PGlite mock in dev and is unaffected. Guards against accidentally
+ * migrating a production database: if `.env.local` resolves to the same database
+ * as production (`.env.production` and/or the production SSM parameter), it
+ * refuses. Reachability/apply failures warn and let dev continue; only the
+ * production-target refusal is fatal. Set `BLOCKS_SKIP_DEV_MIGRATIONS=1` to skip.
+ *
+ * Returns true if a migration step ran, false if skipped.
+ */
+export declare function applyDevMigrations(opts?: {
+    migrationsDir?: string;
+    generatedDir?: string;
+}): Promise<boolean>;
+//# sourceMappingURL=external-migrations-step.d.ts.map

package/dist/scripts/external-migrations-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-migrations-step.d.ts","sourceRoot":"","sources":["../../src/scripts/external-migrations-step.ts"],"names":[],"mappings":"AAmCA;;;;;GAKG;AACH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5G;AAcD,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,SAAS,GAAG,YAAY,CAAC;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,OAAO,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,8BAA8B,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBpG;AAoBD,qFAAqF;AACrF,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAe3E;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAExF;AAuED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnH"}

package/dist/scripts/external-migrations-step.js

@@ -0,0 +1,243 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Apply external-database migrations during the app lifecycle:
+ * `npm run dev` (to the dev database), and `npm run sandbox` / `npm run deploy`
+ * (to the sandbox / production database, before `cdk deploy`).
+ *
+ * `core` must not depend on `bb-data` (the dependency runs the other way), so
+ * this invokes the `bb-data` CLI as a subprocess — the same pattern the deploy
+ * script already uses for client generation. The CLI's migrate path rewrites to
+ * the 5432 session port, takes an advisory lock, and applies pending migrations
+ * idempotently. The connection string is passed to the child via an environment
+ * variable (not argv) so it isn't exposed in the process list.
+ *
+ * Applying a migration makes the schema change live in the database. In the dev
+ * loop (`npm run dev`) the same `bb-data migrate` subprocess also refreshes the
+ * generated types (`--regenerate-types`); sandbox/production deploys apply the
+ * committed schema only and never rewrite source.
+ *
+ * No-op unless BOTH a connection string is resolvable from the environment
+ * (i.e. the app uses an external/fromExisting DB) AND a `./migrations` directory
+ * exists. Aurora-managed databases run migrations via their in-VPC Lambda, not
+ * here.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { findConnectionString } from './ensure-secrets.js';
+import { extractDbRef, dbConnectionParameterName } from '../db-naming.js';
+const DEFAULT_MIGRATIONS_DIR = './migrations';
+/** Default output dir for db-pull generated files (database.types.ts / database.meta.ts). */
+const DEFAULT_GENERATED_DIR = './aws-blocks';
+/**
+ * Invoke `bb-data migrate` for a stage. The connection string is passed via the
+ * BLOCKS_MIGRATE_URL env var rather than argv, so the credential is not visible
+ * in the process list. Arg-array exec (no shell). `--no-install` keeps npx from
+ * reaching the public registry for the private bin (already an app dependency).
+ */
+/**
+ * Build the argv for the `bb-data migrate` subprocess. Extracted as a pure
+ * function so the dev-vs-deploy difference is unit-testable. When
+ * `regenerateTypesDir` is set (dev loop only), append `--regenerate-types=<dir>`
+ * so a successful apply also refreshes generated types. Sandbox/production
+ * deploys omit it — they apply the committed schema and must never rewrite
+ * source files on a CI/deploy host.
+ */
+export function buildMigrateArgs(stage, migrationsDir, regenerateTypesDir) {
+    const args = ['--no-install', 'bb-data', 'migrate', '--stage', stage, migrationsDir];
+    if (regenerateTypesDir)
+        args.push(`--regenerate-types=${regenerateTypesDir}`);
+    return args;
+}
+function runMigrateSubprocess(connValue, stage, migrationsDir, regenerateTypesDir) {
+    execFileSync('npx', buildMigrateArgs(stage, migrationsDir, regenerateTypesDir), {
+        stdio: 'inherit',
+        env: { ...process.env, BLOCKS_MIGRATE_URL: connValue },
+    });
+}
+/**
+ * Which apply stages get the production guard. **Security-relevant:** `sandbox`
+ * resolves its connection from the same `.env.local` as the dev loop, so it must
+ * be guarded against accidentally pointing at production. `production` deploys
+ * intentionally target the production database and must NOT be guarded. Keep this
+ * as the single source of truth for the decision.
+ */
+export function shouldGuardAgainstProduction(stage) {
+    return stage === 'sandbox';
+}
+/**
+ * Apply pending external-DB migrations for the given stage. Returns true if a
+ * migration step ran, false if it was skipped (no external DB / no migrations).
+ *
+ * For `stage: 'sandbox'` it refuses if the resolved connection (`.env.local`)
+ * points at a production database — the same guard as the dev loop. `stage:
+ * 'production'` is intentionally unguarded (deploy is meant to target prod).
+ */
+export async function applyExternalMigrations(opts) {
+    const migrationsDir = opts.migrationsDir ?? DEFAULT_MIGRATIONS_DIR;
+    const conn = findConnectionString();
+    if (!conn)
+        return false; // not an external-DB app
+    if (!existsSync(migrationsDir))
+        return false; // nothing to apply
+    if (readdirSync(migrationsDir).filter(f => f.endsWith('.sql')).length === 0)
+        return false;
+    // Sandbox uses the same `.env.local` as dev, so guard it the same way: never
+    // apply schema changes to a production database. Production deploys are
+    // intentionally NOT guarded — `npm run deploy` is meant to target production.
+    if (shouldGuardAgainstProduction(opts.stage)) {
+        await assertNotProductionTarget(conn.value, { command: 'npm run sandbox', announceFailOpen: true });
+    }
+    console.log(`🧬 Applying external database migrations (${opts.stage})...`);
+    runMigrateSubprocess(conn.value, opts.stage, migrationsDir);
+    return true;
+}
+/** Best-effort DB host for transparency logging. */
+function hostOf(connectionString) {
+    try {
+        return new URL(connectionString).host;
+    }
+    catch {
+        return '(unparseable connection string)';
+    }
+}
+/** Best-effort DB identity ref; null if it can't be derived. */
+function safeRef(connectionString) {
+    try {
+        return extractDbRef(connectionString);
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract production DB identity refs from `.env`-style content (pure/testable). */
+export function parseProductionRefsFromEnvContent(content) {
+    const refs = [];
+    for (const line of content.split('\n')) {
+        const t = line.trim();
+        if (!t || t.startsWith('#'))
+            continue;
+        const eq = t.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = t.slice(0, eq).trim();
+        const val = t.slice(eq + 1).trim();
+        if (/_(DB_URL|CONNECTION_STRING)$/.test(key) && val) {
+            const r = safeRef(val);
+            if (r)
+                refs.push(r);
+        }
+    }
+    return refs;
+}
+/** True when the dev database is one of the known production databases. */
+export function isProductionTarget(devRef, prodRefs) {
+    return devRef != null && prodRefs.has(devRef);
+}
+/**
+ * Collect database identities known to be **production**, to guard the dev loop
+ * from accidentally migrating production:
+ * - local `.env.production` (read directly, NOT loaded into the environment), and
+ * - the production SSM parameter for this ref (best-effort; skipped silently when
+ *   offline or unauthenticated).
+ */
+async function productionRefs(devRef) {
+    const refs = new Set();
+    if (existsSync('.env.production')) {
+        for (const r of parseProductionRefsFromEnvContent(readFileSync('.env.production', 'utf-8'))) {
+            refs.add(r);
+        }
+    }
+    try {
+        const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+        const res = await new SSMClient().send(new GetParameterCommand({ Name: dbConnectionParameterName('production'), WithDecryption: true }));
+        const v = res.Parameter?.Value;
+        const r = v ? safeRef(v) : null;
+        if (r)
+            refs.add(r);
+    }
+    catch {
+        /* best-effort: no creds / offline / parameter absent — skip */
+    }
+    return refs;
+}
+/**
+ * Refuse to run schema changes against a known production database. Compares the
+ * resolved connection's DB identity against the production refs (`.env.production`
+ * + the production SSM parameter). Throws with actionable guidance if they match;
+ * no-op when the ref can't be derived or no production ref is known. Shared by the
+ * dev loop and the sandbox apply (both resolve their connection from `.env.local`).
+ */
+async function assertNotProductionTarget(connValue, opts) {
+    const ref = safeRef(connValue);
+    if (!ref)
+        return;
+    const prodRefs = await productionRefs(ref);
+    if (prodRefs.size === 0) {
+        // Best-effort guard, failing OPEN: with no `.env.production` and no resolvable
+        // production SSM parameter, we cannot prove the target isn't production, so proceed.
+        // The dev loop stays quiet — "no production set up yet" is the normal local case and
+        // a note on every `npm run dev` would be false-alarm noise. The consequential,
+        // deploy-adjacent sandbox apply announces the blind spot instead (see DESIGN.md).
+        if (opts.announceFailOpen) {
+            console.log(`ℹ️  Could not verify the target database isn't production (.env.production absent ` +
+                `and the production SSM parameter was unavailable) — proceeding with \`${opts.command}\`.`);
+        }
+        return;
+    }
+    if (!isProductionTarget(ref, prodRefs))
+        return;
+    const optOut = opts.optOutHint ? `, or ${opts.optOutHint}` : '';
+    throw new Error(`Refusing to apply migrations: .env.local points at your PRODUCTION database (${hostOf(connValue)}).\n` +
+        `\`${opts.command}\` must not run schema changes against production. Point .env.local at a ` +
+        `dev/branch database${optOut}.`);
+}
+/**
+ * Apply pending external-database migrations during `npm run dev`, against the
+ * dev database, so the schema change is live locally without a sandbox round-trip.
+ * (A successful apply also refreshes the generated TypeScript types from the new
+ * schema — `database.types.ts` + `database.meta.ts` — so code type-checks against
+ * it locally before deploy. To refresh by hand at any time, run `npx bb-data pull`.)
+ *
+ * Only acts for external (`fromExisting`) apps — the managed/Aurora path uses a
+ * local PGlite mock in dev and is unaffected. Guards against accidentally
+ * migrating a production database: if `.env.local` resolves to the same database
+ * as production (`.env.production` and/or the production SSM parameter), it
+ * refuses. Reachability/apply failures warn and let dev continue; only the
+ * production-target refusal is fatal. Set `BLOCKS_SKIP_DEV_MIGRATIONS=1` to skip.
+ *
+ * Returns true if a migration step ran, false if skipped.
+ */
+export async function applyDevMigrations(opts) {
+    if (process.env.BLOCKS_SKIP_DEV_MIGRATIONS)
+        return false;
+    const migrationsDir = opts?.migrationsDir ?? DEFAULT_MIGRATIONS_DIR;
+    const generatedDir = opts?.generatedDir ?? DEFAULT_GENERATED_DIR;
+    const conn = findConnectionString();
+    if (!conn)
+        return false; // not an external-DB app (e.g. managed Aurora → local PGlite mock)
+    if (!existsSync(migrationsDir))
+        return false;
+    if (readdirSync(migrationsDir).filter(f => f.endsWith('.sql')).length === 0)
+        return false;
+    // Guardrail: never auto-apply to a production database from the dev loop.
+    await assertNotProductionTarget(conn.value, {
+        command: 'npm run dev',
+        optOutHint: 'set BLOCKS_SKIP_DEV_MIGRATIONS=1 to opt out',
+    });
+    console.log(`🧬 Applying migrations to your dev database (${hostOf(conn.value)})...`);
+    try {
+        // Dev loop: apply, then refresh generated types from the migrated schema in
+        // the SAME subprocess (one developer-visible step). Deploy/sandbox omit the
+        // regenerate-types arg — they apply the committed schema, never rewrite source.
+        runMigrateSubprocess(conn.value, 'dev', migrationsDir, generatedDir);
+        return true;
+    }
+    catch (e) {
+        // Don't block local dev on a migration apply failure (e.g. port 5432 blocked
+        // on a corp network). Warn and continue — the app may still run.
+        console.warn(`⚠️  Could not apply migrations in dev: ${e?.message ?? e}`);
+        console.warn(`    Continuing without applying. Run migrations before deploy.`);
+        return false;
+    }
+}

package/dist/scripts/external-migrations-step.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=external-migrations-step.test.d.ts.map

package/dist/scripts/external-migrations-step.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-migrations-step.test.d.ts","sourceRoot":"","sources":["../../src/scripts/external-migrations-step.test.ts"],"names":[],"mappings":""}

package/dist/scripts/external-migrations-step.test.js

@@ -0,0 +1,47 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { parseProductionRefsFromEnvContent, isProductionTarget, buildMigrateArgs, shouldGuardAgainstProduction, } from './external-migrations-step.js';
+const SUPA = (ref) => `postgresql://postgres.${ref}:pw@aws-0-us-east-1.pooler.supabase.com:6543/postgres`;
+test('parseProductionRefsFromEnvContent extracts DB identity from connection-string vars', () => {
+    const content = [
+        '# production config',
+        `SUPABASE_DB_URL=${SUPA('prodref1')}`,
+        'OTHER=not-a-db',
+        `MY_CONNECTION_STRING=${SUPA('prodref2')}`,
+    ].join('\n');
+    assert.deepStrictEqual(parseProductionRefsFromEnvContent(content).sort(), ['prodref1', 'prodref2']);
+});
+test('parseProductionRefsFromEnvContent ignores comments, blanks, and non-DB keys', () => {
+    assert.deepStrictEqual(parseProductionRefsFromEnvContent('\n# c\nFOO=bar\n'), []);
+});
+test('isProductionTarget refuses when the dev ref matches a production ref', () => {
+    const prod = new Set(['prodref1', 'prodref2']);
+    assert.strictEqual(isProductionTarget('prodref1', prod), true);
+});
+test('isProductionTarget allows a distinct dev database', () => {
+    const prod = new Set(['prodref1']);
+    assert.strictEqual(isProductionTarget('devref', prod), false);
+});
+test('isProductionTarget is safe when the dev ref is unknown (null)', () => {
+    assert.strictEqual(isProductionTarget(null, new Set(['prodref1'])), false);
+});
+test('buildMigrateArgs (deploy/sandbox) is schema-only — no --regenerate-types', () => {
+    const args = buildMigrateArgs('production', './migrations');
+    assert.deepStrictEqual(args, ['--no-install', 'bb-data', 'migrate', '--stage', 'production', './migrations']);
+    assert.ok(!args.some(a => a.startsWith('--regenerate-types')), 'deploy must never rewrite source');
+});
+test('buildMigrateArgs (dev) appends --regenerate-types=<dir> so apply also refreshes types', () => {
+    const args = buildMigrateArgs('sandbox', './migrations', './aws-blocks');
+    assert.deepStrictEqual(args, [
+        '--no-install', 'bb-data', 'migrate', '--stage', 'sandbox', './migrations',
+        '--regenerate-types=./aws-blocks',
+    ]);
+});
+test('shouldGuardAgainstProduction: sandbox is guarded (shares .env.local with dev)', () => {
+    assert.strictEqual(shouldGuardAgainstProduction('sandbox'), true);
+});
+test('shouldGuardAgainstProduction: production deploy is intentionally NOT guarded', () => {
+    assert.strictEqual(shouldGuardAgainstProduction('production'), false);
+});

package/dist/scripts/extract-ts-types.d.ts

@@ -0,0 +1,65 @@
+export interface TransferableInfo {
+    /** The __blocks literal value, e.g. "realtime/channel" */
+    blocksTag: string;
+    /** JSON Schemas of the generic type arguments (e.g., [T] in RealtimeChannel<T>), empty array if non-generic */
+    typeArgs: JsonSchema[];
+}
+export interface MethodTypeInfo {
+    params: ParamTypeInfo[];
+    returnType: JsonSchema;
+    /** Present when the return type is a transferable type */
+    transferable?: TransferableInfo;
+    /**
+     * True when the method's JSDoc carries a `@blocksSkipCodegen` tag. Methods so
+     * marked are still callable through the TS client (the runtime Proxy in
+     * `generate-client.ts` doesn't enumerate methods), but the OpenRPC spec
+     * emitter drops them, so native generators (Swift / Kotlin) never see
+     * them. Use for mock-only / dev-only helpers like `api.getLastCode()`.
+     */
+    skipCodegen?: boolean;
+}
+/**
+ * Public so `generate-spec.ts` and any future emitter can share the same
+ * vocabulary. Spelt as a single token to avoid hyphenation surprises in
+ * JSDoc parsers.
+ */
+export declare const BLOCKS_SKIP_CODEGEN_TAG = "blocksSkipCodegen";
+/**
+ * Pure-AST scan for method names tagged with `@blocksSkipCodegen` inside the
+ * `ApiNamespace(...)` calls of a TS source file. Returns a Set of method
+ * names (the OpenRPC emitter qualifies them by namespace later).
+ *
+ * Distinct from {@link extractMethodTypes} because that function builds a
+ * full `ts.Program` + type checker, and any failure inside type
+ * resolution (an imported module that doesn't typecheck, a third-party
+ * `.d.ts` mismatch) silently empties the returned Map. The skip set must
+ * survive those crashes, so this function uses only the parser.
+ */
+export declare function extractSkipCodegenMethods(sourcePath: string): Set<string>;
+export interface ParamTypeInfo {
+    name: string;
+    required: boolean;
+    schema: JsonSchema;
+}
+export interface JsonSchema {
+    type?: string;
+    properties?: Record<string, JsonSchema>;
+    items?: JsonSchema | JsonSchema[];
+    required?: string[];
+    $ref?: string;
+    nullable?: boolean;
+    enum?: (string | number | boolean | null)[];
+    oneOf?: JsonSchema[];
+    additionalProperties?: JsonSchema | boolean;
+    title?: string;
+    [key: string]: unknown;
+}
+/**
+ * Parse a TypeScript source file with full type checking and extract type
+ * info for all methods inside `ApiNamespace(...)` calls.
+ *
+ * Uses `ts.createProgram` to resolve imports and infer return types.
+ * Falls back to AST-only parsing if program creation fails.
+ */
+export declare function extractMethodTypes(sourcePath: string): Map<string, MethodTypeInfo>;
+//# sourceMappingURL=extract-ts-types.d.ts.map

package/dist/scripts/extract-ts-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-ts-types.d.ts","sourceRoot":"","sources":["../../src/scripts/extract-ts-types.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAChC,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,+GAA+G;IAC/G,QAAQ,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,UAAU,EAAE,UAAU,CAAC;IACvB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAS3D;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CA4DzE;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;IAC5C,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAID;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAqElF"}