@caelo-cms/provisioning 0.10.44 → 0.10.46

package/dist/self-hosted-release.js

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #696 Phase 4 — which Caelo release a self-hosted install runs, and how a
+ * release becomes a pair of verified image digests.
+ *
+ * `.caelo/release.json` is the install metadata for self-hosted (the cloud
+ * providers keep theirs in `~/.caelo-<id>/install.json`): the release
+ * version, the digest-pinned admin + gateway image references the Compose
+ * file runs, and a short history of installs/upgrades/rollbacks. It holds no
+ * secrets (config.json does), so it is safe to read from tooling and
+ * backups; writes refuse secret material like install.json's do.
+ *
+ * Every image reference that reaches the Compose file comes through
+ * {@link resolveVerifiedRelease}: the tag is resolved to a digest in GHCR
+ * (anonymously) and that digest — not the tag — is cosign-verified against
+ * the Caelo release workflow identity. `init` and `upgrade` share it.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { assertNoSecrets, writeJsonAtomic } from "./checkpoint-secrets.js";
+import { ghcrImageDigest, ghcrImageRef } from "./compose.js";
+import { selfCommand } from "./self-command.js";
+import { cosignVerifyArgv, GHCR_NAMESPACE, GHCR_REGISTRY, RELEASE_SERVICES, resolveRegistryDigest, } from "./upgrade/release-images.js";
+/** The real runner: Bun.spawn; a missing binary is exit code 127, not a throw. */
+export const bunHostRunner = {
+    async run(argv, opts) {
+        try {
+            const proc = Bun.spawn([...argv], {
+                stdout: opts?.stdoutPath ? Bun.file(opts.stdoutPath) : "pipe",
+                stderr: "pipe",
+            });
+            const stdout = opts?.stdoutPath
+                ? ""
+                : await new Response(proc.stdout).text();
+            const stderr = await new Response(proc.stderr).text();
+            return { exitCode: await proc.exited, stdout, stderr };
+        }
+        catch (e) {
+            return { exitCode: 127, stdout: "", stderr: e instanceof Error ? e.message : String(e) };
+        }
+    },
+};
+const HISTORY_LIMIT = 20;
+export function releasePath(caeloDir) {
+    return join(caeloDir, "release.json");
+}
+/** The images of a recorded release, as the Compose generator takes them. */
+export function releaseImages(release) {
+    return { mode: "release", admin: release.images.admin, gateway: release.images.gateway };
+}
+/**
+ * The install's recorded release, or null when none is recorded (a dev-mode
+ * install, or one created before #696 that still runs the repo bind mount).
+ * Throws on a malformed record rather than running a guessed image.
+ */
+export function readRelease(caeloDir) {
+    const path = releasePath(caeloDir);
+    if (!existsSync(path))
+        return null;
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    const admin = raw.images?.admin ?? "";
+    const gateway = raw.images?.gateway ?? "";
+    if (typeof raw.version !== "string" ||
+        !ghcrImageDigest("admin", admin) ||
+        !ghcrImageDigest("gateway", gateway)) {
+        throw new Error(`${path} is malformed (needs version + digest-pinned ghcr.io/caelo-cms images); fix it or re-run \`${selfCommand("upgrade", "--version", "<x.y.z>")}\`.`);
+    }
+    return {
+        version: raw.version,
+        images: { admin, gateway },
+        installedAt: raw.installedAt ?? "",
+        history: Array.isArray(raw.history) ? raw.history : [],
+    };
+}
+/**
+ * Record that the install now runs `images` of `version` (or, for a
+ * rollback, keeps running the previous ones), appending to the history.
+ */
+export function recordRelease(caeloDir, next, entry, now = new Date()) {
+    const prior = readRelease(caeloDir);
+    const at = now.toISOString();
+    const record = {
+        version: next.version,
+        images: { admin: next.images.admin, gateway: next.images.gateway },
+        installedAt: prior && prior.version === next.version && entry.outcome === "rolled-back"
+            ? prior.installedAt
+            : at,
+        history: [...(prior?.history ?? []), { at, ...entry }].slice(-HISTORY_LIMIT),
+    };
+    assertNoSecrets(record, "release.json");
+    writeJsonAtomic(releasePath(caeloDir), record);
+    return record;
+}
+/** Record a failed-and-rolled-back upgrade without changing the running release. */
+export function recordRollback(caeloDir, current, attempted, detail, now = new Date()) {
+    recordRelease(caeloDir, { version: current.version, images: releaseImages(current) }, { from: current.version, to: attempted, outcome: "rolled-back", detail }, now);
+}
+/**
+ * Resolve the admin + gateway images of release `tag` in GHCR to digests,
+ * then cosign-verify each digest against the Caelo release workflow
+ * identity (unless `skipVerify`, the escape hatch for forks). The returned
+ * references are digest-pinned, so what was verified is exactly what runs.
+ */
+export async function resolveVerifiedRelease(tag, deps) {
+    const refs = {};
+    for (const service of RELEASE_SERVICES) {
+        deps.onProgress?.(`Resolving ${GHCR_REGISTRY}/${GHCR_NAMESPACE}/${service}:${tag}`);
+        const r = await resolveRegistryDigest(GHCR_REGISTRY, `${GHCR_NAMESPACE}/${service}`, tag, deps.fetchImpl);
+        if (!r.ok) {
+            return {
+                ok: false,
+                error: `Could not resolve ${GHCR_REGISTRY}/${GHCR_NAMESPACE}/${service}:${tag} (${r.reason}).\n` +
+                    "Check the version exists at https://github.com/caelo-cms/caelo-cms/releases and pass it as --version x.y.z.",
+            };
+        }
+        refs[service] = ghcrImageRef(service, r.digest);
+    }
+    const images = {
+        mode: "release",
+        admin: refs.admin ?? "",
+        gateway: refs.gateway ?? "",
+    };
+    if (deps.skipVerify)
+        return { ok: true, images };
+    const probe = await deps.runner.run(["cosign", "version"]);
+    if (probe.exitCode !== 0) {
+        return {
+            ok: false,
+            error: "cosign is required to verify the Caelo release image signatures and was not found on PATH.\n" +
+                "Install it (https://docs.sigstore.dev/cosign/system_config/installation/ — e.g. `brew install cosign`,\n" +
+                "or the release binary for Linux), then re-run. --skip-verify skips the check (NOT for production).",
+        };
+    }
+    for (const service of RELEASE_SERVICES) {
+        deps.onProgress?.(`Verifying the signature of ${service}`);
+        const v = await deps.runner.run(cosignVerifyArgv(images[service]));
+        if (v.exitCode !== 0) {
+            return {
+                ok: false,
+                error: `cosign verify FAILED for ${images[service]}: its signature does not match the Caelo release workflow.\n` +
+                    "Either the registry was compromised, the image is a fork's, or sigstore had an outage (retry).\n" +
+                    `cosign: ${v.stderr.trim().slice(0, 500)}`,
+            };
+        }
+    }
+    return { ok: true, images };
+}
+//# sourceMappingURL=self-hosted-release.js.map

package/dist/self-hosted-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-release.js","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAqBrC,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;gBAChC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC7D,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,EAAE,UAAU;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;CACF,CAAC;AAqBF,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA+B,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;IAC1C,IACE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,8FAA8F,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CACzJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,IAAgD,EAChD,KAAsC,EACtC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QAClE,WAAW,EACT,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa;YACxE,CAAC,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;KAC7E,CAAC;IACF,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,OAA0B,EAC1B,SAAiB,EACjB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;IAEtB,aAAa,CACX,QAAQ,EACR,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAC5D,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EACxE,GAAG,CACJ,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,IAKC;IAED,MAAM,IAAI,GAAiD,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,aAAa,IAAI,cAAc,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,MAAM,qBAAqB,CACnC,aAAa,EACb,GAAG,cAAc,IAAI,OAAO,EAAE,EAC9B,GAAG,EACH,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,qBAAqB,aAAa,IAAI,cAAc,IAAI,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM;oBACzF,6GAA6G;aAChH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,8FAA8F;gBAC9F,0GAA0G;gBAC1G,oGAAoG;SACvG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,4BAA4B,MAAM,CAAC,OAAO,CAAC,8DAA8D;oBACzG,kGAAkG;oBAClG,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/self-hosted-upgrade.d.ts

@@ -0,0 +1,91 @@
+import { type ReleaseImages } from "./compose.js";
+import { type HostRunner } from "./self-hosted-release.js";
+/** Progress output; the CLI wires it to the terminal, tests to an array. */
+export interface UpgradeLog {
+    step(message: string): void;
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+export interface SelfHostedUpgradeDeps {
+    /** The install's `.caelo/` directory (docker-compose.yml, release.json, backups/). */
+    readonly caeloDir: string;
+    readonly runner: HostRunner;
+    /** Renders the Compose file for `images` from the install's config (secrets included). */
+    readonly renderCompose: (images: ReleaseImages) => string;
+    readonly log: UpgradeLog;
+    readonly fetchImpl?: typeof fetch;
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly now?: () => Date;
+    /** Health probe attempts per service and the pause between them. */
+    readonly healthAttempts?: number;
+    readonly healthIntervalMs?: number;
+}
+export interface SelfHostedUpgradeOpts {
+    readonly version?: string;
+    readonly channel?: "stable" | "rc" | "beta";
+    readonly skipVerify?: boolean;
+}
+export type SelfHostedUpgradeResult = {
+    readonly ok: true;
+    readonly status: "upgraded" | "already-current";
+    readonly version: string;
+} | {
+    readonly ok: false;
+    readonly stage: UpgradeStage;
+    readonly error: string;
+    /** Whether the previous release is running again (true when nothing had changed yet). */
+    readonly previousRunning: boolean;
+};
+type UpgradeStage = "target" | "verify" | "converge" | "backup" | "pull" | "migrate" | "roll-admin" | "roll-gateway";
+/** Where an install from before #696 keeps its original Compose file during the move. */
+export declare function legacyComposePath(caeloDir: string): string;
+/** Where the media of an install from before #696 lives: the checkout's admin cwd. */
+export declare function legacyMediaDir(caeloDir: string): string;
+/**
+ * Copy (never move) a legacy install's uploads from the checkout
+ * (`apps/admin/data/media`, the admin's cwd under the repo bind mount) into
+ * `.caelo/media/`, which the release-mode admin mounts as MEDIA_ROOT_DIR.
+ * Skipped when there is nothing to copy or `.caelo/media/` already has
+ * content (a previous run copied it).
+ */
+export declare function adoptLegacyMedia(caeloDir: string): {
+    ok: true;
+    copied: string | null;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function composePath(caeloDir: string): string;
+/**
+ * Upgrade a self-hosted install to `opts.version` (or the newest stable
+ * release). Never throws for an expected failure; the result says which
+ * stage failed and whether the previous release is serving again.
+ */
+export declare function upgradeSelfHosted(opts: SelfHostedUpgradeOpts, deps: SelfHostedUpgradeDeps): Promise<SelfHostedUpgradeResult>;
+/**
+ * pg_dump both databases (custom format) plus the cluster's roles into
+ * `.caelo/backups/pre-upgrade-<timestamp>/` (mode 700). Every dump must exit
+ * 0 and be non-empty, or the upgrade does not start.
+ */
+export declare function backupDatabases(caeloDir: string, runner: HostRunner, at: Date): Promise<{
+    ok: true;
+    dir: string;
+} | {
+    ok: false;
+    error: string;
+}>;
+/**
+ * Apply the committed migrations (cms_admin, then cms_public) with the
+ * admin image the Compose file names, as a one-off container — the
+ * self-hosted equivalent of the GCP `caelo-migrate-<target>` Cloud Run job.
+ * drizzle's bookkeeping makes re-runs apply only new migrations.
+ */
+export declare function runMigrations(caeloDir: string, runner: HostRunner): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+export {};
+//# sourceMappingURL=self-hosted-upgrade.d.ts.map

package/dist/self-hosted-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-upgrade.d.ts","sourceRoot":"","sources":["../src/self-hosted-upgrade.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7D,OAAO,EACL,KAAK,UAAU,EAMhB,MAAM,0BAA0B,CAAC;AAMlC,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChG;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,CAAC;AAEN,KAAK,YAAY,GACb,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,MAAM,GACN,SAAS,GACT,YAAY,GACZ,cAAc,CAAC;AAEnB,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAoBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAcpE;AAqBD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAOD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAuIlC;AA8BD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCnE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBtD"}

package/dist/self-hosted-upgrade.js

@@ -0,0 +1,355 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #696 Phase 4 — `cms-provision upgrade` for a self-hosted Compose install.
+ *
+ * Order, and why:
+ *   1. resolve the target release to digests + cosign-verify them — nothing
+ *      on the host changes until the images are known-good;
+ *   2. back up both databases (pg_dump, hard-fail) — the last moment the
+ *      schema is guaranteed to match the running images;
+ *   3. write the new digests into the Compose file, `docker compose pull`;
+ *   4. run the migrations from the NEW admin image (`docker compose run`,
+ *      the same `migrate.ts` entrypoint the GCP migrate job runs) while the
+ *      old containers keep serving — migrations are expand-only, so the
+ *      running release works on the new schema;
+ *   5. recreate the admin, health-check it (`/_caelo/health`, which proves
+ *      the DB pool and roles); then the gateway (`/healthz`);
+ *   6. record the release in `.caelo/release.json`.
+ * Any failure after step 3 puts the previous Compose file back; once a
+ * container was recreated the previous images are started again and
+ * health-checked (rollback). The database is never restored automatically:
+ * the expand-only migrations keep the previous release working, and the
+ * backup path is printed for the case they do not.
+ *
+ * Idempotent: a target equal to the recorded release is a no-op; a run that
+ * stopped half-way is simply repeated (pull, migrate and `up` converge).
+ *
+ * pgBackRest is NOT used: the Compose file's sidecar has no access to the
+ * Postgres data volume and no stanza is ever created, so `pg_dump` (from the
+ * Postgres container itself) is the backup that actually works here.
+ */
+import { chmodSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { MEDIA_DIR } from "./compose.js";
+import { selfCommand } from "./self-command.js";
+import { readRelease, recordRelease, recordRollback, releaseImages, resolveVerifiedRelease, } from "./self-hosted-release.js";
+import { fetchLatestReleaseTag, RELEASE_SERVICES, releaseTag } from "./upgrade/release-images.js";
+/** The Compose service names of the two Caelo services. */
+const COMPOSE_SERVICE = { admin: "caelo-admin", gateway: "caelo-gateway" };
+/** Where an install from before #696 keeps its original Compose file during the move. */
+export function legacyComposePath(caeloDir) {
+    return join(caeloDir, "docker-compose.pre-release.yml");
+}
+/**
+ * The legacy (repo-mounted) Compose file, saved to
+ * {@link legacyComposePath} on the first upgrade and read from there on
+ * every retry — after a stopped run the live file may already name the
+ * release images, which would make a rollback a no-op.
+ */
+function legacyComposeCheckpoint(caeloDir, live) {
+    const saved = legacyComposePath(caeloDir);
+    try {
+        // `wx`: create only — an existing checkpoint (an earlier run's) wins.
+        writeFileSync(saved, live, { mode: 0o600, flag: "wx" });
+        return live;
+    }
+    catch (e) {
+        if (e.code !== "EEXIST")
+            throw e;
+        return readFileSync(saved, "utf8");
+    }
+}
+/** Where the media of an install from before #696 lives: the checkout's admin cwd. */
+export function legacyMediaDir(caeloDir) {
+    return join(caeloDir, "..", "apps", "admin", "data", "media");
+}
+/**
+ * Copy (never move) a legacy install's uploads from the checkout
+ * (`apps/admin/data/media`, the admin's cwd under the repo bind mount) into
+ * `.caelo/media/`, which the release-mode admin mounts as MEDIA_ROOT_DIR.
+ * Skipped when there is nothing to copy or `.caelo/media/` already has
+ * content (a previous run copied it).
+ */
+export function adoptLegacyMedia(caeloDir) {
+    const from = legacyMediaDir(caeloDir);
+    const to = join(caeloDir, MEDIA_DIR);
+    if (!existsSync(from))
+        return { ok: true, copied: null };
+    if (existsSync(to) && readdirSync(to).length > 0)
+        return { ok: true, copied: null };
+    try {
+        cpSync(from, to, { recursive: true, preserveTimestamps: true });
+        return { ok: true, copied: to };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: `Could not copy the uploaded media from ${from} to ${to} (${e instanceof Error ? e.message : String(e)}). The upgrade did not start.`,
+        };
+    }
+}
+/** The file's size in bytes, 0 when it does not exist. */
+function fileSize(path) {
+    try {
+        return statSync(path).size;
+    }
+    catch {
+        return 0;
+    }
+}
+/** The file's content, or null when it does not exist. */
+function readIfExists(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return null;
+        throw e;
+    }
+}
+export function composePath(caeloDir) {
+    return join(caeloDir, "docker-compose.yml");
+}
+/** `docker compose -f <file>` — every Compose call targets the install's file explicitly. */
+function compose(caeloDir, ...args) {
+    return ["docker", "compose", "-f", composePath(caeloDir), ...args];
+}
+/**
+ * Upgrade a self-hosted install to `opts.version` (or the newest stable
+ * release). Never throws for an expected failure; the result says which
+ * stage failed and whether the previous release is serving again.
+ */
+export async function upgradeSelfHosted(opts, deps) {
+    const { caeloDir, runner, log } = deps;
+    const now = deps.now ?? (() => new Date());
+    const current = readRelease(caeloDir);
+    const file = composePath(caeloDir);
+    const live = readIfExists(file);
+    if (live === null) {
+        return fail("target", `${file} does not exist — run \`${selfCommand("init")}\` first.`, true);
+    }
+    // The file to restore on failure: the recorded release re-rendered (so a
+    // run that stopped after writing new digests cannot "restore" those), or —
+    // for an install from before #696 with no record — the legacy file,
+    // checkpointed once so a retry after a stopped run still has it.
+    const previousCompose = current
+        ? deps.renderCompose(releaseImages(current))
+        : legacyComposeCheckpoint(caeloDir, live);
+    // 1. Target release → verified digests.
+    const target = await targetVersion(opts, deps.fetchImpl);
+    if (!target.ok)
+        return fail("target", target.error, true);
+    log.step(`Upgrading ${current ? `${current.version} → ` : "(repo-mounted install) → "}${target.version}`);
+    const resolved = await resolveVerifiedRelease(target.tag, {
+        runner,
+        ...(opts.skipVerify ? { skipVerify: true } : {}),
+        ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+        onProgress: (m) => log.info(m),
+    });
+    if (!resolved.ok)
+        return fail("verify", resolved.error, true);
+    if (opts.skipVerify)
+        log.warn("--skip-verify set — image signatures NOT verified.");
+    const images = resolved.images;
+    if (current &&
+        current.images.admin === images.admin &&
+        current.images.gateway === images.gateway &&
+        live === previousCompose) {
+        // Recorded, and the Compose file agrees. `up` converges containers a
+        // stopped run or a failed rollback may have left on other images (a
+        // no-op when they already match); the health checks prove it serves.
+        log.info(`Already on ${current.version}; checking the running containers match and are healthy.`);
+        const converged = await startBoth(deps);
+        if (!converged.ok) {
+            return fail("converge", `${converged.error}\nThe recorded release ${current.version} is not serving healthily — check \`docker compose logs\`.`, false);
+        }
+        log.info(`Already on ${current.version} (${shortDigest(images.admin)}); nothing to do.`);
+        return { ok: true, status: "already-current", version: current.version };
+    }
+    // Otherwise (a different target, or a Compose file a stopped run left
+    // with other digests) the full flow below converges the install.
+    // Rendered before the backup so a config problem stops the run before
+    // anything on the host is touched.
+    const nextCompose = deps.renderCompose(images);
+    // 2. Backup — before anything on the host changes.
+    log.step("Backing up the databases (pg_dump)");
+    const backup = await backupDatabases(caeloDir, runner, now());
+    if (!backup.ok)
+        return fail("backup", backup.error, true);
+    log.info(`Backup written to ${backup.dir}`);
+    if (!current) {
+        const media = adoptLegacyMedia(caeloDir);
+        if (!media.ok)
+            return fail("backup", media.error, true);
+        if (media.copied)
+            log.info(`Copied the uploaded media into ${media.copied}`);
+    }
+    // 3. New digests into the Compose file; pull them.
+    writeFileSync(file, nextCompose, { mode: 0o600 });
+    log.step("Pulling the new images");
+    const pull = await runner.run(compose(caeloDir, "pull", COMPOSE_SERVICE.admin, COMPOSE_SERVICE.gateway));
+    if (pull.exitCode !== 0) {
+        restoreCompose(file, previousCompose);
+        return fail("pull", `docker compose pull failed: ${tail(pull.stderr)}`, true);
+    }
+    // 4. Migrations from the new admin image; the old containers keep serving.
+    log.step("Running database migrations with the new admin image");
+    const migrated = await runMigrations(caeloDir, runner);
+    if (!migrated.ok) {
+        restoreCompose(file, previousCompose);
+        return fail("migrate", `${migrated.error}\nThe previous release keeps running. Database backup: ${backup.dir}`, true);
+    }
+    // 5. Roll admin, then gateway, each health-checked.
+    for (const service of RELEASE_SERVICES) {
+        const stage = service === "admin" ? "roll-admin" : "roll-gateway";
+        log.step(`Restarting ${service} on ${shortDigest(images[service])}`);
+        const up = await runner.run(compose(caeloDir, "up", "-d", "--no-deps", COMPOSE_SERVICE[service]));
+        const healthy = up.exitCode === 0
+            ? await waitHealthy(service, caeloDir, deps)
+            : { ok: false, error: `docker compose up failed: ${tail(up.stderr)}` };
+        if (!healthy.ok) {
+            log.error(`${service} is not healthy on ${target.version}: ${healthy.error}`);
+            const restored = await rollback(file, previousCompose, deps);
+            if (current) {
+                recordRollback(caeloDir, current, target.version, `${stage}: ${healthy.error}`, now());
+            }
+            return fail(stage, `${healthy.error}\n${restored
+                ? "Rolled back: the previous release is running and healthy again."
+                : "ROLLBACK FAILED — the previous images did not come back healthy. Check `docker compose ps` / `docker compose logs`."}\nDatabase backup: ${backup.dir}`, restored);
+        }
+        log.info(`${service} healthy ✓`);
+    }
+    // 6. Record.
+    recordRelease(caeloDir, { version: target.version, images }, { from: current?.version ?? null, to: target.version, outcome: "upgraded" }, now());
+    log.step(`Upgraded to ${target.version}. Backup kept at ${backup.dir}`);
+    return { ok: true, status: "upgraded", version: target.version };
+}
+function fail(stage, error, previousRunning) {
+    return { ok: false, stage, error, previousRunning };
+}
+/** The tag to resolve and the version to record: explicit, channel, or newest stable. */
+async function targetVersion(opts, fetchImpl) {
+    if (opts.version || opts.channel === "rc" || opts.channel === "beta") {
+        const tag = releaseTag(opts);
+        return { ok: true, tag, version: tag };
+    }
+    const latest = await fetchLatestReleaseTag(fetchImpl);
+    if (!latest.ok) {
+        return {
+            ok: false,
+            error: `Could not look up the newest Caelo release (${latest.reason}). Pass --version x.y.z.`,
+        };
+    }
+    const tag = releaseTag({ version: latest.tag });
+    return { ok: true, tag, version: tag };
+}
+/**
+ * pg_dump both databases (custom format) plus the cluster's roles into
+ * `.caelo/backups/pre-upgrade-<timestamp>/` (mode 700). Every dump must exit
+ * 0 and be non-empty, or the upgrade does not start.
+ */
+export async function backupDatabases(caeloDir, runner, at) {
+    const ready = await runner.run(compose(caeloDir, "exec", "-T", "postgres", "pg_isready", "-U", "caelo"));
+    if (ready.exitCode !== 0) {
+        return {
+            ok: false,
+            error: "Postgres is not running, so no backup can be taken and the upgrade will not start.\n" +
+                `Start it with \`docker compose -f ${composePath(caeloDir)} up -d postgres\` and re-run.`,
+        };
+    }
+    const dir = join(caeloDir, "backups", `pre-upgrade-${at.toISOString().replace(/[:.]/g, "-")}`);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const dumps = [
+        ["globals.sql", ["pg_dumpall", "-U", "caelo", "--globals-only"]],
+        ["cms_admin.dump", ["pg_dump", "-U", "caelo", "-Fc", "cms_admin"]],
+        ["cms_public.dump", ["pg_dump", "-U", "caelo", "-Fc", "cms_public"]],
+    ];
+    for (const [name, cmd] of dumps) {
+        const out = join(dir, name);
+        const r = await runner.run(compose(caeloDir, "exec", "-T", "postgres", ...cmd), {
+            stdoutPath: out,
+        });
+        if (r.exitCode !== 0 || fileSize(out) === 0) {
+            return {
+                ok: false,
+                error: `Backup failed (${cmd.join(" ")} → ${out}): ${tail(r.stderr) || "empty dump"}. The upgrade did not start.`,
+            };
+        }
+        chmodSync(out, 0o600);
+    }
+    return { ok: true, dir };
+}
+/**
+ * Apply the committed migrations (cms_admin, then cms_public) with the
+ * admin image the Compose file names, as a one-off container — the
+ * self-hosted equivalent of the GCP `caelo-migrate-<target>` Cloud Run job.
+ * drizzle's bookkeeping makes re-runs apply only new migrations.
+ */
+export async function runMigrations(caeloDir, runner) {
+    for (const target of ["admin", "public"]) {
+        const r = await runner.run(compose(caeloDir, "run", "--rm", "--no-deps", "-T", COMPOSE_SERVICE.admin, "bun", "--bun", "/app/packages/migrations/src/migrate.ts", target));
+        if (r.exitCode !== 0) {
+            return { ok: false, error: `${target} migrations failed: ${tail(r.stderr || r.stdout)}` };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * In-container probe scripts (`bun -e`): the containers publish no host
+ * ports, so the probe runs where the service listens. The admin's
+ * `/_caelo/health` checks the DB pool + roles; the gateway's `/healthz` is
+ * its liveness endpoint.
+ */
+const HEALTH_PROBE = {
+    admin: 'const r=await fetch("http://127.0.0.1:"+(process.env.PORT||"3000")+"/_caelo/health").catch(()=>null);process.exit(r&&r.ok?0:1)',
+    gateway: 'const r=await fetch("http://127.0.0.1:"+(process.env.PORT||process.env.GATEWAY_PORT||"8090")+"/healthz").catch(()=>null);process.exit(r&&r.ok?0:1)',
+};
+async function waitHealthy(service, caeloDir, deps) {
+    const attempts = deps.healthAttempts ?? 45;
+    const interval = deps.healthIntervalMs ?? 2000;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let last = "";
+    for (let i = 0; i < attempts; i++) {
+        const r = await deps.runner.run(compose(caeloDir, "exec", "-T", COMPOSE_SERVICE[service], "bun", "-e", HEALTH_PROBE[service]));
+        if (r.exitCode === 0)
+            return { ok: true };
+        last = tail(r.stderr);
+        if (i < attempts - 1)
+            await sleep(interval);
+    }
+    return {
+        ok: false,
+        error: `health check did not pass after ${attempts} attempts${last ? ` (${last})` : ""}`,
+    };
+}
+/** Put the previous Compose file back, restart both services on it, health-check them. */
+async function rollback(file, previousCompose, deps) {
+    deps.log.warn("Rolling back to the previous images");
+    restoreCompose(file, previousCompose);
+    return (await startBoth(deps)).ok;
+}
+/** `up -d` both services on the current Compose file, then health-check each. */
+async function startBoth(deps) {
+    const up = await deps.runner.run(compose(deps.caeloDir, "up", "-d", "--no-deps", COMPOSE_SERVICE.admin, COMPOSE_SERVICE.gateway));
+    if (up.exitCode !== 0)
+        return { ok: false, error: `docker compose up failed: ${tail(up.stderr)}` };
+    for (const service of RELEASE_SERVICES) {
+        const healthy = await waitHealthy(service, deps.caeloDir, deps);
+        if (!healthy.ok)
+            return { ok: false, error: `${service}: ${healthy.error}` };
+    }
+    return { ok: true };
+}
+function restoreCompose(file, previous) {
+    writeFileSync(file, previous, { mode: 0o600 });
+}
+function shortDigest(ref) {
+    const at = ref.indexOf("@sha256:");
+    return at === -1 ? ref : ref.slice(at + 1, at + 20);
+}
+function tail(s) {
+    return s.trim().split("\n").slice(-5).join("\n").slice(0, 800);
+}
+//# sourceMappingURL=self-hosted-upgrade.js.map

package/dist/self-hosted-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-upgrade.js","sourceRoot":"","sources":["../src/self-hosted-upgrade.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,SAAS,EACT,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAsB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAEL,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAElG,2DAA2D;AAC3D,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAW,CAAC;AAmDpF,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,IAAI,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,QAAgB,EAAE,IAAY;IAC7D,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,sEAAsE;QACtE,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB;IAEhB,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0CAA0C,IAAI,OAAO,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B;SAC7I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,SAAS,OAAO,CAAC,QAAgB,EAAE,GAAG,IAAc;IAClD,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B,EAC3B,IAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,2BAA2B,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChG,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,eAAe,GAAG,OAAO;QAC7B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE5C,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CACN,aAAa,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,2BAA2B,GAAG,MAAM,CAAC,OAAO,EAAE,CAChG,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE;QACxD,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IACE,OAAO;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QACrC,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QACzC,IAAI,KAAK,eAAe,EACxB,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,GAAG,CAAC,IAAI,CACN,cAAc,OAAO,CAAC,OAAO,0DAA0D,CACxF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,IAAI,CACT,UAAU,EACV,GAAG,SAAS,CAAC,KAAK,0BAA0B,OAAO,CAAC,OAAO,4DAA4D,EACvH,KAAK,CACN,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3E,CAAC;IACD,sEAAsE;IACtE,iEAAiE;IAEjE,sEAAsE;IACtE,mCAAmC;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAE/C,mDAAmD;IACnD,GAAG,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,mDAAmD;IACnD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAC1E,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACtC,OAAO,IAAI,CACT,SAAS,EACT,GAAG,QAAQ,CAAC,KAAK,0DAA0D,MAAM,CAAC,GAAG,EAAE,EACvF,IAAI,CACL,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,cAAc,OAAO,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CACzB,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CACrE,CAAC;QACF,MAAM,OAAO,GACX,EAAE,CAAC,QAAQ,KAAK,CAAC;YACf,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC;YAC5C,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,6BAA6B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,sBAAsB,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YAC7D,IAAI,OAAO,EAAE,CAAC;gBACZ,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CACT,KAAK,EACL,GAAG,OAAO,CAAC,KAAK,KACd,QAAQ;gBACN,CAAC,CAAC,iEAAiE;gBACnE,CAAC,CAAC,qHACN,sBAAsB,MAAM,CAAC,GAAG,EAAE,EAClC,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;IACnC,CAAC;IAED,aAAa;IACb,aAAa,CACX,QAAQ,EACR,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EACnC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAC3E,GAAG,EAAE,CACN,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,oBAAoB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CACX,KAAmB,EACnB,KAAa,EACb,eAAwB;IAExB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,aAAa,CAC1B,IAA2B,EAC3B,SAAwB;IAExB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,+CAA+C,MAAM,CAAC,MAAM,0BAA0B;SAC9F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAkB,EAClB,EAAQ;IAER,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CACzE,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,sFAAsF;gBACtF,qCAAqC,WAAW,CAAC,QAAQ,CAAC,+BAA+B;SAC5F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/F,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,KAAK,GAAyB;QAClC,CAAC,aAAa,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAChE,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAClE,CAAC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;KACrE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,EAAE;YAC9E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,kBAAkB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,8BAA8B;aAClH,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,MAAkB;IAElB,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CACxB,OAAO,CACL,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,IAAI,EACJ,eAAe,CAAC,KAAK,EACrB,KAAK,EACL,OAAO,EACP,yCAAyC,EACzC,MAAM,CACP,CACF,CAAC;QACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,uBAAuB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAwC;IACxD,KAAK,EACH,gIAAgI;IAClI,OAAO,EACL,oJAAoJ;CACvJ,CAAC;AAEF,KAAK,UAAU,WAAW,CACxB,OAA4B,EAC5B,QAAgB,EAChB,IAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAC7B,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAC9F,CAAC;QACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,mCAAmC,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACzF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,eAAuB,EACvB,IAA2B;IAE3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,SAAS,CACtB,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAC9B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAChG,CAAC;IACF,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9E,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB;IACpD,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC"}