@caelo-cms/provisioning 0.10.71 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/adc-check.d.ts +36 -0
- package/dist/adc-check.d.ts.map +1 -0
- package/dist/adc-check.js +52 -0
- package/dist/adc-check.js.map +1 -0
- package/dist/adc-impersonation.d.ts +6 -2
- package/dist/adc-impersonation.d.ts.map +1 -1
- package/dist/adc-impersonation.js +8 -9
- package/dist/adc-impersonation.js.map +1 -1
- package/dist/agent-db.js +366 -83
- package/dist/state-command.d.ts.map +1 -1
- package/dist/state-command.js +9 -3
- package/dist/state-command.js.map +1 -1
- package/dist/state-migrate.d.ts +12 -0
- package/dist/state-migrate.d.ts.map +1 -1
- package/dist/state-migrate.js +4 -0
- package/dist/state-migrate.js.map +1 -1
- package/dist/wizards/gcp.d.ts.map +1 -1
- package/dist/wizards/gcp.js +19 -12
- package/dist/wizards/gcp.js.map +1 -1
- package/package.json +2 -2
- package/src/adc-check.test.ts +54 -0
- package/src/adc-check.ts +70 -0
- package/src/adc-impersonation.ts +14 -11
- package/src/provisioner-identity.test.ts +25 -0
- package/src/state-command.test.ts +12 -0
- package/src/state-command.ts +11 -3
- package/src/state-migrate.test.ts +53 -0
- package/src/state-migrate.ts +11 -0
- package/src/wizards/gcp.ts +25 -13
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Probe this machine's Application Default Credentials (#1078) — the
|
|
3
|
+
* credentials every local Pulumi run uses (the installer in local mode,
|
|
4
|
+
* `state migrate`). Without the probe, Pulumi starts with missing or
|
|
5
|
+
* expired ADC and prints one provider error per resource (`invalid_grant`
|
|
6
|
+
* … `invalid_rapt`) before failing, and the one line the Owner needs —
|
|
7
|
+
* `gcloud auth application-default login` — never appears.
|
|
8
|
+
*
|
|
9
|
+
* The probe runs `gcloud auth application-default print-access-token`,
|
|
10
|
+
* which refreshes the token exactly as Pulumi's Google provider would, so
|
|
11
|
+
* expired or reauth-blocked credentials fail here. The token is discarded.
|
|
12
|
+
*/
|
|
13
|
+
import { type GcloudResult } from "./gcloud.js";
|
|
14
|
+
/** The command that fixes both a missing and an expired login. */
|
|
15
|
+
export declare const ADC_LOGIN_COMMAND = "gcloud auth application-default login";
|
|
16
|
+
export type AdcProbe = {
|
|
17
|
+
readonly ok: true;
|
|
18
|
+
} | {
|
|
19
|
+
readonly ok: false;
|
|
20
|
+
/**
|
|
21
|
+
* `missing`: no ADC on this machine; `expired`: they exist but can no
|
|
22
|
+
* longer mint a token (expired/revoked refresh token, reauth policy);
|
|
23
|
+
* `error`: gcloud failed for another reason (its line is in `error`).
|
|
24
|
+
*/
|
|
25
|
+
readonly reason: "missing" | "expired" | "error";
|
|
26
|
+
/** One line naming {@link ADC_LOGIN_COMMAND}. */
|
|
27
|
+
readonly error: string;
|
|
28
|
+
};
|
|
29
|
+
/**
|
|
30
|
+
* Classify the result of `gcloud auth application-default print-access-token`.
|
|
31
|
+
* Pure, so the async installer path and the sync attach path word it alike.
|
|
32
|
+
*/
|
|
33
|
+
export declare function adcProbeFromResult(r: GcloudResult): AdcProbe;
|
|
34
|
+
/** The `print-access-token` arguments the probe runs. */
|
|
35
|
+
export declare const ADC_PROBE_ARGS: readonly string[];
|
|
36
|
+
//# sourceMappingURL=adc-check.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"adc-check.d.ts","sourceRoot":"","sources":["../src/adc-check.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAsC,MAAM,aAAa,CAAC;AAEpF,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,0CAA0C,CAAC;AAEzE,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACjD,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAKN;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,QAAQ,CAqB5D;AAED,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
// SPDX-License-Identifier: MPL-2.0
|
|
2
|
+
/**
|
|
3
|
+
* Probe this machine's Application Default Credentials (#1078) — the
|
|
4
|
+
* credentials every local Pulumi run uses (the installer in local mode,
|
|
5
|
+
* `state migrate`). Without the probe, Pulumi starts with missing or
|
|
6
|
+
* expired ADC and prints one provider error per resource (`invalid_grant`
|
|
7
|
+
* … `invalid_rapt`) before failing, and the one line the Owner needs —
|
|
8
|
+
* `gcloud auth application-default login` — never appears.
|
|
9
|
+
*
|
|
10
|
+
* The probe runs `gcloud auth application-default print-access-token`,
|
|
11
|
+
* which refreshes the token exactly as Pulumi's Google provider would, so
|
|
12
|
+
* expired or reauth-blocked credentials fail here. The token is discarded.
|
|
13
|
+
*/
|
|
14
|
+
import { gcloudErrorLine, isGcloudAuthError } from "./gcloud.js";
|
|
15
|
+
/** The command that fixes both a missing and an expired login. */
|
|
16
|
+
export const ADC_LOGIN_COMMAND = "gcloud auth application-default login";
|
|
17
|
+
/** gcloud's wording when no ADC file exists (and google-auth's, for older SDKs). */
|
|
18
|
+
const ADC_MISSING = /credentials were not found|could not automatically determine credentials/i;
|
|
19
|
+
/**
|
|
20
|
+
* Classify the result of `gcloud auth application-default print-access-token`.
|
|
21
|
+
* Pure, so the async installer path and the sync attach path word it alike.
|
|
22
|
+
*/
|
|
23
|
+
export function adcProbeFromResult(r) {
|
|
24
|
+
if (r.ok && r.stdout.trim().length > 0)
|
|
25
|
+
return { ok: true };
|
|
26
|
+
if (ADC_MISSING.test(r.stderr) || (r.ok && r.stdout.trim().length === 0)) {
|
|
27
|
+
return {
|
|
28
|
+
ok: false,
|
|
29
|
+
reason: "missing",
|
|
30
|
+
error: `No Application Default Credentials on this machine; Pulumi needs them. Run \`${ADC_LOGIN_COMMAND}\` and re-run this command.`,
|
|
31
|
+
};
|
|
32
|
+
}
|
|
33
|
+
if (isGcloudAuthError(r.stderr)) {
|
|
34
|
+
return {
|
|
35
|
+
ok: false,
|
|
36
|
+
reason: "expired",
|
|
37
|
+
error: `The Application Default Credentials on this machine have expired (gcloud: ${gcloudErrorLine(r.stderr)}). Run \`${ADC_LOGIN_COMMAND}\` and re-run this command.`,
|
|
38
|
+
};
|
|
39
|
+
}
|
|
40
|
+
return {
|
|
41
|
+
ok: false,
|
|
42
|
+
reason: "error",
|
|
43
|
+
error: `Could not check the Application Default Credentials on this machine (gcloud: ${gcloudErrorLine(r.stderr)}). Run \`${ADC_LOGIN_COMMAND}\` if they are missing or expired, then re-run this command.`,
|
|
44
|
+
};
|
|
45
|
+
}
|
|
46
|
+
/** The `print-access-token` arguments the probe runs. */
|
|
47
|
+
export const ADC_PROBE_ARGS = [
|
|
48
|
+
"auth",
|
|
49
|
+
"application-default",
|
|
50
|
+
"print-access-token",
|
|
51
|
+
];
|
|
52
|
+
//# sourceMappingURL=adc-check.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"adc-check.js","sourceRoot":"","sources":["../src/adc-check.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAqB,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEpF,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAgBzE,oFAAoF;AACpF,MAAM,WAAW,GAAG,2EAA2E,CAAC;AAEhG;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAe;IAChD,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,gFAAgF,iBAAiB,6BAA6B;SACtI,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,6EAA6E,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,iBAAiB,6BAA6B;SACxK,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,gFAAgF,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,iBAAiB,8DAA8D;KAC5M,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,MAAM;IACN,qBAAqB;IACrB,oBAAoB;CACrB,CAAC"}
|
|
@@ -3,8 +3,12 @@ export type AdcCheck = {
|
|
|
3
3
|
readonly ok: true;
|
|
4
4
|
} | {
|
|
5
5
|
readonly ok: false;
|
|
6
|
-
/**
|
|
7
|
-
|
|
6
|
+
/**
|
|
7
|
+
* `no-adc`: no Application Default Credentials; `expired-adc`: they
|
|
8
|
+
* exist but can no longer mint a token (#1078); `denied`: they can't
|
|
9
|
+
* impersonate.
|
|
10
|
+
*/
|
|
11
|
+
readonly reason: "no-adc" | "expired-adc" | "denied" | "error";
|
|
8
12
|
readonly error: string;
|
|
9
13
|
};
|
|
10
14
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"adc-impersonation.d.ts","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"adc-impersonation.d.ts","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,YAAY,EAAa,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAa7E,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,EAC7F,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAC9F,OAAO,CAAC,QAAQ,CAAC,CAmGnB"}
|
|
@@ -10,6 +10,7 @@
|
|
|
10
10
|
* Both access tokens involved (the ADC source token and the minted one)
|
|
11
11
|
* stay in local variables: never printed, logged, returned or written.
|
|
12
12
|
*/
|
|
13
|
+
import { ADC_PROBE_ARGS, adcProbeFromResult } from "./adc-check.js";
|
|
13
14
|
import { gcloud as defaultGcloud } from "./gcloud.js";
|
|
14
15
|
import { realSleep } from "./gcloud-retry.js";
|
|
15
16
|
import { operatorMember, PROPAGATION_DELAYS_MS, provisionerServiceAccountEmail, TOKEN_CREATOR_ROLE, withoutAmbientGoogleCredentials, } from "./provisioner-identity.js";
|
|
@@ -29,19 +30,17 @@ export async function checkAdcImpersonation(target, deps = {}) {
|
|
|
29
30
|
const doFetch = deps.fetch ?? fetch;
|
|
30
31
|
const sa = provisionerServiceAccountEmail(target.projectId);
|
|
31
32
|
const env = withoutAmbientGoogleCredentials(deps.env ?? process.env);
|
|
32
|
-
const adc = await run([
|
|
33
|
-
const
|
|
34
|
-
if (!
|
|
33
|
+
const adc = await run([...ADC_PROBE_ARGS], { env });
|
|
34
|
+
const probe = adcProbeFromResult(adc);
|
|
35
|
+
if (!probe.ok) {
|
|
35
36
|
return {
|
|
36
37
|
ok: false,
|
|
37
|
-
reason: "no-adc",
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
`Infrastructure runs authenticate with your own Google login and impersonate ${sa}; no key file is used.`,
|
|
41
|
-
`Run \`gcloud auth application-default login\` (sign in as ${target.operatorAccount}), then re-run.`,
|
|
42
|
-
].join("\n"),
|
|
38
|
+
reason: probe.reason === "expired" ? "expired-adc" : "no-adc",
|
|
39
|
+
// One line (#1078): the login command must not drown in context.
|
|
40
|
+
error: `${probe.error} Sign in as ${target.operatorAccount}: Pulumi uses these credentials to impersonate ${sa}, no key file.`,
|
|
43
41
|
};
|
|
44
42
|
}
|
|
43
|
+
const sourceToken = adc.stdout.trim();
|
|
45
44
|
// The account to impersonate is the one IAM reports, not a string
|
|
46
45
|
// assembled from install.json: what goes into the request is an email
|
|
47
46
|
// Google confirmed exists in the project (CodeQL js/file-access-to-http:
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"adc-impersonation.js","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAEnC,iEAAiE;AACjE,MAAM,qBAAqB,GACzB,qFAAqF,CAAC;
|
|
1
|
+
{"version":3,"file":"adc-impersonation.js","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAEnC,iEAAiE;AACjE,MAAM,qBAAqB,GACzB,qFAAqF,CAAC;AAexF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA6F,EAC7F,OAA6F,EAAE;IAE/F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;YAC7D,iEAAiE;YACjE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,eAAe,MAAM,CAAC,eAAe,kDAAkD,EAAE,gBAAgB;SAC/H,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEtC,kEAAkE;IAClE,sEAAsE;IACtE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB;QACE,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,uBAAuB;KACxB,EACD,EAAE,GAAG,EAAE,CACR,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,kBAAkB,EAAE,eAAe,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,uEAAuE;SACtN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,SAAS,CAAC,sBAAsB,EAC1H;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,CAAC,gDAAgD,CAAC;oBACzD,QAAQ,EAAE,MAAM;iBACjB,CAAC;aACH,CACF,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,gFAAgF;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChC,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAChG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,MAAM,MAAM,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GACZ,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE;YACL,uCAAuC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,MAAM,EAAE;YAClH,QAAQ;gBACN,CAAC,CAAC,+CAA+C,MAAM,CAAC,eAAe,kBAAkB,kBAAkB,4DAA4D,MAAM,CAAC,eAAe,gBAAgB;gBAC7M,CAAC,CAAC,qBAAqB,kBAAkB,OAAO,EAAE,8KAA8K,EAAE,cAAc,MAAM,CAAC,SAAS,aAAa,cAAc,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,WAAW,kBAAkB,mBAAmB;SACpX,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;QACpE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,WAAmB;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,yCAAyC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
|