@catladder/cli 0.0.0-node16-ddfae617 → 0.0.0-refactor-env-context-9e652b63

package/src/gcloud/cloudRun/getCloudRunDomainSuffix.ts

@@ -0,0 +1,35 @@
+import type { DeployConfigCloudRun } from "@catladder/pipeline";
+import { exec } from "child-process-promise";
+
+const getSuffixFromService = (service: any) => {
+  const fullUrl = service.status.url;
+  const name = service.metadata.name;
+
+  return fullUrl.replace("https://" + name + "-", "");
+};
+export const getCloudRunDomainSuffix = async (config: DeployConfigCloudRun) => {
+  /* google cloud run domains are partially predictable, they have a fixed suffix that depends on the region and project, but we don't know it beforehand
+
+  So what we do is either:
+   - get one service and extract its suffix
+   - create a dummy project, extract the suffix and save that as a gitlab variable
+  
+  
+  */
+
+  const dummyServiceName = "cl-dummy-service-delete-me";
+
+  const existingServices = await exec(
+    `gcloud run services list --format=json  --project="${config.projectId}"  --region=${config.region} --limit=1`
+  ).then((r) => JSON.parse(r.stdout));
+
+  if (existingServices.length > 0) {
+    return getSuffixFromService(existingServices[0]);
+  }
+
+  const result = await exec(
+    `gcloud run deploy ${dummyServiceName} --region=${config.region} --allow-unauthenticated --project ${config.projectId} --image=us-docker.pkg.dev/cloudrun/container/hello --format=json`
+  ).then((r) => JSON.parse(r.stdout));
+
+  return await getSuffixFromService(result);
+};

package/src/gcloud/cloudRun/openCloudRunDashboards.ts

@@ -0,0 +1,22 @@
+import type { Context } from "@catladder/pipeline";
+import { isOfDeployType } from "@catladder/pipeline";
+import type { CommandInstance } from "vorpal";
+import { openGoogleCloudDashboard } from "../openDashboard";
+
+export const openGoogleCloudRunDashboard = async (
+  instance: CommandInstance,
+  context: Context
+) => {
+  if (!isOfDeployType(context.componentConfig.deploy, "google-cloudrun")) {
+    throw new Error("deploy type is not google-cloudrun ");
+  }
+  const { fullName } = context.environment;
+  const { region, projectId } = context.componentConfig.deploy;
+  await openGoogleCloudDashboard(
+    instance,
+    `run/detail/${region}/${fullName}/metrics`,
+    {
+      project: projectId,
+    }
+  );
+};

package/src/gcloud/enableServices.ts

@@ -0,0 +1,14 @@
+import { exec } from "child-process-promise";
+
+export const enableGCloudServices = async (
+  services: string[],
+  config: {
+    projectId: string;
+  }
+) => {
+  for (const service of services) {
+    await exec(
+      `gcloud services enable ${service} --project=${config.projectId}`
+    );
+  }
+};

package/src/gcloud/openDashboard.ts

@@ -0,0 +1,19 @@
+import type { CommandInstance } from "vorpal";
+import { getGoogleAuthUserNumber } from "../apps/cli/utils/getGoogleAuthUserNumber";
+import open from "open";
+export const openGoogleCloudDashboard = async (
+  instance: CommandInstance,
+  path: string,
+  params: Record<string, string>
+) => {
+  const url = new URL("https://console.cloud.google.com/");
+  url.pathname = path;
+  for (const [key, value] of Object.entries(params)) {
+    url.searchParams.set(key, value);
+  }
+
+  const googleAuthUserNumber = await getGoogleAuthUserNumber.call(instance);
+  url.searchParams.set("authuser", googleAuthUserNumber);
+
+  open(url.toString());
+};

package/src/gcloud/serviceAccounts.ts

@@ -0,0 +1,101 @@
+import type { Context } from "@catladder/pipeline";
+
+import { exec } from "child-process-promise";
+import { createHmac } from "crypto";
+import type { CommandInstance } from "vorpal";
+import { upsertAllVariables } from "../utils/gitlab";
+
+export const accountExists = async (fullIdentifier: string) => {
+  try {
+    await exec(`gcloud iam service-accounts describe ${fullIdentifier}`);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+type ServiceAccount = {
+  projectId: string;
+  name: string;
+  displayName: string;
+  roles: string[];
+  description: string;
+};
+const upsertGcloudServiceAccount = async (
+  context: Context,
+  account: ServiceAccount
+): Promise<string> => {
+  const { projectId, name, displayName, roles, description } = account;
+
+  // name has limit of 30
+  const namePrefix = `${name}-`;
+  const nameSuffix = `-${context.environment.shortName}-${context.componentName}`;
+  const nameMiddleLength = 30 - namePrefix.length - nameSuffix.length;
+  const nameMiddle = `${context.fullConfig.customerName}-${context.fullConfig.appName}`;
+
+  const middle = hashIfNessecary(nameMiddle, nameMiddleLength);
+
+  const fullName = `${namePrefix}${middle}${nameSuffix}`;
+
+  const fullDisplayName = `${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.environment.shortName}:${context.componentName} | ${displayName}`;
+
+  const fullIdentifier = `${fullName}@${projectId}.iam.gserviceaccount.com`;
+
+  const existing = await accountExists(fullIdentifier);
+
+  if (!existing) {
+    await exec(
+      `gcloud iam service-accounts create ${fullName} --display-name="${fullDisplayName}" --project="${projectId}"  --description="${description}"`
+    );
+  }
+  const memberName = `serviceAccount:${fullIdentifier}`;
+  for (const role of roles) {
+    await exec(
+      `gcloud projects add-iam-policy-binding ${projectId} --member=${memberName} --role=${role} `
+    );
+  }
+
+  // create key
+
+  // delete first all keys
+  const keys = await exec(
+    `gcloud iam service-accounts keys list --iam-account=${fullIdentifier} --managed-by=user --format=json`
+  ).then((o) => JSON.parse(o.stdout));
+
+  for (const key of keys) {
+    await exec(
+      `gcloud iam service-accounts keys delete ${key.name} --quiet --iam-account=${fullIdentifier}`
+    );
+  }
+
+  return await exec(
+    `gcloud iam service-accounts keys create /dev/stdout --iam-account=${fullIdentifier}`
+  ).then((o) => o.stdout);
+};
+
+export const upsertGcloudServiceAccountAndSaveSecret = async (
+  instance: CommandInstance,
+  context: Context,
+  account: ServiceAccount,
+  secretName: string
+): Promise<void> => {
+  instance.log("upserting service account " + account.name + "...");
+  const key = await upsertGcloudServiceAccount(context, account);
+
+  await upsertAllVariables(
+    instance,
+    {
+      [secretName]: key,
+    },
+    context.environment.shortName,
+    context.componentName
+  );
+  instance.log("done!");
+};
+
+const hashIfNessecary = (str: string, maxLength: number) =>
+  str.length > maxLength ? hash(str, maxLength) : str;
+
+const hash = (str: string, length: number) => {
+  return createHmac("sha256", str).digest("hex").substring(0, length);
+};

package/src/kubernetes/index.ts

@@ -0,0 +1,27 @@
+import { parseChoice } from "../config/parseChoice";
+import { getk8sApi } from "../k8sApi";
+import { getProjectNamespace } from "../utils/projects";
+
+export const getProjectPods = async (envComponent: string) => {
+  const namespace = await getProjectNamespace(envComponent);
+  const k8sApi = getk8sApi();
+  const res = await k8sApi.listNamespacedPod(namespace);
+
+  const { componentName } = parseChoice(envComponent);
+  return res.body.items.filter((item) =>
+    componentName ? item.metadata?.name?.includes(componentName + "-") : true
+  );
+};
+
+export const getProjectPvcs = async (envComponent: string) => {
+  const namespace = await getProjectNamespace(envComponent);
+  const k8sApi = getk8sApi();
+  const res = await k8sApi.listNamespacedPersistentVolumeClaim(namespace);
+
+  return res.body.items;
+};
+
+export const getProjectPodNames = async (envComponent: string) => {
+  const pods = await getProjectPods(envComponent);
+  return pods.map((n) => n.metadata.name);
+};

package/src/kubernetes/openKubernetesDashboards.ts

@@ -0,0 +1,52 @@
+import type { Context } from "@catladder/pipeline";
+import { isOfDeployType } from "@catladder/pipeline";
+import type { CommandInstance } from "vorpal";
+import { openGoogleCloudDashboard } from "../gcloud/openDashboard";
+
+export const openGoogleCloudLogs = async (
+  instance: CommandInstance,
+  context: Context
+) => {
+  const deployConfig = context.componentConfig.deploy;
+  if (!isOfDeployType(deployConfig, "kubernetes")) {
+    throw new Error("context is not of type kubernetes");
+  }
+
+  if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+    throw new Error("no gcloud custer configured");
+  }
+
+  const namespace = context.environment.envVars.KUBE_NAMESPACE;
+  const cluster = deployConfig.cluster;
+
+  const resource = `k8s_container/cluster_name/${cluster.name}${
+    namespace ? `/namespace_name/${namespace}` : ""
+  }`;
+
+  await openGoogleCloudDashboard(instance, "logs/viewer", {
+    project: cluster.projectId,
+    resource: resource,
+  });
+};
+
+export const openGoogleCloudKubernetesDashboard = async (
+  instance: CommandInstance,
+  context: Context
+) => {
+  const deployConfig = context.componentConfig.deploy;
+  if (!isOfDeployType(deployConfig, "kubernetes")) {
+    throw new Error("context is not of type kubernetes");
+  }
+
+  if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+    throw new Error("no gcloud custer configured");
+  }
+  const namespace = context.environment.envVars.KUBE_NAMESPACE;
+  const cluster = deployConfig.cluster;
+  const pageState = `("savedViews":("c":["gke/${cluster.region}/${cluster.name}"],"n":["${namespace}"],"i":"4e42e0b9cd6147f8a4fba7516752ec48"))`;
+
+  await openGoogleCloudDashboard(instance, "kubernetes/workload", {
+    project: cluster.projectId,
+    pageState: pageState,
+  });
+};

package/src/types/child-process-promise.d.ts

@@ -1 +1,36 @@
-declare module 'child-process-promise'
+import type { ReadStream } from "fs-extra";
+
+declare module "child-process-promise" {
+  function exec(
+    cmd: string,
+    options?: {
+      env?: Record<string, string>;
+    }
+  ): Promise<{
+    stdout: string;
+  }>;
+
+  type Stdio = "inherit" | "pipe";
+  type SpawnOptions = {
+    stdio?: Stdio | Stdio[];
+    shell?: boolean;
+    env?: Record<string, string>;
+  };
+
+  function spawn(
+    cmd: string,
+    options?: SpawnOptions
+  ): Promise<{
+    stdout: string;
+  }>;
+
+  function spawn(
+    cmd: string,
+    args: string[],
+    options?: SpawnOptions
+  ): Promise<unknown> & {
+    childProcess: {
+      stdout: ReadStream;
+    };
+  };
+}

package/src/utils/cluster.ts

@@ -1,12 +1,12 @@
-import { $ } from "zx";
+import { exec } from "child-process-promise";
 
 export const getCurrentContext = async () =>
-  (await $`kubectl config current-context`).stdout.trim();
+  (await exec(`kubectl config current-context`)).stdout.trim();
 
 export const getCurrentConnectedClusterName = async () => {
   return await getCurrentContext();
 };
 
 export const connectToCluster = async (fullname: string) => {
-  await $`kubectl config use-context ${fullname}`;
+  await exec(`kubectl config use-context ${fullname}`);
 };

package/src/utils/gitlab.ts

@@ -1,10 +1,10 @@
-import { exec } from "child-process-promise";
 import { getSecretVarName } from "@catladder/pipeline";
-import { isObject } from "lodash";
+import { exec } from "child-process-promise";
+import { has, isObject } from "lodash";
 import memoizee from "memoizee";
 import fetch from "node-fetch";
 import open from "open";
-import { CommandInstance } from "vorpal";
+import type { CommandInstance } from "vorpal";
 import { getPreference, hasPreference, setPreference } from "./preferences";
 
 const TOKEN_KEY = "gitlab-personal-access-token";
@@ -51,15 +51,16 @@ export const getGitlabToken = async (vorpal: CommandInstance) => {
   return getPreference(TOKEN_KEY);
 };
 
+type Method = "GET" | "PUT" | "POST" | "DELETE";
 export const doGitlabRequest = async <T = any>(
   vorpal: CommandInstance,
   path: string,
   data: any = undefined,
-  update?: boolean
+  method: Method = "GET"
 ): Promise<T> => {
   const rootToken = await getGitlabToken(vorpal);
 
-  const method = data ? (update ? "PUT" : "POST") : "GET";
+  //const method = data ? (update ? "PUT" : "POST") : "GET";
 
   const result = await fetch(`https://git.panter.ch/api/v4/${path}`, {
     method,
@@ -67,11 +68,14 @@ export const doGitlabRequest = async <T = any>(
       "Content-Type": "application/json",
       "Private-Token": rootToken,
     },
-    body: JSON.stringify(data),
+    body: data ? JSON.stringify(data) : undefined,
   });
 
   if (result.status >= 200 && result.status < 400) {
-    return result.json();
+    if (result.headers.get("content-type") === "application/json") {
+      return result.json();
+    }
+    return null;
   }
   if (result.status === 404) {
     throw new Error("not found");
@@ -90,9 +94,10 @@ export const getProjectInfo = async (
   const gitRemoteOriginUrl = (
     await exec("git config --get remote.origin.url")
   ).stdout.trim();
-  const projectPath = /(https:\/\/|git@)git\.panter\.ch[:/](.*)\.git/g.exec(
-    gitRemoteOriginUrl
-  );
+  const projectPath =
+    /(https:\/\/|git@)git\.panter\.ch[:/]([^.]*)(\.git)?/g.exec(
+      gitRemoteOriginUrl
+    );
   const project = await doGitlabRequest(
     vorpal,
     `projects/${encodeURIComponent(projectPath[2])}`
@@ -143,48 +148,154 @@ const createVariable = async (
   vorpal: CommandInstance,
   projectId: string,
   key: string,
-  value: string
+  value: string,
+  masked = true,
+  environment_scope = "*"
 ) => {
-  return await doGitlabRequest(vorpal, `projects/${projectId}/variables`, {
-    key,
-    value,
-    masked: isMaskable(value),
-  });
+  return await doGitlabRequest(
+    vorpal,
+    `projects/${projectId}/variables`,
+    {
+      key,
+      value,
+      masked: masked && isMaskable(value),
+      environment_scope,
+    },
+    "POST"
+  );
 };
 
 const updateVariable = async (
   vorpal: CommandInstance,
   projectId: string,
   key: string,
-  value: string
+  value: string,
+  masked = true
 ) => {
   return await doGitlabRequest(
     vorpal,
     `projects/${projectId}/variables/${key}`,
     {
       value,
-      masked: isMaskable(value),
+      masked: masked && isMaskable(value),
     },
-    true
+    "PUT"
+  );
+};
+
+const deleteVariable = async (
+  vorpal: CommandInstance,
+  projectId: string,
+  key: string
+) => {
+  return await doGitlabRequest(
+    vorpal,
+    `projects/${projectId}/variables/${key}`,
+    undefined,
+    "DELETE"
+  );
+};
+
+const getAllCatladderEnvVarsInGitlab = async (vorpal: CommandInstance) => {
+  const allVariables = await getAllVariables(vorpal).then((v) =>
+    v.reduce<{
+      [key: string]: {
+        value?: string;
+        backups: number[];
+      };
+    }>((acc, variable) => {
+      const { key } = variable;
+
+      if (key.startsWith("CL_")) {
+        const matchBackup = key.match(/(CL_.*)_backup_([0-9]+)/);
+
+        if (matchBackup) {
+          const key = matchBackup[1];
+          const timestamp = Number(matchBackup[2]);
+          const backups = [...(acc[key]?.backups ?? []), timestamp];
+          return {
+            ...acc,
+            [key]: {
+              ...(acc[key] ?? {}), // add value
+              backups,
+            },
+          };
+        }
+
+        return {
+          ...acc,
+          [key]: {
+            backups: [],
+            ...(acc[key] ?? {}), // may add backups
+            value: variable.value,
+          },
+        };
+      }
+
+      return acc;
+    }, {})
   );
+  return allVariables;
 };
+
+const getBackupKey = (fullKey: string, timestamp: number) =>
+  `${fullKey}_backup_${timestamp}`;
+export const clearBackups = async (vorpal: CommandInstance, keep: number) => {
+  const existingVariables = await getAllCatladderEnvVarsInGitlab(vorpal);
+  const { id } = await getProjectInfo(vorpal);
+  for (const [key, { backups }] of Object.entries(existingVariables)) {
+    const backupsSorted = backups.sort((a, b) => b - a);
+    //const toKeep = backupsSorted.slice(0, keep);
+    const toDelete = backupsSorted.slice(keep);
+
+    for (const timestamp of toDelete) {
+      await deleteVariable(vorpal, id, getBackupKey(key, timestamp));
+    }
+  }
+};
+
 export const upsertAllVariables = async (
   vorpal: CommandInstance,
   variables: Record<string, any>,
   env: string,
-  componentName: string
+  componentName: string,
+  backup = true,
+  masked = true // FIXME: would be better to have this per variable
 ): Promise<void> => {
   const { id } = await getProjectInfo(vorpal);
 
+  // we list all existing variables. We also gather backup versions, but its currently unused
+  const existingVariables = await getAllCatladderEnvVarsInGitlab(vorpal);
   for (const [key, value] of Object.entries(variables ?? {})) {
     const fullKey = getSecretVarName(env, componentName, key);
     const valueSanitized = isObject(value) ? JSON.stringify(value) : `${value}`;
-    try {
-      await updateVariable(vorpal, id, fullKey, valueSanitized);
-    } catch (e) {
-      await createVariable(vorpal, id, fullKey, valueSanitized);
-    } finally {
-      getAllVariables.clear();
+
+    const exists = has(existingVariables, fullKey);
+    const oldValue = existingVariables[fullKey]?.value;
+    const changed = oldValue !== valueSanitized;
+    if (changed) {
+      if (exists) {
+        vorpal.log(`changed: ${key}`);
+
+        await updateVariable(vorpal, id, fullKey, valueSanitized, masked);
+        // write backup
+        if (backup) {
+          await createVariable(
+            vorpal,
+            id,
+            getBackupKey(fullKey, new Date().getTime()),
+            oldValue,
+            masked,
+            "_backup"
+          );
+        }
+      } else {
+        vorpal.log(`new    : ${key}`);
+        await createVariable(vorpal, id, fullKey, valueSanitized, masked);
+      }
+    } else {
+      vorpal.log(`skip   : ${key}`);
     }
   }
+  getAllVariables.clear();
 };

package/src/utils/passwordstore/index.ts

@@ -1,9 +1,6 @@
 import { exec, spawn } from "child-process-promise";
 import commandExists from "command-exists-promise";
 import dayjs from "dayjs";
-import { readFile, writeFile } from "fs-extra";
-import { withFile } from "tmp-promise";
-import getEditor from "../getEditor";
 import { getPreference, hasPreference, setPreference } from "../preferences";
 
 const DEBUG = false;
@@ -18,7 +15,7 @@ const unlockBitwarden = async () => {
   let session = null;
   promise.childProcess.stdout.on(
     "data",
-    (d: any) => (session = d.toString("utf-8"))
+    (d) => (session = d.toString("utf-8"))
   );
   await promise;
   await setPreference("bwsession", session);
@@ -33,7 +30,7 @@ const loginBitwarden = async () => {
   let session = null;
   promise.childProcess.stdout.on(
     "data",
-    (d: any) => (session = d.toString("utf-8"))
+    (d) => (session = d.toString("utf-8"))
   );
   await promise;
   await setPreference("bwsession", session);
@@ -120,14 +117,6 @@ export const readPass = async (path: string) => {
   return result.notes || result.login?.password;
 };
 
-const update = async (type: string, itemId: string, value: any) => {
-  const result = await execBitwardenCommand(
-    `edit ${type} ${itemId} ${encode(value)}`
-  );
-
-  return result;
-};
-
 const MAX_SYNC_AGE_IN_MINUTES = 30;
 export const syncBitwarden = async (force = true) => {
   const lastSync = (await hasPreference("bwLastSync"))
@@ -171,20 +160,3 @@ export const trashItem = async (path: string) => {
 
   return result;
 };
-export const editPass = async (path: string) => {
-  const item = await getItem(path);
-
-  await withFile(
-    async ({ path: tmpFilePath }) => {
-      await writeFile(tmpFilePath, item.notes);
-      await (await getEditor()).open(tmpFilePath);
-      const newContent = (await readFile(tmpFilePath)).toString("utf-8");
-
-      await update("item", item.id, {
-        ...item,
-        notes: newContent,
-      });
-    },
-    { postfix: ".yml" }
-  );
-};

package/src/utils/projects/index.ts

@@ -1,11 +1,11 @@
-import { $ } from "zx";
 import { join } from "path";
 import { getProjectConfig, parseChoice } from "../../config/getProjectConfig";
-import { getk8sApi } from "../../k8sApi";
+
 import { readFileOrError } from "../files";
+import { exec } from "child-process-promise";
 
 export const getGitRoot = async (): Promise<string> => {
-  return (await $`git rev-parse --show-toplevel`).stdout.trim();
+  return (await exec(`git rev-parse --show-toplevel`)).stdout.trim();
 };
 
 export const getRootGitlabCiFile = async () => {
@@ -29,24 +29,3 @@ export const getProjectNamespace = async (envComponent: string) => {
   const config = await getProjectConfig();
   return `${config.customerName}-${config.appName}-${env}`;
 };
-
-export const getProjectPods = async (envComponent: string) => {
-  const namespace = await getProjectNamespace(envComponent);
-  const k8sApi = getk8sApi();
-  const res = await k8sApi.listNamespacedPod(namespace);
-
-  return res.body.items;
-};
-
-export const getProjectPvcs = async (envComponent: string) => {
-  const namespace = await getProjectNamespace(envComponent);
-  const k8sApi = getk8sApi();
-  const res = await k8sApi.listNamespacedPersistentVolumeClaim(namespace);
-
-  return res.body.items;
-};
-
-export const getProjectPodNames = async (envComponent: string) => {
-  const pods = await getProjectPods(envComponent);
-  return pods.map((n) => n.metadata.name);
-};

package/dist/apps/cli/commands/shared/index.d.ts

@@ -1,3 +0,0 @@
-import { DeployConfigKubernetesCluster } from "@catladder/pipeline";
-export declare const openGoogleCloudLogs: (cluster?: DeployConfigKubernetesCluster, namespace?: string, googleAuthUserNumber?: number) => Promise<void>;
-export declare const openGoogleCloudKubernetesDashboard: (cluster: DeployConfigKubernetesCluster, namespace: string, googleAuthUserNumber?: number) => Promise<void>;

package/dist/apps/cli/commands/shared/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/apps/cli/commands/shared/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,8CAAwB;AAEjB,IAAM,mBAAmB,GAAG,UACjC,OAAuC,EACvC,SAAkB,EAClB,oBAAwB;IAAxB,qCAAA,EAAA,wBAAwB;;;;YAElB,QAAQ,GAAG,qCAA8B,OAAO,CAAC,IAAI,SACzD,SAAS,CAAC,CAAC,CAAC,0BAAmB,SAAS,CAAE,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC;YAEG,GAAG,GAAG,+DACV,OAAO,CAAC,SAAS,SAEjB,QAAQ,CAAC,CAAC,CAAC,oBAAa,kBAAkB,CAAC,QAAQ,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,uBAChD,oBAAoB,CAAE,CAAC;YACpC,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;;;;CACX,CAAC;AAfW,QAAA,mBAAmB,uBAe9B;AAEK,IAAM,kCAAkC,GAAG,UAChD,OAAsC,EACtC,SAAiB,EACjB,oBAAwB;IAAxB,qCAAA,EAAA,wBAAwB;;;;YAMlB,SAAS,GAAG,wCAA4B,OAAO,CAAC,MAAM,cAAI,OAAO,CAAC,IAAI,0BAAY,SAAS,qDAA6C,CAAC;YACzI,GAAG,GAAG,wEAAiE,oBAAoB,sBAC/F,OAAO,CAAC,SAAS,wBACL,kBAAkB,CAAC,SAAS,CAAC,CAAE,CAAC;YAE9C,IAAA,iBAAI,EAAC,GAAG,CAAC,CAAC;;;;CACX,CAAC;AAfW,QAAA,kCAAkC,sCAe7C"}