@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/workspace-deployment/ownership.js

@@ -0,0 +1,381 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKSPACE_STAGE_OWNERSHIP_SCHEMA_VERSION = void 0;
+exports.workspaceStageOwnerParameterName = workspaceStageOwnerParameterName;
+exports.workspaceStageOwnerParameterArn = workspaceStageOwnerParameterArn;
+exports.createWorkspaceStageOwnerRecord = createWorkspaceStageOwnerRecord;
+exports.canonicalWorkspaceStageOwner = canonicalWorkspaceStageOwner;
+exports.workspaceStageOwnershipTarget = workspaceStageOwnershipTarget;
+exports.createWorkspaceStageOwnershipClaimPlan = createWorkspaceStageOwnershipClaimPlan;
+exports.bindStageAuthorityTemplateToWorkspaceOwner = bindStageAuthorityTemplateToWorkspaceOwner;
+exports.inspectWorkspaceStageOwnership = inspectWorkspaceStageOwnership;
+exports.assertWorkspaceStageOwnership = assertWorkspaceStageOwnership;
+exports.assertWorkspaceStageOwnershipForWorkspace = assertWorkspaceStageOwnershipForWorkspace;
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../repository-policy/index.js");
+const identity_js_1 = require("../aws/identity.js");
+const identity_js_2 = require("./identity.js");
+exports.WORKSPACE_STAGE_OWNERSHIP_SCHEMA_VERSION = 1;
+const ACCOUNT_ID = /^\d{12}$/u;
+const REGION = /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/u;
+const WORKSPACE_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/u;
+function partitionForRegion(region) {
+    if (region.startsWith('cn-'))
+        return 'aws-cn';
+    if (region.startsWith('us-gov-'))
+        return 'aws-us-gov';
+    return 'aws';
+}
+function exactWorkspaceDeploymentTupleRule(target) {
+    return Object.freeze({
+        Assertions: [
+            {
+                Assert: {
+                    'Fn::Equals': [{ Ref: 'AWS::AccountId' }, target.accountId],
+                },
+            },
+            {
+                Assert: {
+                    'Fn::Equals': [{ Ref: 'AWS::Region' }, target.region],
+                },
+            },
+            {
+                Assert: {
+                    'Fn::Equals': [
+                        { Ref: 'AWS::Partition' },
+                        partitionForRegion(target.region),
+                    ],
+                },
+            },
+        ],
+    });
+}
+function requireWorkspaceName(value) {
+    if (typeof value !== 'string' ||
+        value.length > 214 ||
+        !WORKSPACE_NAME.test(value)) {
+        throw new Error('Workspace deployment ownership requires one bounded lowercase npm package name for diagnostics.');
+    }
+    return value;
+}
+function requireTarget(input) {
+    if (!ACCOUNT_ID.test(input.accountId) ||
+        !REGION.test(input.region) ||
+        !['development', 'staging', 'production'].includes(input.stage)) {
+        throw new Error('Workspace stage ownership requires one exact account, Region, and canonical stage.');
+    }
+    return {
+        accountId: input.accountId,
+        region: input.region,
+        stage: input.stage,
+        workspaceDeploymentId: (0, identity_js_2.normalizeWorkspaceDeploymentId)(input.workspaceDeploymentId),
+        workspaceName: requireWorkspaceName(input.workspaceName),
+    };
+}
+function requireOwnerIdentity(input) {
+    if (!ACCOUNT_ID.test(input.accountId) ||
+        !REGION.test(input.region) ||
+        !['development', 'staging', 'production'].includes(input.stage)) {
+        throw new Error('Workspace stage ownership requires one exact account, Region, and canonical stage.');
+    }
+    return {
+        accountId: input.accountId,
+        region: input.region,
+        stage: input.stage,
+        workspaceDeploymentId: (0, identity_js_2.normalizeWorkspaceDeploymentId)(input.workspaceDeploymentId),
+    };
+}
+function workspaceStageOwnerParameterName(stage) {
+    if (!['development', 'staging', 'production'].includes(stage)) {
+        throw new Error('Workspace stage owner requires one canonical stage.');
+    }
+    return `/ebk/${stage}/workspace-owner`;
+}
+function workspaceStageOwnerParameterArn(input) {
+    if (!ACCOUNT_ID.test(input.accountId) || !REGION.test(input.region)) {
+        throw new Error('Workspace stage owner ARN requires one exact account and Region.');
+    }
+    return `arn:${partitionForRegion(input.region)}:ssm:${input.region}:${input.accountId}:parameter${workspaceStageOwnerParameterName(input.stage)}`;
+}
+function createWorkspaceStageOwnerRecord(input) {
+    const target = requireOwnerIdentity(input);
+    return Object.freeze({
+        accountId: target.accountId,
+        kind: 'ebk-workspace-stage-owner',
+        region: target.region,
+        schemaVersion: exports.WORKSPACE_STAGE_OWNERSHIP_SCHEMA_VERSION,
+        stage: target.stage,
+        workspaceDeploymentId: target.workspaceDeploymentId,
+    });
+}
+function canonicalWorkspaceStageOwner(input) {
+    return JSON.stringify(createWorkspaceStageOwnerRecord(input));
+}
+function parseWorkspaceStageOwner(value) {
+    let candidate;
+    try {
+        candidate = JSON.parse(value);
+    }
+    catch {
+        throw new Error('Workspace stage owner record is not valid JSON.');
+    }
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+        throw new Error('Workspace stage owner record is not one object.');
+    }
+    const record = candidate;
+    if (JSON.stringify(Object.keys(record).sort()) !==
+        JSON.stringify([
+            'accountId',
+            'kind',
+            'region',
+            'schemaVersion',
+            'stage',
+            'workspaceDeploymentId',
+        ].sort()) ||
+        record.kind !== 'ebk-workspace-stage-owner' ||
+        record.schemaVersion !== exports.WORKSPACE_STAGE_OWNERSHIP_SCHEMA_VERSION ||
+        typeof record.accountId !== 'string' ||
+        typeof record.region !== 'string' ||
+        typeof record.stage !== 'string' ||
+        typeof record.workspaceDeploymentId !== 'string') {
+        throw new Error('Workspace stage owner record has an unexpected shape.');
+    }
+    return createWorkspaceStageOwnerRecord({
+        accountId: record.accountId,
+        region: record.region,
+        stage: record.stage,
+        workspaceDeploymentId: record.workspaceDeploymentId,
+    });
+}
+function rootWorkspaceName(workspaceRoot) {
+    let value;
+    try {
+        value = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(workspaceRoot, 'package.json'), 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Workspace deployment ownership requires a valid root package.json: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return requireWorkspaceName(value && typeof value === 'object' && !Array.isArray(value)
+        ? value.name
+        : undefined);
+}
+function workspaceStageOwnershipTarget(workspaceRoot, stage, policy = (0, index_js_1.readRepositoryOperatingPolicy)(workspaceRoot)) {
+    return requireTarget({
+        accountId: (0, index_js_1.configuredDeploymentAccountForStage)(policy.deploymentProfile, policy.deploymentAccounts, stage),
+        region: (0, index_js_1.configuredDeploymentRegion)(policy.deploymentRegion),
+        stage,
+        workspaceDeploymentId: policy.workspaceDeploymentId,
+        workspaceName: rootWorkspaceName(workspaceRoot),
+    });
+}
+function createWorkspaceStageOwnershipClaimPlan(input) {
+    const target = requireTarget(input);
+    const parameterName = workspaceStageOwnerParameterName(target.stage);
+    const parameterArn = workspaceStageOwnerParameterArn(target);
+    const value = canonicalWorkspaceStageOwner(target);
+    const identity = target.workspaceDeploymentId.slice('ebkws-'.length);
+    const stackName = `ebk-${target.stage}-workspace-owner-${identity}`;
+    const template = Object.freeze({
+        AWSTemplateFormatVersion: '2010-09-09',
+        Description: `Immutable Empire Builder Kit ${target.stage} workspace owner claim.`,
+        Outputs: {
+            WorkspaceDeploymentId: { Value: target.workspaceDeploymentId },
+            WorkspaceStageOwnerParameterArn: { Value: parameterArn },
+        },
+        Rules: {
+            ExactWorkspaceDeploymentTuple: exactWorkspaceDeploymentTupleRule(target),
+        },
+        Resources: {
+            WorkspaceStageOwner: {
+                DeletionPolicy: 'Retain',
+                Properties: {
+                    DataType: 'text',
+                    Description: `Exclusive EBK workspace owner for ${target.stage} in this account and Region.`,
+                    Name: parameterName,
+                    Tags: {
+                        'ebk:managed-by': 'empire-builder-kit',
+                        'ebk:stage': target.stage,
+                        'ebk:workspace': target.workspaceName,
+                        'ebk:workspace-deployment-id': target.workspaceDeploymentId,
+                    },
+                    Type: 'String',
+                    Value: value,
+                },
+                Type: 'AWS::SSM::Parameter',
+                UpdateReplacePolicy: 'Retain',
+            },
+        },
+    });
+    return Object.freeze({
+        digestInput: `${JSON.stringify(template)}\n`,
+        parameterArn,
+        parameterName,
+        stackName,
+        template,
+        value,
+    });
+}
+/** Bind the stage-authority change set to the already-claimed tuple. AWS
+ * resolves the exact SSM value while evaluating CloudFormation Rules, before
+ * any IAM resource in the authority stack can be changed. */
+function bindStageAuthorityTemplateToWorkspaceOwner(template, input) {
+    const target = requireTarget(input);
+    if (Object.prototype.hasOwnProperty.call(template, 'Parameters') ||
+        Object.prototype.hasOwnProperty.call(template, 'Rules')) {
+        throw new Error('Stage authority template already declares Parameters or Rules; workspace ownership binding would be ambiguous.');
+    }
+    return Object.freeze({
+        ...template,
+        Parameters: {
+            WorkspaceStageOwnerValue: {
+                AllowedValues: [workspaceStageOwnerParameterName(target.stage)],
+                Default: workspaceStageOwnerParameterName(target.stage),
+                Type: 'AWS::SSM::Parameter::Value<String>',
+            },
+        },
+        Rules: {
+            ExactWorkspaceDeploymentTuple: exactWorkspaceDeploymentTupleRule(target),
+            ExactWorkspaceStageOwner: {
+                Assertions: [
+                    {
+                        Assert: {
+                            'Fn::Equals': [
+                                { Ref: 'WorkspaceStageOwnerValue' },
+                                canonicalWorkspaceStageOwner(target),
+                            ],
+                        },
+                    },
+                ],
+            },
+        },
+    });
+}
+function ssmClient(target, options) {
+    if (options.client)
+        return options.client;
+    const configuration = {
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', target.region),
+        region: target.region,
+    };
+    if (options.profile) {
+        configuration.credentials = (0, credential_providers_1.fromIni)({
+            profile: options.profile,
+            ...(options.configFilepath
+                ? { configFilepath: options.configFilepath }
+                : {}),
+            ...(options.credentialsFilepath
+                ? { filepath: options.credentialsFilepath }
+                : {}),
+        });
+    }
+    return options.clientFactory
+        ? options.clientFactory(configuration)
+        : new client_ssm_1.SSMClient(configuration);
+}
+function missingParameter(error) {
+    return (error instanceof Error &&
+        (error.name === 'ParameterNotFound' ||
+            error.Code === 'ParameterNotFound'));
+}
+async function inspectWorkspaceStageOwnership(input, options = {}) {
+    const target = requireTarget(input);
+    const expectedOwner = createWorkspaceStageOwnerRecord(target);
+    const parameterName = workspaceStageOwnerParameterName(target.stage);
+    const parameterArn = workspaceStageOwnerParameterArn(target);
+    let response;
+    try {
+        response = await ssmClient(target, options).send(new client_ssm_1.GetParameterCommand({ Name: parameterName, WithDecryption: false }));
+    }
+    catch (error) {
+        if (missingParameter(error)) {
+            return {
+                accountId: target.accountId,
+                expectedOwner,
+                parameterArn,
+                parameterName,
+                region: target.region,
+                stage: target.stage,
+                status: 'unclaimed',
+            };
+        }
+        throw error;
+    }
+    const parameter = response.Parameter;
+    if (parameter?.ARN !== parameterArn ||
+        parameter.Name !== parameterName ||
+        parameter.Type !== 'String' ||
+        typeof parameter.Value !== 'string' ||
+        !Number.isSafeInteger(parameter.Version) ||
+        (parameter.Version ?? 0) < 1) {
+        return {
+            accountId: target.accountId,
+            expectedOwner,
+            parameterArn,
+            parameterName,
+            reason: 'unexpected-identity',
+            region: target.region,
+            stage: target.stage,
+            status: 'conflict',
+        };
+    }
+    let actualOwner;
+    try {
+        actualOwner = parseWorkspaceStageOwner(parameter.Value);
+    }
+    catch {
+        return {
+            accountId: target.accountId,
+            expectedOwner,
+            parameterArn,
+            parameterName,
+            reason: 'malformed-record',
+            region: target.region,
+            stage: target.stage,
+            status: 'conflict',
+        };
+    }
+    if (canonicalWorkspaceStageOwner(actualOwner) !==
+        canonicalWorkspaceStageOwner(target)) {
+        return {
+            accountId: target.accountId,
+            actualOwner,
+            expectedOwner,
+            parameterArn,
+            parameterName,
+            reason: 'different-owner',
+            region: target.region,
+            stage: target.stage,
+            status: 'conflict',
+        };
+    }
+    return {
+        accountId: target.accountId,
+        expectedOwner,
+        parameterArn,
+        parameterName,
+        region: target.region,
+        stage: target.stage,
+        status: 'owned',
+    };
+}
+async function assertWorkspaceStageOwnership(input, options = {}) {
+    const result = await inspectWorkspaceStageOwnership(input, options);
+    if (result.status === 'unclaimed') {
+        throw new Error(`AWS tuple ${result.accountId}/${result.region}/${result.stage} has no EBK workspace owner claim. Apply the exact generated workspace-owner claim before authority or SST lifecycle operations. Existing deployments require committed migration evidence; they are never claimed implicitly.`);
+    }
+    if (result.status === 'conflict') {
+        const target = requireTarget(input);
+        const actual = result.actualOwner
+            ? result.actualOwner.workspaceDeploymentId
+            : result.reason;
+        throw new Error(`AWS tuple ${result.accountId}/${result.region}/${result.stage} is owned by ${actual}, not ${target.workspaceName} (${result.expectedOwner.workspaceDeploymentId}). No SST child or AWS application mutation is permitted.`);
+    }
+    return result;
+}
+async function assertWorkspaceStageOwnershipForWorkspace(workspaceRoot, stage, options = {}) {
+    return assertWorkspaceStageOwnership(workspaceStageOwnershipTarget(workspaceRoot, stage), options);
+}
+//# sourceMappingURL=ownership.js.map

package/src/workspace-deployment/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../../../../packages/nx/src/workspace-deployment/ownership.ts"],"names":[],"mappings":";;;AA8LA,4EAOC;AAED,0EASC;AAED,0EAYC;AAED,oEAIC;AA8DD,sEAkBC;AAED,wFAgDC;AAKD,gGAsCC;AAmCD,wEAuFC;AAED,sEAoBC;AAED,8FASC;AA5iBD,oDAK6B;AAC7B,wEAAwD;AACxD,qCAAuC;AACvC,yCAAiC;AAEjC,4DAMuC;AACvC,oDAAkE;AAClE,+CAA+D;AAElD,QAAA,wCAAwC,GAAG,CAAU,CAAC;AAEnE,MAAM,UAAU,GAAG,WAAW,CAAC;AAC/B,MAAM,MAAM,GAAG,4CAA4C,CAAC;AAC5D,MAAM,cAAc,GAAG,uDAAuD,CAAC;AA2E/E,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iCAAiC,CACxC,MAAmE;IAEnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE;YACV;gBACE,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC5D;aACF;YACD;gBACE,MAAM,EAAE;oBACN,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;iBACtD;aACF;YACD;gBACE,MAAM,EAAE;oBACN,YAAY,EAAE;wBACZ,EAAE,GAAG,EAAE,gBAAgB,EAAE;wBACzB,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;qBAClC;iBACF;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,KAAoC;IAEpC,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,qBAAqB,EAAE,IAAA,4CAA8B,EACnD,KAAK,CAAC,qBAAqB,CAC5B;QACD,aAAa,EAAE,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAkC;IAElC,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QACjC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,qBAAqB,EAAE,IAAA,4CAA8B,EACnD,KAAK,CAAC,qBAAqB,CAC5B;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gCAAgC,CAC9C,KAA+B;IAE/B,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,KAAK,kBAAkB,CAAC;AACzC,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAA4E;IAE5E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,aAAa,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACpJ,CAAC;AAED,SAAgB,+BAA+B,CAC7C,KAAkC;IAElC,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,gDAAwC;QACvD,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,4BAA4B,CAC1C,KAAkC;IAElC,OAAO,IAAI,CAAC,SAAS,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,SAAoC,CAAC;IACpD,IACE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,CACZ;YACE,WAAW;YACX,MAAM;YACN,QAAQ;YACR,eAAe;YACf,OAAO;YACP,uBAAuB;SACxB,CAAC,IAAI,EAAE,CACT;QACH,MAAM,CAAC,IAAI,KAAK,2BAA2B;QAC3C,MAAM,CAAC,aAAa,KAAK,gDAAwC;QACjE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,+BAA+B,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAiC;QAC/C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAChB,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,sEACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CACzB,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzD,CAAC,CAAE,KAAiC,CAAC,IAAI;QACzC,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAC3C,aAAqB,EACrB,KAA+B,EAC/B,SAAoC,IAAA,wCAA6B,EAC/D,aAAa,CACd;IAED,OAAO,aAAa,CAAC;QACnB,SAAS,EAAE,IAAA,8CAAmC,EAC5C,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,kBAAkB,EACzB,KAAK,CACN;QACD,MAAM,EAAE,IAAA,qCAA0B,EAAC,MAAM,CAAC,gBAAgB,CAAC;QAC3D,KAAK;QACL,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;QACnD,aAAa,EAAE,iBAAiB,CAAC,aAAa,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,sCAAsC,CACpD,KAAoC;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,KAAK,oBAAoB,QAAQ,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,wBAAwB,EAAE,YAAY;QACtC,WAAW,EAAE,gCAAgC,MAAM,CAAC,KAAK,yBAAyB;QAClF,OAAO,EAAE;YACP,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAC9D,+BAA+B,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;SACzD;QACD,KAAK,EAAE;YACL,6BAA6B,EAAE,iCAAiC,CAAC,MAAM,CAAC;SACzE;QACD,SAAS,EAAE;YACT,mBAAmB,EAAE;gBACnB,cAAc,EAAE,QAAQ;gBACxB,UAAU,EAAE;oBACV,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,qCAAqC,MAAM,CAAC,KAAK,8BAA8B;oBAC5F,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE;wBACJ,gBAAgB,EAAE,oBAAoB;wBACtC,WAAW,EAAE,MAAM,CAAC,KAAK;wBACzB,eAAe,EAAE,MAAM,CAAC,aAAa;wBACrC,6BAA6B,EAAE,MAAM,CAAC,qBAAqB;qBAC5D;oBACD,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,KAAK;iBACb;gBACD,IAAI,EAAE,qBAAqB;gBAC3B,mBAAmB,EAAE,QAAQ;aAC9B;SACF;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI;QAC5C,YAAY;QACZ,aAAa;QACb,SAAS;QACT,QAAQ;QACR,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;6DAE6D;AAC7D,SAAgB,0CAA0C,CACxD,QAA2C,EAC3C,KAAoC;IAEpC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IACE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,QAAQ;QACX,UAAU,EAAE;YACV,wBAAwB,EAAE;gBACxB,aAAa,EAAE,CAAC,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC/D,OAAO,EAAE,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACvD,IAAI,EAAE,oCAAoC;aAC3C;SACF;QACD,KAAK,EAAE;YACL,6BAA6B,EAAE,iCAAiC,CAAC,MAAM,CAAC;YACxE,wBAAwB,EAAE;gBACxB,UAAU,EAAE;oBACV;wBACE,MAAM,EAAE;4BACN,YAAY,EAAE;gCACZ,EAAE,GAAG,EAAE,0BAA0B,EAAE;gCACnC,4BAA4B,CAAC,MAAM,CAAC;6BACrC;yBACF;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAChB,MAAqC,EACrC,OAAiD;IAEjD,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,aAAa,GAAoB;QACrC,QAAQ,EAAE,IAAA,0CAA4B,EAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5D,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,aAAa,CAAC,WAAW,GAAG,IAAA,8BAAO,EAAC;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,cAAc;gBACxB,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,mBAAmB;gBAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,aAAa;QAC1B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC;QACtC,CAAC,CAAC,IAAI,sBAAS,CAAC,aAAa,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB;YAChC,KAA4B,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAC9D,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,8BAA8B,CAClD,KAAoC,EACpC,UAAoD,EAAE;IAEtD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,aAAa,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAC9C,IAAI,gCAAmB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa;gBACb,YAAY;gBACZ,aAAa;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,WAAW;aACpB,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IACE,SAAS,EAAE,GAAG,KAAK,YAAY;QAC/B,SAAS,CAAC,IAAI,KAAK,aAAa;QAChC,SAAS,CAAC,IAAI,KAAK,QAAQ;QAC3B,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC;QACxC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa;YACb,YAAY;YACZ,aAAa;YACb,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,WAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa;YACb,YAAY;YACZ,aAAa;YACb,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IACD,IACE,4BAA4B,CAAC,WAAW,CAAC;QACzC,4BAA4B,CAAC,MAAM,CAAC,EACpC,CAAC;QACD,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW;YACX,aAAa;YACb,YAAY;YACZ,aAAa;YACb,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa;QACb,YAAY;QACZ,aAAa;QACb,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,6BAA6B,CACjD,KAAoC,EACpC,UAAoD,EAAE;IAEtD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,aAAa,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,gOAAgO,CAC/R,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW;YAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB;YAC1C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,aAAa,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,gBAAgB,MAAM,SAAS,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,CAAC,qBAAqB,2DAA2D,CAC5N,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,yCAAyC,CAC7D,aAAqB,EACrB,KAA+B,EAC/B,UAAoD,EAAE;IAEtD,OAAO,6BAA6B,CAClC,6BAA6B,CAAC,aAAa,EAAE,KAAK,CAAC,EACnD,OAAO,CACR,CAAC;AACJ,CAAC"}