@geekmidas/cli 10.0.0-alpha.1 → 10.0.0-alpha.100

package/dist/secretsManager-CQORubp9.mjs

@@ -0,0 +1,97 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { n as serializeWithin, r as withStageCredentials, t as awsClientConfig } from "./awsStore-Bx5nCFnS.mjs";
+import { CreateSecretCommand, GetSecretValueCommand, PutSecretValueCommand, ResourceNotFoundException, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+//#region src/secrets/secretsManager.ts
+/**
+* A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.
+*
+* One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's
+* parameter name without its leading `/` — holding the same JSON. It is
+* encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`
+* names another. Which account it is in is whichever credentials are active,
+* exactly as for the SSM store.
+*
+* Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's
+* own versioning, at a monthly price per secret.
+*/
+var secretsManager_exports = /* @__PURE__ */ __exportAll({
+	SECRETS_MANAGER_SECRET_LIMIT: () => SECRETS_MANAGER_SECRET_LIMIT,
+	SecretsManagerSecretsStore: () => SecretsManagerSecretsStore,
+	secretsManagerSecretName: () => secretsManagerSecretName
+});
+/** The most a Secrets Manager secret holds: 64 KB. */
+const SECRETS_MANAGER_SECRET_LIMIT = 65536;
+/** The secret a stage's secrets are kept in. */
+function secretsManagerSecretName(project, stage) {
+	return `gkm/${project}/${stage}/secrets`;
+}
+var SecretsManagerSecretsStore = class {
+	options;
+	name = "secrets-manager";
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async secretsManager() {
+		if (this.client) return this.client;
+		this.client = new SecretsManagerClient(await awsClientConfig(this.options));
+		return this.client;
+	}
+	secretName(stage) {
+		return secretsManagerSecretName(this.options.project, stage);
+	}
+	/** Where a call for `stage` is, for an error saying it has no credentials. */
+	context(stage, access) {
+		return {
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
+	async read(stage) {
+		const client = await this.secretsManager();
+		try {
+			const { SecretString } = await withStageCredentials(this.context(stage, "read"), () => client.send(new GetSecretValueCommand({ SecretId: this.secretName(stage) })));
+			return SecretString ? JSON.parse(SecretString) : null;
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException) return null;
+			throw error;
+		}
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
+	async write(stage, secrets) {
+		const value = serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
+		const client = await this.secretsManager();
+		const name = this.secretName(stage);
+		await withStageCredentials(this.context(stage, "write"), () => this.put(client, stage, name, value));
+	}
+	/** Put the secret, creating it on the stage's first write. */
+	async put(client, stage, name, value) {
+		try {
+			await client.send(new PutSecretValueCommand({
+				SecretId: name,
+				SecretString: value
+			}));
+		} catch (error) {
+			if (!(error instanceof ResourceNotFoundException)) throw error;
+			await client.send(new CreateSecretCommand({
+				Name: name,
+				SecretString: value,
+				Description: `gkm secrets for ${this.options.project}/${stage}`,
+				...this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}
+			}));
+		}
+	}
+};
+//#endregion
+export { secretsManager_exports as n, secretsManagerSecretName as t };
+
+//# sourceMappingURL=secretsManager-CQORubp9.mjs.map

package/dist/secretsManager-CQORubp9.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-CQORubp9.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAM,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}

package/dist/secretsManager-RAGcEDX1.cjs

@@ -0,0 +1,108 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_awsStore = require("./awsStore-u3ehhMoY.cjs");
+let _aws_sdk_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+//#region src/secrets/secretsManager.ts
+/**
+* A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.
+*
+* One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's
+* parameter name without its leading `/` — holding the same JSON. It is
+* encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`
+* names another. Which account it is in is whichever credentials are active,
+* exactly as for the SSM store.
+*
+* Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's
+* own versioning, at a monthly price per secret.
+*/
+var secretsManager_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	SECRETS_MANAGER_SECRET_LIMIT: () => SECRETS_MANAGER_SECRET_LIMIT,
+	SecretsManagerSecretsStore: () => SecretsManagerSecretsStore,
+	secretsManagerSecretName: () => secretsManagerSecretName
+});
+/** The most a Secrets Manager secret holds: 64 KB. */
+const SECRETS_MANAGER_SECRET_LIMIT = 65536;
+/** The secret a stage's secrets are kept in. */
+function secretsManagerSecretName(project, stage) {
+	return `gkm/${project}/${stage}/secrets`;
+}
+var SecretsManagerSecretsStore = class {
+	options;
+	name = "secrets-manager";
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async secretsManager() {
+		if (this.client) return this.client;
+		this.client = new _aws_sdk_client_secrets_manager.SecretsManagerClient(await require_awsStore.awsClientConfig(this.options));
+		return this.client;
+	}
+	secretName(stage) {
+		return secretsManagerSecretName(this.options.project, stage);
+	}
+	/** Where a call for `stage` is, for an error saying it has no credentials. */
+	context(stage, access) {
+		return {
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
+	async read(stage) {
+		const client = await this.secretsManager();
+		try {
+			const { SecretString } = await require_awsStore.withStageCredentials(this.context(stage, "read"), () => client.send(new _aws_sdk_client_secrets_manager.GetSecretValueCommand({ SecretId: this.secretName(stage) })));
+			return SecretString ? JSON.parse(SecretString) : null;
+		} catch (error) {
+			if (error instanceof _aws_sdk_client_secrets_manager.ResourceNotFoundException) return null;
+			throw error;
+		}
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
+	async write(stage, secrets) {
+		const value = require_awsStore.serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
+		const client = await this.secretsManager();
+		const name = this.secretName(stage);
+		await require_awsStore.withStageCredentials(this.context(stage, "write"), () => this.put(client, stage, name, value));
+	}
+	/** Put the secret, creating it on the stage's first write. */
+	async put(client, stage, name, value) {
+		try {
+			await client.send(new _aws_sdk_client_secrets_manager.PutSecretValueCommand({
+				SecretId: name,
+				SecretString: value
+			}));
+		} catch (error) {
+			if (!(error instanceof _aws_sdk_client_secrets_manager.ResourceNotFoundException)) throw error;
+			await client.send(new _aws_sdk_client_secrets_manager.CreateSecretCommand({
+				Name: name,
+				SecretString: value,
+				Description: `gkm secrets for ${this.options.project}/${stage}`,
+				...this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}
+			}));
+		}
+	}
+};
+//#endregion
+Object.defineProperty(exports, "secretsManagerSecretName", {
+	enumerable: true,
+	get: function() {
+		return secretsManagerSecretName;
+	}
+});
+Object.defineProperty(exports, "secretsManager_exports", {
+	enumerable: true,
+	get: function() {
+		return secretsManager_exports;
+	}
+});
+
+//# sourceMappingURL=secretsManager-RAGcEDX1.cjs.map

package/dist/secretsManager-RAGcEDX1.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-RAGcEDX1.cjs","names":["SecretsManagerClient","awsClientConfig","withStageCredentials","GetSecretValueCommand","ResourceNotFoundException","serializeWithin","PutSecretValueCommand","CreateSecretCommand"],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAIA,gCAAAA,qBAAqB,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAMC,iBAAAA,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAIC,gCAAAA,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiBC,gCAAAA,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQC,iBAAAA,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAMH,iBAAAA,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAII,gCAAAA,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBF,gCAAAA,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAIG,gCAAAA,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}