@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.111

package/dist/SSMStateStore-sqZ3oDmn.mjs

@@ -0,0 +1,205 @@
+import { n as __require } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { C as decompressBody, b as compressBody, f as StateLocked, g as StateVersionConflict, l as DocumentStateStore, p as StateRejectedBySsm } from "./sniffer-CABMO-Bh.mjs";
+import { DeleteParameterCommand, GetParameterCommand, ParameterAlreadyExists, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+//#region src/deploy/SSMStateStore.ts
+/**
+* AWS SSM Parameter Store state store.
+*
+* - `/gkm/<workspace>/<stage>/state`: the state, a SecureString.
+* - `/gkm/<workspace>/<stage>/lock`: the lock, created only if absent.
+* - `/gkm/<workspace>/<stage>/state.v1`: the v1 state, kept on migration.
+*
+* SSM has no conditional put, so a write checks the parameter's version
+* before it puts, and checks the version the put returns after: a put that
+* did not land exactly one version above the one it was based on raced
+* another writer, and raises `StateVersionConflict` rather than reporting
+* success. Both writes stay in the parameter's history.
+*
+* Size: the state is written with the Intelligent-Tiering tier, so SSM picks
+* the advanced tier (8 KB) once a value passes the standard tier's 4 KB, and a
+* document over {@link SSM_COMPRESS_OVER} bytes is stored gzipped, as `gz:`
+* and base64. Both forms are read, so a document written before either is
+* read as it was. A deploy checks before it starts that the stage's document
+* leaves room under {@link SSM_MAX_BYTES} (`assertStateRoom`); a write SSM
+* refuses anyway raises `StateRejectedBySsm` rather than the SDK's error.
+*/
+/** The most an advanced-tier parameter holds — what the state must fit. */
+const SSM_MAX_BYTES = 8192;
+/**
+* `body` as the state parameter stores it: past the threshold, without its
+* indentation and compressed.
+*/
+function packSsmBody(body) {
+	if (Buffer.byteLength(body) <= 3072) return body;
+	let compact = body;
+	try {
+		compact = JSON.stringify(JSON.parse(body));
+	} catch {}
+	return compressBody(compact);
+}
+/** A refusal of the value itself — its size, past the tier's limit. */
+function refusedValue(error) {
+	return error?.name === "ValidationException";
+}
+var SSMStateStore = class SSMStateStore extends DocumentStateStore {
+	workspaceName;
+	client;
+	region;
+	constructor(workspaceName, client, region = "<region>") {
+		super();
+		this.workspaceName = workspaceName;
+		this.client = client;
+		this.region = region;
+	}
+	static create(options) {
+		const config = {
+			region: options.region,
+			endpoint: options.endpoint
+		};
+		if (options.profile) {
+			const { fromIni } = __require("@aws-sdk/credential-providers");
+			config.credentials = fromIni({ profile: options.profile });
+		} else if (options.credentials) config.credentials = options.credentials;
+		return new SSMStateStore(options.workspaceName, new SSMClient(config), options.region);
+	}
+	name(stage, leaf) {
+		return `/gkm/${this.workspaceName}/${stage}/${leaf}`;
+	}
+	location(stage) {
+		return `ssm:${this.name(stage, "state")}`;
+	}
+	async readRaw(stage) {
+		const parameter = await this.get(this.name(stage, "state"));
+		if (!parameter) return null;
+		return {
+			body: decompressBody(parameter.value),
+			version: String(parameter.version)
+		};
+	}
+	/** The stage's document as the next write would store it. */
+	async capacity(stage) {
+		const raw = await this.readRaw(stage);
+		if (!raw) return null;
+		return {
+			bytes: Buffer.byteLength(packSsmBody(raw.body)),
+			limit: SSM_MAX_BYTES,
+			location: this.location(stage),
+			region: this.region
+		};
+	}
+	async writeRaw(stage, document, expectedVersion) {
+		try {
+			return await this.put(stage, packSsmBody(document), expectedVersion);
+		} catch (error) {
+			if (!refusedValue(error)) throw error;
+			throw new StateRejectedBySsm(stage, Buffer.byteLength(packSsmBody(document)), this.location(stage), this.region, error);
+		}
+	}
+	/** The conditional put of `body`, stored as it is given. */
+	async put(stage, body, expectedVersion) {
+		const Name = this.name(stage, "state");
+		const Description = `GKM deployment state for ${this.workspaceName}/${stage}`;
+		if (expectedVersion === null) try {
+			const { Version } = await this.client.send(new PutParameterCommand({
+				Name,
+				Value: body,
+				Type: "SecureString",
+				Tier: "Intelligent-Tiering",
+				Description
+			}));
+			return String(Version);
+		} catch (error) {
+			if (error instanceof ParameterAlreadyExists) {
+				const current = await this.get(Name);
+				throw new StateVersionConflict(stage, null, current ? String(current.version) : null);
+			}
+			throw error;
+		}
+		const current = await this.get(Name);
+		const actual = current ? String(current.version) : null;
+		if (actual !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, actual);
+		const { Version } = await this.client.send(new PutParameterCommand({
+			Name,
+			Value: body,
+			Type: "SecureString",
+			Tier: "Intelligent-Tiering",
+			Overwrite: true,
+			Description
+		}));
+		if (Version !== Number(expectedVersion) + 1) throw new StateVersionConflict(stage, expectedVersion, String((Version ?? 1) - 1));
+		const landed = await this.get(Name);
+		if (landed && landed.version === Version && landed.value !== body) throw new StateVersionConflict(stage, expectedVersion, String(Version));
+		return String(Version);
+	}
+	async writeV1Backup(stage, body) {
+		try {
+			await this.client.send(new PutParameterCommand({
+				Name: this.name(stage, "state.v1"),
+				Value: packSsmBody(body),
+				Type: "SecureString",
+				Tier: "Intelligent-Tiering",
+				Description: `GKM v1 deployment state for ${this.workspaceName}/${stage}, kept on migration`
+			}));
+		} catch (error) {
+			if (!(error instanceof ParameterAlreadyExists)) throw error;
+		}
+	}
+	async createLock(stage, holder) {
+		const Name = this.name(stage, "lock");
+		try {
+			await this.client.send(new PutParameterCommand({
+				Name,
+				Value: JSON.stringify(holder),
+				Type: "String",
+				Description: `GKM deploy lock for ${this.workspaceName}/${stage}`
+			}));
+		} catch (error) {
+			if (error instanceof ParameterAlreadyExists) throw new StateLocked(stage, await this.readLock(stage), `ssm:${Name}`);
+			throw error;
+		}
+		const created = await this.get(Name);
+		const recorded = created ? parseHolder(created.value) : null;
+		if (created?.version !== 1 || recorded?.id !== holder.id) throw new StateLocked(stage, recorded, `ssm:${Name}`);
+	}
+	async readLock(stage) {
+		const parameter = await this.get(this.name(stage, "lock"));
+		return parameter ? parseHolder(parameter.value) : null;
+	}
+	async removeLock(stage, holder) {
+		if (holder) {
+			if ((await this.readLock(stage))?.id !== holder.id) return;
+		}
+		try {
+			await this.client.send(new DeleteParameterCommand({ Name: this.name(stage, "lock") }));
+		} catch (error) {
+			if (!(error instanceof ParameterNotFound)) throw error;
+		}
+	}
+	async get(Name) {
+		try {
+			const { Parameter } = await this.client.send(new GetParameterCommand({
+				Name,
+				WithDecryption: true
+			}));
+			if (Parameter?.Value === void 0) return null;
+			return {
+				value: Parameter.Value,
+				version: Parameter.Version ?? 1
+			};
+		} catch (error) {
+			if (error instanceof ParameterNotFound) return null;
+			throw error;
+		}
+	}
+};
+function parseHolder(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { SSMStateStore };
+
+//# sourceMappingURL=SSMStateStore-sqZ3oDmn.mjs.map

package/dist/SSMStateStore-sqZ3oDmn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SSMStateStore-sqZ3oDmn.mjs","names":[],"sources":["../src/deploy/SSMStateStore.ts"],"sourcesContent":["/**\n * AWS SSM Parameter Store state store.\n *\n * - `/gkm/<workspace>/<stage>/state`: the state, a SecureString.\n * - `/gkm/<workspace>/<stage>/lock`: the lock, created only if absent.\n * - `/gkm/<workspace>/<stage>/state.v1`: the v1 state, kept on migration.\n *\n * SSM has no conditional put, so a write checks the parameter's version\n * before it puts, and checks the version the put returns after: a put that\n * did not land exactly one version above the one it was based on raced\n * another writer, and raises `StateVersionConflict` rather than reporting\n * success. Both writes stay in the parameter's history.\n *\n * Size: the state is written with the Intelligent-Tiering tier, so SSM picks\n * the advanced tier (8 KB) once a value passes the standard tier's 4 KB, and a\n * document over {@link SSM_COMPRESS_OVER} bytes is stored gzipped, as `gz:`\n * and base64. Both forms are read, so a document written before either is\n * read as it was. A deploy checks before it starts that the stage's document\n * leaves room under {@link SSM_MAX_BYTES} (`assertStateRoom`); a write SSM\n * refuses anyway raises `StateRejectedBySsm` rather than the SDK's error.\n */\n\nimport {\n\tDeleteParameterCommand,\n\tGetParameterCommand,\n\tParameterAlreadyExists,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { AwsRegion } from './StateProvider';\nimport {\n\tcompressBody,\n\tDocumentStateStore,\n\tdecompressBody,\n\ttype LockHolder,\n\ttype RawState,\n\ttype StateCapacity,\n\tStateLocked,\n\tStateRejectedBySsm,\n\ttype StateVersion,\n\tStateVersionConflict,\n} from './StateStore';\n\n/** The most an advanced-tier parameter holds — what the state must fit. */\nexport const SSM_MAX_BYTES = 8192;\n/** A body past this is stored compressed: well under the standard 4 KB. */\nexport const SSM_COMPRESS_OVER = 3072;\n\n/**\n * `body` as the state parameter stores it: past the threshold, without its\n * indentation and compressed.\n */\nexport function packSsmBody(body: string): string {\n\tif (Buffer.byteLength(body) <= SSM_COMPRESS_OVER) return body;\n\tlet compact = body;\n\ttry {\n\t\tcompact = JSON.stringify(JSON.parse(body));\n\t} catch {\n\t\t// Not JSON: stored as it was given, compressed.\n\t}\n\treturn compressBody(compact);\n}\n\n/** A refusal of the value itself — its size, past the tier's limit. */\nfunction refusedValue(error: unknown): boolean {\n\treturn (error as { name?: string })?.name === 'ValidationException';\n}\n\nexport interface SSMStateStoreOptions {\n\tworkspaceName: string;\n\tregion?: AwsRegion;\n\t/** Uses the default credential chain when omitted. */\n\tprofile?: string;\n\tcredentials?: SSMClientConfig['credentials'];\n\t/** For the local AWS emulator. */\n\tendpoint?: string;\n}\n\nexport class SSMStateStore extends DocumentStateStore {\n\tconstructor(\n\t\treadonly workspaceName: string,\n\t\tprivate readonly client: SSMClient,\n\t\t/** For messages; the client's own region is used for every call. */\n\t\treadonly region = '<region>',\n\t) {\n\t\tsuper();\n\t}\n\n\tstatic create(options: SSMStateStoreOptions): SSMStateStore {\n\t\tconst config: SSMClientConfig = {\n\t\t\tregion: options.region,\n\t\t\tendpoint: options.endpoint,\n\t\t};\n\t\tif (options.profile) {\n\t\t\t// Required lazily: only a profile needs the credential providers.\n\t\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t\t} else if (options.credentials) {\n\t\t\tconfig.credentials = options.credentials;\n\t\t}\n\t\treturn new SSMStateStore(\n\t\t\toptions.workspaceName,\n\t\t\tnew SSMClient(config),\n\t\t\toptions.region,\n\t\t);\n\t}\n\n\tprivate name(stage: string, leaf: string): string {\n\t\treturn `/gkm/${this.workspaceName}/${stage}/${leaf}`;\n\t}\n\n\tprotected location(stage: string): string {\n\t\treturn `ssm:${this.name(stage, 'state')}`;\n\t}\n\n\tprotected async readRaw(stage: string): Promise<RawState | null> {\n\t\tconst parameter = await this.get(this.name(stage, 'state'));\n\t\tif (!parameter) return null;\n\t\treturn {\n\t\t\tbody: decompressBody(parameter.value),\n\t\t\tversion: String(parameter.version),\n\t\t};\n\t}\n\n\t/** The stage's document as the next write would store it. */\n\tasync capacity(stage: string): Promise<StateCapacity | null> {\n\t\tconst raw = await this.readRaw(stage);\n\t\tif (!raw) return null;\n\t\treturn {\n\t\t\tbytes: Buffer.byteLength(packSsmBody(raw.body)),\n\t\t\tlimit: SSM_MAX_BYTES,\n\t\t\tlocation: this.location(stage),\n\t\t\tregion: this.region,\n\t\t};\n\t}\n\n\tprotected async writeRaw(\n\t\tstage: string,\n\t\tdocument: string,\n\t\texpectedVersion: StateVersion | null,\n\t): Promise<StateVersion> {\n\t\ttry {\n\t\t\treturn await this.put(stage, packSsmBody(document), expectedVersion);\n\t\t} catch (error) {\n\t\t\tif (!refusedValue(error)) throw error;\n\t\t\tthrow new StateRejectedBySsm(\n\t\t\t\tstage,\n\t\t\t\tBuffer.byteLength(packSsmBody(document)),\n\t\t\t\tthis.location(stage),\n\t\t\t\tthis.region,\n\t\t\t\terror,\n\t\t\t);\n\t\t}\n\t}\n\n\t/** The conditional put of `body`, stored as it is given. */\n\tprivate async put(\n\t\tstage: string,\n\t\tbody: string,\n\t\texpectedVersion: StateVersion | null,\n\t): Promise<StateVersion> {\n\t\tconst Name = this.name(stage, 'state');\n\t\tconst Description = `GKM deployment state for ${this.workspaceName}/${stage}`;\n\n\t\tif (expectedVersion === null) {\n\t\t\ttry {\n\t\t\t\tconst { Version } = await this.client.send(\n\t\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\t\tName,\n\t\t\t\t\t\tValue: body,\n\t\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\t\tTier: 'Intelligent-Tiering',\n\t\t\t\t\t\tDescription,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn String(Version);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof ParameterAlreadyExists) {\n\t\t\t\t\tconst current = await this.get(Name);\n\t\t\t\t\tthrow new StateVersionConflict(\n\t\t\t\t\t\tstage,\n\t\t\t\t\t\tnull,\n\t\t\t\t\t\tcurrent ? String(current.version) : null,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\tconst current = await this.get(Name);\n\t\tconst actual = current ? String(current.version) : null;\n\t\tif (actual !== expectedVersion) {\n\t\t\tthrow new StateVersionConflict(stage, expectedVersion, actual);\n\t\t}\n\n\t\tconst { Version } = await this.client.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName,\n\t\t\t\tValue: body,\n\t\t\t\tType: 'SecureString',\n\t\t\t\tTier: 'Intelligent-Tiering',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription,\n\t\t\t}),\n\t\t);\n\t\tif (Version !== Number(expectedVersion) + 1) {\n\t\t\t// Another put landed between the check and this one. Ours is now\n\t\t\t// on top, but the caller that wrote the other believes its write\n\t\t\t// is current — its next write will conflict too, so neither is\n\t\t\t// lost silently.\n\t\t\tthrow new StateVersionConflict(\n\t\t\t\tstage,\n\t\t\t\texpectedVersion,\n\t\t\t\tString((Version ?? 1) - 1),\n\t\t\t);\n\t\t}\n\n\t\t// The version alone is not enough under an emulator, and need not be\n\t\t// on SSM either: two overwrites that raced can both be answered with\n\t\t// the same version, and both would report success. If the parameter is\n\t\t// still at the version this put returned, it has to hold this body —\n\t\t// otherwise the other put is the one that stuck.\n\t\tconst landed = await this.get(Name);\n\t\tif (landed && landed.version === Version && landed.value !== body) {\n\t\t\tthrow new StateVersionConflict(stage, expectedVersion, String(Version));\n\t\t}\n\t\treturn String(Version);\n\t}\n\n\tprotected async writeV1Backup(stage: string, body: string): Promise<void> {\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName: this.name(stage, 'state.v1'),\n\t\t\t\t\t// Kept as it was — the v1 state a person restores by hand —\n\t\t\t\t\t// unless it is too big to store that way.\n\t\t\t\t\tValue: packSsmBody(body),\n\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\tTier: 'Intelligent-Tiering',\n\t\t\t\t\tDescription: `GKM v1 deployment state for ${this.workspaceName}/${stage}, kept on migration`,\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\t// The first migration's backup is the one worth keeping.\n\t\t\tif (!(error instanceof ParameterAlreadyExists)) throw error;\n\t\t}\n\t}\n\n\tprotected async createLock(stage: string, holder: LockHolder): Promise<void> {\n\t\tconst Name = this.name(stage, 'lock');\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName,\n\t\t\t\t\tValue: JSON.stringify(holder),\n\t\t\t\t\t// A few hundred bytes: the standard tier, which costs nothing.\n\t\t\t\t\tType: 'String',\n\t\t\t\t\tDescription: `GKM deploy lock for ${this.workspaceName}/${stage}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterAlreadyExists) {\n\t\t\t\tthrow new StateLocked(stage, await this.readLock(stage), `ssm:${Name}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\t// A create-only put is atomic on SSM, so the lock is ours. Read it back\n\t\t// anyway: on a store where two racing creates can both succeed (the\n\t\t// local emulator does, a few times in a hundred) the later one has\n\t\t// overwritten the earlier — version 2, someone else's holder — and\n\t\t// taking the lock regardless would give the stage two deploys.\n\t\tconst created = await this.get(Name);\n\t\tconst recorded = created ? parseHolder(created.value) : null;\n\t\tif (created?.version !== 1 || recorded?.id !== holder.id) {\n\t\t\tthrow new StateLocked(stage, recorded, `ssm:${Name}`);\n\t\t}\n\t}\n\n\tprotected async readLock(stage: string): Promise<LockHolder | null> {\n\t\tconst parameter = await this.get(this.name(stage, 'lock'));\n\t\treturn parameter ? parseHolder(parameter.value) : null;\n\t}\n\n\tprotected async removeLock(\n\t\tstage: string,\n\t\tholder: LockHolder | null,\n\t): Promise<void> {\n\t\tif (holder) {\n\t\t\tconst current = await this.readLock(stage);\n\t\t\tif (current?.id !== holder.id) return;\n\t\t}\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew DeleteParameterCommand({ Name: this.name(stage, 'lock') }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ParameterNotFound)) throw error;\n\t\t}\n\t}\n\n\tprivate async get(\n\t\tName: string,\n\t): Promise<{ value: string; version: number } | null> {\n\t\ttry {\n\t\t\tconst { Parameter } = await this.client.send(\n\t\t\t\tnew GetParameterCommand({ Name, WithDecryption: true }),\n\t\t\t);\n\t\t\tif (Parameter?.Value === undefined) return null;\n\t\t\treturn { value: Parameter.Value, version: Parameter.Version ?? 1 };\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n\nfunction parseHolder(value: string): LockHolder | null {\n\ttry {\n\t\treturn JSON.parse(value) as LockHolder;\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAa,gBAAgB;;;;;AAQ7B,SAAgB,YAAY,MAAsB;CACjD,IAAI,OAAO,WAAW,IAAI,KAAA,MAAwB,OAAO;CACzD,IAAI,UAAU;CACd,IAAI;EACH,UAAU,KAAK,UAAU,KAAK,MAAM,IAAI,CAAC;CAC1C,QAAQ,CAER;CACA,OAAO,aAAa,OAAO;AAC5B;;AAGA,SAAS,aAAa,OAAyB;CAC9C,OAAQ,OAA6B,SAAS;AAC/C;AAYA,IAAa,gBAAb,MAAa,sBAAsB,mBAAmB;CAE3C;CACQ;CAER;CAJV,YACC,eACA,QAEA,SAAkB,YACjB;EACD,MAAM;EALG,KAAA,gBAAA;EACQ,KAAA,SAAA;EAER,KAAA,SAAA;CAGV;CAEA,OAAO,OAAO,SAA8C;EAC3D,MAAM,SAA0B;GAC/B,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB;EACA,IAAI,QAAQ,SAAS;GAEpB,MAAM,EAAE,YAAA,UAAoB,+BAA+B;GAC3D,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAC1D,OAAO,IAAI,QAAQ,aAClB,OAAO,cAAc,QAAQ;EAE9B,OAAO,IAAI,cACV,QAAQ,eACR,IAAI,UAAU,MAAM,GACpB,QAAQ,MACT;CACD;CAEA,KAAa,OAAe,MAAsB;EACjD,OAAO,QAAQ,KAAK,cAAc,GAAG,MAAM,GAAG;CAC/C;CAEA,SAAmB,OAAuB;EACzC,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO;CACvC;CAEA,MAAgB,QAAQ,OAAyC;EAChE,MAAM,YAAY,MAAM,KAAK,IAAI,KAAK,KAAK,OAAO,OAAO,CAAC;EAC1D,IAAI,CAAC,WAAW,OAAO;EACvB,OAAO;GACN,MAAM,eAAe,UAAU,KAAK;GACpC,SAAS,OAAO,UAAU,OAAO;EAClC;CACD;;CAGA,MAAM,SAAS,OAA8C;EAC5D,MAAM,MAAM,MAAM,KAAK,QAAQ,KAAK;EACpC,IAAI,CAAC,KAAK,OAAO;EACjB,OAAO;GACN,OAAO,OAAO,WAAW,YAAY,IAAI,IAAI,CAAC;GAC9C,OAAO;GACP,UAAU,KAAK,SAAS,KAAK;GAC7B,QAAQ,KAAK;EACd;CACD;CAEA,MAAgB,SACf,OACA,UACA,iBACwB;EACxB,IAAI;GACH,OAAO,MAAM,KAAK,IAAI,OAAO,YAAY,QAAQ,GAAG,eAAe;EACpE,SAAS,OAAO;GACf,IAAI,CAAC,aAAa,KAAK,GAAG,MAAM;GAChC,MAAM,IAAI,mBACT,OACA,OAAO,WAAW,YAAY,QAAQ,CAAC,GACvC,KAAK,SAAS,KAAK,GACnB,KAAK,QACL,KACD;EACD;CACD;;CAGA,MAAc,IACb,OACA,MACA,iBACwB;EACxB,MAAM,OAAO,KAAK,KAAK,OAAO,OAAO;EACrC,MAAM,cAAc,4BAA4B,KAAK,cAAc,GAAG;EAEtE,IAAI,oBAAoB,MACvB,IAAI;GACH,MAAM,EAAE,YAAY,MAAM,KAAK,OAAO,KACrC,IAAI,oBAAoB;IACvB;IACA,OAAO;IACP,MAAM;IACN,MAAM;IACN;GACD,CAAC,CACF;GACA,OAAO,OAAO,OAAO;EACtB,SAAS,OAAO;GACf,IAAI,iBAAiB,wBAAwB;IAC5C,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;IACnC,MAAM,IAAI,qBACT,OACA,MACA,UAAU,OAAO,QAAQ,OAAO,IAAI,IACrC;GACD;GACA,MAAM;EACP;EAGD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;EACnC,MAAM,SAAS,UAAU,OAAO,QAAQ,OAAO,IAAI;EACnD,IAAI,WAAW,iBACd,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,MAAM;EAG9D,MAAM,EAAE,YAAY,MAAM,KAAK,OAAO,KACrC,IAAI,oBAAoB;GACvB;GACA,OAAO;GACP,MAAM;GACN,MAAM;GACN,WAAW;GACX;EACD,CAAC,CACF;EACA,IAAI,YAAY,OAAO,eAAe,IAAI,GAKzC,MAAM,IAAI,qBACT,OACA,iBACA,QAAQ,WAAW,KAAK,CAAC,CAC1B;EAQD,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI;EAClC,IAAI,UAAU,OAAO,YAAY,WAAW,OAAO,UAAU,MAC5D,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,OAAO,OAAO,CAAC;EAEvE,OAAO,OAAO,OAAO;CACtB;CAEA,MAAgB,cAAc,OAAe,MAA6B;EACzE,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;IACvB,MAAM,KAAK,KAAK,OAAO,UAAU;IAGjC,OAAO,YAAY,IAAI;IACvB,MAAM;IACN,MAAM;IACN,aAAa,+BAA+B,KAAK,cAAc,GAAG,MAAM;GACzE,CAAC,CACF;EACD,SAAS,OAAO;GAEf,IAAI,EAAE,iBAAiB,yBAAyB,MAAM;EACvD;CACD;CAEA,MAAgB,WAAW,OAAe,QAAmC;EAC5E,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM;EACpC,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;IACvB;IACA,OAAO,KAAK,UAAU,MAAM;IAE5B,MAAM;IACN,aAAa,uBAAuB,KAAK,cAAc,GAAG;GAC3D,CAAC,CACF;EACD,SAAS,OAAO;GACf,IAAI,iBAAiB,wBACpB,MAAM,IAAI,YAAY,OAAO,MAAM,KAAK,SAAS,KAAK,GAAG,OAAO,MAAM;GAEvE,MAAM;EACP;EAOA,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;EACnC,MAAM,WAAW,UAAU,YAAY,QAAQ,KAAK,IAAI;EACxD,IAAI,SAAS,YAAY,KAAK,UAAU,OAAO,OAAO,IACrD,MAAM,IAAI,YAAY,OAAO,UAAU,OAAO,MAAM;CAEtD;CAEA,MAAgB,SAAS,OAA2C;EACnE,MAAM,YAAY,MAAM,KAAK,IAAI,KAAK,KAAK,OAAO,MAAM,CAAC;EACzD,OAAO,YAAY,YAAY,UAAU,KAAK,IAAI;CACnD;CAEA,MAAgB,WACf,OACA,QACgB;EAChB,IAAI,QAEC;QAAA,MADkB,KAAK,SAAS,KAAK,EAAA,EAC5B,OAAO,OAAO,IAAI;EAAA;EAEhC,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,uBAAuB,EAAE,MAAM,KAAK,KAAK,OAAO,MAAM,EAAE,CAAC,CAC9D;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,oBAAoB,MAAM;EAClD;CACD;CAEA,MAAc,IACb,MACqD;EACrD,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,KAAK,OAAO,KACvC,IAAI,oBAAoB;IAAE;IAAM,gBAAgB;GAAK,CAAC,CACvD;GACA,IAAI,WAAW,UAAU,KAAA,GAAW,OAAO;GAC3C,OAAO;IAAE,OAAO,UAAU;IAAO,SAAS,UAAU,WAAW;GAAE;EAClE,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;AACD;AAEA,SAAS,YAAY,OAAkC;CACtD,IAAI;EACH,OAAO,KAAK,MAAM,KAAK;CACxB,QAAQ;EACP,OAAO;CACR;AACD"}