@geekmidas/cli 10.0.0-alpha.92 → 10.0.0-alpha.94

package/dist/providers-BFeP_mYw.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers-BFeP_mYw.cjs","names":["storedCredentials","provideKey","appEnvKeys","appKey","dependentsOf","resolveHost","isMainFrontendApp","NoDomainForStage","S3RegionRequired","appKey","bucketName","iamUserName","provideKey","BucketOwnedByAnotherProject","RecordedBucketUnreachable","suffixedBucketName","randomSuffix","BucketNameUnavailable","IamUserNotOwned","IAM_USER_PATH","IAM_POLICY_NAME","s3Url","BucketKeySetElsewhere","RotationInProgress","AccessKeyLimit","ProvisionedBucketUnreachable","checkS3Config","S3_PROVISIONING","PROVIDER_KINDS","stageProvider","GkmError","deployIdentity","deploysWithCompose","createComposeState","createEmptyState","initStageSecrets"],"sources":["../src/deploy/journal.ts","../src/providers/aws.ts","../src/providers/s3/origins.ts","../src/providers/s3/policy.ts","../src/providers/s3/index.ts","../src/providers/registry.ts","../src/providers/index.ts"],"sourcesContent":["/**\n * A deploy's record of what it is creating, written as it goes.\n *\n * Deploy used to write state once, after every app had deployed, so a run that\n * failed half way lost the ids of everything it had created and the next run\n * fell back to finding them by name — or made them again. The journal writes\n * through the stage's `StateStore` after every resource instead:\n *\n * 1. `pending`, before the call that creates it — \"this may now exist\";\n * 2. `ready` with the target's id, once the call has returned.\n *\n * A run that meets a `pending` record looks the resource up before it creates\n * anything, so a run killed between the create and the record adopts what the\n * dead run made instead of making a second one. Every write is conditional on\n * the version the journal last wrote, so a writer that skipped the stage's\n * lock raises `StateVersionConflict` here rather than being overwritten.\n */\n\nimport type { ResourceRecord, StateStore, StateVersion } from './StateStore';\nimport type { StageState } from './state';\n\n/** One resource, as the journal keys and describes it. */\nexport interface JournalEntry {\n\t/** `<type>:<name>`, unique within the stage — `application:api`. */\n\tkey: string;\n\ttype: string;\n\t/** What a later run needs to find it again — its name, usually. */\n\tdata?: Record<string, unknown>;\n}\n\n/** How to get at one kind of resource on the target. */\nexport interface ResourceSteps<T> {\n\t/** By the id a `ready` record holds; `null` when the target lost it. */\n\tget?: (id: string) => Promise<T | null | undefined>;\n\t/** By what identifies it otherwise — its name, in its environment. */\n\tfind: () => Promise<T | null | undefined>;\n\tcreate: () => Promise<T>;\n\tid: (resource: T) => string;\n}\n\nexport interface Ensured<T> {\n\tresource: T;\n\t/**\n\t * - `recorded`: the id in a `ready` record still resolves\n\t * - `resumed`: a `pending` record's resource was found — a run died\n\t *   between creating it and recording it\n\t * - `found`: it existed, unrecorded\n\t * - `created`: it did not exist\n\t */\n\tvia: 'recorded' | 'resumed' | 'found' | 'created';\n\t/** The recorded id that no longer resolved, if there was one. */\n\tstaleId?: string;\n}\n\nexport class DeployJournal<S extends StageState = StageState> {\n\tprivate constructor(\n\t\tprivate readonly store: StateStore,\n\t\treadonly stage: string,\n\t\t/** The stage's state, mutated by the deploy and written by `save`. */\n\t\treadonly state: S,\n\t\tprivate resources: Record<string, ResourceRecord>,\n\t\tprivate version: StateVersion,\n\t\t/** Whether the stage had state before this run. */\n\t\treadonly existed: boolean,\n\t) {}\n\n\t/**\n\t * The stage's journal — its stored state, or `initial` written as the\n\t * stage's first state, so there is somewhere to record the very first\n\t * resource before it is created.\n\t *\n\t * `adopt` turns a stored state into the shape the caller works on — a\n\t * Dokploy deploy of a stage compose deployed keeps its releases and starts\n\t * its Dokploy ids afresh. Without it, the stored state is used as it is.\n\t */\n\tstatic async open(\n\t\tstore: StateStore,\n\t\tstage: string,\n\t\tinitial: () => StageState,\n\t): Promise<DeployJournal<StageState>>;\n\tstatic async open<S extends StageState>(\n\t\tstore: StateStore,\n\t\tstage: string,\n\t\tinitial: () => S,\n\t\tadopt: (stored: StageState) => S,\n\t): Promise<DeployJournal<S>>;\n\tstatic async open(\n\t\tstore: StateStore,\n\t\tstage: string,\n\t\tinitial: () => StageState,\n\t\tadopt: (stored: StageState) => StageState = (stored) => stored,\n\t): Promise<DeployJournal<StageState>> {\n\t\tconst stored = await store.read(stage);\n\t\tif (stored) {\n\t\t\treturn new DeployJournal(\n\t\t\t\tstore,\n\t\t\t\tstage,\n\t\t\t\tadopt(stored.state),\n\t\t\t\tstored.resources,\n\t\t\t\tstored.version,\n\t\t\t\ttrue,\n\t\t\t);\n\t\t}\n\n\t\tconst state = initial();\n\t\tconst version = await store.write(stage, state, { expectedVersion: null });\n\t\treturn new DeployJournal(store, stage, state, {}, version, false);\n\t}\n\n\trecord(key: string): ResourceRecord | undefined {\n\t\treturn this.resources[key];\n\t}\n\n\t/** The keys a previous run marked `pending` and never saw created. */\n\tunfinished(): string[] {\n\t\treturn Object.values(this.resources)\n\t\t\t.filter((record) => record.status === 'pending')\n\t\t\t.map((record) => record.key);\n\t}\n\n\t/** Records that `entry` is about to be created. */\n\tasync pending(entry: JournalEntry): Promise<void> {\n\t\tawait this.put({ ...entry, status: 'pending' });\n\t}\n\n\t/**\n\t * Records `entry` as existing with `id`; a no-op if it already is, with\n\t * the same data.\n\t */\n\tasync ready(entry: JournalEntry, id: string): Promise<void> {\n\t\tconst current = this.resources[entry.key];\n\t\tif (\n\t\t\tcurrent?.status === 'ready' &&\n\t\t\tcurrent.id === id &&\n\t\t\tJSON.stringify(current.data) === JSON.stringify(entry.data)\n\t\t) {\n\t\t\treturn;\n\t\t}\n\t\tawait this.put({ ...entry, status: 'ready', id });\n\t}\n\n\t/**\n\t * The resource `entry` names: by its recorded id, else by looking it up,\n\t * else created — with `pending` written before the create and `ready`\n\t * after, so a run that dies in between leaves a record the next run\n\t * resolves by looking the resource up rather than creating another.\n\t */\n\tasync ensure<T>(\n\t\tentry: JournalEntry,\n\t\tsteps: ResourceSteps<T>,\n\t): Promise<Ensured<T>> {\n\t\tconst record = this.resources[entry.key];\n\t\tlet staleId: string | undefined;\n\n\t\tif (record?.status === 'ready' && record.id && steps.get) {\n\t\t\tconst known = await steps.get(record.id);\n\t\t\tif (known) {\n\t\t\t\tawait this.ready(entry, steps.id(known));\n\t\t\t\treturn { resource: known, via: 'recorded' };\n\t\t\t}\n\t\t\tstaleId = record.id;\n\t\t}\n\n\t\tconst existing = await steps.find();\n\t\tif (existing) {\n\t\t\tawait this.ready(entry, steps.id(existing));\n\t\t\treturn {\n\t\t\t\tresource: existing,\n\t\t\t\tvia: record?.status === 'pending' ? 'resumed' : 'found',\n\t\t\t\t...(staleId ? { staleId } : {}),\n\t\t\t};\n\t\t}\n\n\t\tawait this.pending(entry);\n\t\tconst created = await steps.create();\n\t\tawait this.ready(entry, steps.id(created));\n\t\treturn {\n\t\t\tresource: created,\n\t\t\tvia: 'created',\n\t\t\t...(staleId ? { staleId } : {}),\n\t\t};\n\t}\n\n\t/** Removes `key`'s record — a resource that no longer exists. */\n\tasync forget(key: string): Promise<void> {\n\t\tif (!(key in this.resources)) return;\n\t\tthis.version = await this.store.deleteResource(this.stage, key, {\n\t\t\texpectedVersion: this.version,\n\t\t});\n\t\tconst { [key]: _removed, ...resources } = this.resources;\n\t\tthis.resources = resources;\n\t}\n\n\t/** Every record, as the journal last wrote or read it. */\n\trecords(): Record<string, ResourceRecord> {\n\t\treturn this.resources;\n\t}\n\n\t/** Writes the stage's state, keeping its resource records. */\n\tasync save(): Promise<void> {\n\t\tthis.state.lastDeployedAt = new Date().toISOString();\n\t\tthis.version = await this.store.write(this.stage, this.state, {\n\t\t\texpectedVersion: this.version,\n\t\t});\n\t}\n\n\tprivate async put(record: Omit<ResourceRecord, 'updatedAt'>): Promise<void> {\n\t\tthis.version = await this.store.putResource(this.stage, record, {\n\t\t\texpectedVersion: this.version,\n\t\t});\n\t\tthis.resources = {\n\t\t\t...this.resources,\n\t\t\t[record.key]: { ...record, updatedAt: new Date().toISOString() },\n\t\t};\n\t}\n}\n","/**\n * The AWS account a provider provisions in — the stage's, found the way the\n * SSM and Secrets Manager stores find it.\n *\n * 1. `--profile`, resolved on its own: exported keys left over from another\n *    account never win over a profile someone named.\n * 2. `AWS_PROFILE`, else `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` — the\n *    deploy's own `aws` credential kind (`storedCredentials`).\n * 3. The SDK's default chain: `~/.aws` default profile, SSO, a role. In CI,\n *    whatever `aws-actions/configure-aws-credentials` exported.\n *\n * None of them: the provider has no provisioning credentials, and the stage\n * is treated as `external`.\n */\n\nimport {\n\ttype AwsCredential,\n\tstoredCredentials,\n} from '../deploy/credentials.js';\nimport type { CredentialLookup } from './types.js';\n\n/** An AWS credential, or the default chain the SDK resolves itself. */\nexport type AwsProvisioning =\n\t| AwsCredential\n\t| {\n\t\t\tchain: true;\n\t\t\tregion?: string;\n\t  };\n\nexport async function awsProvisioningCredentials(\n\tlookup: CredentialLookup,\n): Promise<AwsProvisioning | undefined> {\n\tconst region = lookup.env.AWS_REGION ?? lookup.env.AWS_DEFAULT_REGION;\n\tconst where = region ? { region } : {};\n\tif (lookup.profile) return { profile: lookup.profile, ...where };\n\n\tconst stored = await storedCredentials({\n\t\tenv: lookup.env,\n\t\t...(lookup.home ? { home: lookup.home } : {}),\n\t}).get({ kind: 'aws', stage: lookup.stage });\n\tif (stored) return stored;\n\n\ttry {\n\t\tconst { fromNodeProviderChain } = await import(\n\t\t\t'@aws-sdk/credential-providers'\n\t\t);\n\t\tawait fromNodeProviderChain({ timeout: 1000, maxRetries: 0 })();\n\t\treturn { chain: true, ...where };\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\n/**\n * An S3-compatible endpoint the environment points the SDK at — the AWS\n * emulator in tests. The SDK reads it itself; it is read here too, because\n * an emulator takes path-style requests, and a key written for one has to\n * say where it is.\n */\nexport function awsEndpoint(\n\tenv: NodeJS.ProcessEnv,\n\tservice: 'S3' | 'IAM',\n): string | undefined {\n\treturn env[`AWS_ENDPOINT_URL_${service}`] ?? env.AWS_ENDPOINT_URL;\n}\n\n/** An SDK client's config for a provisioning credential. */\nexport async function awsClientConfig(\n\tcredential: AwsProvisioning,\n\tregion: string,\n): Promise<{\n\tregion: string;\n\tcredentials?:\n\t\t| ReturnType<typeof import('@aws-sdk/credential-providers').fromIni>\n\t\t| { accessKeyId: string; secretAccessKey: string; sessionToken?: string };\n}> {\n\tif ('profile' in credential) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\treturn { region, credentials: fromIni({ profile: credential.profile }) };\n\t}\n\tif ('accessKeyId' in credential) {\n\t\treturn {\n\t\t\tregion,\n\t\t\tcredentials: {\n\t\t\t\taccessKeyId: credential.accessKeyId,\n\t\t\t\tsecretAccessKey: credential.secretAccessKey,\n\t\t\t\t...(credential.sessionToken\n\t\t\t\t\t? { sessionToken: credential.sessionToken }\n\t\t\t\t\t: {}),\n\t\t\t},\n\t\t};\n\t}\n\treturn { region };\n}\n","/**\n * Which browser origins may call a bucket: the stage's sites that depend on\n * an API using it.\n *\n * The same reading of the graph an API's own CORS origins are — its callers —\n * taken one step further: a site that calls an API which hands it a presigned\n * upload URL is a site whose browser PUTs to the bucket. A site that reads the\n * bucket (or a file server over it) itself is one too. Nothing is written\n * down: add a site that calls the API and the next provision run allows it.\n */\n\nimport {\n\ttype ConstructManifest,\n\tdependentsOf,\n\tprovideKey,\n} from '@geekmidas/manifest';\nimport { appEnvKeys } from '../../reconcile/apps.js';\nimport {\n\tisMainFrontendApp,\n\tNoDomainForStage,\n\tresolveHost,\n} from '../../target/dokploy/domain.js';\nimport { appKey } from '../../workspace/derive.js';\nimport type { NormalizedWorkspace } from '../../workspace/types.js';\n\nexport interface BucketOriginsInput {\n\tworkspace: Pick<NormalizedWorkspace, 'apps' | 'deploy' | 'domains'>;\n\tmanifest: ConstructManifest;\n\t/** Each owner's runnables' edges, from discovery. */\n\trunnables?: Readonly<Record<string, readonly string[]>>;\n\tstage: string;\n\t/** The `objects` construct's id. */\n\tbucket: string;\n}\n\nexport interface BucketOrigins {\n\t/** `https://<host>` for each site, sorted. */\n\torigins: string[];\n\t/** Sites with no address on the stage — no domain for it. */\n\tunresolved: string[];\n}\n\n/** The keys a reader of this bucket holds: its URL, and each server's over it. */\nexport function bucketKeys(manifest: ConstructManifest, bucket: string) {\n\treturn [\n\t\tprovideKey(bucket, 'url'),\n\t\t...Object.entries(manifest)\n\t\t\t.filter(([, d]) => d.kind === 'file-server' && d.of === bucket)\n\t\t\t.map(([id]) => provideKey(id, 'url')),\n\t];\n}\n\nexport function bucketOrigins(input: BucketOriginsInput): BucketOrigins {\n\tconst { manifest, workspace, stage } = input;\n\tconst keys = bucketKeys(manifest, input.bucket);\n\n\tconst readers = Object.entries(manifest)\n\t\t.filter(([, d]) => d.kind === 'rest-api' || d.kind === 'site')\n\t\t.filter(([id]) => {\n\t\t\tconst env = appEnvKeys(manifest, appKey(id), input.runnables);\n\t\t\treturn env !== undefined && keys.some((key) => env.has(key));\n\t\t});\n\n\tconst sites = new Set<string>();\n\tfor (const [id, declaration] of readers) {\n\t\tif (declaration.kind === 'site') {\n\t\t\tsites.add(id);\n\t\t\tcontinue;\n\t\t}\n\t\tfor (const caller of dependentsOf(manifest, id)) {\n\t\t\tif (manifest[caller]?.kind === 'site') sites.add(caller);\n\t\t}\n\t}\n\n\tconst origins = new Set<string>();\n\tconst unresolved: string[] = [];\n\tfor (const id of [...sites].sort()) {\n\t\tconst name = appKey(id);\n\t\tconst app = workspace.apps[name];\n\t\tif (!app) {\n\t\t\tunresolved.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\ttry {\n\t\t\tconst host = resolveHost(\n\t\t\t\tname,\n\t\t\t\tapp,\n\t\t\t\tstage,\n\t\t\t\tworkspace.domains,\n\t\t\t\tisMainFrontendApp(name, app, workspace.apps),\n\t\t\t);\n\t\t\torigins.add(`https://${host}`);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof NoDomainForStage)) throw error;\n\t\t\tunresolved.push(name);\n\t\t}\n\t}\n\n\treturn { origins: [...origins].sort(), unresolved };\n}\n","/**\n * The documents the `s3` provider writes: the user's inline policy, the\n * bucket's policy, its CORS rule and its public access block.\n *\n * Pure, so each is tested as JSON and compared with what AWS holds on every\n * run — a document that differs is drift, and is put back.\n */\n\n/** One IAM or bucket policy statement. */\nexport interface PolicyStatement {\n\tSid: string;\n\tEffect: 'Allow' | 'Deny';\n\tPrincipal?: '*' | { AWS: string | string[] };\n\tAction: string | string[];\n\tResource: string | string[];\n\tCondition?: Record<string, Record<string, string>>;\n}\n\nexport interface PolicyDocument {\n\tVersion: '2012-10-17';\n\tStatement: PolicyStatement[];\n}\n\nconst bucketArn = (bucket: string) => `arn:aws:s3:::${bucket}`;\n\n/**\n * What the app's key may do: objects in this bucket, and listing it — and\n * nothing else in the account.\n *\n * Multipart uploads are in it because a presigned upload of a large file is\n * one, and an abandoned one is cleaned up by the app. Reading old versions is\n * added only when the bucket keeps them.\n */\nexport function userPolicy(\n\tbucket: string,\n\toptions: { versioning?: boolean } = {},\n): PolicyDocument {\n\treturn {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tSid: 'GkmObjects',\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:AbortMultipartUpload',\n\t\t\t\t\t's3:ListMultipartUploadParts',\n\t\t\t\t\t...(options.versioning ? ['s3:GetObjectVersion'] : []),\n\t\t\t\t],\n\t\t\t\tResource: `${bucketArn(bucket)}/*`,\n\t\t\t},\n\t\t\t{\n\t\t\t\tSid: 'GkmBucket',\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t\t's3:ListBucketMultipartUploads',\n\t\t\t\t],\n\t\t\t\tResource: bucketArn(bucket),\n\t\t\t},\n\t\t],\n\t};\n}\n\n/**\n * One open pattern as the resource it is public on. A `**` is S3's `*`; a\n * single `*` is too, which crosses `/` where the construct's own check does\n * not — the construct is the stricter of the two (see `bucketPolicy` in\n * reconcile, which the local MinIO is given the same way).\n */\nexport function openResource(bucket: string, pattern: string): string {\n\tconst path = pattern.replace(/^\\/+/, '').replace(/\\*\\*/g, '*');\n\treturn `${bucketArn(bucket)}/${path}`;\n}\n\n/**\n * The bucket's own policy: every request refused unless it came over TLS,\n * and — only when a file server opens paths on it — anonymous `s3:GetObject`\n * on exactly those prefixes.\n */\nexport function bucketPolicy(\n\tbucket: string,\n\topen: readonly string[] = [],\n): PolicyDocument {\n\tconst statements: PolicyStatement[] = [\n\t\t{\n\t\t\tSid: 'GkmDenyInsecureTransport',\n\t\t\tEffect: 'Deny',\n\t\t\tPrincipal: '*',\n\t\t\tAction: 's3:*',\n\t\t\tResource: [bucketArn(bucket), `${bucketArn(bucket)}/*`],\n\t\t\tCondition: { Bool: { 'aws:SecureTransport': 'false' } },\n\t\t},\n\t];\n\tif (open.length > 0) {\n\t\tstatements.push({\n\t\t\tSid: 'GkmOpenPaths',\n\t\t\tEffect: 'Allow',\n\t\t\tPrincipal: '*',\n\t\t\tAction: 's3:GetObject',\n\t\t\tResource: [...new Set(open.map((p) => openResource(bucket, p)))].sort(),\n\t\t});\n\t}\n\treturn { Version: '2012-10-17', Statement: statements };\n}\n\n/**\n * Block Public Access. All four flags on, unless the bucket has open paths:\n * then a *policy* may make it public (`BlockPublicPolicy`,\n * `RestrictPublicBuckets` off), and ACLs still may not.\n */\nexport function publicAccessBlock(open: boolean): {\n\tBlockPublicAcls: boolean;\n\tIgnorePublicAcls: boolean;\n\tBlockPublicPolicy: boolean;\n\tRestrictPublicBuckets: boolean;\n} {\n\treturn {\n\t\tBlockPublicAcls: true,\n\t\tIgnorePublicAcls: true,\n\t\tBlockPublicPolicy: !open,\n\t\tRestrictPublicBuckets: !open,\n\t};\n}\n\n/** The one CORS rule: browsers on the stage's sites upload and read. */\nexport interface CorsRule {\n\tAllowedMethods: string[];\n\tAllowedOrigins: string[];\n\tAllowedHeaders: string[];\n\tExposeHeaders: string[];\n\tMaxAgeSeconds: number;\n}\n\nexport function corsRule(origins: readonly string[]): CorsRule {\n\treturn {\n\t\tAllowedMethods: ['GET', 'HEAD', 'POST', 'PUT'],\n\t\tAllowedOrigins: [...new Set(origins)].sort(),\n\t\tAllowedHeaders: ['*'],\n\t\tExposeHeaders: ['ETag'],\n\t\tMaxAgeSeconds: 3000,\n\t};\n}\n\n/**\n * A policy document in one canonical form — keys sorted, a lone string a\n * one-element list, lists sorted — so one AWS reformatted reads as the same\n * document rather than as drift.\n */\nexport function canonicalPolicy(value: unknown): string {\n\treturn JSON.stringify(canonical(value));\n}\n\nfunction canonical(value: unknown, key?: string): unknown {\n\tif (Array.isArray(value)) {\n\t\tconst items = value.map((v) => canonical(v));\n\t\treturn key === 'Statement'\n\t\t\t? items\n\t\t\t: items.map((v) => JSON.stringify(v)).sort();\n\t}\n\tif (value && typeof value === 'object') {\n\t\treturn Object.fromEntries(\n\t\t\tObject.keys(value)\n\t\t\t\t.sort()\n\t\t\t\t.map((k) => {\n\t\t\t\t\tconst v = (value as Record<string, unknown>)[k];\n\t\t\t\t\tconst listy =\n\t\t\t\t\t\tk === 'Action' || k === 'Resource' || k === 'AWS'\n\t\t\t\t\t\t\t? Array.isArray(v)\n\t\t\t\t\t\t\t\t? v\n\t\t\t\t\t\t\t\t: [v]\n\t\t\t\t\t\t\t: v;\n\t\t\t\t\treturn [k, canonical(listy, k)];\n\t\t\t\t}),\n\t\t);\n\t}\n\treturn value;\n}\n","/**\n * `objects: { provider: 's3' }` — each bucket construct, created in the\n * stage's AWS account with a user and key of its own.\n *\n * Per `ObjectStorage` (and each `FileServer` over it), on the stage:\n *\n * - **the bucket**, named `<namespace>-<project>-<stage>-<id>` — or with a\n *   random suffix when another account holds that name — recorded in the\n *   stage's state and reused forever; Block Public Access, SSE-S3, a policy\n *   refusing anything but TLS, versioning when asked, and CORS for the\n *   stage's sites that call an API using it;\n * - **an IAM user**, `gkm-<project>-<stage>-<id>` under `/gkm/`, tagged with\n *   the deploy identity, with an inline policy for that bucket only;\n * - **its access key**, written into the stage's secrets as the bucket's URL\n *   (`s3://KEY:SECRET@bucket?region=…`) — the secret is never printed;\n * - **a file server's** open paths public on exactly those prefixes, and its\n *   URL the bucket's regional endpoint.\n *\n * Every run reads what is there and puts back what drifted. Nothing is ever\n * deleted, with one exception asked for by name: the old key a\n * `--rotate-keys` replaced, once the stage has deployed with the new one.\n */\n\nimport type {\n\tConstructManifest,\n\tFileServerDeclaration,\n\tObjectsDeclaration,\n} from '@geekmidas/manifest';\nimport { provideKey } from '@geekmidas/manifest';\nimport * as s3Url from '@geekmidas/storage/s3-url';\nimport { appKey } from '../../workspace/derive.js';\nimport type { S3ObjectsConfig } from '../../workspace/types.js';\nimport {\n\ttype AwsProvisioning,\n\tawsClientConfig,\n\tawsEndpoint,\n\tawsProvisioningCredentials,\n} from '../aws.js';\nimport type {\n\tEnsureContext,\n\tResourceProvider,\n\tStateEntry,\n\tVerifyContext,\n} from '../types.js';\nimport { checkS3Config, S3_PROVISIONING } from './config.js';\nimport {\n\tAccessKeyLimit,\n\tBucketKeySetElsewhere,\n\tBucketNameUnavailable,\n\tBucketOwnedByAnotherProject,\n\tIamUserNotOwned,\n\tProvisionedBucketUnreachable,\n\tRecordedBucketUnreachable,\n\tRotationInProgress,\n\tS3RegionRequired,\n} from './errors.js';\nimport {\n\tbucketName,\n\tIAM_POLICY_NAME,\n\tIAM_USER_PATH,\n\tiamUserName,\n\trandomSuffix,\n\tSUFFIX_ATTEMPTS,\n\tsuffixedBucketName,\n} from './naming.js';\nimport { bucketOrigins } from './origins.js';\nimport {\n\tbucketPolicy,\n\ttype CorsRule,\n\tcanonicalPolicy,\n\tcorsRule,\n\tpublicAccessBlock,\n\tuserPolicy,\n} from './policy.js';\n\ntype S3Module = typeof import('@aws-sdk/client-s3');\ntype IamModule = typeof import('@aws-sdk/client-iam');\n\ntype Ctx = EnsureContext<S3ObjectsConfig, AwsProvisioning>;\n\n/** The tags gkm finds its own buckets and users by. */\nexport const TAG_PROJECT = 'gkm:project';\nexport const TAG_STAGE = 'gkm:stage';\nexport const TAG_CONSTRUCT = 'gkm:construct';\n\n/** Each bucket construct, with the file servers over it. */\nexport interface BucketConstruct {\n\tid: string;\n\tversioned: boolean;\n\tservers: { id: string; open: readonly string[] }[];\n}\n\nexport function bucketConstructs(\n\tmanifest: ConstructManifest,\n): BucketConstruct[] {\n\treturn Object.entries(manifest)\n\t\t.filter(([, d]) => d.kind === 'objects')\n\t\t.map(([id, d]) => ({\n\t\t\tid,\n\t\t\tversioned: (d as ObjectsDeclaration).versioned === true,\n\t\t\tservers: Object.entries(manifest)\n\t\t\t\t.filter(\n\t\t\t\t\t([, s]) =>\n\t\t\t\t\t\ts.kind === 'file-server' && (s as FileServerDeclaration).of === id,\n\t\t\t\t)\n\t\t\t\t.map(([sid, s]) => ({\n\t\t\t\t\tid: sid,\n\t\t\t\t\topen: (s as FileServerDeclaration).open ?? [],\n\t\t\t\t}))\n\t\t\t\t.sort((a, b) => a.id.localeCompare(b.id)),\n\t\t}))\n\t\t.sort((a, b) => a.id.localeCompare(b.id));\n}\n\n/**\n * The region the stage's buckets are created in: the entry's, the secrets\n * store's when it is in AWS, the credential's, `AWS_REGION`.\n */\nexport function s3Region(\n\tctx: Pick<Ctx, 'config' | 'workspace' | 'stage'> & {\n\t\tcredential?: AwsProvisioning;\n\t},\n\tenv: NodeJS.ProcessEnv = process.env,\n): string {\n\tconst store = ctx.workspace.secrets?.store;\n\tconst storeRegion =\n\t\tstore && typeof store === 'object' && 'region' in store\n\t\t\t? (store as { region?: string }).region\n\t\t\t: undefined;\n\tconst region =\n\t\tctx.config.region ??\n\t\tstoreRegion ??\n\t\tctx.credential?.region ??\n\t\tenv.AWS_REGION ??\n\t\tenv.AWS_DEFAULT_REGION;\n\tif (!region) throw new S3RegionRequired(ctx.stage);\n\treturn region;\n}\n\n/**\n * The address a file server over `bucket` serves on: the bucket's regional\n * virtual-host endpoint, which is what `FileServer.url(key)` appends a key to\n * — `https://<bucket>.s3.<region>.amazonaws.com/<key>`. Against an emulator,\n * its path-style address.\n */\nexport function bucketPublicUrl(\n\tbucket: string,\n\tregion: string,\n\tendpoint?: string,\n): string {\n\tif (endpoint) return `${endpoint.replace(/\\/+$/, '')}/${bucket}`;\n\treturn `https://${bucket}.s3.${region}.amazonaws.com`;\n}\n\n/** What an AWS SDK error is called, whichever field carries it. */\nfunction errorName(error: unknown): string {\n\tconst e = error as { name?: string; Code?: string };\n\treturn e?.Code ?? e?.name ?? '';\n}\n\n/** A read whose \"there is none\" answer is one of `missing`. */\nasync function readOr<T>(\n\tread: () => Promise<T>,\n\tmissing: readonly string[],\n): Promise<T | undefined> {\n\ttry {\n\t\treturn await read();\n\t} catch (error) {\n\t\tif (missing.includes(errorName(error))) return undefined;\n\t\tthrow error;\n\t}\n}\n\ninterface Clients {\n\tS3: S3Module;\n\tIAM: IamModule;\n\ts3: InstanceType<S3Module['S3Client']>;\n\tiam: InstanceType<IamModule['IAMClient']>;\n\tregion: string;\n\t/** An emulator's endpoint, when the environment names one. */\n\tendpoint?: string;\n}\n\n/** Clients for a provisioning run, for tests to replace. */\nexport type S3ClientFactory = (\n\tcredential: AwsProvisioning,\n\tregion: string,\n) => Promise<Clients>;\n\nexport const defaultClients: S3ClientFactory = async (credential, region) => {\n\tconst S3 = await import('@aws-sdk/client-s3');\n\tconst IAM = await import('@aws-sdk/client-iam');\n\tconst config = await awsClientConfig(credential, region);\n\tconst endpoint = awsEndpoint(process.env, 'S3');\n\treturn {\n\t\tS3,\n\t\tIAM,\n\t\ts3: new S3.S3Client({\n\t\t\t...config,\n\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t}),\n\t\tiam: new IAM.IAMClient(config),\n\t\tregion,\n\t\t...(endpoint ? { endpoint } : {}),\n\t};\n};\n\n/** For tests: what makes the clients. */\nlet makeClients: S3ClientFactory = defaultClients;\n\n/** Replace the client factory — a test intercepting a call. Returns the old one. */\nexport function useS3Clients(factory: S3ClientFactory): S3ClientFactory {\n\tconst previous = makeClients;\n\tmakeClients = factory;\n\treturn previous;\n}\n\nasync function ensureS3(ctx: Ctx): Promise<void> {\n\tconst region = s3Region(ctx);\n\tconst clients = await makeClients(ctx.credential, region);\n\tfor (const construct of bucketConstructs(ctx.manifest)) {\n\t\tawait ensureBucket(ctx, clients, construct);\n\t}\n}\n\n/** The keys gkm tags a bucket and a user with. */\nfunction identityTags(ctx: Ctx, id: string) {\n\treturn [\n\t\t{ Key: TAG_PROJECT, Value: ctx.identity.key },\n\t\t{ Key: TAG_STAGE, Value: ctx.stage },\n\t\t{ Key: TAG_CONSTRUCT, Value: id },\n\t];\n}\n\nasync function ensureBucket(\n\tctx: Ctx,\n\tclients: Clients,\n\tconstruct: BucketConstruct,\n): Promise<void> {\n\tconst { id } = construct;\n\tconst nameInput = {\n\t\tscope: ctx.identity.scope,\n\t\tstage: ctx.stage,\n\t\tid: appKey(id),\n\t};\n\tconst versioning = ctx.config.versioning ?? construct.versioned;\n\tconst open = [...new Set(construct.servers.flatMap((s) => s.open))].sort();\n\n\tconst { bucket, exists } = await ensureBucketName(\n\t\tctx,\n\t\tclients,\n\t\tid,\n\t\tbucketName(nameInput),\n\t);\n\tawait ensureBucketSettings(ctx, clients, {\n\t\tid,\n\t\tbucket,\n\t\texists,\n\t\tversioning,\n\t\topen,\n\t});\n\n\tconst user = await ensureUser(\n\t\tctx,\n\t\tclients,\n\t\tid,\n\t\tiamUserName(nameInput),\n\t\tuserPolicy(bucket, { versioning }),\n\t);\n\tawait ensureAccessKey(ctx, clients, { id, bucket, ...user });\n\n\t// Each file server over it serves on the bucket's own endpoint — unless the\n\t// stage set an address of its own for it (a CDN), which is kept.\n\tconst publicUrl = bucketPublicUrl(bucket, clients.region, clients.endpoint);\n\tfor (const server of construct.servers) {\n\t\tconst key = provideKey(server.id, 'url');\n\t\tconst entry: StateEntry = { key: `file-server:${server.id}`, type: 'url' };\n\t\tconst recorded = ctx.state.record(entry.key)?.id;\n\t\tconst current = ctx.secrets[key];\n\t\tif (current === publicUrl) {\n\t\t\tawait ctx.state.ready(entry, publicUrl);\n\t\t\tcontinue;\n\t\t}\n\t\tif (current !== undefined && current !== recorded) {\n\t\t\tctx.log(\n\t\t\t\t`   ${key} is set to ${current} by you, and kept — the bucket's own address is ${publicUrl}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tawait ctx.change(\n\t\t\t{ construct: server.id, resource: key, change: `set to ${publicUrl}` },\n\t\t\tasync () => {\n\t\t\t\tawait ctx.writeSecrets({ [key]: publicUrl });\n\t\t\t\tawait ctx.state.ready(entry, publicUrl);\n\t\t\t},\n\t\t);\n\t}\n}\n\n/**\n * The bucket's name: the recorded one, else the good name, else the good\n * name with a random suffix — up to {@link SUFFIX_ATTEMPTS} times.\n */\nasync function ensureBucketName(\n\tctx: Ctx,\n\tclients: Clients,\n\tid: string,\n\tgood: string,\n): Promise<{ bucket: string; exists: boolean }> {\n\tconst { S3, s3, region } = clients;\n\tconst key = `s3-bucket:${id}`;\n\tconst record = ctx.state.record(key);\n\tconst entry = (name: string): StateEntry => ({\n\t\tkey,\n\t\ttype: 's3-bucket',\n\t\tdata: { name, region },\n\t});\n\n\t/** Whether this account holds `name`: yes, no, or someone else does. */\n\tconst probe = async (name: string): Promise<'ours' | 'none' | 'taken'> => {\n\t\ttry {\n\t\t\tawait s3.send(new S3.HeadBucketCommand({ Bucket: name }));\n\t\t\treturn 'ours';\n\t\t} catch (error) {\n\t\t\tconst name = errorName(error);\n\t\t\tif (name === 'NotFound' || name === 'NoSuchBucket') return 'none';\n\t\t\tif (name === 'Forbidden' || name === 'AccessDenied') return 'taken';\n\t\t\tthrow error;\n\t\t}\n\t};\n\n\tconst create = async (\n\t\tname: string,\n\t): Promise<'created' | 'ours' | 'taken'> => {\n\t\tif (ctx.dryRun) {\n\t\t\tconst found = await probe(name);\n\t\t\tif (found === 'none') {\n\t\t\t\tawait ctx.change(\n\t\t\t\t\t{\n\t\t\t\t\t\tconstruct: id,\n\t\t\t\t\t\tresource: `bucket ${name}`,\n\t\t\t\t\t\tchange: `create in ${region}`,\n\t\t\t\t\t},\n\t\t\t\t\tasync () => {},\n\t\t\t\t);\n\t\t\t\treturn 'created';\n\t\t\t}\n\t\t\treturn found;\n\t\t}\n\t\tawait ctx.state.pending(entry(name));\n\t\ttry {\n\t\t\tawait s3.send(\n\t\t\t\tnew S3.CreateBucketCommand({\n\t\t\t\t\tBucket: name,\n\t\t\t\t\t// us-east-1 is the one region named by leaving it out.\n\t\t\t\t\t...(region === 'us-east-1'\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: {\n\t\t\t\t\t\t\t\tCreateBucketConfiguration: {\n\t\t\t\t\t\t\t\t\tLocationConstraint:\n\t\t\t\t\t\t\t\t\t\tregion as import('@aws-sdk/client-s3').BucketLocationConstraint,\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconst code = errorName(error);\n\t\t\tif (code === 'BucketAlreadyOwnedByYou') return 'ours';\n\t\t\tif (code === 'BucketAlreadyExists') return 'taken';\n\t\t\tthrow error;\n\t\t}\n\t\tawait ctx.change(\n\t\t\t{\n\t\t\t\tconstruct: id,\n\t\t\t\tresource: `bucket ${name}`,\n\t\t\t\tchange: `create in ${region}`,\n\t\t\t},\n\t\t\tasync () => {},\n\t\t);\n\t\treturn 'created';\n\t};\n\n\tconst adopt = async (name: string): Promise<void> => {\n\t\tconst tags = await readOr(\n\t\t\t() => s3.send(new S3.GetBucketTaggingCommand({ Bucket: name })),\n\t\t\t['NoSuchTagSet', 'NoSuchTagSetError'],\n\t\t);\n\t\tconst owner = tags?.TagSet?.find((t) => t.Key === TAG_PROJECT)?.Value;\n\t\tif (owner && owner !== ctx.identity.key) {\n\t\t\tthrow new BucketOwnedByAnotherProject(name, owner, ctx.identity.key);\n\t\t}\n\t};\n\n\t// Recorded: the name is the stage's forever. Gone, it is made again under\n\t// the same name — never a new one.\n\tif (record?.status === 'ready' && record.id) {\n\t\tconst found = await probe(record.id);\n\t\tif (found === 'ours') return { bucket: record.id, exists: true };\n\t\tif (found === 'taken') throw new RecordedBucketUnreachable(id, record.id);\n\t\tconst made = await create(record.id);\n\t\tif (made === 'taken') throw new RecordedBucketUnreachable(id, record.id);\n\t\tif (!ctx.dryRun) await ctx.state.ready(entry(record.id), record.id);\n\t\treturn { bucket: record.id, exists: made === 'ours' };\n\t}\n\n\t// A run that died between creating a suffixed bucket and recording it.\n\tconst pending = record?.data?.name;\n\tconst names = [\n\t\t...(typeof pending === 'string' && pending !== good ? [pending] : []),\n\t\tgood,\n\t\t...Array.from({ length: SUFFIX_ATTEMPTS }, () =>\n\t\t\tsuffixedBucketName(good, randomSuffix()),\n\t\t),\n\t];\n\tconst tried: string[] = [];\n\tfor (const name of names) {\n\t\ttried.push(name);\n\t\tconst made = await create(name);\n\t\tif (made === 'taken') continue;\n\t\tif (made === 'ours') await adopt(name);\n\t\tif (!ctx.dryRun) await ctx.state.ready(entry(name), name);\n\t\tif (name !== good) {\n\t\t\tctx.log(\n\t\t\t\t`   '${good}' is taken by another account; '${id}' is '${name}', recorded in the stage's state`,\n\t\t\t);\n\t\t}\n\t\treturn { bucket: name, exists: made === 'ours' };\n\t}\n\tthrow new BucketNameUnavailable(\n\t\tid,\n\t\ttried.filter((n) => n !== pending),\n\t);\n}\n\n/** Tags, Block Public Access, encryption, policy, versioning and CORS. */\nasync function ensureBucketSettings(\n\tctx: Ctx,\n\tclients: Clients,\n\tinput: {\n\t\tid: string;\n\t\tbucket: string;\n\t\t/** False when a dry run would create it: nothing to read yet. */\n\t\texists: boolean;\n\t\tversioning: boolean;\n\t\topen: readonly string[];\n\t},\n): Promise<void> {\n\tconst { S3, s3 } = clients;\n\tconst { id, bucket } = input;\n\tconst Bucket = bucket;\n\t// A bucket a dry run would create has nothing to read: every setting\n\t// would be set.\n\tconst fresh = ctx.dryRun && !input.exists;\n\tconst read = async <T>(\n\t\tfn: () => Promise<T>,\n\t\tmissing: readonly string[],\n\t): Promise<T | undefined> => (fresh ? undefined : readOr(fn, missing));\n\tconst set = (change: string, apply: () => Promise<unknown>) =>\n\t\tctx.change({ construct: id, resource: `bucket ${bucket}`, change }, () =>\n\t\t\tapply().then(() => undefined),\n\t\t);\n\n\t// Tags — gkm's three, beside whatever else is there.\n\tconst tagged = await read(\n\t\t() => s3.send(new S3.GetBucketTaggingCommand({ Bucket })),\n\t\t['NoSuchTagSet', 'NoSuchTagSetError'],\n\t);\n\tconst ours = identityTags(ctx, id);\n\tconst others = (tagged?.TagSet ?? []).filter(\n\t\t(t) => !ours.some((o) => o.Key === t.Key),\n\t);\n\tconst missingTag = ours.some(\n\t\t(o) => !tagged?.TagSet?.some((t) => t.Key === o.Key && t.Value === o.Value),\n\t);\n\tif (missingTag) {\n\t\tawait set('tag', () =>\n\t\t\ts3.send(\n\t\t\t\tnew S3.PutBucketTaggingCommand({\n\t\t\t\t\tBucket,\n\t\t\t\t\tTagging: {\n\t\t\t\t\t\tTagSet: [...others, ...ours].map((t) => ({\n\t\t\t\t\t\t\tKey: t.Key!,\n\t\t\t\t\t\t\tValue: t.Value!,\n\t\t\t\t\t\t})),\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}\n\n\tconst isOpen = input.open.length > 0;\n\tconst block = publicAccessBlock(isOpen);\n\tconst ensureBlock = async () => {\n\t\tconst current = await read(\n\t\t\t() => s3.send(new S3.GetPublicAccessBlockCommand({ Bucket })),\n\t\t\t['NoSuchPublicAccessBlockConfiguration'],\n\t\t);\n\t\tconst now = current?.PublicAccessBlockConfiguration;\n\t\tconst same =\n\t\t\tnow &&\n\t\t\t(Object.keys(block) as (keyof typeof block)[]).every(\n\t\t\t\t(k) => (now[k] ?? false) === block[k],\n\t\t\t);\n\t\tif (!same) {\n\t\t\tawait set(\n\t\t\t\tisOpen\n\t\t\t\t\t? 'block public access (ACLs; the policy opens the open paths)'\n\t\t\t\t\t: 'block all public access',\n\t\t\t\t() =>\n\t\t\t\t\ts3.send(\n\t\t\t\t\t\tnew S3.PutPublicAccessBlockCommand({\n\t\t\t\t\t\t\tBucket,\n\t\t\t\t\t\t\tPublicAccessBlockConfiguration: block,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t);\n\t\t}\n\t};\n\n\tconst policy = bucketPolicy(bucket, input.open);\n\tconst ensurePolicy = async () => {\n\t\tconst current = await read(\n\t\t\t() => s3.send(new S3.GetBucketPolicyCommand({ Bucket })),\n\t\t\t['NoSuchBucketPolicy'],\n\t\t);\n\t\tconst same =\n\t\t\tcurrent?.Policy !== undefined &&\n\t\t\tcanonicalPolicy(JSON.parse(current.Policy)) === canonicalPolicy(policy);\n\t\tif (!same) {\n\t\t\tawait set(\n\t\t\t\tisOpen\n\t\t\t\t\t? `policy: TLS only, public read on ${input.open.join(', ')}`\n\t\t\t\t\t: 'policy: TLS only',\n\t\t\t\t() =>\n\t\t\t\t\ts3.send(\n\t\t\t\t\t\tnew S3.PutBucketPolicyCommand({\n\t\t\t\t\t\t\tBucket,\n\t\t\t\t\t\t\tPolicy: JSON.stringify(policy),\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t);\n\t\t}\n\t};\n\n\t// A public policy is refused while BlockPublicPolicy is on, and a block\n\t// put back while one is in place would refuse the next put: relax the\n\t// block before opening, and close the policy before blocking.\n\tif (isOpen) {\n\t\tawait ensureBlock();\n\t\tawait ensurePolicy();\n\t} else {\n\t\tawait ensurePolicy();\n\t\tawait ensureBlock();\n\t}\n\n\t// Default encryption: SSE-S3.\n\tconst encryption = await read(\n\t\t() => s3.send(new S3.GetBucketEncryptionCommand({ Bucket })),\n\t\t['ServerSideEncryptionConfigurationNotFoundError'],\n\t);\n\tconst algorithm =\n\t\tencryption?.ServerSideEncryptionConfiguration?.Rules?.[0]\n\t\t\t?.ApplyServerSideEncryptionByDefault?.SSEAlgorithm;\n\t// A new bucket is SSE-S3 already — S3 has encrypted every new bucket by\n\t// default since 2023 — so a dry run does not promise to set it.\n\tif (algorithm !== 'AES256' && !fresh) {\n\t\tawait set('encrypt by default (SSE-S3)', () =>\n\t\t\ts3.send(\n\t\t\t\tnew S3.PutBucketEncryptionCommand({\n\t\t\t\t\tBucket,\n\t\t\t\t\tServerSideEncryptionConfiguration: {\n\t\t\t\t\t\tRules: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tApplyServerSideEncryptionByDefault: { SSEAlgorithm: 'AES256' },\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t},\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}\n\n\t// Versioning: on when asked; a bucket that had it is suspended, never\n\t// stripped of the versions it kept.\n\tconst versioning = await read(\n\t\t() => s3.send(new S3.GetBucketVersioningCommand({ Bucket })),\n\t\t[],\n\t);\n\tconst status = versioning?.Status;\n\tif (input.versioning && status !== 'Enabled') {\n\t\tawait set('enable versioning', () =>\n\t\t\ts3.send(\n\t\t\t\tnew S3.PutBucketVersioningCommand({\n\t\t\t\t\tBucket,\n\t\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t} else if (!input.versioning && status === 'Enabled') {\n\t\tawait set('suspend versioning', () =>\n\t\t\ts3.send(\n\t\t\t\tnew S3.PutBucketVersioningCommand({\n\t\t\t\t\tBucket,\n\t\t\t\t\tVersioningConfiguration: { Status: 'Suspended' },\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}\n\n\t// CORS for the stage's sites.\n\tconst { origins, unresolved } = bucketOrigins({\n\t\tworkspace: ctx.workspace,\n\t\tmanifest: ctx.manifest,\n\t\trunnables: ctx.runnables,\n\t\tstage: ctx.stage,\n\t\tbucket: id,\n\t});\n\tif (unresolved.length > 0) {\n\t\tctx.log(\n\t\t\t`   ${unresolved.join(', ')} ${unresolved.length === 1 ? 'has' : 'have'} no address on '${ctx.stage}' (domains.${ctx.stage}), so ${unresolved.length === 1 ? 'is' : 'are'} not in '${bucket}''s CORS`,\n\t\t);\n\t}\n\tif (origins.length === 0) return;\n\tconst rule = corsRule(origins);\n\tconst cors = await read(\n\t\t() => s3.send(new S3.GetBucketCorsCommand({ Bucket })),\n\t\t['NoSuchCORSConfiguration'],\n\t);\n\tconst sameCors =\n\t\tcors?.CORSRules?.length === 1 &&\n\t\tcanonicalCors(cors.CORSRules[0]!) === canonicalCors(rule);\n\tif (!sameCors) {\n\t\tawait set(`CORS for ${origins.join(', ')}`, () =>\n\t\t\ts3.send(\n\t\t\t\tnew S3.PutBucketCorsCommand({\n\t\t\t\t\tBucket,\n\t\t\t\t\tCORSConfiguration: { CORSRules: [rule] },\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}\n}\n\nfunction canonicalCors(rule: Partial<CorsRule>): string {\n\tconst sorted = (list?: string[]) => [...(list ?? [])].sort();\n\treturn JSON.stringify({\n\t\tAllowedMethods: sorted(rule.AllowedMethods),\n\t\tAllowedOrigins: sorted(rule.AllowedOrigins),\n\t\tAllowedHeaders: sorted(rule.AllowedHeaders),\n\t\tExposeHeaders: sorted(rule.ExposeHeaders),\n\t\tMaxAgeSeconds: rule.MaxAgeSeconds ?? null,\n\t});\n}\n\n/** The bucket's IAM user and its inline policy. */\nasync function ensureUser(\n\tctx: Ctx,\n\tclients: Clients,\n\tid: string,\n\tuser: string,\n\tpolicy: ReturnType<typeof userPolicy>,\n): Promise<{ user: string; exists: boolean }> {\n\tconst { IAM, iam } = clients;\n\tconst entry: StateEntry = { key: `iam-user:${id}`, type: 'iam-user' };\n\tconst found = await readOr(\n\t\t() => iam.send(new IAM.GetUserCommand({ UserName: user })),\n\t\t['NoSuchEntity', 'NoSuchEntityException'],\n\t);\n\n\tif (found?.User) {\n\t\tconst tags = await iam.send(\n\t\t\tnew IAM.ListUserTagsCommand({ UserName: user }),\n\t\t);\n\t\tconst tag = (key: string) => tags.Tags?.find((t) => t.Key === key)?.Value;\n\t\tif (\n\t\t\tfound.User.Path !== IAM_USER_PATH ||\n\t\t\ttag(TAG_PROJECT) !== ctx.identity.key ||\n\t\t\ttag(TAG_STAGE) !== ctx.stage\n\t\t) {\n\t\t\tthrow new IamUserNotOwned(user, ctx.identity.key, ctx.stage);\n\t\t}\n\t\tawait ctx.state.ready(entry, user);\n\t} else {\n\t\tawait ctx.change(\n\t\t\t{\n\t\t\t\tconstruct: id,\n\t\t\t\tresource: `IAM user ${user}`,\n\t\t\t\tchange: `create under ${IAM_USER_PATH}`,\n\t\t\t},\n\t\t\tasync () => {\n\t\t\t\tawait ctx.state.pending(entry);\n\t\t\t\tawait iam.send(\n\t\t\t\t\tnew IAM.CreateUserCommand({\n\t\t\t\t\t\tUserName: user,\n\t\t\t\t\t\tPath: IAM_USER_PATH,\n\t\t\t\t\t\tTags: identityTags(ctx, id),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tawait ctx.state.ready(entry, user);\n\t\t\t},\n\t\t);\n\t}\n\n\tconst exists = Boolean(found?.User) || !ctx.dryRun;\n\tconst current = exists\n\t\t? await readOr(\n\t\t\t\t() =>\n\t\t\t\t\tiam.send(\n\t\t\t\t\t\tnew IAM.GetUserPolicyCommand({\n\t\t\t\t\t\t\tUserName: user,\n\t\t\t\t\t\t\tPolicyName: IAM_POLICY_NAME,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t['NoSuchEntity', 'NoSuchEntityException'],\n\t\t\t)\n\t\t: undefined;\n\tconst document = current?.PolicyDocument\n\t\t? JSON.parse(decodePolicy(current.PolicyDocument))\n\t\t: undefined;\n\tif (!document || canonicalPolicy(document) !== canonicalPolicy(policy)) {\n\t\tawait ctx.change(\n\t\t\t{\n\t\t\t\tconstruct: id,\n\t\t\t\tresource: `IAM user ${user}`,\n\t\t\t\tchange: `policy ${IAM_POLICY_NAME}: this bucket only`,\n\t\t\t},\n\t\t\tasync () => {\n\t\t\t\tawait iam.send(\n\t\t\t\t\tnew IAM.PutUserPolicyCommand({\n\t\t\t\t\t\tUserName: user,\n\t\t\t\t\t\tPolicyName: IAM_POLICY_NAME,\n\t\t\t\t\t\tPolicyDocument: JSON.stringify(policy),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t},\n\t\t);\n\t}\n\treturn { user, exists };\n}\n\n/** IAM returns a policy document URL-encoded; an emulator may not. */\nfunction decodePolicy(document: string): string {\n\ttry {\n\t\treturn decodeURIComponent(document);\n\t} catch {\n\t\treturn document;\n\t}\n}\n\n/**\n * The user's access key, in the stage's secrets as the bucket's URL.\n *\n * - First run: one key, written into the stage's secrets.\n * - `--rotate-keys`: a second key, written in place of the first; the first\n *   stays active until the stage has deployed with the second, and the next\n *   run after that deploy — or `--retire-old-keys` — deletes it.\n * - A key the secrets no longer hold (a store emptied by hand): replaced the\n *   same way, since its secret cannot be read back.\n */\nasync function ensureAccessKey(\n\tctx: Ctx,\n\tclients: Clients,\n\tinput: { id: string; bucket: string; user: string; exists: boolean },\n): Promise<void> {\n\tconst { IAM, iam } = clients;\n\tconst { id, bucket, user } = input;\n\tconst urlKey = provideKey(id, 'url');\n\tconst entryKey = `iam-access-key:${id}`;\n\tconst record = ctx.state.record(entryKey);\n\n\tconst given = ctx.secrets[urlKey];\n\tlet inUrl: string | undefined;\n\tif (given !== undefined) {\n\t\tlet parsed: s3Url.S3Address | undefined;\n\t\ttry {\n\t\t\tparsed = s3Url.parse(given);\n\t\t} catch {\n\t\t\tparsed = undefined;\n\t\t}\n\t\tif (parsed?.bucket !== bucket) {\n\t\t\tthrow new BucketKeySetElsewhere(\n\t\t\t\turlKey,\n\t\t\t\tbucket,\n\t\t\t\tparsed?.bucket ?? given.replace(/\\/\\/[^@]*@/, '//'),\n\t\t\t\tctx.stage,\n\t\t\t);\n\t\t}\n\t\tinUrl = parsed.accessKeyId;\n\t}\n\n\tconst listed = input.exists\n\t\t? ((\n\t\t\t\tawait iam.send(new IAM.ListAccessKeysCommand({ UserName: user }))\n\t\t\t).AccessKeyMetadata?.map((k) => k.AccessKeyId!) ?? [])\n\t\t: [];\n\n\tlet current = record?.status === 'ready' ? record.id : undefined;\n\tlet previous =\n\t\ttypeof record?.data?.previous === 'string'\n\t\t\t? record.data.previous\n\t\t\t: undefined;\n\tconst rotatedAt =\n\t\ttypeof record?.data?.rotatedAt === 'string'\n\t\t\t? record.data.rotatedAt\n\t\t\t: undefined;\n\tconst entry = (data: Record<string, unknown> = {}): StateEntry => ({\n\t\tkey: entryKey,\n\t\ttype: 'iam-access-key',\n\t\tdata: { user, ...data },\n\t});\n\n\t// The old key of a rotation: deleted once the stage deployed after it.\n\tif (previous && current) {\n\t\tconst deployed =\n\t\t\trotatedAt !== undefined &&\n\t\t\tctx.state.lastDeployedAt !== undefined &&\n\t\t\tctx.state.lastDeployedAt > rotatedAt;\n\t\tif (ctx.retireOldKeys || deployed) {\n\t\t\tconst old = previous;\n\t\t\tconst keep = current;\n\t\t\tawait ctx.change(\n\t\t\t\t{\n\t\t\t\t\tconstruct: id,\n\t\t\t\t\tresource: `IAM user ${user}`,\n\t\t\t\t\tchange: `delete the rotated-out access key ${old}`,\n\t\t\t\t},\n\t\t\t\tasync () => {\n\t\t\t\t\tif (listed.includes(old)) {\n\t\t\t\t\t\tawait iam.send(\n\t\t\t\t\t\t\tnew IAM.DeleteAccessKeyCommand({\n\t\t\t\t\t\t\t\tUserName: user,\n\t\t\t\t\t\t\t\tAccessKeyId: old,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tawait ctx.state.ready(entry(), keep);\n\t\t\t\t},\n\t\t\t);\n\t\t\tprevious = undefined;\n\t\t} else {\n\t\t\tctx.log(\n\t\t\t\t`   ${id}: the old access key ${previous} stays active until '${ctx.stage}' is deployed with the new one; the next deploy after that deletes it (or pass --retire-old-keys)`,\n\t\t\t);\n\t\t}\n\t}\n\n\t// No record, and the secrets hold a key of this user's: adopt it.\n\tif (!current && inUrl && listed.includes(inUrl)) {\n\t\tawait ctx.state.ready(entry(), inUrl);\n\t\tcurrent = inUrl;\n\t}\n\n\tconst valid =\n\t\tcurrent !== undefined && listed.includes(current) && inUrl === current;\n\tif (valid && !ctx.rotateKeys) return;\n\tif (ctx.rotateKeys && previous) {\n\t\tthrow new RotationInProgress(id, previous, ctx.stage);\n\t}\n\n\tconst outgoing = current && listed.includes(current) ? current : undefined;\n\tif (listed.length >= 2) throw new AccessKeyLimit(user, listed);\n\n\tconst why = !current\n\t\t? 'create an access key'\n\t\t: ctx.rotateKeys\n\t\t\t? 'rotate: issue a new access key'\n\t\t\t: 'issue a new access key (the secrets no longer hold the recorded one)';\n\tawait ctx.change(\n\t\t{ construct: id, resource: `IAM user ${user}`, change: why },\n\t\tasync () => {\n\t\t\tawait ctx.state.pending(entry(outgoing ? { previous: outgoing } : {}));\n\t\t\tconst created = await iam.send(\n\t\t\t\tnew IAM.CreateAccessKeyCommand({ UserName: user }),\n\t\t\t);\n\t\t\tconst key = created.AccessKey!;\n\t\t\t// Into the stage's secrets before anything else: IAM shows a secret\n\t\t\t// once, and a key whose secret is lost is a key to replace.\n\t\t\tawait ctx.writeSecrets({\n\t\t\t\t[urlKey]: s3Url.build({\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: clients.region,\n\t\t\t\t\t...(clients.endpoint\n\t\t\t\t\t\t? { endpoint: clients.endpoint, forcePathStyle: true }\n\t\t\t\t\t\t: {}),\n\t\t\t\t\taccessKeyId: key.AccessKeyId!,\n\t\t\t\t\tsecretAccessKey: key.SecretAccessKey!,\n\t\t\t\t}),\n\t\t\t});\n\t\t\tawait ctx.state.ready(\n\t\t\t\tentry(\n\t\t\t\t\toutgoing\n\t\t\t\t\t\t? { previous: outgoing, rotatedAt: new Date().toISOString() }\n\t\t\t\t\t\t: {},\n\t\t\t\t),\n\t\t\t\tkey.AccessKeyId!,\n\t\t\t);\n\t\t},\n\t);\n\tif (outgoing) {\n\t\tctx.log(\n\t\t\t`   ${urlKey} holds the new key. This deploy moves '${ctx.stage}' onto it; the next deploy after it deletes the old key ${outgoing}`,\n\t\t);\n\t}\n}\n\n/**\n * Each provisioned bucket answers `HeadBucket` to the key in the stage's\n * secrets — the one the apps will use. A bucket whose URL carries no key is\n * not one this provider wrote, and the deploy's own check covers a URL that\n * is missing.\n */\nasync function verifyS3(ctx: VerifyContext<S3ObjectsConfig>): Promise<void> {\n\tconst S3 = await import('@aws-sdk/client-s3');\n\tfor (const { id } of bucketConstructs(ctx.manifest)) {\n\t\tconst url = ctx.secrets[provideKey(id, 'url')];\n\t\tif (url === undefined) continue;\n\t\tconst address = s3Url.parse(url);\n\t\tif (!address.accessKeyId || !address.secretAccessKey) continue;\n\t\tconst client = new S3.S3Client({\n\t\t\tregion: address.region ?? ctx.config.region ?? 'us-east-1',\n\t\t\tcredentials: {\n\t\t\t\taccessKeyId: address.accessKeyId,\n\t\t\t\tsecretAccessKey: address.secretAccessKey,\n\t\t\t},\n\t\t\t...(address.endpoint ? { endpoint: address.endpoint } : {}),\n\t\t\t...(address.forcePathStyle ? { forcePathStyle: true } : {}),\n\t\t});\n\t\ttry {\n\t\t\tawait client.send(new S3.HeadBucketCommand({ Bucket: address.bucket }));\n\t\t} catch (error) {\n\t\t\tconst name = errorName(error);\n\t\t\tthrow new ProvisionedBucketUnreachable(\n\t\t\t\tid,\n\t\t\t\taddress.bucket,\n\t\t\t\tctx.stage,\n\t\t\t\tname === 'NotFound'\n\t\t\t\t\t? 'it does not exist'\n\t\t\t\t\t: name === 'Forbidden'\n\t\t\t\t\t\t? 'the key is refused'\n\t\t\t\t\t\t: name || String(error),\n\t\t\t);\n\t\t} finally {\n\t\t\tclient.destroy();\n\t\t}\n\t}\n}\n\nexport const s3Provider: ResourceProvider<S3ObjectsConfig, AwsProvisioning> = {\n\tkind: 'objects',\n\tname: 's3',\n\tcheck: checkS3Config,\n\tprovisioning: S3_PROVISIONING,\n\tcredentials: awsProvisioningCredentials,\n\truntimeKeys(manifest) {\n\t\treturn bucketConstructs(manifest).flatMap((b) => [\n\t\t\tprovideKey(b.id, 'url'),\n\t\t\t...b.servers.map((s) => provideKey(s.id, 'url')),\n\t\t]);\n\t},\n\tensure: ensureS3,\n\tverify: verifyS3,\n};\n","/**\n * The providers gkm ships, by kind and name — registered the way a deploy\n * target's built-ins are (`target/builtins.ts`). A provider from a package is\n * one more entry here once there is a loading story for it.\n */\n\nimport { s3Provider } from './s3/index.js';\nimport type { ProviderKind, ResourceProvider } from './types.js';\n\nexport const BUILTIN_PROVIDERS: {\n\treadonly [K in ProviderKind]: Readonly<\n\t\tRecord<string, ResourceProvider<any, any>>\n\t>;\n} = {\n\tobjects: { s3: s3Provider },\n};\n\n/** The provider `kind` names `name`, if gkm has one. */\nexport function builtinProvider(\n\tkind: ProviderKind,\n\tname: string,\n): ResourceProvider<any, any> | undefined {\n\treturn Object.hasOwn(BUILTIN_PROVIDERS[kind], name)\n\t\t? BUILTIN_PROVIDERS[kind][name]\n\t\t: undefined;\n}\n\n/** The names `deploy.<kind>.<stage>` accepts, for messages. */\nexport function providerNames(kind: ProviderKind): string[] {\n\treturn Object.keys(BUILTIN_PROVIDERS[kind]).sort();\n}\n","/**\n * Running providers on a stage: `ensure()` at the start of every deploy —\n * before its checks, so a key the deploy creates is never reported missing —\n * `verify()` from every deploy's checks, and the hint a stage missing a key\n * is given.\n *\n * See `types.ts` for what a provider is.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { deployIdentity } from '../deploy/identity.js';\nimport { DeployJournal } from '../deploy/journal.js';\nimport type { StateStore } from '../deploy/StateStore.js';\nimport { createComposeState, createEmptyState } from '../deploy/state.js';\nimport { GkmError } from '../errors';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { stageProvider } from './config.js';\nimport { deploysWithCompose } from './dns.js';\nimport { assertStageProvidersEnabled } from './notes.js';\nimport { builtinProvider } from './registry.js';\nimport {\n\tPROVIDER_KINDS,\n\ttype ProviderKind,\n\ttype ProvisionAction,\n\ttype ProvisionState,\n\ttype ResourceProvider,\n} from './types.js';\n\nexport {\n\tcheckStageProvider,\n\tstageProvider,\n\tUnknownStageProvider,\n} from './config.js';\nexport {\n\tassertStageProvidersEnabled,\n\tprovisionCommand,\n\tprovisionHint,\n\tStageProviderDisabled,\n\tstageProviderNotes,\n} from './notes.js';\nexport { BUILTIN_PROVIDERS, builtinProvider } from './registry.js';\nexport type * from './types.js';\n\n/** The constructs of a kind: `objects` is every bucket. */\nfunction constructsOf(manifest: ConstructManifest, kind: ProviderKind) {\n\treturn Object.entries(manifest)\n\t\t.filter(([, d]) => d.kind === kind)\n\t\t.map(([id]) => id)\n\t\t.sort();\n}\n\nexport interface VerifyStageInput {\n\tworkspace: NormalizedWorkspace;\n\tmanifest: ConstructManifest;\n\tstage: string;\n\t/** The stage's secrets, by key. */\n\tsecrets: Readonly<Record<string, string>>;\n}\n\n/**\n * What every deploy runs: each provider's `verify()` — the cheap check that\n * what it created is still there and the stage's key reaches it. Nothing on\n * the local stage, and nothing for a kind on `external`.\n *\n * @throws {StageProviderDisabled} for a declared kind the stage has none of\n */\nexport async function verifyStageProviders(\n\tinput: VerifyStageInput,\n): Promise<string[]> {\n\tassertStageProvidersEnabled(input.workspace, input.manifest, input.stage);\n\tconst verified: string[] = [];\n\tfor (const kind of PROVIDER_KINDS) {\n\t\tif (constructsOf(input.manifest, kind).length === 0) continue;\n\t\tconst choice = stageProvider(input.workspace, kind, input.stage);\n\t\tif (choice.mode !== 'provider') continue;\n\t\tconst provider = builtinProvider(kind, choice.name)!;\n\t\tawait provider.verify({\n\t\t\tworkspace: input.workspace,\n\t\t\tmanifest: input.manifest,\n\t\t\tstage: input.stage,\n\t\t\tconfig: choice.config,\n\t\t\tsecrets: input.secrets,\n\t\t});\n\t\tverified.push(`${kind}: ${provider.name}`);\n\t}\n\treturn verified;\n}\n\n/** The stage's secrets, as the deploy reads and writes them. */\nexport interface ProvisionSecrets {\n\tread(): Promise<StageSecrets | null>;\n\twrite(secrets: StageSecrets): Promise<void>;\n}\n\nexport interface ProvisionOptions {\n\tworkspace: NormalizedWorkspace;\n\tstage: string;\n\tmanifest: ConstructManifest;\n\trunnables?: Record<string, string[]>;\n\t/** The stage's secrets — where each runtime key is written. */\n\tsecrets: ProvisionSecrets;\n\t/** The stage's deploy state. The caller holds the stage's lock. */\n\tstate: StateStore;\n\t/** Print the plan; write nothing to the account, the state or the secrets. */\n\tdryRun?: boolean;\n\t/** Issue each runtime key a successor. */\n\trotateKeys?: boolean;\n\t/** Delete a rotated-out key now rather than after the next deploy. */\n\tretireOldKeys?: boolean;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** The CLI's home. */\n\thome?: string;\n\tenv?: NodeJS.ProcessEnv;\n\tlog?: (line: string) => void;\n}\n\n/** What one kind came to on a provisioning run. */\nexport interface KindReport {\n\tkind: ProviderKind;\n\tmode: 'external' | 'none' | 'provider';\n\tprovider?: string;\n\tactions: ProvisionAction[];\n\t/**\n\t * The runtime keys the stage's secrets do not hold yet, which the run\n\t * writes — or, on a dry run, would.\n\t */\n\tplanned: string[];\n}\n\n/**\n * A stage whose provider creates its resources, and no credentials to create\n * them with. Raised before anything is created, built or started.\n */\nexport class ProviderCredentialsMissing extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly kind: ProviderKind,\n\t\treadonly provider: string,\n\t\t/** The constructs it would have created resources for. */\n\t\treadonly ids: readonly string[],\n\t\t/** The environment variables it reads. */\n\t\treadonly env: readonly string[],\n\t\t/** How to supply them, in one line. */\n\t\treadonly describe: string,\n\t\t/** A `gkm login --provider` name, where it has one. */\n\t\treadonly login?: string,\n\t) {\n\t\tsuper(\n\t\t\t`deploy.${kind}.${stage} is ${provider}, so the deploy creates what ` +\n\t\t\t\t`${ids.join(', ')} ${ids.length === 1 ? 'is' : 'are'} backed by on ` +\n\t\t\t\t`'${stage}' and writes ${ids.length === 1 ? 'its key' : 'their keys'} ` +\n\t\t\t\t`into the stage's secrets — and it found no ${provider} credentials ` +\n\t\t\t\t`to do it with. On this machine, supply ${describe}` +\n\t\t\t\t(login ? `, or run gkm login --provider ${login}` : '') +\n\t\t\t\t'. In CI, the step that runs the deploy (or gkm deploy ' +\n\t\t\t\t`--resources-only) needs them: the '${stage}' environment's role ` +\n\t\t\t\t'(AWS_ROLE_ARN, from gkm deploy:github), assumed before that step. ' +\n\t\t\t\t`With the keys set by hand instead, set deploy.${kind}.${stage} to 'external'.`,\n\t\t);\n\t\tthis.name = 'ProviderCredentialsMissing';\n\t}\n}\n\n/**\n * `ensure()` for every provider the stage configures — find or create, fix\n * drift, record in the stage's state, write the runtime keys into its\n * secrets. Run by the deploy, which holds the stage's lock. A provider with\n * no provisioning credentials stops the run with\n * {@link ProviderCredentialsMissing} before anything is created.\n */\nexport async function provisionStage(\n\toptions: ProvisionOptions,\n): Promise<KindReport[]> {\n\tconst { workspace, stage, manifest } = options;\n\tconst dryRun = options.dryRun === true;\n\tconst env = options.env ?? process.env;\n\tconst log = options.log ?? ((line: string) => console.log(line));\n\tconst runnables = options.runnables ?? {};\n\n\tconst reports: KindReport[] = [];\n\tconst configured: {\n\t\tkind: ProviderKind;\n\t\tprovider: ResourceProvider<any, any>;\n\t\tconfig: unknown;\n\t\tcredential: unknown;\n\t\treport: KindReport;\n\t}[] = [];\n\n\tfor (const kind of PROVIDER_KINDS) {\n\t\tconst choice = stageProvider(workspace, kind, stage);\n\t\tif (choice.mode !== 'provider') {\n\t\t\treports.push({ kind, mode: choice.mode, actions: [], planned: [] });\n\t\t\tcontinue;\n\t\t}\n\t\tconst provider = builtinProvider(kind, choice.name)!;\n\t\tconst report: KindReport = {\n\t\t\tkind,\n\t\t\tmode: 'provider',\n\t\t\tprovider: provider.name,\n\t\t\tactions: [],\n\t\t\tplanned: [],\n\t\t};\n\t\treports.push(report);\n\t\tconst ids = constructsOf(manifest, kind);\n\t\tif (ids.length === 0) continue;\n\n\t\tconst credential = await provider.credentials({\n\t\t\tstage,\n\t\t\tenv,\n\t\t\t...(options.profile ? { profile: options.profile } : {}),\n\t\t\t...(options.home ? { home: options.home } : {}),\n\t\t});\n\t\tif (credential === undefined) {\n\t\t\tthrow new ProviderCredentialsMissing(\n\t\t\t\tstage,\n\t\t\t\tkind,\n\t\t\t\tprovider.name,\n\t\t\t\tids,\n\t\t\t\tprovider.provisioning.env,\n\t\t\t\tprovider.provisioning.describe,\n\t\t\t\tprovider.provisioning.login,\n\t\t\t);\n\t\t}\n\t\tconfigured.push({\n\t\t\tkind,\n\t\t\tprovider,\n\t\t\tconfig: choice.config,\n\t\t\tcredential,\n\t\t\treport,\n\t\t});\n\t}\n\n\tif (configured.length === 0) return reports;\n\n\tconst identity = deployIdentity(workspace, stage);\n\tlet secrets = (await options.secrets.read())?.custom ?? {};\n\tfor (const entry of configured) {\n\t\tentry.report.planned = entry.provider\n\t\t\t.runtimeKeys(manifest)\n\t\t\t.filter((key) => secrets[key] === undefined);\n\t}\n\n\tconst state: ProvisionState = dryRun\n\t\t? await readOnlyState(options.state, stage)\n\t\t: journalState(\n\t\t\t\tawait DeployJournal.open(options.state, stage, () =>\n\t\t\t\t\tdeploysWithCompose(workspace)\n\t\t\t\t\t\t? createComposeState(stage)\n\t\t\t\t\t\t: createEmptyState(stage, '', ''),\n\t\t\t\t),\n\t\t\t);\n\n\tconst writeSecrets = async (values: Record<string, string>) => {\n\t\tif (dryRun) return;\n\t\tconst stored = (await options.secrets.read()) ?? initStageSecrets(stage);\n\t\tconst next = {\n\t\t\t...stored,\n\t\t\tcustom: { ...stored.custom, ...values },\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t};\n\t\tawait options.secrets.write(next);\n\t\tsecrets = next.custom;\n\t};\n\n\tfor (const entry of configured) {\n\t\tlog(\n\t\t\t`☁️  ${entry.kind}: ${entry.provider.name}${dryRun ? ' (dry run)' : ''}`,\n\t\t);\n\t\tawait entry.provider.ensure({\n\t\t\tworkspace,\n\t\t\tmanifest,\n\t\t\trunnables,\n\t\t\tstage,\n\t\t\tidentity,\n\t\t\tconfig: entry.config,\n\t\t\tcredential: entry.credential,\n\t\t\tget secrets() {\n\t\t\t\treturn secrets;\n\t\t\t},\n\t\t\tstate,\n\t\t\tdryRun,\n\t\t\trotateKeys: options.rotateKeys === true,\n\t\t\tretireOldKeys: options.retireOldKeys === true,\n\t\t\tasync change(action, apply) {\n\t\t\t\tif (!dryRun) await apply();\n\t\t\t\tentry.report.actions.push(action);\n\t\t\t\tlog(\n\t\t\t\t\t`   ${dryRun ? 'would ' : ''}${action.change} — ${action.resource}`,\n\t\t\t\t);\n\t\t\t},\n\t\t\twriteSecrets,\n\t\t\tlog,\n\t\t});\n\t\tif (entry.report.actions.length === 0) {\n\t\t\tlog('   up to date');\n\t\t}\n\t}\n\n\treturn reports;\n}\n\n/** The journal as `ensure()` sees it. */\nfunction journalState(journal: DeployJournal): ProvisionState {\n\treturn {\n\t\trecord: (key) => journal.record(key),\n\t\tpending: (entry) => journal.pending(entry),\n\t\tready: (entry, id) => journal.ready(entry, id),\n\t\tlastDeployedAt: journal.existed ? journal.state.lastDeployedAt : undefined,\n\t};\n}\n\n/** What a dry run reads, and the writes it does not make. */\nasync function readOnlyState(\n\tstore: StateStore,\n\tstage: string,\n): Promise<ProvisionState> {\n\tconst stored = await store.read(stage);\n\treturn {\n\t\trecord: (key) => stored?.resources[key],\n\t\tpending: async () => {},\n\t\tready: async () => {},\n\t\t...(stored ? { lastDeployedAt: stored.state.lastDeployedAt } : {}),\n\t};\n}\n"],"mappings":";;;;;;;;;;AAsDA,IAAa,gBAAb,MAAa,cAAiD;CAE3C;CACR;CAEA;CACD;CACA;CAEC;CARV,YACC,OACA,OAEA,OACA,WACA,SAEA,SACC;EARgB,KAAA,QAAA;EACR,KAAA,QAAA;EAEA,KAAA,QAAA;EACD,KAAA,YAAA;EACA,KAAA,UAAA;EAEC,KAAA,UAAA;CACP;CAsBH,aAAa,KACZ,OACA,OACA,SACA,SAA6C,WAAW,QACnB;EACrC,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK;EACrC,IAAI,QACH,OAAO,IAAI,cACV,OACA,OACA,MAAM,OAAO,KAAK,GAClB,OAAO,WACP,OAAO,SACP,IACD;EAGD,MAAM,QAAQ,QAAQ;EACtB,MAAM,UAAU,MAAM,MAAM,MAAM,OAAO,OAAO,EAAE,iBAAiB,KAAK,CAAC;EACzE,OAAO,IAAI,cAAc,OAAO,OAAO,OAAO,CAAC,GAAG,SAAS,KAAK;CACjE;CAEA,OAAO,KAAyC;EAC/C,OAAO,KAAK,UAAU;CACvB;;CAGA,aAAuB;EACtB,OAAO,OAAO,OAAO,KAAK,SAAS,CAAC,CAClC,QAAQ,WAAW,OAAO,WAAW,SAAS,CAAC,CAC/C,KAAK,WAAW,OAAO,GAAG;CAC7B;;CAGA,MAAM,QAAQ,OAAoC;EACjD,MAAM,KAAK,IAAI;GAAE,GAAG;GAAO,QAAQ;EAAU,CAAC;CAC/C;;;;;CAMA,MAAM,MAAM,OAAqB,IAA2B;EAC3D,MAAM,UAAU,KAAK,UAAU,MAAM;EACrC,IACC,SAAS,WAAW,WACpB,QAAQ,OAAO,MACf,KAAK,UAAU,QAAQ,IAAI,MAAM,KAAK,UAAU,MAAM,IAAI,GAE1D;EAED,MAAM,KAAK,IAAI;GAAE,GAAG;GAAO,QAAQ;GAAS;EAAG,CAAC;CACjD;;;;;;;CAQA,MAAM,OACL,OACA,OACsB;EACtB,MAAM,SAAS,KAAK,UAAU,MAAM;EACpC,IAAI;EAEJ,IAAI,QAAQ,WAAW,WAAW,OAAO,MAAM,MAAM,KAAK;GACzD,MAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,EAAE;GACvC,IAAI,OAAO;IACV,MAAM,KAAK,MAAM,OAAO,MAAM,GAAG,KAAK,CAAC;IACvC,OAAO;KAAE,UAAU;KAAO,KAAK;IAAW;GAC3C;GACA,UAAU,OAAO;EAClB;EAEA,MAAM,WAAW,MAAM,MAAM,KAAK;EAClC,IAAI,UAAU;GACb,MAAM,KAAK,MAAM,OAAO,MAAM,GAAG,QAAQ,CAAC;GAC1C,OAAO;IACN,UAAU;IACV,KAAK,QAAQ,WAAW,YAAY,YAAY;IAChD,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC9B;EACD;EAEA,MAAM,KAAK,QAAQ,KAAK;EACxB,MAAM,UAAU,MAAM,MAAM,OAAO;EACnC,MAAM,KAAK,MAAM,OAAO,MAAM,GAAG,OAAO,CAAC;EACzC,OAAO;GACN,UAAU;GACV,KAAK;GACL,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC9B;CACD;;CAGA,MAAM,OAAO,KAA4B;EACxC,IAAI,EAAE,OAAO,KAAK,YAAY;EAC9B,KAAK,UAAU,MAAM,KAAK,MAAM,eAAe,KAAK,OAAO,KAAK,EAC/D,iBAAiB,KAAK,QACvB,CAAC;EACD,MAAM,GAAG,MAAM,UAAU,GAAG,cAAc,KAAK;EAC/C,KAAK,YAAY;CAClB;;CAGA,UAA0C;EACzC,OAAO,KAAK;CACb;;CAGA,MAAM,OAAsB;EAC3B,KAAK,MAAM,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY;EACnD,KAAK,UAAU,MAAM,KAAK,MAAM,MAAM,KAAK,OAAO,KAAK,OAAO,EAC7D,iBAAiB,KAAK,QACvB,CAAC;CACF;CAEA,MAAc,IAAI,QAA0D;EAC3E,KAAK,UAAU,MAAM,KAAK,MAAM,YAAY,KAAK,OAAO,QAAQ,EAC/D,iBAAiB,KAAK,QACvB,CAAC;EACD,KAAK,YAAY;GAChB,GAAG,KAAK;IACP,OAAO,MAAM;IAAE,GAAG;IAAQ,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAAE;EAChE;CACD;AACD;;;;;;;;;;;;;;;;;AC1LA,eAAsB,2BACrB,QACuC;CACvC,MAAM,SAAS,OAAO,IAAI,cAAc,OAAO,IAAI;CACnD,MAAM,QAAQ,SAAS,EAAE,OAAO,IAAI,CAAC;CACrC,IAAI,OAAO,SAAS,OAAO;EAAE,SAAS,OAAO;EAAS,GAAG;CAAM;CAE/D,MAAM,SAAS,MAAMA,oBAAAA,kBAAkB;EACtC,KAAK,OAAO;EACZ,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;CAC5C,CAAC,CAAC,CAAC,IAAI;EAAE,MAAM;EAAO,OAAO,OAAO;CAAM,CAAC;CAC3C,IAAI,QAAQ,OAAO;CAEnB,IAAI;EACH,MAAM,EAAE,0BAA0B,MAAM,OACvC;EAED,MAAM,sBAAsB;GAAE,SAAS;GAAM,YAAY;EAAE,CAAC,CAAC,CAAC;EAC9D,OAAO;GAAE,OAAO;GAAM,GAAG;EAAM;CAChC,QAAQ;EACP;CACD;AACD;;;;;;;AAQA,SAAgB,YACf,KACA,SACqB;CACrB,OAAO,IAAI,oBAAoB,cAAc,IAAI;AAClD;;AAGA,eAAsB,gBACrB,YACA,QAME;CACF,IAAI,aAAa,YAAY;EAC5B,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO;GAAE;GAAQ,aAAa,QAAQ,EAAE,SAAS,WAAW,QAAQ,CAAC;EAAE;CACxE;CACA,IAAI,iBAAiB,YACpB,OAAO;EACN;EACA,aAAa;GACZ,aAAa,WAAW;GACxB,iBAAiB,WAAW;GAC5B,GAAI,WAAW,eACZ,EAAE,cAAc,WAAW,aAAa,IACxC,CAAC;EACL;CACD;CAED,OAAO,EAAE,OAAO;AACjB;;;;;;;;;;;;;;AClDA,SAAgB,WAAW,UAA6B,QAAgB;CACvE,OAAO,EAAA,GACNC,oBAAAA,WAAAA,CAAW,QAAQ,KAAK,GACxB,GAAG,OAAO,QAAQ,QAAQ,CAAC,CACzB,QAAQ,GAAG,OAAO,EAAE,SAAS,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAC9D,KAAK,CAAC,SAAA,GAAQA,oBAAAA,WAAAA,CAAW,IAAI,KAAK,CAAC,CACtC;AACD;AAEA,SAAgB,cAAc,OAA0C;CACvE,MAAM,EAAE,UAAU,WAAW,UAAU;CACvC,MAAM,OAAO,WAAW,UAAU,MAAM,MAAM;CAE9C,MAAM,UAAU,OAAO,QAAQ,QAAQ,CAAC,CACtC,QAAQ,GAAG,OAAO,EAAE,SAAS,cAAc,EAAE,SAAS,MAAM,CAAC,CAC7D,QAAQ,CAAC,QAAQ;EACjB,MAAM,MAAMC,cAAAA,WAAW,UAAUC,eAAAA,OAAO,EAAE,GAAG,MAAM,SAAS;EAC5D,OAAO,QAAQ,KAAA,KAAa,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC;CAC5D,CAAC;CAEF,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,CAAC,IAAI,gBAAgB,SAAS;EACxC,IAAI,YAAY,SAAS,QAAQ;GAChC,MAAM,IAAI,EAAE;GACZ;EACD;EACA,KAAK,MAAM,WAAA,GAAUC,oBAAAA,aAAAA,CAAa,UAAU,EAAE,GAC7C,IAAI,SAAS,OAAO,EAAE,SAAS,QAAQ,MAAM,IAAI,MAAM;CAEzD;CAEA,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,aAAuB,CAAC;CAC9B,KAAK,MAAM,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,GAAG;EACnC,MAAM,OAAOD,eAAAA,OAAO,EAAE;EACtB,MAAM,MAAM,UAAU,KAAK;EAC3B,IAAI,CAAC,KAAK;GACT,WAAW,KAAK,IAAI;GACpB;EACD;EACA,IAAI;GACH,MAAM,OAAOE,cAAAA,YACZ,MACA,KACA,OACA,UAAU,SACVC,cAAAA,kBAAkB,MAAM,KAAK,UAAU,IAAI,CAC5C;GACA,QAAQ,IAAI,WAAW,MAAM;EAC9B,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBC,cAAAA,mBAAmB,MAAM;GAChD,WAAW,KAAK,IAAI;EACrB;CACD;CAEA,OAAO;EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK;EAAG;CAAW;AACnD;;;AC5EA,MAAM,aAAa,WAAmB,gBAAgB;;;;;;;;;AAUtD,SAAgB,WACf,QACA,UAAoC,CAAC,GACpB;CACjB,OAAO;EACN,SAAS;EACT,WAAW,CACV;GACC,KAAK;GACL,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;IACA,GAAI,QAAQ,aAAa,CAAC,qBAAqB,IAAI,CAAC;GACrD;GACA,UAAU,GAAG,UAAU,MAAM,EAAE;EAChC,GACA;GACC,KAAK;GACL,QAAQ;GACR,QAAQ;IACP;IACA;IACA;GACD;GACA,UAAU,UAAU,MAAM;EAC3B,CACD;CACD;AACD;;;;;;;AAQA,SAAgB,aAAa,QAAgB,SAAyB;CACrE,MAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE,CAAC,CAAC,QAAQ,SAAS,GAAG;CAC7D,OAAO,GAAG,UAAU,MAAM,EAAE,GAAG;AAChC;;;;;;AAOA,SAAgB,aACf,QACA,OAA0B,CAAC,GACV;CACjB,MAAM,aAAgC,CACrC;EACC,KAAK;EACL,QAAQ;EACR,WAAW;EACX,QAAQ;EACR,UAAU,CAAC,UAAU,MAAM,GAAG,GAAG,UAAU,MAAM,EAAE,GAAG;EACtD,WAAW,EAAE,MAAM,EAAE,uBAAuB,QAAQ,EAAE;CACvD,CACD;CACA,IAAI,KAAK,SAAS,GACjB,WAAW,KAAK;EACf,KAAK;EACL,QAAQ;EACR,WAAW;EACX,QAAQ;EACR,UAAU,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,MAAM,aAAa,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;CACvE,CAAC;CAEF,OAAO;EAAE,SAAS;EAAc,WAAW;CAAW;AACvD;;;;;;AAOA,SAAgB,kBAAkB,MAKhC;CACD,OAAO;EACN,iBAAiB;EACjB,kBAAkB;EAClB,mBAAmB,CAAC;EACpB,uBAAuB,CAAC;CACzB;AACD;AAWA,SAAgB,SAAS,SAAsC;CAC9D,OAAO;EACN,gBAAgB;GAAC;GAAO;GAAQ;GAAQ;EAAK;EAC7C,gBAAgB,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK;EAC3C,gBAAgB,CAAC,GAAG;EACpB,eAAe,CAAC,MAAM;EACtB,eAAe;CAChB;AACD;;;;;;AAOA,SAAgB,gBAAgB,OAAwB;CACvD,OAAO,KAAK,UAAU,UAAU,KAAK,CAAC;AACvC;AAEA,SAAS,UAAU,OAAgB,KAAuB;CACzD,IAAI,MAAM,QAAQ,KAAK,GAAG;EACzB,MAAM,QAAQ,MAAM,KAAK,MAAM,UAAU,CAAC,CAAC;EAC3C,OAAO,QAAQ,cACZ,QACA,MAAM,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK;CAC7C;CACA,IAAI,SAAS,OAAO,UAAU,UAC7B,OAAO,OAAO,YACb,OAAO,KAAK,KAAK,CAAC,CAChB,KAAK,CAAC,CACN,KAAK,MAAM;EACX,MAAM,IAAK,MAAkC;EAO7C,OAAO,CAAC,GAAG,UALV,MAAM,YAAY,MAAM,cAAc,MAAM,QACzC,MAAM,QAAQ,CAAC,IACd,IACA,CAAC,CAAC,IACH,GACwB,CAAC,CAAC;CAC/B,CAAC,CACH;CAED,OAAO;AACR;;;;ACnGA,MAAa,cAAc;AAC3B,MAAa,YAAY;AACzB,MAAa,gBAAgB;AAS7B,SAAgB,iBACf,UACoB;CACpB,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAC7B,QAAQ,GAAG,OAAO,EAAE,SAAS,SAAS,CAAC,CACvC,KAAK,CAAC,IAAI,QAAQ;EAClB;EACA,WAAY,EAAyB,cAAc;EACnD,SAAS,OAAO,QAAQ,QAAQ,CAAC,CAC/B,QACC,GAAG,OACH,EAAE,SAAS,iBAAkB,EAA4B,OAAO,EAClE,CAAC,CACA,KAAK,CAAC,KAAK,QAAQ;GACnB,IAAI;GACJ,MAAO,EAA4B,QAAQ,CAAC;EAC7C,EAAE,CAAC,CACF,MAAM,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;CAC1C,EAAE,CAAC,CACF,MAAM,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAC1C;;;;;AAMA,SAAgB,SACf,KAGA,MAAyB,QAAQ,KACxB;CACT,MAAM,QAAQ,IAAI,UAAU,SAAS;CACrC,MAAM,cACL,SAAS,OAAO,UAAU,YAAY,YAAY,QAC9C,MAA8B,SAC/B,KAAA;CACJ,MAAM,SACL,IAAI,OAAO,UACX,eACA,IAAI,YAAY,UAChB,IAAI,cACJ,IAAI;CACL,IAAI,CAAC,QAAQ,MAAM,IAAIC,kBAAAA,iBAAiB,IAAI,KAAK;CACjD,OAAO;AACR;;;;;;;AAQA,SAAgB,gBACf,QACA,QACA,UACS;CACT,IAAI,UAAU,OAAO,GAAG,SAAS,QAAQ,QAAQ,EAAE,EAAE,GAAG;CACxD,OAAO,WAAW,OAAO,MAAM,OAAO;AACvC;;AAGA,SAAS,UAAU,OAAwB;CAC1C,MAAM,IAAI;CACV,OAAO,GAAG,QAAQ,GAAG,QAAQ;AAC9B;;AAGA,eAAe,OACd,MACA,SACyB;CACzB,IAAI;EACH,OAAO,MAAM,KAAK;CACnB,SAAS,OAAO;EACf,IAAI,QAAQ,SAAS,UAAU,KAAK,CAAC,GAAG,OAAO,KAAA;EAC/C,MAAM;CACP;AACD;AAkBA,MAAa,iBAAkC,OAAO,YAAY,WAAW;CAC5E,MAAM,KAAK,MAAM,OAAO;CACxB,MAAM,MAAM,MAAM,OAAO;CACzB,MAAM,SAAS,MAAM,gBAAgB,YAAY,MAAM;CACvD,MAAM,WAAW,YAAY,QAAQ,KAAK,IAAI;CAC9C,OAAO;EACN;EACA;EACA,IAAI,IAAI,GAAG,SAAS;GACnB,GAAG;GACH,GAAI,WAAW;IAAE;IAAU,gBAAgB;GAAK,IAAI,CAAC;EACtD,CAAC;EACD,KAAK,IAAI,IAAI,UAAU,MAAM;EAC7B;EACA,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CAChC;AACD;;AAGA,IAAI,cAA+B;AASnC,eAAe,SAAS,KAAyB;CAChD,MAAM,SAAS,SAAS,GAAG;CAC3B,MAAM,UAAU,MAAM,YAAY,IAAI,YAAY,MAAM;CACxD,KAAK,MAAM,aAAa,iBAAiB,IAAI,QAAQ,GACpD,MAAM,aAAa,KAAK,SAAS,SAAS;AAE5C;;AAGA,SAAS,aAAa,KAAU,IAAY;CAC3C,OAAO;EACN;GAAE,KAAK;GAAa,OAAO,IAAI,SAAS;EAAI;EAC5C;GAAE,KAAK;GAAW,OAAO,IAAI;EAAM;EACnC;GAAE,KAAK;GAAe,OAAO;EAAG;CACjC;AACD;AAEA,eAAe,aACd,KACA,SACA,WACgB;CAChB,MAAM,EAAE,OAAO;CACf,MAAM,YAAY;EACjB,OAAO,IAAI,SAAS;EACpB,OAAO,IAAI;EACX,IAAIC,eAAAA,OAAO,EAAE;CACd;CACA,MAAM,aAAa,IAAI,OAAO,cAAc,UAAU;CACtD,MAAM,OAAO,CAAC,GAAG,IAAI,IAAI,UAAU,QAAQ,SAAS,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;CAEzE,MAAM,EAAE,QAAQ,WAAW,MAAM,iBAChC,KACA,SACA,IACAC,cAAAA,WAAW,SAAS,CACrB;CACA,MAAM,qBAAqB,KAAK,SAAS;EACxC;EACA;EACA;EACA;EACA;CACD,CAAC;CASD,MAAM,gBAAgB,KAAK,SAAS;EAAE;EAAI;EAAQ,GAAG,MAPlC,WAClB,KACA,SACA,IACAC,cAAAA,YAAY,SAAS,GACrB,WAAW,QAAQ,EAAE,WAAW,CAAC,CAClC;CAC0D,CAAC;CAI3D,MAAM,YAAY,gBAAgB,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;CAC1E,KAAK,MAAM,UAAU,UAAU,SAAS;EACvC,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,OAAO,IAAI,KAAK;EACvC,MAAM,QAAoB;GAAE,KAAK,eAAe,OAAO;GAAM,MAAM;EAAM;EACzE,MAAM,WAAW,IAAI,MAAM,OAAO,MAAM,GAAG,CAAC,EAAE;EAC9C,MAAM,UAAU,IAAI,QAAQ;EAC5B,IAAI,YAAY,WAAW;GAC1B,MAAM,IAAI,MAAM,MAAM,OAAO,SAAS;GACtC;EACD;EACA,IAAI,YAAY,KAAA,KAAa,YAAY,UAAU;GAClD,IAAI,IACH,MAAM,IAAI,aAAa,QAAQ,kDAAkD,WAClF;GACA;EACD;EACA,MAAM,IAAI,OACT;GAAE,WAAW,OAAO;GAAI,UAAU;GAAK,QAAQ,UAAU;EAAY,GACrE,YAAY;GACX,MAAM,IAAI,aAAa,GAAG,MAAM,UAAU,CAAC;GAC3C,MAAM,IAAI,MAAM,MAAM,OAAO,SAAS;EACvC,CACD;CACD;AACD;;;;;AAMA,eAAe,iBACd,KACA,SACA,IACA,MAC+C;CAC/C,MAAM,EAAE,IAAI,IAAI,WAAW;CAC3B,MAAM,MAAM,aAAa;CACzB,MAAM,SAAS,IAAI,MAAM,OAAO,GAAG;CACnC,MAAM,SAAS,UAA8B;EAC5C;EACA,MAAM;EACN,MAAM;GAAE;GAAM;EAAO;CACtB;;CAGA,MAAM,QAAQ,OAAO,SAAqD;EACzE,IAAI;GACH,MAAM,GAAG,KAAK,IAAI,GAAG,kBAAkB,EAAE,QAAQ,KAAK,CAAC,CAAC;GACxD,OAAO;EACR,SAAS,OAAO;GACf,MAAM,OAAO,UAAU,KAAK;GAC5B,IAAI,SAAS,cAAc,SAAS,gBAAgB,OAAO;GAC3D,IAAI,SAAS,eAAe,SAAS,gBAAgB,OAAO;GAC5D,MAAM;EACP;CACD;CAEA,MAAM,SAAS,OACd,SAC2C;EAC3C,IAAI,IAAI,QAAQ;GACf,MAAM,QAAQ,MAAM,MAAM,IAAI;GAC9B,IAAI,UAAU,QAAQ;IACrB,MAAM,IAAI,OACT;KACC,WAAW;KACX,UAAU,UAAU;KACpB,QAAQ,aAAa;IACtB,GACA,YAAY,CAAC,CACd;IACA,OAAO;GACR;GACA,OAAO;EACR;EACA,MAAM,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;EACnC,IAAI;GACH,MAAM,GAAG,KACR,IAAI,GAAG,oBAAoB;IAC1B,QAAQ;IAER,GAAI,WAAW,cACZ,CAAC,IACD,EACA,2BAA2B,EAC1B,oBACC,OACF,EACD;GACH,CAAC,CACF;EACD,SAAS,OAAO;GACf,MAAM,OAAO,UAAU,KAAK;GAC5B,IAAI,SAAS,2BAA2B,OAAO;GAC/C,IAAI,SAAS,uBAAuB,OAAO;GAC3C,MAAM;EACP;EACA,MAAM,IAAI,OACT;GACC,WAAW;GACX,UAAU,UAAU;GACpB,QAAQ,aAAa;EACtB,GACA,YAAY,CAAC,CACd;EACA,OAAO;CACR;CAEA,MAAM,QAAQ,OAAO,SAAgC;EAKpD,MAAM,SAAQ,MAJK,aACZ,GAAG,KAAK,IAAI,GAAG,wBAAwB,EAAE,QAAQ,KAAK,CAAC,CAAC,GAC9D,CAAC,gBAAgB,mBAAmB,CACrC,EAAA,EACoB,QAAQ,MAAM,MAAM,EAAE,QAAQ,WAAW,CAAC,EAAE;EAChE,IAAI,SAAS,UAAU,IAAI,SAAS,KACnC,MAAM,IAAIC,kBAAAA,4BAA4B,MAAM,OAAO,IAAI,SAAS,GAAG;CAErE;CAIA,IAAI,QAAQ,WAAW,WAAW,OAAO,IAAI;EAC5C,MAAM,QAAQ,MAAM,MAAM,OAAO,EAAE;EACnC,IAAI,UAAU,QAAQ,OAAO;GAAE,QAAQ,OAAO;GAAI,QAAQ;EAAK;EAC/D,IAAI,UAAU,SAAS,MAAM,IAAIC,kBAAAA,0BAA0B,IAAI,OAAO,EAAE;EACxE,MAAM,OAAO,MAAM,OAAO,OAAO,EAAE;EACnC,IAAI,SAAS,SAAS,MAAM,IAAIA,kBAAAA,0BAA0B,IAAI,OAAO,EAAE;EACvE,IAAI,CAAC,IAAI,QAAQ,MAAM,IAAI,MAAM,MAAM,MAAM,OAAO,EAAE,GAAG,OAAO,EAAE;EAClE,OAAO;GAAE,QAAQ,OAAO;GAAI,QAAQ,SAAS;EAAO;CACrD;CAGA,MAAM,UAAU,QAAQ,MAAM;CAC9B,MAAM,QAAQ;EACb,GAAI,OAAO,YAAY,YAAY,YAAY,OAAO,CAAC,OAAO,IAAI,CAAC;EACnE;EACA,GAAG,MAAM,KAAK,EAAE,QAAA,EAAwB,SACvCC,cAAAA,mBAAmB,MAAMC,cAAAA,aAAa,CAAC,CACxC;CACD;CACA,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,QAAQ,OAAO;EACzB,MAAM,KAAK,IAAI;EACf,MAAM,OAAO,MAAM,OAAO,IAAI;EAC9B,IAAI,SAAS,SAAS;EACtB,IAAI,SAAS,QAAQ,MAAM,MAAM,IAAI;EACrC,IAAI,CAAC,IAAI,QAAQ,MAAM,IAAI,MAAM,MAAM,MAAM,IAAI,GAAG,IAAI;EACxD,IAAI,SAAS,MACZ,IAAI,IACH,OAAO,KAAK,kCAAkC,GAAG,QAAQ,KAAK,iCAC/D;EAED,OAAO;GAAE,QAAQ;GAAM,QAAQ,SAAS;EAAO;CAChD;CACA,MAAM,IAAIC,kBAAAA,sBACT,IACA,MAAM,QAAQ,MAAM,MAAM,OAAO,CAClC;AACD;;AAGA,eAAe,qBACd,KACA,SACA,OAQgB;CAChB,MAAM,EAAE,IAAI,OAAO;CACnB,MAAM,EAAE,IAAI,WAAW;CACvB,MAAM,SAAS;CAGf,MAAM,QAAQ,IAAI,UAAU,CAAC,MAAM;CACnC,MAAM,OAAO,OACZ,IACA,YAC6B,QAAQ,KAAA,IAAY,OAAO,IAAI,OAAO;CACpE,MAAM,OAAO,QAAgB,UAC5B,IAAI,OAAO;EAAE,WAAW;EAAI,UAAU,UAAU;EAAU;CAAO,SAChE,MAAM,CAAC,CAAC,WAAW,KAAA,CAAS,CAC7B;CAGD,MAAM,SAAS,MAAM,WACd,GAAG,KAAK,IAAI,GAAG,wBAAwB,EAAE,OAAO,CAAC,CAAC,GACxD,CAAC,gBAAgB,mBAAmB,CACrC;CACA,MAAM,OAAO,aAAa,KAAK,EAAE;CACjC,MAAM,UAAU,QAAQ,UAAU,CAAC,EAAA,CAAG,QACpC,MAAM,CAAC,KAAK,MAAM,MAAM,EAAE,QAAQ,EAAE,GAAG,CACzC;CAIA,IAHmB,KAAK,MACtB,MAAM,CAAC,QAAQ,QAAQ,MAAM,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAE9D,GACZ,MAAM,IAAI,aACT,GAAG,KACF,IAAI,GAAG,wBAAwB;EAC9B;EACA,SAAS,EACR,QAAQ,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO;GACxC,KAAK,EAAE;GACP,OAAO,EAAE;EACV,EAAE,EACH;CACD,CAAC,CACF,CACD;CAGD,MAAM,SAAS,MAAM,KAAK,SAAS;CACnC,MAAM,QAAQ,kBAAkB,MAAM;CACtC,MAAM,cAAc,YAAY;EAK/B,MAAM,OAAM,MAJU,WACf,GAAG,KAAK,IAAI,GAAG,4BAA4B,EAAE,OAAO,CAAC,CAAC,GAC5D,CAAC,sCAAsC,CACxC,EAAA,EACqB;EAMrB,IAAI,EAJH,OACC,OAAO,KAAK,KAAK,CAAC,CAA4B,OAC7C,OAAO,IAAI,MAAM,WAAW,MAAM,EACpC,IAEA,MAAM,IACL,SACG,gEACA,iCAEF,GAAG,KACF,IAAI,GAAG,4BAA4B;GAClC;GACA,gCAAgC;EACjC,CAAC,CACF,CACF;CAEF;CAEA,MAAM,SAAS,aAAa,QAAQ,MAAM,IAAI;CAC9C,MAAM,eAAe,YAAY;EAChC,MAAM,UAAU,MAAM,WACf,GAAG,KAAK,IAAI,GAAG,uBAAuB,EAAE,OAAO,CAAC,CAAC,GACvD,CAAC,oBAAoB,CACtB;EAIA,IAAI,EAFH,SAAS,WAAW,KAAA,KACpB,gBAAgB,KAAK,MAAM,QAAQ,MAAM,CAAC,MAAM,gBAAgB,MAAM,IAEtE,MAAM,IACL,SACG,oCAAoC,MAAM,KAAK,KAAK,IAAI,MACxD,0BAEF,GAAG,KACF,IAAI,GAAG,uBAAuB;GAC7B;GACA,QAAQ,KAAK,UAAU,MAAM;EAC9B,CAAC,CACF,CACF;CAEF;CAKA,IAAI,QAAQ;EACX,MAAM,YAAY;EAClB,MAAM,aAAa;CACpB,OAAO;EACN,MAAM,aAAa;EACnB,MAAM,YAAY;CACnB;CAYA,KAJC,MALwB,WAClB,GAAG,KAAK,IAAI,GAAG,2BAA2B,EAAE,OAAO,CAAC,CAAC,GAC3D,CAAC,gDAAgD,CAClD,EAAA,EAEa,mCAAmC,QAAQ,EAAE,EACtD,oCAAoC,iBAGtB,YAAY,CAAC,OAC9B,MAAM,IAAI,qCACT,GAAG,KACF,IAAI,GAAG,2BAA2B;EACjC;EACA,mCAAmC,EAClC,OAAO,CACN,EACC,oCAAoC,EAAE,cAAc,SAAS,EAC9D,CACD,EACD;CACD,CAAC,CACF,CACD;CASD,MAAM,UAAS,MAJU,WAClB,GAAG,KAAK,IAAI,GAAG,2BAA2B,EAAE,OAAO,CAAC,CAAC,GAC3D,CAAC,CACF,EAAA,EAC2B;CAC3B,IAAI,MAAM,cAAc,WAAW,WAClC,MAAM,IAAI,2BACT,GAAG,KACF,IAAI,GAAG,2BAA2B;EACjC;EACA,yBAAyB,EAAE,QAAQ,UAAU;CAC9C,CAAC,CACF,CACD;MACM,IAAI,CAAC,MAAM,cAAc,WAAW,WAC1C,MAAM,IAAI,4BACT,GAAG,KACF,IAAI,GAAG,2BAA2B;EACjC;EACA,yBAAyB,EAAE,QAAQ,YAAY;CAChD,CAAC,CACF,CACD;CAID,MAAM,EAAE,SAAS,eAAe,cAAc;EAC7C,WAAW,IAAI;EACf,UAAU,IAAI;EACd,WAAW,IAAI;EACf,OAAO,IAAI;EACX,QAAQ;CACT,CAAC;CACD,IAAI,WAAW,SAAS,GACvB,IAAI,IACH,MAAM,WAAW,KAAK,IAAI,EAAE,GAAG,WAAW,WAAW,IAAI,QAAQ,OAAO,kBAAkB,IAAI,MAAM,aAAa,IAAI,MAAM,QAAQ,WAAW,WAAW,IAAI,OAAO,MAAM,WAAW,OAAO,SAC7L;CAED,IAAI,QAAQ,WAAW,GAAG;CAC1B,MAAM,OAAO,SAAS,OAAO;CAC7B,MAAM,OAAO,MAAM,WACZ,GAAG,KAAK,IAAI,GAAG,qBAAqB,EAAE,OAAO,CAAC,CAAC,GACrD,CAAC,yBAAyB,CAC3B;CAIA,IAAI,EAFH,MAAM,WAAW,WAAW,KAC5B,cAAc,KAAK,UAAU,EAAG,MAAM,cAAc,IAAI,IAExD,MAAM,IAAI,YAAY,QAAQ,KAAK,IAAI,WACtC,GAAG,KACF,IAAI,GAAG,qBAAqB;EAC3B;EACA,mBAAmB,EAAE,WAAW,CAAC,IAAI,EAAE;CACxC,CAAC,CACF,CACD;AAEF;AAEA,SAAS,cAAc,MAAiC;CACvD,MAAM,UAAU,SAAoB,CAAC,GAAI,QAAQ,CAAC,CAAE,CAAC,CAAC,KAAK;CAC3D,OAAO,KAAK,UAAU;EACrB,gBAAgB,OAAO,KAAK,cAAc;EAC1C,gBAAgB,OAAO,KAAK,cAAc;EAC1C,gBAAgB,OAAO,KAAK,cAAc;EAC1C,eAAe,OAAO,KAAK,aAAa;EACxC,eAAe,KAAK,iBAAiB;CACtC,CAAC;AACF;;AAGA,eAAe,WACd,KACA,SACA,IACA,MACA,QAC6C;CAC7C,MAAM,EAAE,KAAK,QAAQ;CACrB,MAAM,QAAoB;EAAE,KAAK,YAAY;EAAM,MAAM;CAAW;CACpE,MAAM,QAAQ,MAAM,aACb,IAAI,KAAK,IAAI,IAAI,eAAe,EAAE,UAAU,KAAK,CAAC,CAAC,GACzD,CAAC,gBAAgB,uBAAuB,CACzC;CAEA,IAAI,OAAO,MAAM;EAChB,MAAM,OAAO,MAAM,IAAI,KACtB,IAAI,IAAI,oBAAoB,EAAE,UAAU,KAAK,CAAC,CAC/C;EACA,MAAM,OAAO,QAAgB,KAAK,MAAM,MAAM,MAAM,EAAE,QAAQ,GAAG,CAAC,EAAE;EACpE,IACC,MAAM,KAAK,SAAA,WACX,IAAA,aAAe,MAAM,IAAI,SAAS,OAClC,IAAA,WAAa,MAAM,IAAI,OAEvB,MAAM,IAAIC,kBAAAA,gBAAgB,MAAM,IAAI,SAAS,KAAK,IAAI,KAAK;EAE5D,MAAM,IAAI,MAAM,MAAM,OAAO,IAAI;CAClC,OACC,MAAM,IAAI,OACT;EACC,WAAW;EACX,UAAU,YAAY;EACtB,QAAQ,gBAAgBC,cAAAA;CACzB,GACA,YAAY;EACX,MAAM,IAAI,MAAM,QAAQ,KAAK;EAC7B,MAAM,IAAI,KACT,IAAI,IAAI,kBAAkB;GACzB,UAAU;GACV,MAAMA,cAAAA;GACN,MAAM,aAAa,KAAK,EAAE;EAC3B,CAAC,CACF;EACA,MAAM,IAAI,MAAM,MAAM,OAAO,IAAI;CAClC,CACD;CAGD,MAAM,SAAS,QAAQ,OAAO,IAAI,KAAK,CAAC,IAAI;CAC5C,MAAM,UAAU,SACb,MAAM,aAEL,IAAI,KACH,IAAI,IAAI,qBAAqB;EAC5B,UAAU;EACV,YAAYC,cAAAA;CACb,CAAC,CACF,GACD,CAAC,gBAAgB,uBAAuB,CACzC,IACC,KAAA;CACH,MAAM,WAAW,SAAS,iBACvB,KAAK,MAAM,aAAa,QAAQ,cAAc,CAAC,IAC/C,KAAA;CACH,IAAI,CAAC,YAAY,gBAAgB,QAAQ,MAAM,gBAAgB,MAAM,GACpE,MAAM,IAAI,OACT;EACC,WAAW;EACX,UAAU,YAAY;EACtB,QAAQ,UAAUA,cAAAA,gBAAgB;CACnC,GACA,YAAY;EACX,MAAM,IAAI,KACT,IAAI,IAAI,qBAAqB;GAC5B,UAAU;GACV,YAAYA,cAAAA;GACZ,gBAAgB,KAAK,UAAU,MAAM;EACtC,CAAC,CACF;CACD,CACD;CAED,OAAO;EAAE;EAAM;CAAO;AACvB;;AAGA,SAAS,aAAa,UAA0B;CAC/C,IAAI;EACH,OAAO,mBAAmB,QAAQ;CACnC,QAAQ;EACP,OAAO;CACR;AACD;;;;;;;;;;;AAYA,eAAe,gBACd,KACA,SACA,OACgB;CAChB,MAAM,EAAE,KAAK,QAAQ;CACrB,MAAM,EAAE,IAAI,QAAQ,SAAS;CAC7B,MAAM,UAAA,GAASR,oBAAAA,WAAAA,CAAW,IAAI,KAAK;CACnC,MAAM,WAAW,kBAAkB;CACnC,MAAM,SAAS,IAAI,MAAM,OAAO,QAAQ;CAExC,MAAM,QAAQ,IAAI,QAAQ;CAC1B,IAAI;CACJ,IAAI,UAAU,KAAA,GAAW;EACxB,IAAI;EACJ,IAAI;GACH,SAASS,0BAAM,MAAM,KAAK;EAC3B,QAAQ;GACP,SAAS,KAAA;EACV;EACA,IAAI,QAAQ,WAAW,QACtB,MAAM,IAAIC,kBAAAA,sBACT,QACA,QACA,QAAQ,UAAU,MAAM,QAAQ,cAAc,IAAI,GAClD,IAAI,KACL;EAED,QAAQ,OAAO;CAChB;CAEA,MAAM,SAAS,MAAM,UAElB,MAAM,IAAI,KAAK,IAAI,IAAI,sBAAsB,EAAE,UAAU,KAAK,CAAC,CAAC,EAAA,CAC/D,mBAAmB,KAAK,MAAM,EAAE,WAAY,KAAK,CAAC,IACnD,CAAC;CAEJ,IAAI,UAAU,QAAQ,WAAW,UAAU,OAAO,KAAK,KAAA;CACvD,IAAI,WACH,OAAO,QAAQ,MAAM,aAAa,WAC/B,OAAO,KAAK,WACZ,KAAA;CACJ,MAAM,YACL,OAAO,QAAQ,MAAM,cAAc,WAChC,OAAO,KAAK,YACZ,KAAA;CACJ,MAAM,SAAS,OAAgC,CAAC,OAAmB;EAClE,KAAK;EACL,MAAM;EACN,MAAM;GAAE;GAAM,GAAG;EAAK;CACvB;CAGA,IAAI,YAAY,SAAS;EACxB,MAAM,WACL,cAAc,KAAA,KACd,IAAI,MAAM,mBAAmB,KAAA,KAC7B,IAAI,MAAM,iBAAiB;EAC5B,IAAI,IAAI,iBAAiB,UAAU;GAClC,MAAM,MAAM;GACZ,MAAM,OAAO;GACb,MAAM,IAAI,OACT;IACC,WAAW;IACX,UAAU,YAAY;IACtB,QAAQ,qCAAqC;GAC9C,GACA,YAAY;IACX,IAAI,OAAO,SAAS,GAAG,GACtB,MAAM,IAAI,KACT,IAAI,IAAI,uBAAuB;KAC9B,UAAU;KACV,aAAa;IACd,CAAC,CACF;IAED,MAAM,IAAI,MAAM,MAAM,MAAM,GAAG,IAAI;GACpC,CACD;GACA,WAAW,KAAA;EACZ,OACC,IAAI,IACH,MAAM,GAAG,uBAAuB,SAAS,uBAAuB,IAAI,MAAM,kGAC3E;CAEF;CAGA,IAAI,CAAC,WAAW,SAAS,OAAO,SAAS,KAAK,GAAG;EAChD,MAAM,IAAI,MAAM,MAAM,MAAM,GAAG,KAAK;EACpC,UAAU;CACX;CAIA,IADC,YAAY,KAAA,KAAa,OAAO,SAAS,OAAO,KAAK,UAAU,WACnD,CAAC,IAAI,YAAY;CAC9B,IAAI,IAAI,cAAc,UACrB,MAAM,IAAIC,kBAAAA,mBAAmB,IAAI,UAAU,IAAI,KAAK;CAGrD,MAAM,WAAW,WAAW,OAAO,SAAS,OAAO,IAAI,UAAU,KAAA;CACjE,IAAI,OAAO,UAAU,GAAG,MAAM,IAAIC,kBAAAA,eAAe,MAAM,MAAM;CAE7D,MAAM,MAAM,CAAC,UACV,yBACA,IAAI,aACH,mCACA;CACJ,MAAM,IAAI,OACT;EAAE,WAAW;EAAI,UAAU,YAAY;EAAQ,QAAQ;CAAI,GAC3D,YAAY;EACX,MAAM,IAAI,MAAM,QAAQ,MAAM,WAAW,EAAE,UAAU,SAAS,IAAI,CAAC,CAAC,CAAC;EAIrE,MAAM,OAAM,MAHU,IAAI,KACzB,IAAI,IAAI,uBAAuB,EAAE,UAAU,KAAK,CAAC,CAClD,EAAA,CACoB;EAGpB,MAAM,IAAI,aAAa,GACrB,SAASH,0BAAM,MAAM;GACrB;GACA,QAAQ,QAAQ;GAChB,GAAI,QAAQ,WACT;IAAE,UAAU,QAAQ;IAAU,gBAAgB;GAAK,IACnD,CAAC;GACJ,aAAa,IAAI;GACjB,iBAAiB,IAAI;EACtB,CAAC,EACF,CAAC;EACD,MAAM,IAAI,MAAM,MACf,MACC,WACG;GAAE,UAAU;GAAU,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAAE,IAC1D,CAAC,CACL,GACA,IAAI,WACL;CACD,CACD;CACA,IAAI,UACH,IAAI,IACH,MAAM,OAAO,yCAAyC,IAAI,MAAM,0DAA0D,UAC3H;AAEF;;;;;;;AAQA,eAAe,SAAS,KAAoD;CAC3E,MAAM,KAAK,MAAM,OAAO;CACxB,KAAK,MAAM,EAAE,QAAQ,iBAAiB,IAAI,QAAQ,GAAG;EACpD,MAAM,MAAM,IAAI,SAAA,GAAQT,oBAAAA,WAAAA,CAAW,IAAI,KAAK;EAC5C,IAAI,QAAQ,KAAA,GAAW;EACvB,MAAM,UAAUS,0BAAM,MAAM,GAAG;EAC/B,IAAI,CAAC,QAAQ,eAAe,CAAC,QAAQ,iBAAiB;EACtD,MAAM,SAAS,IAAI,GAAG,SAAS;GAC9B,QAAQ,QAAQ,UAAU,IAAI,OAAO,UAAU;GAC/C,aAAa;IACZ,aAAa,QAAQ;IACrB,iBAAiB,QAAQ;GAC1B;GACA,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;GACzD,GAAI,QAAQ,iBAAiB,EAAE,gBAAgB,KAAK,IAAI,CAAC;EAC1D,CAAC;EACD,IAAI;GACH,MAAM,OAAO,KAAK,IAAI,GAAG,kBAAkB,EAAE,QAAQ,QAAQ,OAAO,CAAC,CAAC;EACvE,SAAS,OAAO;GACf,MAAM,OAAO,UAAU,KAAK;GAC5B,MAAM,IAAII,kBAAAA,6BACT,IACA,QAAQ,QACR,IAAI,OACJ,SAAS,aACN,sBACA,SAAS,cACR,uBACA,QAAQ,OAAO,KAAK,CACzB;EACD,UAAU;GACT,OAAO,QAAQ;EAChB;CACD;AACD;;;;;;;;ACx6BA,MAAa,oBAIT,EACH,SAAS,EAAE,IAAI;CDs6Bf,MAAM;CACN,MAAM;CACN,OAAOC,kBAAAA;CACP,cAAcC,kBAAAA;CACd,aAAa;CACb,YAAY,UAAU;EACrB,OAAO,iBAAiB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAA,GAChDf,oBAAAA,WAAAA,CAAW,EAAE,IAAI,KAAK,GACtB,GAAG,EAAE,QAAQ,KAAK,OAAA,GAAMA,oBAAAA,WAAAA,CAAW,EAAE,IAAI,KAAK,CAAC,CAChD,CAAC;CACF;CACA,QAAQ;CACR,QAAQ;ACl7BO,EAAW,EAC3B;;AAGA,SAAgB,gBACf,MACA,MACyC;CACzC,OAAO,OAAO,OAAO,kBAAkB,OAAO,IAAI,IAC/C,kBAAkB,KAAK,CAAC,QACxB,KAAA;AACJ;;;;ACqBA,SAAS,aAAa,UAA6B,MAAoB;CACtE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAC7B,QAAQ,GAAG,OAAO,EAAE,SAAS,IAAI,CAAC,CAClC,KAAK,CAAC,QAAQ,EAAE,CAAC,CACjB,KAAK;AACR;;;;;;;;AAiBA,eAAsB,qBACrB,OACoB;CACpB,cAAA,4BAA4B,MAAM,WAAW,MAAM,UAAU,MAAM,KAAK;CACxE,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,QAAQgB,cAAAA,gBAAgB;EAClC,IAAI,aAAa,MAAM,UAAU,IAAI,CAAC,CAAC,WAAW,GAAG;EACrD,MAAM,SAASC,kBAAAA,cAAc,MAAM,WAAW,MAAM,MAAM,KAAK;EAC/D,IAAI,OAAO,SAAS,YAAY;EAChC,MAAM,WAAW,gBAAgB,MAAM,OAAO,IAAI;EAClD,MAAM,SAAS,OAAO;GACrB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,OAAO,MAAM;GACb,QAAQ,OAAO;GACf,SAAS,MAAM;EAChB,CAAC;EACD,SAAS,KAAK,GAAG,KAAK,IAAI,SAAS,MAAM;CAC1C;CACA,OAAO;AACR;;;;;AAgDA,IAAa,6BAAb,cAAgDC,eAAAA,SAAS;CAE9C;CACA;CACA;CAEA;CAEA;CAEA;CAEA;CAXV,YACC,OACA,MACA,UAEA,KAEA,KAEA,UAEA,OACC;EACD,MACC,UAAU,KAAK,GAAG,MAAM,MAAM,SAAS,+BACnC,IAAI,KAAK,IAAI,EAAE,GAAG,IAAI,WAAW,IAAI,OAAO,MAAM,iBACjD,MAAM,eAAe,IAAI,WAAW,IAAI,YAAY,aAAa,8CACvB,SAAS,sDACb,cACzC,QAAQ,iCAAiC,UAAU,MACpD,4FACsC,MAAM,uIAEK,KAAK,GAAG,MAAM,gBACjE;EAvBS,KAAA,QAAA;EACA,KAAA,OAAA;EACA,KAAA,WAAA;EAEA,KAAA,MAAA;EAEA,KAAA,MAAA;EAEA,KAAA,WAAA;EAEA,KAAA,QAAA;EAcT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,eACrB,SACwB;CACxB,MAAM,EAAE,WAAW,OAAO,aAAa;CACvC,MAAM,SAAS,QAAQ,WAAW;CAClC,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,MAAM,QAAQ,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAC9D,MAAM,YAAY,QAAQ,aAAa,CAAC;CAExC,MAAM,UAAwB,CAAC;CAC/B,MAAM,aAMA,CAAC;CAEP,KAAK,MAAM,QAAQF,cAAAA,gBAAgB;EAClC,MAAM,SAASC,kBAAAA,cAAc,WAAW,MAAM,KAAK;EACnD,IAAI,OAAO,SAAS,YAAY;GAC/B,QAAQ,KAAK;IAAE;IAAM,MAAM,OAAO;IAAM,SAAS,CAAC;IAAG,SAAS,CAAC;GAAE,CAAC;GAClE;EACD;EACA,MAAM,WAAW,gBAAgB,MAAM,OAAO,IAAI;EAClD,MAAM,SAAqB;GAC1B;GACA,MAAM;GACN,UAAU,SAAS;GACnB,SAAS,CAAC;GACV,SAAS,CAAC;EACX;EACA,QAAQ,KAAK,MAAM;EACnB,MAAM,MAAM,aAAa,UAAU,IAAI;EACvC,IAAI,IAAI,WAAW,GAAG;EAEtB,MAAM,aAAa,MAAM,SAAS,YAAY;GAC7C;GACA;GACA,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;GACtD,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;EAC9C,CAAC;EACD,IAAI,eAAe,KAAA,GAClB,MAAM,IAAI,2BACT,OACA,MACA,SAAS,MACT,KACA,SAAS,aAAa,KACtB,SAAS,aAAa,UACtB,SAAS,aAAa,KACvB;EAED,WAAW,KAAK;GACf;GACA;GACA,QAAQ,OAAO;GACf;GACA;EACD,CAAC;CACF;CAEA,IAAI,WAAW,WAAW,GAAG,OAAO;CAEpC,MAAM,WAAWE,cAAAA,eAAe,WAAW,KAAK;CAChD,IAAI,WAAW,MAAM,QAAQ,QAAQ,KAAK,EAAA,EAAI,UAAU,CAAC;CACzD,KAAK,MAAM,SAAS,YACnB,MAAM,OAAO,UAAU,MAAM,SAC3B,YAAY,QAAQ,CAAC,CACrB,QAAQ,QAAQ,QAAQ,SAAS,KAAA,CAAS;CAG7C,MAAM,QAAwB,SAC3B,MAAM,cAAc,QAAQ,OAAO,KAAK,IACxC,aACA,MAAM,cAAc,KAAK,QAAQ,OAAO,aACvCC,cAAAA,mBAAmB,SAAS,IACzBC,cAAAA,mBAAmB,KAAK,IACxBC,cAAAA,iBAAiB,OAAO,IAAI,EAAE,CAClC,CACD;CAEF,MAAM,eAAe,OAAO,WAAmC;EAC9D,IAAI,QAAQ;EACZ,MAAM,SAAU,MAAM,QAAQ,QAAQ,KAAK,KAAMC,cAAAA,iBAAiB,KAAK;EACvE,MAAM,OAAO;GACZ,GAAG;GACH,QAAQ;IAAE,GAAG,OAAO;IAAQ,GAAG;GAAO;GACtC,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC;EACA,MAAM,QAAQ,QAAQ,MAAM,IAAI;EAChC,UAAU,KAAK;CAChB;CAEA,KAAK,MAAM,SAAS,YAAY;EAC/B,IACC,OAAO,MAAM,KAAK,IAAI,MAAM,SAAS,OAAO,SAAS,eAAe,IACrE;EACA,MAAM,MAAM,SAAS,OAAO;GAC3B;GACA;GACA;GACA;GACA;GACA,QAAQ,MAAM;GACd,YAAY,MAAM;GAClB,IAAI,UAAU;IACb,OAAO;GACR;GACA;GACA;GACA,YAAY,QAAQ,eAAe;GACnC,eAAe,QAAQ,kBAAkB;GACzC,MAAM,OAAO,QAAQ,OAAO;IAC3B,IAAI,CAAC,QAAQ,MAAM,MAAM;IACzB,MAAM,OAAO,QAAQ,KAAK,MAAM;IAChC,IACC,MAAM,SAAS,WAAW,KAAK,OAAO,OAAO,KAAK,OAAO,UAC1D;GACD;GACA;GACA;EACD,CAAC;EACD,IAAI,MAAM,OAAO,QAAQ,WAAW,GACnC,IAAI,eAAe;CAErB;CAEA,OAAO;AACR;;AAGA,SAAS,aAAa,SAAwC;CAC7D,OAAO;EACN,SAAS,QAAQ,QAAQ,OAAO,GAAG;EACnC,UAAU,UAAU,QAAQ,QAAQ,KAAK;EACzC,QAAQ,OAAO,OAAO,QAAQ,MAAM,OAAO,EAAE;EAC7C,gBAAgB,QAAQ,UAAU,QAAQ,MAAM,iBAAiB,KAAA;CAClE;AACD;;AAGA,eAAe,cACd,OACA,OAC0B;CAC1B,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK;CACrC,OAAO;EACN,SAAS,QAAQ,QAAQ,UAAU;EACnC,SAAS,YAAY,CAAC;EACtB,OAAO,YAAY,CAAC;EACpB,GAAI,SAAS,EAAE,gBAAgB,OAAO,MAAM,eAAe,IAAI,CAAC;CACjE;AACD"}