@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/dist/state/azure-blob.js

@@ -0,0 +1,201 @@
+/**
+ * Azure Blob Storage for an azurerm backend's state, over its REST API with
+ * `fetch` and `node:crypto`: a blob's properties and metadata, its text, a
+ * write (under a lease when one holds it), a snapshot, a delete, and the
+ * blob lease the backend locks a state with.
+ *
+ * Requests are signed with Shared Key for an account key, carry a SAS as it
+ * is, or carry a storage token the job's OIDC identity is traded for at Entra
+ * ID (a client assertion, the way the azurerm backend does it).
+ *
+ * Lifted from terragucci's `report/azure-blob.ts` (c493e0e), without SAS
+ * links, version reads and version listing.
+ */
+import { createHmac } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { defaultFetch, encodePath, StoreError, xmlText } from "./object-store.js";
+/** The REST version every request names. */
+export const AZURE_VERSION = "2021-08-06";
+/** Entra ID's public cloud. */
+export const AZURE_AUTHORITY = "https://login.microsoftonline.com";
+const STORAGE_SCOPE = "https://storage.azure.com/.default";
+const hmac64 = (key, s) => createHmac("sha256", Buffer.from(key, "base64")).update(s, "utf8").digest("base64");
+/** The headers whose values Shared Key signs by position, in order. */
+const SIGNED = ["content-encoding", "content-language", "content-length", "content-md5", "content-type", "date", "if-modified-since", "if-match", "if-none-match", "if-unmodified-since", "range"];
+/** The Shared Key Authorization header for a request. */
+export function sharedKey(account, accountKey, method, rawUrl, headers) {
+    const url = new URL(rawUrl);
+    const h = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]));
+    const fixed = SIGNED.map((n) => (n === "content-length" && h[n] === "0" ? "" : (h[n] ?? "")));
+    const ms = Object.keys(h).filter((n) => n.startsWith("x-ms-")).sort().map((n) => `${n}:${h[n].trim()}\n`).join("");
+    const params = new Map();
+    for (const [k, v] of url.searchParams)
+        params.set(k.toLowerCase(), [...(params.get(k.toLowerCase()) ?? []), v]);
+    const query = [...params.keys()].sort().map((k) => `\n${k}:${params.get(k).sort().join(",")}`).join("");
+    const toSign = [method, ...fixed].join("\n") + "\n" + ms + `/${account}${url.pathname}` + query;
+    return `SharedKey ${account}:${hmac64(accountKey, toSign)}`;
+}
+/** Entra ID's error, or the start of the body. */
+const why = (text) => {
+    try {
+        const j = JSON.parse(text);
+        if (j.error)
+            return [j.error, j.error_description?.split("\r\n")[0]].filter(Boolean).join(": ");
+    }
+    catch {
+        // Not JSON: Blob Storage answers in XML.
+    }
+    return [xmlText(text, "Code"), xmlText(text, "Message")?.split("\n")[0]].filter(Boolean).join(": ") || text.slice(0, 300);
+};
+export class AzureBlobClient {
+    constructor(target, fetchFn = defaultFetch, readToken = (f) => readFileSync(f, "utf-8")) {
+        this.target = target;
+        this.fetchFn = fetchFn;
+        this.readToken = readToken;
+    }
+    where(key) {
+        return `az://${this.target.account}/${this.target.container}/${key}`;
+    }
+    blobUrl(key, query = "") {
+        const t = this.target;
+        const q = [query, "sas" in t ? t.sas.replace(/^\?/, "") : ""].filter(Boolean).join("&");
+        return `${t.endpoint}/${t.container}/${encodePath(key)}${q ? `?${q}` : ""}`;
+    }
+    /** The storage token for the OIDC identity: once per client, again a minute before it expires. */
+    async bearer(o) {
+        const fetchToken = async () => {
+            let assertion;
+            try {
+                assertion = this.readToken(o.tokenFile).trim();
+            }
+            catch (e) {
+                throw new StoreError(`cannot read the OIDC token in ${o.tokenFile}: ${e.message}`);
+            }
+            if (!assertion)
+                throw new StoreError(`the OIDC token file ${o.tokenFile} is empty`);
+            const body = new URLSearchParams({
+                client_id: o.clientId,
+                scope: STORAGE_SCOPE,
+                grant_type: "client_credentials",
+                client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                client_assertion: assertion,
+            }).toString();
+            const res = await this.fetchFn(`${o.authority}/${o.tenantId}/oauth2/v2.0/token`, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body });
+            const text = await res.text();
+            if (!res.ok)
+                throw new StoreError(`Entra ID refused the OIDC token for client ${o.clientId}: ${res.status} ${why(text)}`);
+            let j = {};
+            try {
+                j = JSON.parse(text);
+            }
+            catch {
+                // Reported below as no token.
+            }
+            if (!j.access_token)
+                throw new StoreError(`Entra ID answered client ${o.clientId} without a token`);
+            return { token: j.access_token, expires: Date.now() + Number(j.expires_in ?? 3600) * 1000 };
+        };
+        const again = () => (this.token = fetchToken().catch((e) => {
+            this.token = undefined;
+            throw e;
+        }));
+        let held = await (this.token ?? again());
+        if (held.expires - Date.now() < 60000)
+            held = await again();
+        return held.token;
+    }
+    /** The headers for one request, signed or with the bearer token. */
+    async headers(method, url, extra) {
+        const h = { "x-ms-date": new Date().toUTCString(), "x-ms-version": AZURE_VERSION, ...extra };
+        const t = this.target;
+        if ("accountKey" in t)
+            return { ...h, authorization: sharedKey(t.account, t.accountKey, method, url, h) };
+        if ("sas" in t)
+            return h;
+        return { ...h, authorization: `Bearer ${await this.bearer(t.oidc)}` };
+    }
+    async get(key) {
+        const url = this.blobUrl(key);
+        const res = await this.fetchFn(url, { method: "GET", headers: await this.headers("GET", url, {}) });
+        if (res.status === 404)
+            return undefined;
+        if (!res.ok)
+            throw new StoreError(`GET ${this.where(key)}: ${res.status} ${why(await res.text())}`);
+        return res.text();
+    }
+    /** A blob's properties and metadata, from a HEAD. */
+    async head(key) {
+        const url = this.blobUrl(key);
+        const res = await this.fetchFn(url, { method: "HEAD", headers: await this.headers("HEAD", url, {}) });
+        if (res.status === 404)
+            return { exists: false, metadata: {} };
+        if (!res.ok)
+            throw new StoreError(`HEAD ${this.where(key)}: ${res.status}`);
+        const get = (n) => res.headers?.get(n) ?? undefined;
+        const metadata = {};
+        const all = res.headers;
+        all?.forEach?.((v, k) => {
+            if (k.toLowerCase().startsWith("x-ms-meta-"))
+                metadata[k.toLowerCase().slice("x-ms-meta-".length)] = v;
+        });
+        const etag = get("etag");
+        const leaseState = get("x-ms-lease-state");
+        return { exists: true, ...(etag ? { etag } : {}), ...(leaseState ? { leaseState } : {}), metadata };
+    }
+    /** Take a snapshot of a blob: its id, the time Azure gives it. */
+    async snapshot(key) {
+        const url = this.blobUrl(key, "comp=snapshot");
+        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, { "content-length": "0" }) });
+        if (!res.ok)
+            throw new StoreError(`snapshot of ${this.where(key)}: ${res.status} ${why(await res.text())}`);
+        const id = res.headers?.get("x-ms-snapshot");
+        if (!id)
+            throw new StoreError(`snapshot of ${this.where(key)}: Azure answered without x-ms-snapshot`);
+        return id;
+    }
+    /** Write a block blob with metadata, under a lease when one holds it; with `ifNoneMatch`, only when there is none (false when one was there). */
+    async putBlob(key, body, contentType, options = {}) {
+        const url = this.blobUrl(key);
+        const meta = Object.fromEntries(Object.entries(options.metadata ?? {}).map(([k, v]) => [`x-ms-meta-${k}`, v]));
+        const extra = {
+            "x-ms-blob-type": "BlockBlob",
+            "content-type": contentType,
+            "content-length": String(Buffer.byteLength(body)),
+            ...meta,
+            ...(options.leaseId ? { "x-ms-lease-id": options.leaseId } : {}),
+            ...(options.ifNoneMatch ? { "if-none-match": "*" } : {}),
+        };
+        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, extra), body });
+        if (options.ifNoneMatch && (res.status === 409 || res.status === 412))
+            return false;
+        if (!res.ok)
+            throw new StoreError(`PUT ${this.where(key)}: ${res.status} ${why(await res.text())}`);
+        return true;
+    }
+    /** Delete a blob. One that is not there is deleted already. */
+    async remove(key) {
+        const url = this.blobUrl(key);
+        const res = await this.fetchFn(url, { method: "DELETE", headers: await this.headers("DELETE", url, {}) });
+        if (!res.ok && res.status !== 404)
+            throw new StoreError(`DELETE ${this.where(key)}: ${res.status} ${why(await res.text())}`);
+    }
+    /** A blob lease: acquire one that never expires with the id given (false when one holds it), or release it. */
+    async lease(key, action, id) {
+        const url = this.blobUrl(key, "comp=lease");
+        const extra = { "x-ms-lease-action": action, "content-length": "0", ...(action === "acquire" ? { "x-ms-lease-duration": "-1", "x-ms-proposed-lease-id": id } : { "x-ms-lease-id": id }) };
+        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, extra) });
+        if (action === "acquire" && res.status === 409)
+            return false;
+        if (!res.ok)
+            throw new StoreError(`${action} the lease of ${this.where(key)}: ${res.status} ${why(await res.text())}`);
+        return true;
+    }
+    /** Set a blob's metadata, all of it, under its lease when one holds it. */
+    async setMetadata(key, metadata, leaseId) {
+        const url = this.blobUrl(key, "comp=metadata");
+        const extra = { "content-length": "0", ...Object.fromEntries(Object.entries(metadata).map(([k, v]) => [`x-ms-meta-${k}`, v])), ...(leaseId ? { "x-ms-lease-id": leaseId } : {}) };
+        const res = await this.fetchFn(url, { method: "PUT", headers: await this.headers("PUT", url, extra) });
+        if (!res.ok)
+            throw new StoreError(`set the metadata of ${this.where(key)}: ${res.status} ${why(await res.text())}`);
+    }
+}

package/dist/state/backend.d.ts

@@ -0,0 +1,158 @@
+import { type AzureOidc } from "./azure-blob.js";
+import { type GcsTarget } from "./gcs.js";
+import { type S3Target } from "./s3.js";
+/** The backend `init` recorded: its type and configuration. */
+export interface InitialisedBackend {
+    type: string;
+    config: Record<string, unknown>;
+}
+/** A state in an S3 bucket. */
+export interface S3State {
+    backend: "s3";
+    bucket: string;
+    key: string;
+    region: string;
+    endpoint?: string;
+    /** `use_lockfile = true`: the backend locks with `<key>.tflock` beside the state. */
+    lockfile: boolean;
+    target: S3Target;
+}
+/** A state in a GCS bucket: `<prefix>/<workspace>.tfstate`, locked by `<prefix>/<workspace>.tflock`. */
+export interface GcsState {
+    backend: "gcs";
+    bucket: string;
+    key: string;
+    lock: string;
+    target: GcsTarget;
+}
+/** How a request to Azure Blob Storage is authorized: an account key, a SAS, or the job's OIDC identity. */
+export type AzureAuth = {
+    accountKey: string;
+} | {
+    sas: string;
+} | {
+    oidc: AzureOidc;
+};
+/** A state blob in an Azure storage container, locked by a lease on it. */
+export interface AzureState {
+    backend: "azurerm";
+    account: string;
+    container: string;
+    key: string;
+    /** The backend snapshots the blob before each write (`snapshot = true`). */
+    snapshot: boolean;
+    /** The account's blob endpoint. */
+    endpoint: string;
+    auth: AzureAuth;
+}
+/** A local state file, its path relative to the root (or absolute). */
+export interface LocalState {
+    backend: "local";
+    path: string;
+}
+/** Why chant does not lock or write a root's state. */
+export type StateRefusalKind = "cloud" | "no-lockfile" | "backend" | "config" | "credentials" | "disagree";
+export interface StateRefusal {
+    backend: string;
+    refused: StateRefusalKind;
+    reason: string;
+}
+/** Where a root's state lives, or why chant does not lock it. */
+export type StateObject = S3State | GcsState | AzureState | LocalState | StateRefusal;
+/** A state in a bucket or a container. */
+export type StoredState = S3State | GcsState | AzureState;
+/** A state chant locks and writes. */
+export type LockableState = StoredState | LocalState;
+export declare const isRefused: (o: StateObject) => o is StateRefusal;
+/** Whether the state is in a bucket or a container: s3, gcs or azurerm. */
+export declare const isStored: (o: StateObject) => o is StoredState;
+/** The backend types whose state chant locks and writes itself, s3 only with `use_lockfile = true` (#4437). The one list (chant#4478). */
+export declare const LOCKABLE_BACKENDS: readonly string[];
+/** What a refusal says chant locks, spelled from {@link LOCKABLE_BACKENDS}. */
+export declare const LOCKS: string;
+/** The root's data dir: `TF_DATA_DIR` (relative to the root, as the binary run with `-chdir` reads it), else `.terraform`. */
+export declare function dataDir(dir: string, env?: NodeJS.ProcessEnv): string;
+/** The backend `init` recorded for the root, or undefined when it has not been initialised with one. */
+export declare function initialisedBackend(dir: string, env?: NodeJS.ProcessEnv): InitialisedBackend | undefined;
+/** The workspace the binary runs in: `TF_WORKSPACE`, else the one `workspace select` recorded, else `default`. */
+export declare function workspaceOf(dir: string, env?: NodeJS.ProcessEnv): string;
+/** The S3 key of a workspace's state, as the S3 backend names it: the key in `default`, else `<workspace_key_prefix>/<workspace>/<key>`. */
+export declare function s3StateKey(key: string, workspace: string, prefix?: string): string;
+/**
+ * Whether the root's code has a `cloud` block, over the configuration files
+ * `binary` reads: `.tf` and `.tf.json`, plus `.tofu` and `.tofu.json` for a
+ * tofu or choudoufu root, from the lexicon's one lister (chant#4457).
+ */
+export declare function hasCloudBlock(dir: string, binary?: string): boolean;
+/** Where a root's backend is read from, before `init` runs. */
+export interface DeclaredBackendInput {
+    /** `terraform.roots.<name>.backendConfig`: the `-backend-config` pairs chant's own init passes, last. */
+    backendConfig?: Readonly<Record<string, string>>;
+    /** `terraform.roots.<name>.backendConfigFiles`: the backend-config files chant's own init passes before the pairs (chant#4459), relative to the root. */
+    backendConfigFiles?: readonly string[];
+    /** The job's environment: its `TF_CLI_ARGS` and `TF_CLI_ARGS_init` may carry `-backend-config` flags. */
+    env?: NodeJS.ProcessEnv;
+    /** `terraform.binary`, which says which of the root's files are its code (chant#4457). */
+    binary?: string;
+}
+/** The `-backend-config` flags in `TF_CLI_ARGS` then `TF_CLI_ARGS_init`, in order: `key=value` pairs, and the paths of backend-config files. */
+export declare function cliBackendConfig(env?: NodeJS.ProcessEnv): {
+    pairs: Record<string, string>;
+    files: string[];
+    ordered: Array<{
+        file: string;
+    } | {
+        key: string;
+        value: string;
+    }>;
+};
+/**
+ * The backend the root's code declares, with the `-backend-config` flags of
+ * `TF_CLI_ARGS`, `TF_CLI_ARGS_init` and then `backendConfig` over it, in the
+ * order init applies them: what `init` would record, as far as chant can read
+ * it before init runs. A `cloud` block is `{ type: "cloud" }`. Undefined when
+ * the code declares neither, which init records as no backend (local).
+ */
+export declare function declaredBackend(dir: string, input?: DeclaredBackendInput): InitialisedBackend | undefined;
+/** A root's backend as both sources give it, and the one the verdict reads. */
+export interface BackendReading {
+    /** From the root's code and the `-backend-config` flags, before init. */
+    declared?: InitialisedBackend;
+    /** What `init` recorded. */
+    recorded?: InitialisedBackend;
+    /** The recorded backend when there is one, else the declared one, else local. */
+    backend: InitialisedBackend;
+    /** Why the two disagree, naming both, when both exist and they do. */
+    disagreement?: string;
+}
+/** Where a root's backend is read from: {@link DeclaredBackendInput}, plus what `init` recorded, which the root's data dir holds unless given. */
+export interface ReadBackendInput extends DeclaredBackendInput {
+    /** What `init` recorded; `null` for none. Read from the root's data dir when absent. */
+    recorded?: InitialisedBackend | null;
+}
+/**
+ * A root's backend from its code and flags and from what `init` recorded,
+ * compared (chant#4478). They disagree when both exist and name another type,
+ * or when a key both give a plain value has two values; a key only one side
+ * gives (a default init filled in, a value from a backend-config file chant
+ * did not read) is no disagreement. Code that declares no backend leaves the
+ * record to stand.
+ */
+export declare function readBackend(dir: string, input?: ReadBackendInput): BackendReading;
+/**
+ * Whether chant can lock the root's state, from one {@link BackendReading}:
+ * undefined when it can, else the refusal and why. The one verdict the
+ * composition's `backend` fallback (#4438) and the state refusals (#4437)
+ * both give (chant#4478).
+ */
+export declare function lockRefusal(reading: BackendReading): StateRefusal | undefined;
+/**
+ * Where the root's state is, or why chant does not lock it, from
+ * {@link readBackend}: what `init` recorded (`backend` stands in for it),
+ * compared with the root's code, `backendConfigFiles` and `backendConfig`. A root neither declares
+ * nor records a backend for reads as a local one.
+ */
+export declare function stateObject(dir: string, env?: NodeJS.ProcessEnv, backend?: InitialisedBackend | undefined, binary?: string, flags?: Pick<DeclaredBackendInput, "backendConfig" | "backendConfigFiles">): StateObject;
+/** `s3://<bucket>/<key>`, `gs://<bucket>/<key>`, `az://<account>/<container>/<key>`, or the local file's path; undefined for a refusal. */
+export declare function stateLocation(o: StateObject): string | undefined;
+//# sourceMappingURL=backend.d.ts.map

package/dist/state/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../src/state/backend.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACrD,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AAKhD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,+BAA+B;AAC/B,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;CAClB;AAED,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,4GAA4G;AAC5G,MAAM,MAAM,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEvF,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,UAAU,CAAC;AAE3G,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;AAEtF,0CAA0C;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE1D,sCAAsC;AACtC,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;AAErD,eAAO,MAAM,SAAS,MAAO,WAAW,KAAG,CAAC,IAAI,YAA8B,CAAC;AAE/E,2EAA2E;AAC3E,eAAO,MAAM,QAAQ,MAAO,WAAW,KAAG,CAAC,IAAI,WAAqD,CAAC;AAErG,0IAA0I;AAC1I,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAsC,CAAC;AAEtF,+EAA+E;AAC/E,eAAO,MAAM,KAAK,QAGd,CAAC;AAIL,8HAA8H;AAC9H,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAIjF;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,GAAG,SAAS,CAYpH;AAED,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQrF;AAED,4IAA4I;AAC5I,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,GAAG,MAAM,CAElF;AASD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAmBnE;AAID,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,yGAAyG;IACzG,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,yJAAyJ;IACzJ,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,yGAAyG;IACzG,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD,gJAAgJ;AAChJ,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAwBnL;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,kBAAkB,GAAG,SAAS,CA6C7G;AAOD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,iFAAiF;IACjF,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,kJAAkJ;AAClJ,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;IAC5D,wFAAwF;IACxF,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,gBAAqB,GAAG,cAAc,CAmBrF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,GAAG,SAAS,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,kBAAkB,GAAG,SAAwC,EACtE,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,GAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,oBAAoB,CAAM,GAC7E,WAAW,CA4Cb;AAmED,2IAA2I;AAC3I,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAMhE"}