@intentius/chant 0.124.44 → 0.124.45

package/dist/ci-identity.d.ts

@@ -21,6 +21,17 @@
  * identity. The record job plans the merged commit with the plan identity,
  * and the apply jobs trade for the apply identity.
  *
+ * Per target (#4332): a rule with `targets` covers only the targets those
+ * globs match, the Terraform roots or Op wave runs inside one member, so
+ * one member's targets can plan and apply as different identities. A
+ * target takes the first rule that covers its environment, member and
+ * target ({@link resolveTargetCloudIdentity}). The plan job then trades for
+ * every plan identity the member's targets take, keeps the credentials of
+ * each in a file named by {@link CLOUD_TARGETS_ENV}, and a product hands
+ * each target's tool its own with {@link targetCloudEnv}. An apply splits
+ * into one job per apply identity ({@link cloudIdentityGroups},
+ * {@link cloudIdentityWave}), so no job holds two targets' apply tokens.
+ *
  * The trade is terragucci's `oidc-trade.ts` (INTENTIUS/terragucci e6cb431,
  * packages/terragucci/src/oidc-trade.ts) with these clients:
  *
@@ -41,12 +52,21 @@
 /** The clouds `ci.identity.cloud` names. */
 export declare const CLOUDS: readonly ["aws", "gcp", "azure"];
 export type Cloud = (typeof CLOUDS)[number];
-/** One rule: the environments and members it covers, and their two identities. */
+/** One rule: the environments, members and targets it covers, and their two identities. */
 export interface CloudIdentityRule {
     /** Environment-name globs. Absent: every environment. */
     environments?: string[];
     /** Member-name globs. Absent: every member, and a pipeline outside a workspace member. */
     members?: string[];
+    /**
+     * Target globs (#4332): the targets inside the member the rule covers,
+     * such as Terraform roots or Op wave run targets. `*` matches within one
+     * `/` segment, `**` across segments, `?` one character. Absent: every
+     * target, and the pipeline as a whole.
+     */
+    targets?: string[];
+    /** The name of the apply job group its targets form (#4332). Default: from its first target glob. */
+    name?: string;
     /** The identity the plan and record jobs take. */
     plan: string;
     /** The identity the apply jobs take. */
@@ -89,45 +109,151 @@ export interface CloudIdentityDeclaration {
     gcp?: GcpCloudIdentity;
     azure?: AzureCloudIdentity;
 }
-/** What one job trades for: per cloud, the one identity and where to trade it. */
+/**
+ * What one job trades for, per cloud: the job's own identity and where to
+ * trade it, and with `targets` (#4332) the identities of the targets that
+ * take another, first match wins. A cloud names its own identity, or
+ * targets, or both.
+ */
 export interface CloudTradeSpec {
     aws?: {
-        role: string;
+        role?: string;
+        targets?: Array<{
+            targets: string[];
+            role: string;
+        }>;
         region: string;
         audience: string;
         endpoint?: string;
     };
     gcp?: {
-        serviceAccount: string;
+        serviceAccount?: string;
+        targets?: Array<{
+            targets: string[];
+            serviceAccount: string;
+        }>;
         provider: string;
         audience: string;
         stsEndpoint?: string;
         iamEndpoint?: string;
     };
     azure?: {
-        clientId: string;
+        clientId?: string;
+        targets?: Array<{
+            targets: string[];
+            clientId: string;
+        }>;
         tenantId: string;
         audience: string;
         subscriptionId?: string;
         authority?: string;
     };
 }
+/** The key a cloud's trade names its identity under. */
+export declare const IDENTITY_KEY: {
+    readonly aws: "role";
+    readonly gcp: "serviceAccount";
+    readonly azure: "clientId";
+};
 /** A pipeline's two trades: the plan and record jobs', and the apply jobs'. */
 export interface PipelineCloudIdentity {
     plan: CloudTradeSpec;
     apply: CloudTradeSpec;
 }
-/** The first rule that covers `env` and `member`, or undefined. */
-export declare function ruleFor(rules: readonly CloudIdentityRule[], env: string, member?: string): CloudIdentityRule | undefined;
+/**
+ * A glob over a name (#4296): `*` and `?` within the name, `[...]` classes,
+ * `{a,b}` alternatives, a leading `!` negates. The grammar `ciMemberGlobs`
+ * documents, with no dependency, so this module bundles small (#4332).
+ */
+export declare function nameGlobMatch(glob: string, name: string): boolean;
+/**
+ * A glob over a target (#4332): `*` within one `/` segment, `**` across
+ * segments (and `a/**\/b` across none), `?` one character. The reading of
+ * `targetGlobMatch` in ./op/gate-quorum.ts and the terraform lexicon's unit
+ * globs, so a root's glob means one thing in each.
+ */
+export declare function targetGlobMatch(glob: string, target: string): boolean;
+/**
+ * The first rule that covers `env`, `member` and `target`, or undefined.
+ * With no `target`, the first rule that names no targets: the pipeline's own.
+ */
+export declare function ruleFor(rules: readonly CloudIdentityRule[], env: string, member?: string, target?: string): CloudIdentityRule | undefined;
 /**
  * The plan and apply trades of the pipeline for `env` and `member`, or
  * undefined when no rule of any cloud covers them. A cloud no rule covers
- * is left out of both.
+ * is left out of both. Each cloud's own identity is the first rule with no
+ * `targets` that covers the pipeline; the rules with `targets` before it
+ * are the cloud's `targets` (#4332), so the plan trade holds every plan
+ * identity a target of the member takes, and the apply trade every apply
+ * identity.
  */
 export declare function resolveCloudIdentity(decl: CloudIdentityDeclaration | undefined, env: string, member?: string): PipelineCloudIdentity | undefined;
+/**
+ * The plan and apply trades of one target (#4332): per cloud, the first
+ * rule that covers `env`, `member` and `target`. Undefined when no rule of
+ * any cloud covers it. Each trade names one identity per cloud and no
+ * `targets`.
+ */
+export declare function resolveTargetCloudIdentity(decl: CloudIdentityDeclaration | undefined, env: string, member: string | undefined, target: string): PipelineCloudIdentity | undefined;
+/** The name a pull request environment's rule is matched against (#4330): any pull request's, as `pr-*` covers it. */
+export declare const PR_ENV_IDENTITY_PROBE = "pr-1";
+/**
+ * The trade a pull request environment's jobs take (#4330): per cloud, the
+ * apply identity of the rules {@link resolveCloudIdentity} gives `pr-1` and
+ * `member`, from the rules that name `environments` only. env-up runs the
+ * change's code with that identity, so a rule with no `environments`, which
+ * covers every environment, is never one it gets: give pull request
+ * environments a rule of their own, such as `environments: ["pr-*"]`, whose
+ * identity reaches only what they may touch. Undefined when no such rule
+ * covers them.
+ */
+export declare function resolvePrEnvCloudIdentity(decl: CloudIdentityDeclaration | undefined, member?: string): CloudTradeSpec | undefined;
+/** One apply job's targets (#4332): those that take the same identities, per cloud. */
+export interface CloudIdentityGroup {
+    /** A job-name-safe name: the first rule with `targets` they took (its `name`, or one from its first glob), else `default`. */
+    name: string;
+    /** The group's targets, in the order given. */
+    targets: string[];
+    /** Their plan and apply trades, one identity per cloud. Undefined when no rule covers them. */
+    identity?: PipelineCloudIdentity;
+}
+/** The name of the apply job group for {@link CloudIdentityGroup}s with no rule of their own. */
+export declare const DEFAULT_IDENTITY_GROUP = "default";
+/**
+ * `targets` grouped by the identities they take (#4332), so each group's
+ * apply runs in a job of its own with its group's identities alone.
+ * Targets that take the same plan and apply identity in every cloud are one
+ * group. The groups come in the order their first target comes, with
+ * `default` (the targets no rule with `targets` took) last. Names are
+ * unique: a second group of one name gets `-2`.
+ */
+export declare function cloudIdentityGroups(decl: CloudIdentityDeclaration | undefined, env: string, member: string | undefined, targets: readonly string[]): CloudIdentityGroup[];
+/**
+ * An Op wave's cloud identities over its run targets (#4332), as
+ * `OpWave.cloud` and `OpWave.jobs` (./op/op-waves.ts) take them. With two
+ * or more {@link cloudIdentityGroups}, the deciding job trades for every
+ * plan identity of the targets and each group's job for its group's apply
+ * identities alone. With one group, the wave's one job trades for that
+ * group's apply identities, and `jobs` is absent. Neither, when no rule
+ * covers a target.
+ */
+export declare function cloudIdentityWave(decl: CloudIdentityDeclaration | undefined, env: string, member: string | undefined, targets: readonly string[]): {
+    cloud?: CloudTradeSpec;
+    jobs?: Array<{
+        name: string;
+        runs: string[];
+        cloud?: CloudTradeSpec;
+    }>;
+};
+/**
+ * Why one job may not apply under `spec` (#4332), or undefined: a cloud
+ * whose trade names more than one identity would hand one job the apply
+ * tokens of targets that apply as different identities.
+ */
+export declare function oneApplyIdentityProblem(spec: CloudTradeSpec): string | undefined;
 /** The clouds a trade covers, in {@link CLOUDS} order. */
 export declare function tradedClouds(spec: CloudTradeSpec): Cloud[];
-/** Every identity a trade names: the role, the service account, the client id. */
+/** Every identity a trade names, once each: the roles, the service accounts, the client ids, its targets' too (#4332). */
 export declare function tradeIdentities(spec: CloudTradeSpec): string[];
 /**
  * The problems of a declared `ci.identity.cloud`, each with its JSON
@@ -158,15 +284,37 @@ export declare const TRADED_VARS: Record<Cloud, readonly string[]>;
  * file of `export` lines a GitLab script sources, mode 0600.
  */
 export type TradeFormat = "github-env" | "sh";
+/**
+ * The variable the trade sets when a cloud names `targets` (#4332): the
+ * path of a JSON file, mode 0600 and outside the checkout, with each
+ * identity's credentials and which targets take it. {@link targetCloudEnv}
+ * reads it.
+ */
+export declare const CLOUD_TARGETS_ENV = "CHANT_CLOUD_TARGETS";
+/** The file {@link CLOUD_TARGETS_ENV} names: per cloud, the job's own identity, the targets that take another, and each identity's variables. */
+export interface CloudTargetsFile {
+    version: 1;
+    clouds: Partial<Record<Cloud, {
+        default?: string;
+        targets: Array<{
+            targets: string[];
+            identity: string;
+        }>;
+        vars: Record<string, Record<string, string>>;
+    }>>;
+}
 /**
  * The trade, a script for `node -e` with no dependency, so it runs before
  * the checkout and reads none of the change's files. argv 1 is the file it
  * writes and argv 2 its {@link TradeFormat}; {@link TRADE_SPEC_ENV} is the
  * spec. The token comes from a cloud's {@link idTokenVar} when the job has
  * it (GitLab's `id_tokens`), else from the forge's request URL with the
- * cloud's audience. A value that holds anything but printable ASCII with no
- * space is refused, so no answer can add a line of its own to the file. The
- * script never prints a token.
+ * cloud's audience, once per cloud. Each identity of a cloud (its own, and
+ * its targets', #4332) is traded with that one token. The job's own
+ * identity's variables go in the file; with targets, every identity's go in
+ * the {@link CLOUD_TARGETS_ENV} file too. A value that holds anything but
+ * printable ASCII with no space is refused, so no answer can add a line of
+ * its own to the file. The script never prints a token.
  */
 export declare const TRADE_JS: string;
 /**
@@ -187,4 +335,27 @@ export declare function gitlabTradeLines(extraUnset?: readonly string[]): string
 export declare function gitlabTradeIdTokens(spec: CloudTradeSpec): Record<string, {
     aud: string;
 }>;
+/**
+ * `env` for one target's tool (#4332): the job's environment with each
+ * cloud's credentials replaced by those of the identity `target` takes, as
+ * the trade left them in the {@link CLOUD_TARGETS_ENV} file. A target that
+ * no rule with `targets` covers keeps the job's own identity. Without the
+ * file (no cloud names targets), `env` as it is. terragucci's `rootRoleEnv`
+ * (roles.ts at INTENTIUS/terragucci ca05bd9).
+ */
+export declare function targetCloudEnv(env: Readonly<Record<string, string | undefined>>, target: string, read?: (path: string) => string): Record<string, string | undefined>;
+/**
+ * The identity `target` takes in one cloud of a {@link CloudTargetsFile}:
+ * the first entry whose globs match, else the job's own. Undefined when
+ * the job has none for that cloud.
+ */
+export declare function targetIdentityIn(cloud: {
+    default?: string;
+    targets: Array<{
+        targets: string[];
+        identity: string;
+    }>;
+}, target: string): string | undefined;
+/** The {@link CloudTargetsFile} at `path`, refused when it is not one. */
+export declare function readTargetsFile(path: string, read?: (path: string) => string): CloudTargetsFile;
 //# sourceMappingURL=ci-identity.d.ts.map

package/dist/ci-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-identity.d.ts","sourceRoot":"","sources":["../src/ci-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,4CAA4C;AAC5C,eAAO,MAAM,MAAM,YAAI,KAAK,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;AACvD,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5C,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,8HAA8H;IAC9H,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,GAAG,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjH,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/G;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,cAAc,CAAC;CACvB;AAKD,mEAAmE;AACnE,wBAAgB,OAAO,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAExH;AAKD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAkChJ;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,CAE1D;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,wBAAwB,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAYjH;AAED,kFAAkF;AAClF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAE/C;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,+GAAyH,CAAC;AAExJ,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAIxD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ,QA2CX,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAElE;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,8CAA8C,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,EAAE,CAM7E;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAEzF"}
+{"version":3,"file":"ci-identity.d.ts","sourceRoot":"","sources":["../src/ci-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAIH,4CAA4C;AAC5C,eAAO,MAAM,MAAM,YAAI,KAAK,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;AACvD,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5C,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qGAAqG;IACrG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,8HAA8H;IAC9H,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnI,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClL,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1K;AAED,wDAAwD;AACxD,eAAO,MAAM,YAAY;aAAK,GAAG,EAAE,MAAM;aAAE,GAAG,EAAE,gBAAgB;aAAE,KAAK,EAAE,UAAU;CAAW,CAAC;AAE/F,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,cAAc,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGrE;AAoDD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAEzI;AAwCD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAgBhJ;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAWjL;AAED,sHAAsH;AACtH,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAQjI;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,8HAA8H;IAC9H,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,qBAAqB,CAAC;CAClC;AAKD,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAyBzK;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB;IAAE,KAAK,CAAC,EAAE,cAAc,CAAC;IAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,CAAA;CAAE,CASpG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAMhF;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,EAAE,CAE1D;AAED,0HAA0H;AAC1H,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAQ9D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,wBAAwB,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAYjH;AAED,kFAAkF;AAClF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAE/C;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,+GAAyH,CAAC;AAExJ,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAIxD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD,iJAAiJ;AACjJ,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;CAC7J;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,QAAQ,QAwDX,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAElE;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,8CAA8C,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,EAAE,CAM7E;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAEzF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAwC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAgBtM;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzJ;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAwC,GAAG,gBAAgB,CAShI"}