@intentius/chant 0.124.52 → 0.124.54

package/dist/lifecycle/snapshot-store-s3.js

@@ -0,0 +1,254 @@
+/**
+ * The `s3` medium of the index store (#4519): objects in a bucket under a
+ * prefix of their own, never a record store's prefix.
+ *
+ * Transport is `fetch` with a SigV4 header signature, hand-written as the aws
+ * lexicon's read client is (lexicons/aws/src/api/sigv4.ts), so core takes no
+ * `@aws-sdk/*` dependency. `fetch` is injectable: the conformance test runs
+ * against an in-process fake and nothing leaves the process.
+ *
+ * ## Credentials
+ *
+ * The rule is the one round 2 of the engine work set for every emulator run:
+ * a store pointed at an endpoint never reaches for the default AWS credential
+ * chain.
+ *
+ * - Explicit credentials (`credentials` in chant.config.ts, or
+ *   `CHANT_SNAPSHOT_S3_ACCESS_KEY_ID` / `_SECRET_ACCESS_KEY` /
+ *   `_SESSION_TOKEN`) are used as given.
+ * - With an `endpoint` and no explicit credentials the store refuses. It does
+ *   not read `AWS_ACCESS_KEY_ID`, a profile file, or an instance role, so an
+ *   emulator run can never sign with, or leak, a real account's keys.
+ * - With no endpoint (real S3), `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`
+ *   / `AWS_SESSION_TOKEN` answer. Profiles and instance roles are not read.
+ *
+ * ## History
+ *
+ * A snapshot keeps one key, so its history is the bucket's object versions:
+ * turn versioning on. An index version is a new key per read, so it needs no
+ * versioning. A write of an index version sends `If-None-Match: *`, and a 412
+ * means the version already exists.
+ */
+import { createHash, createHmac } from "node:crypto";
+export class S3StoreError extends Error {
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "S3StoreError";
+    }
+}
+/**
+ * Resolve the credentials the medium signs with, by the rule in the module
+ * header. Exported for the test that pins it.
+ */
+export function resolveS3Credentials(settings, env = process.env) {
+    if (settings.credentials)
+        return settings.credentials;
+    const explicitId = env.CHANT_SNAPSHOT_S3_ACCESS_KEY_ID;
+    const explicitSecret = env.CHANT_SNAPSHOT_S3_SECRET_ACCESS_KEY;
+    if (explicitId && explicitSecret) {
+        return {
+            accessKeyId: explicitId,
+            secretAccessKey: explicitSecret,
+            ...(env.CHANT_SNAPSHOT_S3_SESSION_TOKEN ? { sessionToken: env.CHANT_SNAPSHOT_S3_SESSION_TOKEN } : {}),
+        };
+    }
+    if (settings.endpoint) {
+        throw new S3StoreError(`the s3 store at ${settings.endpoint} needs explicit credentials (snapshots.credentials in chant.config.ts, or CHANT_SNAPSHOT_S3_ACCESS_KEY_ID and CHANT_SNAPSHOT_S3_SECRET_ACCESS_KEY); against an endpoint it never reads the default AWS credential chain`);
+    }
+    const id = env.AWS_ACCESS_KEY_ID;
+    const secret = env.AWS_SECRET_ACCESS_KEY;
+    if (!id || !secret) {
+        throw new S3StoreError("the s3 store has no credentials: set snapshots.credentials, CHANT_SNAPSHOT_S3_ACCESS_KEY_ID and CHANT_SNAPSHOT_S3_SECRET_ACCESS_KEY, or AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (profiles and instance roles are not read)");
+    }
+    return { accessKeyId: id, secretAccessKey: secret, ...(env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {}) };
+}
+const EMPTY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+const sha256Hex = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+const hmac = (key, data) => createHmac("sha256", key).update(data, "utf8").digest();
+/** RFC 3986 percent-encoding, as S3 signs it. */
+export function encodeRfc3986(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/**
+ * SigV4 headers for one S3 request. S3 signs the path encoded once, which is
+ * how {@link S3Medium} builds it, so the URL's pathname is the canonical URI
+ * as it stands.
+ */
+export function signS3Request(req) {
+    const url = new URL(req.url);
+    const timestamp = (req.now ?? new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+    const day = timestamp.slice(0, 8);
+    const payloadHash = req.body.length === 0 ? EMPTY_SHA256 : sha256Hex(req.body);
+    const signable = {
+        ...Object.fromEntries(Object.entries(req.headers).map(([k, v]) => [k.toLowerCase(), v.trim()])),
+        host: url.host,
+        "x-amz-date": timestamp,
+        "x-amz-content-sha256": payloadHash,
+        ...(req.credentials.sessionToken ? { "x-amz-security-token": req.credentials.sessionToken } : {}),
+    };
+    const names = Object.keys(signable).sort();
+    const pairs = [];
+    url.searchParams.forEach((v, k) => pairs.push([encodeRfc3986(k), encodeRfc3986(v)]));
+    pairs.sort((a, b) => (a[0] === b[0] ? (a[1] < b[1] ? -1 : 1) : a[0] < b[0] ? -1 : 1));
+    const canonical = [
+        req.method.toUpperCase(),
+        url.pathname || "/",
+        pairs.map(([k, v]) => `${k}=${v}`).join("&"),
+        names.map((n) => `${n}:${signable[n].replace(/\s+/g, " ")}\n`).join(""),
+        names.join(";"),
+        payloadHash,
+    ].join("\n");
+    const scope = `${day}/${req.region}/s3/aws4_request`;
+    const toSign = ["AWS4-HMAC-SHA256", timestamp, scope, sha256Hex(canonical)].join("\n");
+    const key = hmac(hmac(hmac(hmac(`AWS4${req.credentials.secretAccessKey}`, day), req.region), "s3"), "aws4_request");
+    const signature = hmac(key, toSign).toString("hex");
+    const { host: _host, ...emitted } = signable;
+    return {
+        ...emitted,
+        authorization: `AWS4-HMAC-SHA256 Credential=${req.credentials.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}`,
+    };
+}
+const XML_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
+const decodeXml = (s) => s.replace(/&(#x[0-9a-fA-F]+|#\d+|amp|lt|gt|quot|apos);/g, (_m, e) => e.startsWith("#x") ? String.fromCodePoint(parseInt(e.slice(2), 16)) : e.startsWith("#") ? String.fromCodePoint(parseInt(e.slice(1), 10)) : XML_ENTITIES[e]);
+const tagAll = (xml, tag) => [...xml.matchAll(new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`, "g"))].map((m) => m[1]);
+const tagOne = (xml, tag) => {
+    const v = tagAll(xml, tag)[0];
+    return v === undefined ? undefined : decodeXml(v);
+};
+/**
+ * Get, put and list over one bucket. Keys passed in are relative to the
+ * store's prefix.
+ */
+export class S3Medium {
+    constructor(settings, opts) {
+        this.settings = settings;
+        if (!settings.bucket)
+            throw new S3StoreError("the s3 store needs a bucket");
+        this.prefix = (settings.prefix ?? "chant").replace(/^\/+|\/+$/g, "");
+        this.region = settings.region ?? "us-east-1";
+        this.fetchImpl = opts?.fetch ?? ((url, init) => fetch(url, init));
+        // Resolved at once, so a missing credential is an error before any request.
+        this.credentials = resolveS3Credentials(settings, opts?.env);
+    }
+    /** `s3://bucket/prefix`, for messages. */
+    get where() {
+        return `s3://${this.settings.bucket}/${this.prefix}`;
+    }
+    fullKey(key) {
+        return this.prefix === "" ? key : `${this.prefix}/${key}`;
+    }
+    stripPrefix(key) {
+        return this.prefix === "" ? key : key.slice(this.prefix.length + 1);
+    }
+    url(key, query) {
+        const pathStyle = this.settings.forcePathStyle ?? this.settings.endpoint !== undefined;
+        const base = this.settings.endpoint
+            ? this.settings.endpoint.replace(/\/+$/, "")
+            : pathStyle
+                ? `https://s3.${this.region}.amazonaws.com`
+                : `https://${this.settings.bucket}.s3.${this.region}.amazonaws.com`;
+        const encodedKey = key === null ? "" : key.split("/").map(encodeRfc3986).join("/");
+        const path = pathStyle ? `/${encodeRfc3986(this.settings.bucket)}${key === null ? "" : `/${encodedKey}`}` : `/${encodedKey}`;
+        const qs = Object.entries(query)
+            .map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`)
+            .join("&");
+        return `${base}${path}${qs ? `?${qs}` : ""}`;
+    }
+    async request(method, key, query, body = "", headers = {}) {
+        const url = this.url(key, query);
+        const signed = signS3Request({ method, url, headers, body, region: this.region, credentials: this.credentials });
+        return this.fetchImpl(url, { method, headers: signed, ...(body !== "" || method === "PUT" ? { body } : {}) });
+    }
+    /** The object's content, or null when absent. `versionId` reads an older version. */
+    async get(key, versionId) {
+        const res = await this.request("GET", this.fullKey(key), versionId ? { versionId } : {});
+        if (res.status === 404)
+            return null;
+        if (res.status === 400 && versionId)
+            return null;
+        if (res.status !== 200)
+            throw new S3StoreError(`s3 GET ${key} returned ${res.status}: ${(await res.text()).slice(0, 200)}`, res.status);
+        return res.text();
+    }
+    /**
+     * Put an object. With `ifAbsent`, an existing key is not overwritten and
+     * the result says `exists`. Returns the version id when the bucket keeps
+     * versions.
+     */
+    async put(key, content, opts) {
+        const headers = { "content-type": "application/json" };
+        if (opts?.ifAbsent)
+            headers["if-none-match"] = "*";
+        const res = await this.request("PUT", this.fullKey(key), {}, content, headers);
+        if (res.status === 412 || res.status === 409)
+            return { exists: true };
+        if (res.status !== 200)
+            throw new S3StoreError(`s3 PUT ${key} returned ${res.status}: ${(await res.text()).slice(0, 200)}`, res.status);
+        const versionId = res.headers.get("x-amz-version-id");
+        return { exists: false, ...(versionId && versionId !== "null" ? { versionId } : {}) };
+    }
+    /** The names directly under `dir/`: files, and directories with a trailing `/`. */
+    async list(dir) {
+        const prefix = `${this.fullKey(dir)}/`;
+        const names = [];
+        let token;
+        do {
+            const res = await this.request("GET", null, {
+                "list-type": "2",
+                prefix,
+                delimiter: "/",
+                ...(token ? { "continuation-token": token } : {}),
+            });
+            if (res.status === 404)
+                return [];
+            if (res.status !== 200)
+                throw new S3StoreError(`s3 list ${dir} returned ${res.status}`, res.status);
+            const xml = await res.text();
+            for (const c of tagAll(xml, "Contents")) {
+                const k = tagOne(c, "Key");
+                if (k !== undefined && k.length > prefix.length)
+                    names.push(k.slice(prefix.length));
+            }
+            for (const p of tagAll(xml, "CommonPrefixes")) {
+                const k = tagOne(p, "Prefix");
+                if (k !== undefined && k.length > prefix.length)
+                    names.push(k.slice(prefix.length));
+            }
+            token = tagOne(xml, "IsTruncated") === "true" ? tagOne(xml, "NextContinuationToken") : undefined;
+        } while (token);
+        return [...new Set(names)].sort();
+    }
+    /** Every version of every key under `dir/` (recursively), newest first. */
+    async versions(dir) {
+        const prefix = `${this.fullKey(dir)}/`;
+        const out = [];
+        let keyMarker;
+        let versionMarker;
+        do {
+            const res = await this.request("GET", null, {
+                versions: "",
+                prefix,
+                ...(keyMarker ? { "key-marker": keyMarker } : {}),
+                ...(versionMarker ? { "version-id-marker": versionMarker } : {}),
+            });
+            if (res.status === 404)
+                return [];
+            if (res.status !== 200)
+                throw new S3StoreError(`s3 list versions ${dir} returned ${res.status}`, res.status);
+            const xml = await res.text();
+            for (const v of tagAll(xml, "Version")) {
+                const key = tagOne(v, "Key");
+                const versionId = tagOne(v, "VersionId");
+                const lastModified = tagOne(v, "LastModified");
+                if (key === undefined || versionId === undefined || lastModified === undefined)
+                    continue;
+                out.push({ key: this.stripPrefix(key), versionId, lastModified, isLatest: tagOne(v, "IsLatest") === "true" });
+            }
+            const truncated = tagOne(xml, "IsTruncated") === "true";
+            keyMarker = truncated ? tagOne(xml, "NextKeyMarker") : undefined;
+            versionMarker = truncated ? tagOne(xml, "NextVersionIdMarker") : undefined;
+        } while (keyMarker);
+        return out.sort((a, b) => (a.lastModified < b.lastModified ? 1 : a.lastModified > b.lastModified ? -1 : 0));
+    }
+}

package/dist/lifecycle/snapshot-store.d.ts

@@ -0,0 +1,170 @@
+import { type LedgerLocation } from "./git.js";
+import { type IndexDocument, type IndexScope } from "./index-document.js";
+import { type S3Fetch, type S3StoreSettings } from "./snapshot-store-s3.js";
+/** The first chant that writes snapshots through the store, to `refs/chant/snapshots` by default. */
+export declare const SNAPSHOT_STORE_FLOOR = "0.124.54";
+/** The ref the default store writes. */
+export declare const SNAPSHOT_REF = "refs/chant/snapshots";
+/** Where index versions sit on a git ref. The underscore keeps it clear of every environment name, as `_gates` and `_members` are. */
+export declare const GIT_INDEX_DIR = "_index";
+export type SnapshotStoreKind = "git-ref" | "orphan-branch" | "local" | "s3" | "none";
+/** One entry of a snapshot history, newest first. */
+export interface SnapshotVersion {
+    /** What {@link SnapshotStore.readAt} takes: a commit on a git store, an object version id on s3, a modification time on local. */
+    version: string;
+    /** ISO time of the write. */
+    date: string;
+    message: string;
+    /** The snapshot key the entry is for, when the store keeps history per key (s3, local). */
+    key?: string;
+}
+/** What a write did. A store that keeps nothing, or a run that records nothing, says so instead of throwing. */
+export interface StoreWrite {
+    written: boolean;
+    /** The commit, object version or file time the write made. */
+    version?: string;
+    /** The store path written, relative to its family root. */
+    path?: string;
+    /** Why nothing was written. */
+    reason?: string;
+}
+/** What publishing a store's writes did: pushed to a remote, kept local, or refused. */
+export interface StorePublish {
+    status: "pushed" | "local" | "nothing" | "stale" | "failed";
+    detail?: string;
+}
+/**
+ * The index store. Snapshot methods take the snapshot's environment and key
+ * (`snapshotStorageKey(lexicon, stack)`), and a {@link LedgerLocation} for a
+ * workspace member; index methods take a scope key (`stamp.scopeKey`).
+ */
+export interface SnapshotStore {
+    readonly kind: SnapshotStoreKind;
+    /** `refs/chant/snapshots`, a directory, `s3://bucket/prefix`, `nowhere`: for messages. */
+    readonly where: string;
+    /** False for `none` and the read-only orphan-branch store. */
+    readonly writable: boolean;
+    write(environment: string, key: string, json: string, at?: LedgerLocation): Promise<StoreWrite>;
+    readLatest(environment: string, key: string, at?: LedgerLocation): Promise<string | null>;
+    readAt(environment: string, key: string, version: string, at?: LedgerLocation): Promise<string | null>;
+    /** Snapshot history, newest first; with `environment`, only that environment's. */
+    list(opts?: LedgerLocation & {
+        environment?: string;
+    }): Promise<SnapshotVersion[]>;
+    /** The snapshot keys an environment holds now. */
+    keys(environment: string, at?: LedgerLocation): Promise<string[]>;
+    /** The environments that hold a snapshot now. */
+    environments(at?: LedgerLocation): Promise<string[]>;
+    /** Write one index version. Refuses a stamp that disagrees with itself; never overwrites. */
+    writeIndex(doc: IndexDocument): Promise<StoreWrite>;
+    /** Version names under a scope key, oldest first (name order is time order). */
+    listIndex(scopeKey: string): Promise<string[]>;
+    readIndexAt(scopeKey: string, version: string): Promise<IndexDocument | null>;
+    readIndexLatest(scopeKey: string): Promise<IndexDocument | null>;
+    /** The scope a scope key's digest stands for, from its `scope.json`. */
+    readIndexScope(scopeKey: string): Promise<IndexScope | null>;
+    /** Bring remote history in, when the store has a remote. Never rewinds local writes. Never throws. */
+    fetch(at?: LedgerLocation): Promise<void>;
+    /** Send this process's writes to the remote, when the store has one. Never throws. */
+    publish(at?: LedgerLocation): Promise<StorePublish>;
+}
+/** Every snapshot an environment holds, by key. The old `readEnvironmentSnapshots`, through a store. */
+export declare function readEnvironmentSnapshotsFrom(store: SnapshotStore, environment: string, at?: LedgerLocation): Promise<Map<string, string>>;
+/** One file written to a ref. */
+export interface RefFileWrite {
+    path: string;
+    content: string;
+    /** Leave an existing file alone and report it. */
+    ifAbsent?: boolean;
+}
+/**
+ * Commit files onto `ref`, keeping every other path the ref holds, with a
+ * compare-and-swap on the ref. Builds the tree in a scratch index, so the
+ * working tree, the real index and HEAD are never touched. A conflict with
+ * another writer is retried against the new tip: every caller writes a
+ * self-contained replacement or a new path, so a retry is always correct.
+ *
+ * Returns the new commit, or null when every `ifAbsent` file existed.
+ */
+export declare function commitFilesToRef(ref: string, files: RefFileWrite[], message: string, opts?: {
+    cwd?: string;
+    /** Build on this commit instead of the ref's tip (`null`: a root commit). The ref is still swapped from its current value. */
+    parent?: string | null;
+}): Promise<{
+    commit: string | null;
+    existed: string[];
+}>;
+/**
+ * Fetch `ref` and fast-forward the local ref when it is behind. A local ref
+ * ahead of or diverged from the remote is kept as it is: its writes go out
+ * on the next {@link publishRef}, which rebases them.
+ */
+export declare function fetchRefFastForward(ref: string, opts?: {
+    cwd?: string;
+}): Promise<"fetched" | "no-remote" | "missing" | "kept" | "failed">;
+/**
+ * Push `ref` under a lease on the remote tip last fetched. A refused push
+ * (another machine pushed first) fetches, commits `pending` again on the
+ * remote tip, and pushes once more, up to three times.
+ */
+export declare function publishRef(ref: string, pending: ReadonlyMap<string, string>, message: string, opts?: {
+    cwd?: string;
+}): Promise<StorePublish>;
+/** `snapshots` in chant.config.ts. */
+export type SnapshotStoreConfig = {
+    store: "git-ref";
+    ref?: string; /** Read `chant/lifecycle` when the ref has no answer. Default true. */
+    readOrphanBranch?: boolean;
+} | {
+    store: "orphan-branch";
+} | {
+    store: "local"; /** Relative to the project. Default `.chant/store`. */
+    dir?: string;
+} | ({
+    store: "s3";
+} & S3StoreSettings) | {
+    store: "none";
+};
+export declare const SNAPSHOT_STORE_KINDS: readonly SnapshotStoreKind[];
+/** Default directory of a `local` store, relative to the project. */
+export declare const DEFAULT_LOCAL_STORE_DIR = ".chant/store";
+/**
+ * The store configuration in effect: `CHANT_SNAPSHOT_STORE` and its
+ * companions over `snapshots` in chant.config.ts over the default `git-ref`.
+ */
+export declare function snapshotStoreConfig(configured?: unknown, env?: Record<string, string | undefined>): SnapshotStoreConfig;
+/** Seams for tests: the s3 transport and the environment its credentials come from. */
+export interface SnapshotStoreDeps {
+    fetch?: S3Fetch;
+    env?: Record<string, string | undefined>;
+}
+/** Build a store from its configuration. `cwd` is the project directory. */
+export declare function createSnapshotStore(config: SnapshotStoreConfig, opts?: {
+    cwd?: string;
+} & SnapshotStoreDeps): SnapshotStore;
+/**
+ * The project's store, built once per directory and configuration so a
+ * write and the publish after it share one instance. `config` is the
+ * project's loaded chant.config; without it the config is loaded from `cwd`
+ * upward, and a directory with none uses the default.
+ */
+export declare function resolveSnapshotStore(opts?: {
+    cwd?: string;
+    config?: {
+        snapshots?: unknown;
+    };
+}): Promise<SnapshotStore>;
+/** Forget every resolved store. For tests. */
+export declare function resetResolvedSnapshotStores(): void;
+/**
+ * The snapshot family as a {@link import("./ledger-port.js").LedgerReadPort}:
+ * `trees` are the environments, `list(env)` the snapshot files, `read` a file.
+ * `chant query` reads its `resources` and `snapshots` tables through this, so
+ * the tables are the same whichever store holds them.
+ */
+export declare function snapshotReadPort(store: SnapshotStore, at?: LedgerLocation): {
+    read: (dir: string, file: string) => Promise<string | null>;
+    list: (dir: string) => Promise<string[]>;
+    trees: () => Promise<string[]>;
+};
+//# sourceMappingURL=snapshot-store.d.ts.map

package/dist/lifecycle/snapshot-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-store.d.ts","sourceRoot":"","sources":["../../src/lifecycle/snapshot-store.ts"],"names":[],"mappings":"AA4DA,OAAO,EAWL,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AAEf,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAY,KAAK,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEnF,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,aAAe,CAAC;AAEjD,wCAAwC;AACxC,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD,sIAAsI;AACtI,eAAO,MAAM,aAAa,WAAW,CAAC;AAEtC,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,eAAe,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,CAAC;AAEtF,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,kIAAkI;IAClI,OAAO,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,gHAAgH;AAChH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1F,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvG,mFAAmF;IACnF,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnF,kDAAkD;IAClD,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,iDAAiD;IACjD,YAAY,CAAC,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD,6FAA6F;IAC7F,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,gFAAgF;IAChF,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACjE,wEAAwE;IACxE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE7D,sGAAsG;IACtG,KAAK,CAAC,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,sFAAsF;IACtF,OAAO,CAAC,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACrD;AAED,wGAAwG;AACxG,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,EAAE,CAAC,EAAE,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAO9B;AAgDD,iCAAiC;AACjC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,YAAY,EAAE,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA8DvD;AAOD;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC,CAqBhJ;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,YAAY,CAAC,CA4BvB;AA+cD,sCAAsC;AACtC,MAAM,MAAM,mBAAmB,GAC3B;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,uEAAuE;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GACtI;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,GAC1B;IAAE,KAAK,EAAE,OAAO,CAAC,CAAC,uDAAuD;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG,eAAe,CAAC,GACnC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtB,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAAwD,CAAC;AAEtH,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,mBAAmB,CAqCrB;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,GAAG,aAAa,CAsB3H;AAID;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAmB5H;AAED,8CAA8C;AAC9C,wBAAgB,2BAA2B,IAAI,IAAI,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,cAAc;IAEtE,IAAI,QAAc,MAAM,QAAQ,MAAM;IACtC,IAAI,QAAc,MAAM;IACxB,KAAK;EAER"}