@nocobase/app-plugin-releases 0.0.0-stage → 0.1.0-beta.1

package/dist/server/services/credentials.js

@@ -0,0 +1,137 @@
+/**
+ * The one bearer credential besides a session or an API key: an upload ticket lets whoever holds it upload one release
+ * into one App before it expires, and deploy it when it says so. An application hands one to a build job so the job
+ * never holds a person's credentials. It acts for the person who issued it, with what that person may still do, and
+ * counts as a `key` caller: never on a protected environment. CI that runs on its own
+ * uses an API key with a scope instead (the application's `releases.apps` permission group).
+ */
+import { randomUUID } from 'node:crypto';
+import { businessKey, noPermissions, } from '../../shared/access.js';
+import { UPLOAD_TICKET_PREFIX, } from '../../shared/releases.js';
+import { ReleasesError, forbidden } from '../errors.js';
+import { decodeDate } from './codec.js';
+import { hashToken, randomToken } from './secrets.js';
+const MAX_TICKET_TTL_SECONDS = 3600;
+/** A permission set cut down to the given App actions; everything else is off. */
+export function restrictPermissions(permissions, actions) {
+    const base = noPermissions();
+    const scopes = { ...base.scopes };
+    for (const action of actions) {
+        const key = businessKey('rel.apps', action);
+        scopes[key] = permissions.scopes[key];
+    }
+    return { ...base, scopes };
+}
+export class UploadTicketService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Issues a ticket. With `conn`, the App is read and the ticket written on that connection, so an application can
+     * mint one inside its own transaction (a build job's claim, where the database may allow one connection); a
+     * deploying ticket still reads its environment outside it, so it is refused there.
+     */
+    async create(caller, appId, input = {}, conn) {
+        const app = await this.options.releases.requireApp(appId, conn);
+        await this.options.guard.requireApp(caller, 'upload', app);
+        const deploy = input.deploy === true;
+        if (deploy && conn)
+            throw new ReleasesError('A ticket minted in a transaction cannot deploy.', 'TICKET_DEPLOY_REFUSED', 'FAILED_PRECONDITION');
+        if (deploy) {
+            const environment = await this.options.environments.record(app.environmentId);
+            if (environment.protected)
+                throw new ReleasesError('An upload ticket cannot deploy to a protected environment.', 'TICKET_DEPLOY_REFUSED', 'FAILED_PRECONDITION');
+            await this.options.guard.requireApp(caller, 'deploy', app);
+        }
+        const ttl = input.ttlSeconds ?? this.options.defaultTtlSeconds ?? 900;
+        if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > MAX_TICKET_TTL_SECONDS)
+            throw new ReleasesError(`A ticket lives from 1 to ${MAX_TICKET_TTL_SECONDS} seconds.`, 'INVALID_TTL', 'INVALID_ARGUMENT');
+        if (!caller.userId)
+            throw forbidden('Upload tickets are issued for a person.', 'USER_REQUIRED');
+        const id = randomUUID();
+        const token = `${UPLOAD_TICKET_PREFIX}${randomToken()}`;
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + ttl * 1000);
+        await (conn?.query ?? this.query())
+            .insertInto('relUploadTickets')
+            .values({
+            id,
+            appId,
+            tokenHash: hashToken(token),
+            deploy,
+            expiresAt,
+            usedAt: null,
+            releaseId: null,
+            createdBy: caller.userId,
+            createdVia: caller.kind,
+            createdAt: now,
+        })
+            .execute();
+        return {
+            id,
+            appId,
+            token,
+            path: `/releases/apps/${encodeURIComponent(appId)}/releases`,
+            deploy,
+            expiresAt: expiresAt.toISOString(),
+        };
+    }
+    /** Checks a ticket for an upload to `appId` without spending it: unused, unexpired and for that App. */
+    async verify(token, appId) {
+        await this.usable(token, appId);
+    }
+    /**
+     * Spends a ticket on an upload to `appId`: valid once, before it expires. Returns the caller the upload runs as —
+     * the issuer, limited to uploading (and deploying, when the ticket says so).
+     */
+    async consume(token, appId) {
+        const row = await this.usable(token, appId);
+        const now = new Date();
+        const claimed = await this.query()
+            .updateTable('relUploadTickets')
+            .set({ usedAt: now })
+            .where('id', '=', row.id)
+            .where('usedAt', 'is', null)
+            .execute();
+        if (claimed.updatedCount !== 1)
+            throw invalidTicket();
+        const deploy = Boolean(row.deploy);
+        const issuer = await this.options.guard.callerForUser(String(row.createdBy), 'key');
+        return {
+            ticketId: String(row.id),
+            deploy,
+            caller: {
+                ...issuer,
+                permissions: restrictPermissions(issuer.permissions, deploy ? ['upload', 'deploy'] : ['upload']),
+            },
+        };
+    }
+    /** Records the release a ticket produced. */
+    async recordRelease(ticketId, releaseId) {
+        await this.query()
+            .updateTable('relUploadTickets')
+            .set({ releaseId })
+            .where('id', '=', ticketId)
+            .execute();
+    }
+    async usable(token, appId) {
+        const row = await this.query()
+            .selectFrom('relUploadTickets')
+            .selectAll()
+            .where('tokenHash', '=', hashToken(token))
+            .executeTakeFirst();
+        if (!row || String(row.appId) !== appId)
+            throw invalidTicket();
+        if (row.usedAt != null || decodeDate(row.expiresAt) <= new Date())
+            throw invalidTicket();
+        return row;
+    }
+    query() {
+        return this.options.database.connection().query;
+    }
+}
+function invalidTicket() {
+    return new ReleasesError('The upload ticket is invalid, used or expired.', 'INVALID_TICKET', 'UNAUTHENTICATED');
+}
+//# sourceMappingURL=credentials.js.map

package/dist/server/services/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../server/services/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EACL,WAAW,EACX,aAAa,GAGd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CACjC,WAAgC,EAChC,OAA6B;IAE7B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAUD,MAAM,OAAO,mBAAmB;IACM;IAApC,YAAoC,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;IAAG,CAAC;IAE3E;;;;OAIG;IACI,KAAK,CAAC,MAAM,CACjB,MAAc,EACd,KAAa,EACb,QAAqE,EAAE,EACvE,IAAyB;QAEzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;QACrC,IAAI,MAAM,IAAI,IAAI;YAChB,MAAM,IAAI,aAAa,CACrB,iDAAiD,EACjD,uBAAuB,EACvB,qBAAqB,CACtB,CAAC;QACJ,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CACxD,GAAG,CAAC,aAAa,CAClB,CAAC;YACF,IAAI,WAAW,CAAC,SAAS;gBACvB,MAAM,IAAI,aAAa,CACrB,4DAA4D,EAC5D,uBAAuB,EACvB,qBAAqB,CACtB,CAAC;YACJ,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,GAAG,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,sBAAsB;YACvE,MAAM,IAAI,aAAa,CACrB,4BAA4B,sBAAsB,WAAW,EAC7D,aAAa,EACb,kBAAkB,CACnB,CAAC;QACJ,IAAI,CAAC,MAAM,CAAC,MAAM;YAChB,MAAM,SAAS,CACb,yCAAyC,EACzC,eAAe,CAChB,CAAC;QACJ,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,oBAAoB,GAAG,WAAW,EAAE,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;aAChC,UAAU,CAAC,kBAAkB,CAAC;aAC9B,MAAM,CAAC;YACN,EAAE;YACF,KAAK;YACL,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;YAC3B,MAAM;YACN,SAAS;YACT,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,SAAS,EAAE,GAAG;SACf,CAAC;aACD,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE;YACF,KAAK;YACL,KAAK;YACL,IAAI,EAAE,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,WAAW;YAC5D,MAAM;YACN,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACnC,CAAC;IACJ,CAAC;IAED,wGAAwG;IACjG,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC9C,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAClB,KAAa,EACb,KAAa;QAMb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC/B,WAAW,CAAC,kBAAkB,CAAC;aAC/B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;aACpB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;aACxB,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;aAC3B,OAAO,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CACnD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EACrB,KAAK,CACN,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM;YACN,MAAM,EAAE;gBACN,GAAG,MAAM;gBACT,WAAW,EAAE,mBAAmB,CAC9B,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC3C;aACF;SACF,CAAC;IACJ,CAAC;IAED,6CAA6C;IACtC,KAAK,CAAC,aAAa,CACxB,QAAgB,EAChB,SAAiB;QAEjB,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,WAAW,CAAC,kBAAkB,CAAC;aAC/B,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;aAClB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC;aAC1B,OAAO,EAAE,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC3B,UAAU,CAAC,kBAAkB,CAAC;aAC9B,SAAS,EAAE;aACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;aACzC,gBAAgB,EAAO,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/D,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE;YAC/D,MAAM,aAAa,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;IAClD,CAAC;CACF;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,aAAa,CACtB,gDAAgD,EAChD,gBAAgB,EAChB,iBAAiB,CAClB,CAAC;AACJ,CAAC"}

package/dist/server/services/environments.d.ts

@@ -0,0 +1,75 @@
+import type { DatabaseManager, Row } from '@nocobase/db';
+import type { DriverSummary, EnvironmentCheckInput, EnvironmentCheckResult, EnvironmentInput, EnvironmentRecord, EnvironmentVariableView, SetEnvironmentVariableInput } from '../../shared/releases.js';
+import { AccessGuard, type Caller } from '../access/caller.js';
+import { type DeploymentDriver, type DriverEnvironment, type DriverRegistry } from '../drivers/types.js';
+import { type ReleasesSecrets } from './secrets.js';
+import { type VariableStore } from './variables.js';
+export interface EnvironmentServiceOptions {
+    readonly database: DatabaseManager;
+    readonly drivers: DriverRegistry;
+    readonly guard: AccessGuard;
+    /** The application's secrets service, which seals the credentials. */
+    readonly secrets?: ReleasesSecrets;
+    /** Called after an environment changed or was removed, so open driver sessions are replaced. */
+    readonly onChanged: (environmentId: string) => Promise<void>;
+    /** How many Apps an environment holds, to refuse removing one in use. */
+    readonly countApps: (environmentId: string) => Promise<number>;
+    /** The open session's check, for `check`. */
+    readonly check: (environmentId: string) => Promise<{
+        ok: boolean;
+        message?: string;
+        details?: unknown;
+    }>;
+    /** Where the environments' variables are kept. */
+    readonly variables: VariableStore;
+}
+export declare class EnvironmentService {
+    private readonly options;
+    constructor(options: EnvironmentServiceOptions);
+    /** Anyone who may see environment settings, create Apps or open the Apps page may list environments. */
+    list(caller: Caller): Promise<readonly EnvironmentRecord[]>;
+    get(caller: Caller, id: string): Promise<EnvironmentRecord>;
+    drivers(caller: Caller): readonly DriverSummary[];
+    create(caller: Caller, input: EnvironmentInput): Promise<EnvironmentRecord>;
+    update(caller: Caller, id: string, input: EnvironmentInput): Promise<EnvironmentRecord>;
+    remove(caller: Caller, id: string): Promise<void>;
+    /** The environment's variables; a secret's value never leaves the server. */
+    listVariables(caller: Caller, id: string): Promise<readonly EnvironmentVariableView[]>;
+    /** Sets one variable every App of the environment gets, unless the App sets its own. */
+    setVariable(caller: Caller, id: string, name: string, input: SetEnvironmentVariableInput): Promise<EnvironmentVariableView>;
+    unsetVariable(caller: Caller, id: string, name: string): Promise<void>;
+    check(caller: Caller, id: string): Promise<{
+        ok: boolean;
+        message?: string;
+        details?: unknown;
+    }>;
+    /**
+     * Tries settings before they are saved: the driver validates them, a session is opened on a throwaway environment
+     * ID (so it never replaces a running environment's session), checked and closed. Editing an environment, the
+     * credentials not changed are its stored ones.
+     */
+    checkDraft(caller: Caller, input: EnvironmentCheckInput): Promise<EnvironmentCheckResult>;
+    /** The environment record, without access checks: for the other services. */
+    record(id: string): Promise<EnvironmentRecord>;
+    find(id: string): Promise<EnvironmentRecord | null>;
+    /** Whether the environment runs release images (the Docker run mode) rather than archives. */
+    runsImages(environment: EnvironmentRecord): boolean;
+    /** What a driver session is opened with: settings and decrypted credentials. */
+    driverEnvironment(id: string): Promise<{
+        readonly environment: EnvironmentRecord;
+        readonly driver: DeploymentDriver;
+        readonly target: DriverEnvironment;
+    }>;
+    private assertRegistry;
+    /** Anyone who may see environment settings, create Apps or open the Apps page reads environments and drivers. */
+    requireReader(caller: Caller): void;
+    private requireDriver;
+    private encrypt;
+    /** The record with the names of its stored credentials; credentials that no longer decrypt name none. */
+    private decode;
+    private decryptRow;
+    private findRow;
+    private query;
+}
+export declare function decodeEnvironment(row: Row, secretKeys?: readonly string[]): EnvironmentRecord;
+//# sourceMappingURL=environments.d.ts.map

package/dist/server/services/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../../server/services/environments.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAWxB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,CACd,aAAa,EAAE,MAAM,KAClB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnE,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;CACnC;AAED,qBAAa,kBAAkB;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,yBAAyB;IAEtE,wGAAwG;IAC3F,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IAW3D,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAKjE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,aAAa,EAAE;IAK3C,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC;IAwChB,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC;IAuDhB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB9D,6EAA6E;IAChE,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC;IAQ9C,wFAAwF;IAC3E,WAAW,CACtB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,CAAC;IAqBtB,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IAOH,KAAK,CAChB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAahE;;;;OAIG;IACU,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC;IAwElC,6EAA6E;IAChE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAM9C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAKhE,8FAA8F;IACvF,UAAU,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO;IAO1D,gFAAgF;IACnE,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAClD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;QACxC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;KACpC,CAAC;YAwBY,cAAc;IAoB5B,iHAAiH;IAC1G,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAW1C,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,OAAO;IASf,yGAAyG;IACzG,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,UAAU;YAaJ,OAAO;IAQrB,OAAO,CAAC,KAAK;CAGd;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,GAAG,EACR,UAAU,GAAE,SAAS,MAAM,EAAO,GACjC,iBAAiB,CAqBnB"}