@oneuptime/common 14.0.0 → 14.0.2

package/build/dist/Server/API/KubernetesClusterAiAccessAPI.js

@@ -0,0 +1,564 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import CommonAPI from "./CommonAPI";
+import Express from "../Utils/Express";
+import Response from "../Utils/Response";
+import OneUptimeDate from "../../Types/Date";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import ObjectID from "../../Types/ObjectID";
+import RunnerJobOrigin from "../../Types/Runbook/RunnerJobOrigin";
+import RunnerJobStatus from "../../Types/Runbook/RunnerJobStatus";
+import { DEFAULT_KUBECTL_TIMEOUT_MS, } from "../../Types/Kubernetes/KubernetesClusterAiAccess";
+import { KUBERNETES_AI_ACCESS_CREDENTIAL_PERMISSIONS } from "../../Types/Kubernetes/KubernetesClusterAiAccessPermissions";
+import KubernetesCluster from "../../Models/DatabaseModels/KubernetesCluster";
+import GlobalCache from "../Infrastructure/GlobalCache";
+import Semaphore from "../Infrastructure/Semaphore";
+import KubernetesClusterService from "../Services/KubernetesClusterService";
+import KubernetesClusterAiAccessService from "../Services/KubernetesClusterAiAccessService";
+import RunnerJobService from "../Services/RunnerJobService";
+import QueryHelper from "../Types/Database/QueryHelper";
+import logger from "../Utils/Logger";
+import { holdsAnyUnblockedPermission } from "../Utils/Runbook/RunbookExecutePermission";
+import KubectlJobRunner, { KUBECTL_CLAIM_TIMEOUT_MS, } from "../Utils/AI/ClusterAccess/KubectlJobRunner";
+const router = Express.getRouter();
+/*
+ * The cluster AI page's two custom calls. Everything else on that page is
+ * ordinary CRUD on KubernetesCluster (the bound Runner, the credential, the
+ * two switches, the allowlist).
+ *
+ *   POST /kubernetes-cluster/ai-access/status  { clusterId }
+ *     The readiness checklist: can OneUptime AI reach this cluster, what
+ *     may it do, and what is missing. Requires read access to the cluster;
+ *     the credential's name (and descriptions that name it) additionally
+ *     need permission to read credentials.
+ *
+ *   POST /kubernetes-cluster/ai-access/test    { clusterId }
+ *     Runs `kubectl version` and `kubectl auth can-i --list` through the
+ *     bound Runner and returns their output, so an operator can see the
+ *     access work (and the RBAC the Runner actually has) before an incident
+ *     does. Read-only, but it spends Runner time, so it requires edit access
+ *     to the cluster and has its own limits instead of spending the
+ *     project's investigation budget: one test at a time per cluster (an
+ *     atomic reservation), a few per minute and a cumulative ceiling per
+ *     hour per cluster, and a few per minute per user.
+ */
+async function getLoggedInProps(req) {
+    const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+    CommonAPI.assertAuthenticatedUser(props);
+    return Object.assign(Object.assign({}, props), { isMultiTenantRequest: false });
+}
+/*
+ * Access check under the USER's permissions inside the tenant. Null is
+ * "does not exist OR not yours", reported identically so the route never
+ * leaks whether an id exists in another project.
+ */
+async function findAccessibleCluster(data) {
+    const clusterIdString = data.req.body["clusterId"];
+    if (!clusterIdString || !ObjectID.isValidUUID(clusterIdString)) {
+        throw new BadDataException("clusterId is required.");
+    }
+    /*
+     * Read under the user's own props — so the cluster's read ACL (and any
+     * label-scoped block) applies exactly as on a CRUD read — and scoped to
+     * the tenant in the query itself.
+     */
+    const cluster = await KubernetesClusterService.findOneBy({
+        query: {
+            _id: clusterIdString,
+            projectId: data.tenantId,
+        },
+        select: { _id: true, projectId: true, name: true },
+        props: data.props,
+    });
+    /*
+     * A row from another project is reported exactly like a missing one
+     * (belt and braces: the query is already tenant-scoped), so the route
+     * never confirms that an id exists somewhere else.
+     */
+    if (!cluster ||
+        !cluster.id ||
+        !cluster.projectId ||
+        cluster.projectId.toString() !== data.tenantId.toString()) {
+        throw new BadDataException("Kubernetes cluster not found (or you do not have access to it).");
+    }
+    return cluster;
+}
+/*
+ * Mirrors KubernetesCluster's update ACL; a block row is a denial, not a
+ * grant. The access test is read-only, but it spends the bound Runner's
+ * time and prints the RBAC the Runner holds, so it is for the people who
+ * may edit the cluster.
+ */
+function assertCanEditCluster(props, projectId) {
+    var _a, _b;
+    if (props.isMasterAdmin) {
+        return;
+    }
+    const allowed = new KubernetesCluster().getUpdatePermissions();
+    const tenantPermission = (_a = props.userTenantAccessPermission) === null || _a === void 0 ? void 0 : _a[projectId.toString()];
+    const hasPermission = Boolean((_b = tenantPermission === null || tenantPermission === void 0 ? void 0 : tenantPermission.permissions) === null || _b === void 0 ? void 0 : _b.some((p) => {
+        return !p.isBlockPermission && allowed.includes(p.permission);
+    }));
+    if (!hasPermission) {
+        throw new NotAuthorizedException("You need permission to edit this Kubernetes cluster to run its AI access test.");
+    }
+}
+/*
+ * The access test's own limits. It enqueues real Runner jobs and holds the
+ * request open while they run, so it is bounded where it is triggered and
+ * never counted against the project-wide investigation brake (the
+ * chokepoint keeps access-test jobs out of it), so no amount of testing can
+ * starve real incident investigations:
+ *
+ * - one test at a time per cluster: an atomic reservation (Redis SET NX,
+ *   released when the test ends and expiring on its own after the longest
+ *   a test can run), so concurrent requests cannot all read "nothing
+ *   running" and all start. The per-cluster counts below are read inside
+ *   it, so they are exact;
+ * - a few per minute and a cumulative ceiling per hour per cluster, and a
+ *   few per minute per user across clusters — the per-user count is read
+ *   and the test's first command run under a per-user lock, so a user's
+ *   concurrent requests on different clusters are counted one after the
+ *   other. Counted on the RunnerJob rows the test creates, which every API
+ *   node shares.
+ */
+export const MAX_AI_ACCESS_TESTS_PER_CLUSTER_PER_MINUTE = 3;
+export const MAX_AI_ACCESS_TESTS_PER_CLUSTER_PER_HOUR = 30;
+export const MAX_AI_ACCESS_TESTS_PER_USER_PER_MINUTE = 6;
+/*
+ * A test job older than this is past both of its windows (claim plus
+ * execution, twice over), so a row a crashed request left Pending never
+ * blocks the next test for good — and neither does a reservation a crashed
+ * request never released.
+ */
+const AI_ACCESS_TEST_MAX_DURATION_MINUTES = 4;
+export const AI_ACCESS_TEST_RESERVATION_NAMESPACE = "kubernetes-ai-access-test";
+export const AI_ACCESS_TEST_USER_LOCK_NAMESPACE = "kubernetes-ai-access-test-user";
+/*
+ * Held from the per-user count until the test's first command has finished.
+ * The lock refreshes itself while it is held; the timeout is how long it
+ * outlives a request that died holding it.
+ */
+const AI_ACCESS_TEST_USER_LOCK_TIMEOUT_MS = 30000;
+const AI_ACCESS_TEST_USER_LOCK_ACQUIRE_TIMEOUT_MS = 15000;
+const ALREADY_RUNNING_MESSAGE = "An AI access test is already running for this cluster. Wait for it to finish, then run it again.";
+const AI_ACCESS_TEST_COMMANDS = [
+    "kubectl version",
+    "kubectl auth can-i --list",
+];
+/*
+ * Every access-test job's stepId starts with this; the first command's
+ * with the "-1-" form plus the user who ran it, so a test (not a command)
+ * can be counted per cluster and per user from the rows alone.
+ */
+export const AI_ACCESS_TEST_STEP_ID_PREFIX = "ai-access-test-";
+export function getAiAccessTestStepId(data) {
+    return `${AI_ACCESS_TEST_STEP_ID_PREFIX}${data.commandNumber}-${data.userId.toString()}`;
+}
+/*
+ * Take this cluster's one access-test slot, atomically, and return the
+ * token that releases it — or refuse: 429 while another test holds it, 503
+ * when the reservation cannot be checked at all (failing closed: the
+ * reservation is what makes "one at a time" true under concurrency).
+ */
+async function reserveClusterForAccessTest(clusterId) {
+    const token = ObjectID.generate().toString();
+    let isReserved = false;
+    try {
+        isReserved = await GlobalCache.setStringIfNotExists(AI_ACCESS_TEST_RESERVATION_NAMESPACE, clusterId.toString(), token, { expiresInSeconds: AI_ACCESS_TEST_MAX_DURATION_MINUTES * 60 });
+    }
+    catch (error) {
+        logger.error(`KubernetesClusterAiAccessAPI: could not reserve the AI access test of cluster ${clusterId.toString()}: ${error}`);
+        throw new ServiceUnavailableException("The AI access test could not start right now. Try again in a moment.");
+    }
+    if (!isReserved) {
+        throw new TooManyRequestsException(ALREADY_RUNNING_MESSAGE);
+    }
+    return token;
+}
+// Best effort: the reservation expires on its own if this fails.
+async function releaseClusterReservation(data) {
+    try {
+        await GlobalCache.deleteKeyIfValue(AI_ACCESS_TEST_RESERVATION_NAMESPACE, data.clusterId.toString(), data.token);
+    }
+    catch (error) {
+        logger.error(`KubernetesClusterAiAccessAPI: could not release the AI access test reservation of cluster ${data.clusterId.toString()}; it expires on its own: ${error}`);
+    }
+}
+/*
+ * The per-cluster limits, read while this request holds the cluster's
+ * reservation — so no other test of this cluster can be counting (or
+ * creating rows) at the same time.
+ */
+async function assertClusterAccessTestMayRun(data) {
+    const inFlight = (await RunnerJobService.countBy({
+        query: {
+            projectId: data.projectId,
+            kubernetesClusterId: data.clusterId,
+            stepId: QueryHelper.startsWith(AI_ACCESS_TEST_STEP_ID_PREFIX),
+            status: QueryHelper.any([
+                RunnerJobStatus.Pending,
+                RunnerJobStatus.Claimed,
+                RunnerJobStatus.Running,
+            ]),
+            createdAt: QueryHelper.greaterThan(OneUptimeDate.getSomeMinutesAgo(AI_ACCESS_TEST_MAX_DURATION_MINUTES)),
+        },
+        props: { isRoot: true },
+    })).toNumber();
+    if (inFlight > 0) {
+        throw new TooManyRequestsException(ALREADY_RUNNING_MESSAGE);
+    }
+    const testsForCluster = (await RunnerJobService.countBy({
+        query: {
+            projectId: data.projectId,
+            kubernetesClusterId: data.clusterId,
+            stepId: QueryHelper.startsWith(`${AI_ACCESS_TEST_STEP_ID_PREFIX}1-`),
+            createdAt: QueryHelper.greaterThan(OneUptimeDate.getSomeMinutesAgo(1)),
+        },
+        props: { isRoot: true },
+    })).toNumber();
+    if (testsForCluster >= MAX_AI_ACCESS_TESTS_PER_CLUSTER_PER_MINUTE) {
+        throw new TooManyRequestsException(`This cluster's AI access was tested ${testsForCluster} times in the last minute, which is its limit (${MAX_AI_ACCESS_TESTS_PER_CLUSTER_PER_MINUTE}). Try again in a minute.`);
+    }
+    /*
+     * The cumulative ceiling: access-test jobs are kept out of the project's
+     * investigation brake, so without this nothing would bound them over an
+     * hour.
+     */
+    const testsForClusterThisHour = (await RunnerJobService.countBy({
+        query: {
+            projectId: data.projectId,
+            kubernetesClusterId: data.clusterId,
+            stepId: QueryHelper.startsWith(`${AI_ACCESS_TEST_STEP_ID_PREFIX}1-`),
+            createdAt: QueryHelper.greaterThan(OneUptimeDate.getSomeHoursAgo(1)),
+        },
+        props: { isRoot: true },
+    })).toNumber();
+    if (testsForClusterThisHour >= MAX_AI_ACCESS_TESTS_PER_CLUSTER_PER_HOUR) {
+        throw new TooManyRequestsException(`This cluster's AI access was tested ${testsForClusterThisHour} times in the last hour, which is its limit (${MAX_AI_ACCESS_TESTS_PER_CLUSTER_PER_HOUR}). Try again later.`);
+    }
+}
+/*
+ * The per-user limit spans clusters, so the cluster reservation does not
+ * serialize it: the count is read and the test's first command run under a
+ * per-user lock, so a user's concurrent tests on different clusters cannot
+ * all read the same count. The lock is held until that first command has
+ * finished, because KubectlJobRunner.run enqueues and waits in one call and
+ * the job it creates is what the next count must see. That is seconds for
+ * a Runner that is online (the test refuses to start for one that is not);
+ * a second test of the same user started meanwhile waits up to the acquire
+ * timeout and is then told one of theirs is still starting.
+ */
+async function lockUserForAccessTestStart(userId) {
+    try {
+        return await Semaphore.lock({
+            key: userId.toString(),
+            namespace: AI_ACCESS_TEST_USER_LOCK_NAMESPACE,
+            lockTimeout: AI_ACCESS_TEST_USER_LOCK_TIMEOUT_MS,
+            acquireTimeout: AI_ACCESS_TEST_USER_LOCK_ACQUIRE_TIMEOUT_MS,
+        });
+    }
+    catch (error) {
+        logger.error(`KubernetesClusterAiAccessAPI: could not take the AI access test lock of user ${userId.toString()}: ${error}`);
+        throw new TooManyRequestsException("Another AI access test of yours is starting right now. Try again in a moment.");
+    }
+}
+async function releaseUserLock(mutex) {
+    try {
+        await Semaphore.release(mutex);
+    }
+    catch (error) {
+        logger.error(`KubernetesClusterAiAccessAPI: could not release an AI access test user lock; it expires on its own: ${error}`);
+    }
+}
+async function assertUserMayStartAccessTest(data) {
+    const testsByUser = (await RunnerJobService.countBy({
+        query: {
+            projectId: data.projectId,
+            stepId: QueryHelper.startsWith(getAiAccessTestStepId({ commandNumber: 1, userId: data.userId })),
+            createdAt: QueryHelper.greaterThan(OneUptimeDate.getSomeMinutesAgo(1)),
+        },
+        props: { isRoot: true },
+    })).toNumber();
+    if (testsByUser >= MAX_AI_ACCESS_TESTS_PER_USER_PER_MINUTE) {
+        throw new TooManyRequestsException(`You ran ${testsByUser} AI access tests in the last minute, which is the limit (${MAX_AI_ACCESS_TESTS_PER_USER_PER_MINUTE}). Try again in a minute.`);
+    }
+}
+/*
+ * One access-test command, run the way every AI kubectl command is
+ * (KubectlJobRunner.run): enqueued through the kubectl chokepoint as an
+ * access test — policy, the read-only rule and the current binding still
+ * apply; the investigation switch and the project's investigation brake do
+ * not — then waited on, read and recorded exactly like an investigation's
+ * command:
+ *
+ * - whether kubectl ran is read from the row (never ran, ran, or unknown for
+ *   a job a Runner took and went silent on), and a timeout is worded in
+ *   kubectl's terms ("did not pick up … Nothing was run", "what the command
+ *   did is unknown"), never a runbook step's;
+ * - the output and the error get the shared kubectl redaction and cap;
+ * - only a success or an ACCESS failure (never claimed, refused, timed out,
+ *   could not reach, authenticate to or was not authorized by the API
+ *   server) becomes the cluster's "Last verified" / "Last error". A command
+ *   that ran and failed for any other reason says nothing about the access
+ *   and must neither set nor clear it.
+ *
+ * No AI run: an access test has none to keep alive.
+ */
+async function runAccessTestCommand(data) {
+    return KubectlJobRunner.run({
+        projectId: data.projectId,
+        origin: RunnerJobOrigin.AiInvestigation,
+        kubernetesClusterId: data.clusterId,
+        targetRunnerId: data.runnerId,
+        credentialId: data.credentialId,
+        command: data.command,
+        stepId: data.stepId,
+        timeoutInMs: DEFAULT_KUBECTL_TIMEOUT_MS,
+        claimTimeoutInMs: KUBECTL_CLAIM_TIMEOUT_MS,
+        isAccessTest: true,
+    });
+}
+/*
+ * Stands in for a gap description that names the Kubernetes credential,
+ * for a caller who may read the cluster but not credentials.
+ */
+export const RESTRICTED_CREDENTIAL_GAP_DESCRIPTION = "The Kubernetes credential this cluster's Runner needs is missing or cannot be used. Someone who can view Runner credentials can see which one on this page.";
+/*
+ * The status as this caller may see it. Reading the cluster shows its
+ * readiness; the credential's name — and gap descriptions that name it —
+ * additionally need permission to read credentials, the rule the AI page's
+ * credential picker and the investigation panel apply. The credential id is
+ * left out with it. Everything the route itself does uses the full status.
+ */
+export function toViewerStatus(data) {
+    if (data.canReadCredentials) {
+        return data.status;
+    }
+    const viewerStatus = Object.assign(Object.assign({}, data.status), { gaps: data.status.gaps.map((gap) => {
+            return gap.code === "credential_missing"
+                ? Object.assign(Object.assign({}, gap), { description: RESTRICTED_CREDENTIAL_GAP_DESCRIPTION }) : gap;
+        }) });
+    delete viewerStatus.credentialId;
+    delete viewerStatus.credentialName;
+    return viewerStatus;
+}
+function canReadCredentials(props, projectId) {
+    return holdsAnyUnblockedPermission({
+        props,
+        projectId,
+        allowed: KUBERNETES_AI_ACCESS_CREDENTIAL_PERMISSIONS,
+    });
+}
+router.post("/kubernetes-cluster/ai-access/status", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+    try {
+        const props = await getLoggedInProps(req);
+        const tenantId = CommonAPI.assertTenantScoped(props);
+        const cluster = await findAccessibleCluster({
+            req,
+            props,
+            tenantId,
+        });
+        const status = await KubernetesClusterAiAccessService.getStatusForCluster({
+            clusterId: cluster.id,
+            projectId: tenantId,
+        });
+        if (!status) {
+            throw new BadDataException("Kubernetes cluster not found.");
+        }
+        Response.sendJsonObjectResponse(req, res, toViewerStatus({
+            status,
+            canReadCredentials: canReadCredentials(props, tenantId),
+        }));
+        return;
+    }
+    catch (err) {
+        next(err);
+        return;
+    }
+});
+/*
+ * Start the test: under this user's lock, check the per-user limit and run
+ * the first command, so the next concurrent test of this user counts its
+ * job (see lockUserForAccessTestStart). The limit refusal is thrown (the
+ * route answers 429); a refusal from the chokepoint, or a wait that broke,
+ * is returned as the first command's failure.
+ */
+async function startAccessTest(data) {
+    const userLock = await lockUserForAccessTestStart(data.userId);
+    try {
+        await assertUserMayStartAccessTest({
+            projectId: data.projectId,
+            userId: data.userId,
+        });
+        try {
+            const outcome = await runAccessTestCommand({
+                projectId: data.projectId,
+                clusterId: data.clusterId,
+                runnerId: data.runnerId,
+                credentialId: data.credentialId,
+                command: data.command,
+                stepId: getAiAccessTestStepId({
+                    commandNumber: 1,
+                    userId: data.userId,
+                }),
+            });
+            return { outcome };
+        }
+        catch (error) {
+            return { error };
+        }
+    }
+    finally {
+        await releaseUserLock(userLock);
+    }
+}
+function describeFailure(error) {
+    if (error === undefined || error === null) {
+        return "The command could not be started.";
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+router.post("/kubernetes-cluster/ai-access/test", UserMiddleware.getUserMiddleware, async (req, res, next) => {
+    var _a, _b;
+    try {
+        const props = await getLoggedInProps(req);
+        const tenantId = CommonAPI.assertTenantScoped(props);
+        const cluster = await findAccessibleCluster({
+            req,
+            props,
+            tenantId,
+        });
+        assertCanEditCluster(props, tenantId);
+        const viewerCanReadCredentials = canReadCredentials(props, tenantId);
+        // One test at a time per cluster: an atomic reservation, held to the end.
+        const reservation = await reserveClusterForAccessTest(cluster.id);
+        try {
+            await assertClusterAccessTestMayRun({
+                projectId: tenantId,
+                clusterId: cluster.id,
+            });
+            const status = await KubernetesClusterAiAccessService.getStatusForCluster({
+                clusterId: cluster.id,
+                projectId: tenantId,
+            });
+            if (!status) {
+                throw new BadDataException("Kubernetes cluster not found.");
+            }
+            /*
+             * The test needs a reachable Runner, not the investigation switch:
+             * an operator checks access BEFORE turning AI on. Only gaps that
+             * block the transport itself stop it.
+             */
+            const transportGap = status.gaps.find((gap) => {
+                return (gap.blocks === "both" &&
+                    gap.code !== "project_ai_disabled" &&
+                    gap.code !== "llm_provider_missing");
+            });
+            if (transportGap || !status.runner) {
+                Response.sendJsonObjectResponse(req, res, {
+                    ok: false,
+                    message: transportGap
+                        ? `${transportGap.title}. ${transportGap.nextStep}`
+                        : "No Runner is bound to this cluster.",
+                    results: [],
+                    status: toViewerStatus({
+                        status,
+                        canReadCredentials: viewerCanReadCredentials,
+                    }),
+                });
+                return;
+            }
+            const runnerId = new ObjectID(status.runner.id);
+            const results = [];
+            let allSucceeded = true;
+            const start = await startAccessTest({
+                projectId: tenantId,
+                clusterId: cluster.id,
+                userId: props.userId,
+                runnerId,
+                credentialId: status.credentialId,
+                command: AI_ACCESS_TEST_COMMANDS[0],
+            });
+            for (let index = 0; index < AI_ACCESS_TEST_COMMANDS.length; index++) {
+                const command = AI_ACCESS_TEST_COMMANDS[index];
+                let failure = undefined;
+                let outcome = undefined;
+                if (index === 0) {
+                    outcome = start.outcome;
+                    failure = start.error;
+                }
+                else {
+                    try {
+                        outcome = await runAccessTestCommand({
+                            projectId: tenantId,
+                            clusterId: cluster.id,
+                            runnerId,
+                            credentialId: status.credentialId,
+                            command,
+                            stepId: getAiAccessTestStepId({
+                                commandNumber: index + 1,
+                                userId: props.userId,
+                            }),
+                        });
+                    }
+                    catch (error) {
+                        failure = error;
+                    }
+                }
+                if (!outcome) {
+                    allSucceeded = false;
+                    results.push({
+                        command,
+                        succeeded: false,
+                        exitCode: null,
+                        output: "",
+                        errorMessage: describeFailure(failure),
+                    });
+                    break;
+                }
+                allSucceeded = allSucceeded && outcome.succeeded;
+                results.push({
+                    command: outcome.displayCommand,
+                    succeeded: outcome.succeeded,
+                    exitCode: (_a = outcome.exitCode) !== null && _a !== void 0 ? _a : null,
+                    output: outcome.output,
+                    errorMessage: (_b = outcome.errorMessage) !== null && _b !== void 0 ? _b : null,
+                });
+                if (!outcome.succeeded) {
+                    break;
+                }
+            }
+            const refreshed = await KubernetesClusterAiAccessService.getStatusForCluster({
+                clusterId: cluster.id,
+                projectId: tenantId,
+            });
+            Response.sendJsonObjectResponse(req, res, {
+                ok: allSucceeded,
+                message: allSucceeded
+                    ? `OneUptime AI can run kubectl on "${cluster.name}" through Runner "${status.runner.name}".`
+                    : "kubectl could not run successfully — see the command output below.",
+                results,
+                status: toViewerStatus({
+                    status: refreshed || status,
+                    canReadCredentials: viewerCanReadCredentials,
+                }),
+            });
+            return;
+        }
+        finally {
+            await releaseClusterReservation({
+                clusterId: cluster.id,
+                token: reservation,
+            });
+        }
+    }
+    catch (err) {
+        next(err);
+        return;
+    }
+});
+export default router;
+//# sourceMappingURL=KubernetesClusterAiAccessAPI.js.map

package/build/dist/Server/API/KubernetesClusterAiAccessAPI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KubernetesClusterAiAccessAPI.js","sourceRoot":"","sources":["../../../../Server/API/KubernetesClusterAiAccessAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,SAAS,MAAM,aAAa,CAAC;AACpC,OAAO,OAKN,MAAM,kBAAkB,CAAC;AAC1B,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AAEzC,OAAO,aAAa,MAAM,kBAAkB,CAAC;AAC7C,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAO,2BAA2B,MAAM,mDAAmD,CAAC;AAC5F,OAAO,wBAAwB,MAAM,gDAAgD,CAAC;AACtF,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAM5C,OAAO,eAAe,MAAM,qCAAqC,CAAC;AAClE,OAAO,eAAe,MAAM,qCAAqC,CAAC;AAClE,OAAO,EACL,0BAA0B,GAG3B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,2CAA2C,EAAE,MAAM,6DAA6D,CAAC;AAC1H,OAAO,iBAAiB,MAAM,+CAA+C,CAAC;AAC9E,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,SAA6B,MAAM,6BAA6B,CAAC;AACxE,OAAO,wBAAwB,MAAM,sCAAsC,CAAC;AAC5E,OAAO,gCAAgC,MAAM,8CAA8C,CAAC;AAC5F,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAC5D,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,gBAAgB,EAAE,EACvB,wBAAwB,GAEzB,MAAM,4CAA4C,CAAC;AAEpD,MAAM,MAAM,GAAkB,OAAO,CAAC,SAAS,EAAE,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,KAAK,UAAU,gBAAgB,CAC7B,GAAmB;IAEnB,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;IAEzD,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAEzC,uCAAY,KAAK,KAAE,oBAAoB,EAAE,KAAK,IAAG;AACnD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAAC,IAIpC;IACC,MAAM,eAAe,GAAuB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAExD,CAAC;IAEd,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,MAAM,OAAO,GACX,MAAM,wBAAwB,CAAC,SAAS,CAAC;QACvC,KAAK,EAAE;YACL,GAAG,EAAE,eAAe;YACpB,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB;QACD,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QAClD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEL;;;;OAIG;IACH,IACE,CAAC,OAAO;QACR,CAAC,OAAO,CAAC,EAAE;QACX,CAAC,OAAO,CAAC,SAAS;QAClB,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EACzD,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,KAAqC,EACrC,SAAmB;;IAEnB,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GACX,IAAI,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,CAAC;IAEjD,MAAM,gBAAgB,GACpB,MAAA,KAAK,CAAC,0BAA0B,0CAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAY,OAAO,CACpC,MAAA,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,WAAW,0CAAE,IAAI,CAAC,CAAC,CAAiB,EAAW,EAAE;QACjE,OAAO,CAAC,CAAC,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAChE,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,sBAAsB,CAC9B,gFAAgF,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAW,CAAC,CAAC;AACpE,MAAM,CAAC,MAAM,wCAAwC,GAAW,EAAE,CAAC;AACnE,MAAM,CAAC,MAAM,uCAAuC,GAAW,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,mCAAmC,GAAW,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,2BAA2B,CAAC;AAC9B,MAAM,CAAC,MAAM,kCAAkC,GAC7C,gCAAgC,CAAC;AAEnC;;;;GAIG;AACH,MAAM,mCAAmC,GAAW,KAAM,CAAC;AAC3D,MAAM,2CAA2C,GAAW,KAAM,CAAC;AAEnE,MAAM,uBAAuB,GAC3B,kGAAkG,CAAC;AAErG,MAAM,uBAAuB,GAAkB;IAC7C,iBAAiB;IACjB,2BAA2B;CAC5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAW,iBAAiB,CAAC;AAEvE,MAAM,UAAU,qBAAqB,CAAC,IAGrC;IACC,OAAO,GAAG,6BAA6B,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,2BAA2B,CACxC,SAAmB;IAEnB,MAAM,KAAK,GAAW,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IACrD,IAAI,UAAU,GAAY,KAAK,CAAC;IAEhC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,WAAW,CAAC,oBAAoB,CACjD,oCAAoC,EACpC,SAAS,CAAC,QAAQ,EAAE,EACpB,KAAK,EACL,EAAE,gBAAgB,EAAE,mCAAmC,GAAG,EAAE,EAAE,CAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,iFAAiF,SAAS,CAAC,QAAQ,EAAE,KAAK,KAAK,EAAE,CAClH,CAAC;QACF,MAAM,IAAI,2BAA2B,CACnC,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,yBAAyB,CAAC,IAGxC;IACC,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,gBAAgB,CAChC,oCAAoC,EACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EACzB,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,6FAA6F,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,4BAA4B,KAAK,EAAE,CAC1J,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,6BAA6B,CAAC,IAG5C;IACC,MAAM,QAAQ,GAAW,CACvB,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,mBAAmB,EAAE,IAAI,CAAC,SAAS;YACnC,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,6BAA6B,CAAC;YAC7D,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;gBACtB,eAAe,CAAC,OAAO;gBACvB,eAAe,CAAC,OAAO;gBACvB,eAAe,CAAC,OAAO;aACxB,CAAC;YACF,SAAS,EAAE,WAAW,CAAC,WAAW,CAChC,aAAa,CAAC,iBAAiB,CAAC,mCAAmC,CAAC,CACrE;SACF;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACxB,CAAC,CACH,CAAC,QAAQ,EAAE,CAAC;IAEb,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAW,CAC9B,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,mBAAmB,EAAE,IAAI,CAAC,SAAS;YACnC,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,6BAA6B,IAAI,CAAC;YACpE,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;SACvE;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACxB,CAAC,CACH,CAAC,QAAQ,EAAE,CAAC;IAEb,IAAI,eAAe,IAAI,0CAA0C,EAAE,CAAC;QAClE,MAAM,IAAI,wBAAwB,CAChC,uCAAuC,eAAe,kDAAkD,0CAA0C,2BAA2B,CAC9K,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,uBAAuB,GAAW,CACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,mBAAmB,EAAE,IAAI,CAAC,SAAS;YACnC,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,6BAA6B,IAAI,CAAC;YACpE,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;SACrE;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACxB,CAAC,CACH,CAAC,QAAQ,EAAE,CAAC;IAEb,IAAI,uBAAuB,IAAI,wCAAwC,EAAE,CAAC;QACxE,MAAM,IAAI,wBAAwB,CAChC,uCAAuC,uBAAuB,gDAAgD,wCAAwC,qBAAqB,CAC5K,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,0BAA0B,CACvC,MAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;YACtB,SAAS,EAAE,kCAAkC;YAC7C,WAAW,EAAE,mCAAmC;YAChD,cAAc,EAAE,2CAA2C;SAC5D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,gFAAgF,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,EAAE,CAC9G,CAAC;QACF,MAAM,IAAI,wBAAwB,CAChC,+EAA+E,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAqB;IAClD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,uGAAuG,KAAK,EAAE,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,IAG3C;IACC,MAAM,WAAW,GAAW,CAC1B,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,WAAW,CAAC,UAAU,CAC5B,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CACjE;YACD,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;SACvE;QACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACxB,CAAC,CACH,CAAC,QAAQ,EAAE,CAAC;IAEb,IAAI,WAAW,IAAI,uCAAuC,EAAE,CAAC;QAC3D,MAAM,IAAI,wBAAwB,CAChC,WAAW,WAAW,4DAA4D,uCAAuC,2BAA2B,CACrJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAOnC;IACC,OAAO,gBAAgB,CAAC,GAAG,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,eAAe,CAAC,eAAe;QACvC,mBAAmB,EAAE,IAAI,CAAC,SAAS;QACnC,cAAc,EAAE,IAAI,CAAC,QAAQ;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,0BAA0B;QACvC,gBAAgB,EAAE,wBAAwB;QAC1C,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAChD,6JAA6J,CAAC;AAEhK;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAG9B;IACC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,mCACb,IAAI,CAAC,MAAM,KACd,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC,GAA0B,EAAyB,EAAE;YACpD,OAAO,GAAG,CAAC,IAAI,KAAK,oBAAoB;gBACtC,CAAC,iCAAM,GAAG,KAAE,WAAW,EAAE,qCAAqC,IAC9D,CAAC,CAAC,GAAG,CAAC;QACV,CAAC,CACF,GACF,CAAC;IAEF,OAAO,YAAY,CAAC,YAAY,CAAC;IACjC,OAAO,YAAY,CAAC,cAAc,CAAC;IAEnC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAqC,EACrC,SAAmB;IAEnB,OAAO,2BAA2B,CAAC;QACjC,KAAK;QACL,SAAS;QACT,OAAO,EAAE,2CAA2C;KACrD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,IAAI,CACT,sCAAsC,EACtC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EACH,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,KAAK,GAAmC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAsB,MAAM,qBAAqB,CAAC;YAC7D,GAAG;YACH,KAAK;YACL,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,MAAM,GACV,MAAM,gCAAgC,CAAC,mBAAmB,CAAC;YACzD,SAAS,EAAE,OAAO,CAAC,EAAG;YACtB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEL,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;QAC9D,CAAC;QAED,QAAQ,CAAC,sBAAsB,CAC7B,GAAG,EACH,GAAG,EACH,cAAc,CAAC;YACb,MAAM;YACN,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;SACxD,CAA0B,CAC5B,CAAC;QACF,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO;IACT,CAAC;AACH,CAAC,CACF,CAAC;AAEF;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,IAO9B;IACC,MAAM,QAAQ,GAAmB,MAAM,0BAA0B,CAC/D,IAAI,CAAC,MAAM,CACZ,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,4BAA4B,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,OAAO,GAAsB,MAAM,oBAAoB,CAAC;gBAC5D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,qBAAqB,CAAC;oBAC5B,aAAa,EAAE,CAAC;oBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;aACH,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IAED,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,IAAI,CACT,oCAAoC,EACpC,cAAc,CAAC,iBAAiB,EAChC,KAAK,EACH,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;;IACjB,IAAI,CAAC;QACH,MAAM,KAAK,GAAmC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAsB,MAAM,qBAAqB,CAAC;YAC7D,GAAG;YACH,KAAK;YACL,QAAQ;SACT,CAAC,CAAC;QAEH,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEtC,MAAM,wBAAwB,GAAY,kBAAkB,CAC1D,KAAK,EACL,QAAQ,CACT,CAAC;QAEF,0EAA0E;QAC1E,MAAM,WAAW,GAAW,MAAM,2BAA2B,CAC3D,OAAO,CAAC,EAAG,CACZ,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,6BAA6B,CAAC;gBAClC,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,OAAO,CAAC,EAAG;aACvB,CAAC,CAAC;YAEH,MAAM,MAAM,GACV,MAAM,gCAAgC,CAAC,mBAAmB,CAAC;gBACzD,SAAS,EAAE,OAAO,CAAC,EAAG;gBACtB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEL,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CAAC,+BAA+B,CAAC,CAAC;YAC9D,CAAC;YAED;;;;eAIG;YACH,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAA0B,EAAE,EAAE;gBAC9C,OAAO,CACL,GAAG,CAAC,MAAM,KAAK,MAAM;oBACrB,GAAG,CAAC,IAAI,KAAK,qBAAqB;oBAClC,GAAG,CAAC,IAAI,KAAK,sBAAsB,CACpC,CAAC;YACJ,CAAC,CAAC,CAAC;YAEL,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnC,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBACxC,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,YAAY;wBACnB,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,KAAK,YAAY,CAAC,QAAQ,EAAE;wBACnD,CAAC,CAAC,qCAAqC;oBACzC,OAAO,EAAE,EAAE;oBACX,MAAM,EAAE,cAAc,CAAC;wBACrB,MAAM;wBACN,kBAAkB,EAAE,wBAAwB;qBAC7C,CAA0B;iBAC5B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAa,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAsB,EAAE,CAAC;YACtC,IAAI,YAAY,GAAY,IAAI,CAAC;YAEjC,MAAM,KAAK,GAGP,MAAM,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,OAAO,CAAC,EAAG;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAO;gBACrB,QAAQ;gBACR,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAE;aACrC,CAAC,CAAC;YAEH,KACE,IAAI,KAAK,GAAW,CAAC,EACrB,KAAK,GAAG,uBAAuB,CAAC,MAAM,EACtC,KAAK,EAAE,EACP,CAAC;gBACD,MAAM,OAAO,GAAW,uBAAuB,CAAC,KAAK,CAAE,CAAC;gBACxD,IAAI,OAAO,GAAY,SAAS,CAAC;gBACjC,IAAI,OAAO,GAAkC,SAAS,CAAC;gBAEvD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;oBACxB,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,oBAAoB,CAAC;4BACnC,SAAS,EAAE,QAAQ;4BACnB,SAAS,EAAE,OAAO,CAAC,EAAG;4BACtB,QAAQ;4BACR,YAAY,EAAE,MAAM,CAAC,YAAY;4BACjC,OAAO;4BACP,MAAM,EAAE,qBAAqB,CAAC;gCAC5B,aAAa,EAAE,KAAK,GAAG,CAAC;gCACxB,MAAM,EAAE,KAAK,CAAC,MAAO;6BACtB,CAAC;yBACH,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,OAAO,GAAG,KAAK,CAAC;oBAClB,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,YAAY,GAAG,KAAK,CAAC;oBACrB,OAAO,CAAC,IAAI,CAAC;wBACX,OAAO;wBACP,SAAS,EAAE,KAAK;wBAChB,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,EAAE;wBACV,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC;qBACvC,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;gBAED,YAAY,GAAG,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;gBAEjD,OAAO,CAAC,IAAI,CAAC;oBACX,OAAO,EAAE,OAAO,CAAC,cAAc;oBAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,IAAI;oBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,YAAY,EAAE,MAAA,OAAO,CAAC,YAAY,mCAAI,IAAI;iBAC3C,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GACb,MAAM,gCAAgC,CAAC,mBAAmB,CAAC;gBACzD,SAAS,EAAE,OAAO,CAAC,EAAG;gBACtB,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YAEL,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;gBACxC,EAAE,EAAE,YAAY;gBAChB,OAAO,EAAE,YAAY;oBACnB,CAAC,CAAC,oCAAoC,OAAO,CAAC,IAAI,qBAAqB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI;oBAC7F,CAAC,CAAC,oEAAoE;gBACxE,OAAO;gBACP,MAAM,EAAE,cAAc,CAAC;oBACrB,MAAM,EAAE,SAAS,IAAI,MAAM;oBAC3B,kBAAkB,EAAE,wBAAwB;iBAC7C,CAA0B;aAC5B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;gBAAS,CAAC;YACT,MAAM,yBAAyB,CAAC;gBAC9B,SAAS,EAAE,OAAO,CAAC,EAAG;gBACtB,KAAK,EAAE,WAAW;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO;IACT,CAAC;AACH,CAAC,CACF,CAAC;AAEF,eAAe,MAAM,CAAC"}