@plumbus/core 0.7.1 → 0.8.0-beta.1

package/dist/tenancy/data-plane-provisioning.js

@@ -0,0 +1,639 @@
+// ── Tenant Data-Plane Provisioning ──
+// Creates and tears down the Postgres data plane that backs a single tenant:
+// the database itself, an owner role (used by migrations) and a least-privilege
+// runtime role (used at request time). Applications describe the data plane they
+// need; the framework performs the DDL. No application should open a raw client
+// or issue provisioning DDL of its own.
+//
+// Every step is idempotent: existing objects are detected up front and the
+// duplicate-object SQLSTATEs (42P04 / 42710) are also tolerated so that two
+// concurrent provisioners converge on the same outcome. `CREATE DATABASE` and
+// `DROP DATABASE` are issued outside any transaction, which Postgres requires.
+//
+// Key exports: provisionDataPlane, dropDataPlane
+import { PlumbusError } from '../errors/plumbus-error.js';
+import { ErrorCode } from '../types/enums.js';
+// ── Errors ──
+/** An identifier supplied by a caller is not safe to use as a SQL identifier. */
+export class DataPlaneNameError extends PlumbusError {
+    constructor(message, metadata) {
+        super(ErrorCode.Validation, message, metadata);
+        this.name = 'DataPlaneNameError';
+    }
+}
+/** A destructive operation was refused because it fell outside the caller's guard. */
+export class DataPlaneGuardError extends PlumbusError {
+    constructor(message, metadata) {
+        super(ErrorCode.Forbidden, message, metadata);
+        this.name = 'DataPlaneGuardError';
+    }
+}
+/** A provisioning step failed; `metadata.step` names the step that failed. */
+export class DataPlaneProvisioningError extends PlumbusError {
+    constructor(message, metadata) {
+        super(ErrorCode.Internal, message, metadata);
+        this.name = 'DataPlaneProvisioningError';
+    }
+}
+// ── Identifier safety ──
+/**
+ * Identifiers are restricted to unquoted-lowercase form. Everything that reaches
+ * a SQL string is validated against this first and then double-quoted, so a
+ * hostile tenant name can neither terminate the identifier nor fold case.
+ */
+const IDENTIFIER_PATTERN = /^[a-z_][a-z0-9_]{0,62}$/;
+/** `pg_` is reserved by Postgres for system roles, schemas and namespaces. */
+const RESERVED_PREFIX = 'pg_';
+/** Encoding / locale names are literals, not identifiers; keep them equally narrow. */
+const LOCALE_PATTERN = /^[A-Za-z0-9_.@-]{1,64}$/;
+const ALLOWED_TABLE_PRIVILEGES = [
+    'SELECT',
+    'INSERT',
+    'UPDATE',
+    'DELETE',
+    'TRUNCATE',
+    'REFERENCES',
+    'TRIGGER',
+];
+const DEFAULT_TABLE_PRIVILEGES = [
+    'SELECT',
+    'INSERT',
+    'UPDATE',
+    'DELETE',
+];
+/** SQLSTATE 42P04 — duplicate_database. */
+const DUPLICATE_DATABASE = '42P04';
+/** SQLSTATE 42710 — duplicate_object (covers duplicate roles and schemas). */
+const DUPLICATE_OBJECT = '42710';
+/**
+ * Validates a caller-supplied identifier and returns it unchanged.
+ *
+ * @param extraPattern additional convention the caller requires (e.g. a tenant
+ *   database prefix). Applied on top of the framework pattern, never instead of it.
+ */
+export function assertSafeIdentifier(value, field, extraPattern) {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new DataPlaneNameError(`${field} must be a non-empty string`, { field });
+    }
+    if (!IDENTIFIER_PATTERN.test(value)) {
+        throw new DataPlaneNameError(`${field} "${value}" is not a safe SQL identifier (expected /^[a-z_][a-z0-9_]{0,62}$/)`, { field, value });
+    }
+    if (value.startsWith(RESERVED_PREFIX)) {
+        throw new DataPlaneNameError(`${field} "${value}" uses the reserved "pg_" prefix`, {
+            field,
+            value,
+        });
+    }
+    if (extraPattern && !matchesPattern(extraPattern, value)) {
+        throw new DataPlaneNameError(`${field} "${value}" does not match the required naming convention ${extraPattern}`, { field, value, pattern: extraPattern.source });
+    }
+    return value;
+}
+/**
+ * Tests a pattern without mutating it. A caller-supplied `/g` or `/y` regex keeps
+ * `lastIndex` between calls, which would make a guard pass or fail by turn order.
+ */
+function matchesPattern(pattern, value) {
+    const flags = pattern.flags.replace(/[gy]/g, '');
+    return new RegExp(pattern.source, flags).test(value);
+}
+/** Double-quotes an already-validated identifier. Defence in depth, not the defence. */
+export function quoteIdentifier(value) {
+    return `"${value.replace(/"/g, '""')}"`;
+}
+function assertLocaleToken(value, field) {
+    if (!LOCALE_PATTERN.test(value)) {
+        throw new DataPlaneNameError(`${field} "${value}" is not a valid ${field} token`, {
+            field,
+            value,
+        });
+    }
+    return value;
+}
+function normalizeTablePrivileges(privileges) {
+    if (!privileges)
+        return [...DEFAULT_TABLE_PRIVILEGES];
+    if (privileges.length === 0) {
+        throw new DataPlaneNameError('runtimeTablePrivileges must not be empty');
+    }
+    return privileges.map((privilege) => {
+        const upper = privilege.toUpperCase();
+        const match = ALLOWED_TABLE_PRIVILEGES.find((allowed) => allowed === upper);
+        if (!match) {
+            throw new DataPlaneNameError(`Unsupported table privilege "${privilege}"`, { privilege });
+        }
+        return match;
+    });
+}
+function isConnectionString(connection) {
+    return typeof connection.connectionString === 'string';
+}
+async function openClient(connection, options) {
+    const postgresModule = (await import('postgres')).default;
+    const shared = {
+        max: 1,
+        connect_timeout: options.connectTimeoutSeconds,
+        // Provisioning DDL is chatty ("role ... does not exist, skipping"); the step
+        // log is the record, not stderr.
+        onnotice: () => { },
+    };
+    if (isConnectionString(connection)) {
+        return postgresModule(connection.connectionString, options.database ? { ...shared, database: options.database } : shared);
+    }
+    return postgresModule({
+        ...shared,
+        host: connection.host,
+        port: connection.port,
+        database: options.database ?? connection.database,
+        username: connection.user,
+        password: connection.password,
+        ssl: connection.ssl,
+    });
+}
+async function closeClient(client) {
+    await client.end({ timeout: 5 });
+}
+function sqlStateOf(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    const code = error.code;
+    return typeof code === 'string' ? code : undefined;
+}
+/** Token swapped for the escaped password literal at execution time; what the step log keeps. */
+const PASSWORD_SLOT = '__PLUMBUS_PASSWORD_LITERAL__';
+async function execute(client, statement, step, target) {
+    try {
+        await client.unsafe(statement);
+    }
+    catch (error) {
+        throw new DataPlaneProvisioningError(`Data-plane step "${step}" failed for "${target}": ${error.message}`, { step, target, sqlState: sqlStateOf(error) });
+    }
+}
+/**
+ * Escapes a password on the server with `quote_literal`, so the result honours the
+ * connection's `standard_conforming_strings` setting instead of assuming it.
+ */
+async function quoteLiteral(client, value) {
+    const rows = await client `SELECT quote_literal(${value}) AS literal`;
+    const literal = rows[0]?.literal;
+    if (typeof literal !== 'string') {
+        throw new DataPlaneProvisioningError('Server refused to quote a role password');
+    }
+    return literal;
+}
+function normalizeRole(role, field, namePattern) {
+    const spec = typeof role === 'string' ? { name: role } : role;
+    const name = assertSafeIdentifier(spec.name, field, namePattern);
+    if (spec.password !== undefined) {
+        if (typeof spec.password !== 'string' || spec.password.length === 0) {
+            throw new DataPlaneNameError(`${field}.password must be a non-empty string when provided`, {
+                field,
+            });
+        }
+        if (spec.password.includes('\u0000')) {
+            throw new DataPlaneNameError(`${field}.password must not contain a NUL character`, { field });
+        }
+        return { name, password: spec.password };
+    }
+    return { name };
+}
+/**
+ * Creates a tenant's data plane, idempotently.
+ *
+ * Performs, in order: owner and runtime roles, admin membership of the owner role
+ * (required to set the database owner and default privileges when the admin is not
+ * a superuser), `CREATE DATABASE` outside a transaction, database-level revocation
+ * of PUBLIC, then per-schema grants and default privileges inside the new database.
+ *
+ * Safe to re-run after a partial failure: each step reports `created` or
+ * `already-present`, so a caller can resume without special-casing.
+ */
+export async function provisionDataPlane(options) {
+    const namePattern = options.namePattern;
+    const databaseName = assertSafeIdentifier(options.databaseName, 'databaseName', namePattern);
+    const owner = normalizeRole(options.ownerRole, 'ownerRole', namePattern);
+    const runtime = normalizeRole(options.runtimeRole, 'runtimeRole', namePattern);
+    if (owner.name === runtime.name) {
+        throw new DataPlaneNameError(`ownerRole and runtimeRole must differ (both "${owner.name}"); the runtime role exists to hold fewer privileges than the owner`, { ownerRole: owner.name, runtimeRole: runtime.name });
+    }
+    const extraSchemas = (options.schemas ?? []).map((schema) => assertSafeIdentifier(schema, 'schema'));
+    const tablePrivileges = normalizeTablePrivileges(options.runtimeTablePrivileges);
+    const template = options.template
+        ? assertSafeIdentifier(options.template, 'template')
+        : undefined;
+    const encoding = options.encoding ? assertLocaleToken(options.encoding, 'encoding') : undefined;
+    const locale = options.locale ? assertLocaleToken(options.locale, 'locale') : undefined;
+    const connectTimeoutSeconds = options.connectTimeoutSeconds ?? 10;
+    const steps = [];
+    const rolesCreated = [];
+    const rolesAlreadyPresent = [];
+    const schemasCreated = [];
+    const schemasAlreadyPresent = [];
+    let databaseCreated = false;
+    const admin = await openClient(options.adminConnection, { connectTimeoutSeconds });
+    try {
+        for (const role of [owner, runtime]) {
+            const created = await ensureRole(admin, role, steps, {
+                updatePassword: options.updateExistingRolePasswords === true,
+            });
+            (created ? rolesCreated : rolesAlreadyPresent).push(role.name);
+        }
+        await ensureAdminMembership(admin, owner.name, steps);
+        databaseCreated = await ensureDatabase(admin, databaseName, owner.name, steps, {
+            template,
+            encoding,
+            locale,
+        });
+        await applyDatabaseGrants(admin, databaseName, owner.name, runtime.name, steps);
+    }
+    finally {
+        await closeClient(admin);
+    }
+    const target = await openClient(options.adminConnection, {
+        database: databaseName,
+        connectTimeoutSeconds,
+    });
+    try {
+        for (const schema of ['public', ...extraSchemas]) {
+            if (schema !== 'public') {
+                const created = await ensureSchema(target, schema, owner.name, steps);
+                (created ? schemasCreated : schemasAlreadyPresent).push(schema);
+            }
+            await applySchemaGrants(target, schema, owner.name, runtime.name, tablePrivileges, steps);
+        }
+    }
+    finally {
+        await closeClient(target);
+    }
+    return {
+        databaseName,
+        ownerRole: owner.name,
+        runtimeRole: runtime.name,
+        databaseCreated,
+        rolesCreated,
+        rolesAlreadyPresent,
+        schemasCreated,
+        schemasAlreadyPresent,
+        steps,
+    };
+}
+async function roleExists(client, name) {
+    const rows = await client `
+    SELECT 1 AS one FROM pg_catalog.pg_roles WHERE rolname = ${name}
+  `;
+    return rows.length > 0;
+}
+async function ensureRole(client, role, steps, options) {
+    const quoted = quoteIdentifier(role.name);
+    const exists = await roleExists(client, role.name);
+    if (exists) {
+        steps.push({
+            step: 'create-role',
+            target: role.name,
+            outcome: 'already-present',
+            statement: '',
+        });
+        if (options.updatePassword && role.password !== undefined) {
+            const literal = await quoteLiteral(client, role.password);
+            await execute(client, `ALTER ROLE ${quoted} WITH LOGIN PASSWORD ${literal}`, 'alter-role-password', role.name);
+            steps.push({
+                step: 'alter-role-password',
+                target: role.name,
+                outcome: 'updated',
+                statement: `ALTER ROLE ${quoted} WITH LOGIN PASSWORD ${PASSWORD_SLOT}`,
+            });
+        }
+        return false;
+    }
+    const attributes = 'LOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS';
+    const redacted = `CREATE ROLE ${quoted} WITH ${attributes}${role.password === undefined ? '' : ` PASSWORD ${PASSWORD_SLOT}`}`;
+    const literal = role.password === undefined ? undefined : await quoteLiteral(client, role.password);
+    // A function replacer, never a string one: `$&`, `$'` and friends inside a
+    // password are String.replace substitution patterns and would otherwise be
+    // expanded into the statement.
+    const statement = literal === undefined ? redacted : redacted.replace(PASSWORD_SLOT, () => literal);
+    try {
+        await client.unsafe(statement);
+    }
+    catch (error) {
+        // Another provisioner won the race between the existence check and the create.
+        if (sqlStateOf(error) === DUPLICATE_OBJECT) {
+            steps.push({
+                step: 'create-role',
+                target: role.name,
+                outcome: 'already-present',
+                statement: '',
+            });
+            return false;
+        }
+        throw new DataPlaneProvisioningError(`Data-plane step "create-role" failed for "${role.name}": ${error.message}`, { step: 'create-role', target: role.name, sqlState: sqlStateOf(error) });
+    }
+    steps.push({
+        step: 'create-role',
+        target: role.name,
+        outcome: 'created',
+        statement: redacted,
+    });
+    return true;
+}
+/**
+ * `CREATE DATABASE ... OWNER x`, `ALTER DEFAULT PRIVILEGES FOR ROLE x` and granting
+ * inside a schema owned by x all require the admin to be a member of x. Superusers
+ * already satisfy `pg_has_role`; a CREATEROLE admin gains membership here.
+ */
+async function ensureAdminMembership(client, ownerRole, steps) {
+    const rows = await client `
+    SELECT pg_catalog.pg_has_role(CURRENT_USER, ${ownerRole}, 'USAGE') AS member,
+           CURRENT_USER::text AS admin_name,
+           pg_catalog.quote_ident(CURRENT_USER::text) AS admin_quoted
+  `;
+    const row = rows[0];
+    if (!row) {
+        throw new DataPlaneProvisioningError('Could not determine the admin role membership');
+    }
+    if (row.member) {
+        steps.push({
+            step: 'grant-role-membership',
+            target: ownerRole,
+            outcome: 'already-present',
+            statement: '',
+        });
+        return;
+    }
+    const statement = `GRANT ${quoteIdentifier(ownerRole)} TO ${row.admin_quoted}`;
+    await execute(client, statement, 'grant-role-membership', ownerRole);
+    steps.push({
+        step: 'grant-role-membership',
+        target: ownerRole,
+        outcome: 'applied',
+        statement,
+    });
+}
+async function databaseExists(client, name) {
+    const rows = await client `
+    SELECT 1 AS one FROM pg_catalog.pg_database WHERE datname = ${name}
+  `;
+    return rows.length > 0;
+}
+async function ensureDatabase(client, databaseName, ownerRole, steps, options) {
+    if (await databaseExists(client, databaseName)) {
+        steps.push({
+            step: 'create-database',
+            target: databaseName,
+            outcome: 'already-present',
+            statement: '',
+        });
+        return false;
+    }
+    // Postgres forbids CREATE DATABASE inside a transaction block; this client runs
+    // in autocommit and the statement is issued on its own.
+    const clauses = [`OWNER ${quoteIdentifier(ownerRole)}`];
+    if (options.template)
+        clauses.push(`TEMPLATE ${quoteIdentifier(options.template)}`);
+    if (options.encoding)
+        clauses.push(`ENCODING '${options.encoding}'`);
+    if (options.locale) {
+        clauses.push(`LC_COLLATE '${options.locale}'`, `LC_CTYPE '${options.locale}'`);
+    }
+    const statement = `CREATE DATABASE ${quoteIdentifier(databaseName)} ${clauses.join(' ')}`;
+    try {
+        await client.unsafe(statement);
+    }
+    catch (error) {
+        if (sqlStateOf(error) === DUPLICATE_DATABASE) {
+            steps.push({
+                step: 'create-database',
+                target: databaseName,
+                outcome: 'already-present',
+                statement: '',
+            });
+            return false;
+        }
+        throw new DataPlaneProvisioningError(`Data-plane step "create-database" failed for "${databaseName}": ${error.message}`, { step: 'create-database', target: databaseName, sqlState: sqlStateOf(error) });
+    }
+    steps.push({
+        step: 'create-database',
+        target: databaseName,
+        outcome: 'created',
+        statement,
+    });
+    return true;
+}
+async function applyDatabaseGrants(client, databaseName, ownerRole, runtimeRole, steps) {
+    const db = quoteIdentifier(databaseName);
+    const revoke = `REVOKE ALL ON DATABASE ${db} FROM PUBLIC`;
+    await execute(client, revoke, 'revoke-database-from-public', databaseName);
+    steps.push({
+        step: 'revoke-database-from-public',
+        target: databaseName,
+        outcome: 'applied',
+        statement: revoke,
+    });
+    const grantOwner = `GRANT CONNECT, TEMPORARY ON DATABASE ${db} TO ${quoteIdentifier(ownerRole)}`;
+    await execute(client, grantOwner, 'grant-database-connect', ownerRole);
+    steps.push({
+        step: 'grant-database-connect',
+        target: ownerRole,
+        outcome: 'applied',
+        statement: grantOwner,
+    });
+    const grantRuntime = `GRANT CONNECT ON DATABASE ${db} TO ${quoteIdentifier(runtimeRole)}`;
+    await execute(client, grantRuntime, 'grant-database-connect', runtimeRole);
+    steps.push({
+        step: 'grant-database-connect',
+        target: runtimeRole,
+        outcome: 'applied',
+        statement: grantRuntime,
+    });
+}
+async function ensureSchema(client, schema, ownerRole, steps) {
+    const rows = await client `
+    SELECT 1 AS one FROM pg_catalog.pg_namespace WHERE nspname = ${schema}
+  `;
+    if (rows.length > 0) {
+        steps.push({
+            step: 'create-schema',
+            target: schema,
+            outcome: 'already-present',
+            statement: '',
+        });
+        return false;
+    }
+    const statement = `CREATE SCHEMA ${quoteIdentifier(schema)} AUTHORIZATION ${quoteIdentifier(ownerRole)}`;
+    try {
+        await client.unsafe(statement);
+    }
+    catch (error) {
+        if (sqlStateOf(error) === DUPLICATE_OBJECT) {
+            steps.push({
+                step: 'create-schema',
+                target: schema,
+                outcome: 'already-present',
+                statement: '',
+            });
+            return false;
+        }
+        throw new DataPlaneProvisioningError(`Data-plane step "create-schema" failed for "${schema}": ${error.message}`, { step: 'create-schema', target: schema, sqlState: sqlStateOf(error) });
+    }
+    steps.push({ step: 'create-schema', target: schema, outcome: 'created', statement });
+    return true;
+}
+async function applySchemaGrants(client, schema, ownerRole, runtimeRole, tablePrivileges, steps) {
+    const ns = quoteIdentifier(schema);
+    const owner = quoteIdentifier(ownerRole);
+    const runtime = quoteIdentifier(runtimeRole);
+    const privileges = tablePrivileges.join(', ');
+    const statements = [
+        // On Postgres < 15 PUBLIC holds CREATE on `public`; on any version it holds
+        // USAGE. Both are removed before anything is granted back explicitly.
+        {
+            step: 'revoke-schema-from-public',
+            target: schema,
+            sql: `REVOKE ALL ON SCHEMA ${ns} FROM PUBLIC`,
+        },
+        {
+            step: 'grant-schema-usage',
+            target: ownerRole,
+            sql: `GRANT USAGE, CREATE ON SCHEMA ${ns} TO ${owner}`,
+        },
+        // The runtime role gets USAGE only: it may reach objects in the schema but
+        // may not create them. DDL stays with the owner role that migrations use.
+        {
+            step: 'grant-schema-usage',
+            target: runtimeRole,
+            sql: `GRANT USAGE ON SCHEMA ${ns} TO ${runtime}`,
+        },
+        {
+            step: 'grant-table-privileges',
+            target: runtimeRole,
+            sql: `GRANT ${privileges} ON ALL TABLES IN SCHEMA ${ns} TO ${runtime}`,
+        },
+        {
+            step: 'grant-sequence-privileges',
+            target: runtimeRole,
+            sql: `GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${ns} TO ${runtime}`,
+        },
+        // Objects a later migration creates as the owner are covered without re-running
+        // provisioning.
+        {
+            step: 'set-default-table-privileges',
+            target: runtimeRole,
+            sql: `ALTER DEFAULT PRIVILEGES FOR ROLE ${owner} IN SCHEMA ${ns} GRANT ${privileges} ON TABLES TO ${runtime}`,
+        },
+        {
+            step: 'set-default-sequence-privileges',
+            target: runtimeRole,
+            sql: `ALTER DEFAULT PRIVILEGES FOR ROLE ${owner} IN SCHEMA ${ns} GRANT USAGE, SELECT ON SEQUENCES TO ${runtime}`,
+        },
+    ];
+    for (const entry of statements) {
+        await execute(client, entry.sql, entry.step, entry.target);
+        steps.push({
+            step: entry.step,
+            target: entry.target,
+            outcome: 'applied',
+            statement: entry.sql,
+        });
+    }
+}
+/**
+ * Drops a tenant's data plane — intended for test and fixture tenants.
+ *
+ * Refuses any database or role name that does not match `allowedNamePattern`, and
+ * refuses to drop the database the admin connection is itself using. Idempotent:
+ * a second call reports `absent` rather than failing.
+ */
+export async function dropDataPlane(options) {
+    if (!(options.allowedNamePattern instanceof RegExp)) {
+        throw new DataPlaneGuardError('allowedNamePattern is required: dropDataPlane will not drop anything without an explicit naming convention');
+    }
+    const databaseName = assertSafeIdentifier(options.databaseName, 'databaseName');
+    if (!matchesPattern(options.allowedNamePattern, databaseName)) {
+        throw new DataPlaneGuardError(`Refusing to drop database "${databaseName}": it does not match ${options.allowedNamePattern}`, { databaseName, pattern: options.allowedNamePattern.source });
+    }
+    const roles = (options.roles ?? []).map((role) => {
+        const name = assertSafeIdentifier(role, 'role');
+        if (!matchesPattern(options.allowedNamePattern, name)) {
+            throw new DataPlaneGuardError(`Refusing to drop role "${name}": it does not match ${options.allowedNamePattern}`, { role: name, pattern: options.allowedNamePattern.source });
+        }
+        return name;
+    });
+    const connectTimeoutSeconds = options.connectTimeoutSeconds ?? 10;
+    const steps = [];
+    const rolesDropped = [];
+    const rolesAbsent = [];
+    let databaseDropped = false;
+    let terminatedConnections = 0;
+    const admin = await openClient(options.adminConnection, { connectTimeoutSeconds });
+    try {
+        const currentRows = await admin `
+      SELECT current_database()::text AS current
+    `;
+        if (currentRows[0]?.current === databaseName) {
+            throw new DataPlaneGuardError(`Refusing to drop database "${databaseName}": it is the admin connection's own database`, { databaseName });
+        }
+        const exists = await databaseExists(admin, databaseName);
+        if (exists) {
+            if (options.terminateConnections !== false) {
+                const terminated = await admin `
+          SELECT pg_catalog.pg_terminate_backend(pid) AS ok, pid
+          FROM pg_catalog.pg_stat_activity
+          WHERE datname = ${databaseName} AND pid <> pg_catalog.pg_backend_pid()
+        `;
+                terminatedConnections = terminated.length;
+                steps.push({
+                    step: 'terminate-connections',
+                    target: databaseName,
+                    outcome: terminatedConnections > 0 ? 'applied' : 'skipped',
+                    statement: 'SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1',
+                });
+            }
+            // DROP DATABASE, like CREATE DATABASE, cannot run inside a transaction block.
+            const statement = `DROP DATABASE IF EXISTS ${quoteIdentifier(databaseName)}`;
+            await execute(admin, statement, 'drop-database', databaseName);
+            databaseDropped = true;
+            steps.push({
+                step: 'drop-database',
+                target: databaseName,
+                outcome: 'dropped',
+                statement,
+            });
+        }
+        else {
+            steps.push({
+                step: 'drop-database',
+                target: databaseName,
+                outcome: 'absent',
+                statement: '',
+            });
+        }
+        for (const role of roles) {
+            if (!(await roleExists(admin, role))) {
+                rolesAbsent.push(role);
+                steps.push({ step: 'drop-role', target: role, outcome: 'absent', statement: '' });
+                continue;
+            }
+            // Clears privileges the role still holds in the admin database; the tenant
+            // database's own objects went with the DROP DATABASE above.
+            const dropOwned = `DROP OWNED BY ${quoteIdentifier(role)}`;
+            await execute(admin, dropOwned, 'drop-owned', role);
+            steps.push({ step: 'drop-owned', target: role, outcome: 'applied', statement: dropOwned });
+            const dropRole = `DROP ROLE IF EXISTS ${quoteIdentifier(role)}`;
+            await execute(admin, dropRole, 'drop-role', role);
+            rolesDropped.push(role);
+            steps.push({ step: 'drop-role', target: role, outcome: 'dropped', statement: dropRole });
+        }
+    }
+    finally {
+        await closeClient(admin);
+    }
+    return {
+        databaseName,
+        databaseDropped,
+        rolesDropped,
+        rolesAbsent,
+        terminatedConnections,
+        steps,
+    };
+}
+//# sourceMappingURL=data-plane-provisioning.js.map

package/dist/tenancy/data-plane-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-plane-provisioning.js","sourceRoot":"","sources":["../../src/tenancy/data-plane-provisioning.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,6EAA6E;AAC7E,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,wCAAwC;AACxC,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,iDAAiD;AAGjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,eAAe;AAEf,iFAAiF;AACjF,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAClD,YAAY,OAAe,EAAE,QAAkC;QAC7D,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD,YAAY,OAAe,EAAE,QAAkC;QAC7D,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,0BAA2B,SAAQ,YAAY;IAC1D,YAAY,OAAe,EAAE,QAAkC;QAC7D,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,0BAA0B;AAE1B;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAErD,8EAA8E;AAC9E,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,uFAAuF;AACvF,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAEjD,MAAM,wBAAwB,GAAG;IAC/B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,SAAS;CACD,CAAC;AAIX,MAAM,wBAAwB,GAA8B;IAC1D,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,2CAA2C;AAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,YAAqB;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAC1B,GAAG,KAAK,KAAK,KAAK,qEAAqE,EACvF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,KAAK,KAAK,kCAAkC,EAAE;YACjF,KAAK;YACL,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,KAAK,KAAK,KAAK,mDAAmD,YAAY,EAAE,EACnF,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,KAAa;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,KAAK,KAAK,oBAAoB,KAAK,QAAQ,EAAE;YAChF,KAAK;YACL,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAAyC;IAEzC,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,GAAG,wBAAwB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,SAAS,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,kBAAkB,CACzB,UAAoC;IAEpC,OAAO,OAAQ,UAA6C,CAAC,gBAAgB,KAAK,QAAQ,CAAC;AAC7F,CAAC;AAQD,KAAK,UAAU,UAAU,CACvB,UAAoC,EACpC,OAA0B;IAE1B,MAAM,cAAc,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,CAAC;QACN,eAAe,EAAE,OAAO,CAAC,qBAAqB;QAC9C,6EAA6E;QAC7E,iCAAiC;QACjC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;KACnB,CAAC;IACF,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,cAAc,CACnB,UAAU,CAAC,gBAAgB,EAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,GAAG,MAAM;QACT,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;QACjD,QAAQ,EAAE,UAAU,CAAC,IAAI;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,EAAE,UAAU,CAAC,GAAG;KACpB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAoB;IAC7C,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAyCD,iGAAiG;AACjG,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAErD,KAAK,UAAU,OAAO,CACpB,MAAoB,EACpB,SAAiB,EACjB,IAAuB,EACvB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,oBAAoB,IAAI,iBAAiB,MAAM,MAAO,KAAe,CAAC,OAAO,EAAE,EAC/E,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,MAAoB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAuB,wBAAwB,KAAK,cAAc,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,0BAA0B,CAAC,yCAAyC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAwDD,SAAS,aAAa,CACpB,IAAgC,EAChC,KAAa,EACb,WAA+B;IAE/B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,oDAAoD,EAAE;gBACzF,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,kBAAkB,CAAC,GAAG,KAAK,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAC1B,gDAAgD,KAAK,CAAC,IAAI,qEAAqE,EAC/H,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1D,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CACvC,CAAC;IACF,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ;QAC/B,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAElE,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;gBACnD,cAAc,EAAE,OAAO,CAAC,2BAA2B,KAAK,IAAI;aAC7D,CAAC,CAAC;YACH,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtD,eAAe,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAC7E,QAAQ;YACR,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,MAAM,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE;QACvD,QAAQ,EAAE,YAAY;QACtB,qBAAqB;KACtB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACtE,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,eAAe;QACf,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,qBAAqB;QACrB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAoB,EAAE,IAAY;IAC1D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAmB;+DACiB,IAAI;GAChE,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAoB,EACpB,IAAyC,EACzC,KAAsB,EACtB,OAAoC;IAEpC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,OAAO,EAAE,iBAAiB;YAC1B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,CACX,MAAM,EACN,cAAc,MAAM,wBAAwB,OAAO,EAAE,EACrD,qBAAqB,EACrB,IAAI,CAAC,IAAI,CACV,CAAC;YACF,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,cAAc,MAAM,wBAAwB,aAAa,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,qEAAqE,CAAC;IACzF,MAAM,QAAQ,GAAG,eAAe,MAAM,SAAS,UAAU,GACvD,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,aAAa,EAC/D,EAAE,CAAC;IACH,MAAM,OAAO,GACX,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtF,2EAA2E;IAC3E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,SAAS,GACb,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAEpF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,6CAA6C,IAAI,CAAC,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,EACtF,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAoB,EACpB,SAAiB,EACjB,KAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAiE;kDAC1C,SAAS;;;GAGxD,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,0BAA0B,CAAC,+CAA+C,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,iBAAiB;YAC1B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,eAAe,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,YAAY,EAAE,CAAC;IAC/E,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,SAAS,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,SAAS;QAClB,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAmB;kEACoB,IAAI;GACnE,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAoB,EACpB,YAAoB,EACpB,SAAiB,EACjB,KAAsB,EACtB,OAAkE;IAElE,IAAI,MAAM,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,iBAAiB;YAC1B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gFAAgF;IAChF,wDAAwD;IACxD,MAAM,OAAO,GAAG,CAAC,SAAS,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,MAAM,GAAG,EAAE,aAAa,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,eAAe,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,iDAAiD,YAAY,MAAO,KAAe,CAAC,OAAO,EAAE,EAC7F,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,SAAS;QAClB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAoB,EACpB,YAAoB,EACpB,SAAiB,EACjB,WAAmB,EACnB,KAAsB;IAEtB,MAAM,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAEzC,MAAM,MAAM,GAAG,0BAA0B,EAAE,cAAc,CAAC;IAC1D,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,YAAY,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,wCAAwC,EAAE,OAAO,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IACjG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,6BAA6B,EAAE,OAAO,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;IAC1F,MAAM,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,YAAY;KACxB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAoB,EACpB,MAAc,EACd,SAAiB,EACjB,KAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAmB;mEACqB,MAAM;GACtE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iBAAiB;YAC1B,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,eAAe,CAAC,MAAM,CAAC,kBAAkB,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IACzG,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,0BAA0B,CAClC,+CAA+C,MAAM,MAAO,KAAe,CAAC,OAAO,EAAE,EACrF,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAoB,EACpB,MAAc,EACd,SAAiB,EACjB,WAAmB,EACnB,eAAmD,EACnD,KAAsB;IAEtB,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,UAAU,GAA+D;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE;YACE,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,wBAAwB,EAAE,cAAc;SAC9C;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,iCAAiC,EAAE,OAAO,KAAK,EAAE;SACvD;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E;YACE,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,yBAAyB,EAAE,OAAO,OAAO,EAAE;SACjD;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,SAAS,UAAU,4BAA4B,EAAE,OAAO,OAAO,EAAE;SACvE;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,kDAAkD,EAAE,OAAO,OAAO,EAAE;SAC1E;QACD,gFAAgF;QAChF,gBAAgB;QAChB;YACE,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,qCAAqC,KAAK,cAAc,EAAE,UAAU,UAAU,iBAAiB,OAAO,EAAE;SAC9G;QACD;YACE,IAAI,EAAE,iCAAiC;YACvC,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,qCAAqC,KAAK,cAAc,EAAE,wCAAwC,OAAO,EAAE;SACjH;KACF,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AA+BD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,IAAI,CAAC,CAAC,OAAO,CAAC,kBAAkB,YAAY,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAC3B,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,YAAY,wBAAwB,OAAO,CAAC,kBAAkB,EAAE,EAC9F,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,0BAA0B,IAAI,wBAAwB,OAAO,CAAC,kBAAkB,EAAE,EAClF,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAC3D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;IAClE,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,KAAK,CAAuB;;KAErD,CAAC;QACF,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,YAAY,8CAA8C,EACxF,EAAE,YAAY,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,OAAO,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;gBAC3C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAmB;;;4BAG7B,YAAY;SAC/B,CAAC;gBACF,qBAAqB,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,YAAY;oBACpB,OAAO,EAAE,qBAAqB,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC1D,SAAS,EAAE,2EAA2E;iBACvF,CAAC,CAAC;YACL,CAAC;YAED,8EAA8E;YAC9E,MAAM,SAAS,GAAG,2BAA2B,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7E,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAC/D,eAAe,GAAG,IAAI,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,SAAS;gBAClB,SAAS;aACV,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,QAAQ;gBACjB,SAAS,EAAE,EAAE;aACd,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,SAAS,GAAG,iBAAiB,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YAE3F,MAAM,QAAQ,GAAG,uBAAuB,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,WAAW;QACX,qBAAqB;QACrB,KAAK;KACN,CAAC;AACJ,CAAC"}