@quarry-systems/drift-secrets-ssm 0.1.0

package/README.md

@@ -0,0 +1,135 @@
+# @quarry-systems/mcg-secrets-ssm
+
+![Backend Only](https://img.shields.io/badge/runtime-node-green) ![Node >= 18](https://img.shields.io/badge/node-%3E%3D18-blue)
+
+AWS Systems Manager Parameter Store secrets adapter for MCG.
+
+## Features
+
+- **AWS SSM integration**: Read secrets from Parameter Store
+- **Automatic decryption**: SecureString parameters are decrypted automatically
+- **Caching**: Optional in-memory cache with TTL
+- **Type-safe**: Full TypeScript support
+- **Peer dependency**: AWS SDK is a peer dependency (you control the version)
+
+## Installation
+
+```bash
+npm install @quarry-systems/mcg-secrets-ssm @aws-sdk/client-ssm
+```
+
+## Usage
+
+```typescript
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { createSSMSecretsAdapter } from '@quarry-systems/mcg-secrets-ssm';
+
+// Create SSM client
+const ssmClient = new SSMClient({ region: 'us-east-1' });
+
+// Create adapter
+const secrets = createSSMSecretsAdapter({
+  client: ssmClient,
+  prefix: '/myapp/',           // Optional: prepend to all keys
+  cache: true,                 // Optional: enable caching
+  cacheTtlMs: 300000          // Optional: cache TTL (5 min)
+});
+
+// Read parameter
+// Fetches from /myapp/database/password
+const dbPassword = await secrets.get({ key: 'database/password' });
+```
+
+### Integration with MCG
+
+```typescript
+import { ManagedCyclicGraph } from '@quarry-systems/managed-cyclic-graph';
+import { SSMClient } from '@aws-sdk/client-ssm';
+import { createSSMSecretsAdapter } from '@quarry-systems/mcg-secrets-ssm';
+
+// Create secrets adapter
+const ssmClient = new SSMClient({ region: 'us-east-1' });
+const secrets = createSSMSecretsAdapter({
+  client: ssmClient,
+  prefix: '/myapp/'
+});
+
+// Build graph with secrets plugin
+const graph = new ManagedCyclicGraph()
+  .use({ services: { secrets } })
+  .node('fetchData', {
+    type: 'action',
+    action: async (ctx, services) => {
+      // Access secrets via services
+      const apiKey = await services.secrets.get({ key: 'api/key' });
+      
+      const response = await fetch('https://api.example.com/data', {
+        headers: { 'Authorization': `Bearer ${apiKey}` }
+      });
+      
+      return { data: await response.json() };
+    }
+  })
+  .build();
+
+// Execute
+await graph.run({ input: 'test' });
+```
+
+## Configuration
+
+```typescript
+interface SSMSecretsConfig {
+  /** AWS SSM client instance */
+  client: SSMClient;
+  
+  /** Optional prefix to prepend to all parameter names */
+  prefix?: string;
+  
+  /** Enable in-memory caching (default: false) */
+  cache?: boolean;
+  
+  /** Cache TTL in milliseconds (default: 300000 = 5 min) */
+  cacheTtlMs?: number;
+}
+```
+
+## AWS Permissions
+
+The IAM role/user needs:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ssm:GetParameter",
+        "ssm:GetParameters",
+        "ssm:DescribeParameters"
+      ],
+      "Resource": "arn:aws:ssm:*:*:parameter/myapp/*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "kms:Decrypt"
+      ],
+      "Resource": "arn:aws:kms:*:*:key/*"
+    }
+  ]
+}
+```
+
+## Testing
+
+Tests use mocked SSM client:
+
+```bash
+npm test
+```
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@quarry-systems/drift-secrets-ssm",
+  "version": "0.1.0",
+  "description": "AWS SSM Parameter Store secrets adapter for Drift",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "scripts": {
+    "build": "tsc -p .",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "keywords": [
+    "drift",
+    "secrets",
+    "aws",
+    "ssm",
+    "parameter-store",
+    "backend",
+    "node"
+  ],
+  "author": "Quarry Systems",
+  "license": "MIT",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "browser": false,
+  "peerDependencies": {
+    "@aws-sdk/client-ssm": "^3.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@aws-sdk/client-ssm": {
+      "optional": false
+    }
+  },
+  "devDependencies": {
+    "@aws-sdk/client-ssm": "^3.700.0",
+    "typescript": "^5.3.0",
+    "vitest": "^2.1.0"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "type": "commonjs"
+}

package/src/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * MCG Secrets SSM Adapter
+ *
+ * AWS SSM Parameter Store secrets adapter for MCG.
+ * Requires @aws-sdk/client-ssm as a peer dependency.
+ *
+ * @packageDocumentation
+ */
+import type { SecretsAdapter } from '@quarry-systems/drift-contracts';
+/**
+ * SSM adapter configuration
+ */
+export interface SSMSecretsConfig {
+    /** AWS region (defaults to AWS_REGION env var or us-east-1) */
+    region?: string;
+    /** Cache TTL in milliseconds (default: 5 minutes, 0 to disable) */
+    cacheTtlMs?: number;
+}
+/**
+ * AWS SSM Parameter Store secrets adapter.
+ *
+ * Resolves references in the format `ssm:/path/to/parameter`.
+ * Includes an in-memory cache to reduce SSM API calls.
+ *
+ * @example
+ * ```typescript
+ * import { ssmSecretsAdapter } from '@quarry-systems/mcg-secrets-ssm';
+ * import { createSecretsAdapter } from '@quarry-systems/mcg-secrets';
+ *
+ * const secrets = createSecretsAdapter()
+ *   .use(ssmSecretsAdapter({ region: 'us-west-2' }));
+ *
+ * const dbPassword = await secrets.resolve('ssm:/prod/db/password');
+ * ```
+ */
+export declare function ssmSecretsAdapter(config?: SSMSecretsConfig): SecretsAdapter;
+/**
+ * Clear the SSM cache (useful for testing)
+ */
+export declare function clearSSMCache(adapter: SecretsAdapter): void;
+export type { SecretsAdapter, SecretRef } from '@quarry-systems/drift-contracts';

package/src/index.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * MCG Secrets SSM Adapter
+ *
+ * AWS SSM Parameter Store secrets adapter for MCG.
+ * Requires @aws-sdk/client-ssm as a peer dependency.
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssmSecretsAdapter = ssmSecretsAdapter;
+exports.clearSSMCache = clearSSMCache;
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+// ============================================================================
+// SSM Adapter
+// ============================================================================
+/**
+ * AWS SSM Parameter Store secrets adapter.
+ *
+ * Resolves references in the format `ssm:/path/to/parameter`.
+ * Includes an in-memory cache to reduce SSM API calls.
+ *
+ * @example
+ * ```typescript
+ * import { ssmSecretsAdapter } from '@quarry-systems/mcg-secrets-ssm';
+ * import { createSecretsAdapter } from '@quarry-systems/mcg-secrets';
+ *
+ * const secrets = createSecretsAdapter()
+ *   .use(ssmSecretsAdapter({ region: 'us-west-2' }));
+ *
+ * const dbPassword = await secrets.resolve('ssm:/prod/db/password');
+ * ```
+ */
+function ssmSecretsAdapter(config = {}) {
+    const region = config.region ?? process.env.AWS_REGION ?? 'us-east-1';
+    const cacheTtlMs = config.cacheTtlMs ?? 5 * 60 * 1000; // 5 minutes default
+    const client = new client_ssm_1.SSMClient({ region });
+    const cache = new Map();
+    function getCached(path) {
+        const entry = cache.get(path);
+        if (!entry)
+            return null; // not in cache
+        if (Date.now() > entry.expiresAt) {
+            cache.delete(path);
+            return null; // expired
+        }
+        return entry.value;
+    }
+    function setCache(path, value) {
+        if (cacheTtlMs <= 0)
+            return;
+        cache.set(path, {
+            value,
+            expiresAt: Date.now() + cacheTtlMs,
+        });
+    }
+    return {
+        name: 'ssm',
+        canResolve(ref) {
+            return ref.startsWith('ssm:');
+        },
+        async resolve(ref) {
+            if (!this.canResolve(ref))
+                return undefined;
+            const path = ref.slice(4); // Remove 'ssm:'
+            // Check cache first
+            const cached = getCached(path);
+            if (cached !== null)
+                return cached;
+            try {
+                const response = await client.send(new client_ssm_1.GetParameterCommand({
+                    Name: path,
+                    WithDecryption: true,
+                }));
+                const value = response.Parameter?.Value;
+                setCache(path, value);
+                return value;
+            }
+            catch (err) {
+                if (err instanceof Error && err.name === 'ParameterNotFound') {
+                    setCache(path, undefined);
+                    return undefined;
+                }
+                throw err;
+            }
+        },
+        async resolveMany(refs) {
+            const results = new Map();
+            const ssmRefs = refs.filter(r => this.canResolve(r));
+            if (ssmRefs.length === 0)
+                return results;
+            // Check cache and collect uncached paths
+            const uncachedRefs = [];
+            const uncachedPaths = [];
+            for (const ref of ssmRefs) {
+                const path = ref.slice(4);
+                const cached = getCached(path);
+                if (cached !== null) {
+                    results.set(ref, cached);
+                }
+                else {
+                    uncachedRefs.push(ref);
+                    uncachedPaths.push(path);
+                }
+            }
+            if (uncachedPaths.length === 0)
+                return results;
+            // SSM GetParameters has a limit of 10 parameters per call
+            const BATCH_SIZE = 10;
+            for (let i = 0; i < uncachedPaths.length; i += BATCH_SIZE) {
+                const batchPaths = uncachedPaths.slice(i, i + BATCH_SIZE);
+                const batchRefs = uncachedRefs.slice(i, i + BATCH_SIZE);
+                try {
+                    const response = await client.send(new client_ssm_1.GetParametersCommand({
+                        Names: batchPaths,
+                        WithDecryption: true,
+                    }));
+                    // Map found parameters
+                    const foundPaths = new Set();
+                    for (const param of response.Parameters ?? []) {
+                        if (param.Name) {
+                            foundPaths.add(param.Name);
+                            const ref = `ssm:${param.Name}`;
+                            results.set(ref, param.Value);
+                            setCache(param.Name, param.Value);
+                        }
+                    }
+                    // Mark not found as undefined
+                    for (let j = 0; j < batchPaths.length; j++) {
+                        const path = batchPaths[j];
+                        if (!foundPaths.has(path)) {
+                            results.set(batchRefs[j], undefined);
+                            setCache(path, undefined);
+                        }
+                    }
+                }
+                catch (err) {
+                    // On error, mark all in batch as undefined
+                    for (const ref of batchRefs) {
+                        results.set(ref, undefined);
+                    }
+                    throw err;
+                }
+            }
+            return results;
+        },
+    };
+}
+/**
+ * Clear the SSM cache (useful for testing)
+ */
+function clearSSMCache(adapter) {
+    // This is a no-op for the public interface
+    // The cache is internal to each adapter instance
+    // Users should create a new adapter if they need a fresh cache
+}
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/drift/drift-plugins/mcg-secrets-ssm/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAsDH,8CA8HC;AAKD,sCAIC;AA3LD,oDAI6B;AA2B7B,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,iBAAiB,CAAC,SAA2B,EAAE;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;IAE3E,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,SAAS,SAAS,CAAC,IAAY;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QACxC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC,CAAC,UAAU;QACzB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAyB;QACvD,IAAI,UAAU,IAAI,CAAC;YAAE,OAAO;QAC5B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACd,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU;SACnC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK;QAEX,UAAU,CAAC,GAAc;YACvB,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAc;YAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAE5C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;YAE3C,oBAAoB;YACpB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;YAEnC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,gCAAmB,CAAC;oBACzD,IAAI,EAAE,IAAI;oBACV,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC,CAAC;gBAEJ,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;gBACxC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBAC7D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAC1B,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,IAAiB;YACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;YACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAErD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YAEzC,yCAAyC;YACzC,MAAM,YAAY,GAAgB,EAAE,CAAC;YACrC,MAAM,aAAa,GAAa,EAAE,CAAC;YAEnC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACpB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACvB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YAE/C,0DAA0D;YAC1D,MAAM,UAAU,GAAG,EAAE,CAAC;YAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;gBAExD,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,iCAAoB,CAAC;wBAC1D,KAAK,EAAE,UAAU;wBACjB,cAAc,EAAE,IAAI;qBACrB,CAAC,CAAC,CAAC;oBAEJ,uBAAuB;oBACvB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;oBACrC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;wBAC9C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;4BACf,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;4BAC3B,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;4BAChC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;4BAC9B,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;wBACpC,CAAC;oBACH,CAAC;oBAED,8BAA8B;oBAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;4BACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC5B,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,2CAA2C;oBAC3C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;wBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBAC9B,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,OAAuB;IACnD,2CAA2C;IAC3C,iDAAiD;IACjD,+DAA+D;AACjE,CAAC"}

package/src/plugin.manifest.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Plugin Manifest for @quarry-systems/mcg-secrets-ssm
+ *
+ * This manifest declares the plugin's metadata, capabilities, and requirements.
+ * It enables future security policies, sandboxing, and hosted execution.
+ */
+import type { PluginManifest } from '@quarry-systems/drift-contracts';
+export declare const manifest: PluginManifest;
+export default manifest;

package/src/plugin.manifest.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Plugin Manifest for @quarry-systems/mcg-secrets-ssm
+ *
+ * This manifest declares the plugin's metadata, capabilities, and requirements.
+ * It enables future security policies, sandboxing, and hosted execution.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.manifest = void 0;
+exports.manifest = {
+    name: '@quarry-systems/mcg-secrets-ssm',
+    version: '0.6.0',
+    apiVersion: '1.0',
+    description: 'AWS Systems Manager Parameter Store secrets plugin for Managed Cyclic Graph (MCG)',
+    author: {
+        name: 'Quarry Systems',
+        email: 'support@quarrysystems.com',
+    },
+    license: 'ISC',
+    type: ['node'],
+    capabilities: {
+        network: true, // Makes AWS API calls
+        filesystem: false,
+        secrets: true, // Manages secrets from AWS SSM
+        subprocess: false,
+    },
+    nodes: [],
+    services: [
+        {
+            id: 'ssmSecrets',
+            name: 'SSM Secrets Service',
+            description: 'AWS Systems Manager Parameter Store integration',
+        },
+    ],
+    peerDependencies: {
+        '@quarry-systems/drift-core': '^0.6.0',
+        '@quarry-systems/drift-contracts': '^0.6.0',
+        '@quarry-systems/mcg-secrets': '^0.6.0',
+    },
+    keywords: ['drift', 'mcg', 'managed-cyclic-graph', 'plugin', 'secrets', 'aws', 'ssm', 'parameter-store'],
+    repository: {
+        type: 'git',
+        url: 'https://github.com/quarry-systems/quarry-systems',
+        directory: 'libs/drift/drift-plugins/mcg-secrets-ssm',
+    },
+};
+exports.default = exports.manifest;
+//# sourceMappingURL=plugin.manifest.js.map

package/src/plugin.manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.manifest.js","sourceRoot":"","sources":["../../../../../../libs/drift/drift-plugins/mcg-secrets-ssm/src/plugin.manifest.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAIU,QAAA,QAAQ,GAAmB;IACtC,IAAI,EAAE,iCAAiC;IACvC,OAAO,EAAE,OAAO;IAChB,UAAU,EAAE,KAAK;IAEjB,WAAW,EAAE,mFAAmF;IAEhG,MAAM,EAAE;QACN,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,2BAA2B;KACnC;IAED,OAAO,EAAE,KAAK;IAEd,IAAI,EAAE,CAAC,MAAM,CAAC;IAEd,YAAY,EAAE;QACZ,OAAO,EAAE,IAAI,EAAO,sBAAsB;QAC1C,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,IAAI,EAAO,+BAA+B;QACnD,UAAU,EAAE,KAAK;KAClB;IAED,KAAK,EAAE,EAAE;IAET,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,iDAAiD;SAC/D;KACF;IAED,gBAAgB,EAAE;QAChB,4BAA4B,EAAE,QAAQ;QACtC,iCAAiC,EAAE,QAAQ;QAC3C,6BAA6B,EAAE,QAAQ;KACxC;IAED,QAAQ,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC;IAExG,UAAU,EAAE;QACV,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,kDAAkD;QACvD,SAAS,EAAE,0CAA0C;KACtD;CACF,CAAC;AAEF,kBAAe,gBAAQ,CAAC"}