@r8s/core 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/defaults.d.ts +82 -2
- package/dist/defaults.d.ts.map +1 -1
- package/dist/defaults.js +13 -0
- package/dist/defaults.js.map +1 -1
- package/dist/guardrails.d.ts +2 -1
- package/dist/guardrails.d.ts.map +1 -1
- package/dist/guardrails.js +227 -174
- package/dist/guardrails.js.map +1 -1
- package/dist/validate.d.ts.map +1 -1
- package/dist/validate.js +11 -0
- package/dist/validate.js.map +1 -1
- package/package.json +1 -1
package/dist/defaults.d.ts
CHANGED
|
@@ -15,7 +15,15 @@ export interface DatabaseConnection {
|
|
|
15
15
|
}
|
|
16
16
|
/** Secret provider configuration */
|
|
17
17
|
export interface SecretProvider {
|
|
18
|
-
backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets' | 'kubernetes';
|
|
18
|
+
backend: 'vault' | 'openbao' | 'sealed-secrets' | 'manual-secrets' | 'kubernetes' | (string & {});
|
|
19
|
+
/**
|
|
20
|
+
* Custom provisioner hook. Built-in backends (vault/openbao) get one
|
|
21
|
+
* attached by the recipes' SecretProvider; anything carrying
|
|
22
|
+
* `provision()` is treated as provisioning-capable regardless of
|
|
23
|
+
* backend identity — orgs can plug ESO/Infisical/CSI without touching
|
|
24
|
+
* packages.
|
|
25
|
+
*/
|
|
26
|
+
provision?: SecretProvisioner;
|
|
19
27
|
mount?: string;
|
|
20
28
|
path?: string;
|
|
21
29
|
authRef?: string;
|
|
@@ -52,6 +60,72 @@ export interface SecretProvider {
|
|
|
52
60
|
*/
|
|
53
61
|
/** Inherits namespace to all child resources */
|
|
54
62
|
export declare const Namespace: import("./context").Context<string>;
|
|
63
|
+
/**
|
|
64
|
+
* Resolve the effective namespace: explicit prop wins, otherwise inherit
|
|
65
|
+
* from the Platform tree, otherwise 'default'. Replaces the inline
|
|
66
|
+
* `namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace :
|
|
67
|
+
* undefined) ?? 'default'` formula that was copied through every recipe
|
|
68
|
+
* and package — namespace policy lives here now.
|
|
69
|
+
*/
|
|
70
|
+
export declare function useNamespace(override?: string): string;
|
|
71
|
+
/** One bundle to provision through a secrets backend */
|
|
72
|
+
export interface StaticSecretRequest {
|
|
73
|
+
/** Resource name (usually equals the destination Secret name) */
|
|
74
|
+
name: string;
|
|
75
|
+
namespace: string;
|
|
76
|
+
/** KV path in the secret store */
|
|
77
|
+
path: string;
|
|
78
|
+
/** Destination→source key mapping (env-case destination, snake_case source) */
|
|
79
|
+
keys: Record<string, string>;
|
|
80
|
+
/**
|
|
81
|
+
* Raw Go-template passthrough merged AFTER the keys mapping — for
|
|
82
|
+
* advanced bundles needing literals or composed templates
|
|
83
|
+
* (e.g. `AWS_ENDPOINTS: 'https://s3.berget.cloud'`).
|
|
84
|
+
*/
|
|
85
|
+
templates?: Record<string, string>;
|
|
86
|
+
/** Provisioned Kubernetes Secret name (defaults to name) */
|
|
87
|
+
secretName?: string;
|
|
88
|
+
/** Store mount path */
|
|
89
|
+
mount?: string;
|
|
90
|
+
/** Auth reference override (defaults to the provider's authRef) */
|
|
91
|
+
authRef?: string;
|
|
92
|
+
/** Re-sync interval */
|
|
93
|
+
refreshAfter?: string;
|
|
94
|
+
/** Workloads restarted after rotation (already field-normalized) */
|
|
95
|
+
restartTargets?: {
|
|
96
|
+
kind?: string;
|
|
97
|
+
name: string;
|
|
98
|
+
apiVersion?: string;
|
|
99
|
+
}[];
|
|
100
|
+
}
|
|
101
|
+
/**
|
|
102
|
+
* Provisioner hook: given a request, produce the backend-specific resources
|
|
103
|
+
* (e.g. VaultStaticSecret, OpenBaoStaticSecret, ExternalSecret, …).
|
|
104
|
+
* Elements are flattened into the render result.
|
|
105
|
+
*/
|
|
106
|
+
export type SecretProvisioner = (req: StaticSecretRequest) => unknown;
|
|
107
|
+
/** Route request handed to a custom routing provisioner */
|
|
108
|
+
export interface RouteRequest {
|
|
109
|
+
name: string;
|
|
110
|
+
namespace: string;
|
|
111
|
+
host: string;
|
|
112
|
+
serviceName: string;
|
|
113
|
+
servicePort: number;
|
|
114
|
+
pathPrefix?: string;
|
|
115
|
+
annotations?: Record<string, string>;
|
|
116
|
+
additionalAnnotations?: Record<string, string>;
|
|
117
|
+
tls?: {
|
|
118
|
+
secretName?: string;
|
|
119
|
+
clusterIssuer?: string;
|
|
120
|
+
wildcardSecretName?: string;
|
|
121
|
+
ingressClassName?: string;
|
|
122
|
+
};
|
|
123
|
+
}
|
|
124
|
+
/**
|
|
125
|
+
* Route provisioner hook: given a request, produce the backend-specific
|
|
126
|
+
* route resources (Ingress/HTTPRoute/… + any supporting objects).
|
|
127
|
+
*/
|
|
128
|
+
export type RouteProvisioner = (req: RouteRequest) => unknown;
|
|
55
129
|
/** Inherits labels to all child resources */
|
|
56
130
|
export declare const Labels: import("./context").Context<Record<string, string>>;
|
|
57
131
|
/** Inherits annotations to all child resources */
|
|
@@ -204,9 +278,15 @@ export declare const OperatorContext: import("./context").Context<Operator[]>;
|
|
|
204
278
|
*/
|
|
205
279
|
export interface RoutingConfig {
|
|
206
280
|
/** Routing implementation: 'ingress' (nginx) or 'gateway' (Envoy Gateway API) */
|
|
207
|
-
mode: 'ingress' | 'gateway';
|
|
281
|
+
mode: 'ingress' | 'gateway' | (string & {});
|
|
208
282
|
/** Gateway class name (only used when mode='gateway', default: 'eg') */
|
|
209
283
|
gatewayClassName?: string;
|
|
284
|
+
/**
|
|
285
|
+
* Custom route provisioner hook. When set, <Endpoint/> delegates the
|
|
286
|
+
* whole route render to it and ignores mode — orgs can plug a custom
|
|
287
|
+
* ingress controller / L7 stack without touching recipes or packages.
|
|
288
|
+
*/
|
|
289
|
+
route?: RouteProvisioner;
|
|
210
290
|
}
|
|
211
291
|
export declare const RoutingContext: import("./context").Context<RoutingConfig>;
|
|
212
292
|
export { createContext } from './context';
|
package/dist/defaults.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjG;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AAChD,eAAO,MAAM,SAAS,qCAAmC,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAGtD;AAQD,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,cAAc,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACxE;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAA;AAErE,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAA;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,MAAM,qDAA4C,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,qDAA4C,CAAA;AAEpE,6DAA6D;AAC7D,eAAO,MAAM,WAAW;UAA+B,MAAM;WAAS,MAAM;IAAQ,CAAA;AAEpF,gEAAgE;AAChE,eAAO,MAAM,SAAS;eACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;aACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;EAC3B,CAAA;AAEN,sDAAsD;AACtD,eAAO,MAAM,cAAc,qCAAmC,CAAA;AAE9D,6DAA6D;AAC7D,eAAO,MAAM,aAAa,qCAA4B,CAAA;AAEtD,2CAA2C;AAC3C,eAAO,MAAM,MAAM,qCAA4B,CAAA;AAE/C,iCAAiC;AACjC,eAAO,MAAM,GAAG;aACL,OAAO;aACP,MAAM;iBACF,MAAM;EACC,CAAA;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/C;AAED,eAAO,MAAM,cAAc,mDAA4C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,eAAe,wDAAiD,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,oDAA6C,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,eAAe,yCAAgC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC3C,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAED,eAAO,MAAM,cAAc,4CAAoD,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA"}
|
package/dist/defaults.js
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.createContext = exports.RoutingContext = exports.OperatorContext = exports.SecretContext = exports.DatabaseContext = exports.ClusterContext = exports.TLS = exports.Domain = exports.ImageRegistry = exports.ServiceAccount = exports.Resources = exports.Environment = exports.Annotations = exports.Labels = exports.Namespace = void 0;
|
|
4
|
+
exports.useNamespace = useNamespace;
|
|
4
5
|
const context_1 = require("./context");
|
|
6
|
+
const renderer_1 = require("./renderer");
|
|
5
7
|
/**
|
|
6
8
|
* Default contexts for shared infrastructure properties.
|
|
7
9
|
*
|
|
@@ -26,6 +28,17 @@ const context_1 = require("./context");
|
|
|
26
28
|
*/
|
|
27
29
|
/** Inherits namespace to all child resources */
|
|
28
30
|
exports.Namespace = (0, context_1.createContext)('default');
|
|
31
|
+
/**
|
|
32
|
+
* Resolve the effective namespace: explicit prop wins, otherwise inherit
|
|
33
|
+
* from the Platform tree, otherwise 'default'. Replaces the inline
|
|
34
|
+
* `namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace :
|
|
35
|
+
* undefined) ?? 'default'` formula that was copied through every recipe
|
|
36
|
+
* and package — namespace policy lives here now.
|
|
37
|
+
*/
|
|
38
|
+
function useNamespace(override) {
|
|
39
|
+
const contextNamespace = (0, renderer_1.useContext)(exports.Namespace);
|
|
40
|
+
return override ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default';
|
|
41
|
+
}
|
|
29
42
|
/** Inherits labels to all child resources */
|
|
30
43
|
exports.Labels = (0, context_1.createContext)({});
|
|
31
44
|
/** Inherits annotations to all child resources */
|
package/dist/defaults.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":";;;AAyEA,oCAGC;AA5ED,uCAAyC;AACzC,yCAAuC;AAuCvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,gDAAgD;AACnC,QAAA,SAAS,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAEzD;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,QAAiB;IAC5C,MAAM,gBAAgB,GAAG,IAAA,qBAAU,EAAC,iBAAS,CAAC,CAAA;IAC9C,OAAO,QAAQ,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;AACjG,CAAC;AAkED,6CAA6C;AAChC,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAE/D,kDAAkD;AACrC,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyB,EAAE,CAAC,CAAA;AAEpE,6DAA6D;AAChD,QAAA,WAAW,GAAG,IAAA,uBAAa,EAAyC,EAAE,CAAC,CAAA;AAEpF,gEAAgE;AACnD,QAAA,SAAS,GAAG,IAAA,uBAAa,EAGnC,EAAE,CAAC,CAAA;AAEN,sDAAsD;AACzC,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAS,SAAS,CAAC,CAAA;AAE9D,6DAA6D;AAChD,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAEtD,2CAA2C;AAC9B,QAAA,MAAM,GAAG,IAAA,uBAAa,EAAS,EAAE,CAAC,CAAA;AAE/C,iCAAiC;AACpB,QAAA,GAAG,GAAG,IAAA,uBAAa,EAI7B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAoCT,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAuB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAA4B,IAAI,CAAC,CAAA;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,aAAa,GAAG,IAAA,uBAAa,EAAwB,IAAI,CAAC,CAAA;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACU,QAAA,eAAe,GAAG,IAAA,uBAAa,EAAa,EAAE,CAAC,CAAA;AAmC/C,QAAA,cAAc,GAAG,IAAA,uBAAa,EAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;AAE/E,6DAA6D;AAC7D,qCAAyC;AAAhC,wGAAA,aAAa,OAAA"}
|
package/dist/guardrails.d.ts
CHANGED
|
@@ -13,6 +13,8 @@ export interface GuardrailRule {
|
|
|
13
13
|
/** Check that all namespaces have NetworkPolicies */
|
|
14
14
|
export declare const requireNetworkPolicies: GuardrailRule;
|
|
15
15
|
/** Check that all Deployments have resource limits */
|
|
16
|
+
/** Workload kinds carrying a pod template with resource needs. */
|
|
17
|
+
export declare const RESOURCE_LIMIT_KINDS: readonly ["Deployment", "StatefulSet", "DaemonSet"];
|
|
16
18
|
export declare const requireResourceLimits: GuardrailRule;
|
|
17
19
|
/** Check that all resources have required labels */
|
|
18
20
|
export declare const requireLabels: (requiredLabels: string[]) => GuardrailRule;
|
|
@@ -32,7 +34,6 @@ export declare const requireLabels: (requiredLabels: string[]) => GuardrailRule;
|
|
|
32
34
|
export declare const noPlaintextSecrets: GuardrailRule;
|
|
33
35
|
/** Check that Ingresses have TLS configured */
|
|
34
36
|
export declare const requireTLS: GuardrailRule;
|
|
35
|
-
/** Check that Pods don't run as root */
|
|
36
37
|
export declare const noRootContainers: GuardrailRule;
|
|
37
38
|
/** Default set of guardrails for production use */
|
|
38
39
|
export declare const defaultGuardrails: GuardrailRule[];
|
package/dist/guardrails.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,EAAE,
|
|
1
|
+
{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB;IACrB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACtC,wFAAwF;IACxF,IAAI,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,CAAA;CAC7D;AAED,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,EAAE,aAgCpC,CAAA;AAED,sDAAsD;AACtD,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,qDAAsD,CAAA;AA6BvF,eAAO,MAAM,qBAAqB,EAAE,aAQnC,CAAA;AACD,oDAAoD;AACpD,eAAO,MAAM,aAAa,GAAI,gBAAgB,MAAM,EAAE,KAAG,aAwBvD,CAAA;AA+WF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAyDhC,CAAA;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,aAyBxB,CAAA;AAkCD,eAAO,MAAM,gBAAgB,EAAE,aAU9B,CAAA;AACD,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,aAAa,EAM5C,CAAA;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,KAAK,GAAE,aAAa,EAAsB,GACzC;IACD,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,IAAI,EAAE,eAAe,EAAE,CAAA;CACxB,CAwBA"}
|
package/dist/guardrails.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.defaultGuardrails = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.requireNetworkPolicies = void 0;
|
|
3
|
+
exports.defaultGuardrails = exports.noRootContainers = exports.requireTLS = exports.noPlaintextSecrets = exports.requireLabels = exports.requireResourceLimits = exports.RESOURCE_LIMIT_KINDS = exports.requireNetworkPolicies = void 0;
|
|
4
4
|
exports.runGuardrails = runGuardrails;
|
|
5
5
|
/** Check that all namespaces have NetworkPolicies */
|
|
6
6
|
exports.requireNetworkPolicies = {
|
|
@@ -34,41 +34,41 @@ exports.requireNetworkPolicies = {
|
|
|
34
34
|
},
|
|
35
35
|
};
|
|
36
36
|
/** Check that all Deployments have resource limits */
|
|
37
|
+
/** Workload kinds carrying a pod template with resource needs. */
|
|
38
|
+
exports.RESOURCE_LIMIT_KINDS = ['Deployment', 'StatefulSet', 'DaemonSet'];
|
|
39
|
+
function containerResourceErrors(resource) {
|
|
40
|
+
const name = resource.metadata?.name;
|
|
41
|
+
return (resource.spec?.template?.spec?.containers || []).flatMap((container) => {
|
|
42
|
+
const label = `Container "${container.name}" in ${resource.kind} "${name}"`;
|
|
43
|
+
const errors = [];
|
|
44
|
+
if (!container.resources?.requests) {
|
|
45
|
+
errors.push({
|
|
46
|
+
code: 'MISSING_RESOURCE_REQUESTS',
|
|
47
|
+
message: `${label} is missing resource requests`,
|
|
48
|
+
resource: resource.kind,
|
|
49
|
+
field: 'spec.template.spec.containers[].resources.requests',
|
|
50
|
+
suggestion: 'Add resource.requests with cpu and memory values',
|
|
51
|
+
});
|
|
52
|
+
}
|
|
53
|
+
if (!container.resources?.limits) {
|
|
54
|
+
errors.push({
|
|
55
|
+
code: 'MISSING_RESOURCE_LIMITS',
|
|
56
|
+
message: `${label} is missing resource limits`,
|
|
57
|
+
resource: resource.kind,
|
|
58
|
+
field: 'spec.template.spec.containers[].resources.limits',
|
|
59
|
+
suggestion: 'Add resource.limits with cpu and memory values to prevent resource exhaustion',
|
|
60
|
+
});
|
|
61
|
+
}
|
|
62
|
+
return errors;
|
|
63
|
+
});
|
|
64
|
+
}
|
|
37
65
|
exports.requireResourceLimits = {
|
|
38
66
|
id: 'require-resource-limits',
|
|
39
67
|
description: 'All containers must have resource requests and limits',
|
|
40
68
|
severity: 'error',
|
|
41
|
-
test: (resources) =>
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
if (resource.kind === 'Deployment' ||
|
|
45
|
-
resource.kind === 'StatefulSet' ||
|
|
46
|
-
resource.kind === 'DaemonSet') {
|
|
47
|
-
const containers = resource.spec?.template?.spec?.containers || [];
|
|
48
|
-
for (const container of containers) {
|
|
49
|
-
if (!container.resources?.requests) {
|
|
50
|
-
errors.push({
|
|
51
|
-
code: 'MISSING_RESOURCE_REQUESTS',
|
|
52
|
-
message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" is missing resource requests`,
|
|
53
|
-
resource: resource.kind,
|
|
54
|
-
field: 'spec.template.spec.containers[].resources.requests',
|
|
55
|
-
suggestion: 'Add resource.requests with cpu and memory values',
|
|
56
|
-
});
|
|
57
|
-
}
|
|
58
|
-
if (!container.resources?.limits) {
|
|
59
|
-
errors.push({
|
|
60
|
-
code: 'MISSING_RESOURCE_LIMITS',
|
|
61
|
-
message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" is missing resource limits`,
|
|
62
|
-
resource: resource.kind,
|
|
63
|
-
field: 'spec.template.spec.containers[].resources.limits',
|
|
64
|
-
suggestion: 'Add resource.limits with cpu and memory values to prevent resource exhaustion',
|
|
65
|
-
});
|
|
66
|
-
}
|
|
67
|
-
}
|
|
68
|
-
}
|
|
69
|
-
}
|
|
70
|
-
return errors;
|
|
71
|
-
},
|
|
69
|
+
test: (resources) => resources
|
|
70
|
+
.filter((resource) => exports.RESOURCE_LIMIT_KINDS.includes(resource.kind))
|
|
71
|
+
.flatMap(containerResourceErrors),
|
|
72
72
|
};
|
|
73
73
|
/** Check that all resources have required labels */
|
|
74
74
|
const requireLabels = (requiredLabels) => ({
|
|
@@ -130,6 +130,17 @@ const SECRET_REFERENCE_SUFFIXES = [
|
|
|
130
130
|
'keyname',
|
|
131
131
|
'credentialsref',
|
|
132
132
|
];
|
|
133
|
+
/**
|
|
134
|
+
* Key prefixes that name a reference to an existing secret (chart
|
|
135
|
+
* convention), not credential values — e.g. the Harbor/Bitnami
|
|
136
|
+
* `existingSecretAdminPassword`, `existingSecretSecretKey` parameters.
|
|
137
|
+
*/
|
|
138
|
+
const SECRET_REFERENCE_PREFIXES = ['existingsecret'];
|
|
139
|
+
/** Does this normalized key hold a reference rather than a credential? */
|
|
140
|
+
function isReferenceKey(normalized) {
|
|
141
|
+
return (SECRET_REFERENCE_SUFFIXES.some((s) => normalized.endsWith(s)) ||
|
|
142
|
+
SECRET_REFERENCE_PREFIXES.some((s) => normalized.startsWith(s)));
|
|
143
|
+
}
|
|
133
144
|
/** Env var names that suggest the value is a credential. */
|
|
134
145
|
const SECRET_ENV_NAME_PATTERN = /(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key|credential|client[_-]?secret)/i;
|
|
135
146
|
/** Env var names that carry policy/lifetime metadata, not credentials
|
|
@@ -236,6 +247,153 @@ function workloadsContainers(resource) {
|
|
|
236
247
|
const podSpec = anyResource.spec?.template?.spec ?? anyResource.spec ?? {};
|
|
237
248
|
return [...(podSpec.containers ?? []), ...(podSpec.initContainers ?? [])];
|
|
238
249
|
}
|
|
250
|
+
const CREDENTIAL_VALUE_SUGGESTION = 'Use a secrets backend (openbao/vault/sealed-secrets) or let the operator provision the credential';
|
|
251
|
+
const SEALED_FILE_SUGGESTION = 'Move the credential into a secrets backend and reference it, or render this file as a sealed secret';
|
|
252
|
+
const CONFIGMAP_SUGGESTION = 'ConfigMaps carry no protection — render credentials as a Secret (from a secrets backend or sealed secret) instead';
|
|
253
|
+
function isNonEmptyString(value) {
|
|
254
|
+
return typeof value === 'string' && value.length > 0;
|
|
255
|
+
}
|
|
256
|
+
/** Does this key name look like it holds a credential value (not a reference)? */
|
|
257
|
+
function isCredentialKeyName(normalized, extraExclusions = []) {
|
|
258
|
+
return (SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
|
|
259
|
+
!isReferenceKey(normalized) &&
|
|
260
|
+
!extraExclusions.some((suffix) => normalized.endsWith(suffix)));
|
|
261
|
+
}
|
|
262
|
+
/** Multi-line values may embed YAML/INI payloads holding credential keys (e.g. appservice registration.yaml). */
|
|
263
|
+
function pushEmbeddedCredentialHits(ctx, hitInfo) {
|
|
264
|
+
const { kind, where, field, value, suggestion } = hitInfo;
|
|
265
|
+
if (typeof value !== 'string' || !value.includes('\n'))
|
|
266
|
+
return;
|
|
267
|
+
for (const hit of embeddedCredentialLines(value)) {
|
|
268
|
+
ctx.push(kind, `${where} — embedded key "${hit.key}"`, field, suggestion);
|
|
269
|
+
}
|
|
270
|
+
}
|
|
271
|
+
/** One stringData/data entry: credential keys, connection strings, PEM keys, embedded payloads. */
|
|
272
|
+
function scanSecretEntry(ctx, entry) {
|
|
273
|
+
const { name, map, key, value } = entry;
|
|
274
|
+
const where = `Secret "${name}" (${map}.${key})`;
|
|
275
|
+
const field = `${map}.${key}`;
|
|
276
|
+
if (isCredentialKeyName(normalizeKey(key)) && isNonEmptyString(value)) {
|
|
277
|
+
ctx.push('Secret', where, field, CREDENTIAL_VALUE_SUGGESTION);
|
|
278
|
+
}
|
|
279
|
+
ctx.scanValue('Secret', where, field, value);
|
|
280
|
+
pushEmbeddedCredentialHits(ctx, {
|
|
281
|
+
kind: 'Secret',
|
|
282
|
+
where,
|
|
283
|
+
field,
|
|
284
|
+
value,
|
|
285
|
+
suggestion: SEALED_FILE_SUGGESTION,
|
|
286
|
+
});
|
|
287
|
+
}
|
|
288
|
+
/** Secret stringData/data maps of a non-exempt Secret. */
|
|
289
|
+
function scanSecretResource(resource, ctx) {
|
|
290
|
+
const anyResource = resource;
|
|
291
|
+
const secretType = anyResource.type || '';
|
|
292
|
+
if (EXEMPT_SECRET_TYPES.includes(secretType) || anyResource.encryptedData !== undefined)
|
|
293
|
+
return;
|
|
294
|
+
for (const map of ['stringData', 'data']) {
|
|
295
|
+
const data = anyResource[map];
|
|
296
|
+
if (!data || typeof data !== 'object')
|
|
297
|
+
continue;
|
|
298
|
+
for (const [key, value] of Object.entries(data)) {
|
|
299
|
+
scanSecretEntry(ctx, { name: resource.metadata?.name, map, key, value });
|
|
300
|
+
}
|
|
301
|
+
}
|
|
302
|
+
}
|
|
303
|
+
/** ConfigMap data — same exposure as Secrets when credentials are embedded. */
|
|
304
|
+
function scanConfigMapResource(resource, ctx) {
|
|
305
|
+
const { push, scanValue } = ctx;
|
|
306
|
+
const data = resource.data;
|
|
307
|
+
if (!data || typeof data !== 'object')
|
|
308
|
+
return;
|
|
309
|
+
const name = resource.metadata?.name;
|
|
310
|
+
for (const [key, value] of Object.entries(data)) {
|
|
311
|
+
if (!isNonEmptyString(value))
|
|
312
|
+
continue;
|
|
313
|
+
const where = `ConfigMap "${name}" (data.${key})`;
|
|
314
|
+
const field = `data.${key}`;
|
|
315
|
+
const isCredentialKey = isCredentialKeyName(normalizeKey(key), EMBEDDED_KEY_EXCLUDE_SUFFIXES) &&
|
|
316
|
+
!looksLikeReference(value) &&
|
|
317
|
+
!PLACEHOLDER_VALUE_RE.test(value);
|
|
318
|
+
if (isCredentialKey)
|
|
319
|
+
push('ConfigMap', where, field, CONFIGMAP_SUGGESTION);
|
|
320
|
+
pushEmbeddedCredentialHits(ctx, {
|
|
321
|
+
kind: 'ConfigMap',
|
|
322
|
+
where,
|
|
323
|
+
field,
|
|
324
|
+
value,
|
|
325
|
+
suggestion: CONFIGMAP_SUGGESTION,
|
|
326
|
+
});
|
|
327
|
+
scanValue('ConfigMap', where, field, value);
|
|
328
|
+
}
|
|
329
|
+
}
|
|
330
|
+
/** Env entries that embed a literal string via `value` (valueFrom is a reference, not exposure). */
|
|
331
|
+
function hasPlainValue(env) {
|
|
332
|
+
return (!!env &&
|
|
333
|
+
typeof env === 'object' &&
|
|
334
|
+
typeof env.name === 'string' &&
|
|
335
|
+
typeof env.value === 'string' &&
|
|
336
|
+
env.valueFrom === undefined);
|
|
337
|
+
}
|
|
338
|
+
function envIsSecretNamed(name) {
|
|
339
|
+
return SECRET_ENV_NAME_PATTERN.test(name) && !NON_SECRET_ENV_NAME_PATTERN.test(name);
|
|
340
|
+
}
|
|
341
|
+
/** Workload env vars: only `value` embeds the credential — valueFrom is a reference. */
|
|
342
|
+
function scanWorkloadEnv(resource, kindName, push) {
|
|
343
|
+
for (const container of workloadsContainers(resource)) {
|
|
344
|
+
for (const env of (container.env ?? []).filter(hasPlainValue)) {
|
|
345
|
+
const where = `${kindName} container "${container.name}" env "${env.name}"`;
|
|
346
|
+
const field = `spec.template.spec.containers[].env[name=${env.name}].value`;
|
|
347
|
+
if (envIsSecretNamed(env.name) && !looksLikeReference(env.value)) {
|
|
348
|
+
push(resource.kind, where, field, 'Use valueFrom.secretKeyRef, a Vault/OpenBao secret reference, or $(VAR) expansion');
|
|
349
|
+
}
|
|
350
|
+
if (connectionStringPassword(env.value) !== null) {
|
|
351
|
+
push(resource.kind, where, field, 'Connection string embeds a password. Split into individual vars and reference the secret');
|
|
352
|
+
}
|
|
353
|
+
}
|
|
354
|
+
}
|
|
355
|
+
}
|
|
356
|
+
/** Nested fields — credentials anywhere in the resource tree (CRD specs, realm users, …). */
|
|
357
|
+
function walkNestedFields(resource, kindName, ctx) {
|
|
358
|
+
const { push, scanValue } = ctx;
|
|
359
|
+
const leafScan = (value, path) => {
|
|
360
|
+
if (typeof value === 'string')
|
|
361
|
+
scanValue(resource.kind, `${kindName} (${path})`, path, value);
|
|
362
|
+
};
|
|
363
|
+
const reportCredentialKey = (key, value, path) => {
|
|
364
|
+
if (!isCredentialKeyName(normalizeKey(key)))
|
|
365
|
+
return;
|
|
366
|
+
if (!isNonEmptyString(value) || looksLikeReference(value))
|
|
367
|
+
return;
|
|
368
|
+
push(resource.kind, `${kindName} (${path}.${key})`, `${path}.${key}`, 'Move the credential into a secrets backend and reference it by name');
|
|
369
|
+
};
|
|
370
|
+
const walkObject = (obj, path) => {
|
|
371
|
+
for (const [key, value] of Object.entries(obj)) {
|
|
372
|
+
// sealed-secrets ciphertext is encrypted with the cluster key
|
|
373
|
+
if (key === 'encryptedData')
|
|
374
|
+
continue;
|
|
375
|
+
reportCredentialKey(key, value, path);
|
|
376
|
+
// Recurse into child objects/arrays so credentials are caught at every
|
|
377
|
+
// depth; leaf strings are scanned for connection strings / PEM keys
|
|
378
|
+
if (value && typeof value === 'object')
|
|
379
|
+
walk(value, `${path}.${key}`);
|
|
380
|
+
else
|
|
381
|
+
leafScan(value, `${path}.${key}`);
|
|
382
|
+
}
|
|
383
|
+
};
|
|
384
|
+
const walk = (node, path) => {
|
|
385
|
+
if (Array.isArray(node)) {
|
|
386
|
+
node.forEach((item, i) => walk(item, `${path}[${i}]`));
|
|
387
|
+
return;
|
|
388
|
+
}
|
|
389
|
+
if (!node || typeof node !== 'object') {
|
|
390
|
+
leafScan(node, path);
|
|
391
|
+
return;
|
|
392
|
+
}
|
|
393
|
+
walkObject(node, path);
|
|
394
|
+
};
|
|
395
|
+
walk(resource.spec, 'spec');
|
|
396
|
+
}
|
|
239
397
|
/**
|
|
240
398
|
* Check that no credentials are rendered as plaintext. Covers:
|
|
241
399
|
* - Secret stringData/data values for credential keys, connection-string
|
|
@@ -279,122 +437,19 @@ exports.noPlaintextSecrets = {
|
|
|
279
437
|
push(resourceKind, where, field, 'PEM private key is embedded in the manifest. Store it in a secrets backend or a sealed secret instead');
|
|
280
438
|
}
|
|
281
439
|
};
|
|
440
|
+
const ctx = { push, scanValue };
|
|
282
441
|
for (const resource of resources) {
|
|
283
442
|
const kindName = `${resource.kind} "${resource.metadata?.name ?? '?'}"`;
|
|
284
|
-
const anyResource = resource;
|
|
285
|
-
// 1. Kubernetes Secret resources
|
|
286
443
|
if (resource.kind === 'Secret') {
|
|
287
|
-
|
|
288
|
-
const isEncrypted = anyResource.encryptedData !== undefined;
|
|
289
|
-
const exempt = EXEMPT_SECRET_TYPES.includes(secretType);
|
|
290
|
-
if (!exempt && !isEncrypted) {
|
|
291
|
-
for (const map of ['stringData', 'data']) {
|
|
292
|
-
const data = anyResource[map];
|
|
293
|
-
if (!data || typeof data !== 'object')
|
|
294
|
-
continue;
|
|
295
|
-
for (const [key, value] of Object.entries(data)) {
|
|
296
|
-
const normalized = normalizeKey(key);
|
|
297
|
-
const isCredentialKey = SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
|
|
298
|
-
!SECRET_REFERENCE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
|
|
299
|
-
if (isCredentialKey && typeof value === 'string' && value.length > 0) {
|
|
300
|
-
push('Secret', `Secret "${resource.metadata?.name}" (${map}.${key})`, `${map}.${key}`, 'Use a secrets backend (openbao/vault/sealed-secrets) or let the operator provision the credential');
|
|
301
|
-
}
|
|
302
|
-
scanValue('Secret', `Secret "${resource.metadata?.name}" (${map}.${key})`, `${map}.${key}`, value);
|
|
303
|
-
// Multi-line values may embed YAML/INI with credential keys
|
|
304
|
-
// (e.g. appservice registration.yaml holding as_token)
|
|
305
|
-
if (typeof value === 'string' && value.includes('\n')) {
|
|
306
|
-
for (const hit of embeddedCredentialLines(value)) {
|
|
307
|
-
push('Secret', `Secret "${resource.metadata?.name}" (${map}.${key}) — embedded key "${hit.key}"`, `${map}.${key}`, 'Move the credential into a secrets backend and reference it, or render this file as a sealed secret');
|
|
308
|
-
}
|
|
309
|
-
}
|
|
310
|
-
}
|
|
311
|
-
}
|
|
312
|
-
}
|
|
444
|
+
scanSecretResource(resource, ctx);
|
|
313
445
|
continue;
|
|
314
446
|
}
|
|
315
|
-
// 1b. ConfigMap data — same exposure as Secrets when credentials are
|
|
316
|
-
// embedded (ConfigMaps are committed to git alongside everything else)
|
|
317
447
|
if (resource.kind === 'ConfigMap') {
|
|
318
|
-
|
|
319
|
-
if (data && typeof data === 'object') {
|
|
320
|
-
for (const [key, value] of Object.entries(data)) {
|
|
321
|
-
if (typeof value !== 'string' || value.length === 0)
|
|
322
|
-
continue;
|
|
323
|
-
const normalized = normalizeKey(key);
|
|
324
|
-
const isCredentialKey = SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
|
|
325
|
-
!SECRET_REFERENCE_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
|
|
326
|
-
!EMBEDDED_KEY_EXCLUDE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
|
|
327
|
-
if (isCredentialKey &&
|
|
328
|
-
!looksLikeReference(value) &&
|
|
329
|
-
!PLACEHOLDER_VALUE_RE.test(value)) {
|
|
330
|
-
push('ConfigMap', `ConfigMap "${resource.metadata?.name}" (data.${key})`, `data.${key}`, 'ConfigMaps carry no protection — render credentials as a Secret (from a secrets backend or sealed secret) instead');
|
|
331
|
-
}
|
|
332
|
-
if (value.includes('\n')) {
|
|
333
|
-
for (const hit of embeddedCredentialLines(value)) {
|
|
334
|
-
push('ConfigMap', `ConfigMap "${resource.metadata?.name}" (data.${key}) — embedded key "${hit.key}"`, `data.${key}`, 'ConfigMaps carry no protection — render credentials as a Secret (from a secrets backend or sealed secret) instead');
|
|
335
|
-
}
|
|
336
|
-
}
|
|
337
|
-
scanValue('ConfigMap', `ConfigMap "${resource.metadata?.name}" (data.${key})`, `data.${key}`, value);
|
|
338
|
-
}
|
|
339
|
-
}
|
|
448
|
+
scanConfigMapResource(resource, ctx);
|
|
340
449
|
continue;
|
|
341
450
|
}
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
for (const env of container.env ?? []) {
|
|
345
|
-
if (!env || typeof env !== 'object' || !env.name)
|
|
346
|
-
continue;
|
|
347
|
-
// Only `value` embeds the credential — valueFrom is a reference.
|
|
348
|
-
if (env.value === undefined || env.valueFrom)
|
|
349
|
-
continue;
|
|
350
|
-
if (typeof env.value !== 'string')
|
|
351
|
-
continue;
|
|
352
|
-
const isSecretName = SECRET_ENV_NAME_PATTERN.test(env.name) && !NON_SECRET_ENV_NAME_PATTERN.test(env.name);
|
|
353
|
-
const hasConnectionString = connectionStringPassword(env.value) !== null;
|
|
354
|
-
if (isSecretName && !looksLikeReference(env.value)) {
|
|
355
|
-
push(resource.kind, `${kindName} container "${container.name}" env "${env.name}"`, `spec.template.spec.containers[].env[name=${env.name}].value`, 'Use valueFrom.secretKeyRef, a Vault/OpenBao secret reference, or $(VAR) expansion');
|
|
356
|
-
}
|
|
357
|
-
if (hasConnectionString) {
|
|
358
|
-
push(resource.kind, `${kindName} container "${container.name}" env "${env.name}"`, `spec.template.spec.containers[].env[name=${env.name}].value`, 'Connection string embeds a password. Split into individual vars and reference the secret');
|
|
359
|
-
}
|
|
360
|
-
}
|
|
361
|
-
}
|
|
362
|
-
// 3. Nested fields — credentials anywhere in the resource tree
|
|
363
|
-
const walk = (node, path) => {
|
|
364
|
-
if (Array.isArray(node)) {
|
|
365
|
-
node.forEach((item, i) => walk(item, `${path}[${i}]`));
|
|
366
|
-
return;
|
|
367
|
-
}
|
|
368
|
-
if (!node || typeof node !== 'object') {
|
|
369
|
-
if (typeof node === 'string')
|
|
370
|
-
scanValue(resource.kind, `${kindName} (${path})`, path, node);
|
|
371
|
-
return;
|
|
372
|
-
}
|
|
373
|
-
for (const [key, value] of Object.entries(node)) {
|
|
374
|
-
// sealed-secrets ciphertext is encrypted with the cluster key
|
|
375
|
-
if (key === 'encryptedData')
|
|
376
|
-
continue;
|
|
377
|
-
const normalized = normalizeKey(key);
|
|
378
|
-
const isCredentialKey = SECRET_KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix)) &&
|
|
379
|
-
!SECRET_REFERENCE_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
|
|
380
|
-
if (isCredentialKey &&
|
|
381
|
-
typeof value === 'string' &&
|
|
382
|
-
value.length > 0 &&
|
|
383
|
-
!looksLikeReference(value)) {
|
|
384
|
-
push(resource.kind, `${kindName} (${path}.${key})`, `${path}.${key}`, 'Move the credential into a secrets backend and reference it by name');
|
|
385
|
-
}
|
|
386
|
-
// Recurse into child objects/arrays so credentials are caught at
|
|
387
|
-
// every depth (pod templates, CRD specs, realm users, …); leaf
|
|
388
|
-
// strings are scanned for connection strings / PEM keys
|
|
389
|
-
if (value && typeof value === 'object') {
|
|
390
|
-
walk(value, `${path}.${key}`);
|
|
391
|
-
}
|
|
392
|
-
else {
|
|
393
|
-
scanValue(resource.kind, `${kindName} (${path}.${key})`, `${path}.${key}`, value);
|
|
394
|
-
}
|
|
395
|
-
}
|
|
396
|
-
};
|
|
397
|
-
walk(anyResource.spec, 'spec');
|
|
451
|
+
scanWorkloadEnv(resource, kindName, push);
|
|
452
|
+
walkNestedFields(resource, kindName, ctx);
|
|
398
453
|
}
|
|
399
454
|
return errors;
|
|
400
455
|
},
|
|
@@ -424,44 +479,42 @@ exports.requireTLS = {
|
|
|
424
479
|
},
|
|
425
480
|
};
|
|
426
481
|
/** Check that Pods don't run as root */
|
|
482
|
+
function runsAsRoot(securityContext) {
|
|
483
|
+
return securityContext?.runAsUser === 0 || securityContext?.runAsRoot === true;
|
|
484
|
+
}
|
|
485
|
+
function rootContainerErrors(resource) {
|
|
486
|
+
const podSpec = resource.spec?.template?.spec || resource.spec || {};
|
|
487
|
+
const name = resource.metadata?.name;
|
|
488
|
+
const errors = [];
|
|
489
|
+
if (runsAsRoot(podSpec.securityContext ?? {})) {
|
|
490
|
+
errors.push({
|
|
491
|
+
code: 'CONTAINER_RUNS_AS_ROOT',
|
|
492
|
+
message: `${resource.kind} "${name}" is configured to run as root`,
|
|
493
|
+
resource: resource.kind,
|
|
494
|
+
field: 'spec.template.spec.securityContext.runAsUser',
|
|
495
|
+
suggestion: 'Set runAsUser to a non-zero UID and runAsRoot to false',
|
|
496
|
+
});
|
|
497
|
+
}
|
|
498
|
+
for (const container of podSpec.containers || []) {
|
|
499
|
+
if (runsAsRoot(container.securityContext ?? {})) {
|
|
500
|
+
errors.push({
|
|
501
|
+
code: 'CONTAINER_RUNS_AS_ROOT',
|
|
502
|
+
message: `Container "${container.name}" in ${resource.kind} "${name}" runs as root`,
|
|
503
|
+
resource: resource.kind,
|
|
504
|
+
field: 'spec.template.spec.containers[].securityContext.runAsUser',
|
|
505
|
+
suggestion: 'Set securityContext.runAsUser to a non-zero UID',
|
|
506
|
+
});
|
|
507
|
+
}
|
|
508
|
+
}
|
|
509
|
+
return errors;
|
|
510
|
+
}
|
|
427
511
|
exports.noRootContainers = {
|
|
428
512
|
id: 'no-root-containers',
|
|
429
513
|
description: 'Containers should not run as root user',
|
|
430
514
|
severity: 'error',
|
|
431
|
-
test: (resources) =>
|
|
432
|
-
|
|
433
|
-
|
|
434
|
-
if (resource.kind === 'Deployment' ||
|
|
435
|
-
resource.kind === 'StatefulSet' ||
|
|
436
|
-
resource.kind === 'DaemonSet' ||
|
|
437
|
-
resource.kind === 'Pod') {
|
|
438
|
-
const podSpec = resource.spec?.template?.spec || resource.spec || {};
|
|
439
|
-
const securityContext = podSpec.securityContext || {};
|
|
440
|
-
if (securityContext.runAsUser === 0 || securityContext.runAsRoot === true) {
|
|
441
|
-
errors.push({
|
|
442
|
-
code: 'CONTAINER_RUNS_AS_ROOT',
|
|
443
|
-
message: `${resource.kind} "${resource.metadata?.name}" is configured to run as root`,
|
|
444
|
-
resource: resource.kind,
|
|
445
|
-
field: 'spec.template.spec.securityContext.runAsUser',
|
|
446
|
-
suggestion: 'Set runAsUser to a non-zero UID and runAsRoot to false',
|
|
447
|
-
});
|
|
448
|
-
}
|
|
449
|
-
for (const container of podSpec.containers || []) {
|
|
450
|
-
const containerSecurity = container.securityContext || {};
|
|
451
|
-
if (containerSecurity.runAsUser === 0 || containerSecurity.runAsRoot === true) {
|
|
452
|
-
errors.push({
|
|
453
|
-
code: 'CONTAINER_RUNS_AS_ROOT',
|
|
454
|
-
message: `Container "${container.name}" in ${resource.kind} "${resource.metadata?.name}" runs as root`,
|
|
455
|
-
resource: resource.kind,
|
|
456
|
-
field: 'spec.template.spec.containers[].securityContext.runAsUser',
|
|
457
|
-
suggestion: 'Set securityContext.runAsUser to a non-zero UID',
|
|
458
|
-
});
|
|
459
|
-
}
|
|
460
|
-
}
|
|
461
|
-
}
|
|
462
|
-
}
|
|
463
|
-
return errors;
|
|
464
|
-
},
|
|
515
|
+
test: (resources) => resources
|
|
516
|
+
.filter((resource) => [...exports.RESOURCE_LIMIT_KINDS, 'Pod'].includes(resource.kind))
|
|
517
|
+
.flatMap(rootContainerErrors),
|
|
465
518
|
};
|
|
466
519
|
/** Default set of guardrails for production use */
|
|
467
520
|
exports.defaultGuardrails = [
|
package/dist/guardrails.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AAwkBA,sCAgCC;AA1lBD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACzC,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW,EAC7B,CAAC;gBACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAA;gBAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;oBACnC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;wBACnC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;4BACtH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,oDAAoD;4BAC3D,UAAU,EAAE,kDAAkD;yBAC/D,CAAC,CAAA;oBACJ,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,yBAAyB;4BAC/B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,8BAA8B;4BACpH,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,kDAAkD;4BACzD,UAAU,EACR,+EAA+E;yBAClF,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,OAAO,EAAE,wDAAwD;IACjE,WAAW;IACX,kBAAkB;CACnB,CAAA;AAED,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,gBAAgB;CACjB,CAAA;AAED,4DAA4D;AAC5D,MAAM,uBAAuB,GAC3B,6GAA6G,CAAA;AAE/G;mEACmE;AACnE,MAAM,2BAA2B,GAC/B,6IAA6I,CAAA;AAE/I,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,gDAAgD,CAAA;AAE7E,gGAAgG;AAChG,MAAM,mBAAmB,GAAG;IAC1B,mBAAmB;IACnB,mBAAmB;IACnB,qCAAqC;IACrC,+BAA+B;IAC/B,oBAAoB;CACrB,CAAA;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,kEAAkE,CAAA;AAE/F;;;;GAIG;AACH,MAAM,2BAA2B,GAC/B,8NAA8N,CAAA;AAEhO;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,UAAU;IACV,KAAK;IACL,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,WAAW;IACX,KAAK;IACL,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,QAAQ,EAAE,oEAAoE;CAC/E,CAAA;AAED,sEAAsE;AACtE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAqC,EAAE,CAAA;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAC5B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACzF,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC9C,gEAAgE;QAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,KAAK,CAAA;IAC5B,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,QAA4B;IACvD,MAAM,WAAW,GAAG,QAAe,CAAA;IACnC,MAAM,IAAI,GAAW,WAAW,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAC1E,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;SAC/E,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAE9B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,UAAkB,EAAE,EAAE;YAC9E,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAM;YAC/B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,2BAA2B,KAAK,EAAE;gBAC3C,QAAQ,EAAE,IAAI;gBACd,KAAK;gBACL,UAAU;aACX,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAE,KAAa,EAAE,KAAa,EAAE,KAAc,EAAE,EAAE;YACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC3D,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,oHAAoH,CACrH,CAAA;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3E,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,uGAAuG,CACxG,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,GAAG,CAAA;YACvE,MAAM,WAAW,GAAG,QAAe,CAAA;YAEnC,iCAAiC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAI,WAAW,CAAC,IAAe,IAAI,EAAE,CAAA;gBACrD,MAAM,WAAW,GAAG,WAAW,CAAC,aAAa,KAAK,SAAS,CAAA;gBAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAEvD,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAU,EAAE,CAAC;wBAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;wBAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,SAAQ;wBAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;4BAChD,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;4BACpC,MAAM,eAAe,GACnB,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gCACjE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;4BAC1E,IAAI,eAAe,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCACrE,IAAI,CACF,QAAQ,EACR,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,EACrD,GAAG,GAAG,IAAI,GAAG,EAAE,EACf,mGAAmG,CACpG,CAAA;4BACH,CAAC;4BACD,SAAS,CACP,QAAQ,EACR,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,EACrD,GAAG,GAAG,IAAI,GAAG,EAAE,EACf,KAAK,CACN,CAAA;4BACD,4DAA4D;4BAC5D,uDAAuD;4BACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gCACtD,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;oCACjD,IAAI,CACF,QAAQ,EACR,WAAW,QAAQ,CAAC,QAAQ,EAAE,IAAI,MAAM,GAAG,IAAI,GAAG,qBAAqB,GAAG,CAAC,GAAG,GAAG,EACjF,GAAG,GAAG,IAAI,GAAG,EAAE,EACf,qGAAqG,CACtG,CAAA;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAA;gBAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;4BAAE,SAAQ;wBAC7D,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;wBACpC,MAAM,eAAe,GACnB,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACjE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACxE,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;wBAC9E,IACE,eAAe;4BACf,CAAC,kBAAkB,CAAC,KAAK,CAAC;4BAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;4BACD,IAAI,CACF,WAAW,EACX,cAAc,QAAQ,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,GAAG,EACtD,QAAQ,GAAG,EAAE,EACb,mHAAmH,CACpH,CAAA;wBACH,CAAC;wBACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BACzB,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;gCACjD,IAAI,CACF,WAAW,EACX,cAAc,QAAQ,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,qBAAqB,GAAG,CAAC,GAAG,GAAG,EAClF,QAAQ,GAAG,EAAE,EACb,mHAAmH,CACpH,CAAA;4BACH,CAAC;wBACH,CAAC;wBACD,SAAS,CACP,WAAW,EACX,cAAc,QAAQ,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,GAAG,EACtD,QAAQ,GAAG,EAAE,EACb,KAAK,CACN,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,uBAAuB;YACvB,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;oBACtC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI;wBAAE,SAAQ;oBAC1D,iEAAiE;oBACjE,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS;wBAAE,SAAQ;oBACtD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;wBAAE,SAAQ;oBAC3C,MAAM,YAAY,GAChB,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACvF,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAA;oBACxE,IAAI,YAAY,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnD,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,eAAe,SAAS,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,GAAG,EAC7D,4CAA4C,GAAG,CAAC,IAAI,SAAS,EAC7D,mFAAmF,CACpF,CAAA;oBACH,CAAC;oBACD,IAAI,mBAAmB,EAAE,CAAC;wBACxB,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,eAAe,SAAS,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,GAAG,EAC7D,4CAA4C,GAAG,CAAC,IAAI,SAAS,EAC7D,0FAA0F,CAC3F,CAAA;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAY,EAAE,EAAE;gBAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;oBACtD,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtC,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAC1B,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;oBAC/D,OAAM;gBACR,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;oBAC3E,8DAA8D;oBAC9D,IAAI,GAAG,KAAK,eAAe;wBAAE,SAAQ;oBACrC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;oBACpC,MAAM,eAAe,GACnB,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBACjE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;oBAC1E,IACE,eAAe;wBACf,OAAO,KAAK,KAAK,QAAQ;wBACzB,KAAK,CAAC,MAAM,GAAG,CAAC;wBAChB,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAC1B,CAAC;wBACD,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,EAC9B,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,qEAAqE,CACtE,CAAA;oBACH,CAAC;oBACD,iEAAiE;oBACjE,+DAA+D;oBAC/D,wDAAwD;oBACxD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACvC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;oBAC/B,CAAC;yBAAM,CAAC;wBACN,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;oBACnF,CAAC;gBACH,CAAC;YACH,CAAC,CAAA;YACD,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAChC,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AAC3B,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,QAAQ,CAAC,IAAI,KAAK,aAAa;gBAC/B,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAC7B,QAAQ,CAAC,IAAI,KAAK,KAAK,EACvB,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;gBACpE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;gBAErD,IAAI,eAAe,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC1E,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBACrF,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,8CAA8C;wBACrD,UAAU,EAAE,wDAAwD;qBACrE,CAAC,CAAA;gBACJ,CAAC;gBAED,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;oBACjD,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,IAAI,EAAE,CAAA;oBACzD,IAAI,iBAAiB,CAAC,SAAS,KAAK,CAAC,IAAI,iBAAiB,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;wBAC9E,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,wBAAwB;4BAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;4BACtG,QAAQ,EAAE,QAAQ,CAAC,IAAI;4BACvB,KAAK,EAAE,2DAA2D;4BAClE,UAAU,EAAE,iDAAiD;yBAC9D,CAAC,CAAA;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../src/guardrails.ts"],"names":[],"mappings":";;;AA0nBA,sCAgCC;AA5oBD,qDAAqD;AACxC,QAAA,sBAAsB,GAAkB;IACnD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;QACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAA;QAE1C,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACtE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,cAAc,EAAE,8BAA8B;oBACvD,QAAQ,EAAE,WAAW;oBACrB,KAAK,EAAE,eAAe;oBACtB,UAAU,EAAE,sCAAsC,EAAE,qCAAqC;iBAC1F,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,sDAAsD;AACtD,kEAAkE;AACrD,QAAA,oBAAoB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,CAAU,CAAA;AAEvF,SAAS,uBAAuB,CAAC,QAAa;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAc,EAAE,EAAE;QAClF,MAAM,KAAK,GAAG,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,IAAI,GAAG,CAAA;QAC3E,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,GAAG,KAAK,+BAA+B;gBAChD,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,oDAAoD;gBAC3D,UAAU,EAAE,kDAAkD;aAC/D,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,GAAG,KAAK,6BAA6B;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,kDAAkD;gBACzD,UAAU,EAAE,+EAA+E;aAC5F,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAEY,QAAA,qBAAqB,GAAkB;IAClD,EAAE,EAAE,yBAAyB;IAC7B,WAAW,EAAE,uDAAuD;IACpE,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CACjB,SAAmB;SACjB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAE,4BAA0C,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACzF,OAAO,CAAC,uBAAuB,CAAC;CACtC,CAAA;AACD,oDAAoD;AAC7C,MAAM,aAAa,GAAG,CAAC,cAAwB,EAAiB,EAAE,CAAC,CAAC;IACzE,EAAE,EAAE,kBAAkB,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;IACvD,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC3E,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAkB,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAA;YAC9C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC,KAAK,GAAG;wBAC7F,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,KAAK,EAAE,mBAAmB,KAAK,EAAE;wBACjC,UAAU,EAAE,cAAc,KAAK,QAAQ,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAC,CAAA;AAxBW,QAAA,aAAa,iBAwBxB;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,UAAU;IACV,QAAQ;IACR,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,OAAO,EAAE,wDAAwD;IACjE,WAAW;IACX,kBAAkB;CACnB,CAAA;AAED,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG;IAChC,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,WAAW;IACX,UAAU;IACV,QAAQ;IACR,SAAS;IACT,gBAAgB;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAAC,gBAAgB,CAAC,CAAA;AAEpD,0EAA0E;AAC1E,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,CACL,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7D,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAChE,CAAA;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,uBAAuB,GAC3B,6GAA6G,CAAA;AAE/G;mEACmE;AACnE,MAAM,2BAA2B,GAC/B,6IAA6I,CAAA;AAE/I,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,gDAAgD,CAAA;AAE7E,gGAAgG;AAChG,MAAM,mBAAmB,GAAG;IAC1B,mBAAmB;IACnB,mBAAmB;IACnB,qCAAqC;IACrC,+BAA+B;IAC/B,oBAAoB;CACrB,CAAA;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,oBAAoB,GAAG,kEAAkE,CAAA;AAE/F;;;;GAIG;AACH,MAAM,2BAA2B,GAC/B,8NAA8N,CAAA;AAEhO;;;GAGG;AACH,MAAM,6BAA6B,GAAG;IACpC,UAAU;IACV,KAAK;IACL,KAAK;IACL,KAAK;IACL,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,WAAW;IACX,KAAK;IACL,QAAQ;IACR,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,QAAQ,EAAE,oEAAoE;CAC/E,CAAA;AAED,sEAAsE;AACtE,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAqC,EAAE,CAAA;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;QAC5B,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,SAAQ;QACzF,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACvC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC9C,gEAAgE;QAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,KAAK,CAAA;IAC5B,wEAAwE;IACxE,qDAAqD;IACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,gEAAgE;AAChE,SAAS,mBAAmB,CAAC,QAA4B;IACvD,MAAM,WAAW,GAAG,QAAe,CAAA;IACnC,MAAM,IAAI,GAAW,WAAW,CAAC,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAC1E,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC;SAC/E,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC;AASD,MAAM,2BAA2B,GAC/B,mGAAmG,CAAA;AACrG,MAAM,sBAAsB,GAC1B,qGAAqG,CAAA;AACvG,MAAM,oBAAoB,GACxB,mHAAmH,CAAA;AAErH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,UAAkB,EAAE,kBAA4B,EAAE;IAC7E,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC,cAAc,CAAC,UAAU,CAAC;QAC3B,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAED,iHAAiH;AACjH,SAAS,0BAA0B,CACjC,GAAkB,EAClB,OAA2F;IAE3F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAM;IAC9D,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,oBAAoB,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CACtB,GAAkB,EAClB,KAA6E;IAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAA;IACvC,MAAM,KAAK,GAAG,WAAW,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,CAAA;IAChD,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;IAC7B,IAAI,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAA;IAC/D,CAAC;IACD,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC5C,0BAA0B,CAAC,GAAG,EAAE;QAC9B,IAAI,EAAE,QAAQ;QACd,KAAK;QACL,KAAK;QACL,KAAK;QACL,UAAU,EAAE,sBAAsB;KACnC,CAAC,CAAA;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,kBAAkB,CAAC,QAA4B,EAAE,GAAkB;IAC1E,MAAM,WAAW,GAAG,QAAe,CAAA;IACnC,MAAM,UAAU,GAAI,WAAW,CAAC,IAAe,IAAI,EAAE,CAAA;IACrD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,aAAa,KAAK,SAAS;QAAE,OAAM;IAE/F,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAU,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,QAA4B,EAAE,GAAkB;IAC7E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAC/B,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAM;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACtC,MAAM,KAAK,GAAG,cAAc,IAAI,WAAW,GAAG,GAAG,CAAA;QACjD,MAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,CAAA;QAC3B,MAAM,eAAe,GACnB,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,6BAA6B,CAAC;YACrE,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,eAAe;YAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAA;QAC1E,0BAA0B,CAAC,GAAG,EAAE;YAC9B,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,KAAK;YACL,KAAK;YACL,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAA;QACF,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAC7C,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,GAAQ;IAC7B,OAAO,CACL,CAAC,CAAC,GAAG;QACL,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,GAAG,CAAC,SAAS,KAAK,SAAS,CAC5B,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtF,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CACtB,QAA4B,EAC5B,QAAgB,EAChB,IAAoB;IAEpB,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,GAAG,QAAQ,eAAe,SAAS,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,GAAG,CAAA;YAC3E,MAAM,KAAK,GAAG,4CAA4C,GAAG,CAAC,IAAI,SAAS,CAAA;YAC3E,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,KAAK,EACL,KAAK,EACL,mFAAmF,CACpF,CAAA;YACH,CAAC;YACD,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,KAAK,EACL,KAAK,EACL,0FAA0F,CAC3F,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,QAAgB,EAChB,GAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,CAAA;IAE/B,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAE,IAAY,EAAQ,EAAE;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/F,CAAC,CAAA;IAED,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,IAAY,EAAQ,EAAE;QAC9E,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAAE,OAAM;QACnD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAM;QACjE,IAAI,CACF,QAAQ,CAAC,IAAI,EACb,GAAG,QAAQ,KAAK,IAAI,IAAI,GAAG,GAAG,EAC9B,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,qEAAqE,CACtE,CAAA;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,GAA4B,EAAE,IAAY,EAAQ,EAAE;QACtE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,8DAA8D;YAC9D,IAAI,GAAG,KAAK,eAAe;gBAAE,SAAQ;YACrC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;YACrC,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;;gBAChE,QAAQ,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;QACxC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAY,EAAQ,EAAE;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QACD,UAAU,CAAC,IAA+B,EAAE,IAAI,CAAC,CAAA;IACnD,CAAC,CAAA;IAED,IAAI,CAAE,QAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,kBAAkB,GAAkB;IAC/C,EAAE,EAAE,sBAAsB;IAC1B,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAE9B,MAAM,IAAI,GAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC9D,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAA;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAM;YAC/B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,2BAA2B,KAAK,EAAE;gBAC3C,QAAQ,EAAE,IAAI;gBACd,KAAK;gBACL,UAAU;aACX,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,SAAS,GAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC3D,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,oHAAoH,CACrH,CAAA;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3E,IAAI,CACF,YAAY,EACZ,KAAK,EACL,KAAK,EACL,uGAAuG,CACxG,CAAA;YACH,CAAC;QACH,CAAC,CAAA;QAED,MAAM,GAAG,GAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC9C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,GAAG,GAAG,CAAA;YACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,qBAAqB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACpC,SAAQ;YACV,CAAC;YACD,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACzC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC3C,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,+CAA+C;AAClC,QAAA,UAAU,GAAkB;IACvC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;QAClB,MAAM,MAAM,GAAsB,EAAE,CAAA;QAEpC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,EAAE,CAAA;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gCAAgC;wBAC5E,QAAQ,EAAE,SAAS;wBACnB,KAAK,EAAE,UAAU;wBACjB,UAAU,EACR,iFAAiF;qBACpF,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF,CAAA;AAED,wCAAwC;AACxC,SAAS,UAAU,CAAC,eAAoB;IACtC,OAAO,eAAe,EAAE,SAAS,KAAK,CAAC,IAAI,eAAe,EAAE,SAAS,KAAK,IAAI,CAAA;AAChF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAa;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;IACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACpC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,IAAI,UAAU,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,gCAAgC;YAClE,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,KAAK,EAAE,8CAA8C;YACrD,UAAU,EAAE,wDAAwD;SACrE,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,cAAc,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,KAAK,IAAI,gBAAgB;gBACnF,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,2DAA2D;gBAClE,UAAU,EAAE,iDAAiD;aAC9D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAEY,QAAA,gBAAgB,GAAkB;IAC7C,EAAE,EAAE,oBAAoB;IACxB,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CACjB,SAAmB;SACjB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAClB,CAAC,GAAG,4BAAoB,EAAE,KAAK,CAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChF;SACA,OAAO,CAAC,mBAAmB,CAAC;CAClC,CAAA;AACD,mDAAmD;AACtC,QAAA,iBAAiB,GAAoB;IAChD,8BAAsB;IACtB,6BAAqB;IACrB,0BAAkB;IAClB,kBAAU;IACV,wBAAgB;CACjB,CAAA;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAC3B,SAA+B,EAC/B,QAAyB,yBAAiB;IAO1C,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACtB,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM;QACN,QAAQ;QACR,IAAI;KACL,CAAA;AACH,CAAC"}
|
package/dist/validate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,eAAe,EAAE,CAAA;gBAEb,MAAM,EAAE,eAAe,EAAE;CAMtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoEhF;AAED,gDAAgD;AAChD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAkE/E;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,
|
|
1
|
+
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,EAAE,eAAe,EAAE,CAAA;gBAEb,MAAM,EAAE,eAAe,EAAE;CAMtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoEhF;AAED,gDAAgD;AAChD,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAkE/E;AAED,kCAAkC;AAClC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CAoD/E;AAED,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,eAAe,EAAE,CA6DlF;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,GAAG,eAAe,EAAE,CAsCjE;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,eAAe,EAAE,CA2BlF"}
|
package/dist/validate.js
CHANGED
|
@@ -174,6 +174,17 @@ function validateService(resource) {
|
|
|
174
174
|
else {
|
|
175
175
|
for (let i = 0; i < spec.ports.length; i++) {
|
|
176
176
|
const port = spec.ports[i];
|
|
177
|
+
// The API server rejects multi-port Services whose ports lack names —
|
|
178
|
+
// Flux catches this at dry-run time (after merge), so catch it in tests
|
|
179
|
+
if (spec.ports.length > 1 && !port.name) {
|
|
180
|
+
errors.push({
|
|
181
|
+
code: 'MULTI_PORT_WITHOUT_NAME',
|
|
182
|
+
message: `Service "${resource.metadata?.name}" has ${spec.ports.length} ports — every port requires a name (spec.ports[${i}] is anonymous)`,
|
|
183
|
+
resource: 'Service',
|
|
184
|
+
field: `spec.ports[${i}].name`,
|
|
185
|
+
suggestion: 'Name every port when a Service has more than one, e.g. { name: "http", port: 8080 }',
|
|
186
|
+
});
|
|
187
|
+
}
|
|
177
188
|
if (!port.port || port.port < 1 || port.port > 65535) {
|
|
178
189
|
errors.push({
|
|
179
190
|
code: 'INVALID_PORT',
|
package/dist/validate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":";;;AA4BA,4CAoEC;AAGD,0CAkEC;AAGD,
|
|
1
|
+
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":";;;AA4BA,4CAoEC;AAGD,0CAkEC;AAGD,0CAoDC;AAGD,gDA6DC;AAGD,4CAsCC;AAGD,0CA2BC;AAnVD,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,MAAM,CAAmB;IAEzB,YAAY,MAAyB;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AATD,gDASC;AAED,qCAAqC;AACrC,SAAgB,gBAAgB,CAAC,QAA4B;IAC3D,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,IAAI,SAAS,CAAA;IAEhD,mBAAmB;IACnB,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,aAAa,IAAI,yBAAyB;YACnD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,iDAAiD;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,aAAa;IACb,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,oDAAoD;SACjE,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,aAAa,IAAI,uBAAuB;YACjD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE,uCAAuC;SACpD,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,aAAa;QACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,aAAa,IAAI,4BAA4B;gBACtD,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EAAE,sCAAsC;aACnD,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,kBAAkB,QAAQ,CAAC,QAAQ,CAAC,IAAI,qCAAqC;gBACtF,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EACR,yFAAyF;aAC5F,CAAC,CAAA;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,aAAa,QAAQ,CAAC,QAAQ,CAAC,IAAI,0BAA0B;gBACtE,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,UAAU,EAAE,0EAA0E;aACvF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,gDAAgD;AAChD,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,cAAc;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;YAC5D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,qDAAqD;SAClE,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,kBAAkB;oBACzE,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EAAE,yCAAyC;iBACtD,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,eAAe;oBACtE,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,cAAc;oBACpC,UAAU,EAAE,8CAA8C;iBAC3D,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACvB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB,CAAC,wBAAwB;oBACrF,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,YAAY,CAAC,cAAc;oBAClC,UAAU,EACR,wGAAwG;iBAC3G,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,kCAAkC;AAClC,SAAgB,eAAe,CAAC,QAA4B;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,kCAAkC;SAC/C,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,cAAc;IACd,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,gBAAgB;YAC5D,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,YAAY;YACnB,UAAU,EAAE,6DAA6D;SAC1E,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,mDAAmD,CAAC,iBAAiB;oBAC3I,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EACR,qFAAqF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,YAAY,QAAQ,CAAC,QAAQ,EAAE,IAAI,UAAU,CAAC,6BAA6B,IAAI,CAAC,IAAI,EAAE;oBAC/F,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,cAAc,CAAC,QAAQ;oBAC9B,UAAU,EAAE,kCAAkC;iBAC/C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qCAAqC;AACrC,SAAgB,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAI,QAAgB,CAAC,IAAI,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,gDAAgD;SAC7D,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,2BAA2B,IAAI,CAAC,QAAQ,EAAE;YACzF,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,yCAAyC;SACtD,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,4BAA4B;YAC3E,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,iDAAiD;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,4BAA4B;YAC3E,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,eAAe;YACtB,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;IACJ,CAAC;SAAM,IACL,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe,QAAQ,CAAC,QAAQ,EAAE,IAAI,qBAAqB;YACpE,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,+BAA+B;YACtC,UAAU,EAAE,gDAAgD;SAC7D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,uCAAuC;AACvC,SAAgB,gBAAgB,CAAC,QAAa;IAC5C,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,0BAA0B;YACnC,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,wEAAwE;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,sBAAsB;YACtE,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,0CAA0C;SACvD,CAAC,CAAA;IACJ,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,CAAC,OAAO,GAAG;YACjF,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,qBAAqB;YACrE,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,yDAAyD;SACtE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,SAAgB,eAAe,CAAC,SAA+B;IAC7D,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAA;IAExC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,CAAA;QAChI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACnB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,aAAa,IAAI,KAAK,IAAI,mBAAmB,SAAS,YAAY,OAAO,CAAC,MAAM,SAAS;gBAClG,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,eAAe;gBACtB,UAAU,EACR,oHAAoH;aACvH,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
|