@venturekit/infra 0.0.0-dev.20260514025219 → 0.0.0-dev.20260515022321

package/dist/cdk/shared/ssm-keys.d.ts

@@ -0,0 +1,460 @@
+/**
+ * SSM Parameter Store key builders for cross-stack references in the
+ * lifecycle-aligned multi-stack layout (network / data / identity /
+ * config / messaging / edge / app).
+ *
+ * # Why SSM and not `Fn::ImportValue`?
+ *
+ * CloudFormation cross-stack `Outputs` + `Fn::ImportValue` carries a
+ * hard lock: once a stack consumes another stack's export, the
+ * exporting stack cannot modify or delete that export until every
+ * consumer is removed. That makes the lower stable tiers (data,
+ * identity) unable to evolve their public surface without coordinated
+ * multi-stack redeploys — a single typo in a Cognito client id rename
+ * becomes a multi-week CFN choreography exercise.
+ *
+ * SSM Parameter Store has no such lock. The producer writes a
+ * `String` parameter; the consumer reads it via
+ * `StringParameter.valueForStringParameter(scope, name)` — a CFN
+ * dynamic reference (`{{resolve:ssm:…}}`) resolved at deploy time, not
+ * a stack-graph dependency. Producers can freely change values; the
+ * next consumer redeploy picks them up. Producers can be deleted with
+ * the parameter still in place; consumers fail loudly at synth/deploy
+ * with a clear "parameter not found" error rather than CFN's
+ * inscrutable "cannot modify export" rejection.
+ *
+ * # Naming convention
+ *
+ *   /venturekit/<project>/<stage>/<category>/<resource-or-id>/<field>
+ *
+ * - Always rooted at `/venturekit/` so this module's parameters never
+ *   collide with operator-managed parameters under `/<project>/...`.
+ * - `<project>` and `<stage>` produce a project- and env-isolated
+ *   namespace so multiple projects in the same AWS account (or
+ *   multiple stages of the same project) do not stomp on each other.
+ * - `<category>` mirrors the seven-tier split (`network`, `data`,
+ *   `identity`, `config`, `messaging`, `edge`, `app`). Operators
+ *   doing forensics can grep CloudTrail / `aws ssm describe-parameters
+ *   --filters "Key=Name,Values=/venturekit/myapp/prod/data/"` to see
+ *   exactly what one tier publishes.
+ * - `<resource-or-id>` is the user-declared `intent.id` for resources
+ *   that come in arrays (databases, queues, auth pools, …); singletons
+ *   collapse to a single key (`api/id` rather than `api/<id>/id`).
+ * - `<field>` is what specific attribute of the resource is stored
+ *   (`endpoint`, `arn`, `secret-arn`, …). Always kebab-case.
+ *
+ * Lists (e.g. multi-AZ subnet IDs) are stored as comma-joined strings
+ * because SSM `StringList` parameters cannot be referenced via the
+ * `{{resolve:ssm:…}}` dynamic reference — only `String` and
+ * `SecureString`. The consumer-side helper `readSsmStringList` in
+ * `cross-stack-refs.ts` does the splitting.
+ *
+ * # Why a single source of truth?
+ *
+ * Every key is constructed via a function in this file — no inline
+ * string templating in stack code anywhere else. That gives us:
+ *
+ *   - One place to change the convention (e.g. add a `version/` prefix
+ *     for forward-compatible breaking changes to a key shape).
+ *   - One place to grep when investigating "why is this Lambda
+ *     reading parameter X?".
+ *   - Test coverage that pins every key shape so a typo in a
+ *     producer's write doesn't silently de-sync from a consumer's
+ *     read three months later.
+ *
+ * # Stability guarantee
+ *
+ * The function names AND their return values are part of the
+ * cross-stack contract. Renaming a function = breaking every
+ * deployed stack that already wrote a parameter at the old name.
+ * Treat changes here the same way you'd treat changes to a public
+ * API: add new keys, deprecate old ones, never silently rename.
+ */
+/**
+ * VPC ID for the project's primary VPC. Singleton — VentureKit
+ * provisions exactly one VPC per stack-set even when multiple
+ * databases / caches / Lambdas live in it.
+ */
+export declare const networkKeys: {
+    readonly vpcId: (project: string, stage: string) => string;
+    /**
+     * Comma-joined private subnet IDs (subnets where Lambdas + RDS run).
+     * Stored as a single comma-joined `String` because CFN's
+     * `{{resolve:ssm:…}}` dynamic reference does not support
+     * `StringList` parameters. `readSsmStringList` in
+     * `cross-stack-refs.ts` re-splits on the consumer side.
+     */
+    readonly privateSubnetIds: (project: string, stage: string) => string;
+    /** Comma-joined public subnet IDs — used by NAT GW + (future) ALB. */
+    readonly publicSubnetIds: (project: string, stage: string) => string;
+    /**
+     * Comma-joined isolated subnet IDs (no internet egress). RDS
+     * instances live here when `dataSafety='strict'` is in effect on
+     * presets that ship isolated subnets (medium+).
+     */
+    readonly isolatedSubnetIds: (project: string, stage: string) => string;
+    /**
+     * Comma-joined Availability Zone names matching the order of the
+     * subnet ID lists above. CDK's `Vpc.fromVpcAttributes` requires
+     * per-subnet AZ to fully reconstruct the VPC abstraction in a
+     * consumer stack, and CFN won't infer it from the subnet IDs alone.
+     */
+    readonly availabilityZones: (project: string, stage: string) => string;
+};
+export declare const dataKeys: {
+    /**
+     * RDS endpoint hostname (no port, no protocol). The port is fixed
+     * per engine type, so consumers reconstruct the JDBC URL from
+     * `engine` + `endpoint` + `port` rather than storing the assembled
+     * URL — keeps reads composable and avoids re-writing on engine
+     * upgrades.
+     */
+    readonly rdsEndpoint: (project: string, stage: string, dbId: string) => string;
+    /** RDS port. Stored explicitly so consumers don't hardcode 5432/3306. */
+    readonly rdsPort: (project: string, stage: string, dbId: string) => string;
+    /**
+     * ARN of the Secrets Manager secret holding `{username,password}`
+     * for the master credentials. Lambdas in the app stack receive this
+     * via env var and call `GetSecretValue` at startup; a future
+     * `connect()` helper will resolve the cached secret to a Postgres
+     * URL transparently.
+     */
+    readonly rdsSecretArn: (project: string, stage: string, dbId: string) => string;
+    /**
+     * Security Group ID for the RDS instance. The app stack creates its
+     * own Lambda SG locally and `rdsSg.connections.allowFrom(lambdaSg,
+     * port)`. CFN emits the resulting `AWS::EC2::SecurityGroupIngress`
+     * in the app stack — on app-stack delete, ingress is removed,
+     * RDS SG unaffected (see plan §6.1).
+     */
+    readonly rdsSecurityGroupId: (project: string, stage: string, dbId: string) => string;
+    /** Database name created on the RDS instance (the actual SQL database). */
+    readonly rdsDatabaseName: (project: string, stage: string, dbId: string) => string;
+    /** S3 bucket name for an operator-declared storage intent. */
+    readonly bucketName: (project: string, stage: string, bucketId: string) => string;
+    /** S3 bucket ARN — for IAM scoping on the consumer side. */
+    readonly bucketArn: (project: string, stage: string, bucketId: string) => string;
+    /**
+     * CloudFront distribution domain (e.g. `d111111abcdef8.cloudfront.net`)
+     * — only present when the storage intent set `cdn: true`. Consumers
+     * inject as `STORAGE_<ID>_CDN_URL` for presign-then-rewrite flows.
+     */
+    readonly cdnDomain: (project: string, stage: string, bucketId: string) => string;
+    /** DynamoDB table name (user-declared on free-tier OR rate-limits). */
+    readonly dynamoTableName: (project: string, stage: string, tableId: string) => string;
+    /** DynamoDB table ARN — for IAM scoping. */
+    readonly dynamoTableArn: (project: string, stage: string, tableId: string) => string;
+    /**
+     * ARN of the internal HMAC secret used by VentureKit auth/runtime
+     * for state-token signing. Singleton per project+stage.
+     */
+    readonly internalHmacSecretArn: (project: string, stage: string) => string;
+    /**
+     * ElastiCache primary endpoint when a `caches` intent is declared.
+     * Currently keyed by `cacheId`; only one is typical but the keyed
+     * form keeps us forward-compatible with multi-cache setups.
+     */
+    readonly cacheEndpoint: (project: string, stage: string, cacheId: string) => string;
+    /** ElastiCache port. Same rationale as `rdsPort`. */
+    readonly cachePort: (project: string, stage: string, cacheId: string) => string;
+    /** ElastiCache security group ID — for the cross-stack ingress pattern. */
+    readonly cacheSecurityGroupId: (project: string, stage: string, cacheId: string) => string;
+};
+export declare const identityKeys: {
+    /** Cognito User Pool ID for an `auth` intent. */
+    readonly userPoolId: (project: string, stage: string, authId: string) => string;
+    /** Cognito User Pool ARN — for IAM scoping `cognito-idp:Admin*` actions. */
+    readonly userPoolArn: (project: string, stage: string, authId: string) => string;
+    /**
+     * Primary App Client ID. Multi-client support exists in the intent
+     * (auth.clients[]) but the dominant case is a single SPA client;
+     * we publish the primary id as a singleton key to avoid the
+     * multi-client SSM tax for the common case. Future per-client keys
+     * can extend this convention with `${authId}/clients/${clientName}`.
+     */
+    readonly primaryClientId: (project: string, stage: string, authId: string) => string;
+    /**
+     * ARN of the Secrets Manager secret holding `{clientId, clientSecret}`
+     * for a federated identity provider (Google / Facebook / Apple).
+     * Created by `createAuth` for every entry in
+     * `AuthIntent.federated[]`; the app stack reads it to enable
+     * `signInAsFederatedUser` server-side.
+     */
+    readonly federatedSecretArn: (project: string, stage: string, authId: string, provider: string) => string;
+};
+export declare const configKeys: {
+    /**
+     * ARN of an operator-declared `secrets` intent (Secrets Manager
+     * variant). The SSM-store variant of the intent is *itself* an SSM
+     * parameter and doesn't need a separate cross-stack key — the app
+     * stack reads the original parameter directly.
+     */
+    readonly secretArn: (project: string, stage: string, secretId: string) => string;
+    /**
+     * SNS events topic ARN for a `notify` intent. The bounce-handler
+     * Lambda in the app stack subscribes to this; operators may attach
+     * additional console-level subscribers for paging / observability.
+     */
+    readonly notifyEventsTopicArn: (project: string, stage: string, notifyId: string) => string;
+    /** Notify SES configuration set name — needed by the dispatcher Lambda. */
+    readonly notifyConfigurationSetName: (project: string, stage: string, notifyId: string) => string;
+    /**
+     * ARN of the WhatsApp Cloud API token Secret (only present when the
+     * notify intent declares `'whatsapp'` in `channels`). Operator
+     * pastes the Meta token into the secret value after first deploy.
+     */
+    readonly whatsappTokenSecretArn: (project: string, stage: string, notifyId: string) => string;
+};
+export declare const messagingKeys: {
+    /** SQS queue ARN for a user-declared `queues` intent. */
+    readonly queueArn: (project: string, stage: string, queueId: string) => string;
+    /** SQS queue URL — what `SendMessage` callers actually need. */
+    readonly queueUrl: (project: string, stage: string, queueId: string) => string;
+    /** Dead-letter queue ARN — for IAM scoping + ESM redrive policy. */
+    readonly queueDlqArn: (project: string, stage: string, queueId: string) => string;
+    /**
+     * Visibility timeout (seconds, integer) of the primary work queue.
+     * App-stack synth uses this to validate the
+     * `queue.visibilityTimeout >= 6 * fn.timeout` invariant when the
+     * queue lives in another stack and CDK can't infer it (plan §6.3).
+     */
+    readonly queueVisibilityTimeoutSeconds: (project: string, stage: string, queueId: string) => string;
+    /** Notify dispatcher DLQ ARN — created by the messaging tier. */
+    readonly notifyDispatcherDlqArn: (project: string, stage: string, notifyId: string) => string;
+    /** Notify bounce-handler DLQ ARN. */
+    readonly notifyBounceDlqArn: (project: string, stage: string, notifyId: string) => string;
+};
+export declare const edgeKeys: {
+    /** API Gateway HttpApi ID. Singleton per stack-set. */
+    readonly apiId: (project: string, stage: string) => string;
+    /**
+     * API Gateway public endpoint (`https://<id>.execute-api.<region>.amazonaws.com`).
+     * Convenience for monitoring + smoke tests; consumers that need
+     * just the ID use `apiId` above.
+     */
+    readonly apiEndpoint: (project: string, stage: string) => string;
+    /**
+     * Custom domain hostname (e.g. `api.example.com`). Only present
+     * when a `domains` intent is declared. Consumers that build OAuth
+     * redirect URIs / webhook URLs should prefer this when set.
+     */
+    readonly apiCustomDomain: (project: string, stage: string) => string;
+    /**
+     * API Gateway default stage name. Always `'$default'` for HttpApi
+     * but published explicitly so future support for named stages
+     * (canary, blue/green) doesn't require a key-shape change.
+     */
+    readonly apiDefaultStageName: (project: string, stage: string) => string;
+    /**
+     * CloudFront distribution domain (`*.cloudfront.net` or the
+     * configured alias) fronting a storage-tier S3 bucket. Only
+     * present when the `storage` intent declares `cdn: true`. App-
+     * stack code injects this into Lambda env vars as
+     * `STORAGE_<UPPER_ID>_CDN_URL` and `VENTURE_STORAGE_CDN_URL`
+     * (primary intent), so application code can build public URLs
+     * without an SDK lookup.
+     */
+    readonly storageCdnDomain: (project: string, stage: string, storageId: string) => string;
+    /**
+     * CloudFront distribution ID for a storage-tier bucket CDN. App-
+     * stack handlers that need to issue invalidations
+     * (`CreateInvalidation` after a content rewrite) read this.
+     */
+    readonly storageCdnDistributionId: (project: string, stage: string, storageId: string) => string;
+};
+/**
+ * Single namespace exporting every category for ergonomic imports
+ * elsewhere: `import { ssmKeys } from './shared/ssm-keys.js';
+ * ssmKeys.data.rdsEndpoint(project, stage, 'main')`.
+ */
+export declare const ssmKeys: {
+    readonly network: {
+        readonly vpcId: (project: string, stage: string) => string;
+        /**
+         * Comma-joined private subnet IDs (subnets where Lambdas + RDS run).
+         * Stored as a single comma-joined `String` because CFN's
+         * `{{resolve:ssm:…}}` dynamic reference does not support
+         * `StringList` parameters. `readSsmStringList` in
+         * `cross-stack-refs.ts` re-splits on the consumer side.
+         */
+        readonly privateSubnetIds: (project: string, stage: string) => string;
+        /** Comma-joined public subnet IDs — used by NAT GW + (future) ALB. */
+        readonly publicSubnetIds: (project: string, stage: string) => string;
+        /**
+         * Comma-joined isolated subnet IDs (no internet egress). RDS
+         * instances live here when `dataSafety='strict'` is in effect on
+         * presets that ship isolated subnets (medium+).
+         */
+        readonly isolatedSubnetIds: (project: string, stage: string) => string;
+        /**
+         * Comma-joined Availability Zone names matching the order of the
+         * subnet ID lists above. CDK's `Vpc.fromVpcAttributes` requires
+         * per-subnet AZ to fully reconstruct the VPC abstraction in a
+         * consumer stack, and CFN won't infer it from the subnet IDs alone.
+         */
+        readonly availabilityZones: (project: string, stage: string) => string;
+    };
+    readonly data: {
+        /**
+         * RDS endpoint hostname (no port, no protocol). The port is fixed
+         * per engine type, so consumers reconstruct the JDBC URL from
+         * `engine` + `endpoint` + `port` rather than storing the assembled
+         * URL — keeps reads composable and avoids re-writing on engine
+         * upgrades.
+         */
+        readonly rdsEndpoint: (project: string, stage: string, dbId: string) => string;
+        /** RDS port. Stored explicitly so consumers don't hardcode 5432/3306. */
+        readonly rdsPort: (project: string, stage: string, dbId: string) => string;
+        /**
+         * ARN of the Secrets Manager secret holding `{username,password}`
+         * for the master credentials. Lambdas in the app stack receive this
+         * via env var and call `GetSecretValue` at startup; a future
+         * `connect()` helper will resolve the cached secret to a Postgres
+         * URL transparently.
+         */
+        readonly rdsSecretArn: (project: string, stage: string, dbId: string) => string;
+        /**
+         * Security Group ID for the RDS instance. The app stack creates its
+         * own Lambda SG locally and `rdsSg.connections.allowFrom(lambdaSg,
+         * port)`. CFN emits the resulting `AWS::EC2::SecurityGroupIngress`
+         * in the app stack — on app-stack delete, ingress is removed,
+         * RDS SG unaffected (see plan §6.1).
+         */
+        readonly rdsSecurityGroupId: (project: string, stage: string, dbId: string) => string;
+        /** Database name created on the RDS instance (the actual SQL database). */
+        readonly rdsDatabaseName: (project: string, stage: string, dbId: string) => string;
+        /** S3 bucket name for an operator-declared storage intent. */
+        readonly bucketName: (project: string, stage: string, bucketId: string) => string;
+        /** S3 bucket ARN — for IAM scoping on the consumer side. */
+        readonly bucketArn: (project: string, stage: string, bucketId: string) => string;
+        /**
+         * CloudFront distribution domain (e.g. `d111111abcdef8.cloudfront.net`)
+         * — only present when the storage intent set `cdn: true`. Consumers
+         * inject as `STORAGE_<ID>_CDN_URL` for presign-then-rewrite flows.
+         */
+        readonly cdnDomain: (project: string, stage: string, bucketId: string) => string;
+        /** DynamoDB table name (user-declared on free-tier OR rate-limits). */
+        readonly dynamoTableName: (project: string, stage: string, tableId: string) => string;
+        /** DynamoDB table ARN — for IAM scoping. */
+        readonly dynamoTableArn: (project: string, stage: string, tableId: string) => string;
+        /**
+         * ARN of the internal HMAC secret used by VentureKit auth/runtime
+         * for state-token signing. Singleton per project+stage.
+         */
+        readonly internalHmacSecretArn: (project: string, stage: string) => string;
+        /**
+         * ElastiCache primary endpoint when a `caches` intent is declared.
+         * Currently keyed by `cacheId`; only one is typical but the keyed
+         * form keeps us forward-compatible with multi-cache setups.
+         */
+        readonly cacheEndpoint: (project: string, stage: string, cacheId: string) => string;
+        /** ElastiCache port. Same rationale as `rdsPort`. */
+        readonly cachePort: (project: string, stage: string, cacheId: string) => string;
+        /** ElastiCache security group ID — for the cross-stack ingress pattern. */
+        readonly cacheSecurityGroupId: (project: string, stage: string, cacheId: string) => string;
+    };
+    readonly identity: {
+        /** Cognito User Pool ID for an `auth` intent. */
+        readonly userPoolId: (project: string, stage: string, authId: string) => string;
+        /** Cognito User Pool ARN — for IAM scoping `cognito-idp:Admin*` actions. */
+        readonly userPoolArn: (project: string, stage: string, authId: string) => string;
+        /**
+         * Primary App Client ID. Multi-client support exists in the intent
+         * (auth.clients[]) but the dominant case is a single SPA client;
+         * we publish the primary id as a singleton key to avoid the
+         * multi-client SSM tax for the common case. Future per-client keys
+         * can extend this convention with `${authId}/clients/${clientName}`.
+         */
+        readonly primaryClientId: (project: string, stage: string, authId: string) => string;
+        /**
+         * ARN of the Secrets Manager secret holding `{clientId, clientSecret}`
+         * for a federated identity provider (Google / Facebook / Apple).
+         * Created by `createAuth` for every entry in
+         * `AuthIntent.federated[]`; the app stack reads it to enable
+         * `signInAsFederatedUser` server-side.
+         */
+        readonly federatedSecretArn: (project: string, stage: string, authId: string, provider: string) => string;
+    };
+    readonly config: {
+        /**
+         * ARN of an operator-declared `secrets` intent (Secrets Manager
+         * variant). The SSM-store variant of the intent is *itself* an SSM
+         * parameter and doesn't need a separate cross-stack key — the app
+         * stack reads the original parameter directly.
+         */
+        readonly secretArn: (project: string, stage: string, secretId: string) => string;
+        /**
+         * SNS events topic ARN for a `notify` intent. The bounce-handler
+         * Lambda in the app stack subscribes to this; operators may attach
+         * additional console-level subscribers for paging / observability.
+         */
+        readonly notifyEventsTopicArn: (project: string, stage: string, notifyId: string) => string;
+        /** Notify SES configuration set name — needed by the dispatcher Lambda. */
+        readonly notifyConfigurationSetName: (project: string, stage: string, notifyId: string) => string;
+        /**
+         * ARN of the WhatsApp Cloud API token Secret (only present when the
+         * notify intent declares `'whatsapp'` in `channels`). Operator
+         * pastes the Meta token into the secret value after first deploy.
+         */
+        readonly whatsappTokenSecretArn: (project: string, stage: string, notifyId: string) => string;
+    };
+    readonly messaging: {
+        /** SQS queue ARN for a user-declared `queues` intent. */
+        readonly queueArn: (project: string, stage: string, queueId: string) => string;
+        /** SQS queue URL — what `SendMessage` callers actually need. */
+        readonly queueUrl: (project: string, stage: string, queueId: string) => string;
+        /** Dead-letter queue ARN — for IAM scoping + ESM redrive policy. */
+        readonly queueDlqArn: (project: string, stage: string, queueId: string) => string;
+        /**
+         * Visibility timeout (seconds, integer) of the primary work queue.
+         * App-stack synth uses this to validate the
+         * `queue.visibilityTimeout >= 6 * fn.timeout` invariant when the
+         * queue lives in another stack and CDK can't infer it (plan §6.3).
+         */
+        readonly queueVisibilityTimeoutSeconds: (project: string, stage: string, queueId: string) => string;
+        /** Notify dispatcher DLQ ARN — created by the messaging tier. */
+        readonly notifyDispatcherDlqArn: (project: string, stage: string, notifyId: string) => string;
+        /** Notify bounce-handler DLQ ARN. */
+        readonly notifyBounceDlqArn: (project: string, stage: string, notifyId: string) => string;
+    };
+    readonly edge: {
+        /** API Gateway HttpApi ID. Singleton per stack-set. */
+        readonly apiId: (project: string, stage: string) => string;
+        /**
+         * API Gateway public endpoint (`https://<id>.execute-api.<region>.amazonaws.com`).
+         * Convenience for monitoring + smoke tests; consumers that need
+         * just the ID use `apiId` above.
+         */
+        readonly apiEndpoint: (project: string, stage: string) => string;
+        /**
+         * Custom domain hostname (e.g. `api.example.com`). Only present
+         * when a `domains` intent is declared. Consumers that build OAuth
+         * redirect URIs / webhook URLs should prefer this when set.
+         */
+        readonly apiCustomDomain: (project: string, stage: string) => string;
+        /**
+         * API Gateway default stage name. Always `'$default'` for HttpApi
+         * but published explicitly so future support for named stages
+         * (canary, blue/green) doesn't require a key-shape change.
+         */
+        readonly apiDefaultStageName: (project: string, stage: string) => string;
+        /**
+         * CloudFront distribution domain (`*.cloudfront.net` or the
+         * configured alias) fronting a storage-tier S3 bucket. Only
+         * present when the `storage` intent declares `cdn: true`. App-
+         * stack code injects this into Lambda env vars as
+         * `STORAGE_<UPPER_ID>_CDN_URL` and `VENTURE_STORAGE_CDN_URL`
+         * (primary intent), so application code can build public URLs
+         * without an SDK lookup.
+         */
+        readonly storageCdnDomain: (project: string, stage: string, storageId: string) => string;
+        /**
+         * CloudFront distribution ID for a storage-tier bucket CDN. App-
+         * stack handlers that need to issue invalidations
+         * (`CreateInvalidation` after a content rewrite) read this.
+         */
+        readonly storageCdnDistributionId: (project: string, stage: string, storageId: string) => string;
+    };
+};
+export type SsmKeys = typeof ssmKeys;
+//# sourceMappingURL=ssm-keys.d.ts.map

package/dist/cdk/shared/ssm-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm-keys.d.ts","sourceRoot":"","sources":["../../../src/cdk/shared/ssm-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAYH;;;;GAIG;AACH,eAAO,MAAM,WAAW;8BACL,MAAM,SAAS,MAAM,KAAG,MAAM;IAG/C;;;;;;OAMG;yCACyB,MAAM,SAAS,MAAM,KAAG,MAAM;IAG1D,sEAAsE;wCAC3C,MAAM,SAAS,MAAM,KAAG,MAAM;IAGzD;;;;OAIG;0CAC0B,MAAM,SAAS,MAAM,KAAG,MAAM;IAG3D;;;;;OAKG;0CAC0B,MAAM,SAAS,MAAM,KAAG,MAAM;CAEnD,CAAC;AAIX,eAAO,MAAM,QAAQ;IACnB;;;;;;OAMG;oCACoB,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;IAGnE,yEAAyE;gCACtD,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;IAG/D;;;;;;OAMG;qCACqB,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;IAGpE;;;;;;OAMG;2CAC2B,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;IAG1E,2EAA2E;wCAChD,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;IAGvE,8DAA8D;mCACxC,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGtE,4DAA4D;kCACvC,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGrE;;;;OAIG;kCACkB,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGrE,uEAAuE;wCAC5C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAG1E,4CAA4C;uCAClB,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGzE;;;OAGG;8CAC8B,MAAM,SAAS,MAAM,KAAG,MAAM;IAG/D;;;;OAIG;sCACsB,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGxE,qDAAqD;kCAChC,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGpE,2EAA2E;6CAC3C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;CAEvE,CAAC;AAIX,eAAO,MAAM,YAAY;IACvB,iDAAiD;mCAC3B,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,MAAM;IAGpE,4EAA4E;oCACrD,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,MAAM;IAGrE;;;;;;OAMG;wCACwB,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,MAAM;IAGzE;;;;;;OAMG;2CAEQ,MAAM,SACR,MAAM,UACL,MAAM,YACJ,MAAM,KACf,MAAM;CAED,CAAC;AAIX,eAAO,MAAM,UAAU;IACrB;;;;;OAKG;kCACkB,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGrE;;;;OAIG;6CAC6B,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGhF,2EAA2E;mDACrC,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGtF;;;;OAIG;+CAC+B,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;CAE1E,CAAC;AAIX,eAAO,MAAM,aAAa;IACxB,yDAAyD;iCACrC,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGnE,gEAAgE;iCAC5C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGnE,oEAAoE;oCAC7C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGtE;;;;;OAKG;sDACsC,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;IAGxF,iEAAiE;+CAC/B,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;IAGlF,qCAAqC;2CACP,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;CAEtE,CAAC;AAIX,eAAO,MAAM,QAAQ;IACnB,uDAAuD;8BACtC,MAAM,SAAS,MAAM,KAAG,MAAM;IAG/C;;;;OAIG;oCACoB,MAAM,SAAS,MAAM,KAAG,MAAM;IAGrD;;;;OAIG;wCACwB,MAAM,SAAS,MAAM,KAAG,MAAM;IAGzD;;;;OAIG;4CAC4B,MAAM,SAAS,MAAM,KAAG,MAAM;IAG7D;;;;;;;;OAQG;yCACyB,MAAM,SAAS,MAAM,aAAa,MAAM,KAAG,MAAM;IAG7E;;;;OAIG;iDACiC,MAAM,SAAS,MAAM,aAAa,MAAM,KAAG,MAAM;CAE7E,CAAC;AAIX;;;;GAIG;AACH,eAAO,MAAM,OAAO;;kCA9RD,MAAM,SAAS,MAAM,KAAG,MAAM;QAG/C;;;;;;WAMG;6CACyB,MAAM,SAAS,MAAM,KAAG,MAAM;QAG1D,sEAAsE;4CAC3C,MAAM,SAAS,MAAM,KAAG,MAAM;QAGzD;;;;WAIG;8CAC0B,MAAM,SAAS,MAAM,KAAG,MAAM;QAG3D;;;;;WAKG;8CAC0B,MAAM,SAAS,MAAM,KAAG,MAAM;;;QAO3D;;;;;;WAMG;wCACoB,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;QAGnE,yEAAyE;oCACtD,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;QAG/D;;;;;;WAMG;yCACqB,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;QAGpE;;;;;;WAMG;+CAC2B,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;QAG1E,2EAA2E;4CAChD,MAAM,SAAS,MAAM,QAAQ,MAAM,KAAG,MAAM;QAGvE,8DAA8D;uCACxC,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGtE,4DAA4D;sCACvC,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGrE;;;;WAIG;sCACkB,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGrE,uEAAuE;4CAC5C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAG1E,4CAA4C;2CAClB,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGzE;;;WAGG;kDAC8B,MAAM,SAAS,MAAM,KAAG,MAAM;QAG/D;;;;WAIG;0CACsB,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGxE,qDAAqD;sCAChC,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGpE,2EAA2E;iDAC3C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;;;QAO/E,iDAAiD;uCAC3B,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,MAAM;QAGpE,4EAA4E;wCACrD,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,MAAM;QAGrE;;;;;;WAMG;4CACwB,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,MAAM;QAGzE;;;;;;WAMG;+CAEQ,MAAM,SACR,MAAM,UACL,MAAM,YACJ,MAAM,KACf,MAAM;;;QAOT;;;;;WAKG;sCACkB,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGrE;;;;WAIG;iDAC6B,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGhF,2EAA2E;uDACrC,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGtF;;;;WAIG;mDAC+B,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;;;QAOlF,yDAAyD;qCACrC,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGnE,gEAAgE;qCAC5C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGnE,oEAAoE;wCAC7C,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGtE;;;;;WAKG;0DACsC,MAAM,SAAS,MAAM,WAAW,MAAM,KAAG,MAAM;QAGxF,iEAAiE;mDAC/B,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;QAGlF,qCAAqC;+CACP,MAAM,SAAS,MAAM,YAAY,MAAM,KAAG,MAAM;;;QAO9E,uDAAuD;kCACtC,MAAM,SAAS,MAAM,KAAG,MAAM;QAG/C;;;;WAIG;wCACoB,MAAM,SAAS,MAAM,KAAG,MAAM;QAGrD;;;;WAIG;4CACwB,MAAM,SAAS,MAAM,KAAG,MAAM;QAGzD;;;;WAIG;gDAC4B,MAAM,SAAS,MAAM,KAAG,MAAM;QAG7D;;;;;;;;WAQG;6CACyB,MAAM,SAAS,MAAM,aAAa,MAAM,KAAG,MAAM;QAG7E;;;;WAIG;qDACiC,MAAM,SAAS,MAAM,aAAa,MAAM,KAAG,MAAM;;CAkB7E,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC"}