@vibesdotdev/integrations-digitalocean 0.0.0-stage → 1.0.0-rc.2

package/dist/secrets/doks-secret.impl.js

@@ -0,0 +1,451 @@
+/**
+ * `secrets/store` backed by a Kubernetes Secret on a DOKS cluster.
+ *
+ * `vault-secrets-operator` was installed on `exemplar-staging` to do exactly
+ * this and, measured 2026-09-08, held **zero** CRs across every namespace — a
+ * Vault, an injector and an operator running for 383 days, delivering nothing.
+ * Meanwhile the two realm federators got their signing keys by hand, and the
+ * key the manifests claimed came from `vibes secrets` had never been in the
+ * store at all.
+ *
+ * So the delivery step becomes a backend: `vibes secrets push --backend
+ * doks-secret` writes the store's values into a Kubernetes Secret that
+ * workloads read with an ordinary `secretKeyRef`. No operator, no second
+ * source of truth, no CRD.
+ *
+ * Values are never logged, returned in an error, or placed in argv. Kubernetes
+ * Secrets carry them to workloads; build jobs can read registry credentials from
+ * their mounted `.npmrc` or `.bunfig.toml` files.
+ */
+import { decodeBase64Text, encodeBase64Text } from "../kubernetes/encoding.js";
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { loadDigitalOceanServiceSettings } from "../config/digitalocean.config.descriptor.js";
+import { DigitalOceanDoksDockerConfigSchema, DigitalOceanDoksSourceCredentialRequestSchema, DigitalOceanDoksWorkerCredentialLeaseSchema, DigitalOceanDoksWorkerSourceOperationAnnotationsSchema, DigitalOceanDoksWorkerPlanSchema } from "../schemas/doks-worker.js";
+import { KubernetesIssuedSchema, KubernetesLeaseSecretSchema } from "../schemas/kubernetes-responses.js";
+import { bindDigitalOceanDoksWorkerCredentialLease } from "../schemas/doks-worker.js";
+import { DoksSecretConfigSchema, KubernetesSecretDataSchema } from "../schemas/kubernetes.js";
+import { getLogger } from '@vibesdotdev/logging';
+import { DOKS_SECRET_STORE_ACCESS } from "./doks-secret.descriptor.js";
+import { DigitalOceanKubernetesClient } from "../kubernetes/index.js";
+import { createKubernetesApi } from "../kubernetes/authority.js";
+import { createDigitalOceanProviderControlPlaneClient } from "../infra/credentials.js";
+/** Kubernetes Secret data keys are restricted; a vibes key that cannot be one is a hard error. */
+const SECRET_DATA_KEY_PATTERN = /^[-._a-zA-Z0-9]+$/;
+function assertDataKey(key) {
+    if (!SECRET_DATA_KEY_PATTERN.test(key)) {
+        throw new Error(`Secret key "${key}" cannot be a Kubernetes Secret data key ` +
+            '(allowed: letters, digits, "-", "_", ".").');
+    }
+}
+export function createDoksSecretStore(runtime, descriptor, options) {
+    const config = DoksSecretConfigSchema.parse(descriptor.config ?? {});
+    const diagnostics = getLogger('digitalocean.doks-secret', runtime);
+    const secretName = config.secretName;
+    let apiPromise;
+    function namespaceFor(environment) {
+        const namespace = config[`namespace.${environment}`] ?? config.namespace;
+        if (!namespace) {
+            throw new Error(`The ${descriptor.id} backend has no namespace for environment "${environment}". ` +
+                'Set `config.namespace`, or `config["namespace.' +
+                environment +
+                '"]`.');
+        }
+        return namespace;
+    }
+    async function api(operationContext) {
+        if (options?.api)
+            return options.api;
+        if (!apiPromise) {
+            const pending = (async () => {
+                const controlPlane = await createDigitalOceanProviderControlPlaneClient(runtime, undefined, operationContext);
+                return createKubernetesApi({
+                    runtime,
+                    kubernetes: new DigitalOceanKubernetesClient(controlPlane),
+                    cluster: { id: config.clusterId, name: config.clusterName }
+                });
+            })();
+            apiPromise = pending;
+            try {
+                return await pending;
+            }
+            catch (cause) {
+                if (apiPromise === pending)
+                    apiPromise = undefined;
+                throw cause;
+            }
+        }
+        return apiPromise;
+    }
+    /**
+     * A connection whose cluster authority is acquired on the first request.
+     * Credential delivery admits a plan against the declared cluster and
+     * namespace before any authority is fetched, so a plan aimed at a target
+     * this store does not serve is refused without touching the cluster.
+     */
+    function lazyApi(operationContext) {
+        let opened;
+        return {
+            cluster: { id: config.clusterId ?? '', name: config.clusterName ?? '' },
+            request(path, init, allowNotFound) {
+                opened ??= api(operationContext);
+                return opened.then((connection) => connection.request(path, init, allowNotFound));
+            }
+        };
+    }
+    function secretPath(namespace) {
+        return namedSecretPath(namespace, secretName);
+    }
+    function namedSecretPath(namespace, name) {
+        return `/api/v1/namespaces/${encodeURIComponent(namespace)}/secrets/${encodeURIComponent(name)}`;
+    }
+    /** `null` when the Secret does not exist yet — an empty environment, not a failure. */
+    async function readData(environment, operationContext) {
+        const namespace = namespaceFor(environment);
+        const connection = await api(operationContext);
+        const response = await connection.request(secretPath(namespace), { method: 'GET' }, true);
+        if (!response)
+            return null;
+        const body = KubernetesSecretDataSchema.parse(await response.json());
+        const decoded = {};
+        for (const [key, value] of Object.entries(body.data ?? {})) {
+            decoded[key] = decodeBase64Text(value);
+        }
+        return decoded;
+    }
+    /**
+     * Merge-patch the Secret, creating it first if absent. A `null` value in the
+     * patch removes that key, which is how `unset` works.
+     */
+    async function writeData(environment, patch, operationContext) {
+        const namespace = namespaceFor(environment);
+        const connection = await api(operationContext);
+        const existing = await connection.request(secretPath(namespace), { method: 'GET' }, true);
+        if (!existing) {
+            await connection.request(`/api/v1/namespaces/${encodeURIComponent(namespace)}/secrets`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    apiVersion: 'v1',
+                    kind: 'Secret',
+                    type: 'Opaque',
+                    metadata: {
+                        name: secretName,
+                        namespace,
+                        labels: { 'app.kubernetes.io/managed-by': 'vibes-secrets' },
+                        annotations: { 'vibes.dev/secrets-environment': environment }
+                    },
+                    stringData: Object.fromEntries(Object.entries(patch).filter((entry) => entry[1] !== null))
+                })
+            });
+            return;
+        }
+        await connection.request(secretPath(namespace), {
+            method: 'PATCH',
+            headers: { 'content-type': 'application/merge-patch+json' },
+            body: JSON.stringify({
+                metadata: {
+                    labels: { 'app.kubernetes.io/managed-by': 'vibes-secrets' },
+                    annotations: { 'vibes.dev/secrets-environment': environment }
+                },
+                stringData: Object.fromEntries(Object.entries(patch).filter((entry) => entry[1] !== null)),
+                // `stringData` cannot express a removal; `data: {key: null}` can.
+                data: Object.fromEntries(Object.entries(patch).filter(([, value]) => value === null))
+            })
+        });
+    }
+    function assertWorkerTarget(plan) {
+        let namespace;
+        try {
+            namespace = namespaceFor(plan.worker);
+        }
+        catch (cause) {
+            throw new CapabilityError('DOKS worker credential namespace is not configured by the selected Secrets descriptor.', 'INVALID_INPUT', { reason: 'doks-worker-secret-target-unconfigured', cause });
+        }
+        // A cluster is named by exactly one of id or name on each side; compare
+        // the identity each side actually declares rather than requiring both.
+        const clusterMatches = plan.cluster.id !== undefined
+            ? plan.cluster.id === config.clusterId
+            : plan.cluster.name === config.clusterName;
+        if (!clusterMatches || namespace !== plan.namespace) {
+            throw new CapabilityError('DOKS worker credential target does not match the selected Secrets descriptor.', 'INVALID_INPUT', { reason: 'doks-worker-secret-target-diverged' });
+        }
+    }
+    async function admitWorkerCredentials(input) {
+        const plan = DigitalOceanDoksWorkerPlanSchema.parse(input);
+        assertWorkerTarget(plan);
+    }
+    async function resolveCredential(authority) {
+        const result = await runtime.resolveCredential({ source: 'secret', ...authority });
+        if (!result.ok)
+            throw result.error;
+        return result.value;
+    }
+    async function writeCredentialSecret(namespace, name, key, value, annotations) {
+        assertDataKey(key);
+        const connection = lazyApi();
+        const query = new URLSearchParams({ fieldManager: 'vibes-secrets', force: 'false' });
+        const labels = { 'app.kubernetes.io/managed-by': 'vibes-secrets' };
+        const metadata = annotations
+            ? { name, namespace, labels, annotations }
+            : { name, namespace, labels };
+        const path = namedSecretPath(namespace, name);
+        await connection.request(`${path}?${query}`, {
+            method: 'PATCH',
+            headers: {
+                'content-type': 'application/apply-patch+yaml',
+                accept: 'application/json'
+            },
+            body: JSON.stringify({
+                apiVersion: 'v1',
+                kind: 'Secret',
+                type: 'Opaque',
+                metadata,
+                data: { [key]: encodeBase64Text(value) }
+            })
+        });
+        const response = await connection.request(path, { method: 'GET', headers: { accept: 'application/json' } }, true);
+        if (!response) {
+            throw new CapabilityError(`DOKS worker prerequisite Secret ${namespace}/${name} was not found.`, 'UNAVAILABLE', { reason: 'doks-worker-secret-not-found' });
+        }
+        const secret = KubernetesLeaseSecretSchema.parse(await response.json());
+        if (!(key in (secret.data ?? {}))) {
+            throw new CapabilityError(`DOKS worker prerequisite Secret ${namespace}/${name} is missing keys [${key}].`, 'UNAVAILABLE', { reason: 'doks-worker-secret-key-missing' });
+        }
+        const expectedOperationId = annotations?.['vibes.dev/source-operation-id'];
+        const observedOperationId = secret.metadata?.annotations?.['vibes.dev/source-operation-id'];
+        if (expectedOperationId !== undefined && observedOperationId !== expectedOperationId) {
+            throw new CapabilityError('DOKS source credential Secret belongs to another operation.', 'CONFLICT', { reason: 'doks-worker-secret-operation-diverged' });
+        }
+    }
+    async function revokeSourceLease(lease) {
+        const [brokerResult, secretResult] = await Promise.allSettled([
+            (async () => {
+                const settings = await loadDigitalOceanServiceSettings(runtime);
+                const authority = await resolveCredential(lease.authority);
+                const serviceFetch = runtime.environment.httpFetch?.bind(runtime.environment) ?? fetch;
+                const response = await serviceFetch(`${settings.sourceBrokerOrigin}/api/internal/forge/source-credential`, {
+                    method: 'DELETE',
+                    headers: {
+                        authorization: `Bearer ${authority}`,
+                        'content-type': 'application/json'
+                    },
+                    body: JSON.stringify(DigitalOceanDoksSourceCredentialRequestSchema.parse({
+                        operationId: lease.operationId,
+                        repositoryId: lease.repositoryId,
+                        ref: lease.ref
+                    }))
+                });
+                if (!response.ok && response.status !== 404) {
+                    throw new Error(`Build source credential revocation failed (${response.status}); response body redacted.`);
+                }
+            })(),
+            (async () => {
+                const connection = await api();
+                const path = namedSecretPath(lease.namespace, lease.name);
+                const response = await connection.request(path, { method: 'GET' }, true);
+                if (!response)
+                    return;
+                const secret = KubernetesLeaseSecretSchema.parse(await response.json());
+                if (secret.metadata?.annotations?.['vibes.dev/source-operation-id'] !== lease.operationId) {
+                    throw new CapabilityError('DOKS source credential Secret belongs to another operation.', 'CONFLICT', { reason: 'doks-worker-secret-operation-diverged' });
+                }
+                const uid = secret.metadata?.uid;
+                if (!uid) {
+                    throw new CapabilityError('DOKS source credential Secret cannot be safely removed without its UID.', 'UNAVAILABLE', { reason: 'doks-worker-secret-uid-unavailable' });
+                }
+                await connection.request(path, {
+                    method: 'DELETE',
+                    headers: { 'content-type': 'application/json', accept: 'application/json' },
+                    body: JSON.stringify({ preconditions: { uid } })
+                });
+            })()
+        ]);
+        const failures = [brokerResult, secretResult]
+            .filter((result) => result.status === 'rejected')
+            .map((result) => result.reason);
+        if (failures.length > 0) {
+            throw new CapabilityError('DOKS worker source credential cleanup failed.', 'UNAVAILABLE', {
+                reason: 'doks-worker-credential-revocation-failed',
+                cause: new AggregateError(failures)
+            });
+        }
+    }
+    async function prepareWorkerCredentials(input) {
+        const plan = DigitalOceanDoksWorkerPlanSchema.parse(input);
+        assertWorkerTarget(plan);
+        const bindings = plan.credentialBindings ?? [];
+        if (bindings.length === 0)
+            return plan;
+        const needsServiceSettings = bindings.some((binding) => binding.kind === 'source-lease' || binding.kind === 'package-registry');
+        const settings = needsServiceSettings
+            ? await loadDigitalOceanServiceSettings(runtime)
+            : undefined;
+        const hasRegistryBinding = bindings.some((binding) => binding.kind === 'package-registry');
+        if (hasRegistryBinding && !settings?.packageScope) {
+            throw new CapabilityError('Package registry scope is not configured for DOKS credential delivery.', 'INVALID_INPUT', { reason: 'doks-worker-package-scope-unconfigured' });
+        }
+        const sourceBinding = bindings.find((binding) => binding.kind === 'source-lease');
+        const preparedPlan = sourceBinding
+            ? bindDigitalOceanDoksWorkerCredentialLease(plan, crypto.randomUUID())
+            : plan;
+        const lease = preparedPlan.credentialLease;
+        try {
+            for (const binding of bindings) {
+                let secretName = binding.name;
+                let value;
+                if (binding.kind === 'source-lease') {
+                    if (!lease) {
+                        throw new CapabilityError('DOKS source credential lease was not prepared.', 'INTERNAL', { reason: 'doks-worker-credential-lease-missing' });
+                    }
+                    const authority = await resolveCredential(binding.authority);
+                    const serviceFetch = runtime.environment.httpFetch?.bind(runtime.environment) ?? fetch;
+                    const response = await serviceFetch(`${settings.sourceBrokerOrigin}/api/internal/forge/source-credential`, {
+                        method: 'POST',
+                        headers: {
+                            authorization: `Bearer ${authority}`,
+                            'content-type': 'application/json'
+                        },
+                        body: JSON.stringify(DigitalOceanDoksSourceCredentialRequestSchema.parse({
+                            operationId: lease.operationId,
+                            repositoryId: binding.repositoryId,
+                            ref: binding.ref
+                        }))
+                    });
+                    if (!response.ok) {
+                        throw new Error(`Build source credential issuance failed (${response.status}); response body redacted.`);
+                    }
+                    const issued = KubernetesIssuedSchema.parse(await response.json());
+                    if (!issued.token)
+                        throw new Error('Build source credential issuance returned no token.');
+                    value = issued.token;
+                    secretName = lease.name;
+                }
+                else if (binding.kind === 'docr') {
+                    const client = await createDigitalOceanProviderControlPlaneClient(runtime);
+                    const dockerConfig = await client.get('/registry/docker-credentials', { query: { read_write: 'true', expiry_seconds: binding.expirySeconds } }, DigitalOceanDoksDockerConfigSchema);
+                    value = JSON.stringify(dockerConfig);
+                }
+                else {
+                    const packageScope = settings?.packageScope;
+                    if (!packageScope) {
+                        throw new CapabilityError('Package registry scope is not configured for DOKS credential delivery.', 'INVALID_INPUT', { reason: 'doks-worker-package-scope-unconfigured' });
+                    }
+                    const registryOrigin = settings?.packageRegistryOrigin;
+                    if (!registryOrigin) {
+                        throw new CapabilityError('Package registry origin is not configured for DOKS credential delivery.', 'INVALID_INPUT', { reason: 'doks-worker-package-origin-unconfigured' });
+                    }
+                    const token = await resolveCredential(binding.authority);
+                    if (token.includes('\n') || token.includes('\r')) {
+                        throw new CapabilityError('Package registry credential cannot be rendered safely.', 'INVALID_INPUT', { reason: 'doks-worker-package-credential-invalid' });
+                    }
+                    if (binding.key === '.npmrc') {
+                        value =
+                            `${packageScope}:registry=${registryOrigin}/\n` +
+                                `//${new URL(registryOrigin).host}/:_authToken=${token}\n`;
+                    }
+                    else {
+                        value =
+                            `[install.scopes]\n` +
+                                `${JSON.stringify(packageScope)} = { token = ${JSON.stringify(token)}, url = ${JSON.stringify(`${registryOrigin}/`)} }\n`;
+                    }
+                }
+                const annotations = binding.kind === 'source-lease' && lease
+                    ? DigitalOceanDoksWorkerSourceOperationAnnotationsSchema.parse({
+                        'vibes.dev/source-operation-id': lease.operationId
+                    })
+                    : undefined;
+                await writeCredentialSecret(binding.namespace, secretName, binding.key, value, annotations);
+            }
+            return preparedPlan;
+        }
+        catch (cause) {
+            // The cause travels with the failure the caller receives. The log names
+            // what was attempted and how far it got, never what it held.
+            diagnostics.warn(`DOKS worker credential preparation failed for ${plan.worker} (bindings=${bindings.length}, lease=${lease ? 'issued' : 'none'}).`);
+            const cleanup = lease
+                ? await settle(() => revokeWorkerCredentials(lease))
+                : null;
+            if (cleanup !== null && 'cause' in cleanup) {
+                throw new CapabilityError('DOKS worker credential preparation and cleanup failed.', 'UNAVAILABLE', {
+                    reason: 'doks-worker-credential-prepare-cleanup-failed',
+                    cause: new AggregateError([cause, cleanup.cause])
+                });
+            }
+            throw new CapabilityError('DOKS worker credential preparation failed.', 'UNAVAILABLE', {
+                reason: 'doks-worker-credential-prepare-failed',
+                cause
+            });
+        }
+    }
+    async function revokeWorkerCredentials(input) {
+        const lease = DigitalOceanDoksWorkerCredentialLeaseSchema.parse(input);
+        await revokeSourceLease(lease);
+    }
+    return {
+        id: descriptor.id,
+        descriptor,
+        async list(environment, operationContext) {
+            const data = await readData(environment, operationContext);
+            return Object.entries(data ?? {}).map(([key, value]) => ({
+                key,
+                hasValue: value.length > 0,
+                source: descriptor.id
+            }));
+        },
+        async get(environment, key, operationContext) {
+            const data = await readData(environment, operationContext);
+            return data?.[key];
+        },
+        async set(environment, key, value, operationContext) {
+            assertDataKey(key);
+            await writeData(environment, { [key]: value }, operationContext);
+        },
+        async unset(environment, key, operationContext) {
+            await writeData(environment, { [key]: null }, operationContext);
+        },
+        async getAll(environment, operationContext) {
+            return (await readData(environment, operationContext)) ?? {};
+        },
+        async setAll(environment, secrets, operationContext) {
+            for (const key of Object.keys(secrets))
+                assertDataKey(key);
+            if (Object.keys(secrets).length === 0)
+                return;
+            await writeData(environment, secrets, operationContext);
+        },
+        admitWorkerCredentials,
+        prepareWorkerCredentials,
+        revokeWorkerCredentials
+    };
+}
+export class DigitalOceanDoksSecretRuntimeClient extends BaseRuntimeClient {
+    #store;
+    constructor(descriptor, context) {
+        super(descriptor, context);
+        const storeDescriptor = context.runtime
+            .query('secrets/store')
+            .withId('doks-secret')
+            .descriptors()[0];
+        if (!storeDescriptor) {
+            throw new CapabilityError('The DOKS Secret store descriptor is unavailable.', 'UNAVAILABLE', {
+                reason: 'doks-secret-descriptor-unavailable',
+                retryable: false
+            });
+        }
+        this.#store = createDoksSecretStore(context.runtime, storeDescriptor);
+    }
+    [DOKS_SECRET_STORE_ACCESS]() {
+        return this.#store;
+    }
+    admitWorkerCredentials(plan) {
+        return this.#store.admitWorkerCredentials(plan);
+    }
+    prepareWorkerCredentials(plan) {
+        return this.#store.prepareWorkerCredentials(plan);
+    }
+    revokeWorkerCredentials(lease) {
+        return this.#store.revokeWorkerCredentials(lease);
+    }
+}
+//# sourceMappingURL=doks-secret.impl.js.map

package/dist/secrets/doks-secret.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doks-secret.impl.js","sourceRoot":"","sources":["../../src/secrets/doks-secret.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,EAAuC,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAgC,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EACN,kCAAkC,EAClC,6CAA6C,EAC7C,2CAA2C,EAC3C,sDAAsD,EAEtD,gCAAgC,EAIhC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACzG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAKjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAsB,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,4CAA4C,EAAE,MAAM,yBAAyB,CAAC;AAEvF,kGAAkG;AAClG,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAEpD,SAAS,aAAa,CAAC,GAAW;IACjC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACd,eAAe,GAAG,2CAA2C;YAC5D,4CAA4C,CAC7C,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,OAAqB,EACrB,UAAkC,EAClC,OAAiC;IAEjC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAA8C,CAAC;IAEnD,SAAS,YAAY,CAAC,WAAmB;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,WAAW,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,OAAO,UAAU,CAAC,EAAE,8CAA8C,WAAW,KAAK;gBACjF,gDAAgD;gBAChD,WAAW;gBACX,MAAM,CACP,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,GAAG,CAAC,gBAAwC;QAC1D,IAAI,OAAO,EAAE,GAAG;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC3B,MAAM,YAAY,GAAG,MAAM,4CAA4C,CACtE,OAAO,EACP,SAAS,EACT,gBAAgB,CAChB,CAAC;gBACF,OAAO,mBAAmB,CAAC;oBAC1B,OAAO;oBACP,UAAU,EAAE,IAAI,4BAA4B,CAAC,YAAY,CAAC;oBAC1D,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE;iBAC3D,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;YACL,UAAU,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,OAAO,CAAC;YACtB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,UAAU,KAAK,OAAO;oBAAE,UAAU,GAAG,SAAS,CAAC;gBACnD,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,SAAS,OAAO,CAAC,gBAAwC;QACxD,IAAI,MAA0C,CAAC;QAC/C,OAAO;YACN,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;YACvE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa;gBAChC,MAAM,KAAK,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACjC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YACnF,CAAC;SACD,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,SAAiB;QACpC,OAAO,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,SAAS,eAAe,CAAC,SAAiB,EAAE,IAAY;QACvD,OAAO,sBAAsB,kBAAkB,CAAC,SAAS,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,uFAAuF;IACvF,KAAK,UAAU,QAAQ,CACtB,WAAmB,EACnB,gBAAwC;QAExC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CACxC,UAAU,CAAC,SAAS,CAAC,EACrB,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,IAAI,CACJ,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,SAAS,CACvB,WAAmB,EACnB,KAAoC,EACpC,gBAAwC;QAExC,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,UAAU,CAAC,OAAO,CAAC,sBAAsB,kBAAkB,CAAC,SAAS,CAAC,UAAU,EAAE;gBACvF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE;wBACT,IAAI,EAAE,UAAU;wBAChB,SAAS;wBACT,MAAM,EAAE,EAAE,8BAA8B,EAAE,eAAe,EAAE;wBAC3D,WAAW,EAAE,EAAE,+BAA+B,EAAE,WAAW,EAAE;qBAC7D;oBACD,UAAU,EAAE,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CACrF;iBACD,CAAC;aACF,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,MAAM,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;YAC/C,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,8BAA8B,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ,EAAE;oBACT,MAAM,EAAE,EAAE,8BAA8B,EAAE,eAAe,EAAE;oBAC3D,WAAW,EAAE,EAAE,+BAA+B,EAAE,WAAW,EAAE;iBAC7D;gBACD,UAAU,EAAE,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CACrF;gBACD,kEAAkE;gBAClE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;aACrF,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,kBAAkB,CAAC,IAAgC;QAC3D,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACxB,wFAAwF,EACxF,eAAe,EACf,EAAE,MAAM,EAAE,wCAAwC,EAAE,KAAK,EAAE,CAC3D,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,cAAc,GACnB,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS;YACtC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,cAAc,IAAI,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACxB,+EAA+E,EAC/E,eAAe,EACf,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAChD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,UAAU,sBAAsB,CAAC,KAAiC;QACtE,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC/B,SAA6D;QAE7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,qBAAqB,CACnC,SAAiB,EACjB,IAAY,EACZ,GAAW,EACX,KAAa,EACb,WAA8D;QAE9D,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,EAAE,8BAA8B,EAAE,eAAe,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,WAAW;YAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAE/B,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE;YAC5C,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACR,cAAc,EAAE,8BAA8B;gBAC9C,MAAM,EAAE,kBAAkB;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,UAAU,EAAE,IAAI;gBAChB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ;gBACR,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE;aACxC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CACxC,IAAI,EACJ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAC1D,IAAI,CACJ,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CACxB,mCAAmC,SAAS,IAAI,IAAI,iBAAiB,EACrE,aAAa,EACb,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAC1C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACxB,mCAAmC,SAAS,IAAI,IAAI,qBAAqB,GAAG,IAAI,EAChF,aAAa,EACb,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAC5C,CAAC;QACH,CAAC;QACD,MAAM,mBAAmB,GAAG,WAAW,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,mBAAmB,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAC5F,IAAI,mBAAmB,KAAK,SAAS,IAAI,mBAAmB,KAAK,mBAAmB,EAAE,CAAC;YACtF,MAAM,IAAI,eAAe,CACxB,6DAA6D,EAC7D,UAAU,EACV,EAAE,MAAM,EAAE,uCAAuC,EAAE,CACnD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,KAA4C;QAC5E,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YAC7D,CAAC,KAAK,IAAI,EAAE;gBACX,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;gBACvF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAClC,GAAG,QAAQ,CAAC,kBAAkB,uCAAuC,EACrE;oBACC,MAAM,EAAE,QAAQ;oBACjB,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,SAAS,EAAE;wBACpC,cAAc,EAAE,kBAAkB;qBAClC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CACnB,6CAA6C,CAAC,KAAK,CAAC;wBACnD,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;wBAChC,GAAG,EAAE,KAAK,CAAC,GAAG;qBACd,CAAC,CACF;iBACD,CACD,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CACd,8CAA8C,QAAQ,CAAC,MAAM,4BAA4B,CACzF,CAAC;gBACH,CAAC;YACF,CAAC,CAAC,EAAE;YACJ,CAAC,KAAK,IAAI,EAAE;gBACX,MAAM,UAAU,GAAG,MAAM,GAAG,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;gBACzE,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxE,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,+BAA+B,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;oBAC3F,MAAM,IAAI,eAAe,CACxB,6DAA6D,EAC7D,UAAU,EACV,EAAE,MAAM,EAAE,uCAAuC,EAAE,CACnD,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC;gBACjC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACV,MAAM,IAAI,eAAe,CACxB,yEAAyE,EACzE,aAAa,EACb,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAChD,CAAC;gBACH,CAAC;gBACD,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE;oBAC9B,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;oBAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;iBAChD,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE;SACJ,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;aAC3C,MAAM,CAAC,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC;aACjF,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACxB,+CAA+C,EAC/C,aAAa,EACb;gBACC,MAAM,EAAE,0CAA0C;gBAClD,KAAK,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC;aACnC,CACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,UAAU,wBAAwB,CAAC,KAAiC;QACxE,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,MAAM,oBAAoB,GAAG,QAAQ,CAAC,IAAI,CACzC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,CACnF,CAAC;QACF,MAAM,QAAQ,GAAG,oBAAoB;YACpC,CAAC,CAAC,MAAM,+BAA+B,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACb,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;QAC3F,IAAI,kBAAkB,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,eAAe,CACxB,wEAAwE,EACxE,eAAe,EACf,EAAE,MAAM,EAAE,wCAAwC,EAAE,CACpD,CAAC;QACH,CAAC;QACD,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,aAAa;YACjC,CAAC,CAAC,yCAAyC,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,eAAe,CAAC;QAE3C,IAAI,CAAC;YACJ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAChC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC9B,IAAI,KAAa,CAAC;gBAClB,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACrC,IAAI,CAAC,KAAK,EAAE,CAAC;wBACZ,MAAM,IAAI,eAAe,CACxB,gDAAgD,EAChD,UAAU,EACV,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAClD,CAAC;oBACH,CAAC;oBACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;oBACvF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAClC,GAAG,QAAS,CAAC,kBAAkB,uCAAuC,EACtE;wBACC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACR,aAAa,EAAE,UAAU,SAAS,EAAE;4BACpC,cAAc,EAAE,kBAAkB;yBAClC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CACnB,6CAA6C,CAAC,KAAK,CAAC;4BACnD,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;4BAClC,GAAG,EAAE,OAAO,CAAC,GAAG;yBAChB,CAAC,CACF;qBACD,CACD,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACd,4CAA4C,QAAQ,CAAC,MAAM,4BAA4B,CACvF,CAAC;oBACH,CAAC;oBACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,CAAC,MAAM,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBAC1F,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;oBACrB,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;gBACzB,CAAC;qBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpC,MAAM,MAAM,GAAG,MAAM,4CAA4C,CAAC,OAAO,CAAC,CAAC;oBAC3E,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,CACpC,8BAA8B,EAC9B,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,EACxE,kCAAkC,CAClC,CAAC;oBACF,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBACtC,CAAC;qBAAM,CAAC;oBACP,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,CAAC;oBAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;wBACnB,MAAM,IAAI,eAAe,CACxB,wEAAwE,EACxE,eAAe,EACf,EAAE,MAAM,EAAE,wCAAwC,EAAE,CACpD,CAAC;oBACH,CAAC;oBACD,MAAM,cAAc,GAAG,QAAQ,EAAE,qBAAqB,CAAC;oBACvD,IAAI,CAAC,cAAc,EAAE,CAAC;wBACrB,MAAM,IAAI,eAAe,CACxB,yEAAyE,EACzE,eAAe,EACf,EAAE,MAAM,EAAE,yCAAyC,EAAE,CACrD,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBACzD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,eAAe,CACxB,wDAAwD,EACxD,eAAe,EACf,EAAE,MAAM,EAAE,wCAAwC,EAAE,CACpD,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC9B,KAAK;4BACJ,GAAG,YAAY,aAAa,cAAc,KAAK;gCAC9C,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,gBAAgB,KAAK,IAAI,CAAC;oBAC9D,CAAC;yBAAM,CAAC;wBACP,KAAK;4BACJ,oBAAoB;gCACnB,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,cAAc,GAAG,CAAC,MAAM,CAAC;oBAC7H,CAAC;gBACF,CAAC;gBAED,MAAM,WAAW,GAChB,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK;oBACvC,CAAC,CAAC,sDAAsD,CAAC,KAAK,CAAC;wBAC7D,+BAA+B,EAAE,KAAK,CAAC,WAAW;qBAClD,CAAC;oBACH,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,YAAY,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,wEAAwE;YACxE,6DAA6D;YAC7D,WAAW,CAAC,IAAI,CACf,iDAAiD,IAAI,CAAC,MAAM,cAAc,QAAQ,CAAC,MAAM,WAAW,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CACjI,CAAC;YAEF,MAAM,OAAO,GAAG,KAAK;gBACpB,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;gBACpD,CAAC,CAAC,IAAI,CAAC;YAER,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC5C,MAAM,IAAI,eAAe,CACxB,wDAAwD,EACxD,aAAa,EACb;oBACC,MAAM,EAAE,+CAA+C;oBACvD,KAAK,EAAE,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;iBACjD,CACD,CAAC;YACH,CAAC;YAED,MAAM,IAAI,eAAe,CACxB,4CAA4C,EAC5C,aAAa,EACb;gBACC,MAAM,EAAE,uCAAuC;gBAC/C,KAAK;aACL,CACD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,UAAU,uBAAuB,CAAC,KAA4C;QAClF,MAAM,KAAK,GAAG,2CAA2C,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO;QACN,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,UAAU;QAEV,KAAK,CAAC,IAAI,CACT,WAAmB,EACnB,gBAAwC;YAExC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxD,GAAG;gBACH,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,EAAE;aACrB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,GAAG,CACR,WAAmB,EACnB,GAAW,EACX,gBAAwC;YAExC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAC3D,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,GAAG,CACR,WAAmB,EACnB,GAAW,EACX,KAAa,EACb,gBAAwC;YAExC,aAAa,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,KAAK,CACV,WAAmB,EACnB,GAAW,EACX,gBAAwC;YAExC,MAAM,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,gBAAwC;YAExC,OAAO,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;QAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,OAA+B,EAC/B,gBAAwC;YAExC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,aAAa,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC9C,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACzD,CAAC;QACD,sBAAsB;QACtB,wBAAwB;QACxB,uBAAuB;KACvB,CAAC;AACH,CAAC;AAWD,MAAM,OAAO,mCAAoC,SAAQ,iBAA+B;IAGvF,MAAM,CAA2C;IAEjD,YAAY,UAAmC,EAAE,OAAkC;QAClF,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO;aACrC,KAAK,CAAyB,eAAe,CAAC;aAC9C,MAAM,CAAC,aAAa,CAAC;aACrB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,eAAe,EAAE,CAAC;YACtB,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE,aAAa,EAAE;gBAC5F,MAAM,EAAE,oCAAoC;gBAC5C,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IAED,CAAC,wBAAwB,CAAC;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,sBAAsB,CAAC,IAAgC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,wBAAwB,CAAC,IAAgC;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,uBAAuB,CAAC,KAA4C;QACnE,OAAO,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;CACD"}

package/dist/secrets/index.d.ts

@@ -0,0 +1,4 @@
+export { createDoksSecretStore } from './doks-secret.impl.ts';
+export { default as doksSecretDescriptor } from './doks-secret.descriptor.ts';
+export { secretsBackendDoksPlugin } from './secrets-backend-doks.plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/secrets/index.js

@@ -0,0 +1,4 @@
+export { createDoksSecretStore } from "./doks-secret.impl.js";
+export { default as doksSecretDescriptor } from "./doks-secret.descriptor.js";
+export { secretsBackendDoksPlugin } from "./secrets-backend-doks.plugin.js";
+//# sourceMappingURL=index.js.map

package/dist/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/secrets/secrets-backend-doks.plugin.d.ts

@@ -0,0 +1,3 @@
+export declare const secretsBackendDoksPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default secretsBackendDoksPlugin;
+//# sourceMappingURL=secrets-backend-doks.plugin.d.ts.map

package/dist/secrets/secrets-backend-doks.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-backend-doks.plugin.d.ts","sourceRoot":"","sources":["../../src/secrets/secrets-backend-doks.plugin.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,wBAAwB,6CA+BnC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}

package/dist/secrets/secrets-backend-doks.plugin.js

@@ -0,0 +1,35 @@
+/**
+ * Registers the DOKS Secret store and its runtime-owned credential delivery client.
+ *
+ * The store kind exposes only store operations. Worker execution resolves the
+ * semantic runtime client directly; both surfaces share its one implementation.
+ */
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { kubernetesTransportKind } from "../kubernetes/transport.js";
+import descriptor, { DOKS_SECRET_DELIVERY_CLIENT_ID, DOKS_SECRET_STORE_ACCESS } from "./doks-secret.descriptor.js";
+export const secretsBackendDoksPlugin = createRuntimePlugin({
+    id: 'digitalocean/secrets/doks',
+    name: 'Secrets Backend: DOKS Kubernetes Secret',
+    description: 'Projects stored secrets into a Kubernetes Secret on a DOKS cluster through the Secrets store and delivery owner.',
+    dependencies: ['secrets', 'runtime-client', 'integrations-digitalocean'],
+    descriptors: [descriptor],
+    onRegister: async (runtime) => {
+        if (!runtime.hasKind(kubernetesTransportKind.id))
+            runtime.registerKind(kubernetesTransportKind);
+        runtime.registerDescriptor('runtime/client', {
+            id: DOKS_SECRET_DELIVERY_CLIENT_ID,
+            kind: 'runtime/client'
+        });
+        runtime.registerLoader('runtime/client', DOKS_SECRET_DELIVERY_CLIENT_ID, async () => {
+            const { DigitalOceanDoksSecretRuntimeClient } = await import("./doks-secret.impl.js");
+            return { impl: DigitalOceanDoksSecretRuntimeClient };
+        });
+        runtime.registerLoader('secrets/store', 'doks-secret', async () => {
+            const client = await getVibesClient(DOKS_SECRET_DELIVERY_CLIENT_ID, runtime);
+            return { impl: client[DOKS_SECRET_STORE_ACCESS]() };
+        }, { priority: 1, origin: 'integrations-digitalocean/secrets' });
+    }
+});
+export default secretsBackendDoksPlugin;
+//# sourceMappingURL=secrets-backend-doks.plugin.js.map

package/dist/secrets/secrets-backend-doks.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-backend-doks.plugin.js","sourceRoot":"","sources":["../../src/secrets/secrets-backend-doks.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAsB,MAAM,4BAA4B,CAAC;AAGhF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,UAAU,EAAE,EAClB,8BAA8B,EAC9B,wBAAwB,EACxB,MAAM,6BAA6B,CAAC;AAOrC,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;IAC3D,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,yCAAyC;IAC/C,WAAW,EACV,kHAAkH;IACnH,YAAY,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,2BAA2B,CAAC;IAExE,WAAW,EAAE,CAAC,UAAU,CAAC;IAEzB,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAEhG,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,EAAE;YAC5C,EAAE,EAAE,8BAA8B;YAClC,IAAI,EAAE,gBAAgB;SACtB,CAAC,CAAC;QACH,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,8BAA8B,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,EAAE,mCAAmC,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,cAAc,CACrB,eAAe,EACf,aAAa,EACb,KAAK,IAAI,EAAE;YACV,MAAM,MAAM,GAAG,MAAM,cAAc,CAA0B,8BAA8B,EAAE,OAAO,CAAC,CAAC;YACtG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,CAAC;QACrD,CAAC,EACD,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAC5D,CAAC;IACF,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,wBAAwB,CAAC"}

package/dist/storage/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * DigitalOcean Storage: Spaces metadata, Volumes, snapshots, NFS.
+ *
+ * Bucket data/configuration uses the S3-compatible API. DigitalOcean's v2
+ * control plane separately owns scoped Spaces access-key lifecycle.
+ */
+import type { DigitalOceanControlPlaneClient } from '../client/control-plane.ts';
+export { DigitalOceanSpacesKeysClient, type DoSpacesKey, type DoSpacesKeyGrant, type DoSpacesKeyPermission } from './spaces-keys.ts';
+export type DoVolume = import('zod/v4').infer<typeof import('../schemas/http.ts').DoVolumeSchema>;
+export type DoVolumeSnapshot = import('zod/v4').infer<typeof import('../schemas/http.ts').DoVolumeSnapshotSchema>;
+export type DoCdnEndpoint = import('zod/v4').infer<typeof import('../schemas/http.ts').DoCdnEndpointSchema>;
+export type DoNfsShare = import('zod/v4').infer<typeof import('../schemas/http.ts').DoNfsShareSchema>;
+export interface CreateVolumeOptions {
+    name: string;
+    region: string;
+    size_gigabytes: number;
+    description?: string;
+    tags?: string[];
+    filesystem_type?: 'ext4' | 'xfs';
+    filesystem_label?: string;
+    snapshot_id?: string;
+}
+export declare class DigitalOceanStorageClient {
+    private readonly client;
+    constructor(client: DigitalOceanControlPlaneClient);
+    listVolumes(filters?: {
+        region?: string;
+        name?: string;
+    }): Promise<DoVolume[]>;
+    getVolume(volumeId: string): Promise<DoVolume>;
+    getVolumeOrNull(volumeId: string): Promise<DoVolume | null>;
+    createVolume(options: CreateVolumeOptions): Promise<DoVolume>;
+    deleteVolume(volumeId: string): Promise<void>;
+    attachVolume(volumeId: string, dropletId: number, region: string): Promise<void>;
+    detachVolume(volumeId: string, dropletId: number, region: string): Promise<void>;
+    listVolumeSnapshots(volumeId: string): Promise<DoVolumeSnapshot[]>;
+    createVolumeSnapshot(volumeId: string, name: string, tags?: string[]): Promise<DoVolumeSnapshot>;
+    listCdnEndpoints(): Promise<DoCdnEndpoint[]>;
+    listNfsShares(): Promise<DoNfsShare[]>;
+    getNfsShare(shareId: string): Promise<DoNfsShare>;
+    createNfsShare(options: {
+        name: string;
+        region: string;
+        size_gibibytes: number;
+        access_rules?: DoNfsShare['access_rules'];
+    }): Promise<DoNfsShare>;
+    deleteNfsShare(shareId: string): Promise<void>;
+    updateNfsShareAccessRules(shareId: string, rules: NonNullable<DoNfsShare['access_rules']>): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAEjF,OAAO,EACN,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,EAAE,KAAK,CAAC,cAAc,oBAAoB,EAAE,cAAc,CAAC,CAAC;AAElG,MAAM,MAAM,gBAAgB,GAAG,OAAO,QAAQ,EAAE,KAAK,CACpD,cAAc,oBAAoB,EAAE,sBAAsB,CAC1D,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,EAAE,KAAK,CACjD,cAAc,oBAAoB,EAAE,mBAAmB,CACvD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,OAAO,QAAQ,EAAE,KAAK,CAC9C,cAAc,oBAAoB,EAAE,gBAAgB,CACpD,CAAC;AAEF,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,yBAAyB;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,8BAA8B;IAE7D,WAAW,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAUlF,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAS9C,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAS3D,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAU7D,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhF,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IASlE,oBAAoB,CACzB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,gBAAgB,CAAC;IAatB,gBAAgB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAS5C,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAStC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IASjD,cAAc,CAAC,OAAO,EAAE;QAC7B,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC;KAC1C,GAAG,OAAO,CAAC,UAAU,CAAC;IAUjB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,yBAAyB,CAC9B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;CAGhB"}