@webda/azure 0.0.0-stage → 4.0.0-beta.14

package/lib/deployers/arm.service.d.ts

@@ -0,0 +1,177 @@
+import { SecretString } from "@webda/core";
+import { ContainerDeployer, ContainerDeployerParameters } from "@webda/oci";
+import { AzureServiceParameters } from "../services/azure-parameters.js";
+import { AzureDeployerInfo, AzureRoleAssignment } from "../services/contributors.js";
+import { AzureTemplate } from "../template.js";
+/** Shared ARM and OCI parameters used by Azure deployment units. */
+export declare class AzureArmDeployerParameters extends ContainerDeployerParameters implements AzureServiceParameters {
+    /**
+     * Tenant ID
+     */
+    tenantId?: string;
+    /**
+     * Client ID
+     */
+    clientId?: string;
+    /**
+     * Client secret
+     */
+    clientSecret?: string | SecretString;
+    /**
+     * Subscription ID
+     */
+    subscriptionId: string;
+    /**
+     * Endpoint
+     */
+    endpoint?: string;
+    /**
+     * Resource group
+     */
+    resourceGroup: string;
+    /**
+     * Location
+     */
+    location: string;
+    /**
+     * Create resource group
+     */
+    createResourceGroup: boolean;
+    /**
+     * Deployment name
+     */
+    deploymentName?: string;
+    /**
+     * Resource tags
+     */
+    resourceTags: Record<string, string>;
+    /**
+     * Custom resources
+     */
+    customResources: Record<string, any>[] | Record<string, Record<string, any>>;
+    /**
+     * Template output
+     */
+    templateOutput?: string;
+    /**
+     * Perform load.
+     * @override
+     */
+    load(params?: any): this;
+}
+/** Deployment results contain resource endpoints, never tokens or secret parameter values. */
+export interface AzureDeployResult {
+    /**
+     * Image
+     */
+    image?: string;
+    /**
+     * Digest
+     */
+    digest?: string;
+    /**
+     * Fqdn
+     */
+    fqdn?: string;
+    /**
+     * Revision
+     */
+    revision?: string;
+    /**
+     * Outputs
+     */
+    outputs: Record<string, any>;
+}
+/** Shared template collection and ARM deployment. SDK clients are created only when deploying. */
+export declare abstract class AzureArmDeployer<T extends AzureArmDeployerParameters = AzureArmDeployerParameters> extends ContainerDeployer<T, AzureDeployResult> implements AzureDeployerInfo {
+    /**
+     * Resources
+     */
+    resources: T;
+    /**
+     * Template
+     */
+    template: AzureTemplate;
+    /**
+     * Result
+     */
+    result?: AzureDeployResult;
+    /**
+     * Secret values
+     */
+    protected secretValues: Map<string, string | SecretString>;
+    /**
+     * Contributed env
+     */
+    protected contributedEnv: Record<string, string | {
+        secretRef: string;
+    }>;
+    /**
+     * Roles
+     */
+    protected roles: AzureRoleAssignment[];
+    /**
+     * Perform get resolved parameters.
+     * @override
+     */
+    getResolvedParameters(): T;
+    /**
+     * Resolve the deployment scope and reset template state.
+     */
+    protected prepare(): void;
+    /**
+     * Merge deployment tags with resource tags.
+     * @param tags - Resource-specific tags
+     * @returns The default tags result
+     */
+    getDefaultTags(tags?: Record<string, string>): Record<string, string>;
+    abstract getAppResourceId(): string;
+    /**
+     * Return the managed identity resource identifier.
+     * @returns The identity resource id result
+     */
+    protected getIdentityResourceId(): string;
+    /**
+     * Return the ARM expression for the application principal.
+     * @returns The app principal id result
+     */
+    abstract getAppPrincipalId(): string;
+    abstract generateTemplate(image?: string): AzureTemplate;
+    /**
+     * Add a secret without placing its value in the serializable template.
+     * @param value - Value to convert or protect
+     * @returns The secure parameter result
+     */
+    protected secureParameter(value: string | SecretString): string;
+    /**
+     * Merge service resources, environment and roles. Conflicting contributions are rejected.
+     */
+    Resources(): void;
+    /**
+     * Add a resource, rejecting conflicting declarations.
+     * @param resource - ARM resource declaration
+     */
+    protected addResource(resource: Record<string, any>): void;
+    /**
+     * Grant every contributed role to one application or job identity.
+     * @param principalId - ARM principal identifier expression
+     * @param identityResourceId - Resource providing the managed identity
+     */
+    protected grantRoles(principalId?: string, identityResourceId?: string): void;
+    /**
+     * Write a reviewable ARM template; this command never builds, pushes or deploys.
+     * @param output - Optional template output path
+     * @returns Generated ARM template
+     */
+    generate(output?: string): Promise<AzureTemplate>;
+    /** Save the current template with secure parameters left as references.
+     * @param output - Optional template output path
+     */
+    protected writeTemplate(output?: string): void;
+    /**
+     * Deploy the ARM template with secure parameter values.
+     * @returns Deployment outputs
+     */
+    sendTemplate(): Promise<Record<string, any>>;
+}
+//# sourceMappingURL=arm.service.d.ts.map

package/lib/deployers/arm.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arm.service.d.ts","sources":["../../src/deployers/arm.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,YAAY,EAAuC,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAI5E,OAAO,EAAE,sBAAsB,EAAuB,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAoB,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAAY,aAAa,EAAmC,MAAM,gBAAgB,CAAC;AAE1F,oEAAoE;AACpE,qBAAa,0BAA2B,SAAQ,2BAA4B,YAAW,sBAAsB;IAC3G;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACrC;;OAEG;IACH,cAAc,EAAG,MAAM,CAAC;IACxB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,EAAG,MAAM,CAAC;IACvB;;OAEG;IACH,QAAQ,SAAgB;IACxB;;OAEG;IACH,mBAAmB,UAAS;IAC5B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA8E;IAClH;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAM;IAClF;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAG3B;CACF;AAED,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9B;AAkBD,kGAAkG;AAClG,8BAAsB,gBAAgB,CAAC,CAAC,SAAS,0BAA0B,GAAG,0BAA0B,CACtG,SAAQ,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,CAC9C,YAAW,iBAAiB;IAE5B;;OAEG;IACH,SAAS,EAAG,CAAC,CAAC;IACd;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAyB;IAChD;;OAEG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;OAEG;IACH,SAAS,CAAC,YAAY,qCAA4C;IAClE;;OAEG;IACH,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAM;IAC9E;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAM;IAE5C;;;OAGG;IACH,qBAAqB,IAAI,CAAC,CAEzB;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,IAAI,IAAI,CAUxB;IAED;;;;OAIG;IACH,cAAc,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExE;IACD,QAAQ,CAAC,gBAAgB,IAAI,MAAM,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,qBAAqB,IAAI,MAAM,CAExC;IACD;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,IAAI,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IAEzD;;;;OAIG;IACH,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,CAK9D;IAED;;OAEG;IACH,SAAS,IAAI,IAAI,CAmBhB;IAED;;;OAGG;IACH,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAWzD;IAED;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAClB,WAAW,SAA2B,EACtC,kBAAkB,SAA+B,GAChD,IAAI,CAsBN;IAED;;;;OAIG;IAEG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAItD;IAED;;OAEG;IACH,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAO7C;IAED;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CA0CjD;CACF"}

package/lib/deployers/arm.service.js

@@ -0,0 +1,307 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+import { ResourceManagementClient } from "@azure/arm-resources";
+import { DeploymentsClient } from "@azure/arm-resourcesdeployments";
+import { Command, SecretString, useApplication, useCore, WebdaError } from "@webda/core";
+import { ContainerDeployer, ContainerDeployerParameters } from "@webda/oci";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { AzureAuth } from "../auth.js";
+import { loadAzureParameters } from "../services/azure-parameters.js";
+import { armValue, createAzureTemplate, resourceId } from "../template.js";
+/** Shared ARM and OCI parameters used by Azure deployment units. */
+export class AzureArmDeployerParameters extends ContainerDeployerParameters {
+    constructor() {
+        super(...arguments);
+        /**
+         * Location
+         */
+        this.location = "westeurope";
+        /**
+         * Create resource group
+         */
+        this.createResourceGroup = false;
+        /**
+         * Resource tags
+         */
+        this.resourceTags = { "webda-deployment": "${deployment}", "webda-version": "${git.version}" };
+        /**
+         * Custom resources
+         */
+        this.customResources = [];
+    }
+    /**
+     * Perform load.
+     * @override
+     */
+    load(params = {}) {
+        super.load(params);
+        return loadAzureParameters(this);
+    }
+}
+/**
+ * Restore secret wrappers after deployment variable expansion serializes their masked values.
+ * @param original - Original parameters retaining secret wrappers
+ * @param resolved - Parameters after deployment variable expansion
+ * @returns The restore secrets result
+ */
+function restoreSecrets(original, resolved) {
+    if (original instanceof SecretString)
+        return original;
+    if (original && typeof original === "object" && resolved && typeof resolved === "object") {
+        for (const key of Object.keys(original))
+            if (Object.prototype.hasOwnProperty.call(resolved, key))
+                resolved[key] = restoreSecrets(original[key], resolved[key]);
+    }
+    return resolved;
+}
+/** Shared template collection and ARM deployment. SDK clients are created only when deploying. */
+let AzureArmDeployer = (() => {
+    var _a;
+    let _classSuper = ContainerDeployer;
+    let _instanceExtraInitializers = [];
+    let _generate_decorators;
+    return _a = class AzureArmDeployer extends _classSuper {
+            constructor() {
+                super(...arguments);
+                /**
+                 * Resources
+                 */
+                this.resources = __runInitializers(this, _instanceExtraInitializers);
+                /**
+                 * Template
+                 */
+                this.template = createAzureTemplate();
+                /**
+                 * Secret values
+                 */
+                this.secretValues = new Map();
+                /**
+                 * Contributed env
+                 */
+                this.contributedEnv = {};
+                /**
+                 * Roles
+                 */
+                this.roles = [];
+            }
+            /**
+             * Perform get resolved parameters.
+             * @override
+             */
+            getResolvedParameters() {
+                return restoreSecrets(this.parameters, super.getResolvedParameters());
+            }
+            /**
+             * Resolve the deployment scope and reset template state.
+             */
+            prepare() {
+                this.resources = this.getResolvedParameters();
+                if (!this.resources.resourceGroup || !this.resources.subscriptionId)
+                    throw new WebdaError.BadRequest("Azure deployment requires resourceGroup and subscriptionId (or AZURE_SUBSCRIPTION_ID)");
+                this.template = createAzureTemplate();
+                this.secretValues.clear();
+                this.contributedEnv = {};
+                this.roles = [];
+            }
+            /**
+             * Merge deployment tags with resource tags.
+             * @param tags - Resource-specific tags
+             * @returns The default tags result
+             */
+            getDefaultTags(tags = {}) {
+                return { ...this.resources.resourceTags, ...tags };
+            }
+            /**
+             * Return the managed identity resource identifier.
+             * @returns The identity resource id result
+             */
+            getIdentityResourceId() {
+                return this.getAppResourceId();
+            }
+            /**
+             * Add a secret without placing its value in the serializable template.
+             * @param value - Value to convert or protect
+             * @returns The secure parameter result
+             */
+            secureParameter(value) {
+                const name = `secret${this.secretValues.size}`;
+                this.template.parameters[name] = { type: "secureString" };
+                this.secretValues.set(name, value);
+                return `[parameters('${name}')]`;
+            }
+            /**
+             * Merge service resources, environment and roles. Conflicting contributions are rejected.
+             */
+            Resources() {
+                for (const service of Object.values(useCore().getServices())) {
+                    if (service === this || typeof service?.getAzureResources !== "function")
+                        continue;
+                    const contribution = service.getAzureResources(this);
+                    for (const resource of contribution.resources ?? [])
+                        this.addResource(resource);
+                    for (const [name, value] of Object.entries(contribution.env ?? {})) {
+                        if (name in this.contributedEnv && JSON.stringify(this.contributedEnv[name]) !== JSON.stringify(value))
+                            throw new WebdaError.BadRequest(`Conflicting Azure environment contribution: ${name}`);
+                        this.contributedEnv[name] = value;
+                    }
+                    for (const [name, value] of Object.entries(contribution.outputs ?? {})) {
+                        if (name in this.template.outputs)
+                            throw new WebdaError.BadRequest(`Conflicting Azure output: ${name}`);
+                        this.template.outputs[name] = value;
+                    }
+                    this.roles.push(...(contribution.roleAssignments ?? []));
+                }
+                const custom = this.resources.customResources;
+                for (const resource of Array.isArray(custom) ? custom : Object.values(custom))
+                    this.addResource(resource);
+            }
+            /**
+             * Add a resource, rejecting conflicting declarations.
+             * @param resource - ARM resource declaration
+             */
+            addResource(resource) {
+                if (resource.properties?.principalId === this.getAppPrincipalId()) {
+                    resource.dependsOn = [...new Set([...(resource.dependsOn ?? []), this.getIdentityResourceId()])];
+                }
+                const previous = this.template.resources.find(item => item.type === resource.type && item.name === resource.name);
+                if (previous) {
+                    if (JSON.stringify(previous) !== JSON.stringify(resource))
+                        throw new WebdaError.BadRequest(`Conflicting Azure resource: ${resource.type}/${resource.name}`);
+                    return;
+                }
+                this.template.resources.push(resource);
+            }
+            /**
+             * Grant every contributed role to one application or job identity.
+             * @param principalId - ARM principal identifier expression
+             * @param identityResourceId - Resource providing the managed identity
+             */
+            grantRoles(principalId = this.getAppPrincipalId(), identityResourceId = this.getIdentityResourceId()) {
+                for (const role of this.roles) {
+                    const dependsOn = [identityResourceId];
+                    // Explicit dependency when the scoped resource is created in this template.
+                    for (const resource of this.template.resources) {
+                        if (typeof resource.type !== "string" || typeof resource.name !== "string" || resource.name.startsWith("["))
+                            continue;
+                        const names = resource.name.split("/"), types = resource.type.split("/");
+                        const absolute = `/subscriptions/${this.resources.subscriptionId}/resourceGroups/${this.resources.resourceGroup}/providers/${types[0]}/${names.map((name, index) => `${types[index + 1]}/${name}`).join("/")}`;
+                        const id = resourceId(resource.type, ...names);
+                        if (role.scope === id || role.scope === absolute)
+                            dependsOn.push(id);
+                    }
+                    this.addResource({
+                        type: "Microsoft.Authorization/roleAssignments",
+                        apiVersion: "2022-04-01",
+                        name: `[guid(${armValue(role.scope)}, ${armValue(role.roleDefinitionId)}, ${armValue(principalId)})]`,
+                        scope: role.scope,
+                        dependsOn,
+                        properties: { roleDefinitionId: role.roleDefinitionId, principalId, principalType: "ServicePrincipal" }
+                    });
+                }
+            }
+            /**
+             * Write a reviewable ARM template; this command never builds, pushes or deploys.
+             * @param output - Optional template output path
+             * @returns Generated ARM template
+             */
+            async generate(output) {
+                const template = this.generateTemplate();
+                this.writeTemplate(output);
+                return template;
+            }
+            /** Save the current template with secure parameters left as references.
+             * @param output - Optional template output path
+             */
+            writeTemplate(output) {
+                const target = output ?? this.resources.templateOutput;
+                if (target) {
+                    const path = resolve(useApplication().applicationPath, target);
+                    mkdirSync(dirname(path), { recursive: true });
+                    writeFileSync(path, JSON.stringify(this.template, null, 2) + "\n");
+                }
+            }
+            /**
+             * Deploy the ARM template with secure parameter values.
+             * @returns Deployment outputs
+             */
+            async sendTemplate() {
+                const p = this.resources, credential = new AzureAuth(p).getCredential();
+                const name = p.deploymentName ?? `webda-${this.getName()}-${Date.now()}`;
+                const client = new DeploymentsClient(credential, p.subscriptionId);
+                this.log("INFO", "Deploying Azure resources", p.resourceGroup, name);
+                const parameters = Object.fromEntries([...this.secretValues].map(([key, value]) => [
+                    key,
+                    { value: value instanceof SecretString ? value.getValue() : value }
+                ]));
+                try {
+                    if (p.createResourceGroup)
+                        await new ResourceManagementClient(credential, p.subscriptionId).resourceGroups.createOrUpdate(p.resourceGroup, { location: p.location, tags: this.getDefaultTags() });
+                    const deployment = await client.deployments
+                        .createOrUpdate(p.resourceGroup, name, {
+                        properties: { mode: "Incremental", template: this.template, parameters }
+                    })
+                        .pollUntilDone();
+                    return deployment.properties?.outputs ?? {};
+                }
+                catch {
+                    const failed = [];
+                    try {
+                        for await (const operation of client.deploymentOperations.list(p.resourceGroup, name)) {
+                            if (operation.properties?.provisioningState === "Failed") {
+                                // Status messages may echo secure parameters; report only Azure's structured error code.
+                                const code = operation.properties.statusMessage?.error?.code;
+                                if (typeof code === "string" && /^[A-Za-z0-9_.-]{1,100}$/.test(code))
+                                    failed.push(code);
+                            }
+                        }
+                    }
+                    catch {
+                        /* Deployment diagnostics can be unavailable when authorization itself failed. */
+                    }
+                    throw new WebdaError.CodeError("AZURE_DEPLOYMENT_FAILED", `Azure deployment failed${failed.length ? ` (${[...new Set(failed)].join(", ")})` : ""}; inspect deployment operations in the Azure portal`);
+                }
+            }
+        },
+        (() => {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _generate_decorators = [Command("azure template", { description: "Generate an ARM template without deploying" })];
+            __esDecorate(_a, null, _generate_decorators, { kind: "method", name: "generate", static: false, private: false, access: { has: obj => "generate" in obj, get: obj => obj.generate }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        })(),
+        _a;
+})();
+export { AzureArmDeployer };
+//# sourceMappingURL=arm.service.js.map

package/lib/deployers/arm.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arm.service.js","sources":["../../src/deployers/arm.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAA0B,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE9F,OAAO,EAAE,QAAQ,EAAiB,mBAAmB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE1F,oEAAoE;AACpE,MAAM,OAAO,0BAA2B,SAAQ,2BAA2B;IAA3E;;QAyBE;;WAEG;QACH,aAAQ,GAAG,YAAY,CAAC;QACxB;;WAEG;QACH,wBAAmB,GAAG,KAAK,CAAC;QAK5B;;WAEG;QACH,iBAAY,GAA2B,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;QAClH;;WAEG;QACH,oBAAe,GAAgE,EAAE,CAAC;IAcpF,CAAC;IARC;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AA0BD;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAa,EAAE,QAAa;IAClD,IAAI,QAAQ,YAAY,YAAY;QAAE,OAAO,QAAQ,CAAC;IACtD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;gBACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;IAC5E,gBAAgB;;sBAC5B,iBAAiB;;;sBADL,gBACpB,SAAQ,WAAuC;;;gBAG/C;;mBAEG;gBACH,cAAS,GAPW,mDAAgB,CAOtB;gBACd;;mBAEG;gBACH,aAAQ,GAAkB,mBAAmB,EAAE,CAAC;gBAKhD;;mBAEG;gBACO,iBAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;gBAClE;;mBAEG;gBACO,mBAAc,GAAmD,EAAE,CAAC;gBAC9E;;mBAEG;gBACO,UAAK,GAA0B,EAAE,CAAC;YA4M9C,CAAC;YA1MC;;;eAGG;YACH,qBAAqB;gBACnB,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACxE,CAAC;YAED;;eAEG;YACO,OAAO;gBACf,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc;oBACjE,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,uFAAuF,CACxF,CAAC;gBACJ,IAAI,CAAC,QAAQ,GAAG,mBAAmB,EAAE,CAAC;gBACtC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClB,CAAC;YAED;;;;eAIG;YACH,cAAc,CAAC,IAAI,GAA2B,EAAE;gBAC9C,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;YACrD,CAAC;YAED;;;eAGG;YACO,qBAAqB;gBAC7B,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,CAAC;YAQD;;;;eAIG;YACO,eAAe,CAAC,KAA4B;gBACpD,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBAC/C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;gBAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnC,OAAO,gBAAgB,IAAI,KAAK,CAAC;YACnC,CAAC;YAED;;eAEG;YACH,SAAS;gBACP,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC7D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAQ,OAAuC,EAAE,iBAAiB,KAAK,UAAU;wBACvG,SAAS;oBACX,MAAM,YAAY,GAAI,OAAuC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;oBACtF,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,SAAS,IAAI,EAAE;wBAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;oBAChF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;wBACnE,IAAI,IAAI,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;4BACpG,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;wBACzF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBACpC,CAAC;oBACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;wBACvE,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;4BAAE,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;wBACxG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBACtC,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC9C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC5G,CAAC;YAED;;;eAGG;YACO,WAAW,CAAC,QAA6B;gBACjD,IAAI,QAAQ,CAAC,UAAU,EAAE,WAAW,KAAK,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;oBAClE,QAAQ,CAAC,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnG,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAClH,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;wBACvD,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,+BAA+B,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnG,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAED;;;;eAIG;YACO,UAAU,CAClB,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,EACtC,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,EAAE;gBAEjD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC9B,MAAM,SAAS,GAAG,CAAC,kBAAkB,CAAC,CAAC;oBACvC,4EAA4E;oBAC5E,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;wBAC/C,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;4BACzG,SAAS;wBACX,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EACpC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBACnC,MAAM,QAAQ,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,cAAc,mBAAmB,IAAI,CAAC,SAAS,CAAC,aAAa,cAAc,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC/N,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;wBAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;4BAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvE,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC;wBACf,IAAI,EAAE,yCAAyC;wBAC/C,UAAU,EAAE,YAAY;wBACxB,IAAI,EAAE,SAAS,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI;wBACrG,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,SAAS;wBACT,UAAU,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE;qBACxG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED;;;;eAIG;YAEH,KAAK,CAAC,QAAQ,CAAC,MAAe;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACzC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED;;eAEG;YACO,aAAa,CAAC,MAAe;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;gBACvD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;oBAC/D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED;;;eAGG;YACH,KAAK,CAAC,YAAY;gBAChB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,EACtB,UAAU,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,SAAS,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzE,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;gBACnE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBACrE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CACnC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oBAC3C,GAAG;oBACH,EAAE,KAAK,EAAE,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;iBACpE,CAAC,CACH,CAAC;gBACF,IAAI,CAAC;oBACH,IAAI,CAAC,CAAC,mBAAmB;wBACvB,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,cAAc,CAC5F,CAAC,CAAC,aAAa,EACf,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CACtD,CAAC;oBACJ,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,WAAW;yBACxC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE;wBACrC,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE;qBACzE,CAAC;yBACD,aAAa,EAAE,CAAC;oBACnB,OAAO,UAAU,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,IAAI,KAAK,EAAE,MAAM,SAAS,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;4BACtF,IAAI,SAAS,CAAC,UAAU,EAAE,iBAAiB,KAAK,QAAQ,EAAE,CAAC;gCACzD,yFAAyF;gCACzF,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC;gCAC7D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;oCAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BAC1F,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,iFAAiF;oBACnF,CAAC;oBACD,MAAM,IAAI,UAAU,CAAC,SAAS,CAC5B,yBAAyB,EACzB,0BAA0B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,qDAAqD,CAC5I,CAAC;gBACJ,CAAC;YACH,CAAC;;;;oCAjEA,OAAO,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;YACzF,yKAAM,QAAQ,6DAIb;;;;;SA1KmB,gBAAgB"}