typekro 0.33.10 → 0.35.0

package/dist/factories/clickhouse/resources/s3-backup.js

@@ -0,0 +1,410 @@
+/**
+ * Scheduled `BACKUP ... TO S3(...)` CronJob for an S3-backed ClickHouse.
+ *
+ * WHY this exists: with `storage.diskType: 's3'` the bucket holds the part
+ * DATA but the part METADATA lives on the node's local disk, so the bucket is
+ * not self-describing — losing the node loses the map to the objects. That
+ * makes durability a backup story, and an "S3-backed" cluster with no backup
+ * is a trap. This factory renders that backup explicitly rather than leaving
+ * it to a README.
+ *
+ * SHAPE OF THE JOB
+ * - A timestamped backup name (`%Y%m%d%H%M%S`) is generated per run, so each
+ *   run is a separate, independently restorable backup under
+ *   `s3://<bucket>/<prefix>/<timestamp>`.
+ * - The `BACKUP` statement carries NO credentials: it executes SERVER-side, and
+ *   the server picks the destination credentials up from the `<s3>` section the
+ *   storage compiler renders into `config.d/storage.xml` (matched by endpoint
+ *   prefix). Keys therefore never reach the query text — and never reach
+ *   `system.query_log`.
+ * - With `retention.days`, the backup runs as an initContainer and a prune
+ *   container follows it, deleting expired timestamped prefixes. The prune step
+ *   needs S3 `DeleteObject` on the backup prefix (see the IAM policy in the
+ *   docs).
+ *
+ * SHARDED CLUSTERS — WHY `ON CLUSTER` IS NOT OPTIONAL
+ * A plain `BACKUP DATABASE db TO S3(...)` is executed by the ONE server the
+ * client happened to connect to, and that server only holds its own shard's
+ * parts. On a multi-shard cluster that silently produces a PARTIAL backup: it
+ * succeeds, it is restorable, and it is missing every other shard's data.
+ * ClickHouse's answer is `BACKUP ... ON CLUSTER '<cluster>' TO S3(...)`, which
+ * fans the statement out to every host of the cluster and coordinates them
+ * through [Zoo]Keeper so that all of them contribute to ONE backup at ONE
+ * destination path (the `backup_restore_keeper_*` settings in the BACKUP/
+ * RESTORE reference exist for exactly this coordination). No `{shard}` /
+ * `{replica}` macros belong in the destination: that convention produces N
+ * INDEPENDENT per-shard backups, which is a different (external-tool) design
+ * and would need N restore statements.
+ *
+ * Because the coordination is Keeper-based, `ON CLUSTER` is only rendered for
+ * topologies that actually have a Keeper — {@link makeClickHouseCluster}
+ * REJECTS a multi-shard/multi-replica topology with a backup schedule and no
+ * keeper at construction rather than emitting a statement that would back up
+ * one shard.
+ *
+ * RESTORE is deliberately NOT automated — restoring over a live database is a
+ * decision, not a schedule. The procedure is documented in
+ * `docs/api/clickhouse/index.md`; in short (matching the backup's own shape):
+ * `RESTORE DATABASE <db> [ON CLUSTER '<cluster>'] FROM S3('<endpoint>/<timestamp>')`.
+ */
+import { type } from 'arktype';
+import { cronJob } from '../../kubernetes/workloads/cron-job.js';
+import { assertClickHouseClusterName } from '../utils/validation.js';
+import { ResolvedClickHouseS3StorageSchema, S3_ACCESS_KEY_ID_ENV, S3_SECRET_ACCESS_KEY_ENV, clickHouseS3ContainerEnv, clickHouseS3ServiceAccountName, } from '../utils/s3-storage.js';
+/**
+ * What `storage` has to be, quoted into the ArkType error on a bad value.
+ *
+ * Re-exported from `utils/s3-storage.ts`, where it is attached to the `mode`
+ * discriminant of the resolved-storage schema; kept on this module's surface
+ * because that is where callers of the backup factory look for it.
+ */
+export { RESOLVED_S3_STORAGE_REQUIREMENT } from '../utils/s3-storage.js';
+/** Image used for the prune step (the ClickHouse image has no AWS CLI). */
+export const DEFAULT_S3_PRUNE_IMAGE = 'amazon/aws-cli:2.22.35';
+/**
+ * The `storage` input: an already-RESOLVED S3 storage.
+ *
+ * It IS {@link ResolvedClickHouseS3StorageSchema} — the one description of a
+ * resolved S3 storage, which `resolveClickHouseStorage()` also asserts its own
+ * output against. There is deliberately no second, looser shape here: this
+ * factory field-selects `storage.backup.*`, `storage.bucket`, `storage.region`
+ * and `storage.auth` to build the CronJob, so the structure it reads has to be
+ * one that runtime validation ESTABLISHES rather than one a predicate claims.
+ *
+ * Re-exported under the old name so `ClickHouseS3BackupCronJobConfigSchema`
+ * reads as a schema of its own fields.
+ */
+export const ClickHouseS3BackupStorageSchema = ResolvedClickHouseS3StorageSchema;
+/**
+ * ArkType schema for ClickHouseS3BackupCronJobConfig.
+ *
+ * Configuration for {@link clickHouseS3BackupCronJob}.
+ */
+export const ClickHouseS3BackupCronJobConfigSchema = type({
+    /** CHI name — anchors the CronJob name and the ClickHouse service host. */
+    name: 'string',
+    /** CHI namespace. */
+    namespace: 'string',
+    /** ClickHouse server version, used for the `clickhouse-client` image. */
+    version: 'string',
+    /** Resolved S3 storage (must carry a `backup` schedule). */
+    storage: ClickHouseS3BackupStorageSchema,
+    /** Native TCP port of the ClickHouse service. */
+    nativePort: 'number',
+    /**
+     * CHI cluster name, required when `onCluster` is set — it becomes the
+     * `ON CLUSTER '<name>'` target. Passed to the container as an env var rather
+     * than baked into the script text so a schema reference (the runtime
+     * `spec.clusterName`) survives serialization the way `database` does.
+     */
+    'clusterName?': 'string',
+    /**
+     * Render `BACKUP ... ON CLUSTER` instead of a single-host statement.
+     *
+     * BUILD-TIME: true iff the topology has more than one shard or replica, or a
+     * Keeper is configured. See the module doc for why a single-host statement is
+     * a partial backup on a sharded cluster.
+     */
+    'onCluster?': 'boolean',
+    /** Resource id for composition references. */
+    'id?': 'string',
+});
+/**
+ * Env var carrying the `ON CLUSTER` target into the backup container.
+ *
+ * `CLICKHOUSE_CLUSTER` is NOT a name `clickhouse-client` interprets, so it
+ * cannot collide with the client's own configuration.
+ */
+export const BACKUP_CLUSTER_ENV = 'CLICKHOUSE_CLUSTER';
+/**
+ * Shell script for the backup step.
+ *
+ * `set -eu` plus an explicit `--query` exit code means a failed BACKUP fails
+ * the Job (and, with `retention`, skips the prune step) rather than reporting
+ * success on an empty backup.
+ */
+function backupScript(onCluster) {
+    // `ON CLUSTER '<name>'` fans the statement out to every host of the cluster
+    // and coordinates them into ONE backup through Keeper. Without it the
+    // connected host backs up only its own shard — see the module doc.
+    //
+    // The clause interpolates `$CLUSTER_SQL`, not the raw env var: see
+    // `clusterNameGuard()` for why the value is re-checked and re-escaped inside
+    // the container even though it is validated on the way in.
+    const onClusterClause = onCluster ? " ON CLUSTER '$CLUSTER_SQL'" : '';
+    return [
+        'set -eu',
+        ...(onCluster ? clusterNameGuard() : []),
+        // DEFENCE IN DEPTH, mirroring `clusterNameGuard()`: the destination URL is
+        // composed and validated as a WHOLE at construction time (see
+        // `composeS3EndpointUrl` in `utils/s3-storage.ts`), and by that check it
+        // cannot contain a quote at all. But the value reaching this statement is an
+        // env var on a rendered CronJob, so the script escapes it the way
+        // ClickHouse escapes a quote in a string literal — doubling it — rather
+        // than trusting that the manifest was never edited. The pair's failure mode
+        // is a backup written to a nonsense path, never an injected statement; the
+        // construction-time validation is what makes the path correct, and this is
+        // only what keeps the LITERAL closed if that validation is ever weakened.
+        'ENDPOINT_SQL="$(printf \'%s\' "$BACKUP_ENDPOINT" | sed "s/\'/\'\'/g")"',
+        'NAME="$(date -u +%Y%m%d%H%M%S)"',
+        onCluster
+            ? 'echo "Backing up database $CLICKHOUSE_DATABASE on cluster' +
+                ` $${BACKUP_CLUSTER_ENV} to $BACKUP_ENDPOINT$NAME"`
+            : 'echo "Backing up database $CLICKHOUSE_DATABASE to $BACKUP_ENDPOINT$NAME"',
+        // The destination credentials come from the server's `<s3>` config section
+        // (rendered by the storage compiler and matched by endpoint prefix), so the
+        // statement itself carries none — nothing sensitive reaches query_log.
+        // The database name is validated as a bare SQL identifier at resolve time;
+        // the cluster name and the endpoint are checked and escaped above.
+        'clickhouse-client --host "$CLICKHOUSE_HOST" --port "$CLICKHOUSE_PORT"' +
+            ' --user "$CLICKHOUSE_USER" --password "$CLICKHOUSE_PASSWORD"' +
+            ` --query "BACKUP DATABASE $CLICKHOUSE_DATABASE${onClusterClause} TO` +
+            " S3('$ENDPOINT_SQL$NAME')\"",
+        'echo "Backup $NAME complete"',
+    ].join('\n');
+}
+/**
+ * Re-validate and escape the `ON CLUSTER` target inside the container.
+ *
+ * DEFENCE IN DEPTH, and the depth is real: the name is checked on the way in
+ * ({@link assertClickHouseClusterName}) only when it is a CONCRETE string, and
+ * carried into the RGD as a `pattern=` marker for the kro path — but the value
+ * that actually reaches this script is an environment variable, resolved by
+ * KRO at instance time and editable on the rendered CronJob afterwards. So the
+ * script asserts the same rule itself and REFUSES to run rather than issue a
+ * statement built from a name it does not recognise.
+ *
+ * The escape (doubling `'`, ClickHouse's own string-literal escape) is
+ * redundant after that check by construction. It is emitted anyway so the
+ * statement stays well-formed if the guard is ever relaxed — the failure mode
+ * of the pair is a refused backup, never an injected one.
+ */
+function clusterNameGuard() {
+    return [
+        `CLUSTER="$${BACKUP_CLUSTER_ENV}"`,
+        // POSIX `case` globs, matched against the WHOLE word: empty, any
+        // disallowed character (the `-` sits last in the bracket expression, where
+        // it is literal), a first character that is not a letter, or a trailing
+        // dash. Same rule as CLICKHOUSE_CLUSTER_NAME_PATTERN.
+        'case "$CLUSTER" in',
+        '  "" | *[!A-Za-z0-9-]* | [!A-Za-z]* | *-)',
+        `    echo "Refusing to back up: $${BACKUP_CLUSTER_ENV} is not a cluster identifier" >&2`,
+        '    exit 1 ;;',
+        'esac',
+        // The Altinity CRD caps `clusters[].name` at 15 characters; a longer value
+        // cannot name a real cluster, so it is a bug or an edit, not a backup.
+        // biome-ignore lint/suspicious/noTemplateCurlyInString: POSIX shell string length
+        'if [ "${#CLUSTER}" -gt 15 ]; then',
+        `  echo "Refusing to back up: $${BACKUP_CLUSTER_ENV} is longer than 15 characters" >&2`,
+        '  exit 1',
+        'fi',
+        // ClickHouse escapes a quote inside a string literal by doubling it.
+        'CLUSTER_SQL="$(printf \'%s\' "$CLUSTER" | sed "s/\'/\'\'/g")"',
+    ];
+}
+/**
+ * Shell script for the retention prune step.
+ *
+ * Backup prefixes are pure-numeric timestamps, so expiry is a string
+ * comparison against a cutoff stamp — no date parsing of listing output, and
+ * anything that is not a timestamped backup directory is skipped rather than
+ * deleted.
+ */
+function pruneScript() {
+    return [
+        'set -eu',
+        'CUTOFF="$(date -u -d "-$RETENTION_DAYS days" +%Y%m%d%H%M%S)"',
+        'echo "Pruning backups older than $CUTOFF"',
+        // The braced form here is a POSIX default-value expansion (the variable is
+        // absent for real AWS), the one place braces are actually required.
+        // biome-ignore lint/suspicious/noTemplateCurlyInString: POSIX shell default value
+        'if [ -n "${AWS_ENDPOINT_URL:-}" ]; then ENDPOINT_ARGS="--endpoint-url $AWS_ENDPOINT_URL";',
+        'else ENDPOINT_ARGS=""; fi',
+        // ENDPOINT_ARGS must word-split into two arguments, so it stays unquoted.
+        '# shellcheck disable=SC2086',
+        'aws s3 ls "s3://$BACKUP_BUCKET/$BACKUP_PREFIX/" $ENDPOINT_ARGS |',
+        '  awk \'$1 == "PRE" { print $2 }\' | tr -d "/" | while read -r NAME; do',
+        // Skip anything that is not a pure-numeric backup timestamp rather than
+        // deleting it — the bucket prefix may hold other objects.
+        '    case "$NAME" in "" | *[!0-9]*) continue ;; esac',
+        '    if [ "$NAME" -lt "$CUTOFF" ]; then',
+        '      echo "Deleting expired backup $NAME"',
+        '      aws s3 rm --recursive "s3://$BACKUP_BUCKET/$BACKUP_PREFIX/$NAME" $ENDPOINT_ARGS',
+        '    fi',
+        '  done',
+    ].join('\n');
+}
+/** ClickHouse connection env for the backup step. */
+function clickHouseConnectionEnv(config) {
+    const backup = config.storage.backup;
+    const auth = backup?.auth;
+    return [
+        {
+            name: 'CLICKHOUSE_HOST',
+            value: `clickhouse-${config.name}.${config.namespace}.svc.cluster.local`,
+        },
+        { name: 'CLICKHOUSE_PORT', value: String(config.nativePort) },
+        { name: 'CLICKHOUSE_DATABASE', value: backup?.database ?? 'default' },
+        auth === undefined
+            ? { name: 'CLICKHOUSE_USER', value: 'default' }
+            : {
+                name: 'CLICKHOUSE_USER',
+                valueFrom: {
+                    secretKeyRef: { name: auth.secretName, key: auth.usernameKey, optional: false },
+                },
+            },
+        auth === undefined
+            ? { name: 'CLICKHOUSE_PASSWORD', value: '' }
+            : {
+                name: 'CLICKHOUSE_PASSWORD',
+                valueFrom: {
+                    secretKeyRef: { name: auth.secretName, key: auth.passwordKey, optional: false },
+                },
+            },
+        { name: 'BACKUP_ENDPOINT', value: backup?.endpointUrl ?? '' },
+        ...(config.onCluster === true
+            ? // `clusterName` is required when `onCluster` is set (checked by the
+                // factory below), but it may legitimately be a schema reference, so it
+                // travels as an env value exactly like `database` does.
+                [{ name: BACKUP_CLUSTER_ENV, value: config.clusterName }]
+            : []),
+    ];
+}
+/** AWS env for the prune step: bucket coordinates plus the same credentials. */
+function pruneEnv(config) {
+    const backup = config.storage.backup;
+    const env = [
+        { name: 'BACKUP_BUCKET', value: backup?.bucket ?? '' },
+        { name: 'BACKUP_PREFIX', value: backup?.prefix ?? '' },
+        { name: 'RETENTION_DAYS', value: String(backup?.retentionDays ?? 0) },
+    ];
+    if (config.storage.region !== undefined) {
+        env.push({ name: 'AWS_REGION', value: config.storage.region });
+    }
+    if (config.storage.endpoint !== undefined) {
+        env.push({ name: 'AWS_ENDPOINT_URL', value: config.storage.endpoint });
+    }
+    // The AWS CLI reads the standard variable names while the storage compiler's
+    // env helper emits ClickHouse-specific ones, so map them here rather than
+    // duplicating the secretKeyRef shape. IRSA needs no mapping at all — the CLI
+    // picks up the same projected web-identity token as the server.
+    //
+    // A `Map`, not an object literal, so the lookup below cannot read
+    // `Object.prototype`: `({})['constructor']` is a FUNCTION, not `undefined`,
+    // so the "unexpected env var" guard would have passed such a name straight
+    // through and pushed a container env var whose `name` is not a string. The
+    // env names are ours today, but the guard is the thing that has to hold.
+    const awsNameByChName = new Map([
+        [S3_ACCESS_KEY_ID_ENV, 'AWS_ACCESS_KEY_ID'],
+        [S3_SECRET_ACCESS_KEY_ENV, 'AWS_SECRET_ACCESS_KEY'],
+    ]);
+    for (const entry of clickHouseS3ContainerEnv(config.storage)) {
+        const awsName = awsNameByChName.get(entry.name);
+        if (awsName === undefined) {
+            throw new Error(`clickHouseS3BackupCronJob: unexpected S3 credential env var '${entry.name}'.`);
+        }
+        env.push({ name: awsName, valueFrom: entry.valueFrom });
+    }
+    return env;
+}
+/**
+ * Create the scheduled backup CronJob for an S3-backed ClickHouse cluster.
+ *
+ * @param config - Backup CronJob configuration
+ * @returns Enhanced CronJob resource with schedule-based readiness evaluation
+ * @throws Error when the resolved storage carries no `backup` schedule, when
+ *   `onCluster` is set without a `clusterName`, or when a concrete
+ *   `clusterName` is not a bare identifier
+ *
+ * @example
+ * ```typescript
+ * const backup = clickHouseS3BackupCronJob({
+ *   name: 'observability',
+ *   namespace: 'observability',
+ *   version: '25.12.5',
+ *   storage: resolved,
+ *   nativePort: 9000,
+ *   // Sharded/replicated topology: back up EVERY shard, coordinated by Keeper.
+ *   onCluster: true,
+ *   clusterName: 'cluster',
+ *   id: 'clickhouseBackup',
+ * });
+ * ```
+ */
+export function clickHouseS3BackupCronJob(config) {
+    const backup = config.storage.backup;
+    if (backup === undefined) {
+        throw new Error('clickHouseS3BackupCronJob: the resolved storage carries no backup schedule. ' +
+            'Set storage.backup.schedule to render a backup CronJob.');
+    }
+    const onCluster = config.onCluster === true;
+    if (onCluster && config.clusterName === undefined) {
+        throw new Error('clickHouseS3BackupCronJob: `onCluster` requires `clusterName` — it is the ' +
+            "`ON CLUSTER '<name>'` target of the BACKUP statement.");
+    }
+    if (onCluster) {
+        // Concrete names only — a schema reference is validated by the generated
+        // KRO schema (`ClickHouseClusterNameSchema`) and, at run time, by the
+        // guard the script itself carries.
+        assertClickHouseClusterName('clickHouseS3BackupCronJob', 'clusterName', config.clusterName);
+    }
+    const backupContainer = {
+        name: 'backup',
+        image: `clickhouse/clickhouse-server:${config.version}`,
+        command: ['sh', '-c', backupScript(onCluster)],
+        env: clickHouseConnectionEnv(config),
+    };
+    const prune = backup.retentionDays === undefined
+        ? undefined
+        : {
+            name: 'prune',
+            image: DEFAULT_S3_PRUNE_IMAGE,
+            command: ['sh', '-c', pruneScript()],
+            env: pruneEnv(config),
+        };
+    const serviceAccountName = clickHouseS3ServiceAccountName(config.storage, config.name);
+    return cronJob({
+        ...(config.id !== undefined && { id: config.id }),
+        metadata: {
+            name: `${config.name}-s3-backup`,
+            namespace: config.namespace,
+            labels: {
+                'app.kubernetes.io/name': 'clickhouse-s3-backup',
+                'app.kubernetes.io/instance': config.name,
+                'app.kubernetes.io/managed-by': 'typekro',
+            },
+        },
+        spec: {
+            schedule: backup.schedule,
+            // A backup that overlaps its predecessor competes for the same server
+            // and the same object keys; skip instead.
+            concurrencyPolicy: 'Forbid',
+            successfulJobsHistoryLimit: 3,
+            failedJobsHistoryLimit: 3,
+            jobTemplate: {
+                spec: {
+                    backoffLimit: 2,
+                    template: {
+                        metadata: {
+                            labels: {
+                                'app.kubernetes.io/name': 'clickhouse-s3-backup',
+                                'app.kubernetes.io/instance': config.name,
+                            },
+                        },
+                        spec: {
+                            restartPolicy: 'Never',
+                            ...(serviceAccountName !== undefined && { serviceAccountName }),
+                            // Sequencing: with retention the backup must COMPLETE before the
+                            // prune reads the listing, and Job containers run in parallel —
+                            // so the backup becomes an initContainer.
+                            ...(prune === undefined
+                                ? { containers: [backupContainer] }
+                                : { initContainers: [backupContainer], containers: [prune] }),
+                        },
+                    },
+                },
+            },
+        },
+    });
+}
+//# sourceMappingURL=s3-backup.js.map

package/dist/factories/clickhouse/resources/s3-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-backup.js","sourceRoot":"","sources":["../../../../src/factories/clickhouse/resources/s3-backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAQH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,OAAO,EAAE,MAAM,wCAAwC,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,iCAAiC,EACjC,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;GAMG;AACH,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAEzE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAoB/D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,CAAC;IACxD,2EAA2E;IAC3E,IAAI,EAAE,QAAQ;IACd,qBAAqB;IACrB,SAAS,EAAE,QAAQ;IACnB,yEAAyE;IACzE,OAAO,EAAE,QAAQ;IACjB,4DAA4D;IAC5D,OAAO,EAAE,+BAA+B;IACxC,iDAAiD;IACjD,UAAU,EAAE,QAAQ;IACpB;;;;;OAKG;IACH,cAAc,EAAE,QAAQ;IACxB;;;;;;OAMG;IACH,YAAY,EAAE,SAAS;IACvB,8CAA8C;IAC9C,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC;AAYH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,SAAkB;IACtC,4EAA4E;IAC5E,sEAAsE;IACtE,mEAAmE;IACnE,EAAE;IACF,mEAAmE;IACnE,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,SAAS;QACT,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,2EAA2E;QAC3E,8DAA8D;QAC9D,yEAAyE;QACzE,6EAA6E;QAC7E,kEAAkE;QAClE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,iCAAiC;QACjC,SAAS;YACP,CAAC,CAAC,2DAA2D;gBAC3D,KAAK,kBAAkB,4BAA4B;YACrD,CAAC,CAAC,0EAA0E;QAC9E,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;YACrE,8DAA8D;YAC9D,iDAAiD,eAAe,KAAK;YACrE,6BAA6B;QAC/B,8BAA8B;KAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB;IACvB,OAAO;QACL,aAAa,kBAAkB,GAAG;QAClC,iEAAiE;QACjE,2EAA2E;QAC3E,wEAAwE;QACxE,sDAAsD;QACtD,oBAAoB;QACpB,2CAA2C;QAC3C,mCAAmC,kBAAkB,mCAAmC;QACxF,eAAe;QACf,MAAM;QACN,2EAA2E;QAC3E,uEAAuE;QACvE,kFAAkF;QAClF,mCAAmC;QACnC,iCAAiC,kBAAkB,oCAAoC;QACvF,UAAU;QACV,IAAI;QACJ,qEAAqE;QACrE,+DAA+D;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,OAAO;QACL,SAAS;QACT,8DAA8D;QAC9D,2CAA2C;QAC3C,2EAA2E;QAC3E,oEAAoE;QACpE,kFAAkF;QAClF,2FAA2F;QAC3F,2BAA2B;QAC3B,0EAA0E;QAC1E,6BAA6B;QAC7B,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,0DAA0D;QAC1D,qDAAqD;QACrD,wCAAwC;QACxC,4CAA4C;QAC5C,uFAAuF;QACvF,QAAQ;QACR,QAAQ;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,qDAAqD;AACrD,SAAS,uBAAuB,CAC9B,MAAiD;IAEjD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,OAAO;QACL;YACE,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,cAAc,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,oBAAoB;SACzE;QACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QAC7D,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,SAAS,EAAE;QACrE,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/C,CAAC,CAAC;gBACE,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE;oBACT,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;iBAChF;aACF;QACL,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,CAAC,CAAC;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,SAAS,EAAE;oBACT,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;iBAChF;aACF;QACL,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,IAAI,EAAE,EAAE;QAC7D,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI;YAC3B,CAAC,CAAC,oEAAoE;gBACpE,uEAAuE;gBACvE,wDAAwD;gBACxD,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAqB,EAAE,CAAC;YACrE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,MAAiD;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACrC,MAAM,GAAG,GAAe;QACtB,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE;QACtD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE;QACtD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,EAAE;KACtE,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,kEAAkE;IAClE,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAiB;QAC9C,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;QAC3C,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;KACpD,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE,KAAK,CAAC,IAAI,IAAI,CAC/E,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAiD;IAEjD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;IAC5C,IAAI,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,2BAA2B,CACzB,2BAA2B,EAC3B,aAAa,EACb,MAAM,CAAC,WAAW,CACnB,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAgB;QACnC,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,gCAAgC,MAAM,CAAC,OAAO,EAAE;QACvD,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAC9C,GAAG,EAAE,uBAAuB,CAAC,MAAM,CAAC;KACrC,CAAC;IACF,MAAM,KAAK,GACT,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACpC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;SACtB,CAAC;IAER,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvF,OAAO,OAAO,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACjD,QAAQ,EAAE;YACR,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,YAAY;YAChC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE;gBACN,wBAAwB,EAAE,sBAAsB;gBAChD,4BAA4B,EAAE,MAAM,CAAC,IAAI;gBACzC,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,sEAAsE;YACtE,0CAA0C;YAC1C,iBAAiB,EAAE,QAAQ;YAC3B,0BAA0B,EAAE,CAAC;YAC7B,sBAAsB,EAAE,CAAC;YACzB,WAAW,EAAE;gBACX,IAAI,EAAE;oBACJ,YAAY,EAAE,CAAC;oBACf,QAAQ,EAAE;wBACR,QAAQ,EAAE;4BACR,MAAM,EAAE;gCACN,wBAAwB,EAAE,sBAAsB;gCAChD,4BAA4B,EAAE,MAAM,CAAC,IAAI;6BAC1C;yBACF;wBACD,IAAI,EAAE;4BACJ,aAAa,EAAE,OAAO;4BACtB,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,kBAAkB,EAAE,CAAC;4BAC/D,iEAAiE;4BACjE,gEAAgE;4BAChE,0CAA0C;4BAC1C,GAAG,CAAC,KAAK,KAAK,SAAS;gCACrB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,eAAe,CAAC,EAAE;gCACnC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;yBAChE;qBACF;iBACF;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC"}