typekro 0.34.0 → 0.35.0

package/dist/alchemy/clickhouse-schema/types.d.ts

@@ -0,0 +1,394 @@
+/**
+ * Types, validation schema and errors for the `ClickHouseSchema` alchemy resource.
+ *
+ * The configurable surface is ArkType-first: {@link ClickHouseSchemaConfigSchema} is the
+ * single source of truth and the config types are INFERRED from it, so a field cannot
+ * exist in the type without existing in the schema that validates it. Only the two
+ * fields ArkType cannot express usefully are declared separately on
+ * {@link ClickHouseSchemaProps}: `kubeConfig` (a structural TypeScript type owned by the
+ * client provider) and `executor` (a runtime-only injection point, deliberately not
+ * serializable — mirroring `TypeKroResourceProps.deployer`).
+ */
+import { TypeKroError } from '../../core/errors.js';
+import type { SerializableKubeConfigOptions } from '../types.js';
+/**
+ * A plaintext credential must never be representable in props: it would be persisted
+ * verbatim into the alchemy state store. `client` therefore REJECTS undeclared keys, so
+ * `password` (and any near-miss spelling of it) fails validation instead of being
+ * silently dropped and leaving the author believing they configured authentication.
+ */
+export declare const ClickHouseSchemaClientSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    user?: string;
+    passwordEnv?: string;
+    database?: string;
+    port?: number;
+}, {}>;
+/** How to reach the ClickHouse server: a namespace, a label selector, and a container. */
+export declare const ClickHouseSchemaTargetSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    namespace: string;
+    podSelector: Record<string, string>;
+    container?: string;
+}, {}>;
+/** Bounded wait for a Ready server pod before the first exec. */
+export declare const ClickHouseSchemaWaitForPodSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    timeoutMs: number;
+}, {}>;
+/** Bounded retry of TRANSIENT exec failures. A SQL error is never retried. */
+export declare const ClickHouseSchemaRetrySchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    maxAttempts?: number;
+    backoffMs?: number;
+}, {}>;
+/**
+ * How the statements reach EVERY server, not just the one the exec landed on.
+ *
+ * ClickHouse DDL is server-local by default. `CREATE TABLE …` executed on one pod creates
+ * that table on that pod and nowhere else, so on a multi-replica or multi-shard
+ * deployment a converge that touches a single pod reports success while the rest of the
+ * cluster has no schema — and then never tries again, because the fingerprint says the
+ * work is done. Two mechanisms make DDL cluster-wide, and this resource requires one of
+ * them to be chosen explicitly:
+ *
+ * - `fanout` (the default) — TypeKro runs the ordered statement list against EVERY pod
+ *   matching the selector, in turn. It needs nothing from the cluster (no Keeper, no
+ *   `Replicated` database engine) and leans on exactly the idempotence the statements
+ *   already promise. It is ALL OR NOTHING: every matching pod that is not terminating or
+ *   finished must become Ready within `waitForPod.timeoutMs` and must carry the requested
+ *   container, or the converge fails — so a StatefulSet mid-rollout makes the resource
+ *   wait, and then fail, rather than fingerprint a half-applied schema. The pod set is
+ *   recorded in state, so a scale-out or a replaced pod re-applies even though the
+ *   statements did not change. A single-replica installation is a one-pod fanout — which
+ *   is why the default is also the correct setting there.
+ * - `onCluster` — the statements distribute themselves and TypeKro runs them ONCE, on the
+ *   first Ready pod; pods that are still rolling are Keeper's problem, not this converge's,
+ *   which is what makes this the right mode on a large cluster. That is only true if each
+ *   statement actually says so, so every statement is validated at construction; see
+ *   {@link ClickHouseSchemaConfigSchema}.
+ *
+ * @see https://clickhouse.com/docs/sql-reference/distributed-ddl
+ */
+export declare const ClickHouseSchemaExecutionSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    mode: "fanout";
+} | {
+    mode: "onCluster";
+    cluster: string;
+}, {}>;
+export type ClickHouseSchemaExecution = typeof ClickHouseSchemaExecutionSchema.infer;
+/** Applied when an author declares no execution model. */
+export declare const DEFAULT_EXECUTION: ClickHouseSchemaExecution;
+/**
+ * The configurable (serializable) surface of a `ClickHouseSchema` resource.
+ *
+ * IDEMPOTENCE IS THE AUTHOR'S CONTRACT. Every statement is re-run whenever the
+ * fingerprint changes, so each one must be safe to execute against a database where
+ * it has already been executed: `CREATE DATABASE IF NOT EXISTS`, `CREATE TABLE IF NOT
+ * EXISTS`, `CREATE OR REPLACE VIEW`, `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`,
+ * `DROP ... IF EXISTS`. TypeKro cannot verify that property — it does not parse SQL —
+ * so a non-idempotent statement surfaces as a converge that fails the second time.
+ */
+export declare const ClickHouseSchemaConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    target: {
+        namespace: string;
+        podSelector: Record<string, string>;
+        container?: string;
+    };
+    statements: string[];
+    onDelete: import("arktype/internal/attributes.ts").Default<"retain" | "run", "retain">;
+    execution: import("arktype/internal/attributes.ts").Default<{
+        mode: "fanout";
+    } | {
+        mode: "onCluster";
+        cluster: string;
+    }, {
+        mode: "fanout";
+    }>;
+    client?: {
+        user?: string;
+        passwordEnv?: string;
+        database?: string;
+        port?: number;
+    };
+    settings?: Record<string, string | number>;
+    deleteStatements?: string[];
+    waitForPod?: {
+        timeoutMs: number;
+    };
+    maxReconcilePasses?: number;
+    statementTimeoutMs?: number;
+    retry?: {
+        maxAttempts?: number;
+        backoffMs?: number;
+    };
+}, {}>;
+/** Author-facing (pre-validation) config: schema defaults are still optional here. */
+export type ClickHouseSchemaConfigInput = typeof ClickHouseSchemaConfigSchema.inferIn;
+/** Validated config: schema defaults have been applied. */
+export type ClickHouseSchemaConfig = typeof ClickHouseSchemaConfigSchema.infer;
+export type ClickHouseSchemaTarget = typeof ClickHouseSchemaTargetSchema.infer;
+export type ClickHouseSchemaClient = typeof ClickHouseSchemaClientSchema.infer;
+/** Non-serializable additions ArkType does not describe. */
+interface ClickHouseSchemaNonSchemaProps {
+    /**
+     * Durable cluster connection state, exactly as `KroResource` accepts it. Omit to use
+     * the ambient kubeconfig.
+     */
+    readonly kubeConfig?: SerializableKubeConfigOptions;
+    /**
+     * Injected transport. Runtime-only — like `TypeKroResourceProps.deployer`, this does
+     * not survive alchemy state rehydration, so a resource that relies on it must be
+     * reconstructed by the same process. Its purpose is testing and embedding.
+     */
+    readonly executor?: ClickHouseExecutor;
+    /**
+     * Alchemy ordering-only input: the channel that makes "run after the ClickHouse
+     * instance is Ready" a real dependency edge rather than a coincidence of statement
+     * order in the Stack body. Pass an alchemy `Output` derived from the instance's
+     * `KroResource` handle and alchemy deploys that resource first:
+     *
+     * ```ts
+     * readyBarrier: Output.map(Output.all(Output.of(instance)), () => true)
+     * ```
+     *
+     * Only the resolved scalar is persisted — the same shape as
+     * `TypeKroResourceProps.schedulingBarrier` — so the barrier orders the converge
+     * without copying an unrelated resource's outputs into this one's state.
+     */
+    readonly readyBarrier?: boolean;
+}
+/** What an author passes to `clickHouseSchema(id, props)`. */
+export type ClickHouseSchemaProps = ClickHouseSchemaConfigInput & ClickHouseSchemaNonSchemaProps;
+/** What the provider receives: validated config plus the non-schema additions. */
+export type ClickHouseSchemaResourceProps = ClickHouseSchemaConfig & ClickHouseSchemaNonSchemaProps;
+/**
+ * One pod an apply executed against, identified by NAME AND UID.
+ *
+ * The name alone is not an identity. A StatefulSet replica that is deleted and recreated
+ * — a node drain, a CHI template change, a `kubectl delete pod` — comes back as
+ * `chi-orders-0-0-0` again, with a fresh empty disk and no schema, and a recorded set of
+ * names cannot tell that apart from the pod that was there before. `metadata.uid` can: it
+ * is unique per pod OBJECT and never reused.
+ *
+ * The guarantee this buys, precisely:
+ *
+ * - a pod whose UID CHANGED is a different pod object — a replacement — and the statements
+ *   re-apply to it;
+ * - a pod that keeps its UID does NOT re-apply, even after a container restart or a server
+ *   crash-loop, and that is correct: the pod object survived, so either its PersistentVolume
+ *   survived with it (and the schema with that) or the `Replicated`/`ON CLUSTER` metadata in
+ *   Keeper did. Re-running the whole ordered list on every container restart would be churn,
+ *   not safety.
+ */
+export interface ClickHouseSchemaAppliedPod {
+    readonly name: string;
+    /**
+     * `metadata.uid`.
+     *
+     * `undefined` only when the transport did not report one — an injected executor whose pod
+     * summaries omit it. An entry with no UID compares by name alone, which is exactly the
+     * pre-UID behaviour, so nothing silently gains a guarantee it cannot keep.
+     */
+    readonly uid?: string;
+}
+/**
+ * Persisted state / resource outputs.
+ *
+ * `fingerprint` is what makes the resource diffable: an unchanged fingerprint against an
+ * unchanged target is a no-op converge, so a stack that redeploys hourly issues no DDL.
+ */
+export interface ClickHouseSchemaState {
+    /** sha256 over the ordered statements, the settings and the client configuration. */
+    readonly fingerprint: string;
+    /** ISO-8601 instant the statements were last applied. */
+    readonly appliedAt: string;
+    readonly statementCount: number;
+    /** Database the statements ran against (`default` unless `client.database` is set). */
+    readonly database: string;
+    /** Where the statements ran, so a target change is visible in state and forces a re-apply. */
+    readonly target: ClickHouseSchemaTarget;
+    /**
+     * Sorted NAMES of every pod the last apply executed against.
+     *
+     * Retained for compatibility and for reading state at a glance; {@link pods} is the
+     * load-bearing field and carries the same pods in the same order. A name-only set cannot
+     * see a same-name replacement, which is why the comparison moved.
+     */
+    readonly podNames: readonly string[];
+    /**
+     * EVERY pod the last apply executed against, as `{ name, uid }` pairs, sorted by name.
+     *
+     * Load-bearing under `execution.mode: 'fanout'`, not informational: a converge compares
+     * the live matching pod set against this one by name AND UID, so a scale-out, a removed
+     * replica, or a pod REPLACED under the same name re-applies the statements even though
+     * the fingerprint is unchanged. See {@link ClickHouseSchemaAppliedPod} for exactly what
+     * that guarantees. Under `onCluster` it records the single initiating pod.
+     *
+     * It is always the set the statements ACTUALLY reached, and under `fanout` it is never
+     * empty: the reconcile loop keeps going until a re-list observes a NON-EMPTY set in which
+     * every pod has been applied to and which matches the observation before it, and fails
+     * rather than record a set that does not cover what is live.
+     *
+     * `undefined` in state written before UIDs were recorded; the comparison then falls back
+     * to {@link podNames}, and the first converge to run re-writes state in the new shape.
+     */
+    readonly pods?: readonly ClickHouseSchemaAppliedPod[];
+    /**
+     * Credential-free identity of the cluster the statements were applied to — sha256 over
+     * the current context's cluster name, server URL and CA material, the same shape the
+     * per-cluster capability cache keys on.
+     *
+     * Without it, `namespace`/`podSelector`/`container` describe a target that two different
+     * kubeconfigs answer to identically: re-pointing the resource at a second cluster would
+     * match the recorded target, match the fingerprint, and skip the DDL entirely.
+     * `undefined` when the kubeconfig names no current cluster, or when a caller injected an
+     * executor and supplied no kubeconfig to identify.
+     */
+    readonly clusterId?: string;
+}
+/** One `clickhouse-client` invocation inside a server container. */
+export interface ClickHouseExecCommand {
+    readonly namespace: string;
+    readonly podName: string;
+    readonly container: string;
+    readonly command: readonly string[];
+    /** Statement text. Passed on stdin so SQL never appears in the container's argv. */
+    readonly stdin: string;
+    readonly timeoutMs: number;
+}
+export interface ClickHouseExecResult {
+    readonly stdout: string;
+    readonly stderr: string;
+    /** 0 on success. A non-zero code is a SQL/command failure and is NEVER retried. */
+    readonly exitCode: number;
+}
+/** A candidate server pod, reduced to what pod selection needs. */
+export interface ClickHousePodSummary {
+    readonly name: string;
+    /**
+     * `metadata.uid` — the identity of the pod OBJECT, unique and never reused.
+     *
+     * What makes a same-name replacement visible: a StatefulSet replica that is deleted and
+     * recreated keeps its name and comes back with an empty disk, so a set of names alone
+     * cannot tell "the pod I applied to" from "its replacement". See
+     * {@link ClickHouseSchemaAppliedPod}. `undefined` when the transport did not report one.
+     */
+    readonly uid?: string;
+    readonly ready: boolean;
+    readonly containers: readonly string[];
+    /**
+     * `status.phase` — `Pending`, `Running`, `Succeeded`, `Failed` or `Unknown`.
+     *
+     * Load-bearing under `fanout`, which waits for every matching pod rather than taking
+     * whichever ones are Ready: a pod in a terminal phase can never become Ready, so waiting
+     * for it would only burn the whole budget before failing. `undefined` when the transport
+     * did not report one, which is treated as "still on its way".
+     */
+    readonly phase?: string;
+    /**
+     * `metadata.deletionTimestamp` is set.
+     *
+     * A terminating pod still reports Ready for a while; exec'ing into one races the
+     * kubelet's SIGTERM, and WAITING for one is worse still — it is leaving, so it will
+     * never be Ready again. Either way it is not part of the matching set.
+     */
+    readonly terminating?: boolean;
+}
+/**
+ * The exec transport.
+ *
+ * The contract that makes retries safe is the split between the two failure modes:
+ *
+ * - a REJECTED promise is a transport failure (websocket error, connection reset,
+ *   API-server hiccup, timeout) and is retried;
+ * - a RESOLVED result with a non-zero `exitCode` is a SQL failure and is not.
+ *
+ * Retrying a failed statement would be wrong in general — a partially applied
+ * non-idempotent statement must surface, not be re-issued.
+ */
+export interface ClickHouseExecutor {
+    listPods(namespace: string, podSelector: Readonly<Record<string, string>>, abortSignal?: AbortSignal): Promise<readonly ClickHousePodSummary[]>;
+    exec(command: ClickHouseExecCommand, abortSignal?: AbortSignal): Promise<ClickHouseExecResult>;
+}
+/**
+ * A statement failed, a pod never became Ready, or the transport gave up.
+ *
+ * SECURITY: the failing statement's TEXT is never carried on the error — only its
+ * INDEX. Statements should not contain credentials (bind them through the server's own
+ * configuration, as the S3 storage compiler does), but a `CREATE TABLE ... S3(...,
+ * aws_secret_access_key)` would, and ClickHouse echoes the offending fragment back in
+ * its own message. Every message that reaches this error is passed through
+ * {@link redactClickHouseText} first.
+ */
+export declare class ClickHouseSchemaError extends TypeKroError {
+    /** The alchemy resource `id` — the logical name the author gave THIS schema. */
+    readonly resourceId: string;
+    /** Index into `statements` (or `deleteStatements`), or `undefined` outside statement execution. */
+    readonly statementIndex?: number | undefined;
+    /** ClickHouse's own error code, parsed from `Code: <n>.`, when the server produced one. */
+    readonly clickHouseCode?: number | undefined;
+    /** Redacted, length-capped server output — see {@link redactClickHouseOutput}. */
+    readonly detail?: string | undefined;
+    /** ClickHouse's exception class (`DB::Exception`, `DB::NetException`, …). */
+    readonly clickHouseException?: string | undefined;
+    constructor(message: string, 
+    /** The alchemy resource `id` — the logical name the author gave THIS schema. */
+    resourceId: string, 
+    /** Index into `statements` (or `deleteStatements`), or `undefined` outside statement execution. */
+    statementIndex?: number | undefined, 
+    /** ClickHouse's own error code, parsed from `Code: <n>.`, when the server produced one. */
+    clickHouseCode?: number | undefined, 
+    /** Redacted, length-capped server output — see {@link redactClickHouseOutput}. */
+    detail?: string | undefined, 
+    /** ClickHouse's exception class (`DB::Exception`, `DB::NetException`, …). */
+    clickHouseException?: string | undefined, options?: ErrorOptions);
+}
+/** Replace every line that could carry a credential with a marker. */
+export declare function redactClickHouseText(text: string): string;
+/**
+ * Ceiling on the server text retained on an error (~2 KiB).
+ *
+ * An echo is a diagnostic aid, not a log sink: a `DESCRIBE`-sized dump or a multi-megabyte
+ * parser trace carried into alchemy state and every log line is a liability of its own,
+ * independent of whether it contains a secret.
+ */
+export declare const MAX_RETAINED_DETAIL_CHARS = 2048;
+/**
+ * What survives from a failed exec's captured output.
+ *
+ * The contract is NOT "server output with credentials filtered out" — that framing is how
+ * the keyword-matching version came to leak. It is: keep what identifies the failure, and
+ * treat every value the SUBMITTED statement contained as a secret.
+ *
+ * In order:
+ *
+ * 1. The statement text itself is replaced wherever the server echoed it back, so a
+ *    definition quoted in full cannot smuggle its own literals through.
+ * 2. Every literal the statement contains — every single-quoted value, plus whatever
+ *    follows `PASSWORD` / `IDENTIFIED BY` / `access_key_id` / `secret_access_key` /
+ *    `aws_access_key_id` / `aws_secret_access_key` / `token` — is replaced with
+ *    `<redacted>` wherever it appears. This is positional, so it catches the arguments
+ *    keyword matching cannot name. Each literal is redacted in EVERY spelling it could be
+ *    echoed in, longest first: the decoded value, the raw source slice between the quotes,
+ *    and the value re-escaped both ways ClickHouse accepts (`\'` and `''`). A credential
+ *    containing a quote is one secret with several spellings, and the server frequently
+ *    quotes back the one it was given rather than the one it decoded.
+ * 3. The keyword line filter runs as a second layer, for text the statement did not
+ *    account for.
+ * 4. The result is capped at {@link MAX_RETAINED_DETAIL_CHARS}.
+ *
+ * ClickHouse's error CODE and exception class are parsed out BEFORE any of this and
+ * carried separately on the error, so redaction never costs the caller the one part of
+ * the message that says what went wrong.
+ */
+export declare function redactClickHouseOutput(output: string, statement?: string): string;
+/** Parse ClickHouse's `Code: 62. DB::Exception: …` prefix out of server output. */
+export declare function parseClickHouseErrorCode(text: string): number | undefined;
+/**
+ * Parse the exception CLASS (`DB::Exception`, `DB::NetException`, `Poco::Exception`) out
+ * of server output.
+ *
+ * Retained alongside the numeric code because the two say different things: the code
+ * names the condition, the class says which subsystem raised it — and neither can carry
+ * a credential, so both survive redaction intact.
+ */
+export declare function parseClickHouseExceptionName(text: string): string | undefined;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/alchemy/clickhouse-schema/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/alchemy/clickhouse-schema/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AA8BjE;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;;;;MAyBrC,CAAC;AAEL,0FAA0F;AAC1F,eAAO,MAAM,4BAA4B;;;;MA6BvC,CAAC;AAEH,iEAAiE;AACjE,eAAO,MAAM,gCAAgC;;MAE3C,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B;;;MAGtC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,+BAA+B;;;;;MAI1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,OAAO,+BAA+B,CAAC,KAAK,CAAC;AAErF,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,yBAA8C,CAAC;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA0FrC,CAAC;AAEL,sFAAsF;AACtF,MAAM,MAAM,2BAA2B,GAAG,OAAO,4BAA4B,CAAC,OAAO,CAAC;AAEtF,2DAA2D;AAC3D,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,KAAK,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,KAAK,CAAC;AAC/E,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,KAAK,CAAC;AAE/E,4DAA4D;AAC5D,UAAU,8BAA8B;IACtC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,6BAA6B,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG,2BAA2B,GAAG,8BAA8B,CAAC;AAEjG,kFAAkF;AAClF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG,8BAA8B,CAAC;AAEpG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC7C,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAE5C,IAAI,CAAC,OAAO,EAAE,qBAAqB,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAChG;AAED;;;;;;;;;GASG;AACH,qBAAa,qBAAsB,SAAQ,YAAY;IAGnD,gFAAgF;aAChE,UAAU,EAAE,MAAM;IAClC,mGAAmG;aACnF,cAAc,CAAC,EAAE,MAAM;IACvC,2FAA2F;aAC3E,cAAc,CAAC,EAAE,MAAM;IACvC,kFAAkF;aAClE,MAAM,CAAC,EAAE,MAAM;IAC/B,6EAA6E;aAC7D,mBAAmB,CAAC,EAAE,MAAM;gBAV5C,OAAO,EAAE,MAAM;IACf,gFAAgF;IAChE,UAAU,EAAE,MAAM;IAClC,mGAAmG;IACnF,cAAc,CAAC,EAAE,MAAM,YAAA;IACvC,2FAA2F;IAC3E,cAAc,CAAC,EAAE,MAAM,YAAA;IACvC,kFAAkF;IAClE,MAAM,CAAC,EAAE,MAAM,YAAA;IAC/B,6EAA6E;IAC7D,mBAAmB,CAAC,EAAE,MAAM,YAAA,EAC5C,OAAO,CAAC,EAAE,YAAY;CAUzB;AAiBD,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAI9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBjF;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7E"}