@avantf/dsh-plugin-base 0.5.2 → 0.6.0

package/{dist → lib}/providers/model.js

@@ -4,7 +4,7 @@
  */
 import { createHash } from 'node:crypto';
 import { once } from 'node:events';
-import { createWriteStream } from 'node:fs';
+import { createReadStream, createWriteStream } from 'node:fs';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { finished } from 'node:stream/promises';
 import { ProvisionError } from '../errors.js';
@@ -138,6 +138,19 @@ function flatSidecarDir(home, targetRoot, repo) {
 function sha256Hex(bytes) {
     return createHash('sha256').update(bytes).digest('hex');
 }
+/**
+ * sha256 of a file on disk, STREAMED one chunk at a time: `fs.readFile` would hold a 2 GiB model
+ * file entirely in the heap just to hash it, so `verify` used to spike to the file's full size on
+ * every required file. The read goes through `node:fs` for the same reason {@link openBlobSpill}'s
+ * write does — {@link ProvisionFs} has no streaming API and this change must not move the interface
+ * generation; the path has already been vetted by the seam's `stat` before this runs.
+ */
+async function sha256File(path) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return hash.digest('hex');
+}
 function text(value) {
     return new TextDecoder().decode(value);
 }
@@ -455,8 +468,26 @@ async function writeBlob(fs, blob, bytes) {
         return;
     await fs.atomicWrite(blob, bytes);
 }
-/** Throw a `verify/failed` for the first file that is not provably usable. */
+/**
+ * A `verify/failed` the provider's own `probe` ALSO reports as a miss.
+ *
+ * The distinction decides whether a shared completion marker is withdrawn (see `verify` below): a
+ * missing, empty or directory required file is already a `found: false` for THIS item, so removing
+ * `refs/<revision>` / `record.json` would only force healthy SIBLING items of the same
+ * repo+revision to reinstall. A content mismatch (`verifyCorrupt`) is invisible to the probe's
+ * existence checks and must withdraw it.
+ */
+class ProbeDetectedVerifyFailure extends ProvisionError {
+    constructor(message) {
+        super('verify/failed', message);
+    }
+}
+/** Throw a `verify/failed` for a problem `probe` already reports as a miss. */
 function verifyFailure(message) {
+    throw new ProbeDetectedVerifyFailure(message);
+}
+/** Throw a `verify/failed` only CONTENT inspection can see — the marker must be withdrawn. */
+function verifyCorrupt(message) {
     throw new ProvisionError('verify/failed', message);
 }
 /** Probe the `flat` layout from the sidecar alone: no network, no mutation. */
@@ -505,27 +536,27 @@ async function verifyHub(ctx, item, spec, resolved) {
             verifyFailure(`模型文件是目录 ${file}：${path}`);
         if (info.size === 0)
             verifyFailure(`模型文件为空 ${file}：${path}`);
-        const digest = sha256Hex(await ctx.fs.readFile(path));
+        const digest = await sha256File(path);
         const link = await ctx.fs.readlink(path);
         if (link !== undefined) {
             // The entry resolves into blobs, so the read above already proved the blob's bytes.
             const target = resolve(dirname(path), link);
             if (!isInside(blobs, target))
-                verifyFailure(`模型文件的链接指向 blobs 之外：${path}`);
+                verifyCorrupt(`模型文件的链接指向 blobs 之外：${path}`);
             const named = basename(target);
             if (!BLOB_PATTERN.test(named))
-                verifyFailure(`模型文件的链接目标名不是 sha256：${path}`);
+                verifyCorrupt(`模型文件的链接目标名不是 sha256：${path}`);
             if (digest !== named)
-                verifyFailure(`模型文件内容与 blob 名不符 ${file}：${path}`);
+                verifyCorrupt(`模型文件内容与 blob 名不符 ${file}：${path}`);
             continue;
         }
         // A real-file fallback carries no expectation; the blob named by its digest must exist intact.
         const blobPath = join(blobs, digest);
         const blobInfo = await ctx.fs.stat(blobPath);
         if (blobInfo === undefined || blobInfo.isDirectory || blobInfo.size === 0)
-            verifyFailure(`blob 缺失或为空：${blobPath}`);
-        if (sha256Hex(await ctx.fs.readFile(blobPath)) !== digest)
-            verifyFailure(`blob 内容与名字不符：${blobPath}`);
+            verifyCorrupt(`blob 缺失或为空：${blobPath}`);
+        if ((await sha256File(blobPath)) !== digest)
+            verifyCorrupt(`blob 内容与名字不符：${blobPath}`);
     }
 }
 /** Prove every required `flat` entry matches its recorded digest or the blob its link names. */
@@ -549,23 +580,62 @@ async function verifyFlat(ctx, item, spec) {
             verifyFailure(`模型文件是目录 ${file}：${path}`);
         if (info.size === 0)
             verifyFailure(`模型文件为空 ${file}：${path}`);
-        const digest = sha256Hex(await ctx.fs.readFile(path));
+        const digest = await sha256File(path);
         const link = await ctx.fs.readlink(path);
         if (link !== undefined) {
             // The entry resolves into the sidecar, so the read above already proved the blob's bytes.
             const target = resolve(dirname(path), link);
             if (!isInside(blobs, target))
-                verifyFailure(`模型文件的链接指向 blobs 之外：${path}`);
+                verifyCorrupt(`模型文件的链接指向 blobs 之外：${path}`);
             const named = basename(target);
             if (!BLOB_PATTERN.test(named))
-                verifyFailure(`模型文件的链接目标名不是 sha256：${path}`);
+                verifyCorrupt(`模型文件的链接目标名不是 sha256：${path}`);
             if (digest !== named)
-                verifyFailure(`模型文件内容与 blob 名不符 ${file}：${path}`);
+                verifyCorrupt(`模型文件内容与 blob 名不符 ${file}：${path}`);
         }
         // A names-only record cannot prove content; a recorded digest always can.
         const expected = digests[file];
         if (expected !== undefined && digest !== expected)
-            verifyFailure(`模型文件内容与 record.json 不符 ${file}：${path}`);
+            verifyCorrupt(`模型文件内容与 record.json 不符 ${file}：${path}`);
+    }
+}
+/**
+ * Withdraw the completion marker — `refs/<revision>` (hub) or `record.json` (flat) — after a
+ * CONTENT failure that `probe` cannot see. The core does not quarantine this kind's `dir`: it is
+ * the shared `snapshots/<sha>` / data directory that `refs/<revision>` and every sibling item of
+ * the same repo+sha point at, so renaming it would dangle the ref and fail healthy items with the
+ * broken one (see `provisioner.ts`'s `ensureOne`). The marker is the only state that says
+ * "installed", so dropping it makes the next `probe` a miss and the next `ensure` reinstall,
+ * while the snapshot/blobs stay for everyone else.
+ *
+ * The marker is SHARED by every item of the same repo+revision, which is why `verify` only calls
+ * this for corruption (`verifyCorrupt`) and not for a missing/empty file that this item's own probe
+ * already reports. The marker is re-read before removal and only dropped when it still names the
+ * sha THIS install wrote: a concurrent installer of another revision may already have replaced it,
+ * and its marker is not ours to withdraw. Best-effort throughout — the verify failure is the report.
+ */
+async function withdrawMarker(ctx, item, spec, resolved) {
+    try {
+        if (layoutOf(spec) === FLAT_LAYOUT) {
+            const recordPath = join(flatSidecarDir(ctx.home, item.target.root, spec.repo), RECORD_FILE);
+            let record;
+            try {
+                record = decodeRecord(await ctx.fs.readFile(recordPath));
+            }
+            catch {
+                record = undefined;
+            }
+            if (record !== undefined && record.sha === resolved.version)
+                await ctx.fs.rm(recordPath);
+            return;
+        }
+        const refPath = join(hubRoot(ctx.home, item.target.root, spec.repo), 'refs', spec.revision ?? DEFAULT_REVISION);
+        const recorded = text(await ctx.fs.readFile(refPath)).trim();
+        if (recorded === resolved.version)
+            await ctx.fs.rm(refPath);
+    }
+    catch {
+        // A marker that cannot be read or removed changes nothing about the failure being reported.
     }
 }
 /** Build the built-in model-cache provider. */
@@ -668,9 +738,22 @@ export function modelCacheProvider(options = {}) {
         },
         async verify(item, resolved, ctx) {
             const spec = parseSpec(item);
-            if (layoutOf(spec) === FLAT_LAYOUT)
-                return verifyFlat(ctx, item, spec);
-            return verifyHub(ctx, item, spec, resolved);
+            try {
+                if (layoutOf(spec) === FLAT_LAYOUT)
+                    return await verifyFlat(ctx, item, spec);
+                return await verifyHub(ctx, item, spec, resolved);
+            }
+            catch (error) {
+                // This kind bypasses `publish()`, so the core will not quarantine the failed directory.
+                // A CONTENT failure is invisible to `probe`'s existence checks, so the shared marker must
+                // go or the broken copy keeps answering present. A failure the probe already detects
+                // (`ProbeDetectedVerifyFailure`: missing/empty/directory) must NOT withdraw it:
+                // that marker is shared by every item of the same repo+revision, and the failing item is a
+                // miss on its own next probe — removing it would only make healthy siblings reinstall.
+                if (!(error instanceof ProbeDetectedVerifyFailure))
+                    await withdrawMarker(ctx, item, spec, resolved);
+                throw error;
+            }
         },
     };
 }

package/{dist → lib}/providers/npm.d.ts

@@ -1,4 +1,4 @@
-import type { Provider } from '../types.js';
+import type { Provider, ProviderContext } from '../types.js';
 export declare const NPM_PACKAGE_KIND = "npm-package";
 /** The `spec` of an `npm-package` item. */
 export interface NpmPackageSpec {
@@ -14,11 +14,20 @@ export interface NpmPackageSpec {
         readonly dir?: string;
     }[];
 }
+export declare function packageVersionOf(ctx: ProviderContext, dir: string): Promise<string | undefined>;
 /** Walk up from a resolved entry to the owning package directory.
  *
  *  The candidate is checked BEFORE stepping up (the entry usually sits directly in the package), and
  *  `dirnameImpl` is the platform `dirname` so the win32 separator path is covered from Linux. */
 export declare function packageDirOf(entry: string, name: string, dirnameImpl?: (path: string) => string): string | undefined;
+/** Resolve a peer directory from this module's tree, falling back to the host CWD with a warning.
+ *
+ *  The order matters: `import.meta.url` is the tree that actually loaded this provider, while the CWD
+ *  is wherever the host happened to start. A peer resolved from the CWD becomes an ABSOLUTE symlink
+ *  inside the published version directory (see {@link linkPeers}); it dangles the moment the host
+ *  starts elsewhere or that tree is removed, and it made "one zod" depend on the launch directory.
+ *  The CWD stays as a last resort, but never silently. */
+export declare function resolvePeerDir(peer: string, ctx: ProviderContext): string | undefined;
 /** Build the built-in npm provider. */
 export declare function npmPackageProvider(options?: {
     readonly id?: string;

package/lib/providers/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/providers/npm.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA+B,QAAQ,EAAE,eAAe,EAAsD,MAAM,aAAa,CAAA;AAE7I,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAM7C,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC1G;AAuJD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CASrG;AAeD;;;iGAGiG;AACjG,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAgB,GAAG,MAAM,GAAG,SAAS,CAS7H;AAED;;;;;;0DAM0D;AAC1D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAyBrF;AA8FD,uCAAuC;AACvC,wBAAgB,kBAAkB,CAAC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CAqKnF"}

package/{dist → lib}/providers/npm.js

@@ -68,6 +68,10 @@ async function download(ctx, urls, integrity) {
             bytes = await readCapped(response, DEFAULT_MAX_BYTES);
         }
         catch (error) {
+            // Crossing the byte cap is terminal: every mirror serves the same oversized object, so the
+            // remaining candidates are not tried (same rule as `providers/model.ts` and `net.ts`).
+            if (error instanceof ProvisionError && error.code === 'fetch/too-large')
+                throw error;
             problems.push(`${url} → ${error instanceof Error ? error.message : String(error)}`);
             continue;
         }
@@ -159,7 +163,7 @@ async function findNativeModule(ctx, dir, depth = 0) {
     }
     return undefined;
 }
-async function packageVersionOf(ctx, dir) {
+export async function packageVersionOf(ctx, dir) {
     try {
         const raw = decodeJson(await ctx.fs.readFile(join(dir, 'package.json')));
         if (typeof raw !== 'object' || raw === null)
@@ -207,7 +211,7 @@ export function packageDirOf(entry, name, dirnameImpl = dirname) {
  *  inside the published version directory (see {@link linkPeers}); it dangles the moment the host
  *  starts elsewhere or that tree is removed, and it made "one zod" depend on the launch directory.
  *  The CWD stays as a last resort, but never silently. */
-function resolvePeerDir(peer, ctx) {
+export function resolvePeerDir(peer, ctx) {
     const from = (root) => {
         try {
             return dirname(createRequire(root).resolve(`${peer}/package.json`));

package/lib/providers/runtime_deps.d.ts

@@ -0,0 +1,184 @@
+import type { ProvisionFs, ProvisionLock, ProvisionLogger } from '../types.js';
+import type { Provider } from '../types.js';
+/** The kind the runtime-dependency provider claims. */
+export declare const RUNTIME_DEPS_KIND = "runtime-deps";
+/**
+ * The canonical `item.target.root` for the shared store. A caller may put the store elsewhere, but
+ * then it is a different shared root: the store is shared through the HOME + target.root pair.
+ */
+export declare const RUNTIME_DEPS_DIR = "deps/runtime";
+/** One registry/cache endpoint the attempts can name. */
+export interface DependencySource {
+    /** Stable id referenced by an {@link InstallAttempt}. */
+    readonly id: string;
+    /** Registry URL (`https://registry.example/`); omitted means "no registry". */
+    readonly registry?: string;
+    /** Manager cache/store directory; with no registry the attempt runs offline. */
+    readonly cache?: string;
+}
+/** One install attempt: a source plus the manager/script/env policy for that try. */
+export interface InstallAttempt {
+    /** An id from {@link RuntimeDepsSpec.sources}. */
+    readonly source: string;
+    /** `pnpm` when omitted (this family's package manager). */
+    readonly manager?: 'npm' | 'pnpm';
+    /** Extra environment for the manager process. */
+    readonly env?: Readonly<Record<string, string>>;
+    /**
+     * Whether lifecycle scripts may run. Default `false`: a self-heal install that runs arbitrary
+     * registry lifecycle scripts is an explicit decision, so a caller that needs a native build says so.
+     */
+    readonly allowScripts?: boolean;
+}
+/** What a plugin declares for one `runtime-deps` item. Base names no package. */
+export interface RuntimeDepsSpec {
+    /** Package name → package.json dependency spec (a range, `file:` path, alias, …). */
+    readonly packages: Readonly<Record<string, string>>;
+    /** The registry/cache endpoints the attempts reference. */
+    readonly sources: readonly DependencySource[];
+    /** Tried in order; the first one whose install AND verify succeeds wins. */
+    readonly attempts: readonly InstallAttempt[];
+    /**
+     * Package specifiers every successful root must resolve (`createRequire(...).resolve()`). Must be
+     * non-empty (a root that verified nothing is not a verified root), and the set is part of the key:
+     * two specs that verify different things never share a root.
+     */
+    readonly verify: readonly string[];
+    /**
+     * Host-provided singletons: name → peer range. They are LINKED from the caller's tree, never
+     * installed. The key commits to the name, the range AND the host copy that gets linked (directory +
+     * version), so two specs that ask for different ranges — or resolve the same range from different
+     * physical copies — never share a root. Every reuse re-reads the version actually linked into the
+     * root against the range declared here.
+     */
+    readonly peers?: Readonly<Record<string, string>>;
+    /** A lockfile whose bytes seed/audit the install and are part of the content key. */
+    readonly lockfile?: string;
+}
+/** What one call to the manager runner returns. */
+export interface RuntimeDepsRunResult {
+    readonly code: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** One manager invocation; injectable so the orchestration is testable without a registry. */
+export interface RuntimeDepsRunInput {
+    readonly manager: 'npm' | 'pnpm';
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly timeoutMs?: number;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Provider options. None of them is a package name: the options only seam the host tree, the
+ * process facts the key is built from, and the manager runner (tests).
+ */
+export interface RuntimeDepsProviderOptions {
+    /** Provider id; defaults to `@avantf/dsh-plugin-base/runtime-deps`. */
+    readonly id?: string;
+    /** The manager used by an attempt that does not name one. Default `pnpm`. */
+    readonly manager?: 'npm' | 'pnpm';
+    /** Explicit peer directories, overriding resolution from the tree that loaded the base. */
+    readonly peerDirs?: Readonly<Record<string, string>>;
+    /** Per-key lock budget. Default 300 000 ms. */
+    readonly lockTimeoutMs?: number;
+    /** A lock whose holder is gone is reclaimed after this age. Default 10 000 ms. */
+    readonly staleLockMs?: number;
+    /** Manager version probe; defaults to `<manager> --version` (cached per process). */
+    readonly managerVersion?: (manager: 'npm' | 'pnpm') => string | undefined;
+    /** The manager runner; defaults to spawning the manager with `stdio: pipe`. */
+    readonly run?: (input: RuntimeDepsRunInput) => Promise<RuntimeDepsRunResult>;
+    /** Process facts the content key includes; defaults to `process.platform/arch/versions.modules`. */
+    readonly target?: {
+        readonly platform?: string;
+        readonly arch?: string;
+        readonly abi?: string;
+    };
+    readonly clock?: () => number;
+}
+/** One attempt as recorded in `.runtime.json`. */
+export interface RuntimeDepsAttemptRecord {
+    readonly source: string;
+    /** The source's registry, REDACTED: a private registry may carry userinfo or a `_authToken`, and this
+     *  record sits in a store every plugin can read. The host survives (the diagnostic value), the
+     *  credential does not; the key still commits to the declared value. */
+    readonly registry?: string;
+    readonly cache?: string;
+    readonly manager: 'npm' | 'pnpm';
+    /** The env KEYS the attempt set. Values are deliberately not persisted: they can carry tokens. */
+    readonly envKeys: readonly string[];
+    readonly allowScripts: boolean;
+    readonly result: 'ok' | 'failed';
+    readonly code?: string;
+    readonly detail?: string;
+    readonly ms: number;
+}
+/** The `.runtime.json` record: the handle a plugin can read back from the root. */
+export interface RuntimeDepsRecord {
+    readonly schemaVersion: number;
+    readonly kind: typeof RUNTIME_DEPS_KIND;
+    readonly state: 'ready';
+    readonly key: string;
+    readonly packages: Readonly<Record<string, string>>;
+    readonly lockHash: string;
+    readonly platform: string;
+    readonly arch: string;
+    readonly nodeAbi: string;
+    readonly attempts: readonly RuntimeDepsAttemptRecord[];
+    readonly peers: readonly string[];
+    /**
+     * Peers whose link fell back to a COPY (`linkOrCopy`: no symlink support on this filesystem).
+     * A linked peer's identity is the resolved host directory AND version; a copied peer only records
+     * the version it was cloned from, so the root states that boundary here instead of implying a
+     * physical link it does not have. Absent in records written before this field existed.
+     */
+    readonly copiedPeers?: readonly string[];
+    readonly integrity: string;
+    readonly installedAt: string;
+}
+/** The shared store root for one item. */
+export declare function runtimeDepsStore(home: string, targetRoot?: string): string;
+/** The per-key lock path; the lock files sit beside the roots, never inside one. */
+export declare function runtimeDepsLockPath(store: string, key: string): string;
+/** Build the built-in shared runtime-dependency provider.
+ *  @stable */
+export declare function runtimeDepsProvider(options?: RuntimeDepsProviderOptions): Provider;
+/** What one explicit GC pass did. */
+export interface RuntimeDepsGcReport {
+    /** Root keys actually removed. */
+    readonly removed: readonly string[];
+    /** Root keys kept because a recorded plugin references them or the caller listed them. */
+    readonly kept: readonly string[];
+    /** Root keys not removed (dry-run candidates, a held lock, an unreadable status plane, a failed rm). */
+    readonly skipped: readonly string[];
+    /** Stale staging trees and dead lock files cleaned up. */
+    readonly cleaned: readonly string[];
+}
+export interface RuntimeDepsGcOptions {
+    /** The provisioner home (the `<home>` in `<home>/<root>/<key>`). */
+    readonly home: string;
+    /** The store root below `home`; defaults to {@link RUNTIME_DEPS_DIR}. */
+    readonly root?: string;
+    /** Extra keys to keep (a caller's own record of the keys it uses). */
+    readonly keep?: readonly string[];
+    /** Report but do not remove anything. */
+    readonly dryRun?: boolean;
+    readonly fs?: ProvisionFs;
+    readonly lock?: ProvisionLock;
+    readonly logger?: ProvisionLogger;
+    readonly clock?: () => number;
+    /** A lock whose holder pid is gone is removed after this age. Default 10 000 ms. */
+    readonly staleMs?: number;
+    /** Staging trees older than this are removed. Default 1 hour. */
+    readonly stagingGraceMs?: number;
+}
+/**
+ * Remove roots no recorded plugin references. EXPLICIT: this is an operator action, never a startup
+ * step, because a running plugin may hold a key that has not reached `status.json` yet.
+ *
+ * A root is kept when its key is in `keep` or in a `runtime-deps` status row's `version` (the
+ * content key this provider reports). Roots in use by a live per-key lock are skipped, never stolen.
+ */
+export declare function gcRuntimeDeps(options: RuntimeDepsGcOptions): Promise<RuntimeDepsGcReport>;
+//# sourceMappingURL=runtime_deps.d.ts.map

package/lib/providers/runtime_deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime_deps.d.ts","sourceRoot":"","sources":["../../src/providers/runtime_deps.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAA+B,QAAQ,EAA0D,MAAM,aAAa,CAAA;AAEhI,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,iBAAiB,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAA;AAwB9C,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACjC,iDAAiD;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC7C,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACjC,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IACzE,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC5E,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CAC9B;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;4EAEwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,CAAA;IAChC,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,iBAAiB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACtD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AA2FD,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAyB,GAAG,MAAM,CAO5F;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtE;AAihBD;cACc;AACd,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,QAAQ,CAsVtF;AAMD,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,wGAAwG;IACxG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,yCAAyC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AA2ED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqI/F"}