@elizaos/ui 2.0.0-alpha.535 → 2.0.0-alpha.537

package/packages/app-core/src/services/n8n-sidecar.d.ts

@@ -0,0 +1,355 @@
+/**
+ * n8n local sidecar: lifecycle + readiness + API-key provisioning.
+ *
+ * Fallback for the @elizaos/plugin-n8n-workflow plugin when the user has
+ * no Eliza Cloud session. Spawns `bunx n8n@<pinned>` (no package.json
+ * dependency on n8n — that tree is ~300MB), polls `/rest/login` until
+ * the instance is reachable, then provisions a personal API key via
+ * `/rest/me/api-keys` so the plugin has `N8N_HOST` + `N8N_API_KEY` to
+ * talk to.
+ *
+ * ── Lifecycle state diagram ─────────────────────────────────────────
+ *
+ *   stopped ──start()──▶ starting ──ready_probe_ok──▶ ready
+ *      ▲                    │
+ *      │                    └──start_error / probe_timeout──▶ error
+ *      │                                                         │
+ *      │                                                  retry_backoff
+ *      │                                                         │
+ *      ├────stop()──── ready                                      │
+ *      │                    │                                     │
+ *      │                   crash                                  │
+ *      │                    ▼                                     │
+ *      │                 error ◀──max_retries_exceeded────────────┘
+ *      │                    │
+ *      └────stop()──────────┘
+ *
+ * Transitions are emitted via an observable so the UI can live-render
+ * "Cloud n8n connected" vs "Local n8n starting…". Secrets never cross
+ * the logger at INFO — the provisioned API key is logged as a redacted
+ * fingerprint only.
+ *
+ * Matches the develop sidecar conventions used by StewardSidecar:
+ *   - Prefers `Bun.spawn` when available, falls back to node:child_process
+ *   - `onStatusChange` + `onLog` callbacks in config (parallels steward)
+ *   - Bounded restart with exponential backoff
+ */
+import { spawn as nodeSpawn } from "node:child_process";
+export type N8nSidecarStatus = "stopped" | "starting" | "ready" | "error";
+export interface N8nSidecarState {
+    status: N8nSidecarStatus;
+    host: string | null;
+    port: number | null;
+    errorMessage: string | null;
+    pid: number | null;
+    retries: number;
+    /**
+     * Last ~40 lines of the child's stdout+stderr, most recent last. Surfaced
+     * so the UI / `/api/n8n/status` can show the real n8n boot output when
+     * the supervisor is stuck in "starting" or has landed in "error". Without
+     * this, the sidecar was a black box: we'd see "not ready" forever with
+     * no way to tell whether bunx was downloading, n8n was migrating, or the
+     * process had crashed on a missing binary.
+     */
+    recentOutput: string[];
+}
+export interface N8nSidecarConfig {
+    /** Enable local sidecar fallback. Default: true when no cloud session. */
+    enabled?: boolean;
+    /** Pinned n8n version. Update via release process; matches bunx cache. */
+    version?: string;
+    /** Preferred starting port; next free port used on collision. Default 5678. */
+    startPort?: number;
+    /** Bind host for the child. Default 127.0.0.1. */
+    host?: string;
+    /**
+     * Binary used to run n8n. Default "npx".
+     *
+     * Why not "bunx"? bunx invokes n8n through Bun's runtime / shim, which
+     * fails two different ways depending on the n8n version:
+     *   1. n8n@1.70.x: bunx resolves `node` via $PATH before reading the
+     *      package's `engines` field. On macOS with Homebrew that's v24,
+     *      which 1.70 rejects ("Node.js version 24.5.0 is currently not
+     *      supported").
+     *   2. n8n@1.108.x: bunx runs n8n under Bun's runtime which does not
+     *      fully implement the `reflect-metadata` + TSyringe decorator
+     *      pattern n8n relies on for DI, failing at bootstrap with
+     *      "[DI] ErrorReporter is not decorated with Service".
+     * `npx --yes` uses npm's cache and execs n8n under the expected Node
+     * runtime, which works across every n8n + Node combo we care about.
+     */
+    binary?: string;
+    /** State directory root; owner email/password + sqlite live here. */
+    stateDir?: string;
+    /**
+     * Readiness probe timeout in ms. Default 180000 (3 minutes).
+     *
+     * First-run `bunx n8n@<pinned>` has to download the full n8n tree
+     * (~300MB) before it can boot. On a typical home connection that's
+     * 30–90s of download plus 15–30s of n8n boot. 60s was not enough —
+     * bump to 3 minutes so cold starts land inside the probe window on
+     * every desktop platform. Subsequent boots hit the bunx cache and
+     * finish in <10s, well inside this budget.
+     */
+    readinessTimeoutMs?: number;
+    /** Interval between readiness probes. Default 750ms. */
+    readinessIntervalMs?: number;
+    /** Max restart attempts before going to `error`. Default 3. */
+    maxRetries?: number;
+    /** Base backoff in ms (exponential). Default 2000. */
+    backoffBaseMs?: number;
+    /** Optional status-change listener (parallels StewardSidecar.onStatusChange). */
+    onStatusChange?: (state: N8nSidecarState) => void;
+    /** Optional log forwarder (parallels StewardSidecar.onLog). */
+    onLog?: (line: string, stream: "stdout" | "stderr") => void;
+}
+export interface N8nSidecarDeps {
+    /** Factory so tests can mock `spawn` without touching `node:child_process`. */
+    spawn?: typeof nodeSpawn;
+    /** HTTP fetch override for tests (readiness probe + API-key provisioning). */
+    fetch?: typeof fetch;
+    /** Port picker override so tests don't need real sockets. */
+    pickPort?: (start: number) => Promise<number>;
+    /** Sleep override for deterministic backoff tests. */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * Returns true if a process with the given pid is alive. Overridable so
+     * tests can simulate orphaned pids without needing real OS processes.
+     */
+    isProcessAlive?: (pid: number) => boolean;
+    /**
+     * Returns the command-line of a process (or null). Used for orphan
+     * detection to avoid killing an unrelated pid that may have been reused.
+     */
+    readProcessCommand?: (pid: number) => Promise<string | null>;
+    /**
+     * Sends a signal to a pid. Used when reaping an orphan from a pidfile.
+     * Separate from the child-process kill because we may not own the
+     * orphan's ChildProcess handle.
+     */
+    killPid?: (pid: number, signal: NodeJS.Signals) => void;
+    /**
+     * Preflight check for the spawn binary. Default implementation runs
+     * `<binary> --version` with a short timeout. Throws on failure.
+     */
+    preflightBinary?: (binary: string) => Promise<void>;
+    /** Current wall-clock time. Injected for deterministic retry-reset tests. */
+    now?: () => number;
+    /** setTimeout override so tests can control the 5-minute retry-reset timer. */
+    setTimer?: (fn: () => void, ms: number) => unknown;
+    /** clearTimeout override paired with `setTimer`. */
+    clearTimer?: (handle: unknown) => void;
+}
+type Listener = (state: N8nSidecarState) => void;
+export declare function isBinaryMissingMessage(message: string): boolean;
+export declare class N8nSidecar {
+    private config;
+    private deps;
+    private state;
+    private static readonly RECENT_OUTPUT_CAP;
+    /** Ring buffer of the child's recent stdout/stderr lines (see state.recentOutput). */
+    private recentOutput;
+    private child;
+    /** Cached API key — secret, never logged, never serialized via getState(). */
+    private apiKey;
+    private listeners;
+    private stopping;
+    private supervisorRunning;
+    /**
+     * Handle for the retry-reset timer. A sidecar that stays ready for
+     * RETRY_RESET_AFTER_MS is declared healthy and its retry count is zeroed
+     * so a future crash doesn't count as part of the original burst.
+     */
+    private retryResetTimer;
+    constructor(config?: N8nSidecarConfig, deps?: N8nSidecarDeps);
+    getState(): N8nSidecarState;
+    /**
+     * Returns the provisioned API key. Separate from `getState()` so state
+     * snapshots can be broadcast to UI/WS clients without leaking the secret.
+     */
+    getApiKey(): string | null;
+    /**
+     * Merge new config into the existing sidecar. Safe to call at any time.
+     *
+     * - If the sidecar has not been spawned yet (no child), the next call to
+     *   start() will pick up the new values.
+     * - If the sidecar is currently running AND a field that requires a
+     *   respawn (binary, host, startPort, stateDir, version) changed, we log
+     *   a warning and keep the old values live. Callers must stop() + start()
+     *   explicitly to apply those changes.
+     */
+    updateConfig(next: N8nSidecarConfig): void;
+    /**
+     * Return the current ResolvedConfig as an N8nSidecarConfig input (used by
+     * updateConfig for the merge). Excludes internal timer state.
+     */
+    private snapshotConfig;
+    subscribe(fn: Listener): () => void;
+    private emit;
+    private setState;
+    /**
+     * Start the sidecar. Safe to call multiple times — no-ops if already
+     * starting/ready. Never throws; failures mark status=error and resolve.
+     */
+    start(): Promise<void>;
+    /**
+     * Supervisor loop: spawn → probe readiness → (on crash) exponential
+     * backoff. Bounded by `maxRetries`; beyond that we land in `error`.
+     */
+    private runSupervisor;
+    private spawnChild;
+    /** Push a line into the bounded recent-output buffer and publish. */
+    private recordOutput;
+    private clearNpmCacheAfterJsonParseFailure;
+    /**
+     * Block until the current child exits. Returns early if the child is null
+     * or if `stop()` has flipped `stopping`. No timeout — n8n is a long-running
+     * service, so timing out here would SIGKILL a healthy child and bounce the
+     * supervisor into a "child exited unexpectedly" → retry loop that ends in
+     * the `max retries exceeded` error state. Shutdown-side timeouts live in
+     * `killChild()` (SIGTERM with a 5s SIGKILL fallback).
+     */
+    private waitForChildExitWithTimeout;
+    private killChild;
+    private attachExistingInstance;
+    private probeExistingInstance;
+    /**
+     * Polls GET {host}/rest/login until 200 or 401 (both mean "up"). 503
+     * means "still booting". Times out per `readinessTimeoutMs`.
+     *
+     * Returns true on success, false on timeout.
+     */
+    private probeReadiness;
+    /**
+     * Resolve an API key for this sidecar.
+     *
+     * Strategy:
+     *   1. If a key is cached on the filesystem at {stateDir}/api-key, try
+     *      it first. If /rest/api-keys accepts it, reuse it — this preserves
+     *      webhook configs across restarts.
+     *   2. Otherwise provision a new key via /rest/me/api-keys and persist
+     *      it mode-600 for the next boot.
+     *   3. If everything fails, return null. The caller logs a warning but
+     *      does not fail readiness.
+     */
+    private ensureApiKey;
+    private apiKeyPath;
+    private loadPersistedApiKey;
+    private persistApiKey;
+    /**
+     * Validate a cached API key by calling the public REST API that accepts
+     * the X-N8N-API-KEY header. A 2xx means the key is still live; 401/403
+     * means it was revoked.
+     *
+     * Important: /rest/api-keys is the internal endpoint that requires the
+     * JWT cookie and will always 401 for an X-N8N-API-KEY regardless of
+     * whether the key itself is valid. Using /api/v1/workflows instead —
+     * the same endpoint the proxy hits, so "valid for probe" = "valid for
+     * real traffic".
+     */
+    private validateApiKey;
+    /**
+     * Provision an API key by driving n8n's owner-setup → login → api-key flow.
+     *
+     * n8n ≥ 1.90-ish removed the anonymous `/rest/me/api-keys` endpoint. The
+     * supported path now requires:
+     *   1. POST /rest/owner/setup   { email, firstName, lastName, password }
+     *      – returns `Set-Cookie: n8n-auth=<JWT>` when no owner exists yet.
+     *   2. POST /rest/login         { emailOrLdapLoginId, password }
+     *      – returns the same cookie on restarts, once the owner is set.
+     *   3. GET  /rest/api-keys/scopes
+     *      – enumerates the scopes the current role is allowed to grant.
+     *   4. POST /rest/api-keys      { label, scopes, expiresAt: null }
+     *      – returns `data.rawApiKey` which stays valid across restarts until
+     *        explicitly revoked.
+     *
+     * Credentials are persisted to `{stateDir}/owner.json` (mode-600) so the
+     * same login works on every subsequent boot; we never re-generate. Password
+     * is random per install — there's no user-facing n8n UI flow in Eliza, so
+     * storing it here is safe for a local single-user sidecar.
+     */
+    private provisionApiKey;
+    /**
+     * Load owner credentials from `{stateDir}/owner.json`, or generate a fresh
+     * pair and persist them mode-600. The email is deterministic (matches the
+     * label we show to the user); the password is a long random token.
+     */
+    private loadOrCreateOwnerCreds;
+    /**
+     * Returns a `Cookie: n8n-auth=<jwt>` string by either creating the owner
+     * (first boot) or logging in (subsequent boots). Returns null if both
+     * fail so the caller can back off gracefully.
+     */
+    private acquireOwnerCookie;
+    /** List scopes the current role may grant when creating an API key. */
+    private fetchApiKeyScopes;
+    /**
+     * Delete every api-key row with a matching label. Used to recover from the
+     * "already exists" case when a previous provisioning run created the label
+     * but lost the `rawApiKey` (n8n only returns the raw key at creation time,
+     * so a partially-persisted state wedges the next boot unless we can delete
+     * and re-create). Returns the number of rows deleted.
+     */
+    private deleteApiKeysByLabel;
+    /** 48 bytes of base64url entropy — ~64 chars, far above n8n's min length. */
+    private generateRandomPassword;
+    /** Stop the sidecar. Idempotent. */
+    stop(): Promise<void>;
+    /** Public helper so callers can gate feature activation on running state. */
+    isRunning(): boolean;
+    private pidfilePath;
+    private readPidfile;
+    private writePidfile;
+    private removePidfile;
+    /**
+     * If the pidfile points at a live n8n process, kill it before spawning.
+     * Guards against orphans created by SIGKILL'ing the parent — without this,
+     * each cold boot leaks a port and eventually a zombie per start.
+     *
+     * We do two levels of verification to avoid nuking an unrelated pid that
+     * may have been reused by the OS:
+     *   1. The pid must be alive.
+     *   2. The pid's cmdline must mention "n8n".
+     */
+    private reapOrphan;
+    private armRetryResetTimer;
+    private cancelRetryResetTimer;
+}
+/**
+ * Returns the process-wide n8n sidecar singleton, constructing it lazily
+ * on first access.
+ *
+ * If the singleton already exists, the provided config is merged via
+ * `updateConfig()` — changes that require a respawn (binary/host/port/
+ * stateDir/version) log a warning and do NOT take effect until an explicit
+ * stop()+start() cycle. Non-respawn fields (timeouts, callbacks, retries)
+ * apply immediately.
+ *
+ * NOTE: This accessor is synchronous for backwards compatibility with
+ * existing callers. If a disposal is currently in flight, you may get a
+ * sidecar that races with the old one. Prefer `getN8nSidecarAsync()` in
+ * new code.
+ */
+export declare function getN8nSidecar(config?: N8nSidecarConfig): N8nSidecar;
+/**
+ * Async-safe variant of getN8nSidecar(). Awaits any in-flight disposal
+ * before constructing or returning the singleton. Use this from code that
+ * can be async (most callers already are).
+ */
+export declare function getN8nSidecarAsync(config?: N8nSidecarConfig): Promise<N8nSidecar>;
+/**
+ * Returns the singleton if one has already been constructed. Used by
+ * routes that should only surface state if the sidecar was explicitly
+ * initialized (avoids side-effectful construction on a read).
+ */
+export declare function peekN8nSidecar(): N8nSidecar | null;
+/**
+ * Stops and clears the singleton. Tests + shutdown paths use this.
+ *
+ * Concurrency contract: concurrent callers all await the same in-flight
+ * stop() before `_singleton` is cleared. Once disposal resolves, the
+ * singleton slot is free and a new sidecar can be constructed.
+ */
+export declare function disposeN8nSidecar(): Promise<void>;
+export {};
+//# sourceMappingURL=n8n-sidecar.d.ts.map

package/packages/app-core/src/services/n8n-sidecar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"n8n-sidecar.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/services/n8n-sidecar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAqB,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY3E,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAClD,+DAA+D;IAC/D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,sDAAsD;IACtD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACxD;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,oDAAoD;IACpD,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;CACxC;AAED,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAwNjD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE/D;AAgDD,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,IAAI,CAA2B;IACvC,OAAO,CAAC,KAAK,CAQX;IAKF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IAChD,sFAAsF;IACtF,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,KAAK,CAA6B;IAC1C,8EAA8E;IAC9E,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,iBAAiB,CAAS;IAClC;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAiB;gBAE5B,MAAM,GAAE,gBAAqB,EAAE,IAAI,GAAE,cAAmB;IA2BpE,QAAQ,IAAI,eAAe;IAI3B;;;OAGG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAI1B;;;;;;;;;OASG;IACH,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAiC1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAiBtB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,IAAI;IAanC,OAAO,CAAC,IAAI;IAgBZ,OAAO,CAAC,QAAQ;IAKhB;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA0C5B;;;OAGG;YACW,aAAa;YAyGb,UAAU;IAgIxB,qEAAqE;IACrE,OAAO,CAAC,YAAY;YAaN,kCAAkC;IAwBhD;;;;;;;OAOG;IACH,OAAO,CAAC,2BAA2B;IAoBnC,OAAO,CAAC,SAAS;YAwBH,sBAAsB;YA6BtB,qBAAqB;IAYnC;;;;;OAKG;YACW,cAAc;IAkC5B;;;;;;;;;;;OAWG;YACW,YAAY;IAc1B,OAAO,CAAC,UAAU;YAIJ,mBAAmB;YAOnB,aAAa;IAc3B;;;;;;;;;;OAUG;YACW,cAAc;IAa5B;;;;;;;;;;;;;;;;;;;OAmBG;YACW,eAAe;IAgF7B;;;;OAIG;YACW,sBAAsB;IAuDpC;;;;OAIG;YACW,kBAAkB;IAsEhC,uEAAuE;YACzD,iBAAiB;IAkB/B;;;;;;OAMG;YACW,oBAAoB;IAuClC,6EAA6E;IAC7E,OAAO,CAAC,sBAAsB;IAQ9B,oCAAoC;IAC9B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,6EAA6E;IAC7E,SAAS,IAAI,OAAO;IAMpB,OAAO,CAAC,WAAW;YAIL,WAAW;YASX,YAAY;YAYZ,aAAa;IAI3B;;;;;;;;;OASG;YACW,UAAU;IAkCxB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,qBAAqB;CAM9B;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,gBAAqB,GAAG,UAAU,CAYvE;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,GAAE,gBAAqB,GAC5B,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAElD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgBvD"}