@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/nodes/node-data-plane.service.js

@@ -0,0 +1,478 @@
+"use strict";
+// =============================================================================
+// The node DATA plane: how a node with no credentials moves bytes
+// (issue #269, epic #254)
+// =============================================================================
+//
+// #268's control plane answers "which work is mine, and what did I conclude
+// about it". It has one hole, and it is not a small one: a worker node holds
+// NO STORAGE CREDENTIALS, so a job whose input is a stored object is a job the
+// node cannot start and a job whose output is bytes is a job it cannot finish.
+// This service is the sanctioned way across that gap, and it is deliberately
+// the ONLY way.
+//
+// THE INVARIANT: BYTES NEVER TOUCH THE API PROCESS. The server mints a
+// short-lived signed URL; the node talks to the storage provider directly.
+// No storage credential ever leaves this process, and no object payload ever
+// enters it. `dto/node-data-plane.dto.ts`'s header records the two
+// alternatives this beats — proxying every byte through the API, and handing
+// nodes a bucket-wide credential — and why each is worse.
+//
+// -----------------------------------------------------------------------------
+// WHY THIS IS A SEPARATE SERVICE FROM `NodesService`
+// -----------------------------------------------------------------------------
+//
+// Because of what it would otherwise DRAG IN. `NodesService` is the control
+// plane: Prisma, the claim, the terminal state machine, the registry.
+// Injecting `STORAGE_PROVIDER` there would make the queue's second executor
+// depend on object storage being configured at all — and #268 was careful in
+// the other direction, keeping the node plane out of `JobsModule` so "the
+// queue does not need to know that nodes exist" stays true. Same argument,
+// one layer out: the control plane does not need to know that storage exists.
+// A deployment with no bucket still registers nodes, claims jobs and settles
+// them; only this service is inert.
+//
+// It also keeps the guard where it belongs. Both routes here are behind
+// `NodesService.assertJobHeldByNode` — REUSED, never reimplemented. That
+// method demands four things at once (claimed by THIS node, `running`, with a
+// lease, unexpired), and it is the single reason a straggler's late request
+// cannot mint a URL for a job somebody else now owns. A second copy of the
+// check written here would start identical and drift on the first fix applied
+// to one side, and the failure it would let through is invisible: a node
+// reading or overwriting an object for a job it no longer holds, with nothing
+// in any log connecting the two.
+//
+// -----------------------------------------------------------------------------
+// ⚠ THE DOWNLOAD IS RESOLVED THROUGH AN *INTERNAL* PATH, WITH NO OWNERSHIP CHECK
+// -----------------------------------------------------------------------------
+//
+// `ObjectsService.getDownloadUrl` exists and is NOT used here, on purpose. It
+// applies a per-user ownership check (`uploadedById !== userId → 403`) because
+// its caller is a person asking for their own file over the interactive API.
+// This caller is not that. A node is a TRUSTED INTERNAL EXECUTOR running work
+// the server itself assigned it, and the ownership question was already
+// settled twice before we arrive here: the job was enqueued by this
+// application against a subject it chose, and `assertJobHeldByNode` proved
+// this node currently holds that job under a live lease.
+//
+// Applying the user check anyway would not add safety; it would add a bug. The
+// user a `nod_` credential resolves to is the node's OWNER — the operator who
+// registered the machine — who has no relationship whatsoever to whoever
+// uploaded the object a job happens to be about. Every job over another
+// user's upload would fail with a `403` that is simply wrong, and the fleet
+// would appear to work perfectly right up until the first cross-user job.
+//
+// THE POSTURE IS EXACTLY THE IN-PROCESS WORKER'S. When `JobWorker` runs
+// `ExampleChecksumHandler.process`, the handler calls
+// `storageProvider.download(key)` and reads the bytes with no ownership check
+// at all, because a background job is not acting on behalf of a user. A node
+// is the same executor on different hardware; giving the two different access
+// rules would mean a job's outcome depended on which one claimed it. What
+// bounds a node is not ownership, it is the LEASE: it may read exactly the
+// input of exactly the job it is holding, for as long as it holds it.
+//
+// -----------------------------------------------------------------------------
+// WHY URLS ARE MINTED HERE AND NOT FOLDED INTO THE CLAIM RESPONSE
+// -----------------------------------------------------------------------------
+//
+// #268's `params` bag was built to receive them ("tomorrow (#269) is that plus
+// presigned URLs"), and they are still not there. Minting at claim time spends
+// the URL's lifetime on the wrong clock: a node claiming its `concurrency` in
+// one call queues that work internally, so the last job's URL has been ageing
+// since before the first job started — and the fix, a longer expiry, widens
+// the very window the short expiry exists to close. On-demand minting means a
+// URL's clock starts when the transfer does. It also means a job whose type
+// never touches storage carries no storage cost at all, and that a retried
+// transfer is one cheap call rather than a re-claim.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var NodeDataPlaneService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeDataPlaneService = exports.NODE_OUTPUT_KEY_PREFIX = exports.NODE_SIGNED_URL_MIN_TTL_SECONDS = exports.NODE_SIGNED_URL_MAX_TTL_SECONDS = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const index_1 = require("../core/index");
+const node_crypto_1 = require("node:crypto");
+const index_2 = require("../jobs/index");
+const ports_1 = require("./ports");
+const nodes_service_1 = require("./nodes.service");
+/**
+ * The longest a node-facing signed URL may live, in seconds.
+ *
+ * FIFTEEN MINUTES, AND IT IS A CEILING RATHER THAN A SETTING. The
+ * application-wide `storage.signedUrlExpiry` defaults to an hour, which is the
+ * right answer for a URL handed to a logged-in person's browser and the wrong
+ * one for a URL handed to an unattended process on hardware this deployment
+ * may not own. A signed URL is a bearer capability: whoever holds the string
+ * has it, so the only thing bounding the damage of one that leaks — into a
+ * node's own debug log, a crash dump, a support ticket, a shell history — is
+ * how long it stays valid.
+ *
+ * Fifteen minutes is long enough for a large object over a slow link and short
+ * enough that a leaked URL is worthless by the time anyone finds it. A node
+ * that needs longer asks again, which costs one request and is available for
+ * as long as it holds the lease.
+ */
+exports.NODE_SIGNED_URL_MAX_TTL_SECONDS = 900;
+/**
+ * The shortest a node-facing signed URL may live.
+ *
+ * Guards against a deployment that sets `SIGNED_URL_EXPIRY=0` (or something
+ * negative, or unparseable) and thereby hands its whole fleet URLs that expire
+ * before the node can use them — a fleet-wide outage produced by a config
+ * typo, whose symptom is every transfer failing with a provider-side
+ * "expired" error that names nothing about this setting.
+ */
+exports.NODE_SIGNED_URL_MIN_TTL_SECONDS = 60;
+/**
+ * The prefix every node-written output lands under.
+ *
+ * One namespace, separate from `uploads/` where `ObjectsService` puts
+ * user-uploaded objects, so "what did the fleet write" is answerable with a
+ * single prefix listing and a lifecycle rule can be applied to node output
+ * without touching a single user upload.
+ */
+// Without the trailing slash, because this constant is joined as
+// `${PREFIX}/${jobId}/...`. The storage slice's key-prefix registry lists the
+// same namespace as `node-outputs/` (the reference app:
+// `storage/storage-key-prefixes.ts`, where `storage-key-prefixes.spec.ts`
+// pins the two together), so a purge can never ask for `node-outputs//`,
+// match nothing, and report success. The slice cannot register it itself
+// until the storage registry is packaged (#736).
+/**
+ * The key prefix every default node output lands under (`node-outputs/<jobId>/<uuid>`), without the trailing slash.
+ *
+ * @stability experimental
+ */
+exports.NODE_OUTPUT_KEY_PREFIX = 'node-outputs';
+/**
+ * What a server-derived storage key is allowed to contain.
+ *
+ * ⚠ THIS IS NOW LOAD-BEARING, NOT DEFENSIVE (#348). It used to assert a
+ * property this file guaranteed on its own: the key was a UUID path parameter
+ * plus a `randomUUID()`, so it could not contain anything else, and the regex
+ * was insurance against a future edit interpolating something less
+ * disciplined into that template. Since #348 the key may come from a
+ * handler's `deriveOutputKey`, which is arbitrary application code computing
+ * a path — a job type, a payload field, a timestamp formatted by hand, a
+ * name read out of a row — so this is the only check standing between that
+ * computation and a signed PUT.
+ *
+ * Path traversal does not announce itself: `..` in an S3 key is not an error,
+ * it is a key, and the object simply lands somewhere nobody looks. The
+ * leading-character rule additionally refuses a key starting with `/`, which
+ * some providers accept and then store under a different name than the one
+ * the handler recorded.
+ */
+const SAFE_STORAGE_KEY = /^[A-Za-z0-9][A-Za-z0-9/_.-]*$/;
+/**
+ * Mints the short-lived signed URLs a node moves a held job's bytes through (`NODE_OBJECT_STORE`).
+ *
+ * @stability experimental
+ */
+let NodeDataPlaneService = NodeDataPlaneService_1 = class NodeDataPlaneService {
+    prisma;
+    config;
+    nodes;
+    storage;
+    registry;
+    inputs;
+    logger = new common_1.Logger(NodeDataPlaneService_1.name);
+    constructor(prisma, config, nodes, storage, 
+    // The registry, for exactly one question: does this job's type want to
+    // choose its own output key (#348)? Injected rather than imported so the
+    // answer comes from the handlers actually registered in THIS process —
+    // the same source `serverOnlyTypes()` and the claim already read.
+    registry, inputs) {
+        this.prisma = prisma;
+        this.config = config;
+        this.nodes = nodes;
+        this.storage = storage;
+        this.registry = registry;
+        this.inputs = inputs;
+    }
+    // ===========================================================================
+    // Reading the input
+    // ===========================================================================
+    /**
+     * A short-lived signed GET for the input object of a job this node holds.
+     *
+     * THE ORDER IS THE CONTRACT, and it is the same discipline `submitResult`
+     * follows: prove the caller may speak for this job, THEN resolve what the
+     * job is about, THEN mint. Nothing is minted for a job whose lease has
+     * lapsed, and nothing is minted for a job whose input cannot be named.
+     *
+     * ⚠ THE URL IS NEVER LOGGED. Not at `debug`, not on the error path, not
+     * "temporarily". It is a bearer capability for the object, and a log line is
+     * the easiest place in a system for one to be copied to somewhere it
+     * outlives its expiry. The log below names the job and the object, which is
+     * everything an operator needs to trace a transfer and nothing that grants
+     * access to it. `S3StorageProvider.getSignedDownloadUrl` holds to the same
+     * rule from its side, and the HTTP interceptor records method, url and
+     * duration only — never a response body.
+     */
+    async createDownloadUrl(userId, nodeId, jobId, dto) {
+        // `dto.claimToken` narrows the guard from "this node" to "THIS CLAIM of
+        // this node" when the node is new enough to quote it (#364), so a stale
+        // worker slot is not handed a bearer capability for the input of a job it
+        // no longer holds. `undefined` for a node that quoted none, which is the
+        // pre-#364 check exactly. No `?.` here: `nodeDownloadUrlSchema`'s
+        // `.default({})` guarantees `dto` is always an object by the time this
+        // method runs, the same guarantee `submitResult`/`reportFailure` rely on
+        // for their own required `dto` parameters.
+        const job = await this.nodes.assertJobHeldByNode(userId, nodeId, jobId, dto.claimToken);
+        const object = await this.resolveInput(job);
+        const expiresIn = this.resolveTtlSeconds();
+        const url = await this.storage.getSignedDownloadUrl(object.storageKey, {
+            expiresIn,
+        });
+        this.logger.log(`Issued a ${expiresIn}s download URL to node ${nodeId} for job ${job.id} ` +
+            `(${job.type}), storage object ${object.id}`);
+        return {
+            url,
+            expiresIn,
+            expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString(),
+            objectId: object.id,
+            size: object.size.toString(),
+            mimeType: object.mimeType,
+        };
+    }
+    // ===========================================================================
+    // Writing the output
+    // ===========================================================================
+    /**
+     * A short-lived signed PUT to a key THIS SERVER CHOSE, for a job this node
+     * holds.
+     *
+     * The key derivation is the security-relevant line and it takes no input
+     * from the request. The DEFAULT is `node-outputs/<jobId>/<uuid>`: the job id
+     * is a UUID the router already validated, the suffix is a fresh
+     * `randomUUID()`. Two consequences worth stating, because both are
+     * load-bearing:
+     *
+     *   * A NODE CANNOT OVERWRITE ANYTHING. The random suffix means every mint
+     *     is a new key, so even the same node asking twice for the same job
+     *     cannot clobber its own earlier output — let alone somebody else's
+     *     upload. A signed PUT is an unconditional overwrite of its key, so
+     *     "the key is always new" is the whole of that guarantee.
+     *   * THE OUTPUT IS ATTRIBUTABLE. The job id is in the path, so an object
+     *     found in the bucket months later can be traced to the row that
+     *     produced it without a lookup table.
+     *
+     * ⚠ A TYPE MAY OVERRIDE WHERE ITS OUTPUT LANDS, AND THE SERVER STILL CHOOSES
+     * (#348). A handler implementing `deriveOutputKey` answers instead of the
+     * template above, because some artifacts have a REQUIRED location: a
+     * database backup's key is recorded on its `database_backup_runs` row and
+     * read back by the retention sweep, the download endpoint and the restore
+     * path, so an archive under `node-outputs/…` is one none of them can find.
+     * Without this, no such type could ever be node-eligible.
+     *
+     * What does NOT change is who decides. `deriveOutputKey` runs in this
+     * process, in the handler that owns the artifact, with the `Job` row as its
+     * only input; the node's influence remains exactly zero. It is also the
+     * handler's job to be IDEMPOTENT — a node that asks twice (a retry, a lost
+     * response) must get the same key back rather than a second artifact; see
+     * `JobHandler.deriveOutputKey`. Note the trade that buys: a handler that
+     * derives a STABLE key gives up the "every mint is a new key" guarantee
+     * above for its own type, deliberately, because a stable location is the
+     * whole point — the overwrite it can then perform is of its own artifact,
+     * for its own job, and of nothing else.
+     *
+     * A `key` in the request body is REFUSED, not ignored — see the DTO file's
+     * header for why the node's author being told beats the node's author
+     * guessing. That refusal is unchanged by the above and happens BEFORE any
+     * derivation runs.
+     *
+     * NO `storage_objects` ROW IS CREATED HERE. Minting a write target is not
+     * the same as recording an object: the node may never use the URL, may
+     * crash mid-transfer, or may have its lease expire and its result refused,
+     * and a row written now would outlive all three as a `pending` object with
+     * nothing behind it. Recording the output is the HANDLER's business, in
+     * `persistNodeResult`, after the bytes are known to exist — which is why the
+     * chosen key is returned to the node rather than kept: the node reports it
+     * back in its result, and the handler writes it down.
+     */
+    async createUploadTarget(userId, nodeId, jobId, dto) {
+        // ⚠ `dto.claimToken` MATTERS MORE HERE THAN ANYWHERE ELSE THIS TOKEN IS
+        // CHECKED (#364), and the reason is `deriveOutputKey` two paragraphs down:
+        // the key is a function of the JOB, not of the claim, so a node's stale
+        // slot asking here would be handed a signed PUT for the exact key its own
+        // later claim is writing. Both PUTs succeed, the bytes that survive are
+        // whichever finished last, and no log anywhere records that two ran. The
+        // guard runs BEFORE any derivation, so a refused slot never learns the key.
+        // No `?.`: `nodeUploadUrlSchema`'s `.default({})` guarantees `dto` is
+        // always an object here — see `createDownloadUrl`'s comment above.
+        const job = await this.nodes.assertJobHeldByNode(userId, nodeId, jobId, dto.claimToken);
+        this.rejectCallerSuppliedFields(job, dto);
+        // The type's own answer if it has one, the data plane's default if it does
+        // not. `?.` twice, not a branch: a job whose type has no registered
+        // handler at all (a row left by a fork's handler that is no longer in this
+        // process) still gets a usable key rather than a crash on the way to one.
+        const handler = this.registry.get(job.type);
+        const key = (await handler?.deriveOutputKey?.(job)) ??
+            `${exports.NODE_OUTPUT_KEY_PREFIX}/${job.id}/${(0, node_crypto_1.randomUUID)()}`;
+        if (!SAFE_STORAGE_KEY.test(key)) {
+            // ⚠ REACHABLE SINCE #348, and this is the check that makes
+            // `deriveOutputKey` safe to hand to arbitrary handlers: the value above
+            // may now be a path some feature's code computed, and `..`, a leading
+            // `/` or a stray space in it is not an error at the provider — it is a
+            // key, and the bytes land somewhere nobody looks.
+            //
+            // A 500 rather than a 400, deliberately: nothing the node sent can
+            // reach this string, so a 4xx would tell an operator to go and fix a
+            // node that is behaving perfectly. The fault is in a handler in this
+            // process, and the log line below names the type so the search starts
+            // in the right file.
+            this.logger.error(`Handler for job type ${job.type} derived an unsafe storage key for job ${job.id}; ` +
+                `refusing to sign an upload. Fix the handler's deriveOutputKey.`);
+            throw new Error(`Refusing to sign an upload for job ${job.id}: the derived storage key is not safe.`);
+        }
+        const expiresIn = this.resolveTtlSeconds();
+        const url = await this.storage.getSignedPutUrl(key, {
+            expiresIn,
+            contentType: dto.contentType,
+        });
+        this.logger.log(`Issued a ${expiresIn}s upload URL to node ${nodeId} for job ${job.id} ` +
+            `(${job.type}), key ${key}`);
+        return {
+            url,
+            key,
+            expiresIn,
+            expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString(),
+        };
+    }
+    // ===========================================================================
+    // Internals
+    // ===========================================================================
+    /**
+     * The job's input object, or a clean 422 naming exactly what is missing.
+     *
+     * THIS IS THE `ENOENT … open ''` FIX, EXPRESSED OVER HTTP.
+     * `NodeJobInputs.resolve` refuses to produce an empty path and throws
+     * one of three named reasons instead (`NodeJobInputError`); this
+     * method's only job is to turn that into a status code a node can act on.
+     *
+     * WHY 422 AND NOT 400, 404 OR 500 — the status is the instruction, exactly
+     * as it is for the 409 in #268:
+     *
+     *   * `400` would say "your request was malformed". It was not: the node
+     *     sent the right thing about the right job. A node written to fix and
+     *     resend a 4xx would resend forever.
+     *   * `404` would say "no such job", which is false and sends the operator
+     *     hunting for a job that is right there in the admin list.
+     *   * `500` would say "this server is broken, try again". It is not, and a
+     *     retry cannot help: all three reasons are permanent (a subject that was
+     *     never set does not appear later; a deleted row does not come back).
+     *   * `422` says "your request was understood and cannot be processed",
+     *     which is the truth. The node's correct response is to report the job
+     *     FAILED through `POST …/failure`, letting the attempt budget and the
+     *     admin job list surface it the way every other permanent failure
+     *     surfaces — with `details.reason` naming which of the three it was.
+     */
+    async resolveInput(job) {
+        try {
+            // The app resolves it in the job's organization: a node principal has
+            // none, but the job it holds does (payload `orgId`; a pre-#725 job gets
+            // the single-mode default).
+            return await this.inputs.resolve(job);
+        }
+        catch (error) {
+            if (!(error instanceof ports_1.NodeJobInputError)) {
+                throw error;
+            }
+            this.logger.warn(`Job ${job.id} (${job.type}) has no resolvable input: ${error.message}`);
+            throw new common_1.UnprocessableEntityException({
+                message: error.message,
+                details: {
+                    jobId: job.id,
+                    type: job.type,
+                    reason: error.reason,
+                    subjectId: error.subjectId,
+                    // Said explicitly because it is the one thing a node cannot work
+                    // out for itself, and getting it wrong costs an attempt per lap.
+                    retryable: false,
+                    action: 'report this job as failed; it cannot succeed on a retry',
+                },
+            });
+        }
+    }
+    /**
+     * Refuses any field the node is not permitted to choose — today, anything
+     * beyond `contentType` and `claimToken`.
+     *
+     * The `key` case is the one that matters and the message says so by name.
+     * Everything else is caught by the same net rather than by a growing list of
+     * individual checks: a field this endpoint does not understand is a field
+     * the node believes has an effect and which is having none, and that belief
+     * is the bug. Naming the offending keys turns "my output went somewhere
+     * else" into "the server told me on the first run".
+     *
+     * ⚠ THIS ALLOWLIST IS THE AUTHORITY, NOT THE ZOD SCHEMA, which is why
+     * `claimToken` had to be added in two places when #364 threaded it through
+     * this route. `nodeUploadUrlSchema` is a `z.looseObject` precisely so
+     * unknown keys survive the parse and can be refused BY NAME here; a field
+     * described there but missing from this set is therefore not permissive, it
+     * is a 400 on every request that sends it. `claimToken` belongs in the set
+     * for the same reason `contentType` does: it is a thing a node may say. The
+     * difference — that it asks for nothing and can only get the caller refused
+     * — is argued in `claim-token.field.ts`, not re-argued here.
+     */
+    rejectCallerSuppliedFields(job, dto) {
+        const permitted = new Set(['contentType', 'claimToken']);
+        const offending = Object.keys(dto ?? {}).filter((key) => !permitted.has(key));
+        if (offending.length === 0) {
+            return;
+        }
+        this.logger.warn(`Node upload request for job ${job.id} carried field(s) it may not set: ` +
+            `[${offending.join(', ')}]. Refused.`);
+        throw new common_1.BadRequestException({
+            message: `This request carried field(s) a node may not set: ${offending.join(', ')}. ` +
+                `The storage key for a node's output is chosen by the server — a node-supplied key ` +
+                `would be an unconditional overwrite of any object in the bucket. Send no key; the ` +
+                `one the server chose is returned as "key" in a successful response.`,
+            details: { jobId: job.id, rejectedFields: offending, permittedFields: [...permitted] },
+        });
+    }
+    /**
+     * How long a node-facing signed URL lives, clamped into
+     * `[NODE_SIGNED_URL_MIN_TTL_SECONDS, NODE_SIGNED_URL_MAX_TTL_SECONDS]`.
+     *
+     * READS THE APPLICATION SETTING AND THEN OVERRIDES IT DOWNWARD, which is
+     * deliberate rather than lazy. An operator who shortens
+     * `SIGNED_URL_EXPIRY` for the interactive API means it for the fleet too, so
+     * the setting is honoured when it is stricter; an operator who lengthens it
+     * to an hour for browser downloads did not mean "hand hour-long bucket
+     * capabilities to unattended machines", so the ceiling wins. There is no
+     * separate node-only environment variable, because a second knob is a second
+     * thing to get wrong and its only correct values are already inside this
+     * range.
+     */
+    resolveTtlSeconds() {
+        const configured = this.config.get('storage.signedUrlExpiry', exports.NODE_SIGNED_URL_MAX_TTL_SECONDS);
+        const seconds = Number.isFinite(configured)
+            ? Math.floor(configured)
+            : exports.NODE_SIGNED_URL_MAX_TTL_SECONDS;
+        return Math.min(exports.NODE_SIGNED_URL_MAX_TTL_SECONDS, Math.max(exports.NODE_SIGNED_URL_MIN_TTL_SECONDS, seconds));
+    }
+};
+exports.NodeDataPlaneService = NodeDataPlaneService;
+exports.NodeDataPlaneService = NodeDataPlaneService = NodeDataPlaneService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(3, (0, common_1.Inject)(ports_1.NODE_OBJECT_STORE)),
+    __param(5, (0, common_1.Inject)(ports_1.NODE_JOB_INPUTS)),
+    __metadata("design:paramtypes", [Object, config_1.ConfigService,
+        nodes_service_1.NodesService, Object, index_2.JobHandlerRegistry, Object])
+], NodeDataPlaneService);
+//# sourceMappingURL=node-data-plane.service.js.map

package/dist/nodes/node-data-plane.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-data-plane.service.js","sourceRoot":"","sources":["../../src/nodes/node-data-plane.service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,kEAAkE;AAClE,0BAA0B;AAC1B,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,gBAAgB;AAChB,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,6EAA6E;AAC7E,mEAAmE;AACnE,6EAA6E;AAC7E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,oEAAoE;AACpE,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,EAAE;AACF,wEAAwE;AACxE,sDAAsD;AACtD,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,qDAAqD;AACrD,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAMwB;AACxB,2CAA+C;AAE/C,yCAAgD;AAChD,6CAAyC;AAEzC,yCAAmD;AACnD,mCAMiB;AAOjB,mDAA+C;AAE/C;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,+BAA+B,GAAG,GAAG,CAAC;AAEnD;;;;;;;;GAQG;AACU,QAAA,+BAA+B,GAAG,EAAE,CAAC;AAElD;;;;;;;GAOG;AACH,iEAAiE;AACjE,8EAA8E;AAC9E,wDAAwD;AACxD,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,iDAAiD;AACjD;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,cAAc,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD;;;;GAIG;AAEI,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAIa;IACzB;IACA;IAKA;IAKA;IAEA;IAjBF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAC4C,MAAkB,EAC3C,MAAqB,EACrB,KAAmB,EAKnB,OAAwB;IACzC,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IACjD,QAA4B,EAE5B,MAAqB;QAdI,WAAM,GAAN,MAAM,CAAY;QAC3C,WAAM,GAAN,MAAM,CAAe;QACrB,UAAK,GAAL,KAAK,CAAc;QAKnB,YAAO,GAAP,OAAO,CAAiB;QAKxB,aAAQ,GAAR,QAAQ,CAAoB;QAE5B,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ,8EAA8E;IAC9E,oBAAoB;IACpB,8EAA8E;IAE9E;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,MAAc,EACd,KAAa,EACb,GAAuB;QAEvB,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,uEAAuE;QACvE,yEAAyE;QACzE,2CAA2C;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE;YACrE,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,YAAY,SAAS,0BAA0B,MAAM,YAAY,GAAG,CAAC,EAAE,GAAG;YACxE,IAAI,GAAG,CAAC,IAAI,qBAAqB,MAAM,CAAC,EAAE,EAAE,CAC/C,CAAC;QAEF,OAAO;YACL,GAAG;YACH,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAChE,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,MAAc,EACd,KAAa,EACb,GAAqB;QAErB,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAExF,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAE1C,2EAA2E;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,GAAG,GACP,CAAC,MAAM,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;YACvC,GAAG,8BAAsB,IAAI,GAAG,CAAC,EAAE,IAAI,IAAA,wBAAU,GAAE,EAAE,CAAC;QAExD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,2DAA2D;YAC3D,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,kDAAkD;YAClD,EAAE;YACF,mEAAmE;YACnE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,qBAAqB;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wBAAwB,GAAG,CAAC,IAAI,0CAA0C,GAAG,CAAC,EAAE,IAAI;gBAClF,gEAAgE,CACnE,CAAC;YAEF,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,CAAC,EAAE,wCAAwC,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YAClD,SAAS;YACT,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,YAAY,SAAS,wBAAwB,MAAM,YAAY,GAAG,CAAC,EAAE,GAAG;YACtE,IAAI,GAAG,CAAC,IAAI,UAAU,GAAG,EAAE,CAC9B,CAAC;QAEF,OAAO;YACL,GAAG;YACH,GAAG;YACH,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SACjE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,YAAY,CAAC,GAAQ;QACjC,IAAI,CAAC;YACH,sEAAsE;YACtE,wEAAwE;YACxE,4BAA4B;YAC5B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,yBAAiB,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,OAAO,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,8BAA8B,KAAK,CAAC,OAAO,EAAE,CACxE,CAAC;YAEF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE;oBACP,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,iEAAiE;oBACjE,iEAAiE;oBACjE,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,yDAAyD;iBAClE;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,0BAA0B,CAAC,GAAQ,EAAE,GAAqB;QAChE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+BAA+B,GAAG,CAAC,EAAE,oCAAoC;YACvE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CACxC,CAAC;QAEF,MAAM,IAAI,4BAAmB,CAAC;YAC5B,OAAO,EACL,qDAAqD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC7E,oFAAoF;gBACpF,oFAAoF;gBACpF,qEAAqE;YACvE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE;SACvF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,iBAAiB;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAChC,yBAAyB,EACzB,uCAA+B,CAChC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YACxB,CAAC,CAAC,uCAA+B,CAAC;QAEpC,OAAO,IAAI,CAAC,GAAG,CACb,uCAA+B,EAC/B,IAAI,CAAC,GAAG,CAAC,uCAA+B,EAAE,OAAO,CAAC,CACnD,CAAC;IACJ,CAAC;CACF,CAAA;AAnVY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IAMvB,WAAA,IAAA,eAAM,EAAC,yBAAiB,CAAC,CAAA;IAOzB,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;6CAZC,sBAAa;QACd,4BAAY,UAUT,0BAAkB;GAhBpC,oBAAoB,CAmVhC"}

package/dist/nodes/node-fleet-metrics.service.d.ts

@@ -0,0 +1,85 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { BatchObservableResult, ObservableGauge } from '@opentelemetry/api';
+import { MetricsHostService } from '../otel-core/index';
+/** How long one fleet snapshot is reused across collections and callbacks (the app gauges' TTL). */
+export declare const GAUGE_CACHE_TTL_MS = 30000;
+import { NodeOffloadService } from '../jobs/index';
+import { type JobsPrisma } from '../jobs/index';
+import { NodeLifecycleService, type NodeHealth } from './node-lifecycle.service';
+/** Vitals older than this many stale windows are not exported. */
+export declare const VITALS_FRESHNESS_MULTIPLIER = 3;
+/** At most this many nodes' vitals are exported per collection (newest vitals first). */
+export declare const MAX_EXPORTED_NODES = 200;
+/** Node-reported cumulative counter key → the `counter` label value. */
+export declare const NODE_COUNTER_LABELS: Readonly<Record<string, string>>;
+/** The numeric vitals, already in the exported unit. */
+export interface ExportedVitals {
+    cpuUtilization?: number;
+    memoryRssBytes?: number;
+    heapUsedBytes?: number;
+    heapLimitBytes?: number;
+    eventLoopDelayP99Seconds?: number;
+    stateDirFreeBytes?: number;
+    stateDirTotalBytes?: number;
+    slotsUsed?: number;
+    slotsTotal?: number;
+    uptimeSeconds?: number;
+    counters: Array<{
+        counter: string;
+        value: number;
+    }>;
+}
+export interface FleetSnapshot {
+    counts: Array<{
+        status: string;
+        health: NodeHealth;
+        count: number;
+    }>;
+    nodes: Array<{
+        nodeId: string;
+        nodeName: string;
+        vitals: ExportedVitals;
+    }>;
+    /** `null` when the offered-type list could not be read. */
+    noEligibleNode: Array<{
+        jobType: string;
+        value: 0 | 1;
+    }> | null;
+}
+type Gauges = Record<'count' | 'cpu' | 'rss' | 'heapUsed' | 'heapLimit' | 'eventLoop' | 'stateFree' | 'stateTotal' | 'slotsUsed' | 'slotsTotal' | 'uptime' | 'counter' | 'noEligibleNode', ObservableGauge>;
+/**
+ * A stored `last_vitals` document, read tolerantly field by field (it was
+ * validated by `nodeVitalsSchema` on the way in, but a row written by an older
+ * or newer API must never break a collection).
+ */
+export declare function exportedVitals(raw: unknown): ExportedVitals;
+/** An operator-chosen node name as a label value (see the header). */
+export declare function nodeNameLabel(name: unknown): string;
+export declare class NodeFleetMetrics implements OnModuleInit {
+    private readonly prisma;
+    private readonly lifecycle;
+    private readonly offload;
+    private readonly logger;
+    private readonly metrics;
+    private registered;
+    private context;
+    private cache;
+    private inFlight;
+    constructor(prisma: JobsPrisma, lifecycle: NodeLifecycleService, offload: NodeOffloadService, metrics?: MetricsHostService);
+    onModuleInit(): void;
+    /** Registers the fleet gauges once, only when `AppMetricsService` says gauges are on. */
+    registerGauges(): void;
+    /** Every fleet gauge, with the name, unit and description the app-metric registry declares for it. */
+    private createGauges;
+    /** The batch callback. Never throws; observes nothing when the snapshot is unavailable. */
+    observe(result: BatchObservableResult, gauges: Gauges): Promise<void>;
+    /**
+     * The cached snapshot: `null` while the export gate is closed (nothing is
+     * queried) or when the read failed; reused for `GAUGE_CACHE_TTL_MS`, one
+     * read in flight.
+     */
+    snapshot(): Promise<FleetSnapshot | null>;
+    private read;
+}
+export {};
+//# sourceMappingURL=node-fleet-metrics.service.d.ts.map

package/dist/nodes/node-fleet-metrics.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-fleet-metrics.service.d.ts","sourceRoot":"","sources":["../../src/nodes/node-fleet-metrics.service.ts"],"names":[],"mappings":"AAoFA,OAAO,EAAsB,YAAY,EAAoB,MAAM,gBAAgB,CAAC;AACpF,OAAO,KAAK,EAAE,qBAAqB,EAAS,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAExF,OAAO,EACL,kBAAkB,EAMnB,MAAM,oBAAoB,CAAC;AAE5B,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAoB,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEnG,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAStC,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWhE,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IAC3E,2DAA2D;IAC3D,cAAc,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACjE;AAED,KAAK,MAAM,GAAG,MAAM,CAChB,OAAO,GACP,KAAK,GACL,KAAK,GACL,UAAU,GACV,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,gBAAgB,EAClB,eAAe,CAChB,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAyB3D;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAOnD;AAUD,qBACa,gBAAiB,YAAW,YAAY;IAUxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,OAAO,CAAgC;IAC/C,OAAO,CAAC,KAAK,CAAqD;IAClE,OAAO,CAAC,QAAQ,CAA8C;gBAGlB,MAAM,EAAE,UAAU,EAC3C,SAAS,EAAE,oBAAoB,EAC/B,OAAO,EAAE,kBAAkB,EAChC,OAAO,CAAC,EAAE,kBAAkB;IAK1C,YAAY,IAAI,IAAI;IAIpB,yFAAyF;IACzF,cAAc,IAAI,IAAI;IAmBtB,sGAAsG;IACtG,OAAO,CAAC,YAAY;IAoBpB,2FAA2F;IACrF,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwC3E;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAyBjC,IAAI;CAqGnB"}