@mcsherrylabs/pi-meerkat 0.7.0 → 0.8.0

package/dist/installer-runtime/dist/src/runtime.js

@@ -0,0 +1,164 @@
+// Meerkat composition root for the shared processor, not a second collector/runtime.
+// All paths/capabilities are operator-fixed here; requests can supply only a channel id.
+import { join } from "node:path";
+import { dockerNodeRestarter, nodeObserver, nodePuller, startControlServer, startProcessor, startReadServer, subscriptionConfig, subscriptionController, } from "@mcsherrylabs/evolver-client/processor";
+import { ensureStateDir } from "./env.js";
+const productionSdk = {
+    dockerNodeRestarter, nodeObserver, nodePuller, startControlServer, startProcessor,
+    startReadServer, subscriptionConfig, subscriptionController,
+};
+export function processorBinding() {
+    return { chainId: process.env.EVOLVER_CHAIN_ID?.trim() ?? "", nodeId: process.env.APP_NODE_ID?.trim() ?? "" };
+}
+export function processorConfigPath(target) {
+    return process.env.EVOLVER_SUBSCRIPTIONS_FILE?.trim() || join(target.stateDir, "subscriptions", "channels.conf");
+}
+export function processorStatePath(target) {
+    return join(target.stateDir, "registry.db");
+}
+export async function startMeerkatProcessor(args, sdk = productionSdk) {
+    const binding = processorBinding();
+    // Synchronous SDK validation of fixed expectations, NOT an online-node startup dependency.
+    const observe = sdk.nodeObserver({ baseUrl: args.target.nodeUrl, binding });
+    const config = sdk.subscriptionConfig(processorConfigPath(args.target));
+    await config.read(); // missing/malformed declaration refuses before opening storage; never reseed
+    let initialized = false;
+    ensureStateDir(args.target);
+    const runtime = await sdk.startProcessor({
+        store: {
+            path: processorStatePath(args.target), binding,
+            modules: args.worker ? [args.worker] : [],
+            limits: { maxEntriesPerChannel: 1000, maxBodyBytes: 64 * 1024 * 1024 },
+        },
+        puller: sdk.nodePuller(args.node), config,
+        // SDK initialization normally attempts setup (which can pace). Defer that attempt until
+        // the caller explicitly paces/runs: service composition binds recovery listeners first.
+        // Every subsequent pace still uses the SDK's verified node/chain/ACTIVE gate.
+        observe: async () => {
+            if (!initialized)
+                throw new Error("Meerkat listeners not started; collection deferred");
+            return observe();
+        },
+        tip: async () => String(await args.node.currentRound()),
+        modules: args.lifecycle ? [args.lifecycle] : [], say: args.say,
+    }).catch(error => {
+        if (error?.name === "ProcessorOwnerLockError") {
+            args.say(error.message);
+            args.say("MANUAL FORCE RECOVERY REQUIRED if the owner has died. Using the SAME Compose project/env/files/volumes: 1) docker compose stop app; stop any other collectors and disable all external automatic restarts. 2) Only when fenced: docker compose run --rm --no-deps app node dist/scripts/recover-owner.js --force. 3) docker compose up -d --no-deps app. For a host-run app, stop it and its supervisor first, then run node dist/scripts/recover-owner.js --force with the SAME target/state environment and restart normally. Ordinary restart or --force-recreate does NOT clear the lock. Never delete database/WAL or reinitialize subscriptions.");
+        }
+        throw error;
+    });
+    initialized = true;
+    return runtime;
+}
+/** Always attempt every release, including when another close fails. */
+export async function closeMeerkat(actions) {
+    const errors = [];
+    for (const action of actions) {
+        try {
+            await action();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    if (errors.length)
+        throw new AggregateError(errors, "Meerkat shutdown failed");
+}
+export async function startMeerkatServers(args, sdk = productionSdk) {
+    const servers = [];
+    try {
+        servers.push(await sdk.startReadServer({
+            store: args.runtime.store, port: args.port,
+            host: process.env.PROCESSOR_READ_HOST?.trim() || "127.0.0.1", routes: args.routes, say: args.say,
+        }));
+        const containerName = process.env.EVOLVER_MANAGED_NODE_CONTAINER?.trim();
+        const socketPath = process.env.EVOLVER_PROCESSOR_CONTROL_SOCKET?.trim() || (containerName ? "/control/control.sock" : undefined);
+        const dockerSocket = containerName ? "/var/run/docker.sock" : undefined;
+        if (socketPath || dockerSocket || containerName) {
+            if (!socketPath || !dockerSocket || !containerName)
+                throw new Error("managed control requires explicit control socket, Docker socket and fixed node container");
+            const binding = processorBinding();
+            const controller = sdk.subscriptionController({
+                binding, runtime: args.runtime, config: sdk.subscriptionConfig(processorConfigPath(args.target)),
+                observe: sdk.nodeObserver({ baseUrl: args.target.nodeUrl, binding }),
+                restart: sdk.dockerNodeRestarter({ socketPath: dockerSocket, containerName }),
+            });
+            servers.push(await sdk.startControlServer({ socketPath, mode: 0o660, controller, say: args.say }));
+        }
+        return { port: servers[0].port, close: () => closeMeerkat([...servers].reverse().map(server => () => server.close())) };
+    }
+    catch (error) {
+        try {
+            await closeMeerkat(servers.reverse().map(server => () => server.close()));
+        }
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], "Meerkat listener startup failed");
+        }
+        throw error;
+    }
+}
+/** One service owner: bind listeners before run/setup, and release the worker on partial bind. */
+export async function startMeerkatService(args, sdk = productionSdk) {
+    const runtime = await startMeerkatProcessor(args, sdk);
+    let servers;
+    try {
+        servers = await startMeerkatServers({ ...args, runtime, routes: args.routes(runtime) }, sdk);
+        runtime.run();
+        let stopping;
+        return { runtime, port: servers.port, stop() {
+                return stopping ??= closeMeerkat([() => servers.close(), () => runtime.stop()]);
+            } };
+    }
+    catch (error) {
+        try {
+            await closeMeerkat([...(servers ? [() => servers.close()] : []), () => runtime.stop()]);
+        }
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], "Meerkat service startup failed");
+        }
+        throw error;
+    }
+}
+/** Signals and normal/error completion share one cleanup path, including partial async startup. */
+export function meerkatShutdown(signals = process) {
+    let stopping;
+    const releases = [];
+    const stop = () => stopping ??= closeMeerkat([...releases].reverse());
+    const onSignal = () => { void stop().then(() => signals.exit(0), error => { console.error(error); signals.exit(1); }); };
+    signals.once("SIGINT", onSignal);
+    signals.once("SIGTERM", onSignal);
+    return {
+        async own(start, release) {
+            if (stopping)
+                throw new Error("Meerkat stopped during startup");
+            const pending = start();
+            // Register before awaiting so a signal DURING startup waits for and releases its result.
+            releases.push(async () => {
+                let resource;
+                try {
+                    resource = await pending;
+                }
+                catch {
+                    return;
+                } // startup owns its partial cleanup
+                await release(resource);
+            });
+            const resource = await pending;
+            if (stopping) {
+                await stopping;
+                throw new Error("Meerkat stopped during startup");
+            }
+            return resource;
+        },
+        async close() {
+            try {
+                await stop();
+            }
+            finally {
+                signals.removeListener("SIGINT", onSignal);
+                signals.removeListener("SIGTERM", onSignal);
+            }
+        },
+    };
+}

package/dist/installer-runtime/dist/src/store.js

@@ -0,0 +1,138 @@
+// ── application state: the identities this app owns, per target ─────────────
+//
+// This is the whole of "application state" for the template. A real app's state is bigger
+// (a message log, a cursor, derived balances) but it has the same two properties, and they
+// are the ones that matter:
+//
+//   1. It is PER TARGET. Keys for an identity on the local chain are meaningless on devnet,
+//      so they live in separate directories and never mix.
+//   2. It is DISPOSABLE, but not free. Deleting it does not remove anything from a chain —
+//      the identities remain committed forever. It only means we no longer hold their keys,
+//      i.e. we have ABANDONED them. That is fine on an ephemeral local chain and permanent
+//      on devnet, which is why the reset command says so out loud for devnet.
+//
+// Private keys are written here in plain hex, which is correct for a development template
+// and wrong for anything else. A real app keeps them in an OS keychain, or behind the SDK's
+// Signer handle so the scalar never reaches application code at all (see the evolver repo's
+// key-isolation work). Said here rather than in a README because this is the file someone
+// copies.
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { newIdentity, edSign } from "@mcsherrylabs/evolver-client";
+import { ensureStateDir } from "./env.js";
+const FILE = "identities.json";
+const VERSION = 1;
+/** State that exists but cannot be trusted: malformed, wrong version, or belonging to another
+ *  target. A distinct type because the CALLERS want different things from it — the app must
+ *  refuse and say why, `status` must report it, `state:reset` must delete it anyway — and
+ *  because the fix is always the same one sentence, which is worth saying instead of a stack
+ *  trace naming a line of store.ts. */
+export class StateError extends Error {
+}
+const hex = (b) => Buffer.from(b).toString("hex");
+const bin = (s) => new Uint8Array(Buffer.from(s, "hex"));
+// READ path — must NOT create anything. `ensureStateDir` mkdirs, so calling it here made
+// merely LOOKING at state (npm run status, which inspects every target) create both state
+// directories as a side effect. Reads resolve the path; only writes create the directory.
+function pathFor(t) { return join(t.stateDir, FILE); }
+function load(t) {
+    try {
+        const f = JSON.parse(readFileSync(pathFor(t), "utf8"));
+        if (f.v !== VERSION)
+            throw new StateError(`state version ${f.v}, expected ${VERSION}`);
+        // A state file that names a DIFFERENT target means the directories got crossed — refuse
+        // rather than hand the app keys for a chain it is not talking to, which would fail later
+        // as an inscrutable `invalid_signature`.
+        if (f.target !== t.name) {
+            throw new StateError(`state in ${t.stateDir} belongs to target '${f.target}', not '${t.name}'`);
+        }
+        return f;
+    }
+    catch (e) {
+        if (e.code === "ENOENT") {
+            return { v: VERSION, target: t.name, identities: {} };
+        }
+        if (e instanceof StateError)
+            throw e;
+        // Anything else reaching here (a truncated file, hand-editing, a JSON syntax error) is the
+        // same problem with the same fix, so it arrives at callers as the same type rather than as
+        // a raw SyntaxError that surfaces to the user as a stack trace.
+        throw new StateError(`${pathFor(t)} is not readable as state — ${e.message}`);
+    }
+}
+// WRITE path — the only place that creates the directory, and the only place that needs to.
+function save(t, f) {
+    const dest = join(ensureStateDir(t), FILE);
+    // Write-then-rename, and mode 0600. These keys are the only thing standing between this
+    // app and its on-chain identities: a crash or a full disk mid-write would otherwise leave
+    // a truncated JSON file that no longer parses, i.e. the keys are gone — and on an
+    // ephemeral local chain that is an annoyance, on devnet it is permanent. rename(2) within
+    // one directory is atomic, so a reader sees the old file or the new one, never a partial.
+    const tmp = `${dest}.tmp`;
+    writeFileSync(tmp, JSON.stringify(f, null, 2) + "\n", { mode: 0o600 });
+    renameSync(tmp, dest);
+}
+/** Identity for `role` from this target's state, or null if we do not hold one. */
+export function get(t, role) {
+    const s = load(t).identities[role];
+    if (!s)
+        return null;
+    return {
+        nodeId: s.nodeId,
+        bls: { priv: bin(s.blsPriv), pub: bin(s.blsPub) },
+        ed: { priv: bin(s.edPriv), pub: bin(s.edPub) },
+    };
+}
+/** Create a fresh identity for `role`, persist it, return it. */
+export function create(t, role, nodeId) {
+    const id = newIdentity(nodeId);
+    const f = load(t);
+    f.identities[role] = {
+        nodeId: id.nodeId,
+        blsPriv: hex(id.bls.priv), blsPub: hex(id.bls.pub),
+        edPriv: hex(id.ed.priv), edPub: hex(id.ed.pub),
+    };
+    save(t, f);
+    return id;
+}
+export function roles(t) {
+    return Object.keys(load(t).identities);
+}
+export function summary(t) {
+    const f = load(t);
+    return Object.entries(f.identities).map(([role, s]) => ({ role, nodeId: s.nodeId }));
+}
+/** What `status` uses. NEVER throws.
+ *
+ *  `load` is deliberately strict — a state file that is malformed, versioned wrong, or
+ *  belongs to another target must stop the APP rather than let it run with keys it cannot
+ *  trust. But `status` is the command you are told to run FIRST when something is wrong, and
+ *  a first-aid command that dies with a stack trace on exactly the state it exists to
+ *  describe is worse than useless. So the strictness stays where it belongs and `status`
+ *  reads through this: the problem becomes a line of output, in the place that names the
+ *  state that has it. */
+export function inspect(t) {
+    if (!existsSync(pathFor(t)))
+        return { ids: [] };
+    try {
+        return { ids: summary(t) };
+    }
+    catch (e) {
+        return { ids: [], problem: e.message };
+    }
+}
+/**
+ * A signer over a stored identity's Ed25519 key.
+ *
+ * HERE because this is where identities live, and because three callers now need one — the
+ * app, the registry and the rig's announcer. It was a private function in app.ts, and the
+ * third caller reaching for `store.signerFor` (which did not exist) is exactly the moment to
+ * stop copying it: two implementations of one rule is one too many, and the second is the one
+ * that goes stale.
+ *
+ * The private half never leaves this module's caller: the signer closes over it and exposes
+ * only `sign`, which is the handle discipline the key-isolation audit established.
+ */
+export function signerFor(id) {
+    return { keyType: "Ed25519", keyLabel: "", nodeId: "", sign: (d) => edSign(d, id.ed.priv) };
+}

package/dist/installer-runtime/package.json

@@ -0,0 +1 @@
+{"name":"evolver-meerkat","type":"module","private":true}

package/dist/installer.d.ts

@@ -0,0 +1,224 @@
+export interface Installation {
+    version: 1;
+    uid: number;
+    id: string;
+    dir: string;
+    project: string;
+    nodeId: string;
+    committeeId: string;
+    identity: string;
+    registryOperator: string;
+    channel: string;
+    ports: [number, number, number];
+    packageVersion: string;
+    daemonId: string;
+    initialization: 'pending' | 'attempted' | 'complete';
+    ready?: true;
+    binding?: {
+        chainId: string;
+        nodeId: string;
+    };
+}
+export interface InstallerDeps {
+    command(command: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): Promise<string>;
+    committeeReady(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
+    nodeBinding(state: Installation, env: NodeJS.ProcessEnv): Promise<{
+        chainId: string;
+        nodeId: string;
+    }>;
+    registryReady(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
+    bootstrap(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
+}
+export declare function managedDirectory(env?: NodeJS.ProcessEnv): string;
+export declare const managedConfigPath: (env?: NodeJS.ProcessEnv) => string;
+export declare function pinnedRegistration(version: string): {
+    mcpServers: {
+        meerkat: {
+            command: string;
+            args: string[];
+        };
+    };
+};
+export declare function renderDeployment(state: Installation): {
+    name: string;
+    services: {
+        committee: {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            container_name: string;
+            build: {
+                context: string;
+                dockerfile: string;
+                labels: {
+                    "io.meerkat.installation": string;
+                };
+                args: {
+                    EVOLVER_NODE_IMAGE: string;
+                };
+            };
+            entrypoint: string[];
+            environment: {
+                NODE_ID: string;
+                PUBLIC_HOST: string;
+            };
+            group_add: string[];
+            volumes: string[];
+            restart: string;
+        };
+        node: {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            container_name: string;
+            entrypoint: string[];
+            build: {
+                context: string;
+                dockerfile: string;
+                labels: {
+                    "io.meerkat.installation": string;
+                };
+                args: {
+                    EVOLVER_NODE_IMAGE: string;
+                };
+            };
+            environment: {
+                APP_NODE_ID: string;
+                DEVNET_API: string;
+                EVOLVER_UPSTREAM_NODE_ID: string;
+                EVOLVER_ALLOWED_OUTBOUND: string;
+                EVOLVER_EXECUTION_ENABLED: string;
+                EVOLVER_NODE_PORT: string;
+                CLAIM_TIMEOUT: string;
+                CLAIM_WATCH_SECS: string;
+            };
+            group_add: string[];
+            volumes: string[];
+            restart: string;
+        };
+        registry: {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            container_name: string;
+            build: {
+                context: string;
+                dockerfile: string;
+                labels: {
+                    "io.meerkat.installation": string;
+                };
+            };
+            user: string;
+            environment: {
+                EVOLVER_TARGET: string;
+                EVOLVER_NODE: string;
+                EVOLVER_FAUCET_URL: string;
+                EVOLVER_CHAIN_ID: string;
+                APP_NODE_ID: string;
+                EVOLVER_SUBSCRIPTIONS_FILE: string;
+                REGISTRY_CHANNEL: string;
+                REGISTRY_CHANNEL_OPERATOR: string;
+                REGISTRY_CONTENT_URL: string;
+                PROCESSOR_HTTP_PORT: string;
+                PROCESSOR_READ_HOST: string;
+            };
+            volumes: string[];
+            restart: string;
+        };
+        'subscriptions-init': {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            profiles: string[];
+            user: string;
+            environment: {
+                EVOLVER_INITIAL_CHANNELS: string;
+                EVOLVER_OPERATOR_UID: string;
+                EVOLVER_OPERATOR_GID: string;
+                EVOLVER_TARGET: string;
+                EVOLVER_NODE: string;
+                EVOLVER_FAUCET_URL: string;
+                EVOLVER_CHAIN_ID: string;
+                APP_NODE_ID: string;
+                EVOLVER_SUBSCRIPTIONS_FILE: string;
+                REGISTRY_CHANNEL: string;
+                REGISTRY_CHANNEL_OPERATOR: string;
+                REGISTRY_CONTENT_URL: string;
+                PROCESSOR_HTTP_PORT: string;
+                PROCESSOR_READ_HOST: string;
+            };
+            entrypoint: string[];
+            command: string[];
+            volumes: string[];
+        };
+    };
+    volumes: {
+        'committee-data': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        genesis: {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'node-data': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'app-state': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        subscriptions: {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'agent-state': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+    };
+    networks: {
+        default: {
+            name: string;
+            internal: boolean;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+    };
+};
+export declare function operatorEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function managedInstallation(env?: NodeJS.ProcessEnv): Promise<Installation | undefined>;
+/** Protocol-only stdio bridge, one new facade/private child/session per harness connection.
+ * Docker exec works even when daemon and harness share neither filesystem nor loopback. */
+export declare function serveManaged(state: Installation, env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function installMeerkat(env?: NodeJS.ProcessEnv, deps?: InstallerDeps): Promise<{
+    dir: string;
+    configPath: string;
+    registration: {
+        mcpServers: {
+            meerkat: {
+                command: string;
+                args: string[];
+            };
+        };
+    };
+}>;
+//# sourceMappingURL=installer.d.ts.map

package/dist/installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IACvG,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACvI,cAAc,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnH;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AACD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI7E;AACD,eAAO,MAAM,iBAAiB,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,MAA0D,CAAC;AACpI,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM;;;;;;;EAGjD;AACD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsCnD;AA2BD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAK7E;AAwDD,wBAAsB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAOjH;AACD;2FAC2F;AAC3F,wBAAsB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC3G;AACD,wBAAsB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,GAAE,aAAwB;;;;;;;;;;;GAiFxG"}