@namzu/sandbox 13.0.0 → 14.0.0

package/dist/backends/kubernetes/workspace.d.ts

@@ -0,0 +1,381 @@
+/**
+ * The persistent workspace: a Sandbox that keeps its disk across suspends.
+ *
+ * A task sandbox (`index.ts`) is claimed, used and deleted inside one run. A
+ * workspace is the opposite object: it is created once, addressed by a name
+ * the CALLER chooses, suspended when nobody is using it, resumed days later
+ * with yesterday's dependency cache and git checkout still on its disk, and
+ * deleted only when someone says so.
+ *
+ * ## Why this is a directly created Sandbox and never a claim
+ *
+ * `Sandbox.spec.volumeClaimTemplates` is CEL-immutable on the served CRD
+ * ("volumeClaimTemplates is immutable"), and a `SandboxClaim` that carries
+ * `spec.volumeClaimTemplates` is forced to cold-start instead of adopting a
+ * warm pool sandbox. So the disk has to be in the spec at creation, and the
+ * appealing middle road — claim a warm diskless sandbox and attach a disk to
+ * it — is not expressible in this API at all. A workspace is therefore a
+ * `Sandbox` POSTed directly, with a deterministic name, and the warm pool has
+ * nothing to do with it.
+ *
+ * ## Block, not a filesystem
+ *
+ * The disk must be `volumeMode: Block`, consumed through the container's
+ * `volumeDevices`, and this module REFUSES a template whose disk is anything
+ * else. Under a VM-isolating RuntimeClass a `Filesystem` PVC reaches the guest
+ * through a host/guest filesystem passthrough (virtio-fs), whose per-file
+ * overhead lands squarely on the two things a workspace does all day: walking
+ * a dependency tree and touching thousands of small files. Nothing FAILS; the
+ * workspace is merely several times slower, and no functional test can see
+ * that. A raw block device the guest formats and mounts itself is an ordinary
+ * local filesystem inside the VM. See {@link KubernetesWorkspaceDiskError}.
+ *
+ * ## No lease
+ *
+ * Every task sandbox carries `shutdownTime` + `shutdownPolicy: Delete`, so a
+ * host that dies mid-run costs the cluster one expiry rather than a leak, and
+ * its handle renews that expiry for as long as it lives. A workspace carries
+ * NEITHER. An expiry on a workspace is a timer that deletes a caller's files,
+ * and a renewal loop makes losing them conditional on a host process staying
+ * up — exactly backwards for an object whose whole purpose is to outlive the
+ * host. A workspace is explicitly managed: it goes away when
+ * `destroy({ deleteDisk: true })` says so, and not before.
+ *
+ * ## Suspend, resume, and what changes across one
+ *
+ * `suspend()` merge-PATCHes `spec.operatingMode: Suspended`; the controller
+ * deletes only the Pod and reconciles PVCs unconditionally on every pass, so
+ * the disk survives with the same UID. It then waits on the POD — not on the
+ * Sandbox's `Suspended` condition, which upstream documents as lingering True
+ * after a resume, and not merely on a `deletionTimestamp`, which appears
+ * while the guest is still running. `resume()` PATCHes it back and waits
+ * for a new pod — and a resumed pod keeps the sandbox's NAME while getting a
+ * new uid and a new IP. Both matter: the uid is the agent's bind token, and
+ * the IP is where the agent answers. So resume re-resolves the address, re-
+ * reads the uid (skipping the outgoing pod, which is still listed under the
+ * same name while it terminates) and rebuilds the transport. Nothing from
+ * before the suspend is reused.
+ *
+ * Between the two, every call refuses with
+ * {@link KubernetesWorkspaceSuspendedError} and issues no dial. A dial would
+ * be worse than useless: the address still resolves — the Service outlives
+ * the pod — so the call would hang until a connect timeout with nothing in
+ * the failure naming the suspend.
+ *
+ * ## Adoption is checked against the object, not against the caller
+ *
+ * A create that collides with an existing object of the same name ADOPTS it,
+ * because the deterministic name is only worth having if coming back is the
+ * normal path. What is adopted is then checked against the configuration: the
+ * block disk, the `sandbox.namzu.ai/template` pod label (the label an egress
+ * NetworkPolicy selects by) and `runtimeClassName` (the VM boundary). A
+ * standing object that disagrees with any of them is refused by name rather
+ * than driven — see {@link KubernetesWorkspaceMismatchError}. What is NOT
+ * checked, and cannot be from here, is whether somebody else is already using
+ * it: two host processes can hold handles to one running workspace, and the
+ * `destroy()` of either suspends the pod the other is executing in. A
+ * workspace id is a name, not a lock.
+ *
+ * ## There is no delete-compute-keep-disk verb
+ *
+ * The API has `operatingMode` and it has DELETE. Nothing in between. So
+ * `destroy()` with no options, or `deleteDisk: false`, SUSPENDS and leaves
+ * the object standing; only `destroy({ deleteDisk: true })` DELETEs the
+ * Sandbox, which cascades to the Pod, the Service and the PVC through
+ * ownerReferences. The default is the non-destructive one because `destroy()`
+ * is what a `finally` block calls, and a `finally` block must not be able to
+ * erase a workspace nobody asked to erase.
+ *
+ * The same holds for the paths nobody asked for at all. A create or resume
+ * that fails suspends the object and rethrows rather than cleaning it up (see
+ * {@link createKubernetesWorkspace}), and a pod that stops being able to say
+ * what happened to a command — the shared execution controller's unconfirmed
+ * cancellation, which retires a task sandbox by DELETING it — is retired here
+ * by that same suspend patch (see {@link retireSession}). Exactly one DELETE
+ * is reachable from this module, and it is the one `deleteDisk: true` asks
+ * for.
+ *
+ * ## A state is committed when the cluster confirms it, never before
+ *
+ * Both verbs are idempotent, and both are idempotent by EARLY-RETURNING on a
+ * state. That makes the moment a state is written the whole correctness
+ * question: a handle that marks itself `deleted` before its DELETE lands
+ * answers every later `destroy()` from that mark, so a 500 is thrown once and
+ * the Sandbox then stands on the cluster with nothing left that would remove
+ * it. The same shape on `suspend()` leaves a pod running — and billing —
+ * behind a handle that says it is suspended.
+ *
+ * So `suspended` is written after the patch lands AND the pod is observed
+ * stopped, `deleted` after the DELETE resolves (or reports the object already
+ * gone), and a request that fails leaves the state it found. Concurrency is
+ * covered the other way round, by a single flight per verb: a second caller
+ * arriving mid-transition awaits the one in progress instead of sending a
+ * second request into the gap the deferred mark opens.
+ */
+import type { OpenTerminalOptions, Sandbox, SandboxDestroyOptions, SandboxTcpConnectOptions, SandboxTcpConnection, TerminalSession } from '@namzu/sdk';
+import { type KubernetesBackendInternalConfig } from './index.js';
+import { type SandboxPodTemplate, type SandboxVolumeClaimTemplate } from './objects.js';
+/**
+ * Thrown when a workspace's `SandboxTemplate` does not describe a block disk
+ * this backend is willing to build a workspace on.
+ *
+ * Named, and thrown before anything is created, because every shape it
+ * refuses WORKS: a template with no disk produces a sandbox whose files
+ * vanish on the next suspend, and a `Filesystem` disk produces one that keeps
+ * its files and is quietly several times slower at the small-file IO a
+ * workspace is made of. Neither fails a functional test, so neither can be
+ * left to be noticed later.
+ */
+export declare class KubernetesWorkspaceDiskError extends Error {
+    /** What was inspected — a `SandboxTemplate`, or an existing Sandbox. */
+    readonly source: string;
+    readonly name = "KubernetesWorkspaceDiskError";
+    constructor(
+    /** What was inspected — a `SandboxTemplate`, or an existing Sandbox. */
+    source: string, message: string);
+}
+/**
+ * Thrown when the Sandbox already standing under a workspace's name was not
+ * built the way this caller is configured to build one.
+ *
+ * Adoption is the NORMAL path — the deterministic name exists so that coming
+ * back to a workspace is cheap — and that is exactly why the object handed
+ * back is checked against the configuration rather than against the caller's
+ * intention. Two controls would otherwise be lost silently, and lost for as
+ * long as the workspace lives, which is the longest of anything this backend
+ * makes:
+ *
+ *  - the `sandbox.namzu.ai/template` pod label, which is what a translated
+ *    egress `NetworkPolicy`'s `podSelector` matches. A pod carrying another
+ *    value — or none — is not selected by the policy this call just verified,
+ *    so the boundary would report verified while covering nothing.
+ *  - `runtimeClassName`, which is the VM boundary. The privilege probe cannot
+ *    stand in for it: `/proc/self/status` reads the same inside a VM guest as
+ *    it does inside an ordinary shared-kernel container.
+ *
+ * Nothing is patched to make the standing object match. Its disk may hold a
+ * month of the caller's files, and rewriting a live workspace's podTemplate to
+ * fit a new configuration is a larger decision than reattaching to it.
+ */
+export declare class KubernetesWorkspaceMismatchError extends Error {
+    /** The Sandbox found standing under this workspace's name. */
+    readonly sandboxName: string;
+    /** Which configured field the standing object disagrees with. */
+    readonly field: 'sandboxTemplateName' | 'runtimeClassName';
+    /** What the configuration asked for. */
+    readonly expected: string;
+    /** What the object carries — absent when it carries nothing at all. */
+    readonly actual: string | undefined;
+    readonly name = "KubernetesWorkspaceMismatchError";
+    constructor(
+    /** The Sandbox found standing under this workspace's name. */
+    sandboxName: string, 
+    /** Which configured field the standing object disagrees with. */
+    field: 'sandboxTemplateName' | 'runtimeClassName', 
+    /** What the configuration asked for. */
+    expected: string, 
+    /** What the object carries — absent when it carries nothing at all. */
+    actual: string | undefined, message: string);
+}
+/**
+ * Thrown by every operation on a workspace that is currently suspended.
+ *
+ * Distinct from {@link KubernetesSandboxDestroyedError} because the state is
+ * RECOVERABLE and the advice is one word: call `resume()`. Nothing is dialed
+ * before it is thrown.
+ */
+export declare class KubernetesWorkspaceSuspendedError extends Error {
+    readonly operation: string;
+    readonly workspaceId: string;
+    readonly sandboxName: string;
+    readonly name = "KubernetesWorkspaceSuspendedError";
+    constructor(operation: string, workspaceId: string, sandboxName: string);
+}
+/**
+ * Thrown when a suspend's `operatingMode: Suspended` patch was accepted and
+ * the pod had still not stopped by the readiness deadline.
+ *
+ * The workspace is left in the state that is TRUE rather than the one that
+ * was asked for: the patch landed, so the pod is on its way out and no call
+ * is admitted — but the suspend is not recorded as finished, because it did
+ * not finish. A later `suspend()` sends the patch again and waits again
+ * instead of returning on a mark this one left behind, and `resume()` still
+ * works.
+ *
+ * Recording it as suspended here is exactly the defect this class exists to
+ * make impossible. The guest is still running, still holding the block device
+ * open and still writing to it, and "suspended" is a promise that the disk is
+ * quiesced — so a handle that made that promise on a wait it lost would let
+ * the next caller resume, or delete, a workspace mid-write.
+ */
+export declare class KubernetesWorkspaceSuspendTimeoutError extends Error {
+    readonly workspaceId: string;
+    readonly sandboxName: string;
+    /** The readiness budget the wait was given, in milliseconds. */
+    readonly timeoutMs: number;
+    readonly name = "KubernetesWorkspaceSuspendTimeoutError";
+    constructor(workspaceId: string, sandboxName: string, 
+    /** The readiness budget the wait was given, in milliseconds. */
+    timeoutMs: number);
+}
+/** Authority for one lifecycle transition, owned independently of the run. */
+export interface KubernetesWorkspaceTransitionOptions {
+    readonly signal?: AbortSignal;
+}
+/**
+ * `destroy()` on a workspace, with the one field that decides whether the
+ * disk survives. See the module comment: the default keeps it.
+ */
+export interface KubernetesWorkspaceDestroyOptions extends SandboxDestroyOptions {
+    /**
+     * `true` DELETEs the Sandbox, cascading to its Pod, Service and PVC —
+     * the caller's files are gone and nothing brings them back. Anything else,
+     * including the default, suspends and leaves the object standing.
+     */
+    readonly deleteDisk?: boolean;
+}
+/**
+ * A {@link Sandbox} that survives having its compute taken away.
+ *
+ * Declared here rather than on the SDK's `Sandbox`: the brief frames these as
+ * BACKEND capabilities, and keeping them out of `@namzu/sdk` means no new
+ * `SandboxStatus` member, no optional `suspend?()`/`resume?()` on the shared
+ * contract that every other backend would then have to answer for, and no
+ * `deleteDisk` field on the shared `SandboxDestroyOptions`.
+ */
+export interface KubernetesWorkspace extends Sandbox {
+    /**
+     * True from the moment `suspend()` starts until `resume()` finishes.
+     *
+     * `status` cannot say this — `SandboxStatus` has four members and none of
+     * them is "suspended" — so a suspended workspace reports `destroyed`,
+     * which is the only member that means "cannot serve a call". This flag is
+     * what tells the recoverable state from the final one without widening the
+     * SDK's union.
+     */
+    readonly suspended: boolean;
+    openTerminal(options: OpenTerminalOptions): Promise<TerminalSession>;
+    openTcpConnection(options: SandboxTcpConnectOptions): Promise<SandboxTcpConnection>;
+    /**
+     * Give the compute back and keep the disk. Idempotent: suspending a
+     * workspace whose suspend has been CONFIRMED sends nothing.
+     *
+     * Resolves once the POD has actually stopped, not merely once the patch
+     * was accepted and not on the Sandbox's `Suspended` condition, which
+     * upstream leaves standing after a resume — a guest that ignores SIGTERM
+     * rides out its `terminationGracePeriodSeconds` first, and it is writing
+     * to the disk for all of it.
+     *
+     * Rejects, leaving the workspace usable and unchanged, if the cluster
+     * refuses the patch; rejects with {@link KubernetesWorkspaceSuspendTimeoutError},
+     * admitting no call, if the patch landed and the pod outlived the wait.
+     * Either way the next `suspend()` sends the patch again rather than
+     * returning on this one's word. Concurrent calls share one transition.
+     *
+     * A call already in flight when this is called is not cancelled: it fails
+     * at the transport when the pod goes away, rather than with the named
+     * suspended error, which only covers calls admitted from here on.
+     */
+    suspend(options?: KubernetesWorkspaceTransitionOptions): Promise<void>;
+    /**
+     * Take a new pod, on a new address, with a new agent token, and prove it
+     * is deprivileged before handing it back. Idempotent: resuming a running
+     * workspace sends nothing.
+     */
+    resume(options?: KubernetesWorkspaceTransitionOptions): Promise<void>;
+    /**
+     * With no options, or `deleteDisk: false`, this SUSPENDS: the disk stays
+     * and so does the handle, which reports `status: 'destroyed'` and
+     * `suspended: true` and can still be `resume()`d. Only
+     * `deleteDisk: true` is final.
+     *
+     * A `deleteDisk: true` whose DELETE fails REJECTS and stays retryable —
+     * the workspace is not recorded as deleted on a request that did not
+     * land, because the early return on that record is what a retry would
+     * hit. Concurrent calls share one DELETE.
+     */
+    destroy(options?: KubernetesWorkspaceDestroyOptions): Promise<void>;
+}
+export interface KubernetesWorkspaceOptions {
+    /**
+     * The caller's own stable name for this workspace. The Sandbox is named
+     * `namzu-ws-<workspaceId>`, deterministically, which is what makes a
+     * workspace reachable again from a different host process — see
+     * {@link workspaceSandboxName} for why the id is refused rather than
+     * sanitised.
+     */
+    readonly workspaceId: string;
+    /** Reported as `rootDir`; where the guest's entrypoint mounted the disk. */
+    readonly workingDirectory: string;
+    /**
+     * `SandboxTemplate` whose `podTemplate` AND `volumeClaimTemplates` this
+     * workspace is built from. Defaults to the backend's own
+     * `sandboxTemplateName`, but a deployment normally has two — a task
+     * template with no disk, and a workspace template with a block one.
+     */
+    readonly sandboxTemplateName?: string;
+    readonly signal?: AbortSignal;
+}
+/** Prefix every workspace Sandbox's name carries. */
+export declare const WORKSPACE_NAME_PREFIX = "namzu-ws-";
+/**
+ * The Sandbox name for a workspace id.
+ *
+ * Deterministic on purpose: it is the only way a second host process, or the
+ * same one tomorrow, finds the workspace again. Which is also why an id that
+ * does not already fit a DNS-1123 label is REFUSED rather than lowercased,
+ * stripped or hashed: sanitising maps two ids onto one name, and two callers
+ * who believe they have separate workspaces would be sharing one disk.
+ * Hashing would fit every id and make the name unreadable in `kubectl get
+ * sandbox`, which is most of what the deterministic name is for.
+ */
+export declare function workspaceSandboxName(workspaceId: string): string;
+/**
+ * Refuse anything that is not a block disk a container actually consumes as
+ * one. Every branch here describes a configuration that would work and then
+ * disappoint — see {@link KubernetesWorkspaceDiskError}.
+ */
+export declare function assertBlockModeWorkspaceDisk(source: string, podTemplate: SandboxPodTemplate | undefined, volumeClaimTemplates: readonly SandboxVolumeClaimTemplate[] | undefined): void;
+/**
+ * Refuse a standing Sandbox that was built from another `SandboxTemplate`, or
+ * that runs without the RuntimeClass this backend is configured for.
+ *
+ * Read off `spec.podTemplate` — the copy the controller actually runs a pod
+ * from — rather than off anything this process decided, because the question
+ * is what the POD is, not what the caller meant it to be.
+ *
+ * The template check is unconditional, `config.egress` set or not: the label
+ * is also how an operator reads which template an object came from, and an
+ * object whose label says one thing while the caller builds from another is a
+ * mix-up worth naming the first time it is seen rather than the first time a
+ * policy is switched on. See {@link KubernetesWorkspaceMismatchError}.
+ */
+export declare function assertAdoptedWorkspaceMatchesConfig(sandboxName: string, namespace: string, podTemplate: SandboxPodTemplate | undefined, expected: {
+    readonly sandboxTemplateName: string;
+    readonly runtimeClassName?: string;
+}): void;
+/**
+ * Create the workspace, or take over the one that is already there.
+ *
+ * A second call with the same `workspaceId` ADOPTS rather than fails: the
+ * POST comes back 409 Conflict, and the object it collided with is this
+ * caller's own workspace from an earlier process. The deterministic name is
+ * only useful if coming back to it is the normal path. An adopted object is
+ * checked against the same block-disk rule a fresh one is, so a Sandbox
+ * standing under this name that is not a workspace is refused rather than
+ * used.
+ *
+ * Nothing here is ever deleted on failure. A create that gets as far as an
+ * existing object and then fails — a readiness timeout, a privilege probe
+ * refusal — SUSPENDS it and rethrows, because the object may be a workspace
+ * with a disk full of the caller's files and `deleteDisk` is not a decision
+ * a failure path gets to make. That holds even when THIS call POSTed the
+ * object and its disk is therefore empty: the 409 above means two processes
+ * can be coming up on one name at once, and the one that got the 201 deleting
+ * its "own" fresh object would take the disk of the one that adopted it. The
+ * cost is named rather than paid: a failed create can leave one suspended
+ * Sandbox standing, which the caller finds again under the same deterministic
+ * name and nothing reaps for them — see the docs page.
+ */
+export declare function createKubernetesWorkspace(config: KubernetesBackendInternalConfig, options: KubernetesWorkspaceOptions): Promise<KubernetesWorkspace>;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/backends/kubernetes/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiHG;AAEH,OAAO,KAAK,EACX,mBAAmB,EACnB,OAAO,EACP,qBAAqB,EAOrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,MAAM,YAAY,CAAA;AAInB,OAAO,EAEN,KAAK,+BAA+B,EAapC,MAAM,YAAY,CAAA;AAOnB,OAAO,EAGN,KAAK,kBAAkB,EAEvB,KAAK,0BAA0B,EAK/B,MAAM,cAAc,CAAA;AAQrB;;;;;;;;;;GAUG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IAIrD,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJxB,SAAkB,IAAI,kCAAiC;;IAGtD,wEAAwE;IAC/D,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;CAIhB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IAIzD,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,kBAAkB;IAC1D,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IAVpC,SAAkB,IAAI,sCAAqC;;IAG1D,8DAA8D;IACrD,WAAW,EAAE,MAAM;IAC5B,iEAAiE;IACxD,KAAK,EAAE,qBAAqB,GAAG,kBAAkB;IAC1D,wCAAwC;IAC/B,QAAQ,EAAE,MAAM;IACzB,uEAAuE;IAC9D,MAAM,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,MAAM;CAIhB;AAED;;;;;;GAMG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAI1D,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAL7B,SAAkB,IAAI,uCAAsC;gBAGlD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM;CAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,sCAAuC,SAAQ,KAAK;IAI/D,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAN3B,SAAkB,IAAI,4CAA2C;gBAGvD,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM;IAC5B,gEAAgE;IACvD,SAAS,EAAE,MAAM;CAM3B;AAED,8EAA8E;AAC9E,MAAM,WAAW,oCAAoC;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,iCAAkC,SAAQ,qBAAqB;IAC/E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAoB,SAAQ,OAAO;IACnD;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IACpE,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,oCAAoC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,oCAAoC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnE;AAED,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,cAAc,CAAA;AAOhD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAOhE;AAyCD;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC3C,oBAAoB,EAAE,SAAS,0BAA0B,EAAE,GAAG,SAAS,GACrE,IAAI,CAoCN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CAClD,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC3C,QAAQ,EAAE;IAAE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF,IAAI,CAuBN;AAwBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,+BAA+B,EACvC,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA8F9B"}