@namzu/sandbox 13.0.0 → 14.0.0

package/dist/backends/kubernetes/index.d.ts

@@ -0,0 +1,374 @@
+/**
+ * Kubernetes / agent-sandbox backend — acquire, readiness and teardown.
+ *
+ * Sibling of `firecracker/` and `aci-standby-pool/`: same
+ * {@link SandboxBackend} surface, same "the host supplies the credential
+ * callback and this package carries no cloud SDK" boundary, a different
+ * control plane. Here the control plane is the Kubernetes API server and the
+ * warm pool is a `SandboxWarmPool` reconciled by the agent-sandbox controller
+ * (kubernetes-sigs/agent-sandbox v1.0.2).
+ *
+ * Registered as `microvm` because {@link SandboxTier} names the strength of
+ * the boundary, not the orchestrator that starts it: a pod scheduled onto a
+ * Kata RuntimeClass runs in a hardware-virtualized guest. The tier also keeps
+ * the backend out of the container tier's mandatory
+ * `ContainerSandboxLayout`, which a remote-copy backend has no use for —
+ * Firecracker took the same exemption.
+ *
+ * ## Two acquire paths, and why they create different kinds
+ *
+ *  - `warmPoolName` set → POST a `SandboxClaim` at the named pool. The
+ *    controller binds an already-running Sandbox out of the pool, which is
+ *    what makes a sub-second acquire possible at all.
+ *  - `warmPoolName` unset → POST a `Sandbox` directly. This is necessitated
+ *    rather than chosen: `SandboxClaimSpec.warmPoolRef` is a REQUIRED field,
+ *    so a pool-less claim does not exist in the API.
+ *
+ * The claim this backend POSTs is PRISTINE: `warmPoolRef` and a lifecycle
+ * bound, nothing else. `spec.env` and `spec.volumeClaimTemplates` are
+ * available on the claim and are never set, because a claim carrying either
+ * is forced to cold-start instead of adopting a pool sandbox — the single
+ * most expensive mistake available on this path, and a silent one, since such
+ * a claim still works and only the latency shows it. Per-sandbox controls
+ * that would need those fields are refused by {@link assertEnforceable}
+ * rather than accepted and dropped.
+ *
+ * ## The bound sandbox is not named after the claim
+ *
+ * A pool sandbox keeps the generated name the pool gave it when the claim
+ * adopts it. The backend therefore reads the bound identity back out of
+ * `status.sandbox` and never derives it from the claim's own name. A test
+ * covers exactly that asymmetry.
+ *
+ * ## Credential
+ *
+ * The per-instance agent bind token is the backing pod's own
+ * `metadata.uid`: the host learns it from the API server after readiness, the
+ * guest learns it through the downward API (`NAMZU_AGENT_BIND_TOKEN`), and
+ * nothing has to be minted, stored or injected at claim time. One GET, no
+ * claim mutation, so the warm path stays pristine. A resumed pod is a new pod
+ * with a new uid, which is correct: it is a new instance.
+ *
+ * ## The lease
+ *
+ * The `shutdownTime` acquire stamps is the leak guard AND, unrenewed, a
+ * deadline on the run. The Sandbox handle owns a renewal loop that PATCHes
+ * it forward every half-TTL for as long as the handle is alive, and
+ * `destroy()` stops it — so a live run keeps its pod and a dead host still
+ * costs the cluster exactly one expiry. See `lease.ts`.
+ *
+ * ## The privilege probe
+ *
+ * `create()` does not resolve until the guest has reported — and this
+ * backend has checked — that it is deprivileged: all four capability masks
+ * zero, `NoNewPrivs: 1`, read out of `/proc/self/status` over the agent's
+ * `execute` op, on a clock of its own so a guest that goes quiet is refused
+ * rather than waited on. A refusal destroys the instance and rejects, so no
+ * handle to an under-hardened sandbox escapes. There is no off switch. See
+ * `privilege-probe.ts`.
+ *
+ * ## Not watch
+ *
+ * Readiness is polled against the shared {@link OperationDeadline}, exactly as
+ * ACI polls `provisioningState`. A watch would buy nothing on a path whose
+ * whole budget is under a second, and would cost resourceVersion tracking,
+ * bookmarks, 410-relist and reconnect backoff.
+ *
+ * ## Egress
+ *
+ * `config.egress` is optional and, when set, translated and VERIFIED — never
+ * created — by `egress-policy.ts`. Verification happens once, lazily, on the
+ * first `create()`, so `buildKubernetesBackend` itself still contacts
+ * nothing. Every Sandbox this file creates directly (`buildSandboxBody`)
+ * carries {@link sandboxTemplateLabel} on its podTemplate specifically so
+ * that translated policy's `podSelector` has something stable to match —
+ * see `objects.ts`'s doc comment on that label for why agent-sandbox's own
+ * controller-owned label does not cover this path.
+ */
+import type { Sandbox } from '@namzu/sdk';
+import type { SandboxBackend, SandboxBackendOptions } from '../../index.js';
+import { OperationDeadline } from '../readiness.js';
+import { type KubernetesEgressConfig } from './egress-policy.js';
+import { type KubernetesAccess, type KubernetesClient } from './k8s-client.js';
+import { type SandboxPodTemplate, type SandboxResource, type SandboxVolumeClaimTemplate } from './objects.js';
+export type { KubernetesEgressConfig, KubernetesEgressEngine } from './egress-policy.js';
+/**
+ * How the backend reaches the API server. Two sources, neither needing a YAML
+ * parser — see `k8s-client.ts` for the reasoning.
+ */
+export type KubernetesClusterAccess = {
+    readonly inCluster: true;
+} | {
+    readonly inCluster?: false;
+    readonly server: string;
+    readonly ca?: string | Buffer;
+    readonly getToken: () => Promise<string>;
+};
+export interface KubernetesBackendInternalConfig {
+    readonly access: KubernetesClusterAccess;
+    /** Namespace the claims, sandboxes and pods live in. */
+    readonly namespace: string;
+    /**
+     * SandboxTemplate whose `podTemplate` a POOL-LESS create copies into the
+     * Sandbox it posts. The warm path never reads it — the pool's own
+     * `sandboxTemplateRef` decides there — but an operator reading this config
+     * still learns which template these sandboxes are built from.
+     */
+    readonly sandboxTemplateName: string;
+    /** Named `SandboxWarmPool`. Absent → every create is a direct Sandbox. */
+    readonly warmPoolName?: string;
+    /** TCP port the guest agent listens on. Default {@link DEFAULT_AGENT_PORT}. */
+    readonly agentPort?: number;
+    readonly readyPollIntervalMs?: number;
+    readonly readyTimeoutMs?: number;
+    /**
+     * Lifetime bound written into every created object, and the amount each
+     * lease renewal pushes the expiry forward. Default 1 hour.
+     */
+    readonly claimTtlSeconds?: number;
+    /**
+     * Every lease-renewal failure that is not "the object is already gone".
+     * `@namzu/sandbox` owns no logger and reads none from module scope, so a
+     * diagnostic it cannot print is handed to the host that can. Renewal
+     * retries on the next tick either way; nothing here changes behaviour.
+     */
+    readonly onLeaseRenewalError?: (error: unknown) => void;
+    /**
+     * RuntimeClass for a POOL-LESS create. Refused together with
+     * `warmPoolName`: a pooled sandbox's runtime class is fixed by the pool's
+     * SandboxTemplate and cannot be chosen per claim.
+     */
+    readonly runtimeClassName?: string;
+    /**
+     * Egress policy this backend's `NetworkPolicy` (or `CiliumNetworkPolicy`,
+     * under `engine: 'cilium'`) is expected to carry. Unset means this backend
+     * neither computes nor verifies one — the cluster's default posture (the
+     * SandboxTemplate's own managed NetworkPolicy) is all that applies. See
+     * `egress-policy.ts`.
+     */
+    readonly egress?: KubernetesEgressConfig;
+}
+/**
+ * The address the guest agent answers on, plus the token to present.
+ *
+ * Structurally the `tcp` arm of the transport's `SandboxAgentHandle`. It is
+ * declared here rather than imported so acquire does not depend on the
+ * transport landing first; the two are asserted equal where they meet.
+ */
+export interface KubernetesAgentAddress {
+    readonly kind: 'tcp';
+    readonly host: string;
+    readonly port: number;
+    readonly token: string;
+}
+/** What the controller bound, read back off the object's own status. */
+export interface KubernetesSandboxBinding {
+    /** The Sandbox's own name — NOT the claim's. */
+    readonly name: string;
+    readonly podIPs?: readonly string[];
+    readonly serviceFQDN?: string;
+    /** `Sandbox.status.selector`, when the path that read it had it for free. */
+    readonly podSelector?: string;
+}
+/** One acquired sandbox: what it is, where it answers, how to give it back. */
+export interface KubernetesAcquisition {
+    readonly binding: KubernetesSandboxBinding;
+    readonly agent: KubernetesAgentAddress;
+    /** API path of the object THIS backend created — the claim, or the Sandbox. */
+    readonly ownedPath: string;
+    /** The TTL acquire stamped, which every renewal re-stamps. */
+    readonly ttlSeconds: number;
+    /** DELETE that object. An already-gone object counts as released. */
+    release(signal?: AbortSignal): Promise<void>;
+    /**
+     * Merge-PATCH the created object's expiry forward to `shutdownTime`.
+     *
+     * On the acquisition rather than in `lease.ts` because only this path
+     * knows WHICH object it created and therefore where the field lives: a
+     * `SandboxClaim` carries it at `spec.lifecycle.shutdownTime`, a directly
+     * created `Sandbox` at `spec.shutdownTime` (v1beta1 as served keeps it at
+     * the top of `spec`). A merge patch of the nested object leaves
+     * `shutdownPolicy` alone.
+     */
+    renew(shutdownTime: string, signal?: AbortSignal): Promise<void>;
+}
+/**
+ * The same number the Firecracker guest agent listens on over vsock
+ * (`DEFAULT_AGENT_VSOCK_PORT`), so one agent has one port across both tiers
+ * and a manifest, a NetworkPolicy and a transport can all name it from
+ * memory. Unprivileged, and the sandbox pod is not sharing it with anything.
+ */
+export declare const DEFAULT_AGENT_PORT = 1024;
+/**
+ * How long the privilege probe may take, given the caller's readiness budget.
+ *
+ * `readyTimeoutMs` bounds the CONTROL plane and has usually expired by the
+ * time the probe starts, so the probe cannot share it — but it is still the
+ * number the caller chose to describe how long an acquire may take, so the
+ * probe is allowed exactly that much again and no more, capped. A caller who
+ * asked for a 500 ms acquire gets a 500 ms probe; one who asked for two
+ * minutes of cold start still gets {@link PRIVILEGE_PROBE_TIMEOUT_CAP_MS}.
+ * Deliberately not a separate config key: a knob whose only correct value is
+ * "long enough for one `cat`" is a knob that only ever gets set wrong.
+ */
+export declare function resolveProbeTimeoutMs(readyTimeoutMs: number): number;
+/**
+ * The readiness bounds every path in this backend polls against — acquire,
+ * and `workspace.ts`'s create/suspend/resume. One function so the two cannot
+ * drift apart on defaults.
+ */
+export declare function resolveKubernetesReadiness(config: {
+    readonly readyTimeoutMs?: number;
+    readonly readyPollIntervalMs?: number;
+}): {
+    readonly timeoutMs: number;
+    readonly pollIntervalMs: number;
+};
+export declare function assertEnforceable(options: SandboxBackendOptions): void;
+/**
+ * Refuse a runtime class the pool path cannot honour.
+ *
+ * A pooled sandbox is already running by the time a claim reaches it, under
+ * whatever RuntimeClass its SandboxTemplate named. `runtimeClassName` in this
+ * config would therefore be read, accepted and ignored — and the thing it
+ * selects is the VM boundary, which is the last control to lose quietly.
+ */
+export declare function assertRuntimeClassIsApplicable(config: {
+    warmPoolName?: string;
+    runtimeClassName?: string;
+}): void;
+/**
+ * Build a {@link SandboxBackend} against a cluster running the agent-sandbox
+ * controller. Construction is synchronous and contacts nothing: readiness
+ * bounds and the config refusals are validated here so a misconfiguration
+ * surfaces during host wiring rather than mid-run, and the first API call
+ * happens on the first `create()`.
+ */
+export declare function buildKubernetesBackend(config: KubernetesBackendInternalConfig): SandboxBackend;
+/**
+ * Translate `egress.policy` and confirm an operator applied a matching
+ * object — the whole verify-not-trust step, isolated so `create()` above
+ * stays about ONE thing (memoize-once-per-backend) rather than two.
+ *
+ * Exported because `workspace.ts` runs the identical step: a workspace does
+ * not go through `buildKubernetesBackend`, and a config `egress` honoured on
+ * one entry point and ignored on the other would be a silent downgrade of the
+ * boundary this backend calls primary. `sandboxTemplateName` is the template
+ * the caller is actually building from — it decides both the default policy
+ * name and the pod label the policy's selector has to match, and a workspace
+ * may be built from a different template than the task path's.
+ */
+export declare function verifyEgressPolicyConfigured(client: KubernetesClient, namespace: string, sandboxTemplateName: string, egress: KubernetesEgressConfig, signal?: AbortSignal): Promise<void>;
+/** Config → the client's own access shape. Shared with `workspace.ts`. */
+export declare function clientAccess(config: KubernetesBackendInternalConfig): KubernetesAccess;
+/**
+ * Claim or create, wait for Ready, read the bound identity back, resolve the
+ * address and learn the pod's uid — or leave nothing behind trying.
+ *
+ * Exported because the sandbox surface is built on top of this record rather
+ * than beside it: one acquire path, one cleanup path, whatever ends up
+ * wrapping them.
+ */
+export declare function acquireKubernetesSandbox(client: KubernetesClient, config: KubernetesBackendInternalConfig, options: SandboxBackendOptions, readiness: {
+    readonly timeoutMs: number;
+    readonly pollIntervalMs: number;
+}): Promise<KubernetesAcquisition>;
+/**
+ * What a directly created Sandbox copies out of a `SandboxTemplate`, and the
+ * two things it decides for itself.
+ */
+export interface SandboxBodyOptions {
+    readonly namespace: string;
+    readonly name: string;
+    readonly template: SandboxTemplateCopy;
+    /** The template the copy came from — the value of {@link sandboxTemplateLabel}. */
+    readonly sandboxTemplateName: string;
+    readonly runtimeClassName?: string;
+    /**
+     * RFC 3339 expiry, paired with `shutdownPolicy: Delete`. ABSENT means the
+     * object carries no expiry at all and nothing reaps it on the wall clock:
+     * that is the persistent workspace (`workspace.ts`), which is explicitly
+     * managed and must survive a host that stops renewing. Every task sandbox
+     * sets it, because an unbounded task sandbox is a leak.
+     */
+    readonly shutdownTime?: string;
+}
+/**
+ * The pool-less body. `Sandbox.spec` has no `templateRef` — only a
+ * SandboxWarmPool consumes a SandboxTemplate — so the template's podTemplate
+ * is copied in here by the client.
+ *
+ * `service: true` is forced rather than inherited: a Sandbox without a Service
+ * has no `status.serviceFQDN`, and then the only address left is a pod IP that
+ * changes on every resume.
+ *
+ * `volumeClaimTemplates` is copied VERBATIM when the template declares any.
+ * Dropping it would be silent: the Sandbox would come up healthy with no disk,
+ * the container's `volumeDevices`/`volumeMounts` entry would fail to resolve
+ * (or, worse, resolve to an empty emptyDir on some paths), and the only
+ * symptom of a workspace that lost its disk would be that yesterday's files
+ * are gone. The controller wires the mount by the entry's own NAME,
+ * StatefulSet style, so the copy needs no matching `volumes:` entry and this
+ * function adds none.
+ *
+ * The podTemplate's metadata gains {@link sandboxTemplateLabel}: this Sandbox
+ * is created DIRECTLY, never adopted out of a pool, so it never gets
+ * agent-sandbox's own controller-owned
+ * `agents.x-k8s.io/sandbox-template-ref-hash` label (that is written only on
+ * bind). Without a label of its own a direct Sandbox's pod would carry
+ * nothing `egress-policy.ts`'s translated `NetworkPolicy` could select it
+ * by. Existing labels on the copied template are preserved — this ADDS to
+ * them rather than replacing the object outright — but this backend's own
+ * key always wins if the template happened to set it too, since this is the
+ * label the translated policy is built to match.
+ */
+export declare function buildSandboxBody(options: SandboxBodyOptions): Record<string, unknown>;
+/** The two halves of a `SandboxTemplate` a directly created Sandbox copies. */
+export interface SandboxTemplateCopy {
+    readonly podTemplate: SandboxPodTemplate;
+    /** Absent when the template declares no disk, which is every task template. */
+    readonly volumeClaimTemplates?: readonly SandboxVolumeClaimTemplate[];
+}
+export declare function readSandboxTemplate(client: KubernetesClient, namespace: string, sandboxTemplateName: string, signal?: AbortSignal): Promise<SandboxTemplateCopy>;
+/**
+ * Where the agent answers.
+ *
+ * Its own function, and the Service FQDN wins over a pod IP, because the
+ * address outlives the pod: a suspended-then-resumed workspace comes back as a
+ * new pod with a new IP behind the same name, and the transport re-resolves
+ * the name on every dial. A literal IP baked into a long-lived handle is the
+ * bug that would produce.
+ */
+export declare function resolveAgentAddress(binding: KubernetesSandboxBinding, agentPort: number, token: string): KubernetesAgentAddress;
+/** Ready-or-not-yet, read off a `Sandbox`'s own status. Shared with `workspace.ts`. */
+export declare function bindingFromSandbox(sandbox: SandboxResource | undefined): KubernetesSandboxBinding | undefined;
+/**
+ * Poll until `read` reports a binding. `read` returns `undefined` for "not
+ * yet" and throws for a failure worth surfacing; the deadline owns every wait,
+ * including the sleep between attempts, so an expired clock cannot be extended
+ * by one more round trip. Shaped after ACI's `pollForRunningIp`.
+ */
+export declare function pollForBinding(read: (signal: AbortSignal) => Promise<KubernetesSandboxBinding | undefined>, deadline: OperationDeadline, readiness: {
+    readonly timeoutMs: number;
+    readonly pollIntervalMs: number;
+}, label: string): Promise<KubernetesSandboxBinding>;
+/**
+ * The per-instance bind token: the backing pod's `metadata.uid`.
+ *
+ * The pod is named after its Sandbox in agent-sandbox v1.0.2 — verified
+ * against a running cluster — but that is an observation, not a documented
+ * guarantee, and `Sandbox.status` exposes no pod name to fall back on. So the
+ * fast path is one GET by that name, and the only cost of the name convention
+ * changing upstream is a second round trip through `status.selector`, which is
+ * exactly what the controller publishes the selector for.
+ */
+export declare function readPodBindToken(client: KubernetesClient, namespace: string, binding: KubernetesSandboxBinding, signal?: AbortSignal): Promise<string>;
+/**
+ * Run the probe against a built Sandbox, on its own clock, and throw if it
+ * refuses. Cleanup is the CALLER's, and the two callers want opposite things:
+ * a task acquire destroys the instance, while `workspace.ts` suspends it,
+ * because deleting a workspace deletes its disk and a probe refusal is not a
+ * reason to lose a caller's files.
+ */
+export declare function probeSandboxPrivileges(sandbox: Sandbox, sandboxName: string, probeTimeoutMs: number, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/kubernetes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/kubernetes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAGzC,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAC3E,OAAO,EACN,iBAAiB,EAIjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,KAAK,sBAAsB,EAK3B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EAErB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAQN,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAEpB,KAAK,0BAA0B,EAW/B,MAAM,cAAc,CAAA;AAKrB,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAExF;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAChC;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GAC5B;IACA,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CACvC,CAAA;AAEJ,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACxC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChE;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAA;AA0BtC;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAKlE;AAyBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACzB,GAAG,IAAI,CAKP;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,+BAA+B,GAAG,cAAc,CA0C9F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,4BAA4B,CACjD,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,sBAAsB,EAC9B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,MAAM,EAAE,+BAA+B,GAAG,gBAAgB,CAStF;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,+BAA+B,EACvC,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxE,OAAO,CAAC,qBAAqB,CAAC,CAoIhC;AA8BD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,mFAAmF;IACnF,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6BrF;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;CACrE;AAED,wBAAsB,mBAAmB,CACxC,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,EACjB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAkB9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,wBAAwB,EACjC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACX,sBAAsB,CAQxB;AAsBD,uFAAuF;AACvF,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,eAAe,GAAG,SAAS,GAClC,wBAAwB,GAAG,SAAS,CAatC;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,EAC5E,QAAQ,EAAE,iBAAiB,EAC3B,SAAS,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,EAC1E,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,wBAAwB,CAAC,CAiBnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACrC,MAAM,EAAE,gBAAgB,EACxB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,wBAAwB,EACjC,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAoCjB;AA6ED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAmCf"}