@namzu/sandbox 13.0.0 → 15.0.0

package/dist/backends/kubernetes/sandbox.js

@@ -0,0 +1,433 @@
+/**
+ * The {@link Sandbox} a kubernetes acquire hands back: the SDK contract,
+ * served over the guest agent's TCP transport, with the lease that keeps the
+ * cluster from deleting the pod out from under a long run.
+ *
+ * Split out of `index.ts` because that file is about the CONTROL plane —
+ * claim, poll, address, release — and this one is about the DATA plane, and
+ * the two are read for different reasons.
+ *
+ * ## What it implements, and what it deliberately does not
+ *
+ * Implemented: `exec` (through the shared {@link RemoteExecutionController},
+ * so an `AbortSignal` terminates the guest process rather than abandoning
+ * the wait), `writeFile`, `readFile`, `listFiles`, `walkFiles`,
+ * `openTerminal`, `openTcpConnection`, `destroy`.
+ *
+ * Conditionally present, on the same contract read the other way:
+ *
+ *  - `setNetworkPolicy` — present on a TASK handle exactly when the backend
+ *    was configured with `egress.perSandbox`, which is what gives this host
+ *    an object to write (one `CiliumNetworkPolicy` per sandbox, owned by the
+ *    claim), an admission fence bounding what it may write, and the RBAC to
+ *    write it. Without that configuration there is still no per-running-pod
+ *    knob to turn, so the method is ABSENT rather than present and throwing —
+ *    the same rule, applied to a capability that now sometimes exists.
+ *    Presence follows configuration alone, never a probe of the cluster. See
+ *    `per-sandbox-policy.ts`.
+ *
+ *    A WORKSPACE handle never carries it: `KubernetesWorkspace`'s create path
+ *    builds its handle through `buildKubernetesSandbox` without this option,
+ *    because it composes no per-sandbox pod label and tracks no owner uid for
+ *    one. That is a property of the PATH and not of the configuration, so it
+ *    is not answered by omission: `createKubernetesWorkspace` refuses a
+ *    config carrying `egress.perSandbox` outright
+ *    (`KubernetesWorkspacePerSandboxEgressConfigError`, before any request)
+ *    rather than letting the option declare a capability the path never
+ *    serves — see `workspace.ts`.
+ *
+ * Absent on purpose, because the SDK's contract says a backend that cannot
+ * honour an optional method must omit it rather than accept and ignore:
+ *
+ *  - `spawnDetached` — the guest agent has no op that starts a process and
+ *    returns it running. A host asking for background jobs must be told no.
+ *
+ * ## Terminals are owned
+ *
+ * `openTerminal` is only a compliant implementation if `destroy()` kills and
+ * awaits every terminal it returned, so open terminals are tracked and
+ * reaped before the object is released — the same thing the Firecracker
+ * backend does, for the same contract.
+ *
+ * ## Two terminal states, one `SandboxStatus`
+ *
+ * `SandboxStatus` has exactly four members and this change does not widen
+ * the SDK's union, so both ways a sandbox ends report `'destroyed'`. They
+ * are told apart by the error a later call throws:
+ * {@link KubernetesSandboxDestroyedError} (this host released it) and
+ * {@link KubernetesSandboxGoneError} (the cluster deleted it — the lease
+ * renewal found the object already gone).
+ */
+import { walkFilesViaExec } from '@namzu/sdk';
+import { OperationDeadline } from '../readiness.js';
+import { RemoteCancellationUnknownError, } from '../remote-execution-controller.js';
+import { KubernetesLeaseRenewal } from './lease.js';
+/**
+ * How long a retirement triggered by an unconfirmed cancellation may spend
+ * deleting the object. Separate from every other clock on the path: the
+ * caller's own deadline has usually already expired by the time this runs,
+ * and reusing it would mean skipping teardown exactly when a command of
+ * unknown state is still out there.
+ */
+const RETIREMENT_TIMEOUT_MS = 15_000;
+/** Thrown by any operation on a sandbox this host already destroyed. */
+export class KubernetesSandboxDestroyedError extends Error {
+    operation;
+    sandboxName;
+    name = 'KubernetesSandboxDestroyedError';
+    constructor(operation, sandboxName) {
+        super(`kubernetes sandbox ${sandboxName} has been destroyed; ${operation}() cannot be admitted. Acquire a new sandbox — a destroyed one's pod, Service and claim are deleted and its agent address no longer resolves.`);
+        this.operation = operation;
+        this.sandboxName = sandboxName;
+    }
+}
+/**
+ * Thrown by any operation on a sandbox the CLUSTER removed while this
+ * handle still held it — the lease renewal PATCH came back 404/410. Distinct
+ * from {@link KubernetesSandboxDestroyedError} because nothing this host did
+ * caused it: the object expired, an operator deleted it, or the controller
+ * reaped it, and the actionable advice is different.
+ */
+export class KubernetesSandboxGoneError extends Error {
+    operation;
+    sandboxName;
+    name = 'KubernetesSandboxGoneError';
+    constructor(operation, sandboxName) {
+        super(`kubernetes sandbox ${sandboxName} no longer exists on the cluster; ${operation}() cannot be admitted. Its lease renewal found the object already deleted — it expired (spec.lifecycle.shutdownTime), an operator deleted it, or the controller reaped it. Nothing this handle can do brings it back; acquire a new sandbox.`);
+        this.operation = operation;
+        this.sandboxName = sandboxName;
+    }
+}
+function detectEnvironment() {
+    // The guest runs Linux; the enum describes the host-facing shape of the
+    // worker, not the isolation technology under it. Firecracker's guest
+    // reports the same for the same reason.
+    return 'linux-namespace';
+}
+/**
+ * Build the handle. It does NOT run the acquire-time privilege probe — that
+ * is `create()`'s job in `index.ts`, so that a refusal can destroy this
+ * object before any caller has a reference to it, and so this function stays
+ * usable by the workspace path that runs its own probe.
+ */
+export function buildKubernetesSandbox(options) {
+    // The cluster owns this name. Preserving it verbatim as the sandbox id —
+    // as the Firecracker backend preserves its orchestrator's — means a log
+    // line carrying an id is also a `kubectl get sandbox` argument.
+    const id = options.name;
+    const transport = options.transport;
+    // Captured as a const so the conditional member below narrows: the method
+    // is on the handle if and only if this is defined, decided once, here.
+    const setNetworkPolicy = options.setNetworkPolicy;
+    let lifecycle = 'active';
+    let activeExecutions = 0;
+    let teardownPromise;
+    let teardownComplete = false;
+    let retirementPromise;
+    const terminals = new Set();
+    // No `renew` ⇒ no expiry to move ⇒ no loop. `stop()` on the undefined
+    // case is the caller's problem to not have, which is why every use below
+    // goes through `lease?.stop()`.
+    const renew = options.renew;
+    const ttlSeconds = options.ttlSeconds;
+    // The type above already pairs the two. This is the runtime half of the
+    // same rule, for a caller that reached here through a cast or from
+    // JavaScript: a lease stamping `now + 0` expires the moment it is written,
+    // and every tick would report success while the controller deleted the
+    // object underneath it.
+    if (renew !== undefined && (typeof ttlSeconds !== 'number' || ttlSeconds <= 0)) {
+        throw new Error(`kubernetes: sandbox ${options.name} was given a lease renewal with ttlSeconds ${String(ttlSeconds)}. A renewal re-stamps shutdownTime as now + ttlSeconds, so a zero or absent TTL stamps an expiry that has already passed and the object is reaped while the loop reports every tick a success. Pass renew and a positive ttlSeconds together, or neither — an object with no expiry (a persistent workspace) runs no renewal loop.`);
+    }
+    // `ttlSeconds === undefined` is unreachable once `renew` is defined — the
+    // throw above saw to that — and is written out anyway because it is what
+    // narrows the field to a number for the constructor below.
+    const lease = renew === undefined || ttlSeconds === undefined
+        ? undefined
+        : new KubernetesLeaseRenewal({
+            ttlSeconds,
+            renew,
+            onGone: () => {
+                // The object is gone; the pod behind the address went with it.
+                // Refuse every later call by name rather than let it dial into a
+                // connect timeout with nothing to explain it.
+                if (lifecycle === 'active')
+                    lifecycle = 'gone';
+            },
+            ...(options.onRenewalError !== undefined
+                ? { onRenewalError: options.onRenewalError }
+                : {}),
+            ...(options.leaseIntervalMs !== undefined ? { intervalMs: options.leaseIntervalMs } : {}),
+        });
+    lease?.start();
+    const assertAdmissible = (operation) => {
+        if (lifecycle === 'active')
+            return;
+        if (lifecycle === 'gone')
+            throw new KubernetesSandboxGoneError(operation, options.name);
+        throw new KubernetesSandboxDestroyedError(operation, options.name);
+    };
+    const teardown = (signal) => {
+        if (lifecycle === 'active')
+            lifecycle = 'retiring';
+        lease?.stop();
+        if (teardownComplete)
+            return Promise.resolve();
+        if (teardownPromise)
+            return teardownPromise;
+        const shared = options.release(signal).then(() => {
+            teardownComplete = true;
+            lifecycle = 'destroyed';
+        }, (error) => {
+            // A failed teardown must stay retryable; keeping the rejected
+            // promise would answer every later destroy() with the same
+            // stale failure.
+            if (teardownPromise === shared)
+                teardownPromise = undefined;
+            throw error;
+        });
+        teardownPromise = shared;
+        return shared;
+    };
+    /**
+     * A command whose cancellation the guest could not confirm may still be
+     * running in that pod, so the pod stops being reusable. Retire it and
+     * report whether the retirement landed, on the error the caller is about
+     * to receive.
+     */
+    const retire = () => {
+        if (lifecycle === 'active')
+            lifecycle = 'retiring';
+        retirementPromise ??= new OperationDeadline(RETIREMENT_TIMEOUT_MS, `kubernetes sandbox ${options.name} retirement`)
+            .run(async (signal) => await teardown(signal))
+            .then(() => ({ accepted: true }))
+            .catch((error) => ({
+            accepted: false,
+            error: error instanceof Error ? error : new Error(String(error)),
+        }));
+        return retirementPromise;
+    };
+    /**
+     * What an unconfirmed cancellation does to THIS sandbox: retire it, or
+     * whatever the owner's hook decided instead — see
+     * {@link KubernetesSandboxBaseOptions.onUnconfirmedCancellation}.
+     */
+    const observeUnconfirmedCancellation = async (error) => {
+        const decide = options.onUnconfirmedCancellation;
+        if (decide === undefined)
+            return await retire();
+        try {
+            return await decide(error);
+        }
+        catch (hookError) {
+            // The caller is already receiving `error`; a hook that threw must
+            // not replace it, and must not be reported as a teardown that was
+            // attempted either.
+            return {
+                accepted: false,
+                error: hookError instanceof Error ? hookError : new Error(String(hookError)),
+            };
+        }
+    };
+    const runExecution = async (operation, run) => {
+        assertAdmissible(operation);
+        activeExecutions += 1;
+        try {
+            return await run();
+        }
+        catch (error) {
+            if (error instanceof RemoteCancellationUnknownError) {
+                error.retirement = await observeUnconfirmedCancellation(error);
+            }
+            throw error;
+        }
+        finally {
+            activeExecutions = Math.max(0, activeExecutions - 1);
+        }
+    };
+    return {
+        id,
+        get status() {
+            // Four members, and no new one: a cluster-side disappearance and a
+            // host-side destroy both read as 'destroyed' here and are told
+            // apart by the error a later call throws.
+            if (lifecycle !== 'active')
+                return 'destroyed';
+            return activeExecutions > 0 ? 'busy' : 'ready';
+        },
+        rootDir: options.rootDir,
+        environment: detectEnvironment(),
+        async exec(command, argv, opts) {
+            return await runExecution('exec', async () => await transport.exec(command, argv, opts));
+        },
+        /**
+         * Every `tcp` request dials a fresh connection, so its envelope is
+         * also that connection's first, not-yet-authenticated frame and is
+         * bounded by the guest's pre-auth frame ceiling (8 MiB by default).
+         * A body above it is no longer a refusal: the transport splits it
+         * into parts that each fit, writes them to a temporary sibling of
+         * the target and finishes with an atomic rename, so this method
+         * takes a body of any size the transport's `maxWriteFileBytes`
+         * admits (1 GiB by default). The named refusals that remain are
+         * passed through unwrapped so a caller can catch them BY CLASS:
+         * `AgentWriteFileTooLargeError` for a body above that bound, and
+         * `AgentPreauthFrameTooLargeError` for an oversized body against a
+         * guest too old to advertise the part protocol.
+         */
+        async writeFile(path, content) {
+            assertAdmissible('writeFile');
+            const buf = Buffer.isBuffer(content) ? content : Buffer.from(content, 'utf8');
+            await transport.writeFile(path, buf);
+        },
+        /**
+         * A whole-file read is served by the guest's streamed op when the
+         * guest advertises it, so neither side holds the file's base64 form
+         * or its JSON envelope in one piece and a file of any size this
+         * workspace's disk holds can be read. `offset`/`length` ask for one
+         * slice instead; a guest too old to honour them is refused with
+         * `AgentReadFileStreamUnsupportedError` rather than answering with
+         * the whole file.
+         */
+        async readFile(path, readOptions) {
+            assertAdmissible('readFile');
+            return await transport.readFile(path, readOptions);
+        },
+        /**
+         * Chunks, in order, with nothing whole at either end — what a host
+         * draining a large output file before `destroy()` needs. The
+         * admissibility check runs at the call, not per chunk: a workspace
+         * suspended mid-stream takes its pod's connection with it, which is
+         * what ends the iteration.
+         */
+        readFileStream(path, readOptions) {
+            assertAdmissible('readFileStream');
+            return transport.readFileStream(path, readOptions);
+        },
+        // Present only when the backend was configured for per-sandbox egress
+        // — see {@link KubernetesSandboxBaseOptions.setNetworkPolicy}. The
+        // admissibility gate is this file's, not the writer's, so a destroyed
+        // or cluster-removed sandbox refuses BY NAME here, exactly as every
+        // other method does, rather than failing at the API server one round
+        // trip later.
+        ...(setNetworkPolicy !== undefined
+            ? {
+                setNetworkPolicy: async (policy) => {
+                    assertAdmissible('setNetworkPolicy');
+                    await setNetworkPolicy(policy);
+                },
+            }
+            : {}),
+        async openTerminal(terminalOptions) {
+            assertAdmissible('openTerminal');
+            const terminal = await transport.openTerminal(terminalOptions);
+            terminals.add(terminal);
+            void terminal.exited.finally(() => terminals.delete(terminal));
+            return terminal;
+        },
+        async openTcpConnection(connectOptions) {
+            assertAdmissible('openTcpConnection');
+            return await transport.openTcpConnection(connectOptions);
+        },
+        async listFiles(rootPath) {
+            return await runExecution('listFiles', async () => {
+                // Same wire as docker/aci/firecracker: `find -printf '%p\t%s\n'`,
+                // parsed line by line, with a non-zero exit (a root that does
+                // not exist yet) mapped to "empty" as the SDK contract asks.
+                const result = await transport.exec('find', [rootPath, '-type', 'f', '-printf', '%p\t%s\n']);
+                if (result.exitCode !== 0)
+                    return [];
+                const entries = [];
+                for (const rawLine of result.stdout.split('\n')) {
+                    if (!rawLine)
+                        continue;
+                    const tab = rawLine.indexOf('\t');
+                    if (tab < 0)
+                        continue;
+                    const filePath = rawLine.slice(0, tab);
+                    const size = Number.parseInt(rawLine.slice(tab + 1), 10);
+                    if (!filePath || !Number.isFinite(size))
+                        continue;
+                    entries.push({ path: filePath, size });
+                }
+                return entries;
+            });
+        },
+        /**
+         * Bounded, lazy file discovery — the method the SDK's `glob` and
+         * `grep` builtins refuse a sandbox for not having.
+         *
+         * Built on {@link walkFilesViaExec}, the same host-side enumerator the
+         * Firecracker and docker backends use, over this transport's `exec`:
+         * the guest needs no new agent op, because the walk IS an execution —
+         * `node -e` running the SDK's own walk program and streaming one JSONL
+         * record per match. The guest image is `node:22-bookworm-slim` (see
+         * `k8s/Dockerfile`) and the agent is itself node, so node on the
+         * guest's PATH is a precondition of the agent existing rather than a
+         * new requirement this method introduces.
+         *
+         * Ownership is the same as `exec`'s, and deliberately NOT
+         * `runExecution`'s: that helper wraps one awaited call, and a walk is a
+         * sequence of them. `activeExecutions` is therefore held for the whole
+         * walk rather than per entry — `status` reads `busy` from the first
+         * `next()` to the last, never flapping between yields — and an
+         * unconfirmed cancellation retires this handle exactly as a failed
+         * `exec` cancel does, on the same error class and through the same
+         * `retire()`.
+         *
+         * Cancellation: `options.signal` and the consumer's own
+         * `iterator.return()` both abort the underlying `exec`, which sends
+         * the guest a `cancel-execution` and kills the walk's process group —
+         * so breaking out of the loop after five entries leaves nothing
+         * running in the pod.
+         */
+        async *walkFiles(rootPath, walkOptions) {
+            assertAdmissible('walkFiles');
+            activeExecutions += 1;
+            try {
+                yield* walkFilesViaExec(async (command, argv, execOpts) => await transport.exec(command, argv, execOpts), rootPath, walkOptions);
+            }
+            catch (error) {
+                // The same rule `runExecution` applies, inlined because a
+                // generator cannot be wrapped by it: a command whose
+                // cancellation the guest could not confirm may still be running
+                // in that pod, so the pod stops being reusable.
+                //
+                // TWO SITES, ONE RULE. This block and `runExecution`'s must
+                // change together — #480, which owns the unconfirmed-cancel
+                // rule for this backend, is the next change to both, and a
+                // change that lands in one of them is a bug in the other.
+                if (error instanceof RemoteCancellationUnknownError) {
+                    error.retirement = await retire();
+                }
+                throw error;
+            }
+            finally {
+                activeExecutions = Math.max(0, activeExecutions - 1);
+            }
+        },
+        async destroy(destroyOptions) {
+            if (retirementPromise) {
+                const observation = await retirementPromise;
+                if (observation.accepted)
+                    return;
+                retirementPromise = undefined;
+            }
+            // A terminal owns an interactive process tree in this pod. Stop and
+            // await every one before releasing the object, so the SDK's
+            // ownership contract is real rather than best-effort bookkeeping.
+            lifecycle = lifecycle === 'active' ? 'retiring' : lifecycle;
+            lease?.stop();
+            const activeTerminals = [...terminals];
+            for (const terminal of activeTerminals)
+                terminal.kill('SIGKILL');
+            await Promise.allSettled(activeTerminals.map((terminal) => terminal.exited));
+            terminals.clear();
+            // Deleting the claim cascades to the sandbox it adopted through the
+            // ownerReferences the controller re-parents on bind, so one DELETE
+            // retires the pod, the Service and the object. An object that is
+            // already gone counts as released — that is the state DELETE was
+            // asking for.
+            await teardown(destroyOptions?.signal);
+        },
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/backends/kubernetes/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../src/backends/kubernetes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAmBH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EACN,8BAA8B,GAE9B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAGnD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC,wEAAwE;AACxE,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAI/C;IACA;IAJQ,IAAI,GAAG,iCAAiC,CAAA;IAE1D,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,wBAAwB,SAAS,+IAA+I,CACjN,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAI1C;IACA;IAJQ,IAAI,GAAG,4BAA4B,CAAA;IAErD,YACU,SAAiB,EACjB,WAAmB;QAE5B,KAAK,CACJ,sBAAsB,WAAW,qCAAqC,SAAS,8OAA8O,CAC7T,CAAA;QALQ,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;IAK7B,CAAC;CACD;AAoGD,SAAS,iBAAiB;IACzB,wEAAwE;IACxE,qEAAqE;IACrE,wCAAwC;IACxC,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAiB,CAAA;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAA;IAGjD,IAAI,SAAS,GAAc,QAAQ,CAAA;IACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,eAA0C,CAAA;IAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAC5B,IAAI,iBAAoE,CAAA;IACxE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAE5C,sEAAsE;IACtE,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,wEAAwE;IACxE,mEAAmE;IACnE,2EAA2E;IAC3E,uEAAuE;IACvE,wBAAwB;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACd,uBAAuB,OAAO,CAAC,IAAI,8CAA8C,MAAM,CAAC,UAAU,CAAC,oUAAoU,CACva,CAAA;IACF,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,KAAK,GACV,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAC9C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,sBAAsB,CAAC;YAC3B,UAAU;YACV,KAAK;YACL,MAAM,EAAE,GAAG,EAAE;gBACZ,+DAA+D;gBAC/D,iEAAiE;gBACjE,8CAA8C;gBAC9C,IAAI,SAAS,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAA;YAC/C,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAA;IACL,KAAK,EAAE,KAAK,EAAE,CAAA;IAEd,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACpD,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAM;QAClC,IAAI,SAAS,KAAK,MAAM;YAAE,MAAM,IAAI,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QACvF,MAAM,IAAI,+BAA+B,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAiB,EAAE;QACxD,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,KAAK,EAAE,IAAI,EAAE,CAAA;QACb,IAAI,gBAAgB;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9C,IAAI,eAAe;YAAE,OAAO,eAAe,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,GAAG,EAAE;YACJ,gBAAgB,GAAG,IAAI,CAAA;YACvB,SAAS,GAAG,WAAW,CAAA;QACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YAClB,8DAA8D;YAC9D,2DAA2D;YAC3D,iBAAiB;YACjB,IAAI,eAAe,KAAK,MAAM;gBAAE,eAAe,GAAG,SAAS,CAAA;YAC3D,MAAM,KAAK,CAAA;QACZ,CAAC,CACD,CAAA;QACD,eAAe,GAAG,MAAM,CAAA;QACxB,OAAO,MAAM,CAAA;IACd,CAAC,CAAA;IAED;;;;;OAKG;IACH,MAAM,MAAM,GAAG,GAA0C,EAAE;QAC1D,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,UAAU,CAAA;QAClD,iBAAiB,KAAK,IAAI,iBAAiB,CAC1C,qBAAqB,EACrB,sBAAsB,OAAO,CAAC,IAAI,aAAa,CAC/C;aACC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;YAC3B,QAAQ,EAAE,KAAc;YACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAChE,CAAC,CAAC,CAAA;QACJ,OAAO,iBAAiB,CAAA;IACzB,CAAC,CAAA;IAED;;;;OAIG;IACH,MAAM,8BAA8B,GAAG,KAAK,EAC3C,KAAqC,EACG,EAAE;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAA;QAChD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,MAAM,EAAE,CAAA;QAC/C,IAAI,CAAC;YACJ,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;QAAC,OAAO,SAAkB,EAAE,CAAC;YAC7B,kEAAkE;YAClE,kEAAkE;YAClE,oBAAoB;YACpB,OAAO;gBACN,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;aAC5E,CAAA;QACF,CAAC;IACF,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,EAAK,SAAiB,EAAE,GAAqB,EAAc,EAAE;QACtF,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAC3B,gBAAgB,IAAI,CAAC,CAAA;QACrB,IAAI,CAAC;YACJ,OAAO,MAAM,GAAG,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;gBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,KAAK,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;QACrD,CAAC;IACF,CAAC,CAAA;IAED,OAAO;QACN,EAAE;QACF,IAAI,MAAM;YACT,mEAAmE;YACnE,+DAA+D;YAC/D,0CAA0C;YAC1C,IAAI,SAAS,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAA;YAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QAC/C,CAAC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,iBAAiB,EAAE;QAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;YAEzB,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACzF,CAAC;QAED;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;YACrD,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,WAAoC;YAChE,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC5B,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAED;;;;;;WAMG;QACH,cAAc,CAAC,IAAY,EAAE,WAAoC;YAChE,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;YAClC,OAAO,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,cAAc;QACd,GAAG,CAAC,gBAAgB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACA,gBAAgB,EAAE,KAAK,EAAE,MAA4B,EAAiB,EAAE;oBACvE,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;oBACpC,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBAC/B,CAAC;aACD;YACF,CAAC,CAAC,EAAE,CAAC;QAEN,KAAK,CAAC,YAAY,CAAC,eAAoC;YACtD,gBAAgB,CAAC,cAAc,CAAC,CAAA;YAChC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,eAAe,CAAC,CAAA;YAC9D,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvB,KAAK,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC9D,OAAO,QAAQ,CAAA;QAChB,CAAC;QAED,KAAK,CAAC,iBAAiB,CACtB,cAAwC;YAExC,gBAAgB,CAAC,mBAAmB,CAAC,CAAA;YACrC,OAAO,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC/B,OAAO,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;gBACjD,kEAAkE;gBAClE,8DAA8D;gBAC9D,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;gBAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAAE,OAAO,EAAE,CAAA;gBACpC,MAAM,OAAO,GAAuB,EAAE,CAAA;gBACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,OAAO;wBAAE,SAAQ;oBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;oBACjC,IAAI,GAAG,GAAG,CAAC;wBAAE,SAAQ;oBACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;oBACtC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,SAAQ;oBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,OAAO,OAAO,CAAA;YACf,CAAC,CAAC,CAAA;QACH,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,WAAoC;YAEpC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YAC7B,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,KAAK,CAAC,CAAC,gBAAgB,CACtB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAChF,QAAQ,EACR,WAAW,CACX,CAAA;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,0DAA0D;gBAC1D,qDAAqD;gBACrD,gEAAgE;gBAChE,gDAAgD;gBAChD,EAAE;gBACF,4DAA4D;gBAC5D,4DAA4D;gBAC5D,2DAA2D;gBAC3D,0DAA0D;gBAC1D,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,cAAsC;YACnD,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;gBAC3C,IAAI,WAAW,CAAC,QAAQ;oBAAE,OAAM;gBAChC,iBAAiB,GAAG,SAAS,CAAA;YAC9B,CAAC;YACD,oEAAoE;YACpE,4DAA4D;YAC5D,kEAAkE;YAClE,SAAS,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3D,KAAK,EAAE,IAAI,EAAE,CAAA;YACb,MAAM,eAAe,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;YACtC,KAAK,MAAM,QAAQ,IAAI,eAAe;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAChE,MAAM,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;YAC5E,SAAS,CAAC,KAAK,EAAE,CAAA;YACjB,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,iEAAiE;YACjE,cAAc;YACd,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACvC,CAAC;KACD,CAAA;AACF,CAAC"}