@namzu/sandbox 14.0.0 → 16.0.0

package/README.md

@@ -52,6 +52,7 @@ const provider = createSandboxProvider({
     image: 'namzu-sandbox:latest',
     network: 'namzu-tasks',
     labels: { 'example.task-id': taskId },
+    cpuLimit: 2,
   },
   layout: {
     outputs: { source: { type: 'hostDir', hostPath: `/srv/tasks/${taskId}/outputs` } },
@@ -63,6 +64,64 @@ const provider = createSandboxProvider({
 })
 ```
 
+## Container hardening baseline
+
+`container:docker` confines every container it starts, and the argv it builds is
+pinned by a test (`src/backends/docker/__tests__/hardening.test.ts`) so a change
+to the baseline has to get past it on purpose. Each flag carries its own
+argument in `src/backends/docker/index.ts`; in one line each:
+
+| Flag | Why |
+|---|---|
+| `--cap-drop=ALL` | No Linux capability, with no re-add list. `CAP_DAC_OVERRIDE` alone walks past the layout's read-only binds, and `NET_ADMIN` is what would put a default route back on a `deny-all` network. |
+| `--security-opt=no-new-privileges` | A setuid binary inside the image cannot re-escalate. |
+| `--ipc private` | This container's IPC namespace is not joinable. `shareable` (docker's other daemon default) hands every container a namespace of its own as well, but leaves it joinable by name with `--ipc container:<name>`. |
+| `--read-only` | The image is not a place the workload writes; the layout's `outputs` and `scratch` binds are separate mounts and stay writable. |
+| `--tmpfs <path>` | The paths inside the container that do stay writable — see below. |
+| `--memory`, `--pids-limit`, `--cpus` | Bounds the host sets through `defaultMemoryLimitMb`, `defaultMaxProcesses` and `cpuLimit`. All three are unset by default, because the right number is a property of the host's machine and of the workload. |
+
+**What stays writable under `--read-only`.** Four paths, all `--tmpfs`:
+`/tmp`, `/var/tmp`, `/workspace` and `/home/namzu`. The first three are where a
+workload's own scratch goes — `/tmp` is `TMPDIR`, where pip builds wheels and
+where a program compiled in the sandbox is run, so these mounts are deliberately
+executable (docker's own `--tmpfs` default is `noexec`, which would turn that
+into `Permission denied` on a file that is plainly executable). `/home/namzu` is
+the reference image's `HOME`: LibreOffice refuses a headless conversion without a
+writable user profile, and matplotlib, fontconfig, npm and `pip install --user`
+all keep caches there. A host that points `image` at its own build says what
+that image needs with `writableRootfsPaths` — the backend cannot read an image's
+writable set, and the alternative to asking is guessing. `readOnlyRootfs: false`
+turns that control off — the container filesystem is writable again — and turns
+off nothing else: `--cap-drop=ALL`, `--security-opt=no-new-privileges` and
+`--ipc private` are applied whatever it says.
+
+Because those four paths are tmpfs, they are RAM, not the container's writable
+layer: scratch larger than half the host's RAM (or than `--memory`, the tighter
+of the two when the host sets one) fails with `ENOSPC` rather than spilling onto
+the host's disk. A run that writes temp files bigger than its memory budget does
+not have to give up the baseline over it: `layout.scratch` is a bind to a host
+directory and stays disk-backed, so a host with room on disk mounts one there
+and points the workload at it — `TMPDIR` set to that container path through the
+per-call `env` option — which keeps the read-only root filesystem and the four
+paths above. `readOnlyRootfs: false` is the last resort rather than the first:
+it buys the container's own writable layer back at the cost of the control.
+
+**Three controls are deliberately absent.** A seccomp profile: docker applies
+its built-in one to every container and nothing here asks for anything looser,
+so what is missing is a *tighter* profile, and a hand-written one cannot be
+verified here against the reference image's toolchain — a profile that blocks a
+syscall chromium or LibreOffice needs breaks the sandbox, which is worse than
+the gap it closes. Set `seccomp-profile` in the daemon's `daemon.json` if you
+want one. `--userns-remap`: it is a daemon property (`userns-remap` in
+`daemon.json`), not a `docker run` flag — a container only chooses between the
+namespaces the daemon already made (`--userns=host|private`), so whether a
+remapped mapping exists is settled before this backend's argv is read and no
+flag here could settle it. Enable it on the host and every container in this
+tier gets uid 0 mapped to an unprivileged uid outside.
+`--user`: supported through `runAsUser` and unset by default, because `--user`
+overrides the image's own choice and the reference image already ends with
+`USER namzu`.
+
 ## Protocol readiness and cancellation
 
 Pass `SandboxExecOptions.signal` to stop a command on any shipped backend. A
@@ -76,6 +135,22 @@ microVM; a confirmed stop with an incomplete terminal stream is reported
 separately so callers do not mistake partial output for an unknown process
 outcome.
 
+**One exception, and it is the only object here that is not disposable.** A
+persistent Kubernetes workspace is not retired on an unconfirmed stop: the
+retirement there is the `operatingMode: Suspended` patch, which makes the
+controller delete the pod, and a workspace is held by more than one process by
+design. Nothing is written, the handle goes on serving, the rejection carries
+`retirement: { accepted: false, reason: 'workspace-kept' }`, and a bounded
+health probe reports through `onCancellationUnconfirmed` whether the guest
+agent is serving, has fenced itself, or could not be reached — so the host
+decides when the live sessions in that pod go down. Because such a workspace
+is held by more than one process, the writes that DO still go to it — suspend,
+resume, adopt, delete — take an optional monotonic holder epoch, stored on the
+object and tested in the same request that writes, so a superseded process's
+late suspend or late delete is refused by the cluster rather than applied.
+A call that passes no epoch sends exactly the requests it always sent. See
+`docs/sdk/kubernetes-sandbox.md`.
+
 Remote peers retain terminal ids briefly for idempotent cancellation, but evict
 the oldest terminal history before refusing new work. If a command leader exits
 while descendants remain, the peer fences itself and retires the whole sandbox
@@ -102,6 +177,114 @@ while still enough for a fast, well-behaved `SIGTERM` handler's own cleanup;
 a deployment that genuinely needs a longer cooperative-shutdown window sets
 either variable explicitly.
 
+**Retained output, and a command that outlives its connection.** On the
+kubernetes workspace tier a command can be started with a caller-chosen
+`executionId` and `retainOutput`, and then followed — or picked up by a
+different host process — through the additive `attach-execution` op. There is
+ONE retained-output primitive in the guest and every consumer reads it: an
+ordered, size-bounded log of stdout and stderr in a single monotonically
+increasing byte-offset space, so a reader resumes with one number and sees the
+interleaving the command produced. Its bound is bytes, not chunks — a chunk
+larger than the whole budget has its head sliced off rather than being kept
+whole — and eviction advances the log's start offset, so a read from before it
+is answered with a `droppedBytes` count. A gap is reported; output is never
+silently skipped, and offsets are absolute so a stale cursor is always
+answerable. Every delta frame of a retained command carries the byte range it
+occupies — on the `execute` stream as well as on an attach — because a host
+must never derive an offset from what it received: output crosses the wire as
+decoded text, and a chunk that ends inside a multi-byte character does not
+decode to its own byte length. `attach-execution` replays from the requested
+offset, follows the live command, and ends with one terminal frame; it never
+signals the process, and closing an attach connection is a no-op. Ending a
+command stays `cancel-execution`'s job alone. Reserving an id the guest still
+holds reports what it holds rather than minting a second reservation, so a
+retried start runs the command once — a guarantee that ends where the record
+does, at the retention window (`NAMZU_AGENT_EXECUTION_RETAINED_TTL_MS`,
+10 min) and at pod replacement. The cost is bounded twice over, per execution
+(`NAMZU_AGENT_EXECUTION_LOG_BYTES`, 1 MiB) and by how many executions may
+retain at once (`NAMZU_AGENT_MAX_RETAINED_OUTPUT_LOGS`, 32), and only a
+command that asked for retention is kept at all. The guest advertises
+`execution-attach` in `healthz` and a host that asks for a detachable command
+against an image without it is refused before the command is admitted.
+
+**Sessions: a terminal or a program that outlives the host process.** On the
+kubernetes workspace tier a terminal can be opened with a caller-chosen
+`sessionId` and `persistent: true`, and a program can be started with no
+terminal at all through the additive `start-detached` op. Both then belong to
+the guest's session registry rather than to the connection that started them:
+closing the connection DETACHES and sends no signal, `attach-session` replays
+from a byte offset and then follows live, `list-sessions` names what is
+running, and `kill-session` ends one. The registry holds the SAME retained-output
+primitive described above — one ring per session, one monotonic offset space,
+eviction reported as `droppedBytes` — rather than a second one, and output is
+read into it whether or not anybody is attached, so a program with no reader
+never blocks on a full PTY. At most one attachment exists per session: a second
+attach ends the first with a named `detached` frame, so two host processes
+cannot interleave keystrokes into one shell. The registry is in memory only,
+so a replaced pod comes back with none. **A teardown now reaches the whole
+session.** The agent's own comment claimed a process-group kill reached "the
+shell and every descendant"; it did not, because util-linux `script` starts the
+shell in a new session, so a job backgrounded with `&` survived every terminal
+teardown and ran until the pod stopped. Both `kill-session` and a
+non-persistent terminal's teardown now signal every process still in that
+kernel session, found through `/proc`. The cost is bounded per session
+(`NAMZU_AGENT_SESSION_LOG_BYTES`, 1 MiB) and by how many may exist
+(`NAMZU_AGENT_MAX_SESSIONS`, 16), with an exited session's record kept for
+`NAMZU_AGENT_SESSION_TERMINAL_TTL_MS` (10 min). The guest advertises `sessions`
+in `healthz` and a host asking for any of it against an image without the
+string is refused rather than served a connection-bound terminal.
+
+**Quiesce: stop everything the guest is running, and keep serving.** A
+workspace host that takes a final capture of the disk could not make it exact.
+`suspend()` reaches the terminals THAT handle returned and an execution
+somebody cancelled by id; a terminal another host process opened, a command
+already in flight, and above all a program that moved into a session of its own
+with `setsid` and was then reparented away from the agent all kept running, and
+kept writing, until the pod stopped — and once the pod has stopped there is no
+agent left to read the disk through. The additive `quiesce` op is where a host
+stands instead: it marks every running execution BEFORE it signals anything
+(without that mark, a group leader dying before the rest of its group makes an
+execution's close handler fence the agent, and a fenced agent refuses the
+capture the quiesce was performed for), scans `/proc` rather than its own
+children, skips PID 1, itself and its own kernel session, then signals in
+rounds — `SIGTERM`, `graceMs`, `SIGKILL` on what is left — until a pass finds
+nothing. A process still present after `SIGKILL` FAILS the call and names its
+pid; it never resolves optimistically. Afterwards `execute`, `read-file` and
+`write-file` all still work, which is the whole point. While it runs, every op
+that would start a process answers `quiesce_in_progress`; the reads do not. The
+general scan covers the guest's PID namespace, which in a pod is the container
+and nothing else, and the agent performs it only when it is the init of that
+namespace or was started by it (`k8s/entrypoint.sh` makes `tini` PID 1 and the
+agent its child); anywhere else it narrows itself to the kernel sessions its own
+registries own and reports `scope: "owned-sessions"` rather than being silently
+weaker. The guest advertises `quiesce` in `healthz` and a host asking an image
+without it is refused by name.
+
+**A workspace's writes reach its disk on purpose.** Nothing in the agent ever
+called `sync`, `syncfs` or `fsync`: a `write-file` answered `ok` as soon as the
+bytes were in the page cache, and a `suspend()` took the pod away as soon as it
+had stopped — which says nothing is writing any more, not that what was written
+arrived. Both halves are closed. A `write-file` now goes through a temp
+sibling, an `fsync`, a rename and a directory `fsync` before it answers, so the
+reply means the bytes are on the device and a write that fails leaves the
+previous contents rather than a truncated file; one `fsync` per part sequence,
+on the last part, covers the whole file. And the additive `flush` op runs
+`syncfs(2)` over the workspace mount, which is the only thing that can reach
+what a COMMAND wrote — the Kubernetes backend sends it and waits for the reply
+before it patches a workspace to `Suspended`, and the agent runs it itself on
+`SIGTERM`, after stopping every process it owns through the same routine
+`quiesce` uses and before exiting 0. The guest advertises `flush` in `healthz`
+**only if it can run one** — the flush runs `sync -f`, and an image that
+strips coreutils has this code and no `sync` — so a host that does not see the
+string is told the image cannot flush rather than being left to read an
+`unknown_op`, or a refusal it can never get past, as a flush that happened.
+
+**The command timeout ceiling is configurable.** The guest agent reads its
+maximum `timeoutMs` from `NAMZU_SANDBOX_MAX_TIMEOUT_MS` — the same variable
+the container worker has always read for the same limit — defaulting to the
+unchanged 30 minutes, and names the variable when it refuses. A request above
+the ceiling is refused, not silently shortened.
+
 Every worker and microVM guest publishes its wire-protocol version in the
 readiness response. The host admits only the exact version implemented by its
 release; missing, older, and newer versions fail before a sandbox handle or
@@ -158,20 +341,71 @@ string is refused at startup in **every** mode: that is the shape a
 downward-API injection takes when it resolved to nothing, and honouring it
 would open precisely the hole the variable was set to close.
 
+Neither the framed wire nor its version changes when the agent grows a
+capability. `healthz` carries a `features` list instead, and a host uses an op
+or a field only when it sees the string there: `write-file-parts` for a body
+written to a temporary sibling in parts and finished with an atomic rename,
+`flush` for the `syncfs` over the workspace mount, `stream-heartbeat` for the
+per-stream liveness frame, and `guest-boot-id` for the agent process's own
+identity.
+
+`guest-boot-id` is a field rather than an op. The agent mints one opaque id at
+startup and stamps it on every reply a caller has already authenticated —
+`reserve-execution`, `cancel-execution` including its `unknown_execution`
+refusal, `read-file`, `write-file`, and the `ready` frame that opens a terminal,
+a session attachment or a `tcp-connect` stream. `healthz`, which is
+unauthenticated, carries only the feature string and no id. It exists because a
+per-instance token cannot answer "is this the same agent": on a container
+orchestrator the token is the pod's uid, and a container restarted in place
+keeps its pod — so the token still works, every call still succeeds, and every
+process the caller started is gone with nothing on the wire saying so. An agent
+that predates the field sends none and a host must read that as "this guest
+cannot tell me", never as a change. A heartbeat is negotiated
+per stream and in both directions — the `terminal` or `tcp-connect` open body
+carries the interval, the agent echoes the interval it will use in its `ready`
+event and only then starts sending, and the host only starts once that echo
+arrived. An agent that predates the field ignores it and echoes nothing, so its
+host behaves exactly as it did; a host that predates it never asks, so it is
+never sent a frame type it would treat as a protocol error. Once negotiated,
+three consecutive intervals with nothing at all arriving end the stream on both
+sides — the same cleanup a closed socket already runs. Both sides count bytes
+rather than whole frames, so a large frame still on its way is proof of life
+like any other; silence while a side has paused reading for backpressure does
+not count; and the echoed interval is honoured only between 100 ms and four
+times what was asked, since each side does its own watchdog arithmetic with
+a number the other sent.
+
 Because the credential rides inside the request envelope, the gate cannot run
 until a whole frame has been parsed — so what an unauthenticated peer may spend
 in that window is bounded rather than trusted, and in the token modes only:
 
 | Variable | Default | What it bounds |
 |---|---|---|
-| `NAMZU_AGENT_MAX_FRAME_BYTES` | 256 MiB | The largest length any frame header may announce, on every listen mode. The 8-hex prefix otherwise permits 4 GiB, which the reader used to honour. Sized for the largest frame the host legitimately writes: a `write-file` carries the whole base64 body in one envelope. |
-| `NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES` | 8 MiB | The same ceiling for a connection that has not yet presented the token, clamped to the one above. Token modes only. It is also the `write-file` ceiling on a token path — see below. |
+| `NAMZU_AGENT_MAX_FRAME_BYTES` | 256 MiB | The largest length any frame header may announce, on every listen mode. The 8-hex prefix otherwise permits 4 GiB, which the reader used to honour. Sized for the largest frame the host legitimately writes: a `write-file` carries the whole base64 body in one envelope when it fits. |
+| `NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES` | 8 MiB | The same ceiling for a connection that has not yet presented the token, clamped to the one above. Token modes only. It is the ceiling on one `write-file` FRAME on a token path, no longer on a file — see below. |
 | `NAMZU_AGENT_MAX_PREAUTH_CONNECTIONS` | 64 | How many connections may be unauthenticated at once. Token modes only. Every bound above is per connection, so without this one they could be paid again on the next connection. A full pool evicts its **oldest** unauthenticated member and serves the arrival — see below for why that direction. |
 | `NAMZU_AGENT_MAX_PREAUTH_BUFFER_BYTES` | 32 MiB | What all unauthenticated connections may buffer **between them**, never less than one pre-auth frame. Token modes only. The count above bounds sockets; this bounds the heap behind them, and the heap is what runs out first. |
 | `NAMZU_AGENT_PREAUTH_IDLE_TIMEOUT_MS` | 10000 | How long a connection may stay unauthenticated while **quiet**. Every byte received resets it, so it retires the connection that says nothing, not the one that says too little. Token modes only, cleared the moment a connection authenticates. |
 | `NAMZU_AGENT_PREAUTH_DEADLINE_MS` | 10000 | How long a connection may stay unauthenticated **at all**, measured from accept and reset by nothing. Token modes only, cleared the moment a connection authenticates, so no long-lived terminal, `tcp-connect` or streaming `execute` is ever measured against it. |
 | `NAMZU_AGENT_REFUSAL_FLUSH_GRACE_MS` | 1000 | How long a refusal frame may take to reach the wire before the socket is destroyed anyway. Every listen mode. A backstop against a peer that has stopped reading, not a budget anything normally spends. |
 
+The `quiesce` op has four bounds and one scope of its own, on every listen mode:
+
+| Variable | Default | What it bounds |
+|---|---|---|
+| `NAMZU_AGENT_QUIESCE_GRACE_MS` | 1000 | How long one round waits after `SIGTERM` before escalating to `SIGKILL`. Clamped below `NAMZU_AGENT_CANCEL_CONFIRM_TIMEOUT_MS`, and a caller-supplied `graceMs` at or above that bound is refused: a marked execution's close handler stops waiting there, so a later escalation would fence the agent mid-quiesce. Not the pod's `terminationGracePeriodSeconds`. |
+| `NAMZU_AGENT_QUIESCE_DEADLINE_MS` | 20000 | The whole op, across every round. Kept well under the host transport's 60s read-idle timeout, because nothing is written on the wire while a quiesce runs — so raise it only up to that timeout (itself configurable on the host), never past it: beyond it the host tears down a quiesce that is working and cannot learn that it did. |
+| `NAMZU_AGENT_QUIESCE_MAX_ROUNDS` | 8 | Scan-and-signal passes before the call reports failure. Rounds exist because a process can be forked while a pass is in flight; a workload forking faster than it can be killed is a failure to report, not a loop to run out the deadline. |
+| `NAMZU_AGENT_QUIESCE_SETTLE_MS` | 1000 | How long the op waits, after everything is gone, for a killed child's `close` event to move its session to `exited` and settle its execution. Bookkeeping only — the processes are already gone, so running out of it does not fail the call. |
+| `NAMZU_AGENT_QUIESCE_SCOPE` | derived | `owned-sessions` narrows the scan to the kernel sessions the agent's own registries own. The only accepted value: the general PID-namespace scan is derived from whether this agent is the init of its own PID namespace or was started by it, and there is deliberately no way to force it on. |
+
+Termination and the flush have two more, on every listen mode:
+
+| Variable | Default | What it bounds |
+|---|---|---|
+| `NAMZU_AGENT_FLUSH_TIMEOUT_MS` | 10000 | One `sync -f` over the workspace mount, whether a host asked for it or the `SIGTERM` handler is running it. Reported unconfirmed rather than abandoned quietly when it expires, because a caller that asked for a flush is usually about to take the pod away. |
+| `NAMZU_AGENT_SHUTDOWN_DEADLINE_MS` | 15000 | The WHOLE `SIGTERM` handler: stop accepting connections, stop every process the guest is running, flush, exit. The agent exits when it expires whatever is still in flight — a process in uninterruptible IO outlives a `SIGKILL` and a `syncfs` takes as long as the device takes, and a handler with no bound would hold the pod open until the kubelet's own `SIGKILL`. Keep it well below the pod's `terminationGracePeriodSeconds`. It is the only bound: a repeat `SIGTERM` is logged and ignored, because in a stopping pod the second one is the kubelet's own (sent as soon as the `preStop` hook returns) rather than anybody asking for a shorter wait. The hook's wait is derived from this number so it outlives it. |
+
 So the most an unauthenticated peer can make the agent hold is
 `NAMZU_AGENT_MAX_PREAUTH_BUFFER_BYTES`, spread over at most
 `NAMZU_AGENT_MAX_PREAUTH_CONNECTIONS` sockets, and both are tunable against the
@@ -214,19 +448,114 @@ this design rests on: the NetworkPolicy ingress rule in front of the agent port
 is the boundary that decides who may reach it at all, and the token and these
 bounds are defence in depth behind it, for a peer already inside that rule.
 
-One consequence is worth naming, because it is the price of putting the
-credential in the envelope rather than in a handshake: a `write-file` body
-travels in the same first frame as the token, so in a token mode the pre-auth
-cap **is** the ceiling on that body — about 6 MiB of file content at the
-default, since the body travels base64-encoded. A deployment that writes larger
-files raises `NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES` to suit, trading pre-auth
-buffer budget for body size. Nothing on the Firecracker path is affected: no
-token mode is active there, so no pre-auth cap applies and a `write-file` frame
-of any size up to `NAMZU_AGENT_MAX_FRAME_BYTES` is accepted exactly as before.
+One consequence used to be worth naming as a limit, because it is the price of
+putting the credential in the envelope rather than in a handshake: a
+`write-file` body travels in the same first frame as the token, so in a token
+mode the pre-auth cap bounds that body — about 6 MiB of file content at the
+default, since the body travels base64-encoded. It is still the bound on one
+frame. It is no longer the bound on a **file**.
+
+`write-file` takes an optional `part` object, and a body too large for one
+frame arrives as a sequence of them:
+
+```jsonc
+// Every part is an ordinary write-file. `path` names a TEMPORARY sibling of
+// the target for the whole sequence, never the target itself.
+{ "op": "write-file", "token": "…", "body": {
+    "path": "seed/.namzu-write-<uuid>-repo.tar.part",
+    "content": "<base64 of this slice>", "encoding": "base64",
+    "part": { "offset": 0, "final": false } } }
+
+// …and the last one renames onto the target.
+{ "op": "write-file", "token": "…", "body": {
+    "path": "seed/.namzu-write-<uuid>-repo.tar.part",
+    "content": "<base64 of the tail>", "encoding": "base64",
+    "part": { "offset": 12582912, "final": true, "renameTo": "seed/repo.tar" } } }
+```
+
+`offset` must equal the temp file's CURRENT size (`0` creates or truncates
+it), so a part that went missing, arrived twice or arrived out of order is
+refused — `write_part_offset_mismatch` — rather than written in the wrong
+place; a per-temp-path lock refuses an overlapping writer outright
+(`write_part_in_flight`). A part whose bytes did not all reach the disk is
+refused too (`write_part_short_write`): one `pwrite` answers a write that
+crosses the volume's free space or an `RLIMIT_FSIZE` with a short count and
+no error, so the agent checks the count it got and the temp file's size
+against what the part claimed before it renames anything. The temp path and
+`renameTo` go through the same workspace jail every other write does, and the
+target changes exactly once, in the final `rename`: a reader never sees a
+half-written file, and a sequence that dies partway leaves the target exactly
+as it was. A host that abandons a sequence removes what it left behind with
+`part: { "discard": true }`, which is idempotent — a path that is not there,
+in a directory that was never created, answers `discarded` and creates
+nothing on the way — and refuses (`write_part_not_a_temp_file`) any path
+whose name, or whose RESOLVED name, is not one of these part files:
+`write-file` removes an abandoned part, never an arbitrary file. A `part`
+that is present but is not an object is refused outright
+(`write_part_invalid_shape`) rather than served as the plain whole-file write
+it resembles.
+
+The guest opts in. `healthz` answers with `features` alongside `ok` and
+`protocolVersion` — `write-file-parts` among them — and a host sends a part
+only to a guest that advertised it: an agent that predates the field would
+ignore `part` and write that slice as a whole file. A deployment that would
+rather send one big frame than several small ones can still raise
+`NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES`, trading pre-auth buffer budget for
+frame size. Nothing on the Firecracker path is affected either way: no token
+mode is active there, so no pre-auth cap applies and a `write-file` frame of
+any size up to `NAMZU_AGENT_MAX_FRAME_BYTES` is accepted exactly as before.
+
+`read-file` has the mirror-image arrangement, for a problem that was never a
+refusal — it just cost more the bigger the file got, until it stopped working.
+The whole-file reply held the file buffer, its base64 string, the JSON string
+and two frame buffers at once, about 7.7x the file: measured against this
+agent over loopback TCP, a 64 MiB read grew it by 405 MiB, and a file of about
+384 MiB or more could not be answered at all because its base64 string is
+longer than V8 permits a string to be. So `read-file` now takes optional
+`offset` and `length` and `pread`s one bounded slice, answering with the WHOLE
+file's `sizeBytes` beside it and with the bytes that exist when the range runs
+past the end; and a new `read-file-stream` op opens the fd once and sends
+`meta`, then base64 `data` frames, then `end`, then the zero-length
+terminator, reusing one read buffer and waiting for the socket to drain
+between chunks. A 1 GiB read grows the agent by about 12 MiB on the same
+measurement.
+
+```jsonc
+// One slice, one reply frame. Capped by NAMZU_AGENT_READ_FILE_RANGE_BYTES
+// (1 MiB): a larger range is REFUSED, not shortened.
+{ "op": "read-file", "token": "…", "body": {
+    "path": "out/report.bin", "encoding": "base64",
+    "offset": 1048576, "length": 262144 } }
+
+// The whole file, as an ordered multi-frame reply.
+{ "op": "read-file-stream", "token": "…", "body": { "path": "out/report.bin" } }
+```
 
-None of this is a wire change. `token` is an optional envelope field, so the
-guest protocol version is deliberately unchanged and no host and no golden
-image has to roll together with this release.
+The guest opts into both together: `healthz`'s `features` list carries both
+strings, `write-file-parts` and `read-file-stream` — one entry for the two
+read shapes, because they ship in the same file and no guest can have one
+without the other. A host that does not see it keeps to the single whole-file
+reply and sends neither — an agent that predates them would ignore
+`offset`/`length` and answer with the whole file, which the caller would read
+as its slice, so the
+host throws `AgentReadFileStreamUnsupportedError` instead. Both new shapes go
+through the same workspace jail the old op used.
+
+Two rules a host writing to this wire has to know. A range must ask for
+`base64`: a `utf8` slice taken at an arbitrary offset can begin or end inside
+a multi-byte character, so the guest refuses one with
+`read_file_range_requires_base64`, while a whole-file read still serves `utf8`
+because its boundaries are the file's own. And `read-file-stream` serves
+regular files only, refusing a directory, a fifo or a device node with
+`read_file_stream_not_a_regular_file` — a regular file that `stat` reports as
+zero bytes and that still has content, the procfs shape, is read to EOF by
+both new shapes rather than answered as empty.
+
+None of this is a wire change. `token`, `part`, `offset` and `length` are
+optional envelope and body fields, `read-file-stream` is a new op nobody is
+obliged to call, and `features` is an additive `healthz` field, so the guest
+protocol version is deliberately unchanged and no host and no golden image
+has to roll together with this release.
 
 What the token is not: a boundary against the sandbox's own workload. Once the
 image entrypoint deprivileges, the agent and the workload share a uid, so a
@@ -282,6 +611,32 @@ that can change egress after admission. A backend must throw when it cannot
 enforce a requested live policy; accepting without applying it would erase the
 security boundary the host relied on.
 
+## Kubernetes per-sandbox egress
+
+The kubernetes backend serves that contract when — and only when —
+`egress.perSandbox` is configured: the method is PRESENT on a task handle
+then and absent otherwise, which is the same omit-rather-than-ignore rule read
+from the other side. A `KubernetesWorkspace` handle never carries it, and
+`createKubernetesWorkspace` refuses a config that sets the option (with
+`KubernetesWorkspacePerSandboxEgressConfigError`, before the first request)
+rather than omitting a method the config asked for. Configured, each
+`setNetworkPolicy` call writes one
+`CiliumNetworkPolicy` for that sandbox alone, named after the claim's uid,
+selecting one per-sandbox pod label, owned by the claim so the cluster
+collects it on `destroy()`, and resolving only once a read-back deep-equals
+what was sent. An empty list deletes that object and leaves the configured
+baseline in force — which is a narrowing only when that baseline denies,
+because cluster policies union.
+
+It has two operator prerequisites, and a host that enables the option without
+them is refused by design rather than by accident: an applied
+`ValidatingAdmissionPolicy` and its binding, which the backend proves before
+its first write and which bound what the host may write, and a separate RBAC
+file granting the policy-write verbs the default Role deliberately withholds.
+Whether such a policy is ENFORCED is a property of the cluster's CNI and is
+not measured anywhere in this repository. See
+`docs/sdk/kubernetes-sandbox.md`.
+
 ## Documentation
 
 - [Namzu docs](https://github.com/cogitave/namzu/tree/main/docs)

package/dist/backends/aci-standby-pool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAEX,8BAA8B,EAS9B,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAc3E;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,mCAAmC,GACzC,cAAc,CAiBhB;AAoMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,IAAI,CAOP"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAEX,8BAA8B,EAU9B,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAc3E;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,mCAAmC,GACzC,cAAc,CAiBhB;AAoMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,IAAI,CAOP"}

package/dist/backends/aci-standby-pool/index.js

@@ -411,12 +411,24 @@ async function spawnAciSandbox(config, options, readiness) {
                     throw new Error(`write-file failed: HTTP ${res.status} ${await res.text()}`);
                 }
             },
-            async readFile(path) {
+            /**
+             * Refused rather than answered whole when a range is asked for —
+             * the worker has no range op, and {@link Sandbox.readFile} says a
+             * backend that takes `offset`/`length` and hands back everything
+             * has given a wrong answer, not a degraded one. `options.signal`
+             * is honoured — one HTTP request is the whole read, so the signal
+             * goes to `fetch`.
+             */
+            async readFile(path, options) {
                 assertActive();
+                if (options?.offset !== undefined || options?.length !== undefined) {
+                    throw new Error('readFile: the standby-pool worker serves whole files only, so offset/length cannot be honoured. Read the file whole, or use a backend that streams.');
+                }
                 const res = await fetch(`${baseUrl}/read-file`, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
                     body: JSON.stringify({ path, encoding: 'base64' }),
+                    signal: options?.signal,
                 });
                 if (!res.ok) {
                     throw new Error(`read-file failed: HTTP ${res.status} ${await res.text()}`);

package/dist/backends/aci-standby-pool/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAcH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,mBAAmB,GACnB,MAAM,mCAAmC,CAAA;AA+E1C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,MAAM,SAAS,GAAG,uBAAuB,CACxC,kBAAkB,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,mBAAmB,EAC1B;QACC,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CACD,CAAA;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACzD,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAGC,EACD,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc,EACd,MAAoB,EACpB,mBAAsC,EAAE;IAExC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;QACpC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,2YAA2Y,CAC3Y,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CACtB,MAAM,EACN,KAAK,EACL,MAAM,CAAC,WAAW,EAClB,IAAI,EACJ,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC9C,SAAS,CAAC,SAAS,EACnB,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;IACD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,iBAAiB,EACjB,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,SAAS,CACnB,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,iBAAiB,EACjB,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,cAAc,CACxB,CAAA;QAGD,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,SAAS,GAAc,QAAQ,CAAA;QACnC,IAAI,iBAEQ,CAAA;QACZ,IAAI,eAA0C,CAAA;QAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QACnD,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,2CAA2C,CAAC,CAAA;YAC1F,CAAC;QACF,CAAC,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAiB,EAAE;YAC/D,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,gBAAgB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC9C,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAC3C,MAAM,OAAO,GAAG,OAAO,CACtB,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,CAAC,CACV,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE;gBACJ,gBAAgB,GAAG,IAAI,CAAA;gBACvB,SAAS,GAAG,WAAW,CAAA;YACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,eAAe,KAAK,MAAM;oBAAE,eAAe,GAAG,SAAS,CAAA;gBAC3D,MAAM,KAAK,CAAA;YACZ,CAAC,CACD,CAAA;YACD,eAAe,GAAG,MAAM,CAAA;YACxB,OAAO,MAAM,CAAA;QACd,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAGZ,EAAE;YACJ,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAA;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC7E,iBAAiB,GAAG,QAAQ;iBAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrB,MAAM,qBAAqB,GAAG,eAAe,KAAK,SAAS,CAAA;gBAC3D,IAAI,CAAC;oBACJ,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAA;oBACzD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACF,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE;gBACV,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAA;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,KAAc;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC,CAAA;YACJ,OAAO,iBAAiB,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,KAAK,EAAK,SAA2B,EAAc,EAAE;YACzE,YAAY,EAAE,CAAA;YACd,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC,CAAA;QAED,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,WAAW,CAAA;gBAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAY;gBAC1B,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAClD,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,OAAgC;gBAEhC,YAAY,EAAE,CAAA;gBACd,gBAAgB,IAAI,CAAC,CAAA;gBACrB,IAAI,CAAC;oBACJ,2EAA2E;oBAC3E,KAAK,CAAC,CAAC,gBAAgB,CACtB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAC/D,QAAQ,EACR,OAAO,CACP,CAAA;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,8BAA8B;wBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;oBACtF,MAAM,KAAK,CAAA;gBACZ,CAAC;wBAAS,CAAC;oBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;gBACrD,CAAC;YACF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,OAA+B;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;oBAC3C,IAAI,WAAW,CAAC,QAAQ;wBAAE,OAAM;oBAChC,iBAAiB,GAAG,SAAS,CAAA;gBAC9B,CAAC;gBACD,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvC,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,QAA2B,EAC3B,cAAsB,EACtB,SAAiB;IAEjB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAiC,CAAA;QACrC,IAAI,CAAC;YACJ,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CACtE,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAM;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,oCAAoC;QACrC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAA8B,EAC9B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAeH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,mBAAmB,GACnB,MAAM,mCAAmC,CAAA;AA+E1C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,MAAM,SAAS,GAAG,uBAAuB,CACxC,kBAAkB,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,mBAAmB,EAC1B;QACC,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CACD,CAAA;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACzD,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAGC,EACD,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc,EACd,MAAoB,EACpB,mBAAsC,EAAE;IAExC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;QACpC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,2YAA2Y,CAC3Y,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CACtB,MAAM,EACN,KAAK,EACL,MAAM,CAAC,WAAW,EAClB,IAAI,EACJ,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC9C,SAAS,CAAC,SAAS,EACnB,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;IACD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,iBAAiB,EACjB,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,SAAS,CACnB,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,iBAAiB,EACjB,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,cAAc,CACxB,CAAA;QAGD,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,SAAS,GAAc,QAAQ,CAAA;QACnC,IAAI,iBAEQ,CAAA;QACZ,IAAI,eAA0C,CAAA;QAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QACnD,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,2CAA2C,CAAC,CAAA;YAC1F,CAAC;QACF,CAAC,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAiB,EAAE;YAC/D,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,gBAAgB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC9C,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAC3C,MAAM,OAAO,GAAG,OAAO,CACtB,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,CAAC,CACV,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE;gBACJ,gBAAgB,GAAG,IAAI,CAAA;gBACvB,SAAS,GAAG,WAAW,CAAA;YACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,eAAe,KAAK,MAAM;oBAAE,eAAe,GAAG,SAAS,CAAA;gBAC3D,MAAM,KAAK,CAAA;YACZ,CAAC,CACD,CAAA;YACD,eAAe,GAAG,MAAM,CAAA;YACxB,OAAO,MAAM,CAAA;QACd,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAGZ,EAAE;YACJ,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAA;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC7E,iBAAiB,GAAG,QAAQ;iBAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrB,MAAM,qBAAqB,GAAG,eAAe,KAAK,SAAS,CAAA;gBAC3D,IAAI,CAAC;oBACJ,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAA;oBACzD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACF,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE;gBACV,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAA;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,KAAc;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC,CAAA;YACJ,OAAO,iBAAiB,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,KAAK,EAAK,SAA2B,EAAc,EAAE;YACzE,YAAY,EAAE,CAAA;YACd,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC,CAAA;QAED,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,WAAW,CAAA;gBAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED;;;;;;;eAOG;YACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgC;gBAC5D,YAAY,EAAE,CAAA;gBACd,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CACd,qJAAqJ,CACrJ,CAAA;gBACF,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBAClD,MAAM,EAAE,OAAO,EAAE,MAAM;iBACvB,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,OAAgC;gBAEhC,YAAY,EAAE,CAAA;gBACd,gBAAgB,IAAI,CAAC,CAAA;gBACrB,IAAI,CAAC;oBACJ,2EAA2E;oBAC3E,KAAK,CAAC,CAAC,gBAAgB,CACtB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAC/D,QAAQ,EACR,OAAO,CACP,CAAA;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,8BAA8B;wBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;oBACtF,MAAM,KAAK,CAAA;gBACZ,CAAC;wBAAS,CAAC;oBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;gBACrD,CAAC;YACF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,OAA+B;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;oBAC3C,IAAI,WAAW,CAAC,QAAQ;wBAAE,OAAM;oBAChC,iBAAiB,GAAG,SAAS,CAAA;gBAC9B,CAAC;gBACD,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvC,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,QAA2B,EAC3B,cAAsB,EACtB,SAAiB;IAEjB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAiC,CAAA;QACrC,IAAI,CAAC;YACJ,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CACtE,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAM;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,oCAAoC;QACrC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAA8B,EAC9B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}