@nimbus-sh/worker 0.1.0

package/dist/runtime/runtime-catalog.d.ts

@@ -0,0 +1,99 @@
+/**
+ * runtime-catalog.ts — R2 + Cache API L2 wrapper for the
+ * `nimbus install <runtime>` package manager.
+ *
+ * Per `/workspace/.seal-internal/2026-05-10-true-os/plan.md` §2.3, §2.4:
+ *
+ *   L1 (per-DO SqliteFS) — populated at install time.
+ *   L2 (caches.default per-colo) — sub-ms reads after first hit.
+ *   L3 (R2 nimbus-runtime-cache) — primary source of truth.
+ *
+ * R2 layout:
+ *
+ *   catalog/v1.json                          ← top-level catalog
+ *   manifests/<name>-<version>.json          ← per-version manifest
+ *   blobs/<name>-<version>/<file>            ← content-addressed blobs
+ *
+ * Catalog schema (RuntimeCatalog):
+ *   { version: 1, runtimes: { <name>: { default, versions: { <ver>: { manifest, size_bytes, license } } } } }
+ *
+ * Manifest schema (RuntimeManifest):
+ *   { name, version, license, wasi_namespace, memfs_companion,
+ *     files: [{ path, content, sha256, size, mode? }],
+ *     entrypoints: [{ binName, runner, args[], kind? }] }
+ *
+ * The wave's anti-reqs apply: no setTimeout / no retry / no defensive-
+ * catch. R2 / cache failures throw; the verb's UX surface formats them.
+ */
+/** Minimal R2Bucket shape we depend on. */
+type R2BucketLike = {
+    get(key: string): Promise<{
+        arrayBuffer(): Promise<ArrayBuffer>;
+        text(): Promise<string>;
+    } | null>;
+} | null | undefined;
+/** Minimal env shape this module consumes. */
+export interface RuntimeCatalogEnv {
+    NIMBUS_RUNTIME_CACHE?: R2BucketLike;
+}
+export interface CatalogVersionEntry {
+    manifest: string;
+    size_bytes: number;
+    license: string;
+}
+export interface CatalogRuntimeEntry {
+    default: string;
+    versions: Record<string, CatalogVersionEntry>;
+}
+export interface RuntimeCatalog {
+    version: 1;
+    runtimes: Record<string, CatalogRuntimeEntry>;
+}
+export interface ManifestFile {
+    /** VFS path relative to ~/.nimbus/runtimes/<name>/<version>/. */
+    path: string;
+    /** R2 key for the content blob. */
+    content: string;
+    /** Hex sha256 of the content blob bytes. */
+    sha256: string;
+    /** Byte size. */
+    size: number;
+    /** Optional file mode hint ("exec" → registered as a shell bin). */
+    mode?: 'exec';
+}
+export interface ManifestEntrypoint {
+    /** Shell command name. */
+    binName: string;
+    /** Runner key (e.g. "clang-runner") — package manager dispatches to
+     *  the right runner factory by this. */
+    runner: string;
+    /** Default args prepended to user args at invocation. */
+    args: string[];
+    /** Optional secondary classification (e.g. "linker" for wasm-ld). */
+    kind?: string;
+}
+export interface RuntimeManifest {
+    name: string;
+    version: string;
+    license: string;
+    /** Which WASI namespace the binaries import — `wasi_unstable` for
+     *  binji clang. `null` for non-WASI runtimes (e.g. Pyodide). */
+    wasi_namespace: string | null;
+    /** Optional sibling-blob VFS path that the runner needs to load
+     *  as a 2nd `modules:` entry (binji's memfs.wasm helper). */
+    memfs_companion: string | null;
+    files: ManifestFile[];
+    entrypoints: ManifestEntrypoint[];
+}
+/** Fetch the top-level catalog. Throws if neither L2 nor R2 has it. */
+export declare function fetchCatalog(env: RuntimeCatalogEnv): Promise<RuntimeCatalog>;
+/** Fetch a per-version manifest by its R2 key. */
+export declare function fetchManifest(env: RuntimeCatalogEnv, manifestKey: string): Promise<RuntimeManifest>;
+/**
+ * Fetch a content-addressed blob by R2 key. Bytes are eternally
+ * cacheable because the key encodes the version. Verifies sha256 if
+ * `expectedSha256` is provided.
+ */
+export declare function fetchBlob(env: RuntimeCatalogEnv, blobKey: string, expectedSha256?: string): Promise<Uint8Array>;
+export {};
+//# sourceMappingURL=runtime-catalog.d.ts.map

package/dist/runtime/runtime-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-catalog.d.ts","sourceRoot":"","sources":["../../src/runtime/runtime-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,2CAA2C;AAC3C,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KACzB,GAAG,IAAI,CAAC,CAAC;CACX,GAAG,IAAI,GAAG,SAAS,CAAC;AAErB,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,CAAC,EAAE,YAAY,CAAC;CACrC;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB;4CACwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;iEAC6D;IAC7D,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,WAAW,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAaD,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoBlF;AAED,kDAAkD;AAClD,wBAAsB,aAAa,CACjC,GAAG,EAAE,iBAAiB,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAwBrB"}

package/dist/runtime/runtime-catalog.js

@@ -0,0 +1,183 @@
+/**
+ * runtime-catalog.ts — R2 + Cache API L2 wrapper for the
+ * `nimbus install <runtime>` package manager.
+ *
+ * Per `/workspace/.seal-internal/2026-05-10-true-os/plan.md` §2.3, §2.4:
+ *
+ *   L1 (per-DO SqliteFS) — populated at install time.
+ *   L2 (caches.default per-colo) — sub-ms reads after first hit.
+ *   L3 (R2 nimbus-runtime-cache) — primary source of truth.
+ *
+ * R2 layout:
+ *
+ *   catalog/v1.json                          ← top-level catalog
+ *   manifests/<name>-<version>.json          ← per-version manifest
+ *   blobs/<name>-<version>/<file>            ← content-addressed blobs
+ *
+ * Catalog schema (RuntimeCatalog):
+ *   { version: 1, runtimes: { <name>: { default, versions: { <ver>: { manifest, size_bytes, license } } } } }
+ *
+ * Manifest schema (RuntimeManifest):
+ *   { name, version, license, wasi_namespace, memfs_companion,
+ *     files: [{ path, content, sha256, size, mode? }],
+ *     entrypoints: [{ binName, runner, args[], kind? }] }
+ *
+ * The wave's anti-reqs apply: no setTimeout / no retry / no defensive-
+ * catch. R2 / cache failures throw; the verb's UX surface formats them.
+ */
+// ── Cache key helpers ────────────────────────────────────────────────
+/** Synthetic L2 cache URLs. Reserved-invalid TLD so they can never
+ *  collide with real user requests. */
+const L2_NS = 'https://nimbus-runtime-cache.invalid';
+const catalogL2Key = () => `${L2_NS}/catalog/v1.json`;
+const manifestL2Key = (key) => `${L2_NS}/${key}`;
+const blobL2Key = (key) => `${L2_NS}/${key}`;
+// ── Fetchers ─────────────────────────────────────────────────────────
+/** Fetch the top-level catalog. Throws if neither L2 nor R2 has it. */
+export async function fetchCatalog(env) {
+    // L2 hot path.
+    const text = await l2GetText(catalogL2Key());
+    if (text)
+        return JSON.parse(text);
+    // R2 path.
+    const r2 = env.NIMBUS_RUNTIME_CACHE;
+    if (!r2) {
+        throw new Error('NIMBUS_RUNTIME_CACHE binding missing — catalog cannot be fetched');
+    }
+    const obj = await r2.get('catalog/v1.json');
+    if (!obj) {
+        throw new Error('catalog/v1.json not in R2 — bundle pipeline has not seeded the catalog');
+    }
+    const catalogText = await obj.text();
+    // Cache for next call. Catalog is small (~1 KB) — 5-min TTL via
+    // Cache-Control: this matches Pyodide-research §D2's "5-min TTL on
+    // packument-style metadata".
+    await l2PutText(catalogL2Key(), catalogText, 300);
+    return JSON.parse(catalogText);
+}
+/** Fetch a per-version manifest by its R2 key. */
+export async function fetchManifest(env, manifestKey) {
+    // L2 hot path.
+    const text = await l2GetText(manifestL2Key(manifestKey));
+    if (text)
+        return JSON.parse(text);
+    // R2 path.
+    const r2 = env.NIMBUS_RUNTIME_CACHE;
+    if (!r2) {
+        throw new Error('NIMBUS_RUNTIME_CACHE binding missing — manifest cannot be fetched');
+    }
+    const obj = await r2.get(manifestKey);
+    if (!obj) {
+        throw new Error(`manifest ${manifestKey} not in R2 — catalog references a missing manifest`);
+    }
+    const manifestText = await obj.text();
+    // 5-min TTL — manifests are content-addressed by version so we
+    // could go eternal, but a short TTL lets us correct a bad upload
+    // by re-running bundle-runtime.mjs without manual cache invalidation.
+    await l2PutText(manifestL2Key(manifestKey), manifestText, 300);
+    return JSON.parse(manifestText);
+}
+/**
+ * Fetch a content-addressed blob by R2 key. Bytes are eternally
+ * cacheable because the key encodes the version. Verifies sha256 if
+ * `expectedSha256` is provided.
+ */
+export async function fetchBlob(env, blobKey, expectedSha256) {
+    // L2 hot path.
+    const cached = await l2GetBytes(blobL2Key(blobKey));
+    if (cached) {
+        if (expectedSha256)
+            await assertSha256(cached, expectedSha256, blobKey);
+        return cached;
+    }
+    // R2 path.
+    const r2 = env.NIMBUS_RUNTIME_CACHE;
+    if (!r2) {
+        throw new Error('NIMBUS_RUNTIME_CACHE binding missing — blob cannot be fetched');
+    }
+    const obj = await r2.get(blobKey);
+    if (!obj) {
+        throw new Error(`blob ${blobKey} not in R2 — manifest references a missing blob`);
+    }
+    const ab = await obj.arrayBuffer();
+    const bytes = new Uint8Array(ab);
+    if (expectedSha256)
+        await assertSha256(bytes, expectedSha256, blobKey);
+    // Eternal-immutable write-back (content-addressed; never changes).
+    await l2PutBytes(blobL2Key(blobKey), bytes);
+    return bytes;
+}
+// ── sha256 verifier ──────────────────────────────────────────────────
+async function assertSha256(bytes, expected, label) {
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    const hex = bytesToHex(new Uint8Array(digest));
+    if (hex !== expected.toLowerCase()) {
+        throw new Error(`sha256 mismatch for ${label}: expected ${expected} got ${hex}`);
+    }
+}
+function bytesToHex(b) {
+    let s = '';
+    for (let i = 0; i < b.length; i++)
+        s += b[i].toString(16).padStart(2, '0');
+    return s;
+}
+// ── L2 (caches.default) helpers ──────────────────────────────────────
+async function l2GetText(key) {
+    try {
+        const c = globalThis.caches;
+        if (!c?.default)
+            return null;
+        const hit = await c.default.match(new Request(key));
+        if (!hit || !hit.ok)
+            return null;
+        return await hit.text();
+    }
+    catch {
+        return null;
+    }
+}
+async function l2PutText(key, text, ttlSeconds) {
+    try {
+        const c = globalThis.caches;
+        if (!c?.default)
+            return;
+        const resp = new Response(text, {
+            headers: {
+                'Content-Type': 'application/json',
+                'Cache-Control': `public, max-age=${ttlSeconds}`,
+            },
+        });
+        await c.default.put(new Request(key), resp);
+    }
+    catch { /* silent */ }
+}
+async function l2GetBytes(key) {
+    try {
+        const c = globalThis.caches;
+        if (!c?.default)
+            return null;
+        const hit = await c.default.match(new Request(key));
+        if (!hit || !hit.ok)
+            return null;
+        const ab = await hit.arrayBuffer();
+        return new Uint8Array(ab);
+    }
+    catch {
+        return null;
+    }
+}
+async function l2PutBytes(key, bytes) {
+    try {
+        const c = globalThis.caches;
+        if (!c?.default)
+            return;
+        const resp = new Response(bytes, {
+            headers: {
+                'Content-Type': 'application/octet-stream',
+                'Cache-Control': 'public, max-age=31536000, immutable',
+            },
+        });
+        await c.default.put(new Request(key), resp);
+    }
+    catch { /* silent */ }
+}

package/dist/runtime/runtime-registry.d.ts

@@ -0,0 +1,136 @@
+/**
+ * runtime-registry.ts — shared shell-command factory for runtime
+ * dispatchers (node, bun, and future native-WASM / Python / Ruby /
+ * AssemblyScript runtimes).
+ *
+ * Why this exists
+ * ───────────────
+ * `node` and `bun` shell-command handlers in src/session/init.ts
+ * shared ~85% of their code: argv parsing for --version / --help /
+ * -e / script-path, VFS lookup, shebang strip, esbuild transform for
+ * .ts/.tsx/.jsx, dispatch to the runner. The duplication had drifted
+ * — only `node` had the primitive #1 nodeFlagSpan fix
+ * (init.ts:233-243), only `node` had primitive-#2 binSpawn ctx
+ * propagation (init.ts:391-403), only `bun` had install / run
+ * subcommand routing.
+ *
+ * `buildRuntimeHandler` returns a single shell-handler function that
+ * encodes the shared contract. Per-runtime variation is supplied
+ * via the `RuntimeSpec` parameter:
+ *
+ *   - name + version + helpText
+ *   - run(): runner fn (runNodeScript / runBunScript / wasm-runner)
+ *   - subcommands: optional map of `<verb> → handler` for
+ *     bun-style `bun install`, `bun run` (node has none today)
+ *   - transform(): optional code rewriter (bun prepends BUN_SHIM_PREAMBLE)
+ *   - supportsBinSpawn: true for node (the .bin handler propagates
+ *     a callerPid); other runtimes use a plain spawn flow.
+ *
+ * Anti-requirements observed
+ * ──────────────────────────
+ *   - NO setTimeout / NO retry / NO defensive-catch added.
+ *   - NO behavioral change vs the pre-refactor handlers — every
+ *     runtime-specific quirk is preserved exactly.
+ *   - Per-runtime test parity: existing primitives-extension probes
+ *     (#1 npx / #2 .bin) and runtime-pkg probes (G1-G4) MUST still
+ *     pass against the refactored handlers — the contract is
+ *     observable behaviour, not implementation shape.
+ */
+import type { FacetManager } from '../facets/manager.js';
+import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
+import type { EsbuildService } from './esbuild-service.js';
+/**
+ * Result shape that runtime-registry expects from a runner. Mirrors
+ * the existing RunFreshResult / RunBunResult shapes — kept narrow so
+ * future runtimes don't have to plumb runtime-internal state.
+ */
+export interface RuntimeRunResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Options the handler passes to the runner. Mirrors RunFreshOpts.
+ */
+export interface RuntimeRunOpts {
+    argv: string[];
+    env: Record<string, string> | undefined;
+    cwd: string | undefined;
+    filename: string;
+    dirname: string;
+    command: string;
+    /** Primitive #1/G4 hooks. node-runner consumes these; other
+     *  runtimes ignore them safely. */
+    skipSpawn?: boolean;
+    callerPid?: number;
+}
+export interface RuntimeSpec {
+    /** Shell-command name: 'node' / 'bun' / 'wasm-runner' / 'python'. */
+    name: string;
+    /** Output of `<name> --version`. Includes the leading 'v' if the
+     *  runtime convention does (Node: 'v20.0.0'; Bun: '1.1.42'). */
+    version: string;
+    /** Multi-line help text for `<name> --help`. */
+    helpText: string;
+    /**
+     * Runner function. Usually wraps facetMgr.exec / facetMgr.spawn.
+     * For native-WASM, this is a thin WebAssembly.instantiate +
+     * function-call helper.
+     */
+    run(facetMgr: FacetManager, code: string, opts: RuntimeRunOpts): Promise<RuntimeRunResult>;
+    /**
+     * Optional pre-execution code transform. Used by Bun to prepend
+     * BUN_SHIM_PREAMBLE; native-WASM runtimes typically skip
+     * this entirely and route around the read-script-from-VFS path
+     * (see `bypassesScriptRead`).
+     */
+    transformCode?(code: string, scriptPath: string): string;
+    /**
+     * Subcommand router. When the first positional arg is a key in
+     * this map, the handler is invoked instead of the standard
+     * script-execution flow. Used by `bun install`, `bun run <script>`.
+     */
+    subcommands?: Record<string, (ctx: any, registry: ShellRegistry) => Promise<number>>;
+    /**
+     * When true, the runtime treats the args list as a binary file
+     * path (NOT a JS script). Used by `wasm-runner` — the args[0] is a
+     * .wasm path, args[1+] are the function name + integer args.
+     * The handler skips the read-and-transform-script flow and calls
+     * `run()` with a synthetic empty `code` — runtimes that set this
+     * flag implement the actual bytes-load inside their runner.
+     */
+    bypassesScriptRead?: boolean;
+    /**
+     * Primitive #1 / G4 — when true, the script-execution branch
+     * propagates `ctx.__nimbusBinSpawn` into RuntimeRunOpts. Only
+     * `node` enables this; bun's runFresh chain doesn't share PID
+     * state with the .bin handler today. Future runtimes set this
+     * iff they share the runFresh contract.
+     */
+    supportsBinSpawn?: boolean;
+}
+/**
+ * Minimal registry shape we depend on. Avoids importing the full
+ * @lifo-sh/core type tree (the shell registry's runtime shape is a
+ * few methods on a Map-like class).
+ */
+export interface ShellRegistry {
+    resolve(name: string): Promise<any> | any;
+}
+/**
+ * Build a shell-handler function for a runtime. The returned function
+ * is the value passed to `registry.register('<name>', handler)`.
+ *
+ * Captures `vfs`, `facetMgr`, `esbuild`, `getEsbuild` (for lazy init)
+ * + the spec. The same factory is used for every runtime; the only
+ * runtime-specific code lives in `spec`.
+ */
+export declare function buildRuntimeHandler(spec: RuntimeSpec, ctx0: {
+    vfs: SqliteVFS;
+    facetMgr: FacetManager;
+    /** Lazy esbuild initialiser. Called once per first .ts/.tsx/.jsx
+     *  invocation — the host owns the init lifecycle. */
+    getEsbuild(): EsbuildService;
+    registry: ShellRegistry;
+}): (ctx: any) => Promise<number>;
+//# sourceMappingURL=runtime-registry.d.ts.map

package/dist/runtime/runtime-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-registry.d.ts","sourceRoot":"","sources":["../../src/runtime/runtime-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;uCACmC;IACnC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;oEACgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3F;;;;;OAKG;IACH,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE;IACJ,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,YAAY,CAAC;IACvB;yDACqD;IACrD,UAAU,IAAI,cAAc,CAAC;IAC7B,QAAQ,EAAE,aAAa,CAAC;CACzB,GACA,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAyR/B"}