@nodetool-ai/compute 0.8.1 → 0.8.3

package/dist/providers/verda-api.js

@@ -0,0 +1,205 @@
+// Verda cloud API transport — authentication, retries, and response decoding.
+//
+// Split from `verda.ts` so the provider reads as lifecycle logic while the
+// awkward parts of the wire protocol live here:
+//
+//   * OAuth2 client-credentials tokens (`POST /v1/oauth2/token`) with a single
+//     in-flight refresh per client, refreshed before expiry.
+//   * The documented rate limits (500 authenticated req/min per project, 60/min
+//     per method+path) surface as 429 + `Retry-After`, honoured with bounded
+//     retries.
+//   * Verda answers instance actions asynchronously: 202 (accepted), 204 (the
+//     single action was already satisfied), 207 (a bulk action partly failed).
+//     Callers get the status code, not a decoded resource, so they can tell
+//     "accepted" from "done".
+//
+// Credentials are injected by the caller (the `WorkerManager` sources them from
+// the secret store); this module never reads `process.env`.
+/** Production base URL. The rendered API reference advertises localhost in its
+ * `servers` block, so it is pinned here rather than taken from a generator. */
+const VERDA_API_BASE_URL = "https://api.verda.com";
+/** Refresh a token this long before it expires, to cover clock skew + latency. */
+const TOKEN_REFRESH_SKEW_MS = 60_000;
+/** Cap on retries of a 429/503 before the call fails. */
+const MAX_RETRIES = 3;
+/** Fallback backoff when a 429 carries no usable `Retry-After`. */
+const DEFAULT_RETRY_DELAY_MS = 2_000;
+/**
+ * A Verda API failure carrying the HTTP status, so callers can tell apart the
+ * failures the brief requires be handled distinctly: no capacity (503),
+ * authentication (401/403), quota/funds (402/422) and malformed input (400).
+ */
+export class VerdaApiError extends Error {
+    status;
+    path;
+    constructor(message, status, path) {
+        super(message);
+        this.status = status;
+        this.path = path;
+        this.name = "VerdaApiError";
+    }
+    /** The provider reported no capacity for the requested configuration. */
+    get isNoCapacity() {
+        return this.status === 503;
+    }
+    /** The credentials were rejected — retrying with the same token cannot help. */
+    get isAuth() {
+        return this.status === 401 || this.status === 403;
+    }
+}
+/**
+ * Reject a resource identifier that would escape its intended API path.
+ *
+ * The Verda Python SDK shipped a path-traversal fix in 1.24.1 (a crafted
+ * resource name or id could redirect an authenticated request to a different
+ * endpoint). NodeTool interpolates ids into paths too — a `provider_ref` read
+ * back from the registry, a volume id from a provider response — so the same
+ * check is enforced here rather than trusted to the far side.
+ */
+export function assertSafeId(id, label) {
+    if (!/^[A-Za-z0-9._-]+$/.test(id)) {
+        throw new Error(`Unsafe Verda ${label} ${JSON.stringify(id)}: ids may contain only ` +
+            `letters, digits, dot, underscore and hyphen`);
+    }
+    return id;
+}
+/** Parse `Retry-After` (delta-seconds or HTTP-date) into milliseconds. */
+function retryAfterMs(header) {
+    if (!header)
+        return DEFAULT_RETRY_DELAY_MS;
+    const seconds = Number(header);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+        return seconds * 1_000;
+    }
+    const date = Date.parse(header);
+    if (!Number.isNaN(date)) {
+        return Math.max(0, date - Date.now());
+    }
+    return DEFAULT_RETRY_DELAY_MS;
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Authenticated Verda REST client. One instance per credential pair holds that
+ * pair's access token; refresh is serialized so a burst of concurrent calls
+ * mints one token rather than racing.
+ */
+export class VerdaApiClient {
+    credentials;
+    baseUrl;
+    accessToken = null;
+    expiresAt = 0;
+    /** In-flight refresh, shared by every caller that arrives during it. */
+    pending = null;
+    constructor(credentials, baseUrl = VERDA_API_BASE_URL) {
+        this.credentials = credentials;
+        this.baseUrl = baseUrl;
+        if (!credentials.clientId || !credentials.clientSecret) {
+            throw new Error("Verda requires both VERDA_CLIENT_ID and VERDA_CLIENT_SECRET");
+        }
+    }
+    /**
+     * Call an authenticated endpoint. Retries 429/503 with backoff, and retries
+     * ONCE after a 401 with a freshly minted token (a token can expire mid-flight);
+     * a second 401 is a credential problem and is surfaced.
+     */
+    async request(method, path, body) {
+        let reauthed = false;
+        for (let attempt = 0;; attempt++) {
+            const token = await this.token();
+            const response = await this.send(method, path, token, body);
+            if (response.status === 401 && !reauthed) {
+                // The token was rejected — drop it and mint a new one exactly once.
+                reauthed = true;
+                this.invalidate();
+                continue;
+            }
+            if ((response.status === 429 || response.status === 503) &&
+                attempt < MAX_RETRIES) {
+                await sleep(retryAfterMs(response.headers.get("retry-after")));
+                continue;
+            }
+            return this.decode(response, method, path);
+        }
+    }
+    /** Drop the cached token, forcing the next call to mint a fresh one. */
+    invalidate() {
+        this.accessToken = null;
+        this.expiresAt = 0;
+    }
+    // --- Internals ----------------------------------------------------------
+    async send(method, path, token, body) {
+        const init = {
+            method,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            signal: AbortSignal.timeout(60_000),
+        };
+        if (body && method !== "GET") {
+            init.body = JSON.stringify(body);
+        }
+        return fetch(`${this.baseUrl}${path}`, init);
+    }
+    async decode(response, method, path) {
+        const text = await response.text().catch(() => "");
+        if (!response.ok) {
+            // Response bodies can echo request fields; include only the provider's
+            // message, never the request body, which carries the worker token.
+            throw new VerdaApiError(`Verda ${method} ${path} failed (${response.status}): ${text.slice(0, 500)}`, response.status, path);
+        }
+        // 202/204 legitimately carry no body — an action was accepted, not applied.
+        let parsed = null;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                // Some creates answer with a bare id rather than JSON; keep the text.
+                parsed = text;
+            }
+        }
+        return { status: response.status, body: parsed };
+    }
+    /** Return a live access token, refreshing when absent or near expiry. */
+    token() {
+        if (this.accessToken && Date.now() < this.expiresAt - TOKEN_REFRESH_SKEW_MS) {
+            return Promise.resolve(this.accessToken);
+        }
+        // Serialize: concurrent callers share one refresh rather than each minting
+        // a token (and burning the per-path rate limit on /oauth2/token).
+        this.pending ??= this.refresh().finally(() => {
+            this.pending = null;
+        });
+        return this.pending;
+    }
+    async refresh() {
+        const response = await fetch(`${this.baseUrl}/v1/oauth2/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Accept: "application/json" },
+            body: JSON.stringify({
+                grant_type: "client_credentials",
+                client_id: this.credentials.clientId,
+                client_secret: this.credentials.clientSecret,
+            }),
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!response.ok) {
+            // Never echo the body: the request carried the client secret and a
+            // provider error may quote it back.
+            throw new VerdaApiError(`Verda authentication failed (${response.status}). Check ` +
+                `VERDA_CLIENT_ID and VERDA_CLIENT_SECRET.`, response.status, "/v1/oauth2/token");
+        }
+        const token = (await response.json());
+        if (!token.access_token) {
+            throw new Error("Verda token response contained no access_token");
+        }
+        this.accessToken = token.access_token;
+        // Treat a missing expires_in conservatively rather than caching forever.
+        const ttl = typeof token.expires_in === "number" ? token.expires_in : 300;
+        this.expiresAt = Date.now() + ttl * 1_000;
+        return token.access_token;
+    }
+}
+//# sourceMappingURL=verda-api.js.map

package/dist/providers/verda-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verda-api.js","sourceRoot":"","sources":["../../src/providers/verda-api.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,6DAA6D;AAC7D,gFAAgF;AAChF,6EAA6E;AAC7E,eAAe;AACf,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,4DAA4D;AAE5D;+EAC+E;AAC/E,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAEnD,kFAAkF;AAClF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,yDAAyD;AACzD,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAgBrC;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAG3B,MAAM;IACN,IAAI;IAHf,YACE,OAAe,EACN,MAAc,EACd,IAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;oBACN,IAAI;QAGb,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IAC7B,CAAC;IAED,gFAAgF;IAChF,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC;IACpD,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,KAAa;IACpD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,yBAAyB;YAClE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,MAAqB;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAON,WAAW;IACX,OAAO;IAPlB,WAAW,GAAkB,IAAI,CAAC;IAClC,SAAS,GAAG,CAAC,CAAC;IACtB,wEAAwE;IAChE,OAAO,GAA2B,IAAI,CAAC;IAE/C,YACmB,WAA6B,EAC7B,OAAO,GAAW,kBAAkB;2BADpC,WAAW;uBACX,OAAO;QAExB,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,MAAmB,EACnB,IAAY,EACZ,IAA8B;QAE9B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAE5D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzC,oEAAoE;gBACpE,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IACE,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;gBACpD,OAAO,GAAG,WAAW,EACrB,CAAC;gBACD,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YAED,OAAO,IAAI,CAAC,MAAM,CAAI,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,UAAU;QACR,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,IAAI,CAChB,MAAmB,EACnB,IAAY,EACZ,KAAa,EACb,IAA8B;QAE9B,MAAM,IAAI,GAAgB;YACxB,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC;QACF,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,QAAkB,EAClB,MAAmB,EACnB,IAAY;QAEZ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,IAAI,aAAa,CACrB,SAAS,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAC5E,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAW,EAAE,CAAC;IACxD,CAAC;IAED,yEAAyE;IACjE,KAAK;QACX,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,qBAAqB,EAAE,CAAC;YAC5E,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QACD,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;gBACpC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;aAC7C,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,mEAAmE;YACnE,oCAAoC;YACpC,MAAM,IAAI,aAAa,CACrB,gCAAgC,QAAQ,CAAC,MAAM,WAAW;gBACxD,0CAA0C,EAC5C,QAAQ,CAAC,MAAM,EACf,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,yEAAyE;QACzE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC;QAC1C,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;CACF"}

package/dist/providers/verda.d.ts

@@ -0,0 +1,75 @@
+import { type ProviderInstance, type ProvisionResult, type WorkerProvider, type WorkerSpec, type WorkerStatus } from "./types.js";
+import { VerdaApiClient, type VerdaCredentials } from "./verda-api.js";
+export declare class VerdaProvider implements WorkerProvider {
+    private readonly api;
+    constructor(credentials: VerdaCredentials, api?: VerdaApiClient);
+    provision(spec: WorkerSpec): Promise<ProvisionResult>;
+    status(ref: string): Promise<WorkerStatus>;
+    /**
+     * Pause: release the GPU compute, retain the OS volume and its model cache.
+     *
+     * This DELETES the Verda instance. A `shutdown` would keep billing the full
+     * instance rate (Verda removed hibernate for the same reason), so it is not
+     * the operation the cost guard needs.
+     */
+    stop(ref: string): Promise<void>;
+    /**
+     * Resume: create a NEW machine that boots from the retained OS volume.
+     *
+     * Returns a new provider ref (the instance id changed). Verda can refuse for
+     * lack of capacity, which surfaces as a distinct error rather than a retry.
+     */
+    resume(ref: string): Promise<ProvisionResult>;
+    /**
+     * Destroy the worker AND its OS volume — the real teardown that ends every
+     * charge. The volume is deleted PERMANENTLY: a trashed volume still occupies
+     * the storage quota and can be restored (at a charge for the deleted
+     * interval), which is not what "terminate" promises. The model cache is gone.
+     */
+    terminate(ref: string): Promise<void>;
+    list(): Promise<ProviderInstance[]>;
+    private resultFor;
+    /**
+     * Pick the guest OS image. An explicit `osImage` is validated against the
+     * live catalog (a typo would otherwise fail deep inside provisioning); with
+     * none set, prefer an image that ships CUDA and Docker, which the bootstrap
+     * script needs.
+     */
+    private resolveOsImage;
+    /**
+     * Resolve the required `location_code` against LIVE availability — a catalog
+     * entry is not a reservation, so this is re-read immediately before each create.
+     * An explicit region is verified rather than trusted.
+     */
+    private resolveLocation;
+    /** Register the spec's public key, reusing an identical existing key. */
+    private ensureSshKey;
+    /**
+     * Create the startup script that turns a bare VM into a NodeTool worker.
+     *
+     * The script is idempotent: Verda runs it on every boot, including after a
+     * resume, and it must not fail on a machine that already has the container.
+     */
+    private createStartupScript;
+    /** `POST /v1/instances`, returning the accepted instance id. */
+    private createInstance;
+    /**
+     * Delete an instance together with every volume attached to it, permanently.
+     *
+     * The volume ids are read back from the instance and NAMED explicitly: an
+     * empty `volume_ids` retains them all, and omitting the field deletes only
+     * the OS volume while detaching the rest — both leave billable storage
+     * behind. Returns false when the instance no longer exists.
+     */
+    private destroyWithVolumes;
+    /**
+     * `PUT /v1/instances` delete. `volumeIds: []` retains every attached volume;
+     * a non-empty list deletes exactly those.
+     */
+    private deleteInstance;
+    /** `GET /v1/instances/{id}`, or null when it no longer exists. */
+    private getInstance;
+    /** Poll until the instance reports `running`, or fail on a terminal state. */
+    private waitForReady;
+}
+//# sourceMappingURL=verda.d.ts.map

package/dist/providers/verda.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verda.d.ts","sourceRoot":"","sources":["../../src/providers/verda.ts"],"names":[],"mappings":"AA2BA,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,cAAc,EAEd,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAiJxB,qBAAa,aAAc,YAAW,cAAc;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiB;IAErC,YAAY,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,cAAc,EAE9D;IAEK,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CA2E1D;IAEK,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAa/C;IAED;;;;;;OAMG;IACG,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAerC;IAED;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAgDlD;IAED;;;;;OAKG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1C;IAEK,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAUxC;IAID,OAAO,CAAC,SAAS;IASjB;;;;;OAKG;YACW,cAAc;IAwC5B;;;;OAIG;YACW,eAAe;IAkC7B,yEAAyE;YAC3D,YAAY;IAkB1B;;;;;OAKG;YACW,mBAAmB;IA0CjC,gEAAgE;YAClD,cAAc;IAmB5B;;;;;;;OAOG;YACW,kBAAkB;IAqBhC;;;OAGG;YACW,cAAc;IA6B5B,kEAAkE;YACpD,WAAW;IAoBzB,8EAA8E;YAChE,YAAY;CA2B3B"}