@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/services/redeploy-decision.js

@@ -0,0 +1,142 @@
+/**
+ * Whether a deployment has anything to do for one app.
+ *
+ * A master restarts — an upgrade, a crash, a laptop waking — and its
+ * boot-time autostart deploys every remote stack again. That is right in
+ * principle: the master is the authority on what a node should run. In
+ * practice it meant the same six artifacts were rebuilt, transferred,
+ * unpacked, `npm install`ed and the six applications restarted, every time,
+ * whether or not a single byte had changed.
+ *
+ * Measured across one afternoon of this session: four master restarts, four
+ * full redeploys, twenty-four application restarts on a node whose files
+ * were identical each time — with every restart's downtime visible from the
+ * onion.
+ *
+ * So: three facts decide, and each is measurable rather than assumed.
+ *
+ *   - the artifact's sha256 against the one the node recorded when the app
+ *     last came up healthy on it — not when it was unpacked: a record written
+ *     at install time claimed «runs this» of files no process had loaded
+ *     (daos/test, 2026-09-24, three apps left on hour-old code);
+ *   - whether the app is running there NOW;
+ *   - whether the configuration it would be started with is about to change
+ *     — credentials, addresses, the app list — because identical files with
+ *     a different environment is a different deployment.
+ *
+ * `leave` is the only new outcome. Everything else behaves as it did.
+ */
+export function decideRedeploy(input) {
+    // "We could not tell" is not "it is the same". A node that never recorded
+    // a checksum — installed by an older master, or by hand — is deployed to.
+    if (input.artifactChanged === null) {
+        return { action: 'deploy', because: 'the node has no record of what it installed' };
+    }
+    if (input.artifactChanged) {
+        return { action: 'deploy', because: 'the artifact changed' };
+    }
+    if (!input.online) {
+        return { action: 'restart', because: 'the same artifact is installed and the app is not running' };
+    }
+    if (input.configChanged) {
+        return {
+            action: 'restart',
+            because: 'the same artifact is installed and the configuration it runs with changed',
+        };
+    }
+    return { action: 'leave', because: 'the same artifact is installed, running, with the same configuration' };
+}
+/**
+ * Whether what the node has is what this deployment would ship.
+ *
+ * `null` when the answer cannot be had: no record on the node, or an
+ * artifact with no checksum of its own. Both are "ask again after
+ * shipping it", never "nothing to do".
+ */
+export function artifactChanged(recorded, checksum) {
+    if (!recorded || !checksum)
+        return null;
+    return recorded !== checksum;
+}
+/** Where a node records the checksum of the artifact it installed. */
+export const ARTIFACT_CHECKSUM_FILE = '.artifact-sha256';
+/**
+ * Where a node records the hash of the app definitions it was given.
+ *
+ * Beside the config rather than derived from it on demand: the body holds
+ * every generated credential on that node, and it should cross the wire once,
+ * in the direction it has to.
+ */
+export const NODE_CONFIG_HASH_FILE = '.omnitron-config-sha256';
+/**
+ * Read that record without turning "there is none" into a failure.
+ *
+ * `cat` of a missing file exits 1, and an `|| true` would swallow a
+ * permission error and an unreachable host with it. This exits 0 for the two
+ * states it knows about and leaves every other failure to the SSH layer.
+ */
+export function readChecksumCommand(remotePath, file = ARTIFACT_CHECKSUM_FILE) {
+    return `if [ -f ${remotePath}/${file} ]; then cat ${remotePath}/${file}; else echo '__none__'; fi`;
+}
+/** What `readChecksumCommand` answered, as a checksum or nothing. */
+export function parseRecordedChecksum(out) {
+    const value = out.trim();
+    if (!value || value === '__none__')
+        return null;
+    // A sha256 and nothing else: a truncated file, or a shell that printed a
+    // warning first, must not be compared as though it were one.
+    return /^[0-9a-f]{64}$/.test(value) ? value : null;
+}
+export function decideNodeStackStart(input) {
+    // Nothing landed is not «nothing to do»: the caller has no list to check
+    // against, so it cannot know the node is running what it should.
+    if (input.apps.length === 0) {
+        return { action: 'start', because: 'no app was named, so nothing here can say the node is running them' };
+    }
+    if (input.configChanged) {
+        return { action: 'start', because: 'the configuration these apps run with changed' };
+    }
+    const down = input.apps.filter((app) => !input.online.has(app));
+    if (down.length > 0) {
+        return {
+            action: 'start',
+            because: `${down.length} of ${input.apps.length} are not running on the node: ${down.join(', ')}`,
+        };
+    }
+    return {
+        action: 'leave',
+        because: `all ${input.apps.length} are running with the configuration they already had`,
+    };
+}
+export function decideSlaveDaemonRestart(input) {
+    if (input.hostChanged) {
+        return { action: 'restart', because: 'the host was prepared, so something under the daemon changed' };
+    }
+    if (input.daemon === null) {
+        return { action: 'restart', because: 'the node would not say what its daemon is doing' };
+    }
+    if (!input.daemon.running) {
+        return { action: 'restart', because: 'the node daemon is not running' };
+    }
+    // An explicit `master` is a wrong role and earns the restart. An ABSENT
+    // one is not evidence of anything, and demanding `=== 'slave'` made this
+    // whole decision unsatisfiable: measured 2026-09-22 against the test node,
+    //
+    //     because=the node daemon is running as no role it would name
+    //     steps=0  role=null  pid=1237622  uptime=273875
+    //
+    // — a daemon plainly up, on a host that needed nothing, taken down anyway
+    // because `omnitron status --json` on that node carries no `role` field at
+    // all. A guard keyed on a value nobody writes is a guard that always
+    // fires, and this one fired by taking six applications down with it.
+    if (input.daemon.role === 'master') {
+        return { action: 'restart', because: 'the node daemon is running as a master, not as a slave' };
+    }
+    return {
+        action: 'leave',
+        because: input.daemon.role === 'slave'
+            ? 'the node daemon is already running as a slave and nothing under it changed'
+            : 'the node daemon is running, it does not name a role, and nothing under it changed',
+    };
+}
+//# sourceMappingURL=redeploy-decision.js.map

package/dist/services/redeploy-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeploy-decision.js","sourceRoot":"","sources":["../../src/services/redeploy-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAuBH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAC;IACrG,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,2EAA2E;SACrF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE,CAAC;AAC9G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAAuB,EAAE,QAA4B;IACnF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,IAAI,GAAW,sBAAsB;IAC3F,OAAO,WAAW,UAAU,IAAI,IAAI,gBAAgB,UAAU,IAAI,IAAI,4BAA4B,CAAC;AACrG,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAChD,yEAAyE;IACzE,6DAA6D;IAC7D,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AA4CD,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC;IAC5G,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,iCAAiC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,sDAAsD;KACxF,CAAC;AACJ,CAAC;AA2CD,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC9D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAC1E,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,EAAE;IACF,kEAAkE;IAClE,qDAAqD;IACrD,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IAClG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YACpC,CAAC,CAAC,4EAA4E;YAC9E,CAAC,CAAC,mFAAmF;KACxF,CAAC;AACJ,CAAC"}

package/dist/services/release.rpc-service.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Release RPC Service — what the console can ask about releases.
+ *
+ * Master-only, like the builds themselves: a release is built from two
+ * checkouts, and only the master has both. A slave exposes nothing here
+ * rather than exposing methods that would refuse.
+ *
+ * The split of roles follows what each call DOES. Reading what was built is
+ * a viewer's business; starting or stopping a fifteen-minute build that will
+ * be deployed is an operator's; deleting one is an administrator's, because
+ * it is the only call that destroys evidence.
+ */
+import type { ReleaseDetail, ReleaseSummary } from '../release/store.js';
+import type { AuditService } from './audit.service.js';
+import type { BuildRecord, ReleaseService } from './release.service.js';
+import type { IOmnitronReleaseService, ReleaseDeploymentDto, ReleasePreflightDto, ReleasePruneAnswer } from '../shared/dto/services.js';
+export declare class ReleaseRpcService implements IOmnitronReleaseService {
+    private readonly releases;
+    private readonly audit?;
+    /** The transport to a stack's node, for attestations run there. */
+    private readonly projects?;
+    constructor(releases: ReleaseService, audit?: AuditService | undefined, 
+    /** The transport to a stack's node, for attestations run there. */
+    projects?: import('./project.service.js').ProjectService | undefined);
+    /**
+     * Whether this master can build at all, before anyone presses Build.
+     *
+     * A daemon started by launchd has the system PATH, and `pnpm` is not on
+     * it. Answering that here turns a fifteen-minute failure into a disabled
+     * button with a reason on it.
+     */
+    preflight(): Promise<ReleasePreflightDto>;
+    list(): Promise<{
+        releases: ReleaseSummary[];
+        root: string;
+    }>;
+    get(data: {
+        id: string;
+    }): Promise<ReleaseDetail>;
+    /**
+     * The tail of one of a build's logs.
+     *
+     * Operator, not viewer: these are the raw outputs of installs and gates,
+     * and a project's test output is not something a read-only console account
+     * is given by default.
+     */
+    getLog(data: {
+        id: string;
+        name: string;
+        lines?: number;
+    }): Promise<{
+        name: string;
+        bytes: number;
+        tail: string;
+    }>;
+    builds(): Promise<BuildRecord[]>;
+    getBuild(data: {
+        buildId: string;
+    }): Promise<BuildRecord | null>;
+    /**
+     * Start a build. Returns as soon as it has started, with the id to watch.
+     *
+     * `env` carries what the gates need and the daemon does not have — daos's
+     * want `TEST_DATABASE__PORT`. The names are checked and the values never
+     * recorded: the audit row keeps the keys, which is what an operator needs
+     * to see when a gate fails for want of one.
+     */
+    build(data: {
+        project: string;
+        projectCommit?: string;
+        omniCommit?: string;
+        forStack?: string;
+        skipGates?: boolean;
+        keepSource?: boolean;
+        env?: Record<string, string>;
+    }): Promise<BuildRecord>;
+    stopBuild(data: {
+        buildId: string;
+    }): Promise<BuildRecord>;
+    /**
+     * Remove all but the newest `keep`, and never a release a stack runs.
+     *
+     * `apply` is what deletes; without it this answers what WOULD go, which is
+     * what the console shows before asking.
+     *
+     * Which releases the stacks run is decided HERE, from this daemon's own
+     * audit trail (`deploymentProtection`). It used to be whatever the caller
+     * sent as `protect`: the console built that list from `deployments()`,
+     * which answers `[]` on a daemon with no audit trail — so the console sent
+     * `protect: []` and its second click removed the release a stack was
+     * running; a direct call with admin rights and no `protect` did the same.
+     * `protect` from the caller now only ADDS to the daemon's list. When the
+     * daemon cannot know — no trail, or a stack that took a release whose name
+     * was not recorded — `apply` is refused unless the caller says, with
+     * `allowUnprotected`, that it accepts removing without knowing.
+     */
+    prune(data: {
+        keep?: number;
+        apply?: boolean;
+        protect?: string[];
+        allowUnprotected?: boolean;
+    }): Promise<ReleasePruneAnswer>;
+    /**
+     * The releases the stacks run, by this daemon's own trail — and, when it
+     * cannot say, why not.
+     */
+    private deploymentProtection;
+    /**
+     * Take an attestation a stack produced about this release.
+     *
+     * The caller hands over what the producer printed, whole; this side
+     * decides whether to keep it (`release/attest.ts`), and refuses in four
+     * named ways. The one refusal that needs this layer is freshness: «older
+     * than the deployment it claims to be about» can only be checked against
+     * the audit trail, which is here and not in the file that does the rest.
+     */
+    attest(data: {
+        release: string;
+        stack: string;
+        stdout: string;
+    }): Promise<import('../shared/dto/services.js').AttestStored>;
+    /**
+     * Run this release's probes on the node of the stack carrying it, and keep
+     * the result if it is one to keep.
+     *
+     * Exit 0 and exit 1 are both stored — a probe that refused is a fact about
+     * the release on that stack, and dropping it would let the next run look
+     * like the first. Exit 2 is the producer failing to measure anything, and
+     * its own words are the refusal. The four refusals of the door itself
+     * (`release/attest.ts`) apply on top, freshness included.
+     *
+     * Long by nature — an upload and a probe suite over SSH — and the console
+     * reaches the daemon through a gateway that cuts a request at 120 s, so the
+     * console calls this with a deadline and says so while it waits.
+     */
+    attestOnNode(data: {
+        release: string;
+        stack: string;
+    }): Promise<import('../shared/dto/services.js').AttestStored & {
+        node: string;
+        scriptsFrom: 'release' | 'history';
+        sourceFiles: number;
+        accounts: 'provisioned' | 'not-declared' | 'producer-cannot';
+    }>;
+    /** When this stack last took this exact release, from the trail. */
+    private lastDeployedAt;
+    /**
+     * What each stack was last started with, from the audit trail.
+     *
+     * The running state lives in memory and a daemon restart empties it; the
+     * `stack.start` rows do not. So «which release is test running» is
+     * answered by the last recorded deployment of it, and the console says
+     * exactly that rather than implying it read the node.
+     */
+    deployments(_data?: {
+        limit?: number;
+    }): Promise<ReleaseDeploymentDto[]>;
+}
+//# sourceMappingURL=release.rpc-service.d.ts.map

package/dist/services/release.rpc-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/release.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAKxI,qBACa,iBAAkB,YAAW,uBAAuB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJ5B,YACmB,QAAQ,EAAE,cAAc,EACxB,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS;IACjD,mEAAmE;IAClD,QAAQ,CAAC,EAAE,OAAO,sBAAsB,EAAE,cAAc,GAAG,SAAS,EACnF;IAEJ;;;;;;OAMG;IAEG,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAoB9C;IAGK,IAAI,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAElE;IAGK,GAAG,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAEtD;IAED;;;;;;OAMG;IAEG,MAAM,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAEvH;IAGK,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAErC;IAGK,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAErE;IAED;;;;;;;OAOG;IAEG,KAAK,CAAC,IAAI,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBvB;IAGK,SAAS,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAS/D;IAED;;;;;;;;;;;;;;;;OAgBG;IAEG,KAAK,CAAC,IAAI,EAAE;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsB9B;IAED;;;OAGG;YACW,oBAAoB;IAgBlC;;;;;;;;OAQG;IAEG,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,2BAA2B,EAAE,YAAY,CAAC,CA6BhI;IAED;;;;;;;;;;;;;OAaG;IAEG,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,2BAA2B,EAAE,YAAY,GAAG;QACvH,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,GAAG,cAAc,GAAG,iBAAiB,CAAC;KAC9D,CAAC,CAUD;IAED,oEAAoE;YACtD,cAAc;IAW5B;;;;;;;OAOG;IAEG,WAAW,CAAC,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAsC7E;CACF"}