@parall/daemon 1.34.0 → 1.36.0

package/dist/browser-pod.d.ts

@@ -0,0 +1,294 @@
+#!/usr/bin/env node
+/**
+ * `parall-browser-pod` — the V2 hosted-browser pod entrypoint.
+ *
+ * This is the production replacement for the Go echo-stub (server/cmd/browser-stub):
+ * a single-profile pod that runs the REAL browser stack (Chromium under Xvfb +
+ * bb-browser, started lazily by BrowserProfileManager) and registers to the Clip
+ * Service hub as the "browser" provider for exactly ONE profile.
+ *
+ * It is deliberately NOT the daemon supervisor. The daemon (`index.ts`) is a
+ * Machine: it authenticates with a 90-day `mck_`, polls `/machines/me/*`, and
+ * supervises per-agent subprocesses. A hosted browser pod has none of that — it
+ * is platform infrastructure with a short-lived, controller-minted platform
+ * assignment token (`pba_`) scoped to `(org_id, profile_id, pod_id)`, and serves
+ * a single profile until its lease is released. Per the V2 design (§3.3, §6) this
+ * is an **image/entrypoint-level** slim mode: it reuses the shared clip-runtime
+ * building blocks (ClipProvider / ClipProcessManager / BrowserProfileManager)
+ * without deleting anything from the shared package, so the BYOC daemon path and
+ * its `mck_` identity are untouched.
+ *
+ * Contract (mirrors server/cmd/browser-stub/main.go, the reference implementation):
+ *
+ *   Env (injected by browser-profile-controller's pod spec):
+ *     PRLL_ASSIGNMENT_TOKEN  the pba_ platform assignment token (required)
+ *     PRLL_CLIP_RPC          in-cluster clip-service URL, e.g. http://clip-service:8095 (required)
+ *     PRLL_PROFILE_ID        the profile this pod serves (required)
+ *     PRLL_POD_ID            this pod's name → provider_name; must match the token's pod_id (required)
+ *     PRLL_ORG_ID            owning org (logging only; the hub derives org from the token)
+ *     PRLL_HEALTH_PORT       liveness/readiness listen port (default 8080)
+ *     PRLL_BROWSER_STATE_DIR root for on-disk browser state (default $HOME/.parall-agent)
+ *
+ *   Health (the contract the controller's K8s probes consume):
+ *     GET /livez  -> 200 always (process is alive; a liveness restart trigger).
+ *     GET /readyz -> 200 only while registered to the hub AND not draining, else 503.
+ *       Readiness is ROUTE-readiness, not mere liveness: a started-but-not-yet-
+ *       registered (or disconnected, or token/lease-invalidated) pod reads
+ *       NotReady, so the controller never treats pod existence as routable. The
+ *       hub fences the ProviderStream on the pba_ token + live lease, so loss of
+ *       either drops the registration → isConnected() → false → NotReady.
+ *
+ *   Shutdown (SIGTERM, on pod deletion / lease release): fail readiness FIRST so
+ *   K8s/controller stop routing, THEN tear down the ProviderStream (hub
+ *   unregisters) and the bb-browser daemon — all within terminationGracePeriod.
+ *   The authoritative lease state transition (lease -> released, quota freed) is
+ *   still owned by the controller/api-server, never inferred from the pod exiting.
+ */
+import * as http from 'node:http';
+import { type GatewayLogger } from '@parall/agent-core';
+import { BrowserStateStore, type HydrateResult } from './clip-runtime/browser-state-store.js';
+export interface BrowserPodConfig {
+    /** Controller-minted pba_ platform assignment token (ProviderStream bearer). */
+    assignmentToken: string;
+    /** Clip Service hub URL (h2c in-cluster, e.g. http://clip-service:8095). */
+    clipRpcUrl: string;
+    /** The single profile this pod serves. */
+    profileId: string;
+    /** This pod's name; becomes the provider_name and must match the token's pod_id. */
+    podId: string;
+    /** Owning org — used for local logging only; the hub derives org from the token. */
+    orgId: string;
+    /** Liveness/readiness HTTP port. */
+    healthPort: number;
+    /** Root for on-disk browser state (parent of the bb-browser user-data dir). */
+    stateDir: string;
+    /** bb-browser user-data dir (BB_BROWSER_HOME); where S3 state hydrates in a later PR. */
+    homeDir: string;
+}
+/**
+ * Resolve and validate the pod's runtime config from the environment. Throws on
+ * any missing required var (fail-fast: a pod missing its token / clip-rpc /
+ * profile / pod id can never register, so we crash now instead of starting a
+ * doomed reconnect loop).
+ */
+export declare function resolveBrowserPodConfig(env?: NodeJS.ProcessEnv): BrowserPodConfig;
+/** Resolved warm-pool config — the identity-less env a warm pod boots with. */
+export interface PoolPodConfig {
+    /** Controller-minted pba_ pool bootstrap token; the bearer required on POST /assign. */
+    poolToken: string;
+    /** This warm pod's name → provider_name after assignment; matches the controller pod spec. */
+    podId: string;
+    /** Clip Service hub URL (stable per cluster; injected at pool creation, reused post-assign). */
+    clipRpcUrl: string;
+    /** Liveness/readiness/control HTTP port. */
+    healthPort: number;
+}
+/**
+ * Resolve a warm pod's identity-less config. Unlike resolveBrowserPodConfig this
+ * requires PRLL_POOL_TOKEN (not PRLL_ASSIGNMENT_TOKEN) and NO profile/org — those
+ * arrive later via /assign. PRLL_CLIP_RPC is injected at pool creation (stable per
+ * cluster) so the assigned path needs no extra wiring.
+ */
+export declare function resolvePoolPodConfig(env?: NodeJS.ProcessEnv): PoolPodConfig;
+/** Profile-scoped S3 credentials delivered in an /assign payload (mirrors the
+ *  controller's PodStateCredentials → cold-pod env injection). */
+export interface AssignStateCreds {
+    bucket: string;
+    region: string;
+    endpoint?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+}
+/** The POST /assign body the browser-profile-controller sends to bind a warm pod
+ *  to a profile (design §9 PR10). Wire format is snake_case (Go JSON). */
+export interface AssignRequest {
+    assignmentToken: string;
+    profileId: string;
+    orgId: string;
+    leaseId: string;
+    generation: number;
+    state?: AssignStateCreds;
+}
+type AssignParseResult = {
+    ok: true;
+    value: AssignRequest;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validate + normalize an /assign body (already JSON-parsed). Rejects a missing /
+ * non-pba_ assignment token, a missing profile/lease, and PARTIAL S3 creds (a
+ * half-set would build a misconfigured S3 client — worse than stateless). State is
+ * optional (stateless profile); when present it must be complete.
+ */
+export declare function parseAssignRequest(body: unknown): AssignParseResult;
+/**
+ * Apply an /assign payload to `env` (process.env in prod) so the assigned path
+ * reads identity + S3 creds EXACTLY as the controller injects them into a cold
+ * pod's spec. The AWS_* creds must land in process.env: the S3 client
+ * (browser-state-store buildS3Client) reads the default AWS provider chain.
+ */
+export declare function applyAssignmentEnv(env: NodeJS.ProcessEnv, req: AssignRequest): void;
+/** HTTP outcome of an /assign request. */
+export type AssignOutcome = {
+    status: number;
+    message?: string;
+};
+/** /assign handler: bearer (already stripped of "Bearer ") + parsed-or-raw body. */
+export type AssignHandler = (bearer: string | undefined, body: unknown) => Promise<AssignOutcome>;
+/** Narrow runtime surface the pool path drives after an assignment lands. */
+export interface AssignedRuntime {
+    isReady(): boolean;
+    drain(): Promise<void>;
+}
+/** A live warm-pool assignment controller — its /assign handler + readiness/drain. */
+export interface PoolAssign {
+    handler: AssignHandler;
+    isReady(): boolean;
+    drain(): Promise<void>;
+    assignedLeaseId(): string | null;
+}
+/**
+ * Build the warm pod's /assign controller. The cardinal rules:
+ *   - auth: bearer MUST equal the pool token (constant-time).
+ *   - single-assignment: a warm pod serves ONE profile for life — a repeat for the
+ *     same lease is idempotent (200), a different lease is a conflict (409). The
+ *     lease is claimed SYNCHRONOUSLY so a duplicate/concurrent POST conflicts.
+ *   - eventual readiness: identity is applied then the real runtime is started in
+ *     the BACKGROUND (hydrate + connect take seconds); /readyz is the gate, exactly
+ *     as a cold pod whose Create returns fast and becomes Ready later.
+ * `startRuntime` is injected so the assign flow is testable without a real hub.
+ */
+export declare function createPoolAssign(opts: {
+    poolToken: string;
+    env: NodeJS.ProcessEnv;
+    log: Pick<GatewayLogger, 'info' | 'warn' | 'error'>;
+    startRuntime: (env: NodeJS.ProcessEnv) => Promise<AssignedRuntime>;
+}): PoolAssign;
+/** Minimal ProviderStream surface the runtime needs — kept narrow for testing. */
+export interface PodProvider {
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    isConnected(): boolean;
+}
+/** Minimal browser-runtime surface the runtime needs — kept narrow for testing. */
+export interface PodBrowser {
+    stop(): Promise<void>;
+}
+/**
+ * Narrow S3-checkpoint surface (kept testable, decoupled from BrowserStateStore).
+ * `checkpointPeriodic` runs on a timer while the pod serves; `checkpointFinal` runs
+ * once during drain AFTER bb-browser is stopped, for a consistent snapshot.
+ */
+export interface PodStateCheckpointer {
+    checkpointPeriodic(): Promise<void>;
+    checkpointFinal(): Promise<void>;
+}
+/**
+ * BrowserPodRuntime owns the pod's readiness state and the ordered teardown. It
+ * is deliberately decoupled from the concrete ClipProvider / BrowserProfileManager
+ * (only the narrow PodProvider / PodBrowser surfaces) so the readiness gate and
+ * drain ORDER are unit-testable without a real browser or hub.
+ */
+export declare class BrowserPodRuntime {
+    private readonly provider;
+    private readonly browser;
+    private readonly log;
+    private readonly checkpointer?;
+    private readonly checkpointIntervalMs;
+    private draining;
+    private drainPromise;
+    private checkpointTimer;
+    constructor(provider: PodProvider, browser: PodBrowser, log: Pick<GatewayLogger, 'info' | 'warn' | 'error'>, checkpointer?: PodStateCheckpointer | undefined, checkpointIntervalMs?: number);
+    /**
+     * Route-readiness: registered to the hub AND not draining. `draining` is checked
+     * first so the readiness gate flips false the instant a drain begins — before
+     * the (async) ProviderStream teardown completes. The hub fences the stream on
+     * the pba_ token + live lease, so isConnected() already encodes "token/lease
+     * still valid".
+     */
+    isReady(): boolean;
+    /** Open the ProviderStream, register as the "browser" provider, and start the
+     *  periodic checkpoint loop (if a checkpointer was supplied). */
+    start(): Promise<void>;
+    /** Periodic S3 checkpoints while serving. Best-effort: a checkpoint error is
+     *  logged but never throws (it must not kill the pod); the timer is unref'd so it
+     *  never keeps the process alive on its own. */
+    private startCheckpointLoop;
+    /**
+     * Graceful drain (SIGTERM / lease release): fail readiness FIRST, stop the
+     * periodic checkpoint loop, then tear down the hub stream and the browser, and
+     * finally take ONE last checkpoint AFTER bb-browser is stopped (a consistent
+     * snapshot of the settled state — design §3.2). Idempotent — a second SIGTERM
+     * joins the first.
+     */
+    drain(): Promise<void>;
+}
+/**
+ * Create the liveness/readiness HTTP server. `/livez` is mere process liveness;
+ * `/readyz` is route-readiness driven by `isReady`. Mirrors the Go stub's health
+ * contract so the controller's probes are runtime-agnostic.
+ */
+export declare function createHealthServer(opts: {
+    isLive: () => boolean;
+    isReady: () => boolean;
+    log: Pick<GatewayLogger, 'info' | 'warn' | 'error'>;
+    onAssign?: AssignHandler;
+}): http.Server;
+/**
+ * Build the S3 state store from env, or return null (stateless pod) ONLY when no
+ * bucket is configured (the feature is off). When a bucket IS set, state was
+ * REQUESTED, so the org id (part of the S3 key + the pod's STS prefix scope) and the
+ * activation generation (the single-writer fence) are required: a missing/invalid
+ * value is a controller-injection misconfiguration and FAILS CLOSED (throws) rather
+ * than silently registering a non-persisted profile — silent stateless serving when
+ * state was configured is data loss. The thrown error propagates to pod startup, so
+ * the pod never reaches readiness and the controller releases it on the deadline.
+ */
+export declare function buildStateStore(config: BrowserPodConfig, env: NodeJS.ProcessEnv, log: GatewayLogger): BrowserStateStore | null;
+/** Resolve the periodic checkpoint cadence (ms) from env, clamped to ≥1s. */
+export declare function resolveCheckpointIntervalMs(env: NodeJS.ProcessEnv): number;
+/**
+ * Whether it is SAFE to checkpoint after a hydrate. Checkpoint ONLY when the prior
+ * snapshot was loaded (hydrated) or there was genuinely none (a new profile —
+ * head returned null, so no flags set). If a snapshot EXISTED but could not be
+ * loaded (checksum mismatch, or a download/extract/HEAD error), checkpointing must
+ * be disabled: an empty homeDir would otherwise overwrite the good state, and the
+ * generation fence permits it (this pod's gen is legitimately higher than the
+ * snapshot's). Returns false in that case so the pod runs checkpoint-less, leaving
+ * the existing snapshot untouched rather than clobbering it (simplified durability:
+ * the prior state is preserved in place — there is no controller-side repair).
+ */
+export declare function shouldCheckpointAfterHydrate(result: HydrateResult): boolean;
+/**
+ * Wire the real clip-runtime stack for a hosted browser pod from a resolved config
+ * and return the {@link BrowserPodRuntime} — WITHOUT creating the health server,
+ * binding a port, or parking on a signal. Splitting this out lets the warm-pool
+ * path (runPoolPod) reuse the EXACT assigned-pod wiring after a `/assign` arrives,
+ * while keeping a single control/health server bound on healthPort (the pool path
+ * already owns it). hydrate() runs here — before the provider opens — because
+ * bb-browser launches lazily on first invoke, so the snapshot must be on disk first.
+ */
+export declare function preparePodRuntime(config: BrowserPodConfig, env: NodeJS.ProcessEnv, log: GatewayLogger): Promise<BrowserPodRuntime>;
+/**
+ * Wire the real clip-runtime stack for a hosted browser pod and run until the
+ * abort signal fires (SIGTERM). Returns after the ordered drain completes. This is
+ * the ASSIGNED path: PRLL_ASSIGNMENT_TOKEN + profile are already in env (the
+ * controller's cold-create pod spec). The warm-pool path (runPoolPod) reaches the
+ * same runtime via preparePodRuntime once a `/assign` delivers the identity.
+ */
+export declare function runBrowserPod(env: NodeJS.ProcessEnv, signal: AbortSignal, log: GatewayLogger): Promise<void>;
+/**
+ * Run a WARM pod: bind ONE control/health server (livez/readyz/assign) on
+ * healthPort and park — no Chromium, no profile, no hub registration — until a
+ * `POST /assign` delivers an identity, at which point the pod transitions into the
+ * exact assigned-pod runtime (preparePodRuntime, hydrating S3 like a cold pod). On
+ * SIGTERM, drain the started runtime (if any) then close the server. The single
+ * server is the reason runPoolPod reuses preparePodRuntime rather than runBrowserPod
+ * (which would bind its own health port).
+ */
+export declare function runPoolPod(env: NodeJS.ProcessEnv, signal: AbortSignal, log: GatewayLogger): Promise<void>;
+export {};
+//# sourceMappingURL=browser-pod.d.ts.map

package/dist/browser-pod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-pod.d.ts","sourceRoot":"","sources":["../src/browser-pod.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAgB9F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;CACjB;AASD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAsC9F;AAYD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAuBxF;AAED;kEACkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;0EAC0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,KAAK,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CA4CnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAanF;AAED,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjE,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElG,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;CAClC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpE,GAAG,UAAU,CA0Cb;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAXvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,eAAe,CAA+C;gBAGnD,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAGnD,YAAY,CAAC,EAAE,oBAAoB,YAAA,EACnC,oBAAoB,GAAE,MAAuC;IAGhF;;;;;;OAMG;IACH,OAAO,IAAI,OAAO;IAIlB;qEACiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B;;oDAEgD;IAChD,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAGpD,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,IAAI,CAAC,MAAM,CAqBd;AAqED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,iBAAiB,GAAG,IAAI,CAiC1B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3E;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAoF5B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAmDf"}