@parall/daemon 1.36.0 → 1.37.0

package/dist/browser-pod.d.ts

@@ -46,6 +46,7 @@
  */
 import * as http from 'node:http';
 import { type GatewayLogger } from '@parall/agent-core';
+import { type BrowserProxyConfig } from './clip-runtime/browser-profile-manager.js';
 import { BrowserStateStore, type HydrateResult } from './clip-runtime/browser-state-store.js';
 export interface BrowserPodConfig {
     /** Controller-minted pba_ platform assignment token (ProviderStream bearer). */
@@ -64,6 +65,9 @@ export interface BrowserPodConfig {
     stateDir: string;
     /** bb-browser user-data dir (BB_BROWSER_HOME); where S3 state hydrates in a later PR. */
     homeDir: string;
+    /** Per-profile outbound proxy (controller-injected via PRLL_BROWSER_PROXY_* env on a
+     *  cold pod, or the /assign body on a warm one). null = direct egress. */
+    proxy: BrowserProxyConfig | null;
 }
 /**
  * Resolve and validate the pod's runtime config from the environment. Throws on
@@ -109,6 +113,9 @@ export interface AssignRequest {
     leaseId: string;
     generation: number;
     state?: AssignStateCreds;
+    /** Per-profile outbound proxy (warm-pod counterpart of the cold pod's
+     *  PRLL_BROWSER_PROXY_* env). Absent = direct egress. */
+    proxy?: BrowserProxyConfig;
 }
 type AssignParseResult = {
     ok: true;

package/dist/browser-pod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-pod.d.ts","sourceRoot":"","sources":["../src/browser-pod.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAgB9F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;CACjB;AASD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAsC9F;AAYD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAuBxF;AAED;kEACkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;0EAC0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED,KAAK,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CA4CnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAanF;AAED,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjE,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElG,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;CAClC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpE,GAAG,UAAU,CA0Cb;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAXvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,eAAe,CAA+C;gBAGnD,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAGnD,YAAY,CAAC,EAAE,oBAAoB,YAAA,EACnC,oBAAoB,GAAE,MAAuC;IAGhF;;;;;;OAMG;IACH,OAAO,IAAI,OAAO;IAIlB;qEACiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B;;oDAEgD;IAChD,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAGpD,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,IAAI,CAAC,MAAM,CAqBd;AAqED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,iBAAiB,GAAG,IAAI,CAiC1B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3E;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,iBAAiB,CAAC,CAoF5B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAmDf"}
+{"version":3,"file":"browser-pod.d.ts","sourceRoot":"","sources":["../src/browser-pod.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAgB9F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB;8EAC0E;IAC1E,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAClC;AASD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuC9F;AA6CD,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAuBxF;AAED;kEACkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;0EAC0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;6DACyD;IACzD,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,KAAK,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,CAiEnE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,IAAI,CAwBnF;AAED,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjE,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAElG,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC;IACnB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;CAClC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACpE,GAAG,UAAU,CA0Cb;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAM1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAGpB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAXvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,eAAe,CAA+C;gBAGnD,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAGnD,YAAY,CAAC,EAAE,oBAAoB,YAAA,EACnC,oBAAoB,GAAE,MAAuC;IAGhF;;;;;;OAMG;IACH,OAAO,IAAI,OAAO;IAIlB;qEACiE;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B;;oDAEgD;IAChD,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IAGpD,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,GAAG,IAAI,CAAC,MAAM,CAqBd;AAqED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,iBAAiB,GAAG,IAAI,CAiC1B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3E;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,iBAAiB,CAAC,CA0F5B;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAmDf"}

package/dist/browser-pod.js

@@ -51,7 +51,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { createLogger } from '@parall/agent-core';
-import { BrowserProfileManager } from './clip-runtime/browser-profile-manager.js';
+import { BrowserProfileManager, } from './clip-runtime/browser-profile-manager.js';
 import { BrowserStateStore } from './clip-runtime/browser-state-store.js';
 import { ClipProvider } from './clip-runtime/clip-provider.js';
 import { ClipProcessManager } from './clip-runtime/process-manager.js';
@@ -114,8 +114,37 @@ export function resolveBrowserPodConfig(env = process.env) {
         healthPort: parsePort(env.PRLL_HEALTH_PORT, DEFAULT_HEALTH_PORT),
         stateDir,
         homeDir,
+        proxy: parseProxyEnv(env),
     };
 }
+/** Parse the controller-injected PRLL_BROWSER_PROXY_* env into a proxy config, or
+ *  null when no proxy is set (PRLL_BROWSER_PROXY_SERVER absent → direct egress).
+ *  The cold pod gets these as env; the warm pod's /assign writes the same vars. */
+function parseProxyEnv(env) {
+    const server = env.PRLL_BROWSER_PROXY_SERVER?.trim();
+    // username + password are credential-like passthrough — kept VERBATIM (never
+    // trimmed), because residential-proxy usernames carry session/geo selectors and
+    // a provider could legitimately use surrounding whitespace. Empty string → undefined.
+    const username = env.PRLL_BROWSER_PROXY_USERNAME || undefined;
+    const password = env.PRLL_BROWSER_PROXY_PASSWORD || undefined;
+    if (!server) {
+        // Orphan credentials with no server must FAIL CLOSED, not silently fall through
+        // to direct egress: a misconfigured pod spec that drops the server var while
+        // keeping creds should crash here, not leak traffic past the intended proxy.
+        if (username !== undefined || password !== undefined) {
+            throw new Error('browser-pod: PRLL_BROWSER_PROXY_USERNAME/PASSWORD set without PRLL_BROWSER_PROXY_SERVER');
+        }
+        return null; // no proxy at all → direct egress
+    }
+    // Reject half-auth at the pod boundary too (the server already enforces the
+    // user+pass pair). A version skew / bad pod spec should fail fast here, not
+    // forward incomplete creds to account_create where it becomes a confusing
+    // runtime auth failure.
+    if ((username === undefined) !== (password === undefined)) {
+        throw new Error('browser-pod: PRLL_BROWSER_PROXY_USERNAME and PRLL_BROWSER_PROXY_PASSWORD must be set together');
+    }
+    return { server, username, password };
+}
 /**
  * Resolve a warm pod's identity-less config. Unlike resolveBrowserPodConfig this
  * requires PRLL_POOL_TOKEN (not PRLL_ASSIGNMENT_TOKEN) and NO profile/org — those
@@ -196,7 +225,29 @@ export function parseAssignRequest(body) {
             sessionToken,
         };
     }
-    return { ok: true, value: { assignmentToken, profileId, orgId, leaseId, generation, state } };
+    let proxy;
+    if (b.proxy !== undefined && b.proxy !== null) {
+        if (typeof b.proxy !== 'object')
+            return { ok: false, error: 'proxy must be an object' };
+        const p = b.proxy;
+        const server = str(p.server);
+        if (!server)
+            return { ok: false, error: 'proxy requires server' };
+        // username + password are credentials — preserved VERBATIM (never trimmed);
+        // empty string → undefined. (server is a structured host:port, so it is trimmed.)
+        const username = (typeof p.username === 'string' ? p.username : '') || undefined;
+        const password = (typeof p.password === 'string' ? p.password : '') || undefined;
+        // Reject half-auth (same invariant the server enforces) before it reaches
+        // account_create as a confusing runtime auth failure.
+        if ((username === undefined) !== (password === undefined)) {
+            return { ok: false, error: 'proxy username and password must be provided together' };
+        }
+        proxy = { server, username, password };
+    }
+    return {
+        ok: true,
+        value: { assignmentToken, profileId, orgId, leaseId, generation, state, proxy },
+    };
 }
 /**
  * Apply an /assign payload to `env` (process.env in prod) so the assigned path
@@ -220,6 +271,19 @@ export function applyAssignmentEnv(env, req) {
         if (req.state.endpoint)
             env.PRLL_BROWSER_STATE_ENDPOINT = req.state.endpoint;
     }
+    // Clear any prior proxy env BEFORE applying this assignment's proxy, so a pod
+    // env reused across assignments never inherits a stale credential (a no-proxy
+    // or different-proxy reassignment must not keep the previous profile's creds).
+    delete env.PRLL_BROWSER_PROXY_SERVER;
+    delete env.PRLL_BROWSER_PROXY_USERNAME;
+    delete env.PRLL_BROWSER_PROXY_PASSWORD;
+    if (req.proxy) {
+        env.PRLL_BROWSER_PROXY_SERVER = req.proxy.server;
+        if (req.proxy.username)
+            env.PRLL_BROWSER_PROXY_USERNAME = req.proxy.username;
+        if (req.proxy.password)
+            env.PRLL_BROWSER_PROXY_PASSWORD = req.proxy.password;
+    }
 }
 /** Constant-time bearer comparison against the injected pool token. The pod cannot
  *  verify the JWT signature (no shared secret), so it string-compares the bearer to
@@ -562,7 +626,13 @@ function makeCheckpointer(store) {
 export async function preparePodRuntime(config, env, log) {
     // Real browser runtime — starts bb-browser + Chromium lazily on first invoke,
     // ensures the single profile's account, persists under homeDir (BB_BROWSER_HOME).
-    const browser = new BrowserProfileManager({ homeDir: config.homeDir, log });
+    // A hosted pod serves exactly one profile, so resolveProxy ignores the id and
+    // returns the controller-injected proxy (env on a cold pod, /assign on a warm one).
+    const browser = new BrowserProfileManager({
+        homeDir: config.homeDir,
+        log,
+        resolveProxy: () => config.proxy,
+    });
     // The process manager hosts no installable clips in pod mode — its only job is
     // to advertise the synthetic "browser" capability (getProviderClips appends it
     // because a BrowserProfileManager is present) and route inbound browser invokes

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAgTA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAuD9E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAkTA,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAuD9E"}

package/dist/cli.js

@@ -219,11 +219,11 @@ function cmdServiceUninstall() {
     }
 }
 async function cmdUpdate(checkOnly) {
-    const { resolveClaudeDaemonConfig, resolveBundleDir } = await import('./config.js');
+    const { resolveClaudeDaemonConfig, resolveBundleDir, resolveUpdateSigningEnabled } = await import('./config.js');
     const { DaemonUpdater } = await import('./updater.js');
     const config = resolveClaudeDaemonConfig(process.env);
     const bundleDir = resolveBundleDir(process.env);
-    const signingEnabled = process.env.PRLL_DAEMON_SIGNING_DISABLED !== '1';
+    const signingEnabled = resolveUpdateSigningEnabled(process.env);
     const updater = new DaemonUpdater(bundleDir, config.updateCdnUrl, {
         info: (msg) => console.log(msg),
         warn: (msg) => console.warn(msg),

package/dist/clip-runtime/browser-daemon-env.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Build the env for a spawned bb-browser daemon: inherit the parent env (so the
+ * Chromium it launches keeps PATH / HOME / DISPLAY / XDG / locale / proxy — the
+ * hosted browser-docker pod runs Chrome under Xvfb and depends on these), set
+ * BB_BROWSER_HOME, and strip the **platform credentials the daemon/pod carries**
+ * before they reach the child — bb-browser uses none of them and the Chromium it
+ * launches runs untrusted web content, so credentials must never land in its env:
+ *   - LLM/provider creds (`ANTHROPIC_*` / `OPENAI_*` / `PRLL_CLAUDE_ALLOW_API_KEY`,
+ *     via the maintained `clearAllProviderCreds` SSOT);
+ *   - the machine key (`PRLL_API_KEY=mck_`, BYOC control plane);
+ *   - hosted-pod creds injected by the browser-profile-controller (browser-pod.ts):
+ *     the platform assignment / pool tokens (`PRLL_ASSIGNMENT_TOKEN`,
+ *     `PRLL_POOL_TOKEN`, `pba_`) and the S3 browser-state STS creds (`AWS_*`).
+ * It also drops the hosted browser-state config the controller injects alongside
+ * those creds (`AWS_REGION`, `PRLL_BROWSER_STATE_BUCKET`, `PRLL_STATE_GENERATION`,
+ * `PRLL_BROWSER_STATE_ENDPOINT`): bb-browser never reads it, so dropping it shrinks
+ * the env surface handed to a process running untrusted content. (Unrelated BYOC
+ * host env is out of scope.)
+ *
+ * ts/daemon/AGENTS.md requires the credential env to be overridden before spawning
+ * a child, and with one bb-browser per profile the exposure would otherwise be
+ * multiplied N×. Denylist rather than allowlist: the SAME spawn feeds the Xvfb
+ * Chromium in the hosted pod, whose full env surface can't be exercised locally, so
+ * a too-narrow allowlist would silently break it — a denylist cannot. The hosted
+ * keys below are a safe no-op on a BYOC host (its env never carries them). Exported
+ * for unit testing.
+ */
+export declare function buildBrowserDaemonEnv(baseEnv: NodeJS.ProcessEnv, homeDir: string): NodeJS.ProcessEnv;
+//# sourceMappingURL=browser-daemon-env.d.ts.map

package/dist/clip-runtime/browser-daemon-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-daemon-env.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-daemon-env.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,UAAU,EAC1B,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,UAAU,CAOnB"}

package/dist/clip-runtime/browser-daemon-env.js

@@ -0,0 +1,70 @@
+import { clearAllProviderCreds } from '@parall/agent-core';
+// Env sanitization for the spawned bb-browser daemon child (and the Chromium it
+// launches, which runs untrusted web content). Split out of browser-profile-manager
+// to keep that file under the size threshold; this is a distinct concern (env
+// scrubbing) from the daemon/account/tab lifecycle.
+/** Env vars stripped from the bb-browser child — the platform credentials it must
+ *  never carry, plus hosted browser-state config it doesn't use (in addition to the
+ *  provider creds scrubbed by clearAllProviderCreds). See buildBrowserDaemonEnv. */
+const BROWSER_DAEMON_STRIPPED_ENV = [
+    'PRLL_API_KEY', // machine key (mck_) — BYOC + agent control plane
+    'PRLL_PROVIDER_CONFIG', // JSON ProviderConfig blob — may carry BYO LLM api keys
+    'PRLL_ASSIGNMENT_TOKEN', // hosted pod platform assignment token (pba_)
+    'PRLL_POOL_TOKEN', // hosted warm-pool bootstrap token (pba_)
+    'AWS_ACCESS_KEY_ID', // hosted S3 browser-state STS creds (browser-pod.ts)
+    'AWS_SECRET_ACCESS_KEY',
+    'AWS_SESSION_TOKEN',
+    // AWS credential-RESOLUTION vars: the SDK derives creds from these too (IRSA
+    // web-identity, ECS/EKS container creds, named profile, on-disk cred/config
+    // files), so a child inheriting them could assume the pod's role even without
+    // the static keys above. bb-browser uses none of them.
+    'AWS_WEB_IDENTITY_TOKEN_FILE',
+    'AWS_ROLE_ARN',
+    'AWS_ROLE_SESSION_NAME',
+    'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI',
+    'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+    'AWS_CONTAINER_AUTHORIZATION_TOKEN',
+    'AWS_PROFILE',
+    'AWS_SHARED_CREDENTIALS_FILE',
+    'AWS_CONFIG_FILE',
+    'AWS_REGION', // hosted browser-state config — bb-browser does not use it
+    'PRLL_BROWSER_STATE_REGION', // browser-pod AWS_REGION fallback — same config family
+    'PRLL_BROWSER_STATE_BUCKET',
+    'PRLL_STATE_GENERATION',
+    'PRLL_BROWSER_STATE_ENDPOINT',
+];
+/**
+ * Build the env for a spawned bb-browser daemon: inherit the parent env (so the
+ * Chromium it launches keeps PATH / HOME / DISPLAY / XDG / locale / proxy — the
+ * hosted browser-docker pod runs Chrome under Xvfb and depends on these), set
+ * BB_BROWSER_HOME, and strip the **platform credentials the daemon/pod carries**
+ * before they reach the child — bb-browser uses none of them and the Chromium it
+ * launches runs untrusted web content, so credentials must never land in its env:
+ *   - LLM/provider creds (`ANTHROPIC_*` / `OPENAI_*` / `PRLL_CLAUDE_ALLOW_API_KEY`,
+ *     via the maintained `clearAllProviderCreds` SSOT);
+ *   - the machine key (`PRLL_API_KEY=mck_`, BYOC control plane);
+ *   - hosted-pod creds injected by the browser-profile-controller (browser-pod.ts):
+ *     the platform assignment / pool tokens (`PRLL_ASSIGNMENT_TOKEN`,
+ *     `PRLL_POOL_TOKEN`, `pba_`) and the S3 browser-state STS creds (`AWS_*`).
+ * It also drops the hosted browser-state config the controller injects alongside
+ * those creds (`AWS_REGION`, `PRLL_BROWSER_STATE_BUCKET`, `PRLL_STATE_GENERATION`,
+ * `PRLL_BROWSER_STATE_ENDPOINT`): bb-browser never reads it, so dropping it shrinks
+ * the env surface handed to a process running untrusted content. (Unrelated BYOC
+ * host env is out of scope.)
+ *
+ * ts/daemon/AGENTS.md requires the credential env to be overridden before spawning
+ * a child, and with one bb-browser per profile the exposure would otherwise be
+ * multiplied N×. Denylist rather than allowlist: the SAME spawn feeds the Xvfb
+ * Chromium in the hosted pod, whose full env surface can't be exercised locally, so
+ * a too-narrow allowlist would silently break it — a denylist cannot. The hosted
+ * keys below are a safe no-op on a BYOC host (its env never carries them). Exported
+ * for unit testing.
+ */
+export function buildBrowserDaemonEnv(baseEnv, homeDir) {
+    const env = { ...baseEnv, BB_BROWSER_HOME: homeDir };
+    clearAllProviderCreds(env); // strips ANTHROPIC_* / OPENAI_* / PRLL_CLAUDE_ALLOW_API_KEY
+    for (const key of BROWSER_DAEMON_STRIPPED_ENV) {
+        delete env[key];
+    }
+    return env;
+}

package/dist/clip-runtime/browser-profile-manager.d.ts

@@ -1,6 +1,15 @@
 import { type ViewerTurnConfig } from './browser-viewer-streamer.js';
-type BrowserProfileStatus = 'running' | 'stopped' | 'error';
-interface BrowserProfileManagerOptions {
+export type BrowserProfileStatus = 'running' | 'stopped' | 'error';
+/** Per-profile outbound proxy (BYO provider credentials) bound at bb-browser
+ *  account_create. server is host:port (optional http/https/socks5 scheme);
+ *  username/password authenticate (CDP Fetch.authRequired). Geo/session targeting
+ *  lives inside the username (provider-specific). null/absent = direct egress. */
+export interface BrowserProxyConfig {
+    server: string;
+    username?: string;
+    password?: string;
+}
+export interface BrowserProfileManagerOptions {
     homeDir: string;
     log: {
         info(msg: string): void;
@@ -8,25 +17,45 @@ interface BrowserProfileManagerOptions {
         error(msg: string): void;
     };
     reportStatus?: (profileId: string, status: BrowserProfileStatus, errorMsg?: string) => void;
+    /** Resolve the profile's outbound proxy, called once per bb-browser account
+     *  creation (the single choke point — invoke / open / ensureRuntime all funnel
+     *  through ensureAccount). A proxy change therefore takes effect on the next
+     *  account_create (after a reset). Returning null = direct egress. A thrown
+     *  error fails the account creation closed (better than egressing from the real
+     *  IP for a proxy-configured profile). */
+    resolveProxy?: (profileId: string) => Promise<BrowserProxyConfig | null> | BrowserProxyConfig | null;
 }
-interface BrowserInvokeRequest {
+export interface BrowserInvokeRequest {
     profileId: string;
     account: string;
     command: string;
     input: unknown;
 }
+/**
+ * The host-side browser invoke surface ClipProcessManager depends on. Both
+ * BrowserProfileManager (one bb-browser, multi-account — used by the hosted
+ * browser pod) and BrowserProfilePool (one bb-browser per profile — used by the
+ * BYOC daemon supervisor for true per-profile isolation) satisfy it, so the
+ * synthetic "browser" capability routes through either without caring which.
+ */
+export interface BrowserInvoker {
+    invoke(request: BrowserInvokeRequest): Promise<unknown>;
+}
 export declare class BrowserProfileManager {
     private readonly opts;
     private daemon;
     private starting;
     private restarting;
+    private stopping;
     private readonly ensuredAccounts;
     private readonly ensuringAccounts;
     private readonly reportedStatuses;
     private readonly viewer;
     constructor(opts: BrowserProfileManagerOptions);
     invoke({ profileId, account, command, input }: BrowserInvokeRequest): Promise<unknown>;
-    ensureRuntime(profileId: string): Promise<void>;
+    ensureRuntime(profileId: string, opts?: {
+        forceStatusReport?: boolean;
+    }): Promise<void>;
     openProfile(profileId: string, startUrl?: string): Promise<void>;
     stopProfile(profileId: string): Promise<void>;
     resetProfile(profileId: string): Promise<void>;
@@ -74,7 +103,7 @@ export declare class BrowserProfileManager {
     private restartDaemon;
     private restartDaemonOnce;
     private startDaemon;
+    private startDaemonAttempt;
     private post;
 }
-export {};
 //# sourceMappingURL=browser-profile-manager.d.ts.map

package/dist/clip-runtime/browser-profile-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-profile-manager.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-profile-manager.ts"],"names":[],"mappings":"AAMA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAG5F,KAAK,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAE5D,UAAU,4BAA4B;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpF,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7F;AAeD,UAAU,oBAAoB;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AA0BD,qBAAa,qBAAqB;IAYpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,QAAQ,CAA4C;IAC5D,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAuC;IACxE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAI9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAElB,IAAI,EAAE,4BAA4B;IAWzD,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CtF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe/C,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBhE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7C,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B;;;;OAIG;IACG,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAInC,qEAAqE;YACvD,WAAW;YAWX,kBAAkB;YAYlB,kBAAkB;YAUlB,gBAAgB;YAOhB,oBAAoB;YAKpB,yBAAyB;YAezB,aAAa;YAWb,mBAAmB;IAqBjC;;;;;;;;;;;;OAYG;YACW,uBAAuB;IAiCrC,oFAAoF;YACtE,oBAAoB;YAuBpB,aAAa;YAiCb,qBAAqB;YAKrB,wBAAwB;YAQxB,kBAAkB;YAQlB,yBAAyB;IAqBvC,OAAO,CAAC,YAAY;YAON,WAAW;YAaX,YAAY;YAmBZ,kBAAkB;YAUlB,aAAa;YAUb,iBAAiB;YAsBjB,WAAW;YAmDX,IAAI;CA2BnB"}
+{"version":3,"file":"browser-profile-manager.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-profile-manager.ts"],"names":[],"mappings":"AAOA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAG5F,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnE;;;kFAGkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpF,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5F;;;;;8CAK0C;IAC1C,YAAY,CAAC,EAAE,CACb,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,kBAAkB,GAAG,IAAI,CAAC;CACrE;AAeD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AA6BD,qBAAa,qBAAqB;IAiBpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,QAAQ,CAA4C;IAC5D,OAAO,CAAC,UAAU,CAA8B;IAKhD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAuC;IACxE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAI9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAElB,IAAI,EAAE,4BAA4B;IAWzD,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CtF,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GACzC,OAAO,CAAC,IAAI,CAAC;IAyBV,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBhE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7C,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyD3B;;;;OAIG;IACG,mBAAmB,CACvB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAInC,qEAAqE;YACvD,WAAW;YAWX,kBAAkB;YAYlB,kBAAkB;YAUlB,gBAAgB;YAOhB,oBAAoB;YAKpB,yBAAyB;YAezB,aAAa;YAWb,mBAAmB;IAqBjC;;;;;;;;;;;;OAYG;YACW,uBAAuB;IAiCrC,oFAAoF;YACtE,oBAAoB;YAuBpB,aAAa;YAsCb,qBAAqB;YAKrB,wBAAwB;YAQxB,kBAAkB;YAQlB,yBAAyB;IAqBvC,OAAO,CAAC,YAAY;YAON,WAAW;YAaX,YAAY;YAmCZ,kBAAkB;YAUlB,aAAa;YAUb,iBAAiB;YAyBjB,WAAW;YAuBX,kBAAkB;YA8ElB,IAAI;CA2BnB"}