@parall/daemon 1.44.0 → 1.46.0

package/dist/clip-runtime/browser-quiescence.js

@@ -0,0 +1,136 @@
+/**
+ * Browser quiescence — the Chrome-exit barrier before a hosted pod's FINAL
+ * checkpoint.
+ *
+ * Why it exists: bb-browser's SIGTERM handler sends Chrome SIGTERM and
+ * `process.exit(0)`s WITHOUT awaiting it, so "the bb-browser child exited"
+ * does not mean the user-data-dir is quiet — an orphaned Chromium may still be
+ * flushing cookies/IndexedDB, and a snapshot taken then is torn (SQLite
+ * mid-write). The final checkpoint must run only after every browser process
+ * is provably gone.
+ *
+ * Ownership model: the daemon spawns bb-browser with `detached: true`, making
+ * it the LEADER of a fresh process group; bb-browser spawns Chrome with
+ * `detached: false` (verified against its bundled source), so Chrome and every
+ * renderer inherit that group. The group id (= the bb-browser child's pid) is
+ * therefore a complete, daemon-owned handle on the whole browser tree:
+ *
+ *   - liveness  = `kill(-pgid, 0)` (ESRCH ⇒ no member left);
+ *   - shutdown  = one signal to `-pgid` reaches every member;
+ *   - safety    = POSIX reserves a pid while it names a live process group, so
+ *     the pgid cannot be recycled out from under us while any member lives.
+ *     EPERM on the probe means "members exist but none are ours" — our whole
+ *     tree (same uid, always signalable) must already be dead and the id was
+ *     recycled — so it reads as exited, and signalling stops immediately.
+ *
+ * No pid scanning, no /proc string matching, no directory-mtime polling: a
+ * profile's group contains exactly the processes its manager spawned, so
+ * quiescing profile A can never signal profile B.
+ *
+ * One CDP refusal probe remains as a CONFIRMATION (the DevTools listener lives
+ * inside the Chrome process, so a refused connect independently corroborates
+ * process exit) — it is not a second ownership authority.
+ *
+ * Everything is bounded by ONE absolute deadline. If exit cannot be confirmed
+ * by then, the answer is `quiesced: false` and the caller must skip the
+ * checkpoint — never guess safety.
+ */
+const DEFAULT_EXIT_DEADLINE_MS = 8_000;
+const DEFAULT_ESCALATE_GRACE_MS = 2_000;
+const DEFAULT_TOTAL_DEADLINE_MS = 20_000;
+const DEFAULT_POLL_MS = 100;
+const sleep = (ms) => new Promise((r) => setTimeout(r, Math.max(0, ms)));
+/** Probe the group with signal 0. ESRCH → gone; EPERM → gone (see the header:
+ *  our members are always signalable, so EPERM proves the id was recycled to a
+ *  foreign group AFTER our tree fully exited). Anything else → assume alive
+ *  (fail closed: an unreadable probe must not green-light a checkpoint). */
+function groupState(pgid, kill) {
+    try {
+        kill(-pgid, 0);
+        return 'alive';
+    }
+    catch (err) {
+        const code = err.code;
+        return code === 'ESRCH' || code === 'EPERM' ? 'gone' : 'alive';
+    }
+}
+/** Signal the whole group; swallow ESRCH (already gone) and EPERM (recycled to
+ *  a foreign group — never signal what we do not own). */
+function signalGroup(pgid, signal, kill) {
+    try {
+        kill(-pgid, signal);
+    }
+    catch {
+        // ESRCH/EPERM: nothing of ours left to signal.
+    }
+}
+/**
+ * cdpAccepting: does the browser's DevTools endpoint still accept connections?
+ * The listener lives inside the Chrome process, so acceptance ⇒ a browser
+ * process survives. Bare fetch with an abort budget; any failure ⇒ refused.
+ */
+async function cdpAccepting(endpoint, budgetMs) {
+    if (budgetMs <= 0)
+        return false;
+    try {
+        await fetch(`http://${endpoint.host}:${endpoint.port}/json/version`, {
+            signal: AbortSignal.timeout(Math.min(1_000, budgetMs)),
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function awaitBrowserQuiescence(opts) {
+    const kill = opts.kill ?? process.kill.bind(process);
+    const poll = opts.pollMs ?? DEFAULT_POLL_MS;
+    const totalDeadline = Date.now() + (opts.totalDeadlineMs ?? DEFAULT_TOTAL_DEADLINE_MS);
+    const capped = (d) => Math.min(d, totalDeadline);
+    const remaining = () => totalDeadline - Date.now();
+    const log = opts.log;
+    if (opts.pgid == null) {
+        // Nothing was ever spawned — there is no writer to wait for.
+        return { quiesced: true, escalated: false };
+    }
+    const pgid = opts.pgid;
+    // Phase 1 — self-exit: bb-browser's shutdown already SIGTERM'd Chrome; give
+    // the group its own deadline to finish flushing and exit.
+    const exitDeadline = capped(Date.now() + (opts.exitDeadlineMs ?? DEFAULT_EXIT_DEADLINE_MS));
+    let escalated = false;
+    while (groupState(pgid, kill) === 'alive') {
+        if (Date.now() >= exitDeadline)
+            break;
+        await sleep(Math.min(poll, remaining()));
+    }
+    // Phase 2 — escalation: SIGTERM the group, then SIGKILL, each with a capped
+    // grace. A group that survives SIGKILL to the deadline is unconfirmable.
+    for (const signal of ['SIGTERM', 'SIGKILL']) {
+        if (groupState(pgid, kill) === 'gone')
+            break;
+        escalated = true;
+        log?.warn(`browser-quiescence: process group ${pgid} still alive — sending ${signal}`);
+        signalGroup(pgid, signal, kill);
+        const grace = capped(Date.now() + (opts.escalateGraceMs ?? DEFAULT_ESCALATE_GRACE_MS));
+        while (groupState(pgid, kill) === 'alive' && Date.now() < grace) {
+            await sleep(Math.min(poll, remaining()));
+        }
+    }
+    if (groupState(pgid, kill) === 'alive') {
+        return {
+            quiesced: false,
+            escalated,
+            reason: `browser process group ${pgid} survived SIGKILL to the deadline`,
+        };
+    }
+    // Phase 3 — CDP refusal confirmation (corroboration, not authority).
+    if (opts.cdpEndpoint && (await cdpAccepting(opts.cdpEndpoint, remaining()))) {
+        return {
+            quiesced: false,
+            escalated,
+            reason: 'CDP endpoint still accepting connections after the process group exited',
+        };
+    }
+    log?.info(`browser-quiescence: process group ${pgid} exited${escalated ? ' (escalated)' : ''}`);
+    return { quiesced: true, escalated };
+}

package/dist/clip-runtime/browser-readiness.d.ts

@@ -0,0 +1,64 @@
+import type { BrowserProxyConfig } from './browser-profile-manager.js';
+import type { BrowserTargetRegistry } from './browser-target-registry.js';
+/**
+ * Open readiness — an `open` may only report `running` after the runtime is
+ * PROVEN usable, not merely after the processes exist:
+ *
+ *   1. bb-browser answers and the profile's OWNED page target exists (a
+ *      tab-scoped command round-trips against exactly that target);
+ *   2. when a proxy is configured, a real navigation through the proxy
+ *      completes without a transport error — `net::ERR_*` (proxy connect, DNS,
+ *      auth, tunnel, timeout) fails the open with a structured code, while any
+ *      HTTP status FROM THE TARGET (4xx/5xx included) proves the tunnel works. A
+ *      407 is the exception: it is the PROXY demanding auth, not the target, so it
+ *      fails closed as an auth failure — a wrong-credential proxy never passes.
+ *
+ * The probe navigates the owned tab to a ~zero-byte Parall-owned endpoint
+ * (PRLL_BROWSER_PROXY_PROBE_URL override for tests/ops). A 204/2xx response
+ * doesn't commit a navigation, so the page the user opened stays put; the
+ * verdict is read from bb-browser's per-tab network log (`failed` +
+ * `failureReason` carry Chromium's net error). Bounded polling — observation,
+ * never a fixed sleep.
+ */
+export type BrowserReadinessCode = 'BROWSER_PROXY_UNREACHABLE' | 'BROWSER_PROXY_AUTH_FAILED' | 'BROWSER_OPEN_TIMEOUT' | 'BROWSER_RUNTIME_NOT_READY';
+export declare class BrowserReadinessError extends Error {
+    readonly code: BrowserReadinessCode;
+    constructor(code: BrowserReadinessCode, message: string);
+}
+export interface ReadinessHost {
+    log: {
+        info(msg: string): void;
+        warn(msg: string): void;
+    };
+    targets: BrowserTargetRegistry;
+    sendCommand(request: Record<string, unknown> & {
+        method: string;
+        account?: string;
+    }): Promise<Record<string, unknown>>;
+}
+export interface OpenReadinessOptions {
+    proxy: BrowserProxyConfig | null;
+    /** Probe endpoint; tests point this at a local observable proxy target. */
+    probeUrl?: string;
+    deadlineMs?: number;
+    pollIntervalMs?: number;
+}
+/**
+ * Last-resort proxy readiness probe target when no Parall-owned public endpoint
+ * is derivable (e.g. a hosted pod without an injected probe URL). A well-known,
+ * globally-reachable, zero-body 204 (Google's connectivity check) — the probe
+ * only needs SOME public host the proxy can reach to prove egress; the "any HTTP
+ * status = reachable" rule means it never depends on this specific host's
+ * content. Overridable via PRLL_BROWSER_PROXY_PROBE_URL; tests always override
+ * it to a local observable proxy target, never the public internet.
+ */
+export declare const PUBLIC_PROXY_PROBE_FALLBACK_URL = "https://www.gstatic.com/generate_204";
+/** Throws BrowserReadinessError when the profile runtime is not actually usable. */
+export declare function assertOpenReady(host: ReadinessHost, account: string, opts: OpenReadinessOptions): Promise<void>;
+/**
+ * Map Chromium's net error on the probe request to a structured readiness
+ * failure. HTTP-level failures never reach here (any status = pass), so every
+ * failureReason on a proxied probe indicates the proxy path itself broke.
+ */
+export declare function classifyProxyFailure(proxy: BrowserProxyConfig, failureReason: string): BrowserReadinessError;
+//# sourceMappingURL=browser-readiness.d.ts.map

package/dist/clip-runtime/browser-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-readiness.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-readiness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAG1E;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,GAC3B,2BAA2B,GAC3B,sBAAsB,GACtB,2BAA2B,CAAC;AAEhC,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EACnC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,CACT,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,yCAAyC,CAAC;AAEtF,oFAAoF;AACpF,wBAAsB,eAAe,CACnC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AA+GD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,kBAAkB,EACzB,aAAa,EAAE,MAAM,GACpB,qBAAqB,CAqCvB"}

package/dist/clip-runtime/browser-readiness.js

@@ -0,0 +1,161 @@
+import { redactedProxyLabel } from './browser-proxy-reconcile.js';
+import { sleep } from './subprocess.js';
+export class BrowserReadinessError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.code = code;
+        this.name = 'BrowserReadinessError';
+    }
+}
+const DEFAULT_PROBE_DEADLINE_MS = 20_000;
+const DEFAULT_POLL_INTERVAL_MS = 250;
+let probeSeq = 0;
+/**
+ * Last-resort proxy readiness probe target when no Parall-owned public endpoint
+ * is derivable (e.g. a hosted pod without an injected probe URL). A well-known,
+ * globally-reachable, zero-body 204 (Google's connectivity check) — the probe
+ * only needs SOME public host the proxy can reach to prove egress; the "any HTTP
+ * status = reachable" rule means it never depends on this specific host's
+ * content. Overridable via PRLL_BROWSER_PROXY_PROBE_URL; tests always override
+ * it to a local observable proxy target, never the public internet.
+ */
+export const PUBLIC_PROXY_PROBE_FALLBACK_URL = 'https://www.gstatic.com/generate_204';
+/** Throws BrowserReadinessError when the profile runtime is not actually usable. */
+export async function assertOpenReady(host, account, opts) {
+    // 1. Owned target exists + a command round-trips against exactly that target.
+    const targetId = await host.targets.resolveCommandTarget(account);
+    try {
+        await host.sendCommand({
+            method: 'network',
+            action: 'requests',
+            account,
+            tabId: targetId,
+            limit: 1,
+        });
+    }
+    catch (err) {
+        throw new BrowserReadinessError('BROWSER_RUNTIME_NOT_READY', `profile page did not answer a command: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // 2. Proxy reachability — only when a proxy is configured.
+    if (!opts.proxy)
+        return;
+    if (!opts.probeUrl) {
+        // No probe endpoint available (misconfigured host) — surface loudly rather
+        // than silently skipping the check the caller believes happened.
+        throw new BrowserReadinessError('BROWSER_RUNTIME_NOT_READY', 'no proxy probe endpoint configured (PRLL_BROWSER_PROXY_PROBE_URL)');
+    }
+    await probeProxy(host, account, opts);
+}
+/**
+ * Probe the proxy on a SACRIFICIAL profile-owned tab, never the user's page
+ * (fix #5). A fresh `tab_new {account}` lands in the profile's own
+ * BrowserContext (so it egresses through the same proxy), gets navigated to the
+ * ~zero-byte probe URL, and is CLOSED in `finally` — the user's primary tab
+ * keeps whatever URL it was on. The probe URL must be a public, proxy-resolvable
+ * endpoint (see the daemon/pod probe-URL resolution); a cluster-internal host
+ * would never resolve through an external proxy.
+ */
+async function probeProxy(host, account, opts) {
+    const proxy = opts.proxy;
+    const tag = `prllprobe${(probeSeq++).toString(36)}${process.pid.toString(36)}`;
+    const probeUrl = withProbeTag(opts.probeUrl, tag);
+    const deadline = Date.now() + (opts.deadlineMs ?? DEFAULT_PROBE_DEADLINE_MS);
+    const interval = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const created = await host.sendCommand({ method: 'tab_new', account, url: 'about:blank' });
+    const probeTabId = typeof created.tabId === 'string' ? created.tabId : undefined;
+    if (!probeTabId) {
+        throw new BrowserReadinessError('BROWSER_RUNTIME_NOT_READY', 'could not open a probe tab in the profile context');
+    }
+    try {
+        await host.sendCommand({ method: 'open', account, tabId: probeTabId, url: probeUrl });
+        while (Date.now() < deadline) {
+            const entry = await findProbeEntry(host, account, probeTabId, tag);
+            if (entry) {
+                // A 407 is the PROXY itself demanding auth — it proves the proxy is
+                // reachable but NOT that we authenticated, so it must fail closed as an
+                // auth failure, never count as a working tunnel (bad-credential case).
+                if (entry.status === 407) {
+                    throw new BrowserReadinessError('BROWSER_PROXY_AUTH_FAILED', `proxy ${redactedProxyLabel(proxy)} returned 407 (authentication required/rejected)`);
+                }
+                // Any OTHER HTTP status — 4xx/5xx included — means the request traversed
+                // the proxy and got an answer from the TARGET: network path OK. (A 204
+                // probe also emits a benign ERR_ABORTED after the response; status wins.)
+                if (typeof entry.status === 'number') {
+                    host.log.info(`[bb-browser] proxy probe ok for ${account} via ${redactedProxyLabel(proxy)} (HTTP ${entry.status})`);
+                    return;
+                }
+                if (entry.failed === true && typeof entry.failureReason === 'string') {
+                    throw classifyProxyFailure(proxy, entry.failureReason);
+                }
+            }
+            await sleep(interval);
+        }
+        throw new BrowserReadinessError('BROWSER_OPEN_TIMEOUT', `proxy probe through ${redactedProxyLabel(proxy)} did not complete within ${opts.deadlineMs ?? DEFAULT_PROBE_DEADLINE_MS}ms`);
+    }
+    finally {
+        // Always tear down the sacrificial tab — a leaked probe tab would accumulate
+        // and could be mistaken for the profile's primary. Best-effort: a close
+        // failure must not mask the probe verdict.
+        try {
+            await host.sendCommand({ method: 'close', account, tabId: probeTabId });
+        }
+        catch (err) {
+            host.log.warn(`[bb-browser] failed to close proxy probe tab for ${account}: ${String(err)}`);
+        }
+    }
+}
+async function findProbeEntry(host, account, targetId, tag) {
+    const result = await host.sendCommand({
+        method: 'network',
+        action: 'requests',
+        account,
+        tabId: targetId,
+        filter: tag,
+    });
+    const requests = Array.isArray(result.networkRequests)
+        ? result.networkRequests
+        : [];
+    // Newest matching entry wins (retries reuse the tab).
+    for (let i = requests.length - 1; i >= 0; i--) {
+        const r = requests[i];
+        if (typeof r.url === 'string' && r.url.includes(tag)) {
+            return {
+                status: typeof r.status === 'number' ? r.status : undefined,
+                failed: r.failed === true,
+                failureReason: typeof r.failureReason === 'string' ? r.failureReason : undefined,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Map Chromium's net error on the probe request to a structured readiness
+ * failure. HTTP-level failures never reach here (any status = pass), so every
+ * failureReason on a proxied probe indicates the proxy path itself broke.
+ */
+export function classifyProxyFailure(proxy, failureReason) {
+    const reason = failureReason.replace(/^net::/, '');
+    const label = redactedProxyLabel(proxy);
+    // Chromium surfaces proxy-auth failure under several codes: ERR_PROXY_AUTH_*
+    // (challenge/requested), and ERR_{INVALID,MISSING}_AUTH_CREDENTIALS when the
+    // proxy REJECTS the supplied credentials — the wrong-password case, which does
+    // NOT contain "PROXY_AUTH". Fail closed as an auth failure (not merely
+    // "unreachable") so a bad credential never rides through as a transport blip.
+    if (/PROXY_AUTH|INVALID_AUTH_CREDENTIALS|MISSING_AUTH_CREDENTIALS|ERR_TOO_MANY_RETRIES/i.test(reason)) {
+        return new BrowserReadinessError('BROWSER_PROXY_AUTH_FAILED', `proxy ${label} rejected the credentials (${reason})`);
+    }
+    if (/TIMED_OUT/i.test(reason)) {
+        return new BrowserReadinessError('BROWSER_PROXY_UNREACHABLE', `proxy ${label} timed out (${reason})`);
+    }
+    if (/NAME_NOT_RESOLVED|NAME_RESOLUTION_FAILED/i.test(reason)) {
+        return new BrowserReadinessError('BROWSER_PROXY_UNREACHABLE', `proxy host in ${label} did not resolve (${reason})`);
+    }
+    // ERR_PROXY_CONNECTION_FAILED / ERR_TUNNEL_CONNECTION_FAILED /
+    // ERR_SOCKS_CONNECTION_FAILED / ERR_CONNECTION_REFUSED / ... — with a proxy
+    // configured, a transport error on the probe is a proxy-path failure.
+    return new BrowserReadinessError('BROWSER_PROXY_UNREACHABLE', `could not reach the network through proxy ${label} (${reason})`);
+}
+function withProbeTag(probeUrl, tag) {
+    return probeUrl.includes('?') ? `${probeUrl}&${tag}=1` : `${probeUrl}?${tag}=1`;
+}

package/dist/clip-runtime/browser-state-store.d.ts

@@ -35,8 +35,16 @@ export interface BrowserStateLogger {
     warn(msg: string): void;
     error(msg: string): void;
 }
-/** buildStateKey is the SSOT key layout, mirrored by the Go controller. */
-export declare function buildStateKey(orgId: string, profileId: string): string;
+/**
+ * buildStateKey is the SSOT key layout, mirrored by the Go controller
+ * (state_gc.go stateObjectKeyForEpoch). The state EPOCH (the profile's
+ * reset_generation at assignment time) scopes the key: epoch 0 is the legacy
+ * un-suffixed key so pre-epoch profiles need no data migration; each Reset bumps
+ * the epoch, so a new pod hydrates a fresh (empty) key while every pre-reset pod
+ * keeps reading/writing only its own superseded object — the old state is
+ * structurally unreachable, no tombstone or write-ordering needed.
+ */
+export declare function buildStateKey(orgId: string, profileId: string, epoch?: number): string;
 /** Thrown by a StateBackend.put when a conditional write precondition fails (S3
  *  412). The store treats it as "lost the CAS race" and aborts the checkpoint. */
 export declare class PreconditionFailedError extends Error {
@@ -69,6 +77,9 @@ export interface BrowserStateStoreConfig {
     profileId: string;
     /** Lease activation generation — the monotonic fencing token (design §3.2). */
     generation: number;
+    /** State epoch (reset_generation at assignment) — scopes the S3 key, see
+     *  buildStateKey. Missing/0 → the legacy un-suffixed key. */
+    epoch?: number;
     /** bb-browser user-data dir (BB_BROWSER_HOME) to snapshot/restore. */
     homeDir: string;
     /** Optional S3 endpoint (MinIO/dev); empty → AWS S3. */

package/dist/clip-runtime/browser-state-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-state-store.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-state-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgCD,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;kFACkF;AAClF,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,kEAAkE;IAClE,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACjF,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,eAAe,CAAuB;gBAG3B,GAAG,EAAE,uBAAuB,EAC7C,OAAO,CAAC,EAAE,YAAY;IAQxB,OAAO,IAAI,OAAO;IAIlB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;IA4CvC;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAUjD,YAAY;CA2D3B;AAoED,gEAAgE;AAChE,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM7D;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhF;AAqDD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD"}
+{"version":3,"file":"browser-state-store.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-state-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgCD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,MAAM,CAGjF;AAED;kFACkF;AAClF,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAwB;CAI5C;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,kEAAkE;IAClE,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACjF,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB;iEAC6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,eAAe,CAAuB;gBAG3B,GAAG,EAAE,uBAAuB,EAC7C,OAAO,CAAC,EAAE,YAAY;IAQxB,OAAO,IAAI,OAAO;IAIlB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;IA4CvC;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAUjD,YAAY;CA2D3B;AAoED,gEAAgE;AAChE,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM7D;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhF;AAqDD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGpD"}

package/dist/clip-runtime/browser-state-store.js

@@ -35,8 +35,8 @@ import { createHash } from 'node:crypto';
 import { mkdirSync } from 'node:fs';
 import { gunzipSync, gzipSync } from 'node:zlib';
 import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
-/** S3 object user-metadata keys. Lowercase; the Go controller reads them
- *  case-insensitively (state_store.go metaValue). SSOT — keep in lockstep. */
+/** S3 object user-metadata keys. Lowercase; the Go side writes them in lockstep
+ *  (state_gc.go). SSOT. */
 const META_GENERATION = 'generation';
 const META_SHA256 = 'sha256';
 const META_FINAL = 'final';
@@ -62,9 +62,18 @@ const ARCHIVE_EXCLUDES = [
     '*/component_crx_cache/*',
     '*/Crashpad/*',
 ];
-/** buildStateKey is the SSOT key layout, mirrored by the Go controller. */
-export function buildStateKey(orgId, profileId) {
-    return `${STATE_KEY_PREFIX}/${orgId}/${profileId}/${STATE_OBJECT}`;
+/**
+ * buildStateKey is the SSOT key layout, mirrored by the Go controller
+ * (state_gc.go stateObjectKeyForEpoch). The state EPOCH (the profile's
+ * reset_generation at assignment time) scopes the key: epoch 0 is the legacy
+ * un-suffixed key so pre-epoch profiles need no data migration; each Reset bumps
+ * the epoch, so a new pod hydrates a fresh (empty) key while every pre-reset pod
+ * keeps reading/writing only its own superseded object — the old state is
+ * structurally unreachable, no tombstone or write-ordering needed.
+ */
+export function buildStateKey(orgId, profileId, epoch = 0) {
+    const base = `${STATE_KEY_PREFIX}/${orgId}/${profileId}`;
+    return epoch > 0 ? `${base}/e${epoch}/${STATE_OBJECT}` : `${base}/${STATE_OBJECT}`;
 }
 /** Thrown by a StateBackend.put when a conditional write precondition fails (S3
  *  412). The store treats it as "lost the CAS race" and aborts the checkpoint. */
@@ -87,7 +96,7 @@ export class BrowserStateStore {
     lastUploadedSha = null;
     constructor(cfg, backend) {
         this.cfg = cfg;
-        this.key = buildStateKey(cfg.orgId, cfg.profileId);
+        this.key = buildStateKey(cfg.orgId, cfg.profileId, cfg.epoch ?? 0);
         // Injected backend wins (tests). Otherwise build a live S3 backend iff a
         // bucket is configured; no bucket → disabled (stateless pod).
         this.backend = backend ?? (cfg.bucket ? new S3Backend(buildS3Client(cfg), cfg.bucket) : null);

package/dist/clip-runtime/browser-target-registry.d.ts

@@ -0,0 +1,143 @@
+/**
+ * BrowserTargetRegistry — binds every browser command to a page target OWNED by
+ * the profile's bb-browser account, so no command can fall through to
+ * bb-browser's account-blind global routing.
+ *
+ * WHY. bb-browser-pro 0.15.0 resolves a tab-less command via
+ * `ensurePageTarget(undefined)` → global `currentTargetId` → `targets[0]`
+ * (verified in its daemon source; `request.account` is never consulted). Chrome
+ * is launched with a literal `about:blank` positional tab in the DEFAULT
+ * browser context — no account cookies, no account proxy — and nothing ever
+ * closes it, so it IS `targets[0]` on a fresh Chromium. Worse, the daemon's own
+ * tab-less `tab_list` warm-up is dispatched through `ensurePageTarget` too and
+ * pins the global `currentTargetId` to that blank page. Any agent command sent
+ * without an explicit `tabId` (navigate/get/click/screenshot/eval/...) then
+ * executes against a cookie-less, proxy-less page — including real-IP egress
+ * for proxy-configured profiles. The registry closes this by resolving an
+ * OWNED target (per `tab_list`'s per-tab `account` attribution) and stamping
+ * its full CDP targetId on every tab-addressed command.
+ *
+ * Ownership ground truth is bb-browser's own `tab_list` attribution (targetId →
+ * account, derived from its BrowserContext bookkeeping), so a recreated tab —
+ * `tab_new {account}` routes through `createTabInContext` → `ensureContext` —
+ * always lands in the profile's BrowserContext with its cookies re-injected,
+ * never the default context.
+ */
+/**
+ * Thrown when a command's target cannot be bound to a profile-owned page: a
+ * caller-supplied ref that is not the profile's own tab (foreign tab, numeric
+ * global index, stale id), or an owned page that cannot be (re)created. The
+ * command is NEVER retargeted at another page — fail closed.
+ */
+export declare class BrowserTargetError extends Error {
+    readonly code: 'BROWSER_TARGET_FOREIGN' | 'BROWSER_TARGET_UNAVAILABLE';
+    constructor(message: string, code: 'BROWSER_TARGET_FOREIGN' | 'BROWSER_TARGET_UNAVAILABLE');
+}
+/** The slice of BrowserProfileManager the registry drives (account-scoped /command). */
+export interface TargetRegistryHost {
+    sendCommand(request: Record<string, unknown> & {
+        method: string;
+        account?: string;
+    }): Promise<Record<string, unknown>>;
+}
+/** A profile-owned page tab as reported by `tab_list` (account-attributed). */
+export interface OwnedTab {
+    /** Full CDP targetId (`tabId` in bb-browser responses). */
+    targetId: string;
+    /** bb-browser short tab id (`tab` in responses). */
+    shortId?: string;
+    url?: string;
+    active?: boolean;
+}
+/** Tunable timings for domain-tab navigation commit (injectable so tests don't
+ *  wait the full production budget). */
+export interface TargetRegistryOptions {
+    /** How long to wait for a created domain tab to commit navigation (default 10s). */
+    commitTimeoutMs?: number;
+    /** Post-commit settle before the tab is used (default 750ms). */
+    commitSettleMs?: number;
+    /** Poll interval while waiting for commit (default 300ms). */
+    commitPollMs?: number;
+}
+export declare class BrowserTargetRegistry {
+    private readonly host;
+    private readonly opts;
+    constructor(host: TargetRegistryHost, opts?: TargetRegistryOptions);
+    /** `tab_list` rows owned by the account (per-tab `account` attribution). */
+    ownedTabs(account: string): Promise<OwnedTab[]>;
+    /**
+     * Resolve the full CDP targetId a command must run against.
+     *
+     * With `ref` (caller-supplied `tabId`/`tab`): it must be one of the account's
+     * OWN tabs (full targetId or short id) — anything else throws
+     * BrowserTargetError. Numeric refs are rejected outright: bb-browser resolves
+     * bare numbers as indices into the GLOBAL page-target array, which can address
+     * another context's page.
+     *
+     * Without `ref`: the owned tab Chrome marks active, else the first owned
+     * tab, else a fresh `about:blank` created INSIDE the account's
+     * BrowserContext (never the default context). Stateless — derived from the
+     * live tab_list every time.
+     */
+    resolveCommandTarget(account: string, ref?: unknown): Promise<string>;
+    /**
+     * Validate + canonicalize a caller-supplied tab ref against owned tabs only.
+     * The ref is matched as a string against owned full/short ids and NEVER
+     * forwarded raw — so bb-browser's numeric-index fallback (which indexes into
+     * the GLOBAL page array, any context) is unreachable.
+     */
+    private resolveExplicitRef;
+    /**
+     * Ensure the account owns at least one page tab, returning its targetId. A
+     * fresh account (or one whose pages were all closed) gets an `about:blank`
+     * tab created in ITS BrowserContext via `tab_new {account}` — bb-browser's
+     * `createTabInContext` re-activates the context (cookies re-injected) when it
+     * was disposed, so recovery never lands in the default context.
+     */
+    ensureOwnedTab(account: string): Promise<string>;
+    private createOwnedTab;
+    /** Owned tab currently on `host` (www-tolerant), optionally only a specific ref. */
+    findOwnedTabOnHost(account: string, host: string, onlyTargetId?: string): Promise<string | undefined>;
+    /** Whether any owned tab is already on `url` (same resource, http→https tolerant). */
+    findOwnedTabMatchingUrl(account: string, url: string): Promise<string | undefined>;
+    /**
+     * Account-scoped tab-by-domain resolution for `eval {domain}` (bb-browser's
+     * own `resolveTabByDomain` is account-blind — the reason this exists). Two
+     * properties the bare `tab_new` + eval approach lacked, both caught on the
+     * staging closed-loop E2E (2026-06-04):
+     *
+     * 1. Reuse: an existing account tab already on the domain is reused instead
+     *    of opening a new tab per eval (upstream reuses matching tabs too).
+     * 2. Load wait: after creating a tab, wait for the navigation to commit
+     *    before eval — upstream waits (~10s poll + settle); without it the clip
+     *    script races `about:blank` and relative fetches fail
+     *    ("Failed to parse URL from /hot.json").
+     */
+    resolveDomainTab(account: string, domain: string): Promise<string | undefined>;
+    /** Close a tab we created but could not commit, so it does not linger as a
+     *  residual owned tab. Best-effort — a close failure (already gone / rejected)
+     *  is swallowed. bb-browser's close command is `close` (→ Target.closeTarget). */
+    private closeTabBestEffort;
+}
+/**
+ * Commands that take no page target at all — everything else is tab-addressed
+ * and MUST carry an owned tabId. `tab_new`, `site_info`, and the `site_*` listing
+ * commands resolve/create their page inside the account's context upstream
+ * (createTabInContext / account-scoped adapter execution), so they pass `account`
+ * instead of a pinned tab. NOTE `tab_list` IS dispatched through bb-browser's
+ * `ensurePageTarget` (its global-current-tab side effect is harmless once every
+ * real command pins its own target). `site_run` is deliberately NOT tab-less:
+ * the manager resolves the adapter's domain via site_info and pins an owned tab
+ * (or fails closed for a domain-less adapter), closing the old global-current-tab
+ * fallthrough — see BrowserProfileManager.buildCommandRequest.
+ */
+export declare const TABLESS_COMMANDS: Set<string>;
+/** Host comparison tolerant of a `www.` prefix on either side. */
+export declare function hostsMatch(a: string, b: string): boolean;
+export declare function normalizeDomainUrl(domain: string): string;
+export declare function comparableUrl(url: string): {
+    protocol: string;
+    host: string;
+    target: string;
+} | null;
+//# sourceMappingURL=browser-target-registry.d.ts.map

package/dist/clip-runtime/browser-target-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-target-registry.d.ts","sourceRoot":"","sources":["../../src/clip-runtime/browser-target-registry.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,4BAA4B;gBADtE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,wBAAwB,GAAG,4BAA4B;CAKzE;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,WAAW,CACT,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrC;AAED,+EAA+E;AAC/E,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;wCACwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,qBAAqB;IAM9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,IAAI,EAAE,kBAAkB,EACxB,IAAI,GAAE,qBAA0B;IAGnD,4EAA4E;IACtE,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAoBrD;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAU3E;;;;;OAKG;YACW,kBAAkB;IAgBhC;;;;;;OAMG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAOxC,cAAc;IAqB5B,oFAAoF;IAC9E,kBAAkB,CACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAc9B,sFAAsF;IAChF,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAiBxF;;;;;;;;;;;;OAYG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA4CpF;;sFAEkF;YACpE,kBAAkB;CAOjC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,aAU3B,CAAC;AAEH,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW3D"}