@telorun/k8s-runner 0.13.0 → 0.15.0

package/src/k8s/watch-session.ts

@@ -23,8 +23,17 @@ import {
 
 import type { K8sRunnerConfig } from "../config.js";
 import { clampLimits } from "../limits.js";
+import { apiFailure, apiReason } from "./api-error.js";
 import type { KubeClient } from "./client.js";
-import { buildSessionIngress, buildSessionService, endpointsFor } from "./ingress.js";
+import {
+  buildSessionService,
+  createOrReplace,
+  endpointsFor,
+  sessionObjectName,
+  watchRouteHealth,
+  type PublishedRoute,
+  type SessionRouter,
+} from "./routing/index.js";
 import { buildWatchPod, inspectPortFor, WORKSPACE_PORT } from "./pod-spec.js";
 import { deletePod, is404, msg, podPhase, podStatus, provisionMessage } from "./pod-status.js";
 import { ensureWorkspaceConfigMap } from "./workspace-configmap.js";
@@ -48,23 +57,24 @@ interface ResizableSocket {
 export interface WatchSessionDeps {
   kube: KubeClient;
   config: K8sRunnerConfig;
+  /** Resolved at boot; absent → logs-only. */
+  router?: SessionRouter;
 }
 
 /**
  * A watch session: one pod, one workspace volume, one container per running
  * application, and the session outliving every run inside it.
  *
- * What it does NOT do is as load-bearing as what it does: it never builds an
- * image. The build path exists to put a dependency closure on disk before boot;
- * a watch session resolves its own into a per-app cache directory that lives as
- * long as the pod, so the download happens once per app per session and every
- * later reload resolves from local disk.
+ * Its cache is what separates it from a run session: the module closure lands in
+ * a directory that lives as long as the POD rather than as long as one run, so
+ * the download happens once per session and every later reload resolves from
+ * local disk.
  */
 export async function startWatchSession(
   deps: WatchSessionDeps,
   spec: BackendStartSpec,
 ): Promise<BackendSession> {
-  const { kube, config } = deps;
+  const { kube, config, router } = deps;
   const ns = config.sessionNamespace;
   const limits = clampLimits(config.appLimits, undefined);
 
@@ -86,6 +96,9 @@ export async function startWatchSession(
     stdins: Map<string, PassThrough>;
     abort: AbortController;
     stopWatch: () => void;
+    /** Aborts the previous route-health watch when a reload republishes routes —
+     *  the old host set is no longer what the session serves. */
+    routeAbort?: AbortController;
   }
   let runtime: PodRuntime | null = null;
 
@@ -117,12 +130,7 @@ export async function startWatchSession(
     try {
       created = await kube.core.createNamespacedPod({ namespace: ns, body: pod });
     } catch (err) {
-      throw new SessionStartError(
-        "start_failed",
-        "create",
-        `failed to create pod: ${msg(err)}`,
-        msg(err),
-      );
+      throw apiFailure(err, "create", "could not create the session pod");
     }
 
     const abort = new AbortController();
@@ -171,22 +179,22 @@ export async function startWatchSession(
     const agent = agentEndpoint();
     spec.onStatus({
       kind: "running",
-      endpoints: endpointsFor(config, spec.sessionId, allPorts(apps)),
+      endpoints: endpointsFor(config, spec.sessionId, allPorts(apps), Boolean(router)),
       ...(agent ? { agent } : {}),
     });
   }
 
   /** Where this session's co-resident agent answers. The pod's containers share
    *  one network namespace, so the agent rides the session's own Service and
-   *  Ingress — the port is simply in the routed set, and the host follows the
+   *  routing objects — the port is simply in the routed set, and the host follows the
    *  same `<port>-<sessionId>` scheme every app port does. */
   function agentEndpoint(): RunnerEndpoint | undefined {
     const port = spec.agent?.port;
     if (port === undefined) return undefined;
-    return endpointsFor(config, spec.sessionId, [{ port, protocol: "tcp" }])[0];
+    return endpointsFor(config, spec.sessionId, [{ port, protocol: "tcp" }], Boolean(router))[0];
   }
 
-  /** Every port the session's Service and Ingress must carry: the apps' declared
+  /** Every port the session's Service and routing objects must carry: the apps' declared
    *  ports plus the agent's. Kept apart from `allPorts`, which answers what the
    *  APPLICATIONS declare — that set is what the client is told about and what a
    *  reload re-reads, and the agent belongs in neither. */
@@ -299,7 +307,7 @@ export async function startWatchSession(
         // channel rather than aborting the start.
         spec.onOutput(
           app.name,
-          Buffer.from(`\r\n[runner] failed to attach: ${msg(err)}\r\n`),
+          Buffer.from(`\r\n[runner] failed to attach: ${apiReason(err)}\r\n`),
           tagFor(app, "stderr"),
         );
       }
@@ -327,8 +335,8 @@ export async function startWatchSession(
    * which matters, because a manifest the runner could not parse would otherwise
    * have to leave routing alone and report, on the hot path of every save.
    *
-   * A pod's `containerPort` list is documentation; the Service and the Ingress
-   * are what make a port reachable, so this needs no pod recreate.
+   * A pod's `containerPort` list is documentation; the Service and the routing
+   * objects are what make a port reachable, so this needs no pod recreate.
    */
   async function applyPortsResolved(appName: string, frame: DebugFrame): Promise<void> {
     const declared = portsResolvedFrom(frame);
@@ -364,16 +372,16 @@ export async function startWatchSession(
       await publishEndpoints(rt, apps);
     } catch (err) {
       spec.onEndpoints(appName, {
-        rejected: accepted.map((p) => ({ port: p.port, reason: msg(err) })),
+        rejected: accepted.map((p) => ({ port: p.port, reason: apiReason(err) })),
       });
       return;
     }
     spec.onEndpoints(appName, {
       ...(accepted.length > 0
-        ? { added: endpointsFor(config, spec.sessionId, accepted) }
+        ? { added: endpointsFor(config, spec.sessionId, accepted, Boolean(router)) }
         : {}),
       ...(removed.length > 0
-        ? { removed: endpointsFor(config, spec.sessionId, removed) }
+        ? { removed: endpointsFor(config, spec.sessionId, removed, Boolean(router)) }
         : {}),
       ...(rejected.length > 0
         ? {
@@ -493,21 +501,25 @@ export async function startWatchSession(
   }
 
   /**
-   * Create or re-patch the Service and Ingress for the session's whole declared
-   * port set. Adding a `ports:` entry is as ordinary an edit as adding an
-   * import, and a container may bind any port regardless of what the pod spec
-   * declares — so without this the app listens and is simply unreachable: no
-   * ingress, no error, no event. The pod's `containerPort` list is
-   * documentation; the Service and Ingress are what make a port reachable, which
-   * is why this needs no pod recreate.
+   * Create or re-patch the Service and the routing objects for the session's
+   * whole declared port set. Adding a `ports:` entry is as ordinary an edit as
+   * adding an import, and a container may bind any port regardless of what the
+   * pod spec declares — so without this the app listens and is simply
+   * unreachable: no route, no error, no event. The pod's `containerPort` list is
+   * documentation; the Service and the routing objects are what make a port
+   * reachable, which is why this needs no pod recreate.
+   *
+   * An EMPTY routed set still reaches the router, because dropping the last
+   * declared port is a reload like any other and its routes must go with it —
+   * returning early here left them serving a port nothing listens on.
    */
   async function publishEndpoints(rt: PodRuntime, forApps: BackendAppSpec[]): Promise<void> {
-    if (!config.sessionIngressBaseDomain) return;
+    if (!router) return;
     const ports = routedPorts(forApps);
-    if (ports.length === 0) return;
-    const service = buildSessionService(config, spec.sessionId, rt.name, rt.uid, ports);
-    const serviceName = service.metadata!.name!;
-    await upsert(
+    const serviceName = sessionObjectName(spec.sessionId);
+    if (ports.length > 0) {
+      const service = buildSessionService(config, spec.sessionId, rt.name, rt.uid, ports);
+      await createOrReplace(
       () => kube.core.createNamespacedService({ namespace: ns, body: service }),
       async () => {
         // A Service replace must carry the assigned `clusterIP` and the current
@@ -532,37 +544,51 @@ export async function startWatchSession(
           },
         });
       },
-    );
-    const { ingress } = buildSessionIngress(
-      config,
-      spec.sessionId,
+      );
+    }
+    const published = await router.publish({
+      sessionId: spec.sessionId,
       serviceName,
-      rt.name,
-      rt.uid,
+      podName: rt.name,
+      podUid: rt.uid,
       ports,
-    );
-    if (!ingress.spec?.rules?.length) return;
-    const ingressName = ingress.metadata!.name!;
-    await upsert(
-      () => kube.networking.createNamespacedIngress({ namespace: ns, body: ingress }),
-      async () => {
-        const existing = await kube.networking.readNamespacedIngress({
-          name: ingressName,
-          namespace: ns,
-        });
-        await kube.networking.replaceNamespacedIngress({
-          name: ingressName,
-          namespace: ns,
-          body: {
-            ...ingress,
-            metadata: {
-              ...ingress.metadata,
-              resourceVersion: existing.metadata?.resourceVersion,
-            },
-          },
-        });
-      },
-    );
+    });
+    watchRoutes(rt, router, published, forApps);
+  }
+
+  /** Verify the routing layer programmed what was just published, and report each
+   *  host. A watch session republishes on every reload, so the previous watch is
+   *  dropped and a fresh one started against the new host set. */
+  function watchRoutes(
+    rt: PodRuntime,
+    sessionRouter: SessionRouter,
+    published: PublishedRoute[],
+    forApps: BackendAppSpec[],
+  ): void {
+    rt.routeAbort?.abort();
+    if (published.length === 0) return;
+    const abort = new AbortController();
+    rt.routeAbort = abort;
+    // A port belongs to at most one app (the session-wide uniqueness rule); the
+    // co-resident agent's port belongs to none, and reports with no `app`.
+    const ownerOf = new Map<number, string>();
+    for (const app of forApps) {
+      for (const p of app.ports) ownerOf.set(p.port, app.name);
+    }
+    void watchRouteHealth({
+      router: sessionRouter,
+      sessionId: spec.sessionId,
+      routes: published,
+      onState: (route, state, reason) =>
+        spec.onRoute(ownerOf.get(route.port), {
+          host: route.host,
+          port: route.port,
+          state,
+          reason,
+        }),
+      signal: AbortSignal.any([abort.signal, rt.abort.signal]),
+      timeoutMs: config.sessionRouting.routeReadyTimeoutMs,
+    });
   }
 
   async function teardownPod(): Promise<void> {
@@ -644,14 +670,6 @@ export async function startWatchSession(
     return app.io === "tty" ? "tty" : real;
   }
 
-  async function upsert(create: () => Promise<unknown>, replace: () => Promise<unknown>) {
-    try {
-      await create();
-    } catch (err) {
-      if (!isConflict(err)) throw err;
-      await replace();
-    }
-  }
 }
 
 function allPorts(apps: BackendAppSpec[]): PortMapping[] {
@@ -673,11 +691,6 @@ function freshPodName(sessionId: string): string {
   return `telo-watch-${sessionId}-${Date.now().toString(36)}${podSequence.toString(36)}`;
 }
 
-function isConflict(err: unknown): boolean {
-  const e = err as { statusCode?: number; code?: number; response?: { statusCode?: number } };
-  return (e?.statusCode ?? e?.code ?? e?.response?.statusCode) === 409;
-}
-
 function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(resolve, ms);

package/src/k8s/workspace-configmap.ts

@@ -4,6 +4,7 @@ import { workspaceAppManifest, WORKSPACE_APP_FILENAME } from "@telorun/runner-co
 
 import type { K8sRunnerConfig } from "../config.js";
 import type { KubeClient } from "./client.js";
+import { is404, isConflict } from "./pod-status.js";
 
 /**
  * The workspace application's manifest, delivered to the pod as a ConfigMap.
@@ -39,7 +40,7 @@ export async function ensureWorkspaceConfigMap(
     await kube.core.readNamespacedConfigMap({ name, namespace: config.sessionNamespace });
     return name;
   } catch (err) {
-    if (!isNotFound(err)) throw err;
+    if (!is404(err)) throw err;
   }
   try {
     await kube.core.createNamespacedConfigMap({
@@ -64,19 +65,6 @@ export async function ensureWorkspaceConfigMap(
   return name;
 }
 
-function statusOf(err: unknown): number | undefined {
-  const e = err as { statusCode?: number; code?: number; response?: { statusCode?: number } };
-  return e?.statusCode ?? e?.code ?? e?.response?.statusCode;
-}
-
-function isNotFound(err: unknown): boolean {
-  return statusOf(err) === 404;
-}
-
-function isConflict(err: unknown): boolean {
-  return statusOf(err) === 409;
-}
-
 /**
  * Delete workspace-app ConfigMaps no live pod mounts.
  *
@@ -126,7 +114,7 @@ export async function sweepWorkspaceConfigMaps(
       await kube.core.deleteNamespacedConfigMap({ name, namespace: config.sessionNamespace });
       removed += 1;
     } catch (err) {
-      if (!isNotFound(err)) log.warn({ err, name }, "failed to delete a stale workspace ConfigMap");
+      if (!is404(err)) log.warn({ err, name }, "failed to delete a stale workspace ConfigMap");
     }
   }
   if (removed > 0) log.info({ removed }, "swept stale workspace-app ConfigMaps");

package/src/server.ts

@@ -16,6 +16,7 @@ import { kubernetesRunnerCapabilities } from "./capabilities.js";
 import { loadK8sRunnerConfig, RunnerConfigError, type K8sRunnerConfig } from "./config.js";
 import { createKubernetesBackend } from "./k8s/backend.js";
 import { createKubeClient } from "./k8s/client.js";
+import { createSessionRouter } from "./k8s/routing/index.js";
 import { sweepWorkspaceConfigMaps } from "./k8s/workspace-configmap.js";
 
 const VERSION: string = packageJson.version;
@@ -54,7 +55,7 @@ export async function buildServer(deps: ServerDeps): Promise<ServerHandle> {
         agents: deps.config.watch.enabled ? coResidentAgentNames(apps) : undefined,
       }),
     // Operator-predefined apps (RUNNER_APPS; none when unset). Advertised on
-    // /v1/capabilities; app sessions run the catalog image directly (no build).
+    // /v1/capabilities; app sessions run the catalog image directly.
     apps,
     validateConfig: catalog
       ? (sessionConfig: SessionConfig): string | undefined =>
@@ -64,8 +65,8 @@ export async function buildServer(deps: ServerDeps): Promise<ServerHandle> {
               `Allowed images: ${catalog.current().join(", ")}`
       : undefined,
   });
-  // Mount the internal, tokenized fetch route on the same app so a build Job's
-  // initContainer can pull the build-context tarball (bundle + Dockerfile).
+  // Mount the internal, tokenized fetch route on the same app so a session pod's
+  // initContainer can pull the bundle tarball.
   deps.bundleStore.registerRoute(handle.app);
   return handle;
 }
@@ -84,7 +85,22 @@ async function main(): Promise<void> {
 
   const kube = createKubeClient();
   const bundleStore = new BundleStore(config.selfUrl);
-  const backend = createKubernetesBackend({ kube, config, bundleStore });
+
+  // Resolve the routing layer ONCE, here: an unroutable configuration must fail
+  // the runner rather than every session it would otherwise accept, publish
+  // routes for, and leave 404-ing with nothing reported.
+  let routing: Awaited<ReturnType<typeof createSessionRouter>>;
+  try {
+    routing = await createSessionRouter(kube, config);
+  } catch (err) {
+    if (err instanceof RunnerConfigError) {
+      process.stderr.write(`${err.message}\n`);
+      process.exit(2);
+    }
+    throw err;
+  }
+
+  const backend = createKubernetesBackend({ kube, config, bundleStore, router: routing.router });
 
   const catalog = config.baseImageCatalog.enabled
     ? new BaseImageCatalog({
@@ -98,6 +114,27 @@ async function main(): Promise<void> {
 
   const { app, registry } = await buildServer({ backend, config, bundleStore, catalog });
 
+  // Say which layer carries session traffic. An operator reading "logs-only" here
+  // is the difference between a misconfiguration found at boot and one found as a
+  // 404 on a URL the editor handed a user.
+  if (routing.resolved.layer === "none") {
+    app.log.warn({ reason: routing.resolved.reason }, "session routing disabled (logs-only)");
+  } else {
+    app.log.info(
+      {
+        layer: routing.resolved.layer,
+        ...(routing.resolved.layer === "gateway"
+          ? {
+              apiVersion: routing.resolved.apiVersion,
+              gateway: `${config.sessionRouting.gateway?.namespace}/${config.sessionRouting.gateway?.name}`,
+            }
+          : { ingressClass: config.sessionRouting.ingressClassName ?? "(cluster default)" }),
+        baseDomain: config.sessionRouting.baseDomain,
+      },
+      "session routing resolved",
+    );
+  }
+
   // Populate the catalog before serving so the first /v1/capabilities carries the
   // full menu; a fetch failure degrades to the default image (surfaced, not
   // swallowed) and the periodic refresh retries.

package/dist/k8s/image-build.d.ts

@@ -1,103 +0,0 @@
-import type { V1Job } from "@kubernetes/client-node";
-import type { PullPolicy, RunBundle } from "@telorun/runner-core";
-import type { ImageBuildConfig } from "../config.js";
-import type { BundleStore } from "../bundle-store.js";
-import type { KubeClient } from "./client.js";
-export interface ImageTagInputs {
-    bundle: RunBundle;
-    /** Base image the per-app image is built FROM. */
-    baseImage: string;
-    /** Resolved digest of `baseImage`, folded into the tag so a moved moving-tag
-     *  (e.g. `latest-slim`) yields a fresh tag and rebuilds. Set only under the
-     *  `always` pull policy; omitted → keyed on the base TAG STRING alone. */
-    baseDigest?: string;
-}
-/**
- * Content-address the per-app image on its DEPENDENCY closure — the only thing
- * `telo install` bakes into `.telo/{manifests,npm}`: the `imports:` set plus any
- * controllers declared by inline `Telo.Definition` docs (`extractDependencyKey`).
- * A body-only edit (resource config, CEL) keeps the tag stable so the image is
- * reused and the new body is delivered to the pod at runtime; an import or
- * controller change produces a fresh tag and rebuilds. The entry path is
- * deliberately excluded — it's supplied to `telo run` at runtime, and the same
- * imports resolve the same closure regardless of the entry filename.
- *
- * `local_path` controllers (or an unparseable file) set `fullContentFallback`,
- * which folds the whole bundle into the digest — keying degrades to today's
- * content-address, which is correct (those depend on body bytes) if less optimal.
- */
-export declare function computeImageTag(inputs: ImageTagInputs): string;
-export declare function imageRef(config: ImageBuildConfig, tag: string): string;
-/**
- * Dockerfile for a self-contained per-app image: `telo install` populates
- * `/telo-cache/{manifests,npm}` so the runtime `telo run` resolves every
- * controller and module from disk with no network and no install. The telo
- * registry arrives as a build-arg so the build (not the running session)
- * carries the registry dependency.
- *
- * `TELO_CACHE_DIR=/telo-cache` relocates the baked `.telo` OFF `/app`, so at
- * runtime the pod mounts the freshly-delivered body at `/app` without shadowing
- * the deps. The deps depend only on the imports/controllers closure (see
- * `computeImageTag`); the body COPYed here is whichever session first built this
- * tag — disposable, replaced at boot.
- */
-export declare function buildDockerfile(opts: {
-    baseImage: string;
-    entryRelativePath: string;
-}): string;
-export interface KanikoJobArgs {
-    config: ImageBuildConfig;
-    jobName: string;
-    /** Tokenized URL the initContainer fetches the build context (bundle + Dockerfile) from. */
-    contextUrl: string;
-    /** Fully-qualified image ref Kaniko pushes. */
-    destination: string;
-    /** Small image (wget + tar) for the context-fetch initContainer. */
-    initImage: string;
-    managedByLabel: string;
-}
-/**
- * Builds the Kaniko Job. An initContainer fetches the tokenized context tarball
- * into a shared emptyDir; Kaniko builds it and pushes to the registry. The Job
- * is single-attempt (`backoffLimit: 0`), deadline-bounded, and self-cleaning
- * (`ttlSecondsAfterFinished`). Kaniko needs a writable rootfs, so this runs in
- * the trusted `telo-builds` namespace at baseline PodSecurity — never alongside
- * untrusted session pods.
- */
-export declare function buildKanikoJob(args: KanikoJobArgs): V1Job;
-export interface EnsureImageDeps {
-    kube: KubeClient;
-    build: ImageBuildConfig;
-    bundleStore: BundleStore;
-    initImage: string;
-    managedByLabel: string;
-}
-export interface EnsureImageArgs {
-    bundle: RunBundle;
-    entryRelativePath: string;
-    baseImage: string;
-    /** Base-image freshness. `always` pins the per-app image to the base's current
-     *  Docker Hub digest so a moved moving-tag rebuilds; `missing` / `never` (and
-     *  `always` on a base whose digest can't be resolved) reuse the cached build. */
-    pullPolicy: PullPolicy;
-    /** Build-phase progress for the editor feed. */
-    onProgress?: (message: string, done?: boolean) => void;
-}
-/**
- * Resolve the per-app image, building it on-cluster if absent. Returns the image
- * ref to run; throws `SessionStartError` (stage `create`) with the build pod's
- * log tail on failure so the cause reaches the editor instead of an opaque hang.
- */
-export declare function ensureSessionImage(deps: EnsureImageDeps, args: EnsureImageArgs): Promise<string>;
-/** Registry pull credentials decoded from a `.dockerconfigjson` Secret. */
-export interface RegistryAuth {
-    username: string;
-    password: string;
-}
-/** Extract credentials for `repository`'s host from a `.dockerconfigjson` payload. */
-export declare function parseDockerConfigAuth(dockerconfigjson: string, repository: string): RegistryAuth | undefined;
-/** Host portion of a registry ref / dockerconfig key (scheme + path stripped). */
-export declare function registryHost(ref: string): string;
-/** Parse `key="value"` pairs out of a `WWW-Authenticate: Bearer ...` challenge. */
-export declare function parseAuthParams(challenge: string): Record<string, string>;
-//# sourceMappingURL=image-build.d.ts.map

package/dist/k8s/image-build.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"image-build.d.ts","sourceRoot":"","sources":["../../src/k8s/image-build.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB;;8EAE0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAkB9D;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAS9F;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,KAAK,CA6EzD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB;;qFAEiF;IACjF,UAAU,EAAE,UAAU,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACxD;AAQD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAuGD,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA6FD,sFAAsF;AACtF,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,GACjB,YAAY,GAAG,SAAS,CAoB1B;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzE"}