modelrig 0.0.1 → 0.2.0

package/dist/telemetry/otlp-emitter.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * OTLP span emitter — E1 (spec §2.3, §4). A SIBLING of the control-plane
+ * exporter, not a sink inside it: it reads the same `inferences` table behind
+ * its OWN watermark (`${sourceId}:otlp`), so the OTLP stream and the
+ * control-plane export never block or drain each other — exactly the pattern
+ * the feedback stream already uses (`:feedback`).
+ *
+ * ── DOCTRINE CLONED FROM exporter.ts (verbatim, on purpose) ───────────────
+ * Fire-and-forget from the run loop; at-least-once with idempotent span ids
+ * (otel-map derives them deterministically, so a re-emit after a crash is a
+ * no-op at the sink); the watermark advances ONLY after a confirmed 2xx;
+ * sink errors are swallowed-and-logged with exponential skip backoff; the
+ * interval timer is `unref()`ed so telemetry never keeps a process alive.
+ *
+ * ── OFF BY DEFAULT ────────────────────────────────────────────────────────
+ * This module is only constructed when `MODELRIG_OTLP_ENDPOINT` is set
+ * (config.ts). No endpoint ⇒ no emitter ⇒ zero behaviour change (spec §6a).
+ *
+ * ── C2 (never leak credentials) ───────────────────────────────────────────
+ * `cfg.headers` may carry sink auth (e.g. Langfuse Basic auth) and `endpoint`
+ * itself may embed a token. NEITHER is ever logged or put in an error. Failure
+ * text is run through the shared secret scrubber before it reaches a warning.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOtlpEmitter = createOtlpEmitter;
+exports.startOtlpEmitterIfConfigured = startOtlpEmitterIfConfigured;
+const node_zlib_1 = require("node:zlib");
+const otel_map_1 = require("./otel-map");
+const scrub_1 = require("../tenancy/scrub");
+const DEFAULT_BATCH_SIZE = 200;
+const DEFAULT_INTERVAL_MS = 10000;
+const BACKOFF_MAX_SKIPS = 32;
+/** Below this, gzip costs more than it saves (mirrors the api sink). */
+const GZIP_MIN_BYTES = 1024;
+function createOtlpEmitter(store, config) {
+    const batchSize = config.batchSize ?? DEFAULT_BATCH_SIZE;
+    const intervalMs = config.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const fetchFn = config.fetchFn ?? fetch;
+    const watermarkKey = `${config.sourceId}:otlp`;
+    const resource = { serviceName: config.sourceId };
+    let timer = null;
+    let flushing = false;
+    let skipsRemaining = 0;
+    let consecutiveFailures = 0;
+    async function postSpans(rows) {
+        const spans = rows.map(({ row }) => (0, otel_map_1.inferenceToSpan)(row));
+        const json = JSON.stringify((0, otel_map_1.buildExportTraceRequest)(spans, resource));
+        const compress = Buffer.byteLength(json) >= GZIP_MIN_BYTES;
+        const response = await fetchFn(config.endpoint, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                ...config.headers,
+                ...(compress ? { "content-encoding": "gzip" } : {}),
+            },
+            body: compress ? (0, node_zlib_1.gzipSync)(json) : json,
+        });
+        if (!response.ok) {
+            // C2: neither the endpoint nor the headers ever appear here — status plus
+            // a SCRUBBED body only. A collector's error body is the likeliest place a
+            // reflected credential could reach someone else's log aggregator.
+            const body = (0, scrub_1.scrubSecrets)(await response.text().catch(() => ""));
+            throw new Error(`otlp export → ${response.status} ${body}`.trim());
+        }
+    }
+    async function flushOnce() {
+        // Inferences past the OTLP watermark, in batches. The watermark advances
+        // ONLY after a confirmed send (at-least-once; deterministic span ids make
+        // the duplicate a no-op at the sink).
+        for (;;) {
+            const watermark = store.getExportWatermark(watermarkKey);
+            const pending = store.readInferencesAfter(watermark, batchSize);
+            if (pending.length === 0)
+                break;
+            await postSpans(pending);
+            store.setExportWatermark(watermarkKey, pending[pending.length - 1].rowid);
+            if (pending.length < batchSize)
+                break;
+        }
+    }
+    async function guardedFlush() {
+        if (flushing)
+            return;
+        flushing = true;
+        try {
+            await flushOnce();
+            consecutiveFailures = 0;
+        }
+        catch (err) {
+            // Swallow-and-log, ALWAYS — an OTLP sink failure must never reach the run
+            // loop, and the scrubber guards the one place a secret could ride out.
+            consecutiveFailures += 1;
+            skipsRemaining = Math.min(2 ** consecutiveFailures, BACKOFF_MAX_SKIPS);
+            console.warn(`[modelrig otlp] export failed (attempt ${consecutiveFailures}, ` +
+                `backing off ${skipsRemaining} intervals): ` +
+                (0, scrub_1.scrubSecrets)(err instanceof Error ? err.message : String(err)));
+        }
+        finally {
+            flushing = false;
+        }
+    }
+    return {
+        start() {
+            if (timer !== null)
+                return;
+            timer = setInterval(() => {
+                if (skipsRemaining > 0) {
+                    skipsRemaining -= 1;
+                    return;
+                }
+                void guardedFlush();
+            }, intervalMs);
+            timer.unref?.();
+        },
+        async flushNow() {
+            await guardedFlush();
+        },
+        async stop() {
+            if (timer !== null) {
+                clearInterval(timer);
+                timer = null;
+            }
+            await guardedFlush();
+        },
+    };
+}
+/**
+ * Construct + start the OTLP emitter iff an endpoint is configured, else null
+ * (spec §6a). Lives here rather than index.ts so createRig's wiring stays one
+ * line and this file keeps the LOC cap on index.ts — the same reason
+ * `buildTelemetrySink` moved to sinks.ts.
+ */
+function startOtlpEmitterIfConfigured(store, otlp, sourceId) {
+    if (otlp == null)
+        return null;
+    const emitter = createOtlpEmitter(store, {
+        endpoint: otlp.endpoint,
+        headers: otlp.headers,
+        sourceId,
+    });
+    emitter.start();
+    return emitter;
+}

package/dist/telemetry/otlp-proto.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Minimal OTLP/protobuf trace decoder — Expansion E3-Harvest (spec §3.2).
+ * PURE. Decodes an `ExportTraceServiceRequest` / `TracesData` protobuf body
+ * into the SAME loose OTLP-JSON-ish structure `otel-normalize.ts` consumes, so
+ * both transports (JSON + protobuf) converge on one normalizer.
+ *
+ * ── WHY HAND-ROLLED (§5.5 dependency firewall) ────────────────────────────
+ * Adding `@opentelemetry/*` or a generated proto runtime would be a new npm
+ * dependency, which needs an explicit addendum + G2 pack-safety review. We are
+ * decoding a fixed, small message set (trace/span/keyvalue), not implementing
+ * protobuf generally, so a focused wire reader is the right, dependency-free
+ * tool (implementation-plan "risks"). It reads only structure/identity/usage
+ * fields; content-adjacent fields (kvlist/bytes AnyValue) are skipped.
+ *
+ * Wire format: tag = (field << 3) | wireType; 0=varint, 1=64-bit, 2=length-
+ * delimited, 5=32-bit. int64 attribute + fixed64 timestamp values are emitted
+ * as DECIMAL STRINGS (what the normalizer's coercion expects), trace/span ids
+ * as lowercase hex.
+ */
+/**
+ * Decode an OTLP `ExportTraceServiceRequest` / `TracesData` protobuf body into
+ * the `{ resourceSpans: [...] }` structure the normalizer reads. Throws on a
+ * truncated/garbled body (the caller turns that into a 400) — never returns
+ * partial garbage.
+ */
+export declare function decodeOtlpProtobufTraces(body: Buffer): {
+    resourceSpans: unknown[];
+};
+//# sourceMappingURL=otlp-proto.d.ts.map

package/dist/telemetry/otlp-proto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otlp-proto.d.ts","sourceRoot":"","sources":["../../src/telemetry/otlp-proto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA4OH;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,OAAO,EAAE,CAAA;CAAE,CAUnF"}

package/dist/telemetry/otlp-proto.js

@@ -0,0 +1,266 @@
+"use strict";
+/**
+ * Minimal OTLP/protobuf trace decoder — Expansion E3-Harvest (spec §3.2).
+ * PURE. Decodes an `ExportTraceServiceRequest` / `TracesData` protobuf body
+ * into the SAME loose OTLP-JSON-ish structure `otel-normalize.ts` consumes, so
+ * both transports (JSON + protobuf) converge on one normalizer.
+ *
+ * ── WHY HAND-ROLLED (§5.5 dependency firewall) ────────────────────────────
+ * Adding `@opentelemetry/*` or a generated proto runtime would be a new npm
+ * dependency, which needs an explicit addendum + G2 pack-safety review. We are
+ * decoding a fixed, small message set (trace/span/keyvalue), not implementing
+ * protobuf generally, so a focused wire reader is the right, dependency-free
+ * tool (implementation-plan "risks"). It reads only structure/identity/usage
+ * fields; content-adjacent fields (kvlist/bytes AnyValue) are skipped.
+ *
+ * Wire format: tag = (field << 3) | wireType; 0=varint, 1=64-bit, 2=length-
+ * delimited, 5=32-bit. int64 attribute + fixed64 timestamp values are emitted
+ * as DECIMAL STRINGS (what the normalizer's coercion expects), trace/span ids
+ * as lowercase hex.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeOtlpProtobufTraces = decodeOtlpProtobufTraces;
+const WIRE_VARINT = 0;
+const WIRE_64BIT = 1;
+const WIRE_LEN = 2;
+const WIRE_32BIT = 5;
+class Reader {
+    constructor(buf) {
+        this.buf = buf;
+        this.pos = 0;
+    }
+    get done() {
+        return this.pos >= this.buf.length;
+    }
+    /** LEB128 varint → bigint (values can exceed 2^53). */
+    varint() {
+        let result = 0n;
+        let shift = 0n;
+        for (;;) {
+            if (this.pos >= this.buf.length)
+                throw new Error("varint overrun");
+            const byte = this.buf[this.pos++];
+            result |= BigInt(byte & 0x7f) << shift;
+            if ((byte & 0x80) === 0)
+                break;
+            shift += 7n;
+            if (shift > 70n)
+                throw new Error("varint too long");
+        }
+        return result;
+    }
+    /** A field tag → {field, wireType}. */
+    tag() {
+        const t = Number(this.varint());
+        return { field: t >>> 3, wireType: t & 0x7 };
+    }
+    bytes() {
+        const len = Number(this.varint());
+        if (this.pos + len > this.buf.length)
+            throw new Error("length-delimited overrun");
+        const slice = this.buf.subarray(this.pos, this.pos + len);
+        this.pos += len;
+        return slice;
+    }
+    fixed64() {
+        if (this.pos + 8 > this.buf.length)
+            throw new Error("fixed64 overrun");
+        const slice = this.buf.subarray(this.pos, this.pos + 8);
+        this.pos += 8;
+        return slice;
+    }
+    /** Skip a field of the given wire type we do not consume. */
+    skip(wireType) {
+        if (wireType === WIRE_VARINT)
+            this.varint();
+        else if (wireType === WIRE_64BIT)
+            this.pos += 8;
+        else if (wireType === WIRE_LEN)
+            this.bytes();
+        else if (wireType === WIRE_32BIT)
+            this.pos += 4;
+        else
+            throw new Error(`unknown wire type ${wireType}`);
+    }
+}
+function fixed64ToDecimalString(b) {
+    // Little-endian uint64 → decimal string.
+    let v = 0n;
+    for (let i = 7; i >= 0; i--)
+        v = (v << 8n) | BigInt(b[i]);
+    return v.toString();
+}
+function fixed64ToDouble(b) {
+    return b.readDoubleLE(0);
+}
+function decodeAnyValue(buf) {
+    const r = new Reader(buf);
+    const out = {};
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        // Guard the wire type on EVERY field: a field whose wire type does not match
+        // its schema (malformed input, or a wrong-message-type body such as a logs
+        // record decoded as a span) is skipped, never mis-read. Without this a
+        // fixed64 log timestamp at field 1 would be read as a length-delimited
+        // string and corrupt the parse.
+        if (field === 1 && wireType === WIRE_LEN)
+            out.stringValue = r.bytes().toString("utf8");
+        else if (field === 2 && wireType === WIRE_VARINT)
+            out.boolValue = r.varint() !== 0n;
+        else if (field === 3 && wireType === WIRE_VARINT)
+            out.intValue = r.varint().toString();
+        else if (field === 4 && wireType === WIRE_64BIT)
+            out.doubleValue = fixed64ToDouble(r.fixed64());
+        else if (field === 5 && wireType === WIRE_LEN)
+            out.arrayValue = { values: decodeArrayValue(r.bytes()) };
+        // 6 kvlist_value / 7 bytes_value are content-adjacent — skipped in v0.
+        else
+            r.skip(wireType);
+    }
+    return out;
+}
+function decodeArrayValue(buf) {
+    const r = new Reader(buf);
+    const values = [];
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 1 && wireType === WIRE_LEN)
+            values.push(decodeAnyValue(r.bytes()));
+        else
+            r.skip(wireType);
+    }
+    return values;
+}
+function decodeKeyValue(buf) {
+    const r = new Reader(buf);
+    const kv = {};
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 1 && wireType === WIRE_LEN)
+            kv.key = r.bytes().toString("utf8");
+        else if (field === 2 && wireType === WIRE_LEN)
+            kv.value = decodeAnyValue(r.bytes());
+        else
+            r.skip(wireType);
+    }
+    return kv;
+}
+function decodeSpan(buf) {
+    const r = new Reader(buf);
+    const span = { attributes: [] };
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        // Wire-type-guarded (see decodeAnyValue): a LogRecord decoded here as a Span
+        // has a fixed64 at field 1 where a Span expects bytes; guarding makes that a
+        // skip (→ an id-less span the normalizer drops / logs-detection catches),
+        // never a corrupt read.
+        if (field === 1 && wireType === WIRE_LEN)
+            span.traceId = r.bytes().toString("hex");
+        else if (field === 2 && wireType === WIRE_LEN)
+            span.spanId = r.bytes().toString("hex");
+        else if (field === 4 && wireType === WIRE_LEN)
+            span.parentSpanId = r.bytes().toString("hex");
+        else if (field === 5 && wireType === WIRE_LEN)
+            span.name = r.bytes().toString("utf8");
+        else if (field === 6 && wireType === WIRE_VARINT)
+            span.kind = Number(r.varint());
+        else if (field === 7 && wireType === WIRE_64BIT)
+            span.startTimeUnixNano = fixed64ToDecimalString(r.fixed64());
+        else if (field === 8 && wireType === WIRE_64BIT)
+            span.endTimeUnixNano = fixed64ToDecimalString(r.fixed64());
+        else if (field === 9 && wireType === WIRE_LEN)
+            span.attributes.push(decodeKeyValue(r.bytes()));
+        else if (field === 15 && wireType === WIRE_LEN)
+            span.status = decodeStatus(r.bytes());
+        else
+            r.skip(wireType);
+    }
+    return span;
+}
+function decodeStatus(buf) {
+    const r = new Reader(buf);
+    const status = {};
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 2 && wireType === WIRE_LEN)
+            status.message = r.bytes().toString("utf8");
+        else if (field === 3 && wireType === WIRE_VARINT)
+            status.code = Number(r.varint());
+        else
+            r.skip(wireType);
+    }
+    return status;
+}
+function decodeScope(buf) {
+    const r = new Reader(buf);
+    const scope = {};
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 1 && wireType === WIRE_LEN)
+            scope.name = r.bytes().toString("utf8");
+        else if (field === 2 && wireType === WIRE_LEN)
+            scope.version = r.bytes().toString("utf8");
+        else
+            r.skip(wireType);
+    }
+    return scope;
+}
+function decodeScopeSpans(buf) {
+    const r = new Reader(buf);
+    const out = { spans: [] };
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 1 && wireType === WIRE_LEN)
+            out.scope = decodeScope(r.bytes());
+        else if (field === 2 && wireType === WIRE_LEN)
+            out.spans.push(decodeSpan(r.bytes()));
+        else
+            r.skip(wireType);
+    }
+    return out;
+}
+function decodeResource(buf) {
+    const r = new Reader(buf);
+    const attributes = [];
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 1 && wireType === WIRE_LEN)
+            attributes.push(decodeKeyValue(r.bytes()));
+        else
+            r.skip(wireType);
+    }
+    return { attributes };
+}
+function decodeResourceSpans(buf) {
+    const r = new Reader(buf);
+    const out = { scopeSpans: [] };
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        if (field === 1 && wireType === WIRE_LEN)
+            out.resource = decodeResource(r.bytes());
+        else if (field === 2 && wireType === WIRE_LEN)
+            out.scopeSpans.push(decodeScopeSpans(r.bytes()));
+        else
+            r.skip(wireType);
+    }
+    return out;
+}
+/**
+ * Decode an OTLP `ExportTraceServiceRequest` / `TracesData` protobuf body into
+ * the `{ resourceSpans: [...] }` structure the normalizer reads. Throws on a
+ * truncated/garbled body (the caller turns that into a 400) — never returns
+ * partial garbage.
+ */
+function decodeOtlpProtobufTraces(body) {
+    const r = new Reader(body);
+    const resourceSpans = [];
+    while (!r.done) {
+        const { field, wireType } = r.tag();
+        // TracesData.resource_spans = 1; ExportTraceServiceRequest.resource_spans = 1.
+        if (field === 1 && wireType === WIRE_LEN)
+            resourceSpans.push(decodeResourceSpans(r.bytes()));
+        else
+            r.skip(wireType);
+    }
+    return { resourceSpans };
+}

package/dist/telemetry/sinks.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The two telemetry transports — Phase 6 WS2.
+ *
+ * telemetry-ingestion-boundary.md §2.4 names three modes. Two of them are
+ * sinks and live here; the third (local-only) is the absence of a sink.
+ *
+ *   direct   self-host + our own single-tenant deployments · their database
+ *   api      every hosted customer · their `rig_sk_` key only
+ *
+ * Both implement `TelemetrySink`, both are driven by the SAME exporter loop,
+ * and both produce their database rows through `stampBatch` — so the promise
+ * that "self-host ↔ hosted migration is a config change, not a data model
+ * change" is enforced by construction rather than by review.
+ *
+ * ── WHY THE API SINK GZIPS AND THE DIRECT ONE DOES NOT ───────────────────
+ * The api sink crosses the public internet with one batch per flush, and a
+ * batch is highly repetitive JSON. The direct sink talks to PostgREST, which
+ * would have to decompress it again on the way into the same database the
+ * caller already holds a service-role key for. Compression there would be
+ * cost with no payer.
+ */
+import type { IngestBatch, IngestOutcome, Tenancy } from "./ingest-protocol";
+import type { ApiExportConfig, DirectExportConfig } from "../config";
+export interface TelemetrySink {
+    /** Named so a boot banner and `/status` can say which lane is live without
+     * inspecting config — the "which mode am I in?" question got asked enough
+     * during WS1 to be worth answering in the object. */
+    readonly mode: "direct" | "api";
+    /** Deliver one batch. Throws `SinkSendError` on failure; the exporter owns
+     * retry/backoff and reads `retriable` to tell a transient blip apart from a
+     * deterministic rejection it must poison-skip (E2 hardening Phase 2). */
+    send(batch: IngestBatch): Promise<void>;
+}
+/**
+ * A sink send failed — the typed error both transports throw (E2 hardening
+ * Phase 2, spec §2.3.1). It carries the HTTP status the sink observed (absent
+ * for a network-level throw) and a `retriable` verdict the exporter branches on:
+ *
+ *   retriable  network throw (no status) · any 5xx · a 429 (overload)
+ *              → the same batch may land next time; retry forever, never drop.
+ *   NOT        every other 4xx, including the server's deterministic 422
+ *              → the same bytes will be rejected identically forever; the
+ *                exporter poison-skips it after a bounded self-heal window.
+ *
+ * The message is leak-safe BY CONSTRUCTION — status + table only, NEVER the
+ * PostgREST/response body. An exporter's warnings are the likeliest place for a
+ * secret or a foreign row to reach someone else's log aggregator (C2's leak
+ * gate), so the body a failed write returns is logged nowhere.
+ */
+export declare class SinkSendError extends Error {
+    /** The HTTP status observed, or undefined for a network-level throw. */
+    readonly status?: number;
+    /** True ⇔ a transient failure the exporter should retry forever (never a
+     * poison-skip candidate). Derived once, from the status, so the classification
+     * lives in exactly one place. */
+    readonly retriable: boolean;
+    constructor(message: string, status: number | undefined);
+}
+export interface DirectSinkConfig {
+    readonly supabaseUrl: string;
+    /** Service-role key — server-side only; never reaches a browser. */
+    readonly serviceRoleKey: string;
+    /** The tenant this deployment stamps. Every row it writes lands here. */
+    readonly tenancy: Tenancy;
+    readonly fetchFn?: typeof fetch;
+}
+export declare function createDirectSink(config: DirectSinkConfig): TelemetrySink;
+export interface ApiSinkConfig {
+    /** Base URL of the ingest service, e.g. https://api.modelrig.ai */
+    readonly ingestUrl: string;
+    /** `rig_sk_…` with the `ingest` scope. The ONLY credential a hosted
+     * customer holds — no database URL, no service role (§2's one rule). */
+    readonly apiKey: string;
+    readonly fetchFn?: typeof fetch;
+    /** Called with each batch's outcome. The exporter logs dropped rows through
+     * this: a batch the server partly refused is a 200, and a customer whose
+     * rows are being dropped must hear about it from their own process rather
+     * than by noticing a gap in a chart weeks later. */
+    readonly onOutcome?: (outcome: IngestOutcome) => void;
+}
+export declare function createApiSink(config: ApiSinkConfig): TelemetrySink;
+/**
+ * Build the telemetry transport for the configured export mode. One place, so
+ * the run-loop exporter and the load-error reporter build it the same way —
+ * telemetry-ingestion-boundary.md §4's "one loop, two transports". (Lived in
+ * index.ts until Phase D; moved here — its natural home — to keep that file
+ * under the LOC cap.)
+ */
+export declare function buildTelemetrySink(exportConfig: ApiExportConfig | DirectExportConfig, sourceId: string): TelemetrySink;
+//# sourceMappingURL=sinks.d.ts.map

package/dist/telemetry/sinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinks.d.ts","sourceRoot":"","sources":["../../src/telemetry/sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAGrE,MAAM,WAAW,aAAa;IAC5B;;yDAEqD;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC;;6EAEyE;IACzE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;qCAEiC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMxD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CA0CxE;AAMD,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC;;;wDAGoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CACvD;AAKD,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CA4ClE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,eAAe,GAAG,kBAAkB,EAClD,QAAQ,EAAE,MAAM,GACf,aAAa,CA0Bf"}