@alma-harness/runtime 0.11.0 → 0.12.0

package/README.md

@@ -1,8 +1,49 @@
 # @alma-harness/runtime
 
-Official storage composition and a simple text conversation facade. The root
-export contains types only. Use `/agent` for query/resume, `/memory` or `/postgres`
-for storage, and the lower-level `createConversationRunner` for advanced routing.
+Official storage composition, a deployment that derives governed runners, and a
+simple text conversation facade. The root export contains types only. Use
+`/deployment` to configure once, `/agent` for query/resume, `/memory` or
+`/postgres` for storage, and the lower-level factories for advanced routing.
+
+## Configure once: `/deployment`
+
+```ts
+import { createRuntimeDeployment } from '@alma-harness/runtime/deployment';
+const deployment = createRuntimeDeployment({
+  runtime, clients: { anthropic, openai }, prices, priceVersion,
+  consumers: ['product'], caps, retentionMs: 60_000,
+  limits: { deadlineMs: 8_000, runTimeoutMs: 120_000, stepTimeoutMs: 60_000, maxCalls: 24,
+            maxInputChars: 64_000, maxRequestChars: 1_000_000, maxOutputChars: 100_000 },
+  onBackgroundError: reportAccountingIssue,
+});
+const titles = deployment.singleCall({ policy, policyVersion, outputContractVersion, system: [], maxTokens: 64 });
+const pick = deployment.structuredCall({ policy, policyVersion, outputContractVersion, system, maxTokens, tools, toolChoice });
+const chat = deployment.conversation({ policy, policyVersion, configRevision, resultContractVersion, system, tools,
+  caps: perTurnCaps, limits: { maxCalls: 8 } });
+```
+
+Each factory returns the runner that `createSingleCallRunner`,
+`createStructuredCallRunner` or `createConversationRunner` would build from the same
+values. They keep their validation, bindings and replay (spec: runtime-deployment).
+
+- **Owned by the deployment:** the runtime's stores and audit log, `clients`,
+  `prices`, `priceVersion`, `consumers`, the result retention and a conversation's
+  `step`. An operation passing any of them, even as `undefined`, throws `TypeError`.
+  A product that needs a different store, audit sink or price table for one
+  operation composes that runner explicitly.
+- **Overridable per operation:** `caps` replaces the deployment's caps whole (no
+  merging), `limits` merge field by field, `onBackgroundError` replaces.
+- **Required limits:** single-call and structured need `deadlineMs`,
+  `maxInputChars` and `maxOutputChars`. A conversation needs `runTimeoutMs` (root),
+  `stepTimeoutMs` (each step), `maxCalls`, `maxInputChars`, `maxRequestChars` and
+  `maxOutputChars`. There are no defaults: text replay binds versions, not limits,
+  so a default that moved in a release would change admitted work silently.
+- **Snapshot:** prices, caps, limits, consumers, the client registry and both levels
+  of the store map are copied at construction. The deployment owns no pools and
+  never closes the runtime.
+- **Your versioning duty is unchanged:** bump `policyVersion`, `priceVersion`,
+  `outputContractVersion`, `configRevision` or `inputRevision` when what they name
+  changes.
 
 ## Start and resume a conversation
 
@@ -17,7 +58,7 @@ const agent = createConversationAgent({
   instructions: 'You are a helpful assistant.',
   intent: { tier: 'standard', sensitivity: 'personal' },
   limits: { caps: { perTurnUsd: 0.25 }, retentionMs: 60_000 },
-  audit, onBackgroundError: reportAccountingIssue,
+  onBackgroundError: reportAccountingIssue, // audit defaults to runtime.stores.audit
 });
 const user = agent.forUser({ org, uid }); // verified by the host
 const first = await user.query({ prompt: 'Hello', messageId: 'delivery-1' });
@@ -32,7 +73,8 @@ const observed = await user.read({ sessionId: first.sessionId, messageId: 'deliv
 
 The complete [quickstart](../../examples/quickstart/src/agent.ts) shows storage,
 tools and configuration. The facade wires all stores, one model's routing and
-internal versions; it does not own/close the supplied runtime. Optional `tools`,
+internal versions; it does not own/close the supplied runtime. `audit` is optional and
+defaults to `runtime.stores.audit`; omitting it never disables auditing. Optional `tools`,
 `hooks` and `volatile` configure trusted behavior. Model/client/prices, audit,
 intent, budget and retention remain explicit deployment choices. Keep one
 immutable revision for the entire configuration, including trusted capabilities.
@@ -128,6 +170,11 @@ remains five seconds and idle timeout ten seconds. Generic driver overrides and
 public pool handles are not provided. Migrations have their own two max1 pools,
 always closed on completion/failure; application sizing does not tune migrations.
 
+`runtime.stores.audit` writes to the audit tables the migration already installs in
+the execution namespace, on the execution pool, so audit writes share that budget.
+Audit history a host kept in another schema stays there; retention must cover the
+execution namespace, as it already must for its settlement rows.
+
 Budget `sum(runtime instances × (execution + roots))` plus migrations, retention,
 backup, other pools and an administrative reserve against database capacity.
 Count every replica/worker class and reuse a runtime across its turns/observers.
@@ -142,6 +189,110 @@ before `close()`; it attempts both pools and is idempotent. Closing neither abor
 nor releases uncertain admissions. Resolve `reconciliation_required` through the
 existing operator procedure, never by issuing a new delivery key.
 
+## Maintenance: one entry point for interrupted work
+
+```ts
+import { createPostgresMaintenance } from '@alma-harness/runtime/maintenance';
+const maintenance = createPostgresMaintenance({ schema, rootSchema, stepResultPolicy, rootResultPolicy, onPoolError,
+  discovery: { connectionString: discoveryURL }, worker: { connectionString: workerURL } });
+const report = await maintenance.maintain({ limit: 50, signal }); // schedule it; the host names no scope
+await maintenance.close();
+```
+
+`maintain` finds the scopes with due work and sweeps them, taking the least
+recently visited first (spec: runtime-maintenance). It can find:
+
+- expired admissions, which become uncertain and are never released;
+- expired roots and executions, which are fenced;
+- executions that can complete from their retained results;
+- pending usage.
+
+The report holds counts only. Nothing is logged, and the sweep never
+dispatches: it has no model client.
+
+**Provision two new logins, both without superuser, BYPASSRLS or ownership:**
+
+- **Discovery:** a member of `alma_maintenance` only. That role is created by
+  `migratePostgresRuntime`. It sees identifiers, states and times across
+  scopes, never content.
+- **Worker:** a member of `alma_app` only, and not the login of your request
+  path. It works one scope at a time with the application's authority.
+
+Neither login may be a member of `alma_retention`, or of the other's role.
+Every call checks this and throws before doing any work. Change these
+memberships with maintenance stopped.
+
+Scopes are claimed with session advisory locks, so concurrent callers skip each
+other's scopes. Each scope gets a budget of 50 items per call for each kind of
+work, and its own cursors. A scope that never clears comes back on the next lap
+without starving the others. Retention and erasure stay with the `alma_retention`
+operator. The memory runtime has no maintenance.
+
+## Receipt projections
+
+```ts
+import { createPostgresProjections } from '@alma-harness/runtime/projections';
+const projections = createPostgresProjections({ schema, rootSchema, stepResultPolicy, rootResultPolicy, onPoolError,
+  discovery: { connectionString: projectionURL }, worker: { connectionString: workerURL } });
+const report = await projections.drain('cost-dashboard', async delivery => {
+  // { scope, consumer, settlementId, receipt, attribution, signal }; deduplicate on (scope, consumer, settlementId)
+}, { limit: 50 });
+await projections.quiesce(scope, () => erasure.erase(scope, request), { timeoutMs: 30_000 });
+```
+
+`drain` finds the scopes with pending governed receipts for one consumer and
+delivers each receipt with its session attribution (spec: receipt-projections).
+Attribution is one of `available` (with labels), `erased` or `none`; erased is
+never reported as none, so never fall back to labels you kept. A receipt is
+acknowledged only after the handler resolves. A crash in between redelivers the
+same key, so commit the deduplication and the effect in one transaction.
+
+Delivery is fair and never loses a receipt:
+
+- a receipt that always fails is passed over and retried on the next lap;
+- laps are finite, and a late settlement is reached on a later lap.
+
+The report holds counts only.
+
+**Logins.** Provision two, as for maintenance:
+
+- a **discovery** login that is a member of `alma_projection` only. It sees
+  pending receipt identities and times, never payloads;
+- a **worker** login that is a member of `alma_app` only, and not your request
+  path's login.
+
+Every call checks both. The database does not separate consumers from each
+other. Give each consuming service its own pair of logins, and drain only the
+consumer names that service owns.
+
+**Erasure: quiesce, and fence any destination that stores labels.**
+`quiesce` waits for a drain working the scope, holds new ones off, and runs
+your erasure. If the erasure reports `complete: false`, `quiesce` rejects with
+`IncompleteErasureError`. A drain whose claim is lost aborts `delivery.signal`
+and starts no further receipt.
+
+No Alma lock can stop a write a handler already began. So a destination that
+keeps label values **must** serialize with erasure through gate rows. The
+empty session `''` is the scope gate.
+
+```sql
+create table gates (org text, uid text, session text, erased boolean not null default false, primary key (org, uid, session));
+-- publication, one transaction:
+insert into gates (org, uid, session) values ($org, $uid, ''), ($org, $uid, $session) on conflict do nothing;
+select erased from gates where org = $org and uid = $uid and session in ('', $session) for share;  -- held until commit
+-- write the labels only if no row is erased; otherwise write the receipt without them. Then commit.
+-- erasure, inside quiesce, one transaction, two statements:
+insert into gates (org, uid, session, erased) values ($org, $uid, $session, true)
+  on conflict (org, uid, session) do update set erased = true;  -- waits for a publication holding the gate
+update your_rows set labels = null where org = $org and uid = $uid and session = $session;  -- a new snapshot, after the wait
+```
+
+Keep the clearing in its own statement. In READ COMMITTED, a single statement
+keeps the snapshot it took before waiting on the gate, so it would miss the row
+the waiting publication just committed. For a scope-wide erasure, do the same
+with the `''` gate and every row of the scope. A consumer that stores receipts
+without labels needs no fence.
+
 ## Conversation operations
 
 `@alma-harness/runtime/operations` exports `createConversationOperations`. Supply
@@ -158,3 +309,7 @@ blocked; release never marks an incomplete root successful. Expiry sweeps are
 explicitly scope-wide. A stale digest requires reinspection, while lost resolution
 ACK retries retain the same resolutionId. This is operator infrastructure, not a
 request-path fallback or a remote-worker fencing implementation.
+
+`runtime.stores.labels` is the session label store (spec: session-labels), in
+memory or in the execution namespace on PostgreSQL; `migratePostgresRuntime`
+installs it. Wire it into erasure as `createMemoryErasure({ sessionLabels })`.

package/dist/agent.d.ts

@@ -13,7 +13,8 @@ interface ConversationAgentOptions {
         prices: ModelPrice[];
     };
     instructions: string;
-    audit: ConversationConfig["step"]["audit"];
+    /** Omitted means `runtime.stores.audit`; never disables auditing (spec: runtime-deployment). */
+    audit?: ConversationConfig["step"]["audit"];
     intent: SimpleConversationInput["intent"];
     tools?: ConversationConfig["tools"];
     hooks?: ConversationConfig["hooks"];

package/dist/agent.js

@@ -1,3 +1,7 @@
+import {
+  isAuditLog
+} from "./chunk-II7NDZRL.js";
+
 // src/agent.ts
 import { createHash } from "crypto";
 import { settlementIdentifier, settlementScope } from "@alma-harness/core";
@@ -38,6 +42,8 @@ function createConversationAgent(value) {
   }
   if (limits.caps === void 0 || limits.caps === null) throw new TypeError("Explicit conversation budget required");
   if (typeof options.instructions !== "string" || typeof options.onBackgroundError !== "function") throw new TypeError("Conversation instructions and error observer are required");
+  const audit = options.audit ?? options.runtime.stores.audit;
+  if (!isAuditLog(audit)) throw new TypeError("Conversation agent requires an audit log");
   const version = `${FORMAT}:${digest([FORMAT, id, revision])}`;
   const runTimeoutMs = limits.runTimeoutMs ?? 12e4;
   const config = {
@@ -61,7 +67,7 @@ function createConversationAgent(value) {
     step: {
       ...options.runtime.stores.step,
       clients: { [ref.provider]: model.client },
-      audit: options.audit,
+      audit,
       runTimeoutMs,
       maxRequestChars: limits.maxRequestChars ?? 1e6,
       maxOutputChars: limits.maxOutputChars ?? 1e5,

package/dist/agent.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/agent.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { settlementIdentifier, settlementScope, type ModelPrice, type ModelRef, type Scope, type SingleDispatchModelClient } from \"@alma-harness/core\";\nimport { conversationRootKey, createConversationDescriptor, createConversationRunner, type ConversationConfig, type ConversationView, type SimpleConversationInput } from \"@alma-harness/conversation\";\nimport type { Runtime } from \"./index\";\n\n// DECISION: default changes require a format bump, preserving admitted bindings.\nconst FORMAT = \"conversation-agent-v1\";\nconst digest = (parts: unknown[]) => createHash(\"sha256\").update(JSON.stringify(parts)).digest(\"hex\");\nexport interface ConversationAgentOptions {\n  id: string;\n  /** Immutable host configuration: includes prices, tools and trusted callbacks. */\n  revision: string;\n  runtime: Runtime;\n  model: { ref: ModelRef; client: SingleDispatchModelClient; prices: ModelPrice[] };\n  instructions: string;\n  audit: ConversationConfig[\"step\"][\"audit\"];\n  intent: SimpleConversationInput[\"intent\"];\n  tools?: ConversationConfig[\"tools\"];\n  hooks?: ConversationConfig[\"hooks\"];\n  volatile?: ConversationConfig[\"volatile\"];\n  limits: {\n    caps: ConversationConfig[\"caps\"];\n    retentionMs: number;\n    runTimeoutMs?: number;\n    maxCalls?: number;\n    maxInputChars?: number;\n    maxRequestChars?: number;\n    maxOutputChars?: number;\n  };\n  onBackgroundError: ConversationConfig[\"step\"][\"onBackgroundError\"];\n}\nexport interface ConversationQuery { prompt: string; messageId: string; resume?: string; signal?: AbortSignal }\nexport interface ConversationQueryKey { sessionId: string; messageId: string }\nexport interface ConversationQueryResult extends ConversationQueryKey { rootKey: string; view: ConversationView }\nexport interface ConversationQueryObservation extends ConversationQueryKey { rootKey: string; view: ConversationView | null }\nexport interface UserConversationAgent {\n  query(input: ConversationQuery): Promise<ConversationQueryResult>;\n  read(key: ConversationQueryKey): Promise<ConversationQueryObservation>;\n}\nexport interface ConversationAgent { forUser(scope: Scope): UserConversationAgent }\nexport class ConversationResumeError extends Error {\n  readonly code = \"conversation_resume_not_found\";\n  constructor() { super(\"Conversation session not found in the bound scope\"); this.name = \"ConversationResumeError\"; }\n}\n\n/** Inspect data descriptors before reading values; a request cannot invoke getters. */\nfunction fields(value: unknown, allowed: readonly string[]): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw new TypeError(\"Invalid conversation agent input\");\n  return Object.fromEntries(Reflect.ownKeys(value).map(key => {\n    const d = Object.getOwnPropertyDescriptor(value, key)!;\n    if (typeof key !== \"string\" || !allowed.includes(key) || !d.enumerable || !(\"value\" in d)) throw new TypeError(\"Invalid conversation agent field\");\n    return [key, d.value];\n  }));\n}\nconst scopeCopy = (value: Scope): Scope => settlementScope(fields(value, [\"org\", \"uid\"]) as unknown as Scope);\n\n/** Deterministic even when the first response was lost. Never derives identity from text or revision. */\nexport function conversationAgentSessionId(agentId: string, scope: Scope, messageId: string): string {\n  const s = scopeCopy(scope);\n  return `agent-session-v1:${digest([\"agent-session-v1\", settlementIdentifier(agentId), s.org, s.uid, settlementIdentifier(messageId)])}`;\n}\n\n/** A text facade over the canonical engine. Owns no stores, pools, retries or session registry. */\nexport function createConversationAgent(value: ConversationAgentOptions): ConversationAgent {\n  const options = fields(value, [\"id\", \"revision\", \"runtime\", \"model\", \"instructions\", \"audit\", \"intent\", \"tools\", \"hooks\", \"volatile\", \"limits\", \"onBackgroundError\"]) as unknown as ConversationAgentOptions;\n  const id = settlementIdentifier(options.id), revision = settlementIdentifier(options.revision);\n  const model = fields(options.model, [\"ref\", \"client\", \"prices\"]) as unknown as ConversationAgentOptions[\"model\"];\n  const ref = structuredClone(model.ref), intent = structuredClone(options.intent);\n  const limits = fields(options.limits, [\"caps\", \"retentionMs\", \"runTimeoutMs\", \"maxCalls\", \"maxInputChars\", \"maxRequestChars\", \"maxOutputChars\"]) as unknown as ConversationAgentOptions[\"limits\"];\n  if (![\"anthropic\", \"openai\", \"openrouter\"].includes(ref.provider)) throw new TypeError(\"Invalid conversation model provider\");\n  settlementIdentifier(ref.id);\n  for (const key of [\"runTimeoutMs\", \"maxCalls\", \"maxInputChars\", \"maxRequestChars\", \"maxOutputChars\"] as const) {\n    const n = limits[key];\n    if (n !== undefined && (!Number.isSafeInteger(n) || n < 1)) throw new TypeError(\"Invalid conversation agent limit\");\n  }\n  if (limits.caps === undefined || limits.caps === null) throw new TypeError(\"Explicit conversation budget required\");\n  if (typeof options.instructions !== \"string\" || typeof options.onBackgroundError !== \"function\") throw new TypeError(\"Conversation instructions and error observer are required\");\n  const version = `${FORMAT}:${digest([FORMAT, id, revision])}`;\n  const runTimeoutMs = limits.runTimeoutMs ?? 120000;\n  const config: ConversationConfig = {\n    ...options.runtime.stores,\n    system: [{ text: options.instructions, volatility: \"stable\" }],\n    policy: { resolve: () => ({ model: { ...ref }, rationale: \"configured conversation agent model\" }) },\n    prices: structuredClone(model.prices), caps: structuredClone(limits.caps), consumers: [],\n    policyVersion: version, priceVersion: version, configRevision: version, resultContractVersion: FORMAT,\n    resultRetentionMs: limits.retentionMs, runTimeoutMs, maxCalls: limits.maxCalls ?? 24, maxInputChars: limits.maxInputChars ?? 64000,\n    ...(options.tools !== undefined ? { tools: options.tools } : {}),\n    ...(options.hooks !== undefined ? { hooks: options.hooks } : {}),\n    ...(options.volatile !== undefined ? { volatile: options.volatile } : {}),\n    step: { ...options.runtime.stores.step, clients: { [ref.provider]: model.client }, audit: options.audit, runTimeoutMs,\n      maxRequestChars: limits.maxRequestChars ?? 1000000, maxOutputChars: limits.maxOutputChars ?? 100000,\n      onBackgroundError: options.onBackgroundError },\n  };\n  // Reuse canonical validation, including intent, before any request can perform I/O.\n  createConversationDescriptor(config, { scope: { org: \"validation\", uid: \"validation\" }, sessionId: \"validation\", idempotencyKey: \"validation\",\n    input: { role: \"user\", blocks: [] }, intent }, new Date(Date.now() + runTimeoutMs).toISOString());\n  const runner = createConversationRunner(config), admissions = options.runtime.stores.admissions;\n  return { forUser(value) {\n    const scope = scopeCopy(value);\n    return {\n      async query(value) {\n        const q = fields(value, [\"prompt\", \"messageId\", \"resume\", \"signal\"]);\n        const messageId = settlementIdentifier(q.messageId);\n        const sessionId = q.resume === undefined ? conversationAgentSessionId(id, scope, messageId) : settlementIdentifier(q.resume);\n        if (typeof q.prompt !== \"string\" || q.prompt.length > config.maxInputChars) throw new TypeError(\"Invalid conversation prompt\");\n        const input: SimpleConversationInput = { scope: { ...scope }, sessionId, idempotencyKey: messageId,\n          input: { role: \"user\", blocks: [{ type: \"text\", text: q.prompt }] }, intent: structuredClone(intent),\n          ...(q.signal !== undefined ? { signal: q.signal as AbortSignal } : {}) };\n        // Validate the canonical envelope before the resume lookup, not after I/O.\n        const root = createConversationDescriptor(config, input, new Date(Date.now() + runTimeoutMs).toISOString());\n        if (q.resume !== undefined && !(await admissions.list({ ...scope }, sessionId, { limit: 1 })).length) throw new ConversationResumeError();\n        return { sessionId, messageId, rootKey: root.key, view: await runner.runTurn(input) };\n      },\n      async read(value) {\n        const key = fields(value, [\"sessionId\", \"messageId\"]);\n        const sessionId = settlementIdentifier(key.sessionId), messageId = settlementIdentifier(key.messageId);\n        const rootKey = conversationRootKey(scope, sessionId, messageId);\n        return { sessionId, messageId, rootKey, view: await runner.read({ ...scope }, rootKey) };\n      },\n    };\n  } };\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB,uBAAmG;AAClI,SAAS,qBAAqB,8BAA8B,gCAA8G;AAI1K,IAAM,SAAS;AACf,IAAM,SAAS,CAAC,UAAqB,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,OAAO,KAAK;AAiC7F,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC,OAAO;AAAA,EAChB,cAAc;AAAE,UAAM,mDAAmD;AAAG,SAAK,OAAO;AAAA,EAA2B;AACrH;AAGA,SAAS,OAAO,OAAgB,SAAqD;AACnF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,CAAC,OAAO,WAAW,IAAI,EAAE,SAAS,OAAO,eAAe,KAAK,CAAC,EAAG,OAAM,IAAI,UAAU,kCAAkC;AACnK,SAAO,OAAO,YAAY,QAAQ,QAAQ,KAAK,EAAE,IAAI,SAAO;AAC1D,UAAM,IAAI,OAAO,yBAAyB,OAAO,GAAG;AACpD,QAAI,OAAO,QAAQ,YAAY,CAAC,QAAQ,SAAS,GAAG,KAAK,CAAC,EAAE,cAAc,EAAE,WAAW,GAAI,OAAM,IAAI,UAAU,kCAAkC;AACjJ,WAAO,CAAC,KAAK,EAAE,KAAK;AAAA,EACtB,CAAC,CAAC;AACJ;AACA,IAAM,YAAY,CAAC,UAAwB,gBAAgB,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAqB;AAGrG,SAAS,2BAA2B,SAAiB,OAAc,WAA2B;AACnG,QAAM,IAAI,UAAU,KAAK;AACzB,SAAO,oBAAoB,OAAO,CAAC,oBAAoB,qBAAqB,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,qBAAqB,SAAS,CAAC,CAAC,CAAC;AACvI;AAGO,SAAS,wBAAwB,OAAoD;AAC1F,QAAM,UAAU,OAAO,OAAO,CAAC,MAAM,YAAY,WAAW,SAAS,gBAAgB,SAAS,UAAU,SAAS,SAAS,YAAY,UAAU,mBAAmB,CAAC;AACpK,QAAM,KAAK,qBAAqB,QAAQ,EAAE,GAAG,WAAW,qBAAqB,QAAQ,QAAQ;AAC7F,QAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC,OAAO,UAAU,QAAQ,CAAC;AAC/D,QAAM,MAAM,gBAAgB,MAAM,GAAG,GAAG,SAAS,gBAAgB,QAAQ,MAAM;AAC/E,QAAM,SAAS,OAAO,QAAQ,QAAQ,CAAC,QAAQ,eAAe,gBAAgB,YAAY,iBAAiB,mBAAmB,gBAAgB,CAAC;AAC/I,MAAI,CAAC,CAAC,aAAa,UAAU,YAAY,EAAE,SAAS,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,qCAAqC;AAC5H,uBAAqB,IAAI,EAAE;AAC3B,aAAW,OAAO,CAAC,gBAAgB,YAAY,iBAAiB,mBAAmB,gBAAgB,GAAY;AAC7G,UAAM,IAAI,OAAO,GAAG;AACpB,QAAI,MAAM,WAAc,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,GAAI,OAAM,IAAI,UAAU,kCAAkC;AAAA,EACpH;AACA,MAAI,OAAO,SAAS,UAAa,OAAO,SAAS,KAAM,OAAM,IAAI,UAAU,uCAAuC;AAClH,MAAI,OAAO,QAAQ,iBAAiB,YAAY,OAAO,QAAQ,sBAAsB,WAAY,OAAM,IAAI,UAAU,2DAA2D;AAChL,QAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;AAC3D,QAAM,eAAe,OAAO,gBAAgB;AAC5C,QAAM,SAA6B;AAAA,IACjC,GAAG,QAAQ,QAAQ;AAAA,IACnB,QAAQ,CAAC,EAAE,MAAM,QAAQ,cAAc,YAAY,SAAS,CAAC;AAAA,IAC7D,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,WAAW,sCAAsC,GAAG;AAAA,IACnG,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IAAG,MAAM,gBAAgB,OAAO,IAAI;AAAA,IAAG,WAAW,CAAC;AAAA,IACvF,eAAe;AAAA,IAAS,cAAc;AAAA,IAAS,gBAAgB;AAAA,IAAS,uBAAuB;AAAA,IAC/F,mBAAmB,OAAO;AAAA,IAAa;AAAA,IAAc,UAAU,OAAO,YAAY;AAAA,IAAI,eAAe,OAAO,iBAAiB;AAAA,IAC7H,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAC9D,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAC9D,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvE,MAAM;AAAA,MAAE,GAAG,QAAQ,QAAQ,OAAO;AAAA,MAAM,SAAS,EAAE,CAAC,IAAI,QAAQ,GAAG,MAAM,OAAO;AAAA,MAAG,OAAO,QAAQ;AAAA,MAAO;AAAA,MACvG,iBAAiB,OAAO,mBAAmB;AAAA,MAAS,gBAAgB,OAAO,kBAAkB;AAAA,MAC7F,mBAAmB,QAAQ;AAAA,IAAkB;AAAA,EACjD;AAEA,+BAA6B,QAAQ;AAAA,IAAE,OAAO,EAAE,KAAK,cAAc,KAAK,aAAa;AAAA,IAAG,WAAW;AAAA,IAAc,gBAAgB;AAAA,IAC/H,OAAO,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAAA,IAAG;AAAA,EAAO,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,EAAE,YAAY,CAAC;AAClG,QAAM,SAAS,yBAAyB,MAAM,GAAG,aAAa,QAAQ,QAAQ,OAAO;AACrF,SAAO,EAAE,QAAQA,QAAO;AACtB,UAAM,QAAQ,UAAUA,MAAK;AAC7B,WAAO;AAAA,MACL,MAAM,MAAMA,QAAO;AACjB,cAAM,IAAI,OAAOA,QAAO,CAAC,UAAU,aAAa,UAAU,QAAQ,CAAC;AACnE,cAAM,YAAY,qBAAqB,EAAE,SAAS;AAClD,cAAM,YAAY,EAAE,WAAW,SAAY,2BAA2B,IAAI,OAAO,SAAS,IAAI,qBAAqB,EAAE,MAAM;AAC3H,YAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,SAAS,OAAO,cAAe,OAAM,IAAI,UAAU,6BAA6B;AAC7H,cAAM,QAAiC;AAAA,UAAE,OAAO,EAAE,GAAG,MAAM;AAAA,UAAG;AAAA,UAAW,gBAAgB;AAAA,UACvF,OAAO,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE,MAAM,QAAQ,MAAM,EAAE,OAAO,CAAC,EAAE;AAAA,UAAG,QAAQ,gBAAgB,MAAM;AAAA,UACnG,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAsB,IAAI,CAAC;AAAA,QAAG;AAEzE,cAAM,OAAO,6BAA6B,QAAQ,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,EAAE,YAAY,CAAC;AAC1G,YAAI,EAAE,WAAW,UAAa,EAAE,MAAM,WAAW,KAAK,EAAE,GAAG,MAAM,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,OAAQ,OAAM,IAAI,wBAAwB;AACxI,eAAO,EAAE,WAAW,WAAW,SAAS,KAAK,KAAK,MAAM,MAAM,OAAO,QAAQ,KAAK,EAAE;AAAA,MACtF;AAAA,MACA,MAAM,KAAKA,QAAO;AAChB,cAAM,MAAM,OAAOA,QAAO,CAAC,aAAa,WAAW,CAAC;AACpD,cAAM,YAAY,qBAAqB,IAAI,SAAS,GAAG,YAAY,qBAAqB,IAAI,SAAS;AACrG,cAAM,UAAU,oBAAoB,OAAO,WAAW,SAAS;AAC/D,eAAO,EAAE,WAAW,WAAW,SAAS,MAAM,MAAM,OAAO,KAAK,EAAE,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,MACzF;AAAA,IACF;AAAA,EACF,EAAE;AACJ;","names":["value"]}
+{"version":3,"sources":["../src/agent.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { settlementIdentifier, settlementScope, type ModelPrice, type ModelRef, type Scope, type SingleDispatchModelClient } from \"@alma-harness/core\";\nimport { conversationRootKey, createConversationDescriptor, createConversationRunner, type ConversationConfig, type ConversationView, type SimpleConversationInput } from \"@alma-harness/conversation\";\nimport type { Runtime } from \"./index\";\nimport { isAuditLog } from \"./policies\";\n\n// DECISION: default changes require a format bump, preserving admitted bindings.\nconst FORMAT = \"conversation-agent-v1\";\nconst digest = (parts: unknown[]) => createHash(\"sha256\").update(JSON.stringify(parts)).digest(\"hex\");\nexport interface ConversationAgentOptions {\n  id: string;\n  /** Immutable host configuration: includes prices, tools and trusted callbacks. */\n  revision: string;\n  runtime: Runtime;\n  model: { ref: ModelRef; client: SingleDispatchModelClient; prices: ModelPrice[] };\n  instructions: string;\n  /** Omitted means `runtime.stores.audit`; never disables auditing (spec: runtime-deployment). */\n  audit?: ConversationConfig[\"step\"][\"audit\"];\n  intent: SimpleConversationInput[\"intent\"];\n  tools?: ConversationConfig[\"tools\"];\n  hooks?: ConversationConfig[\"hooks\"];\n  volatile?: ConversationConfig[\"volatile\"];\n  limits: {\n    caps: ConversationConfig[\"caps\"];\n    retentionMs: number;\n    runTimeoutMs?: number;\n    maxCalls?: number;\n    maxInputChars?: number;\n    maxRequestChars?: number;\n    maxOutputChars?: number;\n  };\n  onBackgroundError: ConversationConfig[\"step\"][\"onBackgroundError\"];\n}\nexport interface ConversationQuery { prompt: string; messageId: string; resume?: string; signal?: AbortSignal }\nexport interface ConversationQueryKey { sessionId: string; messageId: string }\nexport interface ConversationQueryResult extends ConversationQueryKey { rootKey: string; view: ConversationView }\nexport interface ConversationQueryObservation extends ConversationQueryKey { rootKey: string; view: ConversationView | null }\nexport interface UserConversationAgent {\n  query(input: ConversationQuery): Promise<ConversationQueryResult>;\n  read(key: ConversationQueryKey): Promise<ConversationQueryObservation>;\n}\nexport interface ConversationAgent { forUser(scope: Scope): UserConversationAgent }\nexport class ConversationResumeError extends Error {\n  readonly code = \"conversation_resume_not_found\";\n  constructor() { super(\"Conversation session not found in the bound scope\"); this.name = \"ConversationResumeError\"; }\n}\n\n/** Inspect data descriptors before reading values; a request cannot invoke getters. */\nfunction fields(value: unknown, allowed: readonly string[]): Record<string, unknown> {\n  if (!value || typeof value !== \"object\" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw new TypeError(\"Invalid conversation agent input\");\n  return Object.fromEntries(Reflect.ownKeys(value).map(key => {\n    const d = Object.getOwnPropertyDescriptor(value, key)!;\n    if (typeof key !== \"string\" || !allowed.includes(key) || !d.enumerable || !(\"value\" in d)) throw new TypeError(\"Invalid conversation agent field\");\n    return [key, d.value];\n  }));\n}\nconst scopeCopy = (value: Scope): Scope => settlementScope(fields(value, [\"org\", \"uid\"]) as unknown as Scope);\n\n/** Deterministic even when the first response was lost. Never derives identity from text or revision. */\nexport function conversationAgentSessionId(agentId: string, scope: Scope, messageId: string): string {\n  const s = scopeCopy(scope);\n  return `agent-session-v1:${digest([\"agent-session-v1\", settlementIdentifier(agentId), s.org, s.uid, settlementIdentifier(messageId)])}`;\n}\n\n/** A text facade over the canonical engine. Owns no stores, pools, retries or session registry. */\nexport function createConversationAgent(value: ConversationAgentOptions): ConversationAgent {\n  const options = fields(value, [\"id\", \"revision\", \"runtime\", \"model\", \"instructions\", \"audit\", \"intent\", \"tools\", \"hooks\", \"volatile\", \"limits\", \"onBackgroundError\"]) as unknown as ConversationAgentOptions;\n  const id = settlementIdentifier(options.id), revision = settlementIdentifier(options.revision);\n  const model = fields(options.model, [\"ref\", \"client\", \"prices\"]) as unknown as ConversationAgentOptions[\"model\"];\n  const ref = structuredClone(model.ref), intent = structuredClone(options.intent);\n  const limits = fields(options.limits, [\"caps\", \"retentionMs\", \"runTimeoutMs\", \"maxCalls\", \"maxInputChars\", \"maxRequestChars\", \"maxOutputChars\"]) as unknown as ConversationAgentOptions[\"limits\"];\n  if (![\"anthropic\", \"openai\", \"openrouter\"].includes(ref.provider)) throw new TypeError(\"Invalid conversation model provider\");\n  settlementIdentifier(ref.id);\n  for (const key of [\"runTimeoutMs\", \"maxCalls\", \"maxInputChars\", \"maxRequestChars\", \"maxOutputChars\"] as const) {\n    const n = limits[key];\n    if (n !== undefined && (!Number.isSafeInteger(n) || n < 1)) throw new TypeError(\"Invalid conversation agent limit\");\n  }\n  if (limits.caps === undefined || limits.caps === null) throw new TypeError(\"Explicit conversation budget required\");\n  if (typeof options.instructions !== \"string\" || typeof options.onBackgroundError !== \"function\") throw new TypeError(\"Conversation instructions and error observer are required\");\n  const audit = options.audit ?? options.runtime.stores.audit;\n  if (!isAuditLog(audit)) throw new TypeError(\"Conversation agent requires an audit log\");\n  const version = `${FORMAT}:${digest([FORMAT, id, revision])}`;\n  const runTimeoutMs = limits.runTimeoutMs ?? 120000;\n  const config: ConversationConfig = {\n    ...options.runtime.stores,\n    system: [{ text: options.instructions, volatility: \"stable\" }],\n    policy: { resolve: () => ({ model: { ...ref }, rationale: \"configured conversation agent model\" }) },\n    prices: structuredClone(model.prices), caps: structuredClone(limits.caps), consumers: [],\n    policyVersion: version, priceVersion: version, configRevision: version, resultContractVersion: FORMAT,\n    resultRetentionMs: limits.retentionMs, runTimeoutMs, maxCalls: limits.maxCalls ?? 24, maxInputChars: limits.maxInputChars ?? 64000,\n    ...(options.tools !== undefined ? { tools: options.tools } : {}),\n    ...(options.hooks !== undefined ? { hooks: options.hooks } : {}),\n    ...(options.volatile !== undefined ? { volatile: options.volatile } : {}),\n    step: { ...options.runtime.stores.step, clients: { [ref.provider]: model.client }, audit, runTimeoutMs,\n      maxRequestChars: limits.maxRequestChars ?? 1000000, maxOutputChars: limits.maxOutputChars ?? 100000,\n      onBackgroundError: options.onBackgroundError },\n  };\n  // Reuse canonical validation, including intent, before any request can perform I/O.\n  createConversationDescriptor(config, { scope: { org: \"validation\", uid: \"validation\" }, sessionId: \"validation\", idempotencyKey: \"validation\",\n    input: { role: \"user\", blocks: [] }, intent }, new Date(Date.now() + runTimeoutMs).toISOString());\n  const runner = createConversationRunner(config), admissions = options.runtime.stores.admissions;\n  return { forUser(value) {\n    const scope = scopeCopy(value);\n    return {\n      async query(value) {\n        const q = fields(value, [\"prompt\", \"messageId\", \"resume\", \"signal\"]);\n        const messageId = settlementIdentifier(q.messageId);\n        const sessionId = q.resume === undefined ? conversationAgentSessionId(id, scope, messageId) : settlementIdentifier(q.resume);\n        if (typeof q.prompt !== \"string\" || q.prompt.length > config.maxInputChars) throw new TypeError(\"Invalid conversation prompt\");\n        const input: SimpleConversationInput = { scope: { ...scope }, sessionId, idempotencyKey: messageId,\n          input: { role: \"user\", blocks: [{ type: \"text\", text: q.prompt }] }, intent: structuredClone(intent),\n          ...(q.signal !== undefined ? { signal: q.signal as AbortSignal } : {}) };\n        // Validate the canonical envelope before the resume lookup, not after I/O.\n        const root = createConversationDescriptor(config, input, new Date(Date.now() + runTimeoutMs).toISOString());\n        if (q.resume !== undefined && !(await admissions.list({ ...scope }, sessionId, { limit: 1 })).length) throw new ConversationResumeError();\n        return { sessionId, messageId, rootKey: root.key, view: await runner.runTurn(input) };\n      },\n      async read(value) {\n        const key = fields(value, [\"sessionId\", \"messageId\"]);\n        const sessionId = settlementIdentifier(key.sessionId), messageId = settlementIdentifier(key.messageId);\n        const rootKey = conversationRootKey(scope, sessionId, messageId);\n        return { sessionId, messageId, rootKey, view: await runner.read({ ...scope }, rootKey) };\n      },\n    };\n  } };\n}\n"],"mappings":";;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB,uBAAmG;AAClI,SAAS,qBAAqB,8BAA8B,gCAA8G;AAK1K,IAAM,SAAS;AACf,IAAM,SAAS,CAAC,UAAqB,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,OAAO,KAAK;AAkC7F,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACxC,OAAO;AAAA,EAChB,cAAc;AAAE,UAAM,mDAAmD;AAAG,SAAK,OAAO;AAAA,EAA2B;AACrH;AAGA,SAAS,OAAO,OAAgB,SAAqD;AACnF,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,CAAC,CAAC,OAAO,WAAW,IAAI,EAAE,SAAS,OAAO,eAAe,KAAK,CAAC,EAAG,OAAM,IAAI,UAAU,kCAAkC;AACnK,SAAO,OAAO,YAAY,QAAQ,QAAQ,KAAK,EAAE,IAAI,SAAO;AAC1D,UAAM,IAAI,OAAO,yBAAyB,OAAO,GAAG;AACpD,QAAI,OAAO,QAAQ,YAAY,CAAC,QAAQ,SAAS,GAAG,KAAK,CAAC,EAAE,cAAc,EAAE,WAAW,GAAI,OAAM,IAAI,UAAU,kCAAkC;AACjJ,WAAO,CAAC,KAAK,EAAE,KAAK;AAAA,EACtB,CAAC,CAAC;AACJ;AACA,IAAM,YAAY,CAAC,UAAwB,gBAAgB,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAqB;AAGrG,SAAS,2BAA2B,SAAiB,OAAc,WAA2B;AACnG,QAAM,IAAI,UAAU,KAAK;AACzB,SAAO,oBAAoB,OAAO,CAAC,oBAAoB,qBAAqB,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,qBAAqB,SAAS,CAAC,CAAC,CAAC;AACvI;AAGO,SAAS,wBAAwB,OAAoD;AAC1F,QAAM,UAAU,OAAO,OAAO,CAAC,MAAM,YAAY,WAAW,SAAS,gBAAgB,SAAS,UAAU,SAAS,SAAS,YAAY,UAAU,mBAAmB,CAAC;AACpK,QAAM,KAAK,qBAAqB,QAAQ,EAAE,GAAG,WAAW,qBAAqB,QAAQ,QAAQ;AAC7F,QAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC,OAAO,UAAU,QAAQ,CAAC;AAC/D,QAAM,MAAM,gBAAgB,MAAM,GAAG,GAAG,SAAS,gBAAgB,QAAQ,MAAM;AAC/E,QAAM,SAAS,OAAO,QAAQ,QAAQ,CAAC,QAAQ,eAAe,gBAAgB,YAAY,iBAAiB,mBAAmB,gBAAgB,CAAC;AAC/I,MAAI,CAAC,CAAC,aAAa,UAAU,YAAY,EAAE,SAAS,IAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,qCAAqC;AAC5H,uBAAqB,IAAI,EAAE;AAC3B,aAAW,OAAO,CAAC,gBAAgB,YAAY,iBAAiB,mBAAmB,gBAAgB,GAAY;AAC7G,UAAM,IAAI,OAAO,GAAG;AACpB,QAAI,MAAM,WAAc,CAAC,OAAO,cAAc,CAAC,KAAK,IAAI,GAAI,OAAM,IAAI,UAAU,kCAAkC;AAAA,EACpH;AACA,MAAI,OAAO,SAAS,UAAa,OAAO,SAAS,KAAM,OAAM,IAAI,UAAU,uCAAuC;AAClH,MAAI,OAAO,QAAQ,iBAAiB,YAAY,OAAO,QAAQ,sBAAsB,WAAY,OAAM,IAAI,UAAU,2DAA2D;AAChL,QAAM,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,OAAO;AACtD,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,UAAU,0CAA0C;AACtF,QAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;AAC3D,QAAM,eAAe,OAAO,gBAAgB;AAC5C,QAAM,SAA6B;AAAA,IACjC,GAAG,QAAQ,QAAQ;AAAA,IACnB,QAAQ,CAAC,EAAE,MAAM,QAAQ,cAAc,YAAY,SAAS,CAAC;AAAA,IAC7D,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,GAAG,WAAW,sCAAsC,GAAG;AAAA,IACnG,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IAAG,MAAM,gBAAgB,OAAO,IAAI;AAAA,IAAG,WAAW,CAAC;AAAA,IACvF,eAAe;AAAA,IAAS,cAAc;AAAA,IAAS,gBAAgB;AAAA,IAAS,uBAAuB;AAAA,IAC/F,mBAAmB,OAAO;AAAA,IAAa;AAAA,IAAc,UAAU,OAAO,YAAY;AAAA,IAAI,eAAe,OAAO,iBAAiB;AAAA,IAC7H,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAC9D,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAC9D,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvE,MAAM;AAAA,MAAE,GAAG,QAAQ,QAAQ,OAAO;AAAA,MAAM,SAAS,EAAE,CAAC,IAAI,QAAQ,GAAG,MAAM,OAAO;AAAA,MAAG;AAAA,MAAO;AAAA,MACxF,iBAAiB,OAAO,mBAAmB;AAAA,MAAS,gBAAgB,OAAO,kBAAkB;AAAA,MAC7F,mBAAmB,QAAQ;AAAA,IAAkB;AAAA,EACjD;AAEA,+BAA6B,QAAQ;AAAA,IAAE,OAAO,EAAE,KAAK,cAAc,KAAK,aAAa;AAAA,IAAG,WAAW;AAAA,IAAc,gBAAgB;AAAA,IAC/H,OAAO,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE;AAAA,IAAG;AAAA,EAAO,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,EAAE,YAAY,CAAC;AAClG,QAAM,SAAS,yBAAyB,MAAM,GAAG,aAAa,QAAQ,QAAQ,OAAO;AACrF,SAAO,EAAE,QAAQA,QAAO;AACtB,UAAM,QAAQ,UAAUA,MAAK;AAC7B,WAAO;AAAA,MACL,MAAM,MAAMA,QAAO;AACjB,cAAM,IAAI,OAAOA,QAAO,CAAC,UAAU,aAAa,UAAU,QAAQ,CAAC;AACnE,cAAM,YAAY,qBAAqB,EAAE,SAAS;AAClD,cAAM,YAAY,EAAE,WAAW,SAAY,2BAA2B,IAAI,OAAO,SAAS,IAAI,qBAAqB,EAAE,MAAM;AAC3H,YAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,SAAS,OAAO,cAAe,OAAM,IAAI,UAAU,6BAA6B;AAC7H,cAAM,QAAiC;AAAA,UAAE,OAAO,EAAE,GAAG,MAAM;AAAA,UAAG;AAAA,UAAW,gBAAgB;AAAA,UACvF,OAAO,EAAE,MAAM,QAAQ,QAAQ,CAAC,EAAE,MAAM,QAAQ,MAAM,EAAE,OAAO,CAAC,EAAE;AAAA,UAAG,QAAQ,gBAAgB,MAAM;AAAA,UACnG,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAsB,IAAI,CAAC;AAAA,QAAG;AAEzE,cAAM,OAAO,6BAA6B,QAAQ,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,EAAE,YAAY,CAAC;AAC1G,YAAI,EAAE,WAAW,UAAa,EAAE,MAAM,WAAW,KAAK,EAAE,GAAG,MAAM,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC,GAAG,OAAQ,OAAM,IAAI,wBAAwB;AACxI,eAAO,EAAE,WAAW,WAAW,SAAS,KAAK,KAAK,MAAM,MAAM,OAAO,QAAQ,KAAK,EAAE;AAAA,MACtF;AAAA,MACA,MAAM,KAAKA,QAAO;AAChB,cAAM,MAAM,OAAOA,QAAO,CAAC,aAAa,WAAW,CAAC;AACpD,cAAM,YAAY,qBAAqB,IAAI,SAAS,GAAG,YAAY,qBAAqB,IAAI,SAAS;AACrG,cAAM,UAAU,oBAAoB,OAAO,WAAW,SAAS;AAC/D,eAAO,EAAE,WAAW,WAAW,SAAS,MAAM,MAAM,OAAO,KAAK,EAAE,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,MACzF;AAAA,IACF;AAAA,EACF,EAAE;AACJ;","names":["value"]}

package/dist/chunk-6MFSZ4VS.js

@@ -0,0 +1,274 @@
+// src/maintenance-core.ts
+import { createGovernedStepRunner, createSingleCallRunner } from "@alma-harness/single-call";
+var BUDGET = 50;
+var LEASE_MS = 1e4;
+var usageBefore = (a, b) => {
+  const x = Date.parse(a.receivedAt), y = Date.parse(b.receivedAt);
+  return x < y || x === y && a.id <= b.id;
+};
+async function resumeLap(stored, start) {
+  if (stored?.bound && stored.budget !== null && stored.budget > 0) return { after: stored.after, bound: stored.bound, budget: stored.budget };
+  const s = await start();
+  return s ? { after: stored?.bound ? null : stored?.after ?? null, bound: s.bound, budget: s.budget } : null;
+}
+var refuse = () => {
+  throw new Error("Maintenance never dispatches");
+};
+function createMaintenance(options) {
+  const { stores, discovery } = options, step = stores.step;
+  const text = createSingleCallRunner({
+    ...step,
+    audit: stores.audit,
+    clients: {},
+    policy: { resolve: refuse },
+    policyVersion: "alma-maintenance",
+    priceVersion: "alma-maintenance",
+    outputContractVersion: "alma-maintenance",
+    prices: [],
+    caps: {},
+    consumers: [],
+    system: [],
+    maxTokens: 1,
+    maxInputChars: 1,
+    maxOutputChars: 1e6,
+    deadlineMs: 1e3,
+    resultRetentionMs: 1e3,
+    onBackgroundError() {
+    }
+  });
+  const governed = createGovernedStepRunner({
+    ...step,
+    audit: stores.audit,
+    clients: {},
+    runTimeoutMs: 1e3,
+    maxRequestChars: 1,
+    maxOutputChars: 1e6,
+    onBackgroundError() {
+    }
+  });
+  async function work(scope, claim, signal, r) {
+    const live = () => !signal?.aborted && claim.alive();
+    let budget = BUDGET;
+    for (const store of [stores.admissions, step.trees, step.executions]) {
+      if (!live() || budget < 1) break;
+      try {
+        const n = (await store.reconcileExpired(scope, { limit: budget })).length;
+        budget -= n;
+        if (store === stores.admissions) r.expired.admissions += n;
+        else if (store === step.trees) r.expired.roots += n;
+        else r.expired.executions += n;
+      } catch {
+        r.failed++;
+      }
+    }
+    const cursors = await discovery.cursors(scope);
+    let executions = null;
+    try {
+      const l = await resumeLap(cursors.executions, () => discovery.executionLap(scope));
+      if (l) {
+        const want = Math.min(BUDGET, l.budget), items = await discovery.recoverable(scope, l.after, l.bound, want);
+        let attempted = 0;
+        for (const item of items) {
+          if (!live()) break;
+          try {
+            const view = item.rootKey ? await governed.recover({ scope, rootKey: item.rootKey, operationKey: item.operationKey }, { leaseMs: LEASE_MS }) : await text.recover(scope, item.operationKey, { leaseMs: LEASE_MS });
+            if (view?.status === "completed") r.recovered++;
+          } catch {
+            r.failed++;
+          }
+          l.after = { createdAt: item.createdAt, operationKey: item.operationKey };
+          l.budget--;
+          attempted++;
+        }
+        executions = attempted < items.length ? l : items.length < want || l.budget < 1 ? null : l;
+      }
+    } catch {
+      r.failed++;
+      executions = cursors.executions;
+    }
+    let usage = null;
+    try {
+      const l = await resumeLap(cursors.usage, () => discovery.usageLap(scope));
+      if (l && live()) {
+        const want = Math.min(BUDGET, l.budget);
+        const page = await step.inbox.listPending(scope, { limit: want, ...l.after ? { after: l.after } : {} });
+        const rows = page.filter((row) => usageBefore({ receivedAt: row.receivedAt, id: row.input.id }, l.bound));
+        let attempted = 0;
+        for (const row of rows) {
+          if (!live()) break;
+          const query = { limit: 1, ...l.after ? { after: l.after } : {} };
+          try {
+            const root = (await discovery.members(scope, [row.input.execution.operationKey])).get(row.input.execution.operationKey);
+            const result = root ? await governed.reconcileUsage({ scope, rootKey: root }, query) : await text.reconcileUsage(scope, query, { skip: async (key) => (await discovery.members(scope, [key])).has(key) });
+            r.acknowledged += result.acknowledged;
+          } catch {
+            r.failed++;
+          }
+          l.after = { receivedAt: row.receivedAt, id: row.input.id };
+          l.budget--;
+          attempted++;
+        }
+        usage = attempted < rows.length ? l : rows.length < want || l.budget < 1 ? null : l;
+      }
+    } catch {
+      r.failed++;
+      usage = cursors.usage;
+    }
+    await discovery.saveCursors(scope, { executions, usage });
+  }
+  let queue = Promise.resolve();
+  return {
+    maintain(value) {
+      const run = queue.then(() => sweep(value), () => sweep(value));
+      queue = run.catch(() => void 0);
+      return run;
+    }
+  };
+  async function sweep(value) {
+    if (!value || !Number.isSafeInteger(value.limit) || value.limit < 1 || value.limit > 1e3) throw new TypeError("Invalid maintenance limit");
+    const signal = value.signal;
+    await discovery.verify();
+    const r = { scopes: 0, skipped: 0, expired: { admissions: 0, roots: 0, executions: 0 }, recovered: 0, acknowledged: 0, failed: 0 };
+    for (const scope of await discovery.nextScopes(value.limit)) {
+      if (signal?.aborted) break;
+      const claim = await discovery.claim(scope);
+      if (!claim) {
+        r.skipped++;
+        continue;
+      }
+      r.scopes++;
+      try {
+        await work(scope, claim, signal, r);
+      } catch {
+        r.failed++;
+      } finally {
+        await claim.release();
+      }
+    }
+    return r;
+  }
+}
+
+// src/scope-rotation.ts
+import pg from "pg";
+var ROLES = ["alma_app", "alma_maintenance", "alma_projection", "alma_retention"];
+function scopeRotation(pool, options) {
+  const { role, lockPrefix, workerURL } = options;
+  const lockKey = `hashtextextended(jsonb_build_array('${lockPrefix}',$1::text,$2::text)::text,0)`;
+  async function tx(fn) {
+    const c = await pool.connect();
+    try {
+      await c.query(`begin; set local role ${role}`);
+      const r = await fn(c);
+      await c.query("commit");
+      return r;
+    } catch (e) {
+      await c.query("rollback").catch(() => void 0);
+      throw e;
+    } finally {
+      c.release();
+    }
+  }
+  const memberships = async (c) => (await c.query(`select session_user as who,
+    ${ROLES.map((r) => `pg_has_role(session_user,'${r}','MEMBER') as ${r}`).join(", ")}`)).rows[0];
+  async function hold(c, scope, onLost) {
+    let alive = true;
+    const listeners = /* @__PURE__ */ new Set([onLost]);
+    const lost = () => {
+      if (!alive) return;
+      alive = false;
+      for (const l of listeners) {
+        try {
+          l();
+        } catch {
+        }
+      }
+    };
+    c.on("error", lost);
+    c.on("end", lost);
+    return {
+      alive: () => alive,
+      onLost(fn) {
+        listeners.add(fn);
+        if (!alive) fn();
+      },
+      async release() {
+        let unlocked = false;
+        try {
+          unlocked = (await c.query(`select pg_advisory_unlock(${lockKey}) ok`, [scope.org, scope.uid])).rows[0].ok === true;
+        } catch {
+        }
+        c.off("error", lost);
+        c.off("end", lost);
+        c.release(!unlocked);
+      }
+    };
+  }
+  return {
+    tx,
+    /** Membership, not inheritance: an indirect or non-inherited grant is still authority a SET ROLE can take. */
+    async verify() {
+      const c = await pool.connect();
+      let d;
+      try {
+        d = await memberships(c);
+      } finally {
+        c.release();
+      }
+      const w = new pg.Client({ connectionString: workerURL });
+      await w.connect();
+      let k;
+      try {
+        k = await memberships(w);
+      } finally {
+        await w.end();
+      }
+      const others = (m, own) => ROLES.some((r) => r !== own && m[r]);
+      if (!d[role] || others(d, role) || !k.alma_app || others(k, "alma_app") || d.who === k.who)
+        throw new TypeError(`Requires a discovery login in ${role} only and a separate worker login in alma_app only`);
+    },
+    async claim(scope) {
+      const c = await pool.connect();
+      try {
+        if (!(await c.query(`select pg_try_advisory_lock(${lockKey}) got`, [scope.org, scope.uid])).rows[0].got) {
+          c.release();
+          return null;
+        }
+      } catch (e) {
+        c.release(true);
+        throw e;
+      }
+      return hold(c, scope, () => void 0);
+    },
+    /** Waits for the scope's claim (a working drain holds it) under lock_timeout, then runs `fn` while holding it. */
+    async quiesce(scope, fn, timeoutMs) {
+      const c = await pool.connect();
+      try {
+        await c.query("select set_config('lock_timeout', $1, false)", [String(timeoutMs)]);
+        await c.query(`select pg_advisory_lock(${lockKey})`, [scope.org, scope.uid]);
+        await c.query("select set_config('lock_timeout', '0', false)");
+      } catch (e) {
+        c.release(true);
+        throw e;
+      }
+      let lost = false;
+      const claim = await hold(c, scope, () => {
+        lost = true;
+      });
+      try {
+        const result = await fn();
+        if (lost) throw new Error("Quiesce claim lost while the callback ran: retry under a new quiesce");
+        return result;
+      } finally {
+        await claim.release();
+      }
+    }
+  };
+}
+
+export {
+  resumeLap,
+  createMaintenance,
+  scopeRotation
+};
+//# sourceMappingURL=chunk-6MFSZ4VS.js.map

package/dist/chunk-6MFSZ4VS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/maintenance-core.ts","../src/scope-rotation.ts"],"sourcesContent":["import type { Scope, UsageInboxQuery } from \"@alma-harness/core\";\nimport { createGovernedStepRunner, createSingleCallRunner } from \"@alma-harness/single-call\";\nimport type { RuntimeStores } from \"./index\";\n\nexport type ExecutionCursor = { createdAt: string; operationKey: string };\nexport type UsageCursor = NonNullable<UsageInboxQuery[\"after\"]>;\nexport interface RecoverableExecution { operationKey: string; createdAt: string; rootKey: string | null }\nexport interface ScopeClaim { alive(): boolean; release(): Promise<void>; onLost?(fn: () => void): void }\n/** A finite lap: items after `after` up to `bound`, at most `budget` more attempts (spec: receipt-projections). A null bound is a cursor written before laps existed. */\nexport interface Lap<C> { after: C | null; bound: C | null; budget: number | null }\nexport interface MaintenanceCursors { executions: Lap<ExecutionCursor> | null; usage: Lap<UsageCursor> | null }\n/** Cross-scope metadata only: identifiers, states, times and the maintenance cursors (spec: runtime-maintenance). */\nexport interface MaintenanceDiscovery {\n  /** Throws unless the logins keep discovery and scoped work apart. */\n  verify(): Promise<void>;\n  nextScopes(limit: number): Promise<Scope[]>;\n  claim(scope: Scope): Promise<ScopeClaim | null>;\n  recoverable(scope: Scope, after: ExecutionCursor | null, bound: ExecutionCursor, limit: number): Promise<RecoverableExecution[]>;\n  /** The greatest eligible execution and how many are eligible up to it; null when none is. */\n  executionLap(scope: Scope): Promise<{ bound: ExecutionCursor; budget: number } | null>;\n  usageLap(scope: Scope): Promise<{ bound: UsageCursor; budget: number } | null>;\n  /** Root keys of the given operation keys that are members of a root. */\n  members(scope: Scope, operationKeys: string[]): Promise<Map<string, string>>;\n  cursors(scope: Scope): Promise<MaintenanceCursors>;\n  saveCursors(scope: Scope, cursors: MaintenanceCursors): Promise<void>;\n}\nexport interface MaintenanceReport {\n  scopes: number; skipped: number; expired: { admissions: number; roots: number; executions: number };\n  recovered: number; acknowledged: number; failed: number;\n}\nconst BUDGET = 50, LEASE_MS = 10_000;\nconst usageBefore = (a: UsageCursor, b: UsageCursor) => { const x = Date.parse(a.receivedAt), y = Date.parse(b.receivedAt); return x < y || (x === y && a.id <= b.id); };\n/** Resumes a lap, or starts one with a bound and budget captured now; an old cursor keeps its position. */\nexport async function resumeLap<C>(stored: Lap<C> | null, start: () => Promise<{ bound: C; budget: number } | null>): Promise<{ after: C | null; bound: C; budget: number } | null> {\n  if (stored?.bound && stored.budget !== null && stored.budget > 0) return { after: stored.after, bound: stored.bound, budget: stored.budget };\n  const s = await start();\n  return s ? { after: stored?.bound ? null : stored?.after ?? null, bound: s.bound, budget: s.budget } : null;\n}\nconst refuse = (): never => { throw new Error(\"Maintenance never dispatches\"); };\n\n/** Store work per scope; no client, no release, no content in the report. */\nexport function createMaintenance(options: { stores: RuntimeStores; discovery: MaintenanceDiscovery }) {\n  const { stores, discovery } = options, step = stores.step;\n  // Recovery reads the journal, retained result and receipts only: an empty client registry makes dispatch impossible.\n  const text = createSingleCallRunner({ ...step, audit: stores.audit, clients: {}, policy: { resolve: refuse }, policyVersion: \"alma-maintenance\",\n    priceVersion: \"alma-maintenance\", outputContractVersion: \"alma-maintenance\", prices: [], caps: {}, consumers: [], system: [],\n    maxTokens: 1, maxInputChars: 1, maxOutputChars: 1_000_000, deadlineMs: 1000, resultRetentionMs: 1000, onBackgroundError() {} });\n  const governed = createGovernedStepRunner({ ...step, audit: stores.audit, clients: {}, runTimeoutMs: 1000, maxRequestChars: 1,\n    maxOutputChars: 1_000_000, onBackgroundError() {} });\n\n  async function work(scope: Scope, claim: ScopeClaim, signal: AbortSignal | undefined, r: MaintenanceReport) {\n    const live = () => !signal?.aborted && claim.alive();\n    let budget = BUDGET;\n    // Each category fails on its own: a broken store in one never starves the others.\n    for (const store of [stores.admissions, step.trees, step.executions] as const) {\n      if (!live() || budget < 1) break;\n      try {\n        const n = (await store.reconcileExpired(scope, { limit: budget })).length; budget -= n;\n        if (store === stores.admissions) r.expired.admissions += n; else if (store === step.trees) r.expired.roots += n; else r.expired.executions += n;\n      } catch { r.failed++; }\n    }\n    const cursors = await discovery.cursors(scope);\n    let executions: Lap<ExecutionCursor> | null = null;\n    try {\n      const l = await resumeLap(cursors.executions, () => discovery.executionLap(scope));\n      if (l) {\n        const want = Math.min(BUDGET, l.budget), items = await discovery.recoverable(scope, l.after, l.bound, want);\n        let attempted = 0;\n        for (const item of items) {\n          if (!live()) break;\n          try {\n            const view = item.rootKey ? await governed.recover({ scope, rootKey: item.rootKey, operationKey: item.operationKey }, { leaseMs: LEASE_MS })\n              : await text.recover(scope, item.operationKey, { leaseMs: LEASE_MS });\n            if (view?.status === \"completed\") r.recovered++;\n          } catch { r.failed++; }\n          l.after = { createdAt: item.createdAt, operationKey: item.operationKey }; l.budget--; attempted++;\n        }\n        // An interrupted page resumes; otherwise the lap ends when its range ran out or its budget is spent.\n        executions = attempted < items.length ? l : items.length < want || l.budget < 1 ? null : l;\n      }\n    } catch { r.failed++; executions = cursors.executions; }\n    let usage: Lap<UsageCursor> | null = null;\n    try {\n      const l = await resumeLap(cursors.usage, () => discovery.usageLap(scope));\n      if (l && live()) {\n        const want = Math.min(BUDGET, l.budget);\n        const page = await step.inbox.listPending(scope, { limit: want, ...(l.after ? { after: l.after } : {}) });\n        const rows = page.filter(row => usageBefore({ receivedAt: row.receivedAt, id: row.input.id }, l.bound));\n        // One official call per row, aimed at it by its predecessor in this page. If another acknowledger\n        // removed it, the call scans the next existing row instead, and that path's own check (membership,\n        // via `skip` on the text path) still decides. No target is passed over by a sliding window.\n        let attempted = 0;\n        for (const row of rows) {\n          if (!live()) break;\n          const query = { limit: 1, ...(l.after ? { after: l.after } : {}) };\n          try {\n            const root = (await discovery.members(scope, [row.input.execution.operationKey])).get(row.input.execution.operationKey);\n            const result = root ? await governed.reconcileUsage({ scope, rootKey: root }, query)\n              : await text.reconcileUsage(scope, query, { skip: async key => (await discovery.members(scope, [key])).has(key) });\n            r.acknowledged += result.acknowledged;\n          } catch { r.failed++; }\n          l.after = { receivedAt: row.receivedAt, id: row.input.id }; l.budget--; attempted++;\n        }\n        usage = attempted < rows.length ? l : rows.length < want || l.budget < 1 ? null : l;\n      }\n    } catch { r.failed++; usage = cursors.usage; }\n    await discovery.saveCursors(scope, { executions, usage });\n  }\n\n  // One sweep at a time per instance: each holds a claim connection plus one query connection.\n  let queue: Promise<unknown> = Promise.resolve();\n  return {\n    maintain(value: { limit: number; signal?: AbortSignal }): Promise<MaintenanceReport> {\n      const run = queue.then(() => sweep(value), () => sweep(value)); queue = run.catch(() => undefined); return run;\n    },\n  };\n  async function sweep(value: { limit: number; signal?: AbortSignal }): Promise<MaintenanceReport> {\n      if (!value || !Number.isSafeInteger(value.limit) || value.limit < 1 || value.limit > 1000) throw new TypeError(\"Invalid maintenance limit\");\n      const signal = value.signal;\n      await discovery.verify();\n      const r: MaintenanceReport = { scopes: 0, skipped: 0, expired: { admissions: 0, roots: 0, executions: 0 }, recovered: 0, acknowledged: 0, failed: 0 };\n      for (const scope of await discovery.nextScopes(value.limit)) {\n        if (signal?.aborted) break;\n        const claim = await discovery.claim(scope);\n        if (!claim) { r.skipped++; continue; }\n        r.scopes++;\n        try { await work(scope, claim, signal, r); } catch { r.failed++; } finally { await claim.release(); }\n      }\n      return r;\n  }\n}\n","import pg from \"pg\";\nimport type { Scope } from \"@alma-harness/core\";\nimport type { ScopeClaim } from \"./maintenance-core\";\n\nconst ROLES = [\"alma_app\", \"alma_maintenance\", \"alma_projection\", \"alma_retention\"] as const;\ntype Role = typeof ROLES[number];\n/** Cross-scope discovery on its own login, shared by maintenance and projections (specs: runtime-maintenance, receipt-projections). */\nexport function scopeRotation(pool: pg.Pool, options: { role: Role; lockPrefix: string; workerURL: string }) {\n  const { role, lockPrefix, workerURL } = options;\n  const lockKey = `hashtextextended(jsonb_build_array('${lockPrefix}',$1::text,$2::text)::text,0)`;\n  async function tx<T>(fn: (c: pg.PoolClient) => Promise<T>): Promise<T> {\n    const c = await pool.connect();\n    try { await c.query(`begin; set local role ${role}`); const r = await fn(c); await c.query(\"commit\"); return r; }\n    catch (e) { await c.query(\"rollback\").catch(() => undefined); throw e; }\n    finally { c.release(); }\n  }\n  const memberships = async (c: pg.ClientBase): Promise<{ who: string } & Record<Role, boolean>> => (await c.query(`select session_user as who,\n    ${ROLES.map(r => `pg_has_role(session_user,'${r}','MEMBER') as ${r}`).join(\", \")}`)).rows[0];\n  /** One dedicated connection per claim, released only after a confirmed unlock; otherwise destroyed. */\n  async function hold(c: pg.PoolClient, scope: Scope, onLost: () => void): Promise<ScopeClaim> {\n    let alive = true; const listeners = new Set<() => void>([onLost]);\n    const lost = () => { if (!alive) return; alive = false; for (const l of listeners) { try { l(); } catch { /* A listener cannot stop the release. */ } } };\n    c.on(\"error\", lost); c.on(\"end\", lost);\n    return {\n      alive: () => alive,\n      onLost(fn: () => void) { listeners.add(fn); if (!alive) fn(); },\n      async release() {\n        let unlocked = false;\n        try { unlocked = (await c.query<{ ok: boolean }>(`select pg_advisory_unlock(${lockKey}) ok`, [scope.org, scope.uid])).rows[0]!.ok === true; } catch { /* Destroyed below. */ }\n        c.off(\"error\", lost); c.off(\"end\", lost);\n        // An unconfirmed unlock must never ride a pooled connection into its next checkout.\n        c.release(!unlocked);\n      },\n    };\n  }\n  return {\n    tx,\n    /** Membership, not inheritance: an indirect or non-inherited grant is still authority a SET ROLE can take. */\n    async verify() {\n      const c = await pool.connect();\n      let d; try { d = await memberships(c); } finally { c.release(); }\n      const w = new pg.Client({ connectionString: workerURL }); await w.connect();\n      let k; try { k = await memberships(w); } finally { await w.end(); }\n      const others = (m: Record<Role, boolean>, own: Role) => ROLES.some(r => r !== own && m[r]);\n      if (!d[role] || others(d, role) || !k.alma_app || others(k, \"alma_app\") || d.who === k.who)\n        throw new TypeError(`Requires a discovery login in ${role} only and a separate worker login in alma_app only`);\n    },\n    async claim(scope: Scope): Promise<ScopeClaim | null> {\n      const c = await pool.connect();\n      try {\n        if (!(await c.query<{ got: boolean }>(`select pg_try_advisory_lock(${lockKey}) got`, [scope.org, scope.uid])).rows[0]!.got) { c.release(); return null; }\n      } catch (e) { c.release(true); throw e; }\n      return hold(c, scope, () => undefined);\n    },\n    /** Waits for the scope's claim (a working drain holds it) under lock_timeout, then runs `fn` while holding it. */\n    async quiesce<T>(scope: Scope, fn: () => Promise<T>, timeoutMs: number): Promise<T> {\n      const c = await pool.connect();\n      try {\n        await c.query(\"select set_config('lock_timeout', $1, false)\", [String(timeoutMs)]);\n        await c.query(`select pg_advisory_lock(${lockKey})`, [scope.org, scope.uid]);\n        await c.query(\"select set_config('lock_timeout', '0', false)\");\n      } catch (e) { c.release(true); throw e; }\n      let lost = false;\n      const claim = await hold(c, scope, () => { lost = true; });\n      try {\n        const result = await fn();\n        if (lost) throw new Error(\"Quiesce claim lost while the callback ran: retry under a new quiesce\");\n        return result;\n      } finally { await claim.release(); }\n    },\n  };\n}\n"],"mappings":";AACA,SAAS,0BAA0B,8BAA8B;AA6BjE,IAAM,SAAS;AAAf,IAAmB,WAAW;AAC9B,IAAM,cAAc,CAAC,GAAgB,MAAmB;AAAE,QAAM,IAAI,KAAK,MAAM,EAAE,UAAU,GAAG,IAAI,KAAK,MAAM,EAAE,UAAU;AAAG,SAAO,IAAI,KAAM,MAAM,KAAK,EAAE,MAAM,EAAE;AAAK;AAEvK,eAAsB,UAAa,QAAuB,OAA0H;AAClL,MAAI,QAAQ,SAAS,OAAO,WAAW,QAAQ,OAAO,SAAS,EAAG,QAAO,EAAE,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AAC3I,QAAM,IAAI,MAAM,MAAM;AACtB,SAAO,IAAI,EAAE,OAAO,QAAQ,QAAQ,OAAO,QAAQ,SAAS,MAAM,OAAO,EAAE,OAAO,QAAQ,EAAE,OAAO,IAAI;AACzG;AACA,IAAM,SAAS,MAAa;AAAE,QAAM,IAAI,MAAM,8BAA8B;AAAG;AAGxE,SAAS,kBAAkB,SAAqE;AACrG,QAAM,EAAE,QAAQ,UAAU,IAAI,SAAS,OAAO,OAAO;AAErD,QAAM,OAAO,uBAAuB;AAAA,IAAE,GAAG;AAAA,IAAM,OAAO,OAAO;AAAA,IAAO,SAAS,CAAC;AAAA,IAAG,QAAQ,EAAE,SAAS,OAAO;AAAA,IAAG,eAAe;AAAA,IAC3H,cAAc;AAAA,IAAoB,uBAAuB;AAAA,IAAoB,QAAQ,CAAC;AAAA,IAAG,MAAM,CAAC;AAAA,IAAG,WAAW,CAAC;AAAA,IAAG,QAAQ,CAAC;AAAA,IAC3H,WAAW;AAAA,IAAG,eAAe;AAAA,IAAG,gBAAgB;AAAA,IAAW,YAAY;AAAA,IAAM,mBAAmB;AAAA,IAAM,oBAAoB;AAAA,IAAC;AAAA,EAAE,CAAC;AAChI,QAAM,WAAW,yBAAyB;AAAA,IAAE,GAAG;AAAA,IAAM,OAAO,OAAO;AAAA,IAAO,SAAS,CAAC;AAAA,IAAG,cAAc;AAAA,IAAM,iBAAiB;AAAA,IAC1H,gBAAgB;AAAA,IAAW,oBAAoB;AAAA,IAAC;AAAA,EAAE,CAAC;AAErD,iBAAe,KAAK,OAAc,OAAmB,QAAiC,GAAsB;AAC1G,UAAM,OAAO,MAAM,CAAC,QAAQ,WAAW,MAAM,MAAM;AACnD,QAAI,SAAS;AAEb,eAAW,SAAS,CAAC,OAAO,YAAY,KAAK,OAAO,KAAK,UAAU,GAAY;AAC7E,UAAI,CAAC,KAAK,KAAK,SAAS,EAAG;AAC3B,UAAI;AACF,cAAM,KAAK,MAAM,MAAM,iBAAiB,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG;AAAQ,kBAAU;AACrF,YAAI,UAAU,OAAO,WAAY,GAAE,QAAQ,cAAc;AAAA,iBAAY,UAAU,KAAK,MAAO,GAAE,QAAQ,SAAS;AAAA,YAAQ,GAAE,QAAQ,cAAc;AAAA,MAChJ,QAAQ;AAAE,UAAE;AAAA,MAAU;AAAA,IACxB;AACA,UAAM,UAAU,MAAM,UAAU,QAAQ,KAAK;AAC7C,QAAI,aAA0C;AAC9C,QAAI;AACF,YAAM,IAAI,MAAM,UAAU,QAAQ,YAAY,MAAM,UAAU,aAAa,KAAK,CAAC;AACjF,UAAI,GAAG;AACL,cAAM,OAAO,KAAK,IAAI,QAAQ,EAAE,MAAM,GAAG,QAAQ,MAAM,UAAU,YAAY,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI;AAC1G,YAAI,YAAY;AAChB,mBAAW,QAAQ,OAAO;AACxB,cAAI,CAAC,KAAK,EAAG;AACb,cAAI;AACF,kBAAM,OAAO,KAAK,UAAU,MAAM,SAAS,QAAQ,EAAE,OAAO,SAAS,KAAK,SAAS,cAAc,KAAK,aAAa,GAAG,EAAE,SAAS,SAAS,CAAC,IACvI,MAAM,KAAK,QAAQ,OAAO,KAAK,cAAc,EAAE,SAAS,SAAS,CAAC;AACtE,gBAAI,MAAM,WAAW,YAAa,GAAE;AAAA,UACtC,QAAQ;AAAE,cAAE;AAAA,UAAU;AACtB,YAAE,QAAQ,EAAE,WAAW,KAAK,WAAW,cAAc,KAAK,aAAa;AAAG,YAAE;AAAU;AAAA,QACxF;AAEA,qBAAa,YAAY,MAAM,SAAS,IAAI,MAAM,SAAS,QAAQ,EAAE,SAAS,IAAI,OAAO;AAAA,MAC3F;AAAA,IACF,QAAQ;AAAE,QAAE;AAAU,mBAAa,QAAQ;AAAA,IAAY;AACvD,QAAI,QAAiC;AACrC,QAAI;AACF,YAAM,IAAI,MAAM,UAAU,QAAQ,OAAO,MAAM,UAAU,SAAS,KAAK,CAAC;AACxE,UAAI,KAAK,KAAK,GAAG;AACf,cAAM,OAAO,KAAK,IAAI,QAAQ,EAAE,MAAM;AACtC,cAAM,OAAO,MAAM,KAAK,MAAM,YAAY,OAAO,EAAE,OAAO,MAAM,GAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;AACxG,cAAM,OAAO,KAAK,OAAO,SAAO,YAAY,EAAE,YAAY,IAAI,YAAY,IAAI,IAAI,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC;AAItG,YAAI,YAAY;AAChB,mBAAW,OAAO,MAAM;AACtB,cAAI,CAAC,KAAK,EAAG;AACb,gBAAM,QAAQ,EAAE,OAAO,GAAG,GAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,EAAG;AACjE,cAAI;AACF,kBAAM,QAAQ,MAAM,UAAU,QAAQ,OAAO,CAAC,IAAI,MAAM,UAAU,YAAY,CAAC,GAAG,IAAI,IAAI,MAAM,UAAU,YAAY;AACtH,kBAAM,SAAS,OAAO,MAAM,SAAS,eAAe,EAAE,OAAO,SAAS,KAAK,GAAG,KAAK,IAC/E,MAAM,KAAK,eAAe,OAAO,OAAO,EAAE,MAAM,OAAM,SAAQ,MAAM,UAAU,QAAQ,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;AACnH,cAAE,gBAAgB,OAAO;AAAA,UAC3B,QAAQ;AAAE,cAAE;AAAA,UAAU;AACtB,YAAE,QAAQ,EAAE,YAAY,IAAI,YAAY,IAAI,IAAI,MAAM,GAAG;AAAG,YAAE;AAAU;AAAA,QAC1E;AACA,gBAAQ,YAAY,KAAK,SAAS,IAAI,KAAK,SAAS,QAAQ,EAAE,SAAS,IAAI,OAAO;AAAA,MACpF;AAAA,IACF,QAAQ;AAAE,QAAE;AAAU,cAAQ,QAAQ;AAAA,IAAO;AAC7C,UAAM,UAAU,YAAY,OAAO,EAAE,YAAY,MAAM,CAAC;AAAA,EAC1D;AAGA,MAAI,QAA0B,QAAQ,QAAQ;AAC9C,SAAO;AAAA,IACL,SAAS,OAA4E;AACnF,YAAM,MAAM,MAAM,KAAK,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,KAAK,CAAC;AAAG,cAAQ,IAAI,MAAM,MAAM,MAAS;AAAG,aAAO;AAAA,IAC7G;AAAA,EACF;AACA,iBAAe,MAAM,OAA4E;AAC7F,QAAI,CAAC,SAAS,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,QAAQ,IAAM,OAAM,IAAI,UAAU,2BAA2B;AAC1I,UAAM,SAAS,MAAM;AACrB,UAAM,UAAU,OAAO;AACvB,UAAM,IAAuB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,EAAE,YAAY,GAAG,OAAO,GAAG,YAAY,EAAE,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,EAAE;AACpJ,eAAW,SAAS,MAAM,UAAU,WAAW,MAAM,KAAK,GAAG;AAC3D,UAAI,QAAQ,QAAS;AACrB,YAAM,QAAQ,MAAM,UAAU,MAAM,KAAK;AACzC,UAAI,CAAC,OAAO;AAAE,UAAE;AAAW;AAAA,MAAU;AACrC,QAAE;AACF,UAAI;AAAE,cAAM,KAAK,OAAO,OAAO,QAAQ,CAAC;AAAA,MAAG,QAAQ;AAAE,UAAE;AAAA,MAAU,UAAE;AAAU,cAAM,MAAM,QAAQ;AAAA,MAAG;AAAA,IACtG;AACA,WAAO;AAAA,EACX;AACF;;;AClIA,OAAO,QAAQ;AAIf,IAAM,QAAQ,CAAC,YAAY,oBAAoB,mBAAmB,gBAAgB;AAG3E,SAAS,cAAc,MAAe,SAAgE;AAC3G,QAAM,EAAE,MAAM,YAAY,UAAU,IAAI;AACxC,QAAM,UAAU,uCAAuC,UAAU;AACjE,iBAAe,GAAM,IAAkD;AACrE,UAAM,IAAI,MAAM,KAAK,QAAQ;AAC7B,QAAI;AAAE,YAAM,EAAE,MAAM,yBAAyB,IAAI,EAAE;AAAG,YAAM,IAAI,MAAM,GAAG,CAAC;AAAG,YAAM,EAAE,MAAM,QAAQ;AAAG,aAAO;AAAA,IAAG,SACzG,GAAG;AAAE,YAAM,EAAE,MAAM,UAAU,EAAE,MAAM,MAAM,MAAS;AAAG,YAAM;AAAA,IAAG,UACvE;AAAU,QAAE,QAAQ;AAAA,IAAG;AAAA,EACzB;AACA,QAAM,cAAc,OAAO,OAAwE,MAAM,EAAE,MAAM;AAAA,MAC7G,MAAM,IAAI,OAAK,6BAA6B,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC;AAE7F,iBAAe,KAAK,GAAkB,OAAc,QAAyC;AAC3F,QAAI,QAAQ;AAAM,UAAM,YAAY,oBAAI,IAAgB,CAAC,MAAM,CAAC;AAChE,UAAM,OAAO,MAAM;AAAE,UAAI,CAAC,MAAO;AAAQ,cAAQ;AAAO,iBAAW,KAAK,WAAW;AAAE,YAAI;AAAE,YAAE;AAAA,QAAG,QAAQ;AAAA,QAA4C;AAAA,MAAE;AAAA,IAAE;AACxJ,MAAE,GAAG,SAAS,IAAI;AAAG,MAAE,GAAG,OAAO,IAAI;AACrC,WAAO;AAAA,MACL,OAAO,MAAM;AAAA,MACb,OAAO,IAAgB;AAAE,kBAAU,IAAI,EAAE;AAAG,YAAI,CAAC,MAAO,IAAG;AAAA,MAAG;AAAA,MAC9D,MAAM,UAAU;AACd,YAAI,WAAW;AACf,YAAI;AAAE,sBAAY,MAAM,EAAE,MAAuB,6BAA6B,OAAO,QAAQ,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,EAAG,OAAO;AAAA,QAAM,QAAQ;AAAA,QAAyB;AAC7K,UAAE,IAAI,SAAS,IAAI;AAAG,UAAE,IAAI,OAAO,IAAI;AAEvC,UAAE,QAAQ,CAAC,QAAQ;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA;AAAA,IAEA,MAAM,SAAS;AACb,YAAM,IAAI,MAAM,KAAK,QAAQ;AAC7B,UAAI;AAAG,UAAI;AAAE,YAAI,MAAM,YAAY,CAAC;AAAA,MAAG,UAAE;AAAU,UAAE,QAAQ;AAAA,MAAG;AAChE,YAAM,IAAI,IAAI,GAAG,OAAO,EAAE,kBAAkB,UAAU,CAAC;AAAG,YAAM,EAAE,QAAQ;AAC1E,UAAI;AAAG,UAAI;AAAE,YAAI,MAAM,YAAY,CAAC;AAAA,MAAG,UAAE;AAAU,cAAM,EAAE,IAAI;AAAA,MAAG;AAClE,YAAM,SAAS,CAAC,GAA0B,QAAc,MAAM,KAAK,OAAK,MAAM,OAAO,EAAE,CAAC,CAAC;AACzF,UAAI,CAAC,EAAE,IAAI,KAAK,OAAO,GAAG,IAAI,KAAK,CAAC,EAAE,YAAY,OAAO,GAAG,UAAU,KAAK,EAAE,QAAQ,EAAE;AACrF,cAAM,IAAI,UAAU,iCAAiC,IAAI,oDAAoD;AAAA,IACjH;AAAA,IACA,MAAM,MAAM,OAA0C;AACpD,YAAM,IAAI,MAAM,KAAK,QAAQ;AAC7B,UAAI;AACF,YAAI,EAAE,MAAM,EAAE,MAAwB,+BAA+B,OAAO,SAAS,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,EAAG,KAAK;AAAE,YAAE,QAAQ;AAAG,iBAAO;AAAA,QAAM;AAAA,MAC1J,SAAS,GAAG;AAAE,UAAE,QAAQ,IAAI;AAAG,cAAM;AAAA,MAAG;AACxC,aAAO,KAAK,GAAG,OAAO,MAAM,MAAS;AAAA,IACvC;AAAA;AAAA,IAEA,MAAM,QAAW,OAAc,IAAsB,WAA+B;AAClF,YAAM,IAAI,MAAM,KAAK,QAAQ;AAC7B,UAAI;AACF,cAAM,EAAE,MAAM,gDAAgD,CAAC,OAAO,SAAS,CAAC,CAAC;AACjF,cAAM,EAAE,MAAM,2BAA2B,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC;AAC3E,cAAM,EAAE,MAAM,+CAA+C;AAAA,MAC/D,SAAS,GAAG;AAAE,UAAE,QAAQ,IAAI;AAAG,cAAM;AAAA,MAAG;AACxC,UAAI,OAAO;AACX,YAAM,QAAQ,MAAM,KAAK,GAAG,OAAO,MAAM;AAAE,eAAO;AAAA,MAAM,CAAC;AACzD,UAAI;AACF,cAAM,SAAS,MAAM,GAAG;AACxB,YAAI,KAAM,OAAM,IAAI,MAAM,sEAAsE;AAChG,eAAO;AAAA,MACT,UAAE;AAAU,cAAM,MAAM,QAAQ;AAAA,MAAG;AAAA,IACrC;AAAA,EACF;AACF;","names":[]}