@catalyst-cloud/sdk 0.6.0 → 0.8.0

package/README.md

@@ -127,6 +127,98 @@ void client.start(); // never await in the browser
 
 Requires a platform `WebSocket` (browser, Bun, or Node ≥22). On older Node, inject a `wsFactory` that wraps the [`ws`](https://www.npmjs.com/package/ws) package.
 
+### Browser — managed OPFS replica (`/browser`)
+
+`BrowserReplica` is the browser twin of `/node`'s `CatalystReplica`: an OPFS-persisted SQLite replica
+in a dedicated Web Worker, seeded from `/snapshot` in bounded streamed batches, kept live off the same
+change feed, and read through the same `@catalyst-cloud/read-model` views — no hand-written worker,
+apply, or seeding code in your app.
+
+```ts
+import {
+  BrowserReplica,
+  isBrowserReplicaSupported,
+  type ReplicaStatus,
+} from "@catalyst-cloud/sdk/browser";
+
+let status: ReplicaStatus = "loading";
+
+if (isBrowserReplicaSupported()) {
+  const replica = new BrowserReplica(
+    {
+      onChanged: () => void refreshList(), // after the seed and after every applied delta drain
+      onStatus: (s) => {
+        status = s; // "loading" | "live" | "reconnecting" | "error" | "secondary" | …
+        setBadge(s);
+      },
+    },
+    {
+      baseUrl: "/api/v1", // same-origin, cookie-authed; accountId optional
+      // REQUIRED. The OPFS database is shared by every replica on the origin and a warm cursor skips
+      // the snapshot, so without a fence a change of signed-in user serves the PREVIOUS user's rows.
+      // Pass a stable per-user id from your session — e.g. the WorkOS `user.id`. It never leaves the
+      // browser; it is only compared against the value stamped in the local DB, and a mismatch wipes
+      // the replica and forces a re-seed.
+      identity: session.user.id,
+    },
+  );
+  // AWAIT it. start() suspends on the Web Lock before the worker exists, so a query issued against a
+  // not-yet-started replica rejects with "replica client closed".
+  await replica.start(); // resolves once seeded — or immediately, with status "secondary"
+
+  // Another tab already owns the origin's replica. That is a normal outcome, not an error: this tab
+  // should read via its usual fetch path and leave the local DB alone.
+  if (status !== "secondary") {
+    const rows = await replica.queryIssues(); // read-model IssueView[], served locally
+  }
+  // replica.close() on teardown — cooperatively releases the OPFS handles, then terminates the worker
+}
+```
+
+`status` above is whatever your `onStatus` handler last recorded. `start()` REJECTS if the boot fails
+(bad origin, missing worker chunk, OPFS unavailable) — it does not resolve into a broken state, so a
+`try`/`catch` around it is where you surface the error to the user.
+
+Built in, because browsers need them:
+
+- **Single-owner election** (Web Locks): OPFS SAHPool is single-connection-per-origin, so exactly one
+  tab boots the replica; every other tab gets status `"secondary"` (a clean state, not an error) and
+  should read via its normal fetch path.
+- **Backpressure**: live deltas are coalesced into batched, single-flight applies with a bounded
+  buffer; a backlog too deep to replay escalates to a fresh snapshot instead of growing.
+
+**Peer dependency**: install [`@sqlite.org/sqlite-wasm`](https://www.npmjs.com/package/@sqlite.org/sqlite-wasm)
+yourself — the SDK never bundles the wasm.
+
+**Bundlers**: the worker is created with `new Worker(new URL("./db.worker.js", import.meta.url),
+{ type: "module" })`, which Vite, webpack 5, and Rollup detect statically and split into its own chunk
+(nothing wasm-related touches your main bundle; `/node` consumers never see it at all). Notes:
+
+- **Vite**: works out of the box in `build`. In dev, if pre-bundling interferes with the worker URL,
+  add `optimizeDeps: { exclude: ["@catalyst-cloud/sdk"] }`.
+- **webpack 5 / Rollup**: the `new Worker(new URL(...))` syntax is supported natively (Rollup needs
+  worker support in your config, e.g. `@surma/rollup-plugin-off-main-thread` or equivalent).
+- **Exotic bundlers**: pass `createWorker` in `BrowserReplicaOptions` and construct the worker
+  however your toolchain requires. The worker module is published at the dedicated subpath
+  **`@catalyst-cloud/sdk/browser/db-worker`** — that specifier is the supported entry point:
+
+  ```ts
+  // Vite
+  import DbWorker from "@catalyst-cloud/sdk/browser/db-worker?worker";
+  createWorker: () => new DbWorker();
+
+  // webpack 5 / anything that resolves a bare specifier to a URL
+  createWorker: () =>
+    new Worker(
+      new URL("@catalyst-cloud/sdk/browser/db-worker", import.meta.url),
+      { type: "module" },
+    );
+  ```
+
+  The worker is a **side-effect module** (it registers a message handler and exports nothing), so it
+  is listed in the package's `sideEffects` array — do not configure your bundler to tree-shake it, or
+  it will load and register nothing and every replica call will hang.
+
 ## API
 
 | Export | What it is |

package/dist/browser.d.ts

@@ -0,0 +1,9 @@
+export { BrowserReplica, streamSeedIntoWorker, type BrowserReplicaOptions, type ReplicaHandlers, type ReplicaStatus, } from "./replica/browser/browser-replica.js";
+export { isBrowserReplicaSupported } from "./replica/browser/support.js";
+export { acquireReplicaLock, type ReplicaLockHandle, type ReplicaLockOptions, } from "./replica/browser/browser-lock.js";
+export { DeltaQueue, MAX_APPLY_BATCH_ROWS, MAX_INBOX_DEPTH, type SeqChange, type DeltaQueueOptions, } from "./replica/browser/delta-queue.js";
+export { streamSnapshotBatches, SEED_BATCH_ROWS } from "./replica/browser/snapshot-stream.js";
+export type { WireChange, ReplicaRequest, ReplicaResponse, Envelope, ResultMap, ApplyChangesResult, } from "./replica/browser/protocol.js";
+export { LiveSyncClient, type AuthStrategy, type LiveSyncStatus, type LogLevel, type WebSocketLike, type WebSocketFactory, } from "./live-sync-client.js";
+export { ENTITY_NAMES, CHANGE_OPS, type AccountId, type EntityName, type ChangeOp, type ChangeFrame, } from "./types.js";
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAE9F,YAAY,EACV,UAAU,EACV,cAAc,EACd,eAAe,EACf,QAAQ,EACR,SAAS,EACT,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,YAAY,EACZ,UAAU,EACV,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}

package/dist/browser.js

@@ -0,0 +1,24 @@
+// @catalyst-cloud/sdk/browser — the managed replica for the browser (CTC-114, milestone 2 of the
+// managed-replica roadmap; ADR-0002).
+//
+// `BrowserReplica` is the browser twin of `/node`'s CatalystReplica behind ONE import: claim
+// single-ownership of the origin's replica (Web Locks — a losing tab degrades to "secondary", never a
+// red error), open + migrate an OPFS SAHPool SQLite DB inside a dedicated Worker, stream-seed
+// /snapshot in bounded batches, subscribe to the live change feed (the SDK's LiveSyncClient) through a
+// coalescing, depth-bounded delta queue, and serve the @catalyst-cloud/read-model `build*View`
+// queries over it — the "same query, four runtimes" proof, in the browser.
+//
+// BUNDLER CONTRACT: the worker is reached via `new Worker(new URL("./db.worker.js",
+// import.meta.url), { type: "module" })`, which Vite, webpack 5 and Rollup detect statically and emit
+// as a separate chunk; `@sqlite.org/sqlite-wasm` is a PEER dependency resolved by the consumer inside
+// that chunk. Import this subpath ONLY from browser code — the root ("@catalyst-cloud/sdk") stays the
+// transport-only isomorphic surface, and '/node' never pulls any of this into a node bundle.
+export { BrowserReplica, streamSeedIntoWorker, } from "./replica/browser/browser-replica.js";
+export { isBrowserReplicaSupported } from "./replica/browser/support.js";
+export { acquireReplicaLock, } from "./replica/browser/browser-lock.js";
+export { DeltaQueue, MAX_APPLY_BATCH_ROWS, MAX_INBOX_DEPTH, } from "./replica/browser/delta-queue.js";
+export { streamSnapshotBatches, SEED_BATCH_ROWS } from "./replica/browser/snapshot-stream.js";
+// Re-export the transport surface so a consumer can stay on one import.
+export { LiveSyncClient, } from "./live-sync-client.js";
+export { ENTITY_NAMES, CHANGE_OPS, } from "./types.js";
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,sCAAsC;AACtC,EAAE;AACF,6FAA6F;AAC7F,sGAAsG;AACtG,8FAA8F;AAC9F,uGAAuG;AACvG,+FAA+F;AAC/F,2EAA2E;AAC3E,EAAE;AACF,oFAAoF;AACpF,sGAAsG;AACtG,sGAAsG;AACtG,sGAAsG;AACtG,6FAA6F;AAE7F,OAAO,EACL,cAAc,EACd,oBAAoB,GAIrB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEzE,OAAO,EACL,kBAAkB,GAGnB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,GAGhB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAW9F,wEAAwE;AACxE,OAAO,EACL,cAAc,GAMf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,YAAY,EACZ,UAAU,GAKX,MAAM,YAAY,CAAC"}

package/dist/live-sync-client.d.ts

@@ -45,8 +45,20 @@ export interface LiveSyncClientOptions {
      * verbatim (path-preserving). A trailing slash is trimmed.
      */
     baseUrl: string;
-    /** The tenant id = the mirror's name; sent as `?account=` on the connect URL. */
-    accountId: string;
+    /**
+     * The tenant id = the mirror's name; sent as `?account=` on the connect URL.
+     *
+     * OPTIONAL, and omitting it is the browser default: the OPEN read plane scopes a cookie-authed
+     * connection to the session user's own tenant, and an explicit account is the tenant-SWITCHER path.
+     * When absent the parameter is omitted entirely rather than serialized as `?account=` — an empty
+     * value is not a mirror name, and freezing it into the wire contract would leave the one nearby
+     * server-side fallback that a bare empty value can reach (`adminAccountScope`'s `|| "tenant-0"`)
+     * cross-tenant-shaped.
+     *
+     * REQUIRED for `auth: {kind:"token"}` — a host has no session to fall back to, so the constructor
+     * throws rather than letting it fail later as an opaque server 401.
+     */
+    accountId?: string;
     /**
      * The connect route. Default "/connect"; the service dual-serves it at "/api/v1/connect" too, so a
      * path-prefixed `baseUrl` ("…/api/v1") with the default "/connect" resolves to "…/api/v1/connect".
@@ -58,9 +70,26 @@ export interface LiveSyncClientOptions {
      * Re-seed the consumer's store from a full snapshot and resolve to the FRESH cursor. Called on a
      * `{type:"resync"}` underflow frame and (optionally) before the first connect. The host pulls
      * /snapshot into bun:sqlite; the browser re-runs its OPFS seed(). The client closes the socket
-     * before calling this so no live frame interleaves with the seed.
+     * before calling this so no live frame interleaves with the seed. The await is bounded by
+     * {@link reseedTimeoutMs} (CTC-281) — a hanging reseed is abandoned (its late settle discarded)
+     * and the client re-enters the backoff path, so this callback can never wedge the transport; still,
+     * bound your own I/O (as the replica's seedFromSnapshot does) so a dead fetch fails fast, not at
+     * the backstop.
+     *
+     * `signal` ABORTS when the transport gives up on this attempt — the {@link reseedTimeoutMs}
+     * deadline expiring, or `stop()` (CTC-114 review round 10). Honour it: the transport considers the
+     * attempt over the moment it fires, and RECONNECTS. A callback that keeps writing after that is a
+     * second writer racing the socket the transport just reopened — the browser replica's concrete
+     * failure was frames delivered past the abandoned seed's cursor being dropped by its paused queue,
+     * after which a late seed completion left the socket advanced over a hole that later deltas sealed
+     * permanently.
+     *
+     * This is why "abandon" alone was not enough. Two layers bounding one operation with NO
+     * cancellation link between them is the defect; the signal is the link. Optional parameter, so
+     * existing zero-arg callbacks still typecheck — but a consumer that ignores it keeps the old
+     * two-writer hazard.
      */
-    reseed: () => Promise<number>;
+    reseed: (signal?: AbortSignal) => Promise<number>;
     /**
      * Read the consumer's durable cursor (the last applied feed seq), or null/undefined if it has
      * never seeded. Drives the `{type:"sync", after}` catch-up request. Return `null` to send
@@ -93,6 +122,37 @@ export interface LiveSyncClientOptions {
      * socket half-open and force-reconnecting through the normal backoff path. Default `15_000`.
      */
     pongTimeoutMs?: number;
+    /**
+     * Connect/open deadline (CTC-281): how long (ms) after constructing a socket to wait for `onopen`
+     * before treating the attempt as failed (tear the socket down, status "reconnecting", backoff
+     * reconnect). Without it, a TCP-connect or HTTP-upgrade stall that never fires open/close/error
+     * (undici sets no upgrade deadline; injected impls are trusted blindly) wedges the client in
+     * "connecting" with ZERO pending timers — restart-only. Default `20_000`; `0` disables.
+     */
+    openTimeoutMs?: number;
+    /**
+     * Re-seed deadline (CTC-281): how long (ms) to wait for the injected {@link reseed} callback to
+     * settle before abandoning the attempt (status "reconnecting", backoff reconnect; the abandoned
+     * reseed's late settle is discarded). While resyncing the client holds NO socket and suppresses
+     * scheduleReconnect, so an unbounded reseed hang was a zero-timer restart-only wedge — the exact
+     * ticket-ask-3 state. A TOTAL-duration backstop, deliberately generous: the replica's
+     * seedFromSnapshot already fails fast on a dead stream via its own IDLE abort
+     * (`snapshotIdleTimeoutMs`); this bound exists for reseed impls with no bound of their own (e.g. a
+     * browser OPFS seed over a default fetch). Raise it if a legitimate full seed can stream longer.
+     * Default `600_000` (10 min); `0` disables.
+     */
+    reseedTimeoutMs?: number;
+    /**
+     * How long a CANCELLED reseed gets to unwind before the transport settles and reconnects anyway.
+     * Default 250ms; the value must cover the consumer's OWN cleanup bound (CTC-114 review round 14).
+     *
+     * Reconnecting before the consumer has unwound is not merely early: its store may still be latched,
+     * so replayed frames are refused while this client's `deliveredSeq` advances over them — and the
+     * next frame it does accept carries the durable cursor past the gap, permanently. The transport
+     * cannot know how long a given consumer takes to unwind, so the consumer sets this. The browser
+     * replica raises it to cover its worker-RPC deadline, since its cleanup is a `seedAbort` RPC.
+     */
+    cancelCleanupGraceMs?: number;
     /**
      * Gap detection (CTL-1402): how long (ms) to wait for a `{type:"sync"}` gap re-request to finish
      * redelivering the detected hole before retrying (or, once {@link gapRetryLimit} re-requests have
@@ -134,7 +194,7 @@ export declare function stripTrailingSlashes(s: string): string;
 export declare function buildConnectUrl(opts: {
     baseUrl: string;
     connectPath: string;
-    accountId: string;
+    accountId?: string;
     auth: AuthStrategy;
 }): string;
 export declare class LiveSyncClient {
@@ -151,6 +211,9 @@ export declare class LiveSyncClient {
     private readonly maxBackoffMs;
     private readonly pingIntervalMs;
     private readonly pongTimeoutMs;
+    private readonly openTimeoutMs;
+    private readonly reseedTimeoutMs;
+    private readonly cancelCleanupGraceMs;
     private readonly gapTimeoutMs;
     private readonly gapRetryLimit;
     private readonly wsFactory;
@@ -158,6 +221,36 @@ export declare class LiveSyncClient {
     private readonly telemetryConfig;
     private ws;
     private stopped;
+    /**
+     * Has start() been entered? `stopped` alone cannot answer this — it is false BEFORE the first
+     * start() as well as during a run, so every "am I running?" guard read true on a client that had
+     * never booted. Only the public `requestResync()` can reach that window (CTC-114 review round 5):
+     * it would reseed and open a socket with no lifecycle deferred and no telemetry resolved, and the
+     * later real start() would then openSocket() again — overwriting `this.ws`, so the first socket
+     * kept delivering duplicate frames and could no longer be closed through the stored reference.
+     */
+    private started;
+    /** The in-flight boot task, or null once it settles — `requestResync()` serializes behind it. */
+    private bootTask;
+    /** Settles an in-flight `boundedReseed` wrapper on stop(), so an awaited resync cannot hang. */
+    private abandonReseed;
+    /**
+     * The in-flight resync, so a concurrent caller AWAITS it instead of being handed an
+     * already-resolved promise and acting on a store still being rebuilt (round 10).
+     */
+    private activeResync;
+    /** Did the boot this request waited on perform a COLD re-seed? Only then may it be absorbed. */
+    private bootColdSeeded;
+    /**
+     * Did the last boot REJECT? Latched until the next `start()` (CTC-114 review round 9).
+     *
+     * Round 8 read the failure from the awaited `bootTask`, but that handle is nulled once the boot
+     * settles — so a `requestResync()` arriving after that microtask found no record of the failure,
+     * with `started` still true and `stopped` still false, and sailed past the guard into a reseed that
+     * could open a live socket under an application already told startup had failed. The outcome has to
+     * outlive the handle.
+     */
+    private bootFailed;
     private resyncing;
     private backoff;
     private reconnectTimer;
@@ -191,11 +284,36 @@ export declare class LiveSyncClient {
     private pingSentAt;
     /** Client-lifetime: consecutive opened-then-never-ponged connections. Reset to 0 by ANY pong. */
     private probeFailures;
-    /** Client-lifetime: after PROBE_FAILURE_LIMIT never-ponged connections we stop pinging for good
-     *  (an old server without auto-pong), degrading to close/error-only detection. */
-    private watchdogDisabled;
+    /** Client-lifetime until a pong: after PROBE_FAILURE_LIMIT never-ponged connections the watchdog
+     *  DEGRADES to a {@link DEGRADED_PROBE_MULTIPLIER}x-slower re-probe (an old server without auto-pong)
+     *  — it never turns off outright, so detection is never a restart-only casualty (CTC-281). Only
+     *  reachable while pong capability is UNPROVEN ({@link pongEverObserved}); the first pong clears it. */
+    private watchdogDegraded;
+    /** Client-lifetime pong latch (CTC-281): has ANY connection EVER answered a ping? Once true, the
+     *  server's auto-pong capability is PROVEN for good — a later never-ponged connection is a liveness
+     *  failure (the incident's open-but-silent socket), never feature-detect evidence, so the watchdog
+     *  can no longer even degrade itself. PER-PROCESS by design — which is exactly why the degrade must
+     *  be soft (see {@link DEGRADED_PROBE_MULTIPLIER}): a restart mid-incident resets this latch. */
+    private pongEverObserved;
     private pingTimer;
     private pongDeadline;
+    /** Per-CONNECTION connect/open deadline (CTC-281): armed when the socket is constructed, cleared on
+     *  open/close/teardown. The only timer pending between openSocket() and onopen — the guarantee that
+     *  a never-firing ws impl cannot leave the client wedged in "connecting" with nothing scheduled. */
+    private connectTimer;
+    /** Per-CONNECTION onerror→onclose fallback (CTC-281): armed by onerror, fires forceReconnect once
+     *  if the impl never follows error with close (undici #3697/#3546). Cleared on open/close/teardown. */
+    private errorFallbackTimer;
+    /** Per-CONNECTION: has THIS socket fired onopen? The connect-deadline's late-timer guard (a
+     *  throttled background tab can fire the deadline after onopen already ran and cleared it). */
+    private socketOpened;
+    /** The pending reseed deadline (CTC-281) — the timer that makes "resyncing" (no socket, reconnect
+     *  suppressed) a bounded state instead of a restart-only wedge. Cleared when the reseed settles in
+     *  time and by stop() (ask 4: stop() leaves NOTHING pending). At most one reseed is ever in flight:
+     *  `resyncing` guards the resync path, and the boot cold seed SETS that same flag for its duration.
+     *  (It used to rely on "the boot seed runs before any socket exists" — true only while a resync
+     *  needed a server frame. The public `requestResync()` added in 0.8.0 needs no socket.) */
+    private reseedTimer;
     constructor(opts: LiveSyncClientOptions);
     /**
      * Start the client: seed first if the consumer has no cursor, then open the live socket and keep it
@@ -208,6 +326,13 @@ export declare class LiveSyncClient {
     stop(): void;
     /** The ws(s):// URL this client opens, for diagnostics/tests. Re-derived from the options. */
     connectUrl(): string;
+    /**
+     * The tenant label for telemetry. Attributes are `Record<string, string>`, and an empty string reads
+     * as a MISSING attribute in Loki/Tempo — which silently merges every session-scoped browser client
+     * into one unlabelled bucket. `"session"` names the case instead: this client is scoped to whatever
+     * tenant the cookie resolves to.
+     */
+    private get tenantAttr();
     private setStatus;
     private openSocket;
     /** End the in-flight connect span exactly once (idempotent — nulls the handle). */
@@ -263,6 +388,45 @@ export declare class LiveSyncClient {
     /** Drop all gap state (pending hole + timer) — on (re)open and on the resync/re-seed path, both of
      *  which re-request/rebuild from the durable cursor and so supersede any pending re-request. */
     private clearGapState;
+    private clearReseedTimer;
+    /**
+     * Run the injected reseed() bounded by {@link LiveSyncClientOptions.reseedTimeoutMs} (CTC-281).
+     * The injected callback is a trust boundary like the ws impl: while it runs there is NO socket and
+     * scheduleReconnect is suppressed, so an unbounded await here was the last zero-timer wedge — the
+     * deadline below is the pending timer that upholds the header invariant for the "resyncing" state.
+     * On timeout the attempt is both CANCELLED and abandoned (CTC-114 review round 10). It used to be
+     * abandoned only, justified as "the callback owns its own I/O bounds" — but the callback owning
+     * bounds is exactly what makes a SECOND, independent deadline here dangerous. The browser seed is
+     * bounded by network idleness and by per-RPC worker deadlines, both of which a legitimately slow
+     * ~100 MB snapshot satisfies indefinitely; this total deadline could therefore fire on a seed that
+     * was making honest progress, whereupon the transport reconnected while the callback kept writing.
+     * Frames past the abandoned seed's cursor were then accepted by the socket and discarded by the
+     * replica's paused queue, and a late seed completion left the socket advanced over a hole that
+     * later deltas sealed for good.
+     *
+     * So the deadline now fires an AbortSignal FIRST and rejects second: whoever is told the attempt is
+     * over is also told to stop. A late settle is still discarded via the `settled` latch, and a late
+     * REJECTION is still swallowed so it can never surface as an unhandled rejection.
+     */
+    private boundedReseed;
+    /**
+     * Ask the client to drop the socket, re-seed, and reconnect from the fresh cursor — the same path a
+     * server `{type:"resync"}` frame drives, exposed for a consumer that discovers ON ITS OWN SIDE that
+     * its store can no longer be caught up by deltas.
+     *
+     * The browser replica is the motivating caller: when its delta queue overflows (or its applies keep
+     * rejecting) the buffered frames are dropped, so the transport's notion of what has been delivered is
+     * now ahead of what the store actually holds. Re-seeding through here — rather than calling the
+     * `reseed` callback directly — is what makes that safe: this CLOSES THE SOCKET FIRST, so no live
+     * frame interleaves with the snapshot and lands in the window that is in neither the snapshot nor the
+     * store.
+     *
+     * Delegates to the existing resync path in full — same `resyncing` re-entrancy guard, same
+     * `boundedReseed` deadline, same span, same failure→backoff behaviour. NEVER rejects: a failed
+     * re-seed is already handled internally by re-entering the reconnect path, and this is called from
+     * event handlers and `void` contexts where a rejection would surface as an unhandled promise.
+     */
+    requestResync(): Promise<void>;
     /**
      * Cursor underflow: the deltas we need were evicted from the service's retained change buffer. Close the socket
      * (so no live frame interleaves with the re-seed), re-seed via the injected callback, then reconnect
@@ -270,6 +434,21 @@ export declare class LiveSyncClient {
      * frame and suppresses scheduleReconnect for the duration so we reopen exactly once.
      */
     private handleResync;
+    /**
+     * The resync body. Never call directly — `handleResync()` owns the in-flight handle.
+     *
+     * TWO FLAGS, ONE FACT — documented rather than consolidated here, deliberately. `resyncing` and
+     * `activeResync` both mean "a re-seed is in flight", and they can disagree: the boot path sets
+     * `resyncing` directly (so a resync cannot race startup) without ever creating an `activeResync`
+     * handle. In that window a call landing here would hit the guard below and resolve silently, which
+     * is the very shape round 10 fixed for the live path.
+     *
+     * It is NOT reachable today, and both reasons are load-bearing: `requestResync()` serialises behind
+     * `bootTask` before it can get here, and the server-frame path needs a socket, which does not exist
+     * until the boot opens one. Consolidating the two into a single handle is the right fix and belongs
+     * with the wider lifecycle rework — not in a release candidate at round eleven.
+     */
+    private runResync;
     /** Epoch ms of the last inbound frame (change, pong, or malformed) — null before the first frame.
      *  Any inbound bytes prove the socket is alive; the catalyst daemon's stall classifier reads this to
      *  tell a quiet feed from a half-open socket (the per-frame timestamp it previously lacked). */
@@ -284,8 +463,10 @@ export declare class LiveSyncClient {
     /** Any inbound frame: stamp liveness, cancel a pending pong deadline (it was answered), and postpone
      *  the next ping so a busy stream never sends one. Runs synchronously in onmessage before parsing. */
     private onInboundFrame;
-    /** (Re)arm the idle-ping timer. No-op when the watchdog is disabled/off or there is no live socket,
-     *  so it is safe to call on every frame. A setTimeout chain (not setInterval): each frame resets it. */
+    /** (Re)arm the idle-ping timer. No-op when the watchdog is off or there is no live socket, so it is
+     *  safe to call on every frame. A setTimeout chain (not setInterval): each frame resets it. A
+     *  DEGRADED watchdog still arms — at {@link DEGRADED_PROBE_MULTIPLIER}x the interval — so detection
+     *  is never permanently off (CTC-281): every live socket always has a probe pending. */
     private armPing;
     /** The feed has been idle for a full interval: send one liveness ping and start the pong deadline. A
      *  synchronous send throw means the socket is already dead — treat it as an unanswered probe now. */
@@ -295,9 +476,16 @@ export declare class LiveSyncClient {
      *  is proven — re-arm and move on (detection latency grows; correctness holds). Otherwise: half-open. */
     private onPongDeadline;
     /** A ping went unanswered (deadline elapsed or the send threw). If this connection had already proven
-     *  pong capability it is a genuine liveness timeout; otherwise it counts toward the feature-detect —
-     *  after PROBE_FAILURE_LIMIT never-ponged connections the watchdog disables itself for good (an old
-     *  server without auto-pong). Either way, force-reconnect through the existing backoff path. */
+     *  pong capability it is a genuine liveness timeout. If pong capability was proven EARLIER in this
+     *  client's lifetime (CTC-281), a never-ponged connection is the incident signature — a half-open
+     *  socket against a server we KNOW auto-pongs — so it too is a liveness failure and must NEVER count
+     *  toward the feature-detect (during the Jul 17-23 windows, 3 such sockets permanently disabled
+     *  detection). Only while capability is UNPROVEN does the failure count toward the DEGRADE — after
+     *  PROBE_FAILURE_LIMIT never-ponged connections the watchdog backs its probes off to
+     *  DEGRADED_PROBE_MULTIPLIER x pingIntervalMs (an old server without auto-pong costs one bounded
+     *  reconnect per degraded window; a mid-incident restart — per-process latch reset — still detects
+     *  the next half-open within one degraded window, never restart-only; CTC-281). Every path
+     *  force-reconnects through the existing backoff. */
     private onProbeUnanswered;
     /** Tear the socket down and reconnect through the normal backoff. closeSocket detaches handlers (so
      *  onclose won't also fire) and clears the liveness timers, so we schedule the reopen ourselves. */
@@ -305,6 +493,8 @@ export declare class LiveSyncClient {
     private clearPingTimer;
     private clearPongDeadline;
     private clearLivenessTimers;
+    /** Clear the per-connection connect/open deadline + onerror→onclose fallback (CTC-281). */
+    private clearConnectTimers;
 }
 /** Parse a WS frame (string or ArrayBuffer) into a known server frame, or null for anything malformed. */
 export declare function parseFrame(data: unknown): ServerFrame | null;

package/dist/live-sync-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-sync-client.d.ts","sourceRoot":"","sources":["../src/live-sync-client.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,WAAW,EAAqC,WAAW,EAAa,MAAM,YAAY,CAAC;AAEzG,OAAO,EAUL,KAAK,SAAS,EACd,KAAK,eAAe,EAErB,MAAM,WAAW,CAAC;AAEnB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,aAAa,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEjF,gFAAgF;AAChF,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,MAAM,GACN,cAAc,GACd,WAAW,GACX,OAAO,GACP,SAAS,CAAC;AAEd,6BAA6B;AAC7B,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,IAAI,EAAE,YAAY,CAAC;IACnB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,iGAAiG;IACjG,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;IAC5C,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,uDAAuD;IACvD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9D;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACzC;AAaD,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;GAIG;AACH,4GAA4G;AAC5G,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,MAAM,CAMT;AASD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4C;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,OAAO,CAAC,EAAE,CAA8B;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,WAAW,CAA6B;IAChD,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAA6B;IAC9C,0GAA0G;IAC1G,OAAO,CAAC,WAAW,CAA2B;IAG9C;;;gGAG4F;IAC5F,OAAO,CAAC,YAAY,CAAM;IAC1B;qGACiG;IACjG,OAAO,CAAC,GAAG,CAAoE;IAC/E,OAAO,CAAC,QAAQ,CAA8C;IAC9D;uGACmG;IACnG,OAAO,CAAC,kBAAkB,CAAuB;IACjD,uFAAuF;IACvF,OAAO,CAAC,UAAU,CAAwD;IAG1E;;6GAEyG;IACzG,OAAO,CAAC,YAAY,CAAuB;IAC3C;sEACkE;IAClE,OAAO,CAAC,YAAY,CAAS;IAC7B,+FAA+F;IAC/F,OAAO,CAAC,UAAU,CAAK;IACvB,iGAAiG;IACjG,OAAO,CAAC,aAAa,CAAK;IAC1B;sFACkF;IAClF,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,YAAY,CAA8C;gBAEtD,IAAI,EAAE,qBAAqB;IAyBvC;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B5B,oGAAoG;IACpG,IAAI,IAAI,IAAI;IAaZ,8FAA8F;IAC9F,UAAU,IAAI,MAAM;IASpB,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,UAAU;IA6DlB,mFAAmF;IACnF,OAAO,CAAC,cAAc;IAOtB,+FAA+F;IAC/F,OAAO,CAAC,WAAW;IAoBnB,OAAO,CAAC,iBAAiB;IAUzB,qEAAqE;IACrE,OAAO,CAAC,QAAQ;YAUF,WAAW;IAkEzB;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IASnB,gGAAgG;IAChG,OAAO,CAAC,cAAc;IAWtB;;;6FAGyF;IACzF,OAAO,CAAC,cAAc;IAOtB;;uCAEmC;IACnC,OAAO,CAAC,YAAY;IAcpB,gGAAgG;IAChG,OAAO,CAAC,WAAW;IAQnB;;;;;6FAKyF;IACzF,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,aAAa;IAOrB;oGACgG;IAChG,OAAO,CAAC,aAAa;IAKrB;;;;;OAKG;YACW,YAAY;IA6B1B;;oGAEgG;IAChG,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;;;yGAKqG;IACrG,IAAI,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAErC;IAED;0GACsG;IACtG,OAAO,CAAC,cAAc;IAMtB;4GACwG;IACxG,OAAO,CAAC,OAAO;IAMf;yGACqG;IACrG,OAAO,CAAC,QAAQ;IAchB;;6GAEyG;IACzG,OAAO,CAAC,cAAc;IAUtB;;;oGAGgG;IAChG,OAAO,CAAC,iBAAiB;IAgBzB;wGACoG;IACpG,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,mBAAmB;CAO5B;AAED,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAqB5D"}
+{"version":3,"file":"live-sync-client.d.ts","sourceRoot":"","sources":["../src/live-sync-client.ts"],"names":[],"mappings":"AA+EA,OAAO,KAAK,EAAE,WAAW,EAAqC,WAAW,EAAa,MAAM,YAAY,CAAC;AAEzG,OAAO,EAUL,KAAK,SAAS,EACd,KAAK,eAAe,EAErB,MAAM,WAAW,CAAC;AAEnB;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,qGAAqG;AACrG,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,aAAa,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEjF,gFAAgF;AAChF,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,MAAM,GACN,cAAc,GACd,WAAW,GACX,OAAO,GACP,SAAS,CAAC;AAEd,6BAA6B;AAC7B,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,kDAAkD;AAClD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,IAAI,EAAE,YAAY,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,iGAAiG;IACjG,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;IAC5C,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,uDAAuD;IACvD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9D;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACzC;AAwBD,wGAAwG;AACxG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;GAIG;AACH,4GAA4G;AAC5G,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,MAAM,CAWT;AAiCD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA+B;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA4C;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAE1E,OAAO,CAAC,EAAE,CAA8B;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,CAAS;IACxB,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAA8B;IAC9C,gGAAgG;IAChG,OAAO,CAAC,aAAa,CAA6B;IAClD;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA8B;IAClD,gGAAgG;IAChG,OAAO,CAAC,cAAc,CAAS;IAC/B;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,WAAW,CAA6B;IAChD,gFAAgF;IAChF,OAAO,CAAC,SAAS,CAA6B;IAC9C,0GAA0G;IAC1G,OAAO,CAAC,WAAW,CAA2B;IAG9C;;;gGAG4F;IAC5F,OAAO,CAAC,YAAY,CAAM;IAC1B;qGACiG;IACjG,OAAO,CAAC,GAAG,CAAoE;IAC/E,OAAO,CAAC,QAAQ,CAA8C;IAC9D;uGACmG;IACnG,OAAO,CAAC,kBAAkB,CAAuB;IACjD,uFAAuF;IACvF,OAAO,CAAC,UAAU,CAAwD;IAG1E;;6GAEyG;IACzG,OAAO,CAAC,YAAY,CAAuB;IAC3C;sEACkE;IAClE,OAAO,CAAC,YAAY,CAAS;IAC7B,+FAA+F;IAC/F,OAAO,CAAC,UAAU,CAAK;IACvB,iGAAiG;IACjG,OAAO,CAAC,aAAa,CAAK;IAC1B;;;4GAGwG;IACxG,OAAO,CAAC,gBAAgB,CAAS;IACjC;;;;qGAIiG;IACjG,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,YAAY,CAA8C;IAClE;;wGAEoG;IACpG,OAAO,CAAC,YAAY,CAA8C;IAClE;2GACuG;IACvG,OAAO,CAAC,kBAAkB,CAA8C;IACxE;mGAC+F;IAC/F,OAAO,CAAC,YAAY,CAAS;IAC7B;;;;;+FAK2F;IAC3F,OAAO,CAAC,WAAW,CAA8C;gBAErD,IAAI,EAAE,qBAAqB;IAsCvC;;;;;OAKG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAoGtB,oGAAoG;IACpG,IAAI,IAAI,IAAI;IAuBZ,8FAA8F;IAC9F,UAAU,IAAI,MAAM;IASpB;;;;;OAKG;IACH,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,UAAU;IAqGlB,mFAAmF;IACnF,OAAO,CAAC,cAAc;IAOtB,+FAA+F;IAC/F,OAAO,CAAC,WAAW;IAoCnB,OAAO,CAAC,iBAAiB;IAUzB,qEAAqE;IACrE,OAAO,CAAC,QAAQ;YAUF,WAAW;IA0EzB;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;IAOlB;;;;;;;;;OASG;IACH,OAAO,CAAC,WAAW;IASnB,gGAAgG;IAChG,OAAO,CAAC,cAAc;IAWtB;;;6FAGyF;IACzF,OAAO,CAAC,cAAc;IAOtB;;uCAEmC;IACnC,OAAO,CAAC,YAAY;IAcpB,gGAAgG;IAChG,OAAO,CAAC,WAAW;IAQnB;;;;;6FAKyF;IACzF,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,aAAa;IAOrB;oGACgG;IAChG,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,aAAa;IA+FrB;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAsDpC;;;;;OAKG;YACW,YAAY;IAuB1B;;;;;;;;;;;;;OAaG;YACW,SAAS;IA0CvB;;oGAEgG;IAChG,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;;;yGAKqG;IACrG,IAAI,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAErC;IAED;0GACsG;IACtG,OAAO,CAAC,cAAc;IAMtB;;;4FAGwF;IACxF,OAAO,CAAC,OAAO;IASf;yGACqG;IACrG,OAAO,CAAC,QAAQ;IAchB;;6GAEyG;IACzG,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;yDAUqD;IACrD,OAAO,CAAC,iBAAiB;IAuBzB;wGACoG;IACpG,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,mBAAmB;IAW3B,2FAA2F;IAC3F,OAAO,CAAC,kBAAkB;CAU3B;AAED,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAqB5D"}