@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/submission-retry.js

@@ -0,0 +1,506 @@
+import { extractErrorMessage } from "./error-message.js";
+/**
+ * Send failures worth retrying — the ones that are NOT a verdict on the submission.
+ *
+ *   directory_unreachable / signaling_reconnecting / signaling_lost
+ *       Nothing reached anybody. This is the case the unit exists for.
+ *   submission_unsupported_by_node
+ *       The node never decoded the frame. Nodes deploy independently per region, so the reconnect
+ *       this rides may land on one that has the frame kind — which IS the failover case. It is not
+ *       a decision about the submission; the node did not get far enough to make one.
+ *   submission_write_timeout
+ *       The transport handed the frame over and no ack came back. Storage is UNKNOWN, which is
+ *       different from refused: re-sending is safe by the content-derived id, so the honest move is
+ *       to try again rather than to report a failure the operator cannot resolve either.
+ *
+ *   submission_refused_by_node
+ *       The node decoded it, evaluated it and said no. A retry cannot change that answer, and a
+ *       machine asking again is badgering a node that has already decided.
+ *   submission_agent_unloaded
+ *       Retry-path only, and terminal: nobody on this daemon can sign as the submitting agent any
+ *       more, so no amount of waiting produces a sender.
+ *
+ * A `Record`, NOT a hand-written list, and that is the whole point (review §4). A list is a loop
+ * over what the author typed; adding a seventh member to `SubmissionSendFailure` left the old test
+ * green while the new member defaulted into "not retried" in silence. A total record fails to
+ * COMPILE until someone decides — and it lives here rather than in a test, because
+ * `core/daemon/tsconfig.json` excludes `src/__tests__`, so a compile-time pin there is never
+ * evaluated and asserts nothing (`signal-submission.ts` calls that "a hollow test wearing
+ * compile-time clothing").
+ */
+const RETRY_DECISION = {
+    directory_unreachable: true,
+    signaling_reconnecting: true,
+    signaling_lost: true,
+    submission_unsupported_by_node: true,
+    submission_write_timeout: true,
+    submission_refused_by_node: false,
+    submission_agent_unloaded: false,
+};
+const RETRYABLE_SEND_FAILURES = new Set(Object.keys(RETRY_DECISION).filter((r) => RETRY_DECISION[r]));
+/**
+ * Failures that say something about OUR local preconditions rather than about the submission.
+ *
+ * These retry on the same backoff but do NOT consume the attempt budget — they are bounded by the
+ * retry WINDOW instead, so a genuinely dead network still stops eventually. Straight from
+ * `restart-seal-resolver.ts`'s `LOCAL_PRECONDITION_REFUSALS`, for the same reason: without it a
+ * flapping stream durably gives up on work that was never in question.
+ */
+const LOCAL_PRECONDITION_FAILURES = new Set([
+    "directory_unreachable",
+    "signaling_reconnecting",
+    "signaling_lost",
+]);
+export function isRetryableSendFailure(reason) {
+    return RETRYABLE_SEND_FAILURES.has(reason);
+}
+const DEFAULT_STAGGER_MS = 5_000;
+const DEFAULT_MAX_ATTEMPTS = 5;
+/**
+ * How long to wait before re-trying a LOCAL PRECONDITION failure.
+ *
+ * Deliberately not the stagger. When the stream is down `sendRaw` returns without touching the
+ * network, so a stagger-paced retry would be nearly free and nearly useless — 720 attempts and 720
+ * log lines in an hour, none of which could have succeeded. The reconnect callback is the real
+ * trigger; this is only the backstop for a reconnect that never fires, so it is paced against the
+ * ~70-second stream turnover rather than against impatience.
+ */
+const LOCAL_PRECONDITION_RETRY_MS = 60_000;
+/** Doubles from here, so five attempts span roughly fifteen minutes. */
+const BASE_BACKOFF_MS = 30_000;
+/**
+ * One hour. Chosen against the intake key, not against patience: the queued blob is sealed to the
+ * intake key the manifest published at compose time, and a manifest window is measured in weeks.
+ *
+ * THIS COMMENT USED TO ASSERT THAT AN HOUR "CANNOT OUTLIVE THE KEY", AND THAT WAS AN UNCHECKED
+ * CLAIM (review M4). It holds only when the manifest has more than an hour left at compose time.
+ * `composeSealedSubmission` refuses an already-expired manifest, but nothing stopped a submission
+ * composed one minute before expiry from being held and re-sent for the next fifty-nine — and the
+ * portal's rotated-key retention does not cover it either, because that rule keeps a retired key
+ * "until no undrained row references it" (M10B-D11) and a HELD submission has no row at any node.
+ * The result is exactly the state the expiry gate exists to prevent: a blob the portal cannot open
+ * and cannot attribute, arriving as poison with no reply possible — while the operator has been
+ * told it is held and needs nothing from them.
+ *
+ * So the CALLER checks rather than this comment asserting. See the enqueue site in `daemon.ts`,
+ * which has the manifest in hand and refuses to hold a submission whose intake key would expire
+ * inside this window.
+ */
+export const DEFAULT_RETRY_WINDOW_MS = 60 * 60_000;
+const DEFAULT_QUEUE_CAP = 32;
+/** What the operator does about a submission still in flight. Named verb, real parameterless call. */
+const RETRYING_GUIDANCE = "The daemon is retrying this submission on its own — it is sealed and held, and it goes out as " +
+    "soon as the directory signaling stream is back. You do not need to send it again. Run " +
+    "cello_attestations_issued to see where it got to. It is held IN MEMORY: if the daemon restarts " +
+    "before it lands, it is gone and you will have to write it again — re-sending is safe either way, " +
+    "the submission id is derived from the content.";
+function gaveUpGuidance(reason, last) {
+    const shared = "Nothing was minted and nothing was recorded at a directory. Re-submitting is safe — the " +
+        "submission id is derived from the content, so a re-send is stored once, not twice — but the " +
+        "text is not kept on this machine, so you have to write it again: run cello_attestations_issue " +
+        "with the same subject.";
+    switch (reason) {
+        case "attempts_exhausted":
+            // "ANSWERED" WAS WRONG (review L8). The only reason that normally exhausts this budget is
+            // `submission_write_timeout` — where the node answered NOTHING, which is what the reason
+            // means — and `submission_unsupported_by_node`, where it answered `not_authenticated`, a
+            // frame `sendSealedSubmission` deliberately refuses to treat as an answer.
+            return (`The daemon retried this submission until it ran out of attempts; the last attempt ended ` +
+                `in '${last}'. ${shared}`);
+        case "retry_window_elapsed":
+            return (`The daemon held this submission for an hour and the directory signaling stream never came ` +
+                `back (last state '${last}'). Check the daemon's directory connection with cello_status ` +
+                `first — this is a connectivity problem, not a rejection. ${shared}`);
+        case "refused_by_node":
+            // Reached only when a node refuses mid-retry AND gives no reason of its own; the node's
+            // words win whenever it has any. Even here it must not read as a network problem.
+            return ("A directory node decoded this submission and refused it. That is a decision about the " +
+                "submission, not a connectivity problem, so it will not be retried — sending it again " +
+                "unchanged will be refused again. " + shared);
+        case "agent_unloaded":
+            return ("This daemon can no longer sign as the agent that wrote this submission, so the held bytes " +
+                "cannot be sent by anyone. Start the agent with cello_start_agent, then issue it again. " +
+                shared);
+    }
+}
+function defaultSchedule(fn, ms) {
+    const t = setTimeout(fn, ms);
+    // A background retry must never be the reason a daemon will not exit.
+    t.unref?.();
+    return { cancel: () => clearTimeout(t) };
+}
+/**
+ * The retry queue. One per daemon; keyed by (agentId, submissionId) because two agents on one
+ * daemon can each submit about the same subject and the rows are per-agent facts.
+ */
+export class SubmissionRetryQueue {
+    #deps;
+    #now;
+    #schedule;
+    #staggerMs;
+    #maxAttempts;
+    #retryWindowMs;
+    #localPreconditionRetryMs;
+    #baseBackoffMs;
+    #queueCap;
+    /** Live retries. An entry leaves on acceptance or on give-up. */
+    #queue = new Map();
+    /**
+     * Given-up submissions, kept so the operator surface can SHOW the terminal state. A give-up whose
+     * only consumer is a log line is indistinguishable from the submission never having existed,
+     * which is exactly the silence this unit exists to end. Bounded by the same cap.
+     */
+    #gaveUp = [];
+    #timer = null;
+    #running = false;
+    #stopped = false;
+    constructor(deps) {
+        this.#deps = deps;
+        this.#now = deps.now ?? (() => Date.now());
+        this.#schedule = deps.schedule ?? defaultSchedule;
+        this.#staggerMs = deps.staggerMs ?? DEFAULT_STAGGER_MS;
+        this.#maxAttempts = deps.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+        this.#retryWindowMs = deps.retryWindowMs ?? DEFAULT_RETRY_WINDOW_MS;
+        this.#localPreconditionRetryMs = deps.localPreconditionRetryMs ?? LOCAL_PRECONDITION_RETRY_MS;
+        this.#baseBackoffMs = deps.baseBackoffMs ?? BASE_BACKOFF_MS;
+        this.#queueCap = deps.queueCap ?? DEFAULT_QUEUE_CAP;
+    }
+    /**
+     * Take ownership of a submission whose send failed for a retryable reason.
+     *
+     * Returns `false` when the queue is full, and the caller then reports the plain failure — an
+     * operator who is told "the daemon has it" about a submission the daemon dropped is worse off
+     * than one who is told it failed, because only the second knows to act.
+     */
+    enqueue(item, lastReason) {
+        if (this.#stopped)
+            return false;
+        const key = `${item.agentId}:${item.submissionId}`;
+        // Idempotent on the content-derived id: re-submitting the same body while a retry is pending is
+        // the SAME submission, not a second one.
+        if (this.#queue.has(key))
+            return true;
+        if (this.#queue.size >= this.#queueCap) {
+            this.#deps.logger.warn("signal.submission.retry.queue_full", {
+                agentName: item.agentName,
+                submissionId: item.submissionId,
+                cap: this.#queueCap,
+                impact: "this submission is NOT held for retry — the operator is told it failed and must re-send",
+            });
+            return false;
+        }
+        const now = this.#now();
+        this.#queue.set(key, {
+            item,
+            attempts: 0,
+            totalSends: 0,
+            enqueuedAt: now,
+            // Deliberately NOT now: the stream is down, and an immediate attempt spends the stagger on a
+            // connection that does not exist. The reconnect is what makes it due.
+            nextAt: now + this.#staggerMs,
+            delivery: {
+                state: "retrying",
+                attempts: 0,
+                lastReason,
+                nextAttemptAt: now + this.#staggerMs,
+                guidance: RETRYING_GUIDANCE,
+            },
+        });
+        this.#deps.logger.info("signal.submission.retry.enqueued", {
+            agentName: item.agentName,
+            submissionId: item.submissionId,
+            op: item.op,
+            reason: lastReason,
+            pending: this.#queue.size,
+        });
+        this.#arm(this.#staggerMs);
+        return true;
+    }
+    /**
+     * The agent's directory signaling stream reached 'connected' — the first connect and every
+     * reconnect after a drop. THIS IS THE FAILOVER. Which node it landed on is not this module's
+     * business and is deliberately not read.
+     */
+    onSignalingConnected(agentName) {
+        if (this.#stopped)
+            return;
+        const now = this.#now();
+        let woke = 0;
+        for (const entry of this.#queue.values()) {
+            if (entry.item.agentName !== agentName)
+                continue;
+            entry.nextAt = now;
+            // Only live entries are in `#queue`, so this is always the retrying shape — written out
+            // rather than spread, so a later member of the union cannot be silently mangled by a cast.
+            entry.delivery = {
+                state: "retrying",
+                attempts: entry.attempts,
+                lastReason: entry.delivery.lastReason,
+                nextAttemptAt: now,
+                guidance: RETRYING_GUIDANCE,
+            };
+            woke += 1;
+        }
+        if (woke === 0)
+            return;
+        this.#deps.logger.info("signal.submission.retry.woken", { agentName, count: woke });
+        this.#arm(0);
+    }
+    /**
+     * What this agent still has in flight, and what was given up on. Read by `wallet_list_issued`,
+     * which is the surface behind `cello_attestations_issued` — the verb whose whole question is
+     * "what happened to what I sent?".
+     */
+    list(agentId) {
+        const views = [];
+        for (const entry of [...this.#queue.values(), ...this.#gaveUp]) {
+            if (entry.item.agentId !== agentId)
+                continue;
+            views.push({
+                submissionId: entry.item.submissionId,
+                op: entry.item.op,
+                subject: entry.item.subject,
+                intakeKeyId: entry.item.intakeKeyId,
+                delivery: entry.delivery,
+            });
+        }
+        return views;
+    }
+    /**
+     * A submission finally landed by some other route — the operator re-issued it, and the
+     * first-pass send succeeded. Drop any give-up recorded for it (review L9).
+     *
+     * The id is content-derived, so re-issuing the SAME words about the SAME subject produces the
+     * SAME id: this is precisely the "I wrote it again and it worked" case. Without it the operator
+     * sees the old failure and the new accepted row side by side for the life of the daemon, with no
+     * way to dismiss the one that is no longer true.
+     */
+    clearGaveUp(agentId, submissionId) {
+        const at = this.#gaveUp.findIndex((e) => e.item.agentId === agentId && e.item.submissionId === submissionId);
+        if (at === -1)
+            return;
+        this.#gaveUp.splice(at, 1);
+        this.#deps.logger.info("signal.submission.retry.gave_up.cleared", {
+            agentId,
+            submissionId,
+            impact: "a later send of the same submission succeeded, so the earlier give-up no longer stands",
+        });
+    }
+    /**
+     * Stop, and start nothing further.
+     *
+     * EVERY DROPPED SUBMISSION IS NAMED (review H2). The queue is in memory by design, but the
+     * operator was told in as many words "you do NOT need to run this again" — and before this, a
+     * restart left no durable trace anywhere naming what had been lost. A comment in the composition
+     * root asserting "in memory by design" is not a record; these lines are.
+     *
+     * The SUBJECT is logged and the body is not: the subject is a pubkey or a signal hash, and the
+     * body is the operator's own words about a third party, which this whole path exists to keep out
+     * of the clear on disk.
+     */
+    stop() {
+        this.#stopped = true;
+        this.#timer?.cancel();
+        this.#timer = null;
+        for (const entry of this.#queue.values()) {
+            this.#deps.logger.warn("signal.submission.retry.dropped_on_shutdown", {
+                agentName: entry.item.agentName,
+                submissionId: entry.item.submissionId,
+                op: entry.item.op,
+                subject: entry.item.subject,
+                attempts: entry.attempts,
+                sends: entry.totalSends,
+                impact: "it reached no directory node and the daemon is stopping — it must be issued again",
+            });
+        }
+        this.#queue.clear();
+    }
+    #arm(delayMs) {
+        if (this.#stopped)
+            return;
+        if (this.#queue.size === 0)
+            return;
+        this.#timer?.cancel();
+        this.#timer = this.#schedule(() => {
+            this.#timer = null;
+            void this.#pump();
+        }, delayMs);
+    }
+    /**
+     * Arm for whichever entry is due SOONEST, floored at the stagger so a queue is never a burst.
+     *
+     * It used to arm unconditionally at the stagger, which was right for the "one just finished"
+     * case and wrong for every other: an entry re-armed 60 seconds out would still be woken every 5
+     * seconds, and conversely a failing entry's own long wait used to be armed on behalf of siblings
+     * that were already due (review M7).
+     */
+    #armIfWork() {
+        if (this.#queue.size === 0)
+            return;
+        const now = this.#now();
+        let earliest = Infinity;
+        for (const entry of this.#queue.values())
+            earliest = Math.min(earliest, entry.nextAt);
+        this.#arm(Math.max(this.#staggerMs, earliest - now));
+    }
+    async #pump() {
+        if (this.#stopped || this.#running || this.#queue.size === 0)
+            return;
+        const now = this.#now();
+        let due = null;
+        for (const entry of this.#queue.values()) {
+            if (entry.nextAt <= now && (due === null || entry.nextAt < due.nextAt))
+                due = entry;
+        }
+        if (due === null) {
+            let earliest = Infinity;
+            for (const entry of this.#queue.values())
+                earliest = Math.min(earliest, entry.nextAt);
+            if (earliest !== Infinity)
+                this.#arm(Math.max(0, earliest - now));
+            return;
+        }
+        const entry = due;
+        const key = `${entry.item.agentId}:${entry.item.submissionId}`;
+        entry.totalSends += 1;
+        this.#running = true;
+        let result;
+        try {
+            result = await this.#deps.send(entry.item);
+        }
+        catch (err) {
+            // A thrown send is not a decision about the submission either — it is our own transport
+            // falling over. Treated as the local precondition it is.
+            this.#deps.logger.warn("signal.submission.retry.threw", {
+                agentName: entry.item.agentName,
+                submissionId: entry.item.submissionId,
+                error: extractErrorMessage(err),
+            });
+            result = { ok: false, reason: "directory_unreachable", guidance: "" };
+        }
+        finally {
+            this.#running = false;
+        }
+        /**
+         * AN ACCEPTANCE IS RECORDED EVEN IF WE ARE SHUTTING DOWN, and the `#stopped` check sits BELOW
+         * this branch for that reason (review H1).
+         *
+         * `stop()` does not await the send in flight. Checking `#stopped` first meant a node that
+         * accepted the submission during shutdown produced no `onAccepted`, no log line, and no row in
+         * `issued_submissions` — while the portal went on to mint it. The endorsement is real and the
+         * operator holds no handle to it, so it can never be withdrawn: `recordIssuedSubmission`'s own
+         * comment is "KEEP THE HANDLE, or a withdrawal has nothing to name."
+         *
+         * The log line goes out FIRST and carries the subject, so even if the database is already
+         * closed the handle survives in `daemon.log`. A bare `return` here was the worst of the three
+         * available options.
+         */
+        if (result.ok) {
+            this.#queue.delete(key);
+            this.#deps.logger.info("signal.submission.retry.accepted", {
+                agentName: entry.item.agentName,
+                submissionId: entry.item.submissionId,
+                op: entry.item.op,
+                // The SUBJECT, so this line alone is enough to reconstruct the handle if the write below
+                // cannot run. It is a pubkey or a signal hash — never the operator's words.
+                subject: entry.item.subject,
+                intakeKeyId: entry.item.intakeKeyId,
+                sends: entry.totalSends,
+                stored: result.stored,
+                ...(this.#stopped ? { duringShutdown: true } : {}),
+            });
+            try {
+                this.#deps.onAccepted(entry.item, result.stored);
+            }
+            catch (err) {
+                // Best-effort, exactly as the first-pass record write is: the submission IS accepted, and
+                // failing over a local bookkeeping write would invite a re-send of something already queued.
+                this.#deps.logger.error("signal.submission.retry.record_failed", {
+                    agentName: entry.item.agentName,
+                    submissionId: entry.item.submissionId,
+                    subject: entry.item.subject,
+                    error: extractErrorMessage(err),
+                });
+            }
+            if (!this.#stopped)
+                this.#armIfWork();
+            return;
+        }
+        // Below here everything is bookkeeping for a FUTURE attempt, and a stopped queue makes none.
+        if (this.#stopped)
+            return;
+        // A NON-RETRYABLE FAILURE ARRIVING MID-RETRY IS TERMINAL, AND IT KEEPS ITS OWN NAME (review
+        // H3). Stamping these `attempts_exhausted` printed a transport story — with `attempts: 0` beside
+        // it — for a quota refusal, in the one field a machine consumer branches on.
+        if (!isRetryableSendFailure(result.reason)) {
+            this.#giveUp(key, entry, result.reason, result.reason === "submission_agent_unloaded" ? "agent_unloaded" : "refused_by_node", result.guidance);
+            return;
+        }
+        const localPrecondition = LOCAL_PRECONDITION_FAILURES.has(result.reason);
+        if (!localPrecondition)
+            entry.attempts += 1;
+        const windowElapsed = this.#now() - entry.enqueuedAt >= this.#retryWindowMs;
+        if (windowElapsed) {
+            this.#giveUp(key, entry, result.reason, "retry_window_elapsed");
+            return;
+        }
+        if (!localPrecondition && entry.attempts >= this.#maxAttempts) {
+            this.#giveUp(key, entry, result.reason, "attempts_exhausted");
+            return;
+        }
+        const waitMs = localPrecondition
+            ? this.#localPreconditionRetryMs
+            : this.#baseBackoffMs * 2 ** Math.max(0, entry.attempts - 1);
+        entry.nextAt = this.#now() + waitMs;
+        entry.delivery = {
+            state: "retrying",
+            attempts: entry.attempts,
+            lastReason: result.reason,
+            nextAttemptAt: entry.nextAt,
+            guidance: RETRYING_GUIDANCE,
+        };
+        this.#deps.logger.info("signal.submission.retry.waiting", {
+            agentName: entry.item.agentName,
+            submissionId: entry.item.submissionId,
+            attempts: entry.attempts,
+            sends: entry.totalSends,
+            reason: result.reason,
+            localPrecondition,
+            retryInMs: waitMs,
+        });
+        // ARM FOR THE EARLIEST DEADLINE IN THE QUEUE, not for this entry's (review M7). A reconnect
+        // makes EVERY held submission for that agent due at once; arming on the failing entry's own
+        // 60-second wait sent the rest back to sleep on a stream that was up, so throughput collapsed
+        // to one send per minute regardless of queue depth — defeating the stagger this module claims.
+        this.#armIfWork();
+    }
+    #giveUp(key, entry, lastReason, because, nodeGuidance) {
+        this.#queue.delete(key);
+        entry.delivery = {
+            state: "gave_up",
+            attempts: entry.attempts,
+            lastReason,
+            gaveUpBecause: because,
+            // The NODE'S OWN words survive when it gave any — a refusal on the merits names something
+            // this module cannot know. Ours is the fallback, never the replacement.
+            guidance: nodeGuidance && nodeGuidance.length > 0 ? nodeGuidance : gaveUpGuidance(because, lastReason),
+        };
+        this.#gaveUp.push(entry);
+        while (this.#gaveUp.length > this.#queueCap)
+            this.#gaveUp.shift();
+        this.#deps.logger.warn("signal.submission.retry.gave_up", {
+            agentName: entry.item.agentName,
+            submissionId: entry.item.submissionId,
+            op: entry.item.op,
+            attempts: entry.attempts,
+            sends: entry.totalSends,
+            reason: lastReason,
+            // WHY it stopped, not just that it did — "we ran out of tries" and "the network never came
+            // back" lead to different operator actions.
+            stoppedBecause: because,
+            impact: "this trust signal reached no directory node; it is visible as gave_up in cello_attestations_issued",
+        });
+        this.#armIfWork();
+    }
+}
+//# sourceMappingURL=submission-retry.js.map

package/dist/submission-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-retry.js","sourceRoot":"","sources":["../src/submission-retry.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,cAAc,GAAqD;IACvE,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,IAAI;IAC5B,cAAc,EAAE,IAAI;IACpB,8BAA8B,EAAE,IAAI;IACpC,wBAAwB,EAAE,IAAI;IAC9B,0BAA0B,EAAE,KAAK;IACjC,yBAAyB,EAAE,KAAK;CACjC,CAAC;AAEF,MAAM,uBAAuB,GAAuC,IAAI,GAAG,CACxE,MAAM,CAAC,IAAI,CAAC,cAAc,CAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAC1F,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAuC,IAAI,GAAG,CAAwB;IACrG,uBAAuB;IACvB,wBAAwB;IACxB,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,MAA6B;IAClE,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAmGD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B;;;;;;;;GAQG;AACH,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,wEAAwE;AACxE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,sGAAsG;AACtG,MAAM,iBAAiB,GACrB,gGAAgG;IAChG,wFAAwF;IACxF,iGAAiG;IACjG,mGAAmG;IACnG,gDAAgD,CAAC;AAEnD,SAAS,cAAc,CAAC,MAA8B,EAAE,IAA2B;IACjF,MAAM,MAAM,GACV,0FAA0F;QAC1F,8FAA8F;QAC9F,gGAAgG;QAChG,wBAAwB,CAAC;IAC3B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,CACL,0FAA0F;gBAC1F,OAAO,IAAI,MAAM,MAAM,EAAE,CAC1B,CAAC;QACJ,KAAK,sBAAsB;YACzB,OAAO,CACL,4FAA4F;gBAC5F,qBAAqB,IAAI,gEAAgE;gBACzF,4DAA4D,MAAM,EAAE,CACrE,CAAC;QACJ,KAAK,iBAAiB;YACpB,wFAAwF;YACxF,kFAAkF;YAClF,OAAO,CACL,wFAAwF;gBACxF,uFAAuF;gBACvF,mCAAmC,GAAG,MAAM,CAC7C,CAAC;QACJ,KAAK,gBAAgB;YACnB,OAAO,CACL,4FAA4F;gBAC5F,yFAAyF;gBACzF,MAAM,CACP,CAAC;IACN,CAAC;AACH,CAAC;AAYD,SAAS,eAAe,CAAC,EAAc,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7B,sEAAsE;IACtE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IACtB,KAAK,CAA2B;IAChC,IAAI,CAAe;IACnB,SAAS,CAAgD;IACzD,UAAU,CAAS;IACnB,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,yBAAyB,CAAS;IAClC,cAAc,CAAS;IACvB,SAAS,CAAS;IAE3B,iEAAiE;IACxD,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC/C;;;;OAIG;IACM,OAAO,GAAgB,EAAE,CAAC;IAEnC,MAAM,GAAyB,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACpE,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC,wBAAwB,IAAI,2BAA2B,CAAC;QAC9F,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAuB,EAAE,UAAiC;QAChE,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACnD,gGAAgG;QAChG,yCAAyC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,GAAG,EAAE,IAAI,CAAC,SAAS;gBACnB,MAAM,EAAE,yFAAyF;aAClG,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,IAAI;YACJ,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,GAAG;YACf,6FAA6F;YAC7F,sEAAsE;YACtE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU;YAC7B,QAAQ,EAAE;gBACR,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,CAAC;gBACX,UAAU;gBACV,aAAa,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU;gBACpC,QAAQ,EAAE,iBAAiB;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YACzD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,SAAiB;QACpC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YACjD,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YACnB,wFAAwF;YACxF,2FAA2F;YAC3F,KAAK,CAAC,QAAQ,GAAG;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;gBACrC,aAAa,EAAE,GAAG;gBAClB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC;YACF,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAAe;QAClB,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YAC7C,KAAK,CAAC,IAAI,CAAC;gBACT,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;gBACrC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;gBACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,OAAe,EAAE,YAAoB;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,YAAY,CAC1E,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;YAChE,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,wFAAwF;SACjG,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACpE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;gBACrC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;gBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,UAAU;gBACvB,MAAM,EAAE,mFAAmF;aAC5F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACnC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,UAAU;QACR,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,QAAQ,GAAG,QAAQ,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAErE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,GAAqB,IAAI,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBAAE,GAAG,GAAG,KAAK,CAAC;QACtF,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACtF,IAAI,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/D,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,wFAAwF;YACxF,yDAAyD;YACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBACtD,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;gBACrC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;YACH,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QAED;;;;;;;;;;;;;WAaG;QACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACzD,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;gBACrC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;gBACjB,yFAAyF;gBACzF,4EAA4E;gBAC5E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;gBAC3B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;gBACnC,KAAK,EAAE,KAAK,CAAC,UAAU;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,0FAA0F;gBAC1F,6FAA6F;gBAC7F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC/D,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;oBAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;oBACrC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;oBAC3B,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,6FAA6F;QAC7F,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,4FAA4F;QAC5F,iGAAiG;QACjG,6EAA6E;QAC7E,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CACV,GAAG,EACH,KAAK,EACL,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,KAAK,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,EACpF,MAAM,CAAC,QAAQ,CAChB,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,iBAAiB;YAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;QAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,CAAC;QAC5E,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB;YAC9B,CAAC,CAAC,IAAI,CAAC,yBAAyB;YAChC,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC;QACpC,KAAK,CAAC,QAAQ,GAAG;YACf,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,aAAa,EAAE,KAAK,CAAC,MAAM;YAC3B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YACxD,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,iBAAiB;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,4FAA4F;QAC5F,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,CACL,GAAW,EACX,KAAgB,EAChB,UAAiC,EACjC,OAA+B,EAC/B,YAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,CAAC,QAAQ,GAAG;YACf,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU;YACV,aAAa,EAAE,OAAO;YACtB,0FAA0F;YAC1F,wEAAwE;YACxE,QAAQ,EAAE,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC;SACvG,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YACxD,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;YACrC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,MAAM,EAAE,UAAU;YAClB,2FAA2F;YAC3F,4CAA4C;YAC5C,cAAc,EAAE,OAAO;YACvB,MAAM,EAAE,oGAAoG;SAC7G,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/telegram-bot-client.d.ts

@@ -0,0 +1,34 @@
+/**
+ * M8C-TGDOOR-1: the Telegram Bot API adapter — an interface + a real HTTP implementation, per the
+ * M4+ rule ("every external dependency is behind an interface... never call it directly from
+ * application code"). Tests inject a fake implementing the same interface; no real network.
+ */
+export interface TelegramUpdate {
+    update_id: number;
+    message?: {
+        chat: {
+            id: number | string;
+        };
+        text?: string;
+        message_id: number;
+    };
+}
+export interface TelegramBotClient {
+    /** Long-poll for updates since `offset` (the next update_id to fetch), waiting up to
+     *  `timeoutSec` for one to arrive. Returns an empty array on timeout (not an error). */
+    getUpdates(offset: number, timeoutSec: number): Promise<TelegramUpdate[]>;
+    sendMessage(chatId: string, text: string): Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+}
+export declare class HttpTelegramBotClient implements TelegramBotClient {
+    private readonly botToken;
+    constructor(botToken: string);
+    getUpdates(offset: number, timeoutSec: number): Promise<TelegramUpdate[]>;
+    sendMessage(chatId: string, text: string): Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+}
+//# sourceMappingURL=telegram-bot-client.d.ts.map

package/dist/telegram-bot-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-bot-client.d.ts","sourceRoot":"","sources":["../src/telegram-bot-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC;QAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC;4FACwF;IACxF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1E,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrF;AAED,qBAAa,qBAAsB,YAAW,iBAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAezE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAU1F"}

package/dist/telegram-bot-client.js

@@ -0,0 +1,36 @@
+/**
+ * M8C-TGDOOR-1: the Telegram Bot API adapter — an interface + a real HTTP implementation, per the
+ * M4+ rule ("every external dependency is behind an interface... never call it directly from
+ * application code"). Tests inject a fake implementing the same interface; no real network.
+ */
+export class HttpTelegramBotClient {
+    botToken;
+    constructor(botToken) {
+        this.botToken = botToken;
+    }
+    async getUpdates(offset, timeoutSec) {
+        const url = `https://api.telegram.org/bot${this.botToken}/getUpdates?offset=${offset}&timeout=${timeoutSec}`;
+        const res = await fetch(url);
+        const body = (await res.json());
+        // Reviewer HIGH fix: fetch() does not throw on a non-2xx/ok:false Telegram response (e.g. a
+        // revoked token returns HTTP 200 with {ok:false}) — treating that the same as "genuinely no
+        // updates waiting" (an empty array) silently hides a misconfigured/dead bot forever, since the
+        // poller's only error-observability path is its catch block, which this never reached. THROW
+        // so the caller's catch/backoff/log path actually fires.
+        if (!body.ok) {
+            throw new Error(`telegram_get_updates_failed: ${body.description ?? "unknown_telegram_error"}`);
+        }
+        return body.result ?? [];
+    }
+    async sendMessage(chatId, text) {
+        const url = `https://api.telegram.org/bot${this.botToken}/sendMessage`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ chat_id: chatId, text }),
+        });
+        const body = (await res.json());
+        return body.ok ? { ok: true } : { ok: false, error: body.description ?? "unknown_telegram_error" };
+    }
+}
+//# sourceMappingURL=telegram-bot-client.js.map

package/dist/telegram-bot-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-bot-client.js","sourceRoot":"","sources":["../src/telegram-bot-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,UAAkB;QACjD,MAAM,GAAG,GAAG,+BAA+B,IAAI,CAAC,QAAQ,sBAAsB,MAAM,YAAY,UAAU,EAAE,CAAC;QAC7G,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqE,CAAC;QACpG,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,WAAW,IAAI,wBAAwB,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,IAAY;QAC5C,MAAM,GAAG,GAAG,+BAA+B,IAAI,CAAC,QAAQ,cAAc,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;QACzE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,wBAAwB,EAAE,CAAC;IACrG,CAAC;CACF"}

package/dist/telegram-doorbell.d.ts

@@ -0,0 +1,38 @@
+/**
+ * M8C-TGDOOR-1: the Telegram doorbell.
+ *
+ * A daemon-owned bot pushes discrete, CONTENT-FREE events (session request / message waiting /
+ * state change) to one allowlisted operator chat. It is a convenience, never load-bearing: a
+ * network hiccup backs off and retries rather than killing the poller, and an unconfigured
+ * doorbell is INERT, not an error.
+ *
+ * Two invariants worth stating at the boundary, because the boundary is what enforces them now:
+ *
+ *   DOD-INV-CONTENTFREE — the doorbell sends a fixed label per event kind, NEVER message text.
+ *     This module cannot leak conversation content because it is never given any: its whole
+ *     dependency list is a logger, the stored settings, and a bot client.
+ *   D6 — an inbound Telegram message from ANY chat is acknowledged and dropped. Nothing from
+ *     Telegram enters a CELLO content path. Inside startDaemon that was a promise; here it is
+ *     structural — there is no session-send seam in this module to abuse.
+ */
+import { type TelegramBotClient } from "./telegram-bot-client.js";
+import type { Logger } from "./types.js";
+export interface TelegramDoorbellDeps {
+    logger: Logger;
+    /** The persisted bot token + allowlisted chat id, or null when TGDOOR was never configured. */
+    getTelegramSettings: () => {
+        botToken: string;
+        allowlistedChatId: string;
+    } | null;
+    /** Test injection. Production passes nothing and a real HttpTelegramBotClient is built per token. */
+    injectedClient?: TelegramBotClient | null;
+}
+export interface TelegramDoorbell {
+    sendTelegramDoorbell: (agentName: string, sessionId: string, kind: "session_request" | "message_waiting" | "state_change", detail: string) => Promise<void>;
+    clearTelegramRung: (agentName: string, sessionId: string) => void;
+    startTelegramPollerIfConfigured: () => void;
+    /** Shutdown: invalidate the running loop. It exits on its next generation check. */
+    stopTelegramPoller: () => void;
+}
+export declare function createTelegramDoorbell(deps: TelegramDoorbellDeps): TelegramDoorbell;
+//# sourceMappingURL=telegram-doorbell.d.ts.map

package/dist/telegram-doorbell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telegram-doorbell.d.ts","sourceRoot":"","sources":["../src/telegram-doorbell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,mBAAmB,EAAE,MAAM;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClF,qGAAqG;IACrG,cAAc,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,cAAc,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5J,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,+BAA+B,EAAE,MAAM,IAAI,CAAC;IAC5C,oFAAoF;IACpF,kBAAkB,EAAE,MAAM,IAAI,CAAC;CAChC;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CA+HnF"}