@cotal-ai/core 0.12.0 → 0.13.1

package/dist/endpoint-virtual.js

@@ -0,0 +1,440 @@
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { epwStreamName, poolDurable, canonConsumerConfig, epjStreamName, canonDurable } from "./endpoint-binding.js";
+import { AckPolicy, jetstreamManager } from "@nats-io/jetstream";
+import { reconcileWorkItem, assertWorkPoolContext, } from "./endpoint-work.js";
+import { mintSupervisorWrite } from "./endpoint-supervisor.js";
+import { writeServiceStatus, parseServiceStatus, parseServiceSpec, parseActivationPolicy, SERVICE_ESCALATED, SERVICE_EXITED, SERVICE_RESTART_HISTORY_FIELD, SERVICE_RETIRED_MARK_FIELD, } from "./endpoint-service.js";
+import { RECORD_KINDS, recordSpecKey, recordStatusKey, updateRecordEntry, readRecordLeader } from "./endpoint-records.js";
+import { assertLifecycleToken, endpointToken, assertPoolToken } from "./endpoint-subjects.js";
+import { spacePrefix, assertInboxConnId } from "./subjects.js";
+function invalid(what) {
+    throw new EpEnvelopeError("contract-invalid", `${what} (SPEC 13.6 virtual)`);
+}
+const uint = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+const isRec = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const ACTIVATOR_CONTEXTS = new WeakSet();
+export async function activatorContext(nc, space) {
+    spacePrefix(space); // boundary guard: usable space token, throws otherwise
+    const ctx = Object.freeze({ jsm: await jetstreamManager(nc, { checkAPI: false }), space });
+    ACTIVATOR_CONTEXTS.add(ctx);
+    return ctx;
+}
+/** The activator principal's COMPLETE broker authority (§13.6/§13.9): the exact per-pool
+ *  Consumer INFO PUBLISH row plus — since Consumer INFO is a request/reply call — the
+ *  CONNECTION-SCOPED reply inbox SUBSCRIBE row `_INBOX_<connId>.>` (never account-wide
+ *  `_INBOX.>`, which is cross-connection reply-read authority). The start is a mediated,
+ *  target-bound seam (off-broker or its own ep rail), so it contributes no row here; NOTHING
+ *  else — no MSG.NEXT/ACK, no EPW STREAM.MSG.GET, no consumer create/update/delete, no EPW
+ *  publish. The credential's OWN lifetime/renewal/lifecycle-UID binding rides the production
+ *  activator provisioning (the named manager-wiring slice); this is the confined subject set.
+ *  `connId` is the connection's validated inbox nonce (the same `_INBOX_<connId>` prefix the
+ *  connection sets); omit it to get the publish half alone. */
+export function activatorGrants(space, endpoint, pool, connId) {
+    const publish = [`$JS.API.CONSUMER.INFO.${epwStreamName(space)}.${poolDurable(endpoint, pool)}`];
+    const subscribe = connId !== undefined ? [`_INBOX_${assertInboxConnId(connId)}.>`] : [];
+    return { publish, subscribe };
+}
+/**
+ * Read the pool's occupancy FRESH from the exact per-pool Consumer INFO (request/reply
+ * snapshot; leader-routed like every JS API call). FAIL CLOSED, never fabricated — and every
+ * EDITABLE knob the count depends on is re-proved at EVERY read, because a post-create
+ * consumer edit must not silently falsify the fence:
+ *  - a missing or unreadable consumer is `unavailable` (an admission fence cannot treat
+ *    ignorance as an empty pool);
+ *  - a reported `max_deliver` other than -1 (unlimited) is `failed-precondition`
+ *    ({@link poolConsumerConfig} pins -1 at create; MaxDeliver is editable after);
+ *  - a `filter_subject` that is not EXACTLY the pool's derived filter — or any multi-filter
+ *    (`filter_subjects`) shape — is `failed-precondition`: FilterSubject is editable, and a
+ *    narrowed/foreign filter reads 0 while stored work remains;
+ *  - a non-explicit ack policy is `failed-precondition` (without an ack barrier,
+ *    `num_ack_pending` does not mean "work still owned").
+ * Accepts the branded {@link WorkPoolContext} (admission path) or the narrow branded
+ * {@link ActivatorContext} (the watch loop); a hand-assembled context is refused.
+ */
+export async function readPoolOccupancy(ctx, endpoint, pool) {
+    if (!ACTIVATOR_CONTEXTS.has(ctx))
+        assertWorkPoolContext(ctx);
+    const stream = epwStreamName(ctx.space);
+    const durable = poolDurable(endpoint, pool);
+    let info;
+    try {
+        info = await ctx.jsm.consumers.info(stream, durable);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("unavailable", `the pool occupancy read failed for ${stream}/${durable}; an admission fence fails closed, never open (SPEC 13.6): ${e?.message ?? String(e)}`);
+    }
+    if (info.config.max_deliver !== -1)
+        throw new EpEnvelopeError("failed-precondition", `pool consumer ${durable} reports max_deliver ${String(info.config.max_deliver)}, not -1 (unlimited); a finite delivery ceiling strands exhausted items outside num_pending and num_ack_pending, so the occupancy sum would be a lie; repin the consumer (SPEC 13.6)`);
+    const expectedFilter = `${spacePrefix(ctx.space)}.epw.${endpointToken(endpoint)}.${assertPoolToken(pool)}.>`;
+    if (info.config.filter_subjects !== undefined)
+        throw new EpEnvelopeError("failed-precondition", `pool consumer ${durable} reports a multi-filter (filter_subjects); the §13.6 count is defined over exactly ONE pool filter; repin the consumer (SPEC 13.9)`);
+    if (info.config.filter_subject !== expectedFilter)
+        throw new EpEnvelopeError("failed-precondition", `pool consumer ${durable} reports filter "${String(info.config.filter_subject)}", not the pool's own "${expectedFilter}"; FilterSubject is editable post-create and a narrowed/foreign filter undercounts stored work; repin the consumer (SPEC 13.6/13.9)`);
+    if (info.config.ack_policy !== AckPolicy.Explicit)
+        throw new EpEnvelopeError("failed-precondition", `pool consumer ${durable} reports ack_policy "${String(info.config.ack_policy)}", not explicit; without the ack barrier num_ack_pending does not mean owned work (SPEC 13.9)`);
+    if (info.config.deliver_subject !== undefined)
+        throw new EpEnvelopeError("failed-precondition", `pool consumer ${durable} is a PUSH consumer (deliver_subject set); the §13.6 pool is pull-only, a delete/recreate must not substitute a push shape; repin the consumer (SPEC 13.9)`);
+    if (!uint(info.num_pending) || !uint(info.num_ack_pending) || !Number.isSafeInteger(info.num_pending + info.num_ack_pending))
+        throw new EpEnvelopeError("internal", `pool consumer ${durable} reported non-safe-integer counters (num_pending ${String(info.num_pending)}, num_ack_pending ${String(info.num_ack_pending)})`);
+    return { pending: info.num_pending, ackPending: info.num_ack_pending, occupancy: info.num_pending + info.num_ack_pending };
+}
+// ---- the serial admission durable --------------------------------------------------------------
+/**
+ * The VIRTUAL endpoint's canonicalizer durable: {@link canonConsumerConfig} with
+ * `max_ack_pending` PINNED to 1 (not an option — the pin is the point). One submission is in
+ * the admission path at a time, so the count → decide → enqueue sequence is SERIAL and two
+ * concurrent submissions cannot both observe the same free slot. Pool-worker execution
+ * concurrency is untouched: occupancy already counts every worker's `num_ack_pending`, and the
+ * worker durable keeps its own knobs. Because MaxAckPending is EDITABLE post-create,
+ * {@link admitVirtualWork} re-proves the live pin at every admission — creation intent alone
+ * is not the invariant.
+ */
+export function virtualAdmissionConsumerConfig(space, endpoint, opts = {}) {
+    return canonConsumerConfig(space, endpoint, { ackWaitMs: opts.ackWaitMs, maxAckPending: 1 });
+}
+// ---- the registered activation policy (bound to the svc registration, never caller-supplied) ---
+/**
+ * Read the endpoint's REGISTERED §13.6 activation policy from its `svc.<endpoint>.<instanceId>`
+ * spec — the ONE authority for capacity and the restart knobs, so no decision or supervision
+ * seam trusts a caller-supplied policy. The read is fail-closed: a missing registration is
+ * `failed-precondition` (there is no policy to admit or supervise under), and a registration
+ * without an `activation` block means the endpoint is not virtual, so a virtual decision over
+ * it refuses. `readSpec` MUST be LEADER-SERVED (the policy read gates escalation/retirement and
+ * capacity, so it is FENCING by use; a follower Direct Get could read a stale wider policy) and
+ * returns the spec value plus its store revision, so a decision can carry the revision and
+ * RE-PROVE it after its later awaits (a re-registration must not narrow the policy mid-flight).
+ */
+async function readRegisteredActivation(readSpec, endpoint, instanceId) {
+    const iId = assertLifecycleToken(instanceId, "instanceId");
+    const entry = await readSpec();
+    if (entry === undefined)
+        throw new EpEnvelopeError("failed-precondition", `endpoint "${endpoint}/${iId}" has no registered svc spec; a virtual decision has no policy to bind to (SPEC 13.6)`);
+    const spec = parseServiceSpec(entry.value, { endpoint });
+    if (spec.activation === undefined)
+        throw new EpEnvelopeError("failed-precondition", `endpoint "${endpoint}/${iId}" is registered without an activation policy (not a virtual endpoint); no on-demand admission or restart supervision applies (SPEC 13.6)`);
+    return { policy: parseActivationPolicy(spec.activation), revision: entry.revision };
+}
+/**
+ * The §13.6 admission fence, in the canonicalizer's decide path (admission BEFORE decision):
+ *  1. RE-PROVE the serial pin LIVE: the canonicalizer durable must report
+ *     `max_ack_pending === 1` and its exact EPJ filter (both editable post-create); a drifted
+ *     admission durable means the serial invariant is GONE — refuse, never decide;
+ *  2. RECONCILE the caller's outstanding acceptances (`reconcileWorkItem` per item, the §13.6
+ *     predicate): an accepted item with no terminal, no settled lease, and no live pool entry
+ *     is re-enqueued NOW, so repaired work is inside the count new work competes under;
+ *  3. read occupancy FRESH ({@link readPoolOccupancy}, fail-closed against every editable knob);
+ *  4. verdict: `occupancy < policy.capacity` (the REGISTERED activation policy, closed schema).
+ * Infrastructure failures THROW (`unavailable`/`failed-precondition`); only a genuine
+ * over-capacity state returns `admitted: false`.
+ */
+export async function admitVirtualWork(ctx, args) {
+    assertWorkPoolContext(ctx);
+    if (!Number.isSafeInteger(args.now))
+        invalid(`now ${String(args.now)} is not an integer`);
+    // The capacity is bound to the REGISTERED policy, read leader-served (the admission fence is
+    // a decision gate): a caller cannot pass a wider capacity than the endpoint registered.
+    const specKey = recordSpecKey(RECORD_KINDS.svc, [args.endpoint, args.instanceId]);
+    const readPolicy = () => readRegisteredActivation(() => readRecordLeader(ctx.jsm, ctx.space, specKey), args.endpoint, args.instanceId);
+    const { policy, revision: policyRevision } = await readPolicy();
+    // (1) The serial pin is proved LIVE at every admission, not assumed from creation.
+    const admissionDurable = canonDurable(args.endpoint);
+    let admissionInfo;
+    try {
+        admissionInfo = await ctx.jsm.consumers.info(epjStreamName(ctx.space), admissionDurable);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("unavailable", `the admission-durable read failed for ${admissionDurable}; the serial pin cannot be assumed, admission fails closed (SPEC 13.6): ${e?.message ?? String(e)}`);
+    }
+    if (admissionInfo.config.max_ack_pending !== 1)
+        throw new EpEnvelopeError("failed-precondition", `admission durable ${admissionDurable} reports max_ack_pending ${String(admissionInfo.config.max_ack_pending)}, not 1; MaxAckPending is editable post-create and without the pin two submissions can observe the same free slot; repin the consumer (SPEC 13.6)`);
+    // Re-prove the load-bearing shape too (defense against a delete/recreate substituting a
+    // semantically different consumer that keeps the same max_ack_pending/filter): the serial
+    // pin only serializes when ack is Explicit and delivery is pull (no deliver_subject).
+    if (admissionInfo.config.ack_policy !== AckPolicy.Explicit)
+        throw new EpEnvelopeError("failed-precondition", `admission durable ${admissionDurable} reports ack_policy "${String(admissionInfo.config.ack_policy)}", not explicit; max_ack_pending only serializes an ack-barriered consumer (SPEC 13.9)`);
+    if (admissionInfo.config.deliver_subject !== undefined)
+        throw new EpEnvelopeError("failed-precondition", `admission durable ${admissionDurable} is a PUSH consumer (deliver_subject set); the canonicalizer is pull-only, a push shape does not serialize the decision path (SPEC 13.9)`);
+    const expectedAdmissionFilter = `${spacePrefix(ctx.space)}.epj.${endpointToken(args.endpoint)}.>`;
+    if (admissionInfo.config.filter_subjects !== undefined || admissionInfo.config.filter_subject !== expectedAdmissionFilter)
+        throw new EpEnvelopeError("failed-precondition", `admission durable ${admissionDurable} reports filter "${String(admissionInfo.config.filter_subject)}", not the endpoint's own "${expectedAdmissionFilter}"; a drifted admission filter serializes the wrong stream; repin the consumer (SPEC 13.9)`);
+    // (2) Repair BEFORE counting.
+    let repaired = 0;
+    for (const o of args.outstanding ?? []) {
+        const verdict = await reconcileWorkItem(ctx, { ref: o.ref, itemBytes: o.itemBytes, workExpiry: o.workExpiry, now: args.now });
+        if (verdict.state === "re-enqueued")
+            repaired++;
+    }
+    // (3) occupancy
+    const occupancy = await readPoolOccupancy(ctx, args.endpoint, args.pool);
+    // (4) RE-PROVE the policy revision after every await above: a re-registration that NARROWED
+    // capacity mid-flight must not let this decision admit under the stale wider policy. The
+    // decision binds the re-proven policy (§13.6); the caller carries `policyRevision` into the
+    // acceptance commit so the accept CAS (after this helper returns) fences on the same coordinate.
+    const fresh = await readPolicy();
+    if (fresh.revision !== policyRevision)
+        throw new EpEnvelopeError("conflict", `endpoint "${args.endpoint}/${args.instanceId}" re-registered during admission (policy revision ${policyRevision} → ${fresh.revision}); the decision refuses rather than admit under a stale policy (SPEC 13.6)`);
+    return { admitted: occupancy.occupancy < fresh.policy.capacity, occupancy, capacity: fresh.policy.capacity, repaired, policyRevision: fresh.revision };
+}
+/**
+ * Watch one pool by BOUNDED POLLING of its exact Consumer INFO and start the instance through
+ * the bound seam when there is work and no live instance. See the module header for the
+ * authority profile this loop is confined to. One start is in flight at a time (the guard is
+ * local dedupe, not the correctness fence — registration owns that); polls stay serial with the
+ * tick chain, so a slow INFO read never stacks requests.
+ */
+export function startVirtualActivator(opts) {
+    if (!ACTIVATOR_CONTEXTS.has(opts.ctx))
+        throw new EpEnvelopeError("failed-precondition", `the activator context was not constructed by activatorContext(); a hand-assembled resource bundle never authorizes (SPEC 13.4)`);
+    const pollMs = opts.pollMs ?? 500;
+    const maxPollMs = opts.maxPollMs ?? 5000;
+    if (!Number.isSafeInteger(pollMs) || pollMs <= 0)
+        invalid(`pollMs ${String(opts.pollMs)} is not a positive integer`);
+    if (!Number.isSafeInteger(maxPollMs) || maxPollMs < pollMs)
+        invalid(`maxPollMs ${String(opts.maxPollMs)} is not a FINITE integer >= pollMs ${pollMs}; the backoff ceiling bounds the activation delay`);
+    if (typeof opts.onError !== "function")
+        invalid("onError is required; an unobserved activator failure is a silent liveness hole");
+    const setTimeoutFn = opts.setTimeoutFn ?? ((fn, ms) => setTimeout(fn, ms));
+    const clearTimeoutFn = opts.clearTimeoutFn ?? ((h) => clearTimeout(h));
+    let stopped = false;
+    let timer;
+    let startInFlight = false;
+    let delay = pollMs;
+    let polls = 0, starts = 0, infoErrors = 0, startErrors = 0, lastOccupancy = 0;
+    const schedule = () => {
+        if (stopped)
+            return;
+        timer = setTimeoutFn(() => { void tick(); }, delay);
+        timer.unref?.();
+    };
+    const tick = async () => {
+        if (stopped)
+            return;
+        polls++;
+        let occ;
+        try {
+            occ = await readPoolOccupancy(opts.ctx, opts.endpoint, opts.pool);
+        }
+        catch (e) {
+            if (stopped)
+                return; // stop() during the INFO: report nothing, schedule nothing
+            infoErrors++;
+            opts.onError("info", e);
+            delay = Math.min(maxPollMs, delay * 2);
+            schedule();
+            return;
+        }
+        if (stopped)
+            return; // stop() during the INFO: a not-yet-started activation never begins
+        lastOccupancy = occ.occupancy;
+        if (occ.occupancy > 0) {
+            delay = pollMs; // work present: poll at base rate
+            if (!startInFlight) {
+                startInFlight = true;
+                // Deliberately NOT awaited by the tick chain: a slow or wedged start must not stop the
+                // polling that makes the wedge observable. The flag dedupes; errors surface via onError.
+                void (async () => {
+                    let begun = false;
+                    try {
+                        const live = await opts.isLive();
+                        if (stopped)
+                            return; // stop() during the liveness read: do not begin
+                        if (!live) {
+                            starts++;
+                            begun = true;
+                            await opts.startInstance();
+                        }
+                    }
+                    catch (e) {
+                        // A pre-start failure (a rejecting isLive) AFTER stop is SILENT: no start began, so
+                        // it is not a real activation fault, only a race the stop won. A failure once the
+                        // start actually BEGAN is always reported (the started work's result matters).
+                        if (!begun && stopped)
+                            return;
+                        startErrors++;
+                        opts.onError("start", e);
+                    }
+                    finally {
+                        startInFlight = false;
+                    }
+                })();
+            }
+        }
+        else {
+            delay = Math.min(maxPollMs, delay * 2); // quiet: back off toward the finite ceiling
+        }
+        schedule();
+    };
+    schedule();
+    return {
+        stop() {
+            stopped = true;
+            if (timer)
+                clearTimeoutFn(timer);
+        },
+        stats: () => ({ polls, starts, infoErrors, startErrors, lastOccupancy }),
+    };
+}
+// ---- restart-intensity supervision -------------------------------------------------------------
+/** §13.6 defaults: more than 3 restarts within 60s escalates. */
+export const RESTART_MAX_DEFAULT = 3;
+export const RESTART_WINDOW_MS_DEFAULT = 60_000;
+/** The SUPERVISOR-OWNED status field carrying the durable restart history: entries are
+ *  `{ t, epoch }`, one per DYING PROCESS EPOCH (a real restart advances the epoch, so a
+ *  replayed note is an idempotent no-op). The field is defined by the service module because
+ *  {@link writeServiceStatus} carries it forward through instance-side writes. */
+export const RESTART_HISTORY_FIELD = SERVICE_RESTART_HISTORY_FIELD;
+/** The reconciler's durable retirement-complete mark (see {@link reconcileEscalation}). */
+export const RETIRED_MARK_FIELD = SERVICE_RETIRED_MARK_FIELD;
+const td = new TextDecoder();
+function parseHistory(raw, what) {
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw) || !raw.every((e) => isRec(e) && uint(e.t) && uint(e.epoch)))
+        throw new EpEnvelopeError("internal", `the stored restart history for ${what} is garbled; a mediated-writer record that does not validate is a writer bug (SPEC 13.3)`);
+    return raw;
+}
+/**
+ * Note one restart of a virtual instance, DURABLY and CAS-fenced (§13.6 supervision):
+ *  - the restart history rides the instance's `svc….status` record and is SUPERVISOR-OWNED
+ *    ({@link writeServiceStatus} carries it forward through every unpinned instance write, so
+ *    a successor's ordinary `ready` convergence cannot reset or forge it);
+ *  - the write is pinned to the revision THIS call read (`expectedStatusRevision`), so two
+ *    concurrent notes can never merge-lose a restart (one loses `conflict` and retries);
+ *  - each entry is BOUND to the dying process epoch: a note whose epoch is already recorded is
+ *    an idempotent NO-OP (`duplicate: true`) — one physical restart counts once, however many
+ *    times its notification is retried or duplicated;
+ *  - a CLOCK REGRESSION (`now` before the newest recorded restart) REFUSES
+ *    (`failed-precondition`): a rolled-back supervisor clock must not amnesty durable history;
+ *  - a stored {@link SERVICE_ESCALATED} state REFUSES (`failed-precondition`): the instance
+ *    has stopped restarting, terminally — {@link reconcileEscalation} is the retirement retry;
+ *  - more than `maxRestarts` entries within `restartWindowMs` (the pruned history plus this
+ *    note) ESCALATES: the status commits {@link SERVICE_ESCALATED} first (irreversible at the
+ *    writer), then the caller's D13 retire seam runs (`retireLifecycle`, the §13.1 terminal
+ *    barrier, MUST be idempotent). A retire failure is `unavailable` with the escalated status
+ *    already durable — honest halves; {@link reconcileEscalation} retries until it completes.
+ * A non-escalating note records {@link SERVICE_EXITED} (the instance just died; its successor
+ * writes `ready` itself when it registers) with the pruned history plus this note.
+ */
+export async function noteInstanceRestart(kv, args) {
+    if (!uint(args.now))
+        invalid(`now ${String(args.now)} is not an unsigned integer`);
+    if (!uint(args.epoch))
+        invalid(`epoch ${String(args.epoch)} is not an unsigned integer`);
+    if (typeof args.retireLifecycle !== "function")
+        invalid("retireLifecycle is required; escalation without terminal retirement is a half-fence");
+    if (typeof args.readSpecLeader !== "function")
+        invalid("readSpecLeader is required; the restart-intensity policy is FENCING and must be read leader-served, never a follower KV get (SPEC 13.6/13.9)");
+    const iId = assertLifecycleToken(args.instanceId, "instanceId");
+    const what = `"${args.endpoint}/${args.instanceId}"`;
+    // The restart-intensity thresholds are bound to the REGISTERED activation policy, read
+    // LEADER-SERVED (fencing by use), never caller-supplied and never follower-stale: a supervisor
+    // cannot loosen the window to suppress an escalation, and a stale wider window cannot either.
+    const { policy } = await readRegisteredActivation(args.readSpecLeader, args.endpoint, iId);
+    const maxRestarts = policy.maxRestarts ?? RESTART_MAX_DEFAULT;
+    const windowMs = policy.restartWindowMs ?? RESTART_WINDOW_MS_DEFAULT;
+    const key = recordStatusKey(RECORD_KINDS.svc, [args.endpoint, iId]);
+    const stored = await kv.get(key);
+    let prior;
+    let expectedStatusRevision = 0;
+    if (stored && stored.operation === "PUT") {
+        prior = parseServiceStatus(JSON.parse(td.decode(stored.value)));
+        expectedStatusRevision = stored.revision;
+    }
+    else if (stored && stored.operation !== "PUT") {
+        throw new EpEnvelopeError("failed-precondition", `the status for ${what} carries a ${stored.operation} marker; supervising over a deletion would resurrect authoritative state (SPEC 13.12)`);
+    }
+    if (prior?.state === SERVICE_ESCALATED)
+        throw new EpEnvelopeError("failed-precondition", `${what} is escalated; the instance has stopped restarting and its lifecycle retires terminally (SPEC 13.6; reconcileEscalation is the retirement retry), a further restart note never applies`);
+    const history = parseHistory(prior?.[RESTART_HISTORY_FIELD], what);
+    // CLOCK REGRESSION is checked BEFORE the duplicate short-circuit: a rolled-back supervision
+    // clock must fail loud on EVERY note, including a replay, rather than silently returning a
+    // stale window count computed against the bad clock (SPEC 13.6).
+    const newest = history.reduce((m, e) => Math.max(m, e.t), 0);
+    if (args.now < newest)
+        throw new EpEnvelopeError("failed-precondition", `${what}: the supervision clock ${args.now} is BEHIND the newest recorded restart ${newest}; a clock regression must not amnesty durable history (SPEC 13.6); restore the clock or reconcile manually`);
+    if (history.some((e) => e.epoch === args.epoch)) {
+        // The SAME dying epoch is already recorded: this note is a replay/duplicate of a restart
+        // already counted — idempotent no-op (a real restart advances the epoch).
+        const inWindow = history.filter((e) => args.now - e.t < windowMs).length;
+        return { escalated: false, restartsInWindow: inWindow, duplicate: true };
+    }
+    const pruned = history.filter((e) => args.now - e.t < windowMs);
+    pruned.push({ t: args.now, epoch: args.epoch });
+    const escalated = pruned.length > maxRestarts;
+    const status = {
+        epoch: args.epoch,
+        state: escalated ? SERVICE_ESCALATED : SERVICE_EXITED,
+        observedSpecRevision: prior?.observedSpecRevision ?? 0,
+        [RESTART_HISTORY_FIELD]: pruned,
+    };
+    const committedRevision = await writeServiceStatus(kv, {
+        endpoint: args.endpoint,
+        instanceId: iId,
+        epoch: args.epoch,
+        status,
+        readProcessEpoch: args.readProcessEpoch,
+        expectedStatusRevision,
+        supervisor: mintSupervisorWrite(), // the package-private authority to originate the history + escalation
+    });
+    if (escalated) {
+        try {
+            await args.retireLifecycle();
+        }
+        catch (e) {
+            throw new EpEnvelopeError("unavailable", `${what} escalated durably (the status stands and blocks restarts) but the lifecycle retire seam failed; reconcileEscalation retries it, nothing un-escalates (SPEC 13.6/13.1): ${e?.message ?? String(e)}`);
+        }
+        // Best-effort retirement-complete mark (the ONE touch an escalated row admits, pinned).
+        // A failure here is harmless: reconcileEscalation re-invokes the idempotent retire seam
+        // and writes the mark on its own pass.
+        try {
+            await updateRecordEntry(kv, key, { ...status, [RETIRED_MARK_FIELD]: args.now }, committedRevision);
+        }
+        catch {
+            /* reconciler backstop */
+        }
+    }
+    return { escalated, restartsInWindow: pruned.length, duplicate: false };
+}
+/**
+ * The escalation RETIREMENT reconciler (§13.6: "the lifecycle retires terminally" must survive
+ * a crash or a failed retire between the escalation CAS and the barrier): acts on an
+ * already-escalated status row, re-invokes the caller's IDEMPOTENT retire seam until it
+ * succeeds, and then durably marks completion (a revision-pinned direct update — the one touch
+ * an escalated row admits; {@link writeServiceStatus} refuses everything else). Run it on
+ * supervisor startup and whenever {@link noteInstanceRestart} refuses on an escalated row.
+ * Returns what it found and whether THIS pass did the retirement.
+ */
+export async function reconcileEscalation(kv, args) {
+    if (typeof args.retireLifecycle !== "function")
+        invalid("retireLifecycle is required");
+    if (!uint(args.now))
+        invalid(`now ${String(args.now)} is not an unsigned integer`);
+    const iId = assertLifecycleToken(args.instanceId, "instanceId");
+    const key = recordStatusKey(RECORD_KINDS.svc, [args.endpoint, iId]);
+    const stored = await kv.get(key);
+    if (!stored)
+        return { escalated: false, retired: false, acted: false }; // TRUE absence: never escalated
+    // A DEL/PURGE marker is CORRUPTION, not clean absence: reconciling over it could let an
+    // escalated identity's retirement silently never run. Fail closed (§13.12 retention floor).
+    if (stored.operation !== "PUT")
+        throw new EpEnvelopeError("failed-precondition", `the status for "${args.endpoint}/${args.instanceId}" carries a ${stored.operation} marker; a deletion is never clean absence, an escalated identity must not skip retirement (SPEC 13.12)`);
+    const status = parseServiceStatus(JSON.parse(td.decode(stored.value)));
+    if (status.state !== SERVICE_ESCALATED)
+        return { escalated: false, retired: false, acted: false };
+    if (status[RETIRED_MARK_FIELD] !== undefined)
+        return { escalated: true, retired: true, acted: false };
+    try {
+        await args.retireLifecycle();
+    }
+    catch (e) {
+        throw new EpEnvelopeError("unavailable", `the retirement of escalated "${args.endpoint}/${args.instanceId}" failed again; the escalation stands and this reconciler retries (SPEC 13.6/13.1): ${e?.message ?? String(e)}`);
+    }
+    try {
+        await updateRecordEntry(kv, key, { ...status, [RETIRED_MARK_FIELD]: args.now }, stored.revision);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("conflict", `the retirement of "${args.endpoint}/${args.instanceId}" completed but its mark lost a CAS (a concurrent reconciler passed); re-run to converge: ${e?.message ?? String(e)}`);
+    }
+    return { escalated: true, retired: true, acted: true };
+}
+//# sourceMappingURL=endpoint-virtual.js.map

package/dist/endpoint-virtual.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-virtual.js","sourceRoot":"","sources":["../src/endpoint-virtual.ts"],"names":[],"mappings":"AA+DA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAA8C,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAGtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,6BAA6B,EAC7B,0BAA0B,GAG3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC1H,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE/D,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;AAC/E,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAarH,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAAoB,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAkB,EAAE,KAAa;IACtE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,uDAAuD;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;+DAS+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAY,EAAE,MAAe;IAC5F,MAAM,OAAO,GAAG,CAAC,yBAAyB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAuC,EACvC,QAAgB,EAChB,IAAY;IAEZ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAuB,CAAC;QAAE,qBAAqB,CAAC,GAAsB,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,sCAAsC,MAAM,IAAI,OAAO,8DAA+D,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtM,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,CAAC,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,OAAO,wBAAwB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sLAAsL,CAAC,CAAC;IAC1T,MAAM,cAAc,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7G,IAAK,IAAI,CAAC,MAAwC,CAAC,eAAe,KAAK,SAAS;QAC9E,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,OAAO,oIAAoI,CAAC,CAAC;IACjN,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,cAAc;QAC/C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,OAAO,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,0BAA0B,cAAc,qIAAqI,CAAC,CAAC;IAChT,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,QAAQ;QAC/C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,OAAO,wBAAwB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,+FAA+F,CAAC,CAAC;IAClO,IAAK,IAAI,CAAC,MAAwC,CAAC,eAAe,KAAK,SAAS;QAC9E,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iBAAiB,OAAO,4JAA4J,CAAC,CAAC;IACzO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC;QAC1H,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iBAAiB,OAAO,oDAAoD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAqB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAClM,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;AAC7H,CAAC;AAED,mGAAmG;AAEnG;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAa,EACb,QAAgB,EAChB,OAA+B,EAAE;IAEjC,OAAO,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,mGAAmG;AAEnG;;;;;;;;;;GAUG;AACH,KAAK,UAAU,wBAAwB,CACrC,QAAyE,EACzE,QAAgB,EAChB,UAAkB;IAElB,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;QACrB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,aAAa,QAAQ,IAAI,GAAG,uFAAuF,CAAC,CAAC;IACxK,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAC/B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,aAAa,QAAQ,IAAI,GAAG,0IAA0I,CAAC,CAAC;IAC3N,OAAO,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAyBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,IASC;IAED,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC1F,6FAA6F;IAC7F,wFAAwF;IACxF,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvI,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IAEhE,mFAAmF;IACnF,MAAM,gBAAgB,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,aAAiE,CAAC;IACtE,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,yCAAyC,gBAAgB,2EAA4E,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrN,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,gBAAgB,4BAA4B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,mJAAmJ,CAAC,CAAC;IACrT,wFAAwF;IACxF,0FAA0F;IAC1F,sFAAsF;IACtF,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,QAAQ;QACxD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,gBAAgB,wBAAwB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,wFAAwF,CAAC,CAAC;IACjP,IAAK,aAAa,CAAC,MAAwC,CAAC,eAAe,KAAK,SAAS;QACvF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,gBAAgB,0IAA0I,CAAC,CAAC;IACpO,MAAM,uBAAuB,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClG,IAAK,aAAa,CAAC,MAAwC,CAAC,eAAe,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,cAAc,KAAK,uBAAuB;QAC1J,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,gBAAgB,oBAAoB,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,8BAA8B,uBAAuB,2FAA2F,CAAC,CAAC;IAEzS,8BAA8B;IAC9B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9H,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa;YAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,gBAAgB;IAChB,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,iGAAiG;IACjG,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc;QACnC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,qDAAqD,cAAc,MAAM,KAAK,CAAC,QAAQ,4EAA4E,CAAC,CAAC;IAC1P,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACzJ,CAAC;AA4CD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA0B;IAC9D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gIAAgI,CAAC,CAAC;IACrL,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACrH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,MAAM;QACxD,OAAO,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sCAAsC,MAAM,mDAAmD,CAAC,CAAC;IAC9I,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,CAAC,gFAAgF,CAAC,CAAC;IAClI,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EAAc,EAAE,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/F,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC,CAAC,CAAC;IAEjH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAyC,CAAC;IAC9C,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,WAAW,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,KAAK,EAAE,CAAC;QACR,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,OAAO;gBAAE,OAAO,CAAC,2DAA2D;YAChF,UAAU,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACvC,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,OAAO;YAAE,OAAO,CAAC,oEAAoE;QACzF,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC;QAC9B,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,CAAC,CAAC,kCAAkC;YAClD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,aAAa,GAAG,IAAI,CAAC;gBACrB,uFAAuF;gBACvF,yFAAyF;gBACzF,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,IAAI,KAAK,GAAG,KAAK,CAAC;oBAClB,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;wBACjC,IAAI,OAAO;4BAAE,OAAO,CAAC,gDAAgD;wBACrE,IAAI,CAAC,IAAI,EAAE,CAAC;4BACV,MAAM,EAAE,CAAC;4BACT,KAAK,GAAG,IAAI,CAAC;4BACb,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;wBAC7B,CAAC;oBACH,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,oFAAoF;wBACpF,kFAAkF;wBAClF,+EAA+E;wBAC/E,IAAI,CAAC,KAAK,IAAI,OAAO;4BAAE,OAAO;wBAC9B,WAAW,EAAE,CAAC;wBACd,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAC3B,CAAC;4BAAS,CAAC;wBACT,aAAa,GAAG,KAAK,CAAC;oBACxB,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,4CAA4C;QACtF,CAAC;QACD,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC;IACF,QAAQ,EAAE,CAAC;IAEX,OAAO;QACL,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK;gBAAE,cAAc,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,mGAAmG;AAEnG,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAChD;;;kFAGkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AACnE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAQ7D,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;AAE7B,SAAS,YAAY,CAAC,GAAY,EAAE,IAAY;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,kCAAkC,IAAI,0FAA0F,CAAC,CAAC;IAC1K,OAAO,GAAuC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,IAiBC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACzF,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,UAAU;QAAE,OAAO,CAAC,qFAAqF,CAAC,CAAC;IAC/I,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAAE,OAAO,CAAC,8IAA8I,CAAC,CAAC;IAEvM,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;IACrD,uFAAuF;IACvF,+FAA+F;IAC/F,8FAA8F;IAC9F,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC3F,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC;IACrE,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAgC,CAAC;IACrC,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QACzC,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChE,sBAAsB,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,CAAC;SAAM,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,kBAAkB,IAAI,cAAc,MAAM,CAAC,SAAS,uFAAuF,CAAC,CAAC;IAChM,CAAC;IACD,IAAI,KAAK,EAAE,KAAK,KAAK,iBAAiB;QACpC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,IAAI,wLAAwL,CAAC,CAAC;IAEpP,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,4FAA4F;IAC5F,2FAA2F;IAC3F,iEAAiE;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM;QACnB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,IAAI,2BAA2B,IAAI,CAAC,GAAG,0CAA0C,MAAM,4GAA4G,CAAC,CAAC;IAC3P,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,yFAAyF;QACzF,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC;IAE9C,MAAM,MAAM,GAAkB;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc;QACrD,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,IAAI,CAAC;QACtD,CAAC,qBAAqB,CAAC,EAAE,MAAM;KAChC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE;QACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM;QACN,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,sBAAsB;QACtB,UAAU,EAAE,mBAAmB,EAAE,EAAE,sEAAsE;KAC1G,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,2KAA4K,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnQ,CAAC;QACD,wFAAwF;QACxF,wFAAwF;QACxF,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,IAKC;IAED,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,UAAU;QAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,gCAAgC;IACxG,wFAAwF;IACxF,4FAA4F;IAC5F,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK;QAC5B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,eAAe,MAAM,CAAC,SAAS,yGAAyG,CAAC,CAAC;IAChP,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClG,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACtG,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,gCAAgC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,uFAAwF,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxO,CAAC;IACD,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,sBAAsB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,6FAA8F,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjO,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzD,CAAC"}