@cotal-ai/runtime 0.41.4 → 0.42.0

package/dist/mesh-handler.d.ts

@@ -1,7 +1,8 @@
-import { type CheckpointRef, type CheckpointSettleFact } from "@cotal-ai/core";
+import { type CheckpointRef, type CheckpointSettleFact, type EpCaller } from "@cotal-ai/core";
+import type { NatsConnection } from "@nats-io/transport-node";
 import type { JetStreamClient, JetStreamManager } from "@nats-io/jetstream";
-import type { KV } from "@nats-io/kv";
-import { EffectRefused, type WaitRequest, type CheckpointRaw, type CheckpointRequest, type EffectContext, type JournalEntry, type NotifyRequest, type SleepRequest } from "@cotal-ai/lang";
+import { type KV } from "@nats-io/kv";
+import { type AskRequest, type AgentHandleValue, type ChannelHandleValue, type ConclaveRequest, type WaitRequest, type CheckpointRaw, type CheckpointRequest, type EffectContext, type JournalEntry, type MonitorRequest, type NotifyRequest, type SleepRequest, type SpawnRequest, type TurnRequest, type TurnResultValue } from "@cotal-ai/lang";
 /** Who this handler acts as, and where. All of it is the DRIVER's identity, not the program's. */
 export interface MeshHandlerBinding {
     readonly space: string;
@@ -18,6 +19,14 @@ export interface MeshHandlerBinding {
      * the caller hands `drive()` a run id and a handler together.
      */
     readonly runId: string;
+    /**
+     * The caller triple this run's durable ACTIONS ride: goal facts key on
+     * `epf.<e>.goal.<owner>.<actor>.<uid>.<goalId>.result`, so the triple that submits a spawn must
+     * be the triple that reads its terminal back after a crash — on any host, at any epoch. It is
+     * therefore RUN-STABLE by contract: derive it from the run id (the run-command derivation), never
+     * from the process identity, or a resumed run polls a subject its own submission never wrote.
+     */
+    readonly caller: EpCaller;
     readonly instanceId: string;
     readonly epoch: number;
     /**
@@ -63,14 +72,67 @@ export interface SettleWatcher {
      */
     awaitSettle(ref: CheckpointRef): Promise<CheckpointSettleFact>;
 }
+/**
+ * The one subject the remaining seam is gated by: `turn` and `wait(replied)` both ride the turn
+ * machinery an agent handle answers through (`spawn`, `conclave`, `ask`, `monitor` and
+ * `wait(down)` perform). Named once so the refusals cannot drift apart.
+ */
 export declare class MeshHandler {
+    private readonly nc;
     private readonly kv;
     private readonly js;
     private readonly jsm;
     private readonly binding;
     private readonly watcher;
     private readonly clock;
-    constructor(kv: KV, js: JetStreamClient, jsm: JetStreamManager, binding: MeshHandlerBinding, watcher: SettleWatcher, clock?: () => number);
+    constructor(nc: NatsConnection, kv: KV, js: JetStreamClient, jsm: JetStreamManager, binding: MeshHandlerBinding, watcher: SettleWatcher, clock?: () => number);
+    /**
+     * The resolved manager service, memoized as a PROMISE so concurrent branches share one describe
+     * round-trip — and dropped on failure, so a resolve that lost to a manager restart is retried by
+     * the next effect instead of poisoning every spawn for the handler's lifetime.
+     */
+    private managerService;
+    private manager;
+    /** The branded goal-fact context over this handler's own connection, memoized the same way. */
+    private actions;
+    private actionCtx;
+    private presenceKvOpen;
+    private presenceRegistry;
+    private membersKvOpen;
+    private membersRegistry;
+    private channelsKvOpen;
+    private channelRegistry;
+    /** The chat stream's current last sequence — a conclave join/leave cursor (SPEC §7 interval). */
+    private chatFrontier;
+    /** The open conclaves this process performed, keyed by the scope's request id, so the close that
+     *  follows the body reads the SAME plan the open executed. A crash loses the map and loses
+     *  nothing: the plan was bound as the entry's external state before a single row was written,
+     *  and a re-entered open repopulates the map from `ctx.resume`. */
+    private readonly conclaves;
+    /** The run's roster: every agent this run spawned, by name — the handle a handoff resolves to,
+     *  and the owner/actor address a `turn` targets (absent when the spawn's acceptance floor was
+     *  never served; a `turn` on such an agent refuses loudly rather than guessing an address).
+     *  Seeded live by `spawn`, rebuilt at adoption from the journal's settled spawn entries. */
+    private readonly roster;
+    /** Turns this run has dispatched per handle composite, live and seeded — what a `turns` permit is spent against. */
+    private readonly turnsTaken;
+    /** Handle composites a `monitor` registered, live and seeded — what makes `down(agent)` observable. */
+    private readonly monitored;
+    /** The most recent unhonored handoff yield per SCOPE (lang §5.3): the goal-chain linkage memo.
+     *  `"ambiguous"` when two pending handoffs in one scope named the same agent — ambiguity records
+     *  no linkage at all. Spent (deleted) by the next `turn` in the scope, honored or not: honoring
+     *  is immediate-only. Rebuilt at adoption by replaying the same two rules over the journal. */
+    private readonly handoffMemos;
+    /** This run's turn goals per handle composite ("name#uid") — the observable `wait(replied)`
+     *  rides. Fed by `turn` at submission and adoption, reseeded from journal turn entries. */
+    private readonly turnGoals;
+    /** The last agent this run spawned into each logical worktree — what the L4008 guard reads.
+     *  Fed by `spawn` and reseeded from journal spawn results at adoption. */
+    private readonly worktreeHolders;
+    /** Seats a committed migration handed to this program under `--adopt`, keyed by persona and
+     *  handed out in journal order: the next `spawn` of that persona receives the recorded seat
+     *  instead of minting one. Fed by {@link adoptMigratedSeats}; spent by `spawn`. */
+    private readonly adoptable;
     now(): number;
     /**
      * WHAT to repair when this process takes a run over. The driver decides WHEN and calls this.
@@ -83,6 +145,104 @@ export declare class MeshHandler {
      * cannot advance it.
      */
     adopted(entries: readonly JournalEntry[]): Promise<string[]>;
+    /**
+     * Hand this program the seats a committed migration kept for it under `--adopt` (spec §11.2).
+     * The orphaned spawn's settled entry is the whole hand-over: the next `spawn` of its persona
+     * returns that entry's handle, binds that entry's floor, and submits nothing, so the seat keeps
+     * its identity, its worktree and its turn history across the edit. Called by the driver on the
+     * migrated run before the program runs; a map with no entry for a persona changes nothing.
+     */
+    adoptMigratedSeats(seats: ReadonlyMap<string, readonly JournalEntry[]>): void;
+    /**
+     * Rebuild the in-memory run memos an adopted run needs to keep performing `turn`: the roster
+     * (from every settled ok `spawn`, its result the handle and its bound floor the address), the
+     * worktree holders (a settled spawn holds its tree by identity, a spawn still in flight by the
+     * reservation its bound request took) and the handoff memos (replaying, in journal order, the
+     * same two rules the live path applies — a turn's begin spends its scope's memo, a settled
+     * handoff yield writes one, a second pending handoff to the same name in one scope makes it
+     * ambiguous). Deterministic from the journal alone.
+     */
+    private seedRunMemos;
+    /**
+     * The runtime half of "two agents MUST NOT share a worktree concurrently" (spec 6.5; the
+     * validator owns the literal case as L3022). The registry records who holds each logical
+     * worktree this run spawned into — the live seat, or the spawn still bringing one up — and a
+     * new spawn CLAIMS the tree here before anything is submitted: a tree nobody holds is taken in
+     * the same synchronous step that read it, so two branches spawning into one computed id cannot
+     * both pass; a tree held by a spawn in flight refuses; a tree held by a seat is admitted only
+     * when that holder is no longer live on presence, and re-read after the liveness wait, because
+     * a sibling may have claimed it meanwhile. Sequential reuse is legal, concurrency is data loss.
+     * The liveness read is the same witness `wait(down)` and a conclave join use, so "still
+     * holding" and "down" are one definition — a discharged loser or a crashed seat releases its
+     * tree the moment its presence row is gone, with no bookkeeping of its own.
+     */
+    private claimWorktree;
+    /** One turn goal registered under its handle composite — what `wait(replied)` observes. */
+    private recordTurnGoal;
+    /** One handoff yield's memo write: most-recent-wins across different names, ambiguous when a
+     *  pending handoff to the SAME name is already waiting (lang §5.3 — ambiguity records nothing). */
+    private recordHandoffMemo;
+    /**
+     * End the external state of a cancelled scope's LOSERS: the world half of the discharge the
+     * scope entry's `cancel.issued` records (§7.6, and the driver's `dischargeCancellations` is the
+     * caller). The entries handed in are the losers' subtrees; what has external state to end is the
+     * three pause kinds — a pause's timer is claimed so its armed schedule cannot fire into a run
+     * that moved on, and a wait's durable consumer is deleted because a cancelled wait replays as
+     * cancelled and nothing will ever read its position.
+     *
+     * IDEMPOTENT BY THE PLANE: `cancelTimer` declines a pause that is not waiting, the consumer
+     * delete tolerates one already gone, and both tolerate a loser that cleaned up after itself on
+     * the live path — this is the durable backstop for the process that died before its own cleanup
+     * landed, and the flip to `issued: true` happens only after it returns.
+     */
+    discharge(entries: readonly JournalEntry[]): Promise<void>;
+    /**
+     * Withdraw a cancelled `notify`'s undelivered notices.
+     *
+     * A notice is world state exactly as a live seat or an armed timer is: it sits on the run
+     * waiting to be rendered ahead of its addressee's next turn. A branch the run cancelled decided
+     * nothing, and a decision the run withdrew must not arrive at an agent afterwards — which is
+     * what happened, because the discharge released seats, memberships and timers and walked past
+     * this one kind.
+     *
+     * Withdrawn is spelled as CONSUMED, by the discharge rather than by a turn. The notice's status
+     * is a closed record with one meaning — this notice will not be delivered again — and that is
+     * the fact being recorded; `by` says which cancelled step withdrew it, so a reader tracing a
+     * notice finds the withdrawal instead of a delivery that never happened. It also puts the
+     * migration verdict where it belongs: an orphaned `notify` is rejected only while its notice is
+     * still owed to somebody, and this one is not owed to anybody any more.
+     *
+     * IDEMPOTENT BY THE PLANE, like the rest of the discharge: the consumption write is create-only,
+     * so a notice a turn already carried, or that an earlier discharge pass already withdrew, is
+     * left exactly as it is.
+     */
+    private dischargeNotify;
+    /**
+     * Release a cancelled spawn's AGENT (§8.6.4): the world half a loser `spawn` leaves behind is a
+     * seat the run will never address, so the discharge despawns it. The goal's identity re-derives
+     * from the entry alone — the request id IS the goalId (the pinned envelope id) unless the entry
+     * bound another (an adopted seat's), and the caller triple is run-stable — so a crash before the
+     * acceptance was even bound still finds its goal.
+     *
+     * The terminal is what says whether a seat exists. No goal at all: the submission never landed,
+     * nothing to release. Accepted but not terminal: the manager owes a terminal within the accepted
+     * readiness window, so this waits it out (bounded by the recorded window plus one poll of slack)
+     * and THROWS if none lands — an unfinished discharge must not be flipped to `issued`, and the
+     * driver's next sweep retries idempotently. `succeeded` and `uncertain` both despawn (an
+     * uncertain readiness verdict leaves the process running); `failed` was reaped by the manager
+     * and `cancelled` means a despawn already drove the teardown, so both are already released.
+     */
+    private dischargeSpawn;
+    /**
+     * Release a cancelled conclave's MEMBERSHIP (spec §7.5): a cancelled body performs no new
+     * effect, so it never closed its room, and the release travels this recovery path like every
+     * other branch-local resource. The entry's own `closed` fact is the gate — a conclave whose
+     * body failed but whose close acknowledged holds nothing. An entry with no bound plan created
+     * nothing (rows are written only after the bind), so there is nothing to release and no retry
+     * that could learn more. Failures are raised: an unfinished release must not be flipped to
+     * `issued`, and the driver's next sweep retries idempotently.
+     */
+    private dischargeConclave;
     /**
      * `sleep` is a checkpoint nobody answers.
      *
@@ -105,6 +265,13 @@ export declare class MeshHandler {
      * It returns the RAW outcome and never the program's result. Whether an expiry throws or returns
      * is `onExpiry`, which is computed from today's source on the live path and the replay path
      * alike; deciding it here would bake one answer into the journal.
+     *
+     * WHAT IT ASKS IS BOUND ON THE ENTRY, and that is not decoration. A pause the reference calls
+     * "a durable pause a human or an agent resolves from anywhere" is answered by address (`run`
+     * plus step key), and the prompt lived only in the source: everything durable held the input
+     * HASH, so whoever was asked saw a token and had to go find the program to learn the question.
+     * `to` rides with it for the same reason — an escalation names an addressee, and an addressee
+     * nothing records is an addressee nobody can be shown.
      */
     checkpoint(req: CheckpointRequest, ctx: EffectContext): Promise<CheckpointRaw>;
     /**
@@ -119,10 +286,56 @@ export declare class MeshHandler {
      * resumed 20-minute wait with 30 seconds left has 30 seconds left. A timeout resolves `null` and
      * never throws: `??` is `otherwise`.
      *
-     * `replied(agent)` and `down(agent)` are not here. They address an agent handle, which only
-     * `spawn` produces, so they refuse through the same named seam as the durable actions.
+     * `down(agent)` and `replied(agent)` are agent-addressed events with no channel, so they branch
+     * to `waitDown` and `waitReplied` before any of the channel machinery.
      */
     wait(req: WaitRequest, ctx: EffectContext): Promise<unknown | null>;
+    /**
+     * `wait(down(agent))` — the death of one incarnation, read off presence liveness.
+     *
+     * The handle pins `<name>#<lifecycleUid>` and DOWN is a fact about the INCARNATION. The mesh's
+     * liveness witness is the presence row a seat heartbeats — TTL'd out of the bucket when the
+     * heartbeats stop — and it is the same source conclave membership resolves members through, so
+     * "down" here and "down or gone" at a conclave join are one definition. No live row carrying
+     * the name AND this incarnation is the death, with the reason split by what the name shows now:
+     * `"lapsed"` when nothing live holds the name any more, `"superseded"` when a live row holds it
+     * under a DIFFERENT incarnation — this incarnation dead with a successor already up.
+     *
+     * NOTHING BINDS, because a death is re-observable where a matched message is not: a lifecycle
+     * uid is minted once per incarnation and never heartbeats again after its row lapses, so a
+     * crash between the observation and the settle re-observes the same death on resume — at worst
+     * with the reason upgraded from `"lapsed"` to `"superseded"` by a successor that appeared in
+     * between. `at` is the time of OBSERVATION: presence records no time of death, and inventing
+     * one would be a value the planes cannot back.
+     *
+     * The TIMEOUT is the same mediated pause every wait arms — minted once with an absolute
+     * deadline under the step's own request id, so a resume ATTACHES to the recorded deadline
+     * rather than restarting the clock — and it resolves `null`, never a throw: `??` is
+     * `otherwise`. The discharge and the adoption re-arm already speak this wait's tokens (the
+     * `wait` kind arms under its request id), so a cancelled or adopted down-wait needs nothing of
+     * its own.
+     */
+    private waitDown;
+    /**
+     * `wait(replied(agent))` — the agent finished a reply, observed over THIS RUN's turn terminals.
+     *
+     * The honest observable a run holds for "finished a reply" is the terminal fact of a turn it
+     * relayed itself: a `succeeded` turn goal IS a completed reply, durable on the goal plane. The
+     * wait resolves off the run's turn-goal registry for the handle — fed by `turn` at submission
+     * and reseeded from the journal on adoption — and REPLIED IS A LEVEL, exactly as `down` is: a
+     * reply that already exists resolves the wait at once (the latest, by the yield's own `at`
+     * stamp), and a wait that begins before any reply parks for the next terminal. A denied or
+     * cancelled turn is not a reply — the agent never finished one — so it leaves the wait parked.
+     * A handle outside the run's roster with no recorded turn can never be observed (only this
+     * run's turns are), so it refuses loudly instead of parking on nothing.
+     *
+     * NOTHING BINDS, for `down`'s reason: goal terminals are durable facts, so a crash between the
+     * observation and the settle re-observes the same reply on resume — at worst a NEWER reply
+     * completed in between. The value is the observation record, `down`-shaped:
+     * `{ agent, status, note?, at }`, where `at` is the yield's own stamp. The TIMEOUT is the same
+     * mediated pause every wait arms, resolving `null`, never a throw.
+     */
+    private waitReplied;
     /**
      * `notify` writes one bounded decision record per addressee, onto the run.
      *
@@ -134,39 +347,242 @@ export declare class MeshHandler {
      * **One call to N agents is N records, and a retry lands on its own.** The id is derived from the
      * step's request id and the addressee, so a crash between the second and third write is repaired
      * by re-running the call: the first two creates find their own bytes and return, the third
-     * happens. Nothing is written twice and nothing needs a memo of how far it got.
+     * happens. Nothing is written twice and nothing needs a memo of how far it got. That holds only
+     * because the instant every notice carries is bound with the step rather than read from the
+     * clock again, which is the one field a second pass could otherwise change.
      *
      * The fact's bound is the language's and is enforced BEFORE this is reached (L3043 at the effect
      * boundary), so a fact that could not be rendered as one table row cannot arrive here.
      */
     notify(req: NotifyRequest, ctx: EffectContext): Promise<null>;
-    spawn(_req: unknown, _ctx: EffectContext): Promise<never>;
-    turn(_req: unknown, _ctx: EffectContext): Promise<never>;
-    ask(_req: unknown, _ctx: EffectContext): Promise<never>;
-    monitor(_req: unknown, _ctx: EffectContext): Promise<never>;
     /**
-     * A conclave, refused with the rest — and this one is an OVER-refusal, stated rather than hidden.
+     * `spawn` is the manager's spawn ACTION, submitted under the step's own identity.
+     *
+     * **The request id is the goalId.** The envelope id is pinned to `ctx.requestId`, and the
+     * manager binds its goal under the envelope id — so a resumed run that re-submits is served the
+     * RECORDED acceptance (same fingerprint, same goal) instead of allocating a second seat, and the
+     * goal's terminal fact sits on a subject this run can re-derive from nothing but its journal.
+     *
+     * The ACCEPTANCE is bound as the entry's external state before the terminal is awaited, so a
+     * crash mid-await resumes straight into the poll — it must NOT re-invoke, because by then the
+     * manager may have restarted and a fresh submission would be judged against a live seat rather
+     * than served from its acceptance cache. The terminal await itself is a read of a durable fact,
+     * deliberately not `submitAndFollowGoal`: a live progress subscription dies with the process,
+     * and the fact is the thing a resume can still read.
+     *
+     * `permits`, `supervise` and `onFork` are POLICY, not identity (§6.4): they ride the journalled
+     * request and are enforced where they bind (`permits` at `turn`, `supervise` by `monitor`, an
+     * `onFork` at fork adoption) — nothing about them travels in the submission.
+     */
+    spawn(req: SpawnRequest, ctx: EffectContext): Promise<AgentHandleValue>;
+    /**
+     * A spawn that ends without a handle gives its tree back. The one exception is a cancellation
+     * while parked on an ACCEPTED submission: the seat may well be up in the tree until its
+     * discharge lands, so the reservation becomes a hold by the accepted identity, which presence
+     * liveness then releases the way it releases any holder.
+     */
+    private releaseWorktree;
+    /** Poll the goal's durable terminal fact, observing cancellation on the poll cadence — the same
+     *  discipline as `wait`: a race decided against this branch stops parking within one poll, and
+     *  the seat its acceptance may have produced is the DISCHARGE's to release, not this branch's. */
+    private goalTerminal;
+    /**
+     * `turn` wakes ONE AGENT for one turn, over the manager's relay (a seat is not an endpoint):
+     * the manager accepts the goal, parks the rendered context durably, the seat pulls and yields
+     * under its own self reach, and the yield is this goal's terminal. The request id is the goalId,
+     * the same recovery discipline as `spawn`: a resumed run re-enters the poll, never re-submits.
+     *
+     * THREE AUTHORITIES END IT, one per ending. The seat's yield is the manager's `succeeded`
+     * terminal, carrying the TurnResult. The DEADLINE is double-covered: the manager arms a
+     * goal-bound hold (its expiry commits `failed` reason `turn-deadline`), and this client arms its
+     * OWN pause under the step's request id — the L4003 authority that survives a dead manager.
+     * DEATH likewise: the manager's reap hook fails pending turns `agent-down`, and this client
+     * watches presence itself (the L4002 authority when the manager died with the seat).
+     *
+     * Handoff honoring (lang §5.3) happens HERE: the scope's pending memo is spent at every turn's
+     * begin, and when this turn targets its `to`, the link rides the submission (`handoffFrom`, the
+     * manager mirrors it into the terminal) and the bound external state. A handoff YIELD is
+     * validated against the run roster: an addressee outside it is L4005, one in a different
+     * worktree is L4004.
+     */
+    turn(req: TurnRequest, ctx: EffectContext): Promise<TurnResultValue>;
+    /** Map a turn goal's terminal onto the effect's contract: `succeeded` carries the TurnResult
+     *  (a handoff addressee resolved against the roster — L4005 outside it, L4004 across
+     *  worktrees), `failed` splits on the manager's recorded reason, `cancelled` unwinds. The
+     *  consumed notices are marked HERE, by the goal that carried them, tolerating the re-entry
+     *  conflict (a crash between the terminal and the mark re-marks on resume). */
+    /**
+     * A yielded handoff's refusal class: L4005 when the addressee is not in this run's roster,
+     * L4004 when it sits in a different worktree than the seat handing off, undefined when the
+     * handoff is honorable. One reading for the turn that raises it and the `wait(replied)` that
+     * must not count it, so the two observers never diverge on a spoofed or misdirected `to`.
+     */
+    private handoffRefusal;
+    private turnOutcome;
+    /**
+     * `ask` is a schema-checked pause the ADDRESSED AGENT is expected to answer.
+     *
+     * Each attempt is one checkpoint-plane pause — the same mint, settle and answer record a
+     * `checkpoint` rides, answered through the run driver's `resolveCheckpoint` (`cotal run
+     * answer`), which is how "the agent publishes a record" reaches a holder-bound plane: the agent,
+     * or anyone the run's ACL admits on its behalf, answers through the driver exactly as a human
+     * answers a checkpoint. What `ask` adds is the handler-side contract of §6.5: the schema is read
+     * as the SHORTHAND (refused L4022 when it cannot be), every answer is checked against it, a
+     * non-conforming answer costs one attempt and the refusal reason is bound onto the entry for the
+     * answerer to read, and exhausted attempts are the effect's own catchable L4006.
+     *
+     * **One absolute deadline for the whole ask**, computed once and bound with the first attempt: a
+     * re-ask does not restart the clock, or a stream of non-conforming answers could stretch the
+     * pause forever. The deadline elapsing with no conforming answer is the ask's own L4006, the
+     * same outcome exhausted attempts name: the budget it ran out of is the ask's, and L4003 belongs
+     * to a `turn` whose own deadline elapsed.
+     *
+     * **Attempt N's token derives from the step's request id** (attempt 1 IS the request id), and
+     * the CURRENT attempt's token is bound as `askToken` before its pause is armed — so a resume
+     * re-enters the attempt in flight, an answer judged non-conforming just before a crash is
+     * re-judged identically from its durable settle, and the discharge and the adoption re-arm
+     * address the one timer that is actually armed.
+     */
+    ask(req: AskRequest, ctx: EffectContext): Promise<unknown>;
+    /**
+     * One ask attempt's relay to the addressed seat: a `turn` goal under the attempt's token whose
+     * payload carries the ask (token, schema, attempt, deadline, the previous refusal), rendered by
+     * the seat's connector as the request to answer. The goal is the seat's to yield when it has
+     * answered; the ask itself settles on the checkpoint plane, so the relay's terminal is never
+     * read here, and it is never a reply `wait(replied)` observes. A seat the serve boundary reports
+     * gone is the agent-down failure (L4002).
+     */
+    private askSeat;
+    /**
+     * Where a relay to an agent of this run is addressed: the roster entry under the handle's name,
+     * at the handle's incarnation, with the owner/actor coordinates its acceptance floor served.
+     * One resolver for the three relays (`turn`, `ask`, an escalation), because the three
+     * dispositions differ and the lookup does not: a turn and an ask refuse, an escalation stands.
+     */
+    private seatAddress;
+    private relayAsk;
+    /**
+     * An escalated checkpoint, delivered to the agent it names.
      *
-     * A conclave's members are agent handles, so the ordinary case is gated exactly like the others.
-     * `conclave([], …)` is not: a sub-team with nobody in it is a channel, and the channel plane is
-     * here. It is refused anyway, because shipping the empty case alone would put half a primitive on
-     * the durable plane — a program that works with no members and refuses with one is a worse thing
-     * to explain than a primitive that is not here yet.
+     * `to` is legal only with `onExpiry: "escalate"` and the escalation is the SECOND mint, so this
+     * runs once per chain at most. The addressee is resolved through the run's own roster: a name
+     * this run spawned is a seat and is told, and anything else is a person — the pause is
+     * answerable from anywhere by design, its addressee is on the entry, and refusing a program
+     * that escalates to a human would be this host narrowing an option the reference leaves open.
+     *
+     * The relay is the ask's, because the two are the same act: one turn on the seat, carrying what
+     * is asked and the token to answer under, settling on the checkpoint plane rather than on the
+     * relay's own terminal.
      */
-    openConclave(_req: unknown, _ctx: EffectContext): Promise<never>;
-    closeConclave(_req: unknown, _ctx: EffectContext): Promise<never>;
+    private relayEscalation;
+    /**
+     * Submit one relay to a seat as a `turn` goal, and read its acceptance.
+     *
+     * IDEMPOTENT BY THE GOAL RECORD, which is also the arbiter when the invoke does not come back:
+     * a relay that landed and lost its reply is a relay that landed, and re-submitting it would put
+     * a second turn on the seat for one request. A seat the serve boundary reports gone is the
+     * agent-down failure (L4002); every other refusal is this endpoint's and is uncatchable.
+     */
+    private relayToSeat;
+    /**
+     * `monitor` registers interest: after it, `down(agent)` is an event a branch can await (§5.9).
+     *
+     * THE REGISTRATION IS THE JOURNAL ENTRY, and that is the whole mechanism. Death is a STATE on
+     * this mesh — the monitored incarnation's presence row gone (see `waitDown`) — not a message
+     * that must find a standing mailbox, so there is no subscription to create, nothing to arm, and
+     * nothing for a discharge or a migration to release: `wait(down(...))` reads the same fact
+     * whenever it is asked, and the migration table's row for `monitor` ("nothing outlives it")
+     * stays true. What the step performs is the validation a registration owes: the value must BE
+     * an agent handle, refused loudly when it is not, because a wait parked on a malformed handle
+     * would poll for a death nothing can ever report.
+     *
+     * Monitoring an agent that is ALREADY dead succeeds — Erlang's monitor of a dead process
+     * delivers its DOWN rather than failing, and the rescue idiom (race work against
+     * `wait(down(...))`) needs exactly that: the death is observed by the wait, immediately.
+     */
+    monitor(req: MonitorRequest, ctx: EffectContext): Promise<null>;
+    /**
+     * `conclave` open: mint (or take) the channel and join the members as durable membership rows.
+     *
+     * **The plan is the recovery identity.** Everything the close and the discharge need — the
+     * channel, whether this open minted its registry row, and per member the resolved principal,
+     * incarnation, generation and whether THIS conclave created the row — is computed first, bound
+     * as the entry's external state, and only then executed. A crash before the bind created
+     * nothing (rows are written after it); a crash after it re-enters with `ctx.resume` carrying
+     * the plan, and the execute converges idempotently without re-resolving anything: the members
+     * may have died since, and the recorded plan — not the world's current shape — is what a
+     * release answers to.
+     *
+     * **The channel is handler-derived** when the program names none: `conclave-` plus a digest of
+     * the step's own request id, so a resumed run re-derives the same room instead of opening a
+     * second one. A program-named channel is taken as-is (validated concrete) and its registry row
+     * is left alone — naming a room is not creating one, and the close must not tear down a channel
+     * the run merely borrowed.
+     *
+     * **Members resolve through presence.** A handle carries `<name>#<lifecycleUid>`; the row that
+     * maps it to the principal a membership record needs is the seat's own self-published presence —
+     * the same source DM name-resolution reads, and the witness the manager's readiness gate
+     * requires before a spawn reports `succeeded`. A member with no matching row is down or gone,
+     * which is the effect's own catchable failure (L4002), not a handler fault.
+     *
+     * A member already durably in the channel (a pinned pre-existing room) is planned `joined:
+     * false`: the conclave neither re-joins nor — at close — evicts a membership it did not create.
+     */
+    openConclave(req: ConclaveRequest, ctx: EffectContext): Promise<ChannelHandleValue>;
+    /**
+     * `conclave` close: release exactly what the recorded plan says the open created — tombstone
+     * the memberships planned `joined: true`, delete the registry row when this conclave minted the
+     * channel. A member that left and rejoined on its own since carries a newer generation, and the
+     * stale-write guard makes this leave a no-op for it: the membership is theirs now.
+     *
+     * Idempotent by the plane (a tombstone at or below an existing leave cursor is a no-op), so the
+     * re-entry that retries an unacknowledged close converges. The failure mode is the interpreter's
+     * `CloseOwed`: a close that throws leaves the entry pending, which IS the durable "a close is
+     * still owed".
+     */
+    closeConclave(_req: ConclaveRequest, ctx: EffectContext): Promise<null>;
+    /** Compute the conclave plan from the world: derive or validate the channel, resolve every
+     *  member handle to its principal, and read each existing membership row so the join generation
+     *  and the created-by-us fact are decided BEFORE anything is written. Duplicate handles collapse
+     *  to one planned member — one identity is one membership row. */
+    private planConclave;
+    /** Execute a conclave plan against the registries, idempotently: the registry row is a merge
+     *  the re-entry rewrites byte-identical, and a member row is committed only where the plan's
+     *  generation is NEWER than what is stored — a re-entry must not roll a landed row's join
+     *  cursor forward (the members were mid-conversation when the host died), and a row the world
+     *  moved past (an independent leave or rejoin) is theirs, not this conclave's. */
+    private executeConclavePlan;
+    /** The world half of ending a conclave, shared by the close and the discharge: tombstone the
+     *  memberships this conclave created, then delete the registry row it minted. Idempotent, and
+     *  tolerant of exactly one foreign move — a NEWER generation on a row (the member left and
+     *  rejoined on its own), which the stale-write guard reports and this leave must not evict. */
+    private releaseConclave;
+    /** Every live presence row that decodes. Foreign bytes in the bucket are skipped — a peer's
+     *  malformed self-publish must not break another agent's name resolution — and what an ABSENT
+     *  row means belongs to the caller: `resolveMemberPrincipal` refuses the join loudly, and
+     *  `waitDown` reads it as the death it is waiting for. */
+    private presenceRows;
     /**
      * Arm this pause, or ATTACH to the one already recorded under the same token.
      *
-     * A mint is idempotent only if the whole spec is identical, so the recorded deadline is the
-     * authority and a resume may not recompute one: `now() + duration` is a different deadline a
-     * second later, and the plane reads a different deadline as a different intent. The pause holds
-     * it; a second copy anywhere else is a second thing to disagree.
+     * A mint is idempotent only if the whole spec is identical, so the recorded spec is the
+     * authority for BOTH halves of the mint's identity and a resume may not recompute either. The
+     * deadline, because `now() + duration` is a different deadline a second later, and the plane
+     * reads a different deadline as a different intent. And the HOLDER, because a resumed run does
+     * not necessarily arrive under the principal that minted its pause: the CLI mints a fresh holder
+     * per invocation, and a cross-host adoption is a different principal by definition. Only the
+     * recorded holder itself may mint again — completing its own crash between the spec and the
+     * status, where the identical spec is exactly what makes the retry idempotent. Everyone else
+     * attaches. Measured before the repair, through the CLI: one `resume` of a checkpoint-parked
+     * run re-minted under its own fresh holder, the plane refused ("a token is minted once"), and
+     * the interpreter recorded that infrastructure refusal as the step's own failure (L4000) — a
+     * stranded run whose journal blames the program.
      *
      * An already-passed deadline cannot be minted at all, correctly, because a due pause is not being
      * armed. It needs its schedule re-emitted at the status's current generation, which is the
-     * reconciler's job. A spec with no status and an elapsed deadline is unrepairable from here, so it
-     * is raised rather than waited on.
+     * reconciler's job — the same operation an attaching successor needs, so the two share the exit.
+     * A spec with no status that this holder cannot complete is unrepairable from here, so it is
+     * raised rather than waited on.
      */
     private arm;
     /** Push a live deadline out — the idle window restarting. The heartbeat CAS-advances the
@@ -209,6 +625,10 @@ export declare class MeshHandler {
      * already in the past.
      */
     private settle;
+    /** Reject with `Cancelled` the moment this branch's signal fires, then claim the pause so its
+     *  armed schedule cannot fire into a run that has moved on. The claim also writes the one-use
+     *  settle, which is what lets an abandoned `awaitSettle` poll loop see a fact and end. */
+    private settleCancelled;
     /** Take this deadline's fire for as long as somebody is waiting on it. */
     private pumpFires;
 }
@@ -225,19 +645,6 @@ export declare function waitConsumerName(requestId: string): string;
  * this wait's to see.
  */
 export declare function waitConsumerConfig(space: string, requestId: string, channel: string): Record<string, unknown>;
-/**
- * An effect whose durable substrate has not landed on this host.
- *
- * An honest two-exit, and deliberately not a fake success: the simulator implements these, so a
- * program that uses them can be written, validated and dry-run today — but a DURABLE run refuses
- * rather than performing them on a plane that could not recover them. A run that "succeeded" at an
- * effect nothing can replay would be a lie the journal then carries forever.
- */
-export declare class NotYetDurable extends EffectRefused {
-    readonly effect: string;
-    readonly needs: string;
-    constructor(effect: string, needs: string);
-}
 /**
  * RE-ARM the timers of every pause this run is still holding, under THIS driver's coordinates.
  *
@@ -267,10 +674,10 @@ export declare function rearmOutstandingPauses(deps: {
  * later record wins — a step that settled has a settled entry after its pending one, and reading
  * only the first would re-arm timers for pauses that are already over.
  *
- * THE KINDS ARE THE THREE THAT ARM A TIMER, and `wait` is one of them. It mints no pause of its own
- * so it does not look like one, but its idle window and its timeout are mediated deadlines exactly
- * as `sleep`'s is, and a `wait` adopted at a new epoch would otherwise wait on a deadline no live
- * epoch fires.
+ * THE KINDS ARE THE FIVE THAT ARM A TIMER, and `wait`, `ask` and `turn` are three of them. None of
+ * the three mints a pause that looks like its own, but a wait's idle window and timeout, an ask
+ * attempt's deadline, and a turn's deadline authority are mediated deadlines exactly as `sleep`'s
+ * is, and one adopted at a new epoch would otherwise wait on a deadline no live epoch fires.
  *
  * An idle wait with a timeout arms TWO, and the second is DERIVED rather than recorded, so it is
  * re-derived here for the same reason the live path derives it: a resume that had to remember it
@@ -278,6 +685,11 @@ export declare function rearmOutstandingPauses(deps: {
  * is harmless by construction — the reconciler reads the checkpoint's status first and re-emits
  * nothing when there is none — and the alternative, reading the request shape back out of the
  * entry to decide, would make the repair depend on a field a replay is not guaranteed to carry.
+ * An ask's armed pause is its CURRENT attempt's, whose token is bound as `askToken`; before the
+ * first bind it is attempt 1, which is the request id itself. A `turn`'s is under its goal id,
+ * which is the request id: that pause is the client-side L4003 authority the run keeps for a
+ * manager that dies, so leaving it armed at the predecessor's coordinates would go dark in exactly
+ * the window recovery opens.
  */
 export declare function outstandingPauseTokens(entries: readonly JournalEntry[]): string[];
 /**

package/dist/mesh-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-handler.d.ts","sourceRoot":"","sources":["../src/mesh-handler.ts"],"names":[],"mappings":"AAmBA,OAAO,EAoBL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAE1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAEL,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAGlB,MAAM,gBAAgB,CAAC;AAExB,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;gBAApD,KAAK,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,GAAG,SAAS;CAS1E;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAQD,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBALL,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,MAAM,MAAyB;IAGzD,GAAG,IAAI,MAAM;IAIb;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQlE;;;;;;;;OAQG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjE;;;;;;;;;;;;OAYG;IACG,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IA0BpF;;;;;;;;;;;;;;OAcG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAwFzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC7D,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAIzD,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAIxD,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAIvD,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAIjE;;;;;;;;OAQG;IACG,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAIhE,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAIvE;;;;;;;;;;;;OAYG;YACW,GAAG;IAiCjB;uGACmG;YACrF,IAAI;IAUlB;;;;;;;;;;;;;;OAcG;YACW,QAAQ;IAmBtB;;;;oGAIgG;YAClF,OAAO;IAQrB;;4EAEwE;YAC1D,WAAW;IAezB,kFAAkF;YACpE,SAAS;IAUvB;;;;;;;OAOG;YACW,MAAM;IAqBpB,0EAA0E;YAC5D,SAAS;CAQxB;AAED;;6FAE6F;AAC7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO7G;AA0DD;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,aAAa;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;gBAAtC,MAAM,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;CAY5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,EAAE,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,EAC5D,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC,EAChF,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,EAAE,CAUjF;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAElD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,SAAS;IAG5B,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAgCrE"}
+{"version":3,"file":"mesh-handler.d.ts","sourceRoot":"","sources":["../src/mesh-handler.ts"],"names":[],"mappings":"AAmBA,OAAO,EA2CL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAGzB,KAAK,QAAQ,EAKd,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EASL,KAAK,UAAU,EACf,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAExB,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;gBAApD,KAAK,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,GAAG,SAAS;CAS1E;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED;;;;GAIG;AAEH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBANL,EAAE,EAAE,cAAc,EAClB,EAAE,EAAE,EAAE,EACN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,MAAM,MAAyB;IAGzD;;;;OAIG;IACH,OAAO,CAAC,cAAc,CAAuC;IAC7D,OAAO,CAAC,OAAO;IASf,+FAA+F;IAC/F,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,SAAS;IAYjB,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,eAAe;IAQvB,iGAAiG;YACnF,YAAY;IAI1B;;;uEAGmE;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAE7D;;;gGAG4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4I;IACnK,oHAAoH;IACpH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,uGAAuG;IACvG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C;;;mGAG+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuE;IAEpG;+FAC2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAE5D;8EAC0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IAErE;;uFAEmF;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAE/D,GAAG,IAAI,MAAM;IAIb;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUlE;;;;;;OAMG;IACH,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,GAAG,IAAI;IAK7E;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IA4CpB;;;;;;;;;;;;OAYG;YACW,aAAa;IAqC3B,2FAA2F;IAC3F,OAAO,CAAC,cAAc;IAMtB;uGACmG;IACnG,OAAO,CAAC,iBAAiB;IAKzB;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqChE;;;;;;;;;;;;;;;;;;;OAmBG;YACW,eAAe;IAmB7B;;;;;;;;;;;;;;OAcG;YACW,cAAc;IA0C5B;;;;;;;;OAQG;YACW,iBAAiB;IAQ/B;;;;;;;;OAQG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBjE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IA+CpF;;;;;;;;;;;;;;OAcG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAuHzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,QAAQ;IA4CtB;;;;;;;;;;;;;;;;;;OAkBG;YACW,WAAW;IAmDzB;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBnE;;;;;;;;;;;;;;;;;;OAkBG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAqH7E;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAUvB;;sGAEkG;YACpF,YAAY;IAU1B;;;;;;;;;;;;;;;;;;OAkBG;IACG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAmJ1E;;;;mFAI+E;IAC/E;;;;;OAKG;IACH,OAAO,CAAC,cAAc;YAQR,WAAW;IA2DzB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAmEhE;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;IAYf;;;;;OAKG;IACH,OAAO,CAAC,WAAW;YAOL,QAAQ;IAetB;;;;;;;;;;;;OAYG;YACW,eAAe;IA4B7B;;;;;;;OAOG;YACW,WAAW;IAiCzB;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAczF;;;;;;;;;;OAUG;IACG,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7E;;;sEAGkE;YACpD,YAAY;IA6B1B;;;;sFAIkF;YACpE,mBAAmB;IAoCjC;;;mGAG+F;YACjF,eAAe;IAmB7B;;;8DAG0D;YAC5C,YAAY;IAY1B;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,GAAG;IAqDjB;uGACmG;YACrF,IAAI;IAUlB;;;;;;;;;;;;;;OAcG;YACW,QAAQ;IA0BtB;;;;oGAIgG;YAClF,OAAO;IAQrB;;4EAEwE;YAC1D,WAAW;IA8BzB,kFAAkF;YACpE,SAAS;IAUvB;;;;;;;OAOG;YACW,MAAM;IA2BpB;;8FAE0F;IAC1F,OAAO,CAAC,eAAe;IAiBvB,0EAA0E;YAC5D,SAAS;CAQxB;AAED;;6FAE6F;AAC7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO7G;AAgTD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,EAAE,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,EAC5D,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC,EAChF,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,EAAE,CAYjF;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAElD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,SAAS;IAG5B,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAgCrE"}