@happyvertical/smrt-app-runtime 0.53.2 → 0.53.4

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-app-runtime",
-  "packageVersion": "0.53.2",
+  "packageVersion": "0.53.4",
   "objects": {},
   "moduleType": "smrt",
   "smrtDependencies": [

package/dist/operation-lock.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Exclusive operator-operation lock (`<state>/operation.lock`).
+ *
+ * Ported from the template's `scripts/smrt-operation-lock.mjs`: the same
+ * file, record shape, and messages. Stale-owner reclamation is serialized
+ * through `stale-reclaim.ts` so it can never remove a live lock.
+ */
+/** Held lock handed to the operation callback. */
+export interface OperationLock {
+    /** Per-acquisition nonce; a managed writer presents it to join the operation. */
+    readonly instance: string;
+    /** Lock file path. */
+    readonly path: string;
+}
+/** True when `pid` names a live process, including one owned by another user. */
+export declare function processExists(pid: number): boolean;
+/** Owner pid of a lock record, or `null` when it cannot be verified. */
+export declare function lockOwnerPid(contents: string): number | null;
+/** True when an operation-lock record names an owner that no longer exists. */
+export declare function isStaleOperationLock(contents: string): boolean;
+/**
+ * Run `callback` while holding the application's exclusive operation lock.
+ *
+ * A lock whose owner process is gone is reclaimed; an unverifiable lock fails
+ * closed. The lock is only removed when it is still this acquisition's own.
+ */
+export declare function withOperationLock<T>(stateRoot: string, operation: string, callback: (lock: OperationLock) => Promise<T> | T): Promise<T>;
+//# sourceMappingURL=operation-lock.d.ts.map

package/dist/operation-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-lock.d.ts","sourceRoot":"","sources":["../src/operation-lock.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sBAAsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD;AAED,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS5D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAiEZ"}

package/dist/provider-readiness.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Provider-owned readiness probes for deployed profiles.
+ *
+ * Ported from the template's `scripts/smrt-provider-readiness.mjs`. The
+ * module named by the environment setting is resolved from the application
+ * (not from this CLI package), because it is the application's installed
+ * provider adapter.
+ */
+/** Provider components with a readiness module setting. */
+export type ReadinessComponent = 'authentication' | 'assets' | 'secrets';
+/** Environment variable naming each component's readiness module. */
+export declare const PROVIDER_READINESS_SETTINGS: Readonly<Record<ReadinessComponent, string>>;
+/** Context handed to the provider's probe. */
+export interface ReadinessContext {
+    profile: string;
+    provider: string;
+}
+/** Options for {@link createProviderReadinessProbe}. */
+export interface ProviderReadinessOptions {
+    /** Application root the module is resolved from. Defaults to `process.cwd()`. */
+    sourceRoot?: string;
+    /** Environment to read the setting from. Defaults to `process.env`. */
+    environment?: Record<string, string | undefined>;
+}
+/**
+ * Locate an installed package the way an ES module in `sourceRoot` would:
+ * the nearest `node_modules/<name>` walking up from the application. Unlike
+ * CommonJS resolution this never consults `NODE_PATH`, which package-manager
+ * bin shims point at the CLI's own dependency store.
+ */
+export declare function findInstalledPackage(sourceRoot: string, packageName: string): string | null;
+/**
+ * Resolve a readiness module specifier the way the application would.
+ *
+ * URLs (`data:`, `file:`) are imported as given; absolute paths become file
+ * URLs; relative paths resolve against the application root; bare package
+ * specifiers resolve through Node's ESM resolver from the application root
+ * (as the template's in-app `import()` did) and must land inside the
+ * package installed in the application's own `node_modules` chain.
+ */
+export declare function resolveReadinessModule(specifier: string, sourceRoot: string): Promise<string>;
+/**
+ * Build a provider-owned readiness probe. The installed adapter module must
+ * export `checkReadiness()` (or a default function) and return `true` or
+ * `{ ready: true }` only after checking its real backing service.
+ */
+export declare function createProviderReadinessProbe(component: ReadinessComponent, context: ReadinessContext, options?: ProviderReadinessOptions): () => Promise<void>;
+//# sourceMappingURL=provider-readiness.d.ts.map

package/dist/provider-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-readiness.d.ts","sourceRoot":"","sources":["../src/provider-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzE,qEAAqE;AACrE,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAChD,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAKlC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CASf;AAgDD;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,kBAAkB,EAC7B,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,wBAA6B,GACrC,MAAM,OAAO,CAAC,IAAI,CAAC,CAkCrB"}

package/dist/smrt-knowledge.json

@@ -3,16 +3,17 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-app-runtime",
-  "packageVersion": "0.53.2",
+  "packageVersion": "0.53.4",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "da6d43216990de06a4eb5fd339a52f99769c131f071c2986fbc8f50cd84bf723",
-    "packageJson": "4edeaa8a90fff64b12f8180678c210bd2e0e9a0978953c3929aea81a01da6546",
-    "agents": "f209485465cd0e0f48385f49f0785443a717f2563a9d0a6ca811ca0f24940cc2"
+    "manifest": "f8a14990e08ea950957549cfbbb2be899cd072b001200577acb271db6f16be8c",
+    "packageJson": "13238017d8b75b279d6a8c11475de37d708a0b5a6b313d5a120936a11299f4e6",
+    "agents": "5c8c37ce0684124b676c28b12ef9bad2eeebfc6a6bf2ecae7cb01289a8fe4616"
   },
   "exports": [
-    "."
+    ".",
+    "./sveltekit"
   ],
   "dependencies": {
     "@happyvertical/smrt-config": "workspace:*",
@@ -23,7 +24,9 @@
     "@happyvertical/smrt-users": "workspace:*",
     "@happyvertical/sql": "catalog:",
     "@happyvertical/smrt-vitest": "workspace:*",
+    "@sveltejs/kit": "^2.20.0",
     "@types/node": "24.13.6",
+    "tsx": "^4.23.13",
     "typescript": "6.0.3",
     "vite": "8.1.4",
     "vitest": "4.1.10"
@@ -63,5 +66,5 @@
     "polymorphicAssociations": 0,
     "uuidColumns": 0
   },
-  "agentDoc": "# @happyvertical/smrt-app-runtime\n\nApplication infrastructure composition for the validated runtime profiles in\n`@happyvertical/smrt-config`.\n\n## Local profile\n\n- `validateApplicationId()` is the canonical strict validator for explicit app\n  IDs. `encodeApplicationId()` derives a length-bounded, collision-resistant\n  ID from package names; generated operational surfaces must share these APIs.\n- `initializeLocalApplicationRuntime()` owns user data paths, SQLite tuning,\n  local application-secret creation, and the single-use owner bootstrap flow.\n- SQLite is acquired through `@happyvertical/sql`'s explicit\n  `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the\n  runtime establishes its user-owned mode-0700 data root.\n- Application migrations are explicit through `prepareDatabase`; runtime never\n  creates application model tables implicitly. A rejected `prepareDatabase` is\n  normalized into `LocalRuntimeError` with the stable `migration_failed` code\n  and the fixed recovery message `MIGRATION_FAILED_MESSAGE` (\"run pnpm\n  app:setup and inspect the private migration logs\"). The caller's error text\n  is never surfaced — it is retained only as a non-enumerable `cause` for\n  private logs — and the same application root stays retryable.\n- Standalone migration commands must call `prepareLocalDatabaseStorage()`\n  before opening SQLite so custody is established without creating schema or\n  bootstrap records.\n- Read-only/copy/import operator commands must call\n  `validateLocalDatabaseStorage()` before opening SQLite; it verifies the\n  app-bound marker, source separation, real path chain, ownership, and mode\n  without creating or repairing storage.\n- Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /\n  `Membership`, and `Session` records in one transaction.\n- Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.\n  A token that cannot claim fails a read-only preflight before role/catalog\n  seeding (#3323); the claim transaction's conditional UPDATE stays the\n  authority for single use, expiry, and concurrency.\n- Background jobs and application-defined paid capabilities are default-off.\n- The embedded runner reuses `TaskRunner`; it is not a second job contract.\n\n## Deployed profiles\n\n- `initializeDeployedApplicationRuntime()` composes only `self-hosted` and\n  `cloud`; it rejects local initialization and provider/binding mismatches.\n- Provider bindings own credentials, vendor clients, and readiness checks.\n  Runtime diagnostics contain selectors and status only.\n- The database binding must expose a provider-owned `close` callback before\n  `connect` can run. The runtime owns that cleanup boundary and runs the\n  application's explicit, idempotent `prepareDatabase` hook.\n- A failed startup cleanup throws `DeployedRuntimeCleanupError`; callers retain\n  and retry its idempotent `retryCleanup()` boundary until it succeeds.\n- Public authentication, asset storage, and secret bindings are mandatory and\n  readiness-checked before startup succeeds.\n- `createTaskWorker()` and `createScheduleWorker()` initialize the normal jobs\n  package runners against the shared PostgreSQL database. They are intended for\n  separate processes; the web process does not start them automatically. The\n  worker process must import the app's compiled registration\n  (`.smrt/runtime/register.js`, #3117) first; runners resolve `objectType`\n  through the registry and never load application source themselves.\n- `close()` drains in-flight readiness/session/worker initialization and\n  serialized runner start/stop operations, stops every runner returned by the\n  runtime, and then closes PostgreSQL. Returned runners must not be restarted\n  after runtime shutdown begins.\n- A tracked operation may await a re-entrant `close()` request without\n  deadlocking; external `close()` callers still await complete cleanup.\n- `health()` is process liveness. `readiness()` probes database/auth/assets/\n  secrets; it does not claim that an external worker fleet is running.\n- Database-provider readiness is additive; a PostgreSQL-specific server-version\n  probe always gates startup and live readiness.\n- Cloud must keep required tenant context and must never introduce a root or\n  unscoped tenant fallback. RLS remains an explicit deployment/migration choice.\n\n## Public runtime diagnostics\n\n- `projectRuntimeDiagnostics()` is the only public diagnostic projection. It\n  constructs the schema-version-1 allowlist and never serializes the private\n  local or deployed diagnostics objects.\n- The allowlist is limited to active profile/coarse health, schema and\n  migration readiness, six fixed capability statuses, a sorted/capped public\n  tool inventory plus digest, explicit operational topology differences,\n  coarse worker heartbeat state, and eight stable code/timestamp errors.\n- Callers supply an explicit clock and worker-heartbeat seam. A missing\n  heartbeat is `unknown`; web-process liveness never proves worker liveness.\n- Error ingestion maps unknown codes to `runtime_error`, truncates timestamps\n  to the minute, and ignores messages, stacks, logs, records, and nested state.\n- Authentication and diagnostics-read authorization belong before every call\n  to the projector or its runtime probes.\n\n## Invariants\n\n- Never expose application-secret bytes or bootstrap token hashes in diagnostics.\n- Never include migration or provider error text in a local or deployed startup\n  error message; migration driver text is a likely credential carrier.\n- Never include provider error text, URLs, tokens, or credentials in deployed\n  errors, diagnostics, health, or readiness payloads.\n- Keep local data, assets, database, and secrets outside the source tree.\n- Do not reach into collection/database private fields. Add an upstream public\n  API if composition cannot be expressed through exported surfaces.\n- Keep profile selection out of domain models, generated APIs, MCP/WebMCP\n  surfaces, effects, approvals, and authorization records.\n\n## Validation\n\n```bash\npnpm --filter @happyvertical/smrt-app-runtime test\npnpm --filter @happyvertical/smrt-app-runtime typecheck\npnpm --filter @happyvertical/smrt-app-runtime build\n```\n"
+  "agentDoc": "# @happyvertical/smrt-app-runtime\n\nApplication infrastructure composition for the validated runtime profiles in\n`@happyvertical/smrt-config`.\n\n## Local profile\n\n- `validateApplicationId()` is the canonical strict validator for explicit app\n  IDs. `encodeApplicationId()` derives a length-bounded, collision-resistant\n  ID from package names; generated operational surfaces must share these APIs.\n- `initializeLocalApplicationRuntime()` owns user data paths, SQLite tuning,\n  local application-secret creation, and the single-use owner bootstrap flow.\n- SQLite is acquired through `@happyvertical/sql`'s explicit\n  `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the\n  runtime establishes its user-owned mode-0700 data root.\n- Application migrations are explicit through `prepareDatabase`; runtime never\n  creates application model tables implicitly. A rejected `prepareDatabase` is\n  normalized into `LocalRuntimeError` with the stable `migration_failed` code\n  and the fixed recovery message `MIGRATION_FAILED_MESSAGE` (\"run pnpm\n  app:setup and inspect the private migration logs\"). The caller's error text\n  is never surfaced — it is retained only as a non-enumerable `cause` for\n  private logs — and the same application root stays retryable.\n- Standalone migration commands must call `prepareLocalDatabaseStorage()`\n  before opening SQLite so custody is established without creating schema or\n  bootstrap records.\n- Read-only/copy/import operator commands must call\n  `validateLocalDatabaseStorage()` before opening SQLite; it verifies the\n  app-bound marker, source separation, real path chain, ownership, and mode\n  without creating or repairing storage.\n- Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /\n  `Membership`, and `Session` records in one transaction.\n- Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.\n  A token that cannot claim fails a read-only preflight before role/catalog\n  seeding (#3323); the claim transaction's conditional UPDATE stays the\n  authority for single use, expiry, and concurrency.\n- Background jobs and application-defined paid capabilities are default-off.\n- The embedded runner reuses `TaskRunner`; it is not a second job contract.\n\n## Deployed profiles\n\n- `initializeDeployedApplicationRuntime()` composes only `self-hosted` and\n  `cloud`; it rejects local initialization and provider/binding mismatches.\n- Provider bindings own credentials, vendor clients, and readiness checks.\n  Runtime diagnostics contain selectors and status only.\n- The database binding must expose a provider-owned `close` callback before\n  `connect` can run. The runtime owns that cleanup boundary and runs the\n  application's explicit, idempotent `prepareDatabase` hook.\n- A failed startup cleanup throws `DeployedRuntimeCleanupError`; callers retain\n  and retry its idempotent `retryCleanup()` boundary until it succeeds.\n- Public authentication, asset storage, and secret bindings are mandatory and\n  readiness-checked before startup succeeds.\n- `createTaskWorker()` and `createScheduleWorker()` initialize the normal jobs\n  package runners against the shared PostgreSQL database. They are intended for\n  separate processes; the web process does not start them automatically. The\n  worker process must import the app's compiled registration\n  (`.smrt/runtime/register.js`, #3117) first; runners resolve `objectType`\n  through the registry and never load application source themselves.\n- `close()` drains in-flight readiness/session/worker initialization and\n  serialized runner start/stop operations, stops every runner returned by the\n  runtime, and then closes PostgreSQL. Returned runners must not be restarted\n  after runtime shutdown begins.\n- A tracked operation may await a re-entrant `close()` request without\n  deadlocking; external `close()` callers still await complete cleanup.\n- `health()` is process liveness. `readiness()` probes database/auth/assets/\n  secrets; it does not claim that an external worker fleet is running.\n- Database-provider readiness is additive; a PostgreSQL-specific server-version\n  probe always gates startup and live readiness.\n- Cloud must keep required tenant context and must never introduce a root or\n  unscoped tenant fallback. RLS remains an explicit deployment/migration choice.\n\n## SvelteKit entry (`./sveltekit`)\n\n- Server-only subpath; `@sveltejs/kit` is an optional peer and is externalized\n  in `vite.config.ts` (kit recognizes `redirect`/`fail` by class identity).\n  The root entry must never import kit or Svelte.\n- `createSmrtSvelteKitRuntime()` order is fixed: readiness gate → URL tenant\n  selection (`locals.selectedTenant*`, never tenant context, headers ignored) →\n  verified session (tenant context entered only when\n  `isSessionTenantAuthorized()` accepts it, else unauthenticated; never via\n  `createSessionHandler`, which re-runs `resolve` on downstream errors) →\n  publish `locals.tenantContext` only for that verified tenant.\n- `database-rls` isolation forces `postgresRls: true`, including on\n  `skipPaths` (anonymous principal). `resolve` runs at most once;\n  session-layer failure before it is a 500 with cleared locals.\n- In an RLS request `classOptions()`/`databaseConfig()` return the\n  transaction-bound request db (class `db` overrides win). Anything that\n  outlives a request (session service, tenant selector) must use the base\n  config, never these.\n- The writer lease, provider readiness, and onboarding file cleanup are\n  injected hooks. Apps pass the root entry's `acquireWriterLease` (over\n  `prepareApplicationStateRoot`) and `createProviderReadinessProbe`; deployed\n  startup fails closed without `providerReadiness`.\n- Owner setup re-checks loopback peer and loopback URL host per request and\n  returns only fixed `{ code, message }` failures.\n- `resolveApplicationId()` / `runtimeConfigurationFingerprint()` must stay\n  byte-compatible with process managers (golden vectors in tests).\n\n## Operator state (root entry)\n\n- One owner for the state shared by the web process and `smrt app`\n  (`@happyvertical/smrt-cli/app` re-exports these): `resolveApplicationStateRoot`\n  / `prepareApplicationStateRoot` (private app-bound mode-0700 root and\n  marker), `withOperationLock` (`operation.lock`), `acquireWriterLease` /\n  `readActiveWriterLease` (`writer.lease`), `reclaimStaleRecord`, and\n  `createProviderReadinessProbe` (`SMRT_*_READINESS_MODULE`, resolved from the\n  app root with Node's own ESM rules). File names, record formats, and\n  messages are a cross-process contract; never change them unilaterally.\n- Tests that hook `node:fs` interleavings must live in this package: from a\n  consumer the package is an externalized dependency a mock cannot reach.\n\n## Public runtime diagnostics\n\n- `projectRuntimeDiagnostics()` is the only public diagnostic projection. It\n  constructs the schema-version-1 allowlist and never serializes the private\n  local or deployed diagnostics objects.\n- The allowlist is limited to active profile/coarse health, schema and\n  migration readiness, six fixed capability statuses, a sorted/capped public\n  tool inventory plus digest, explicit operational topology differences,\n  coarse worker heartbeat state, and eight stable code/timestamp errors.\n- Callers supply an explicit clock and worker-heartbeat seam. A missing\n  heartbeat is `unknown`; web-process liveness never proves worker liveness.\n- Error ingestion maps unknown codes to `runtime_error`, truncates timestamps\n  to the minute, and ignores messages, stacks, logs, records, and nested state.\n- Authentication and diagnostics-read authorization belong before every call\n  to the projector or its runtime probes.\n\n## Invariants\n\n- Never expose application-secret bytes or bootstrap token hashes in diagnostics.\n- Never include migration or provider error text in a local or deployed startup\n  error message; migration driver text is a likely credential carrier.\n- Never include provider error text, URLs, tokens, or credentials in deployed\n  errors, diagnostics, health, or readiness payloads.\n- Keep local data, assets, database, and secrets outside the source tree.\n- Do not reach into collection/database private fields. Add an upstream public\n  API if composition cannot be expressed through exported surfaces.\n- Keep profile selection out of domain models, generated APIs, MCP/WebMCP\n  surfaces, effects, approvals, and authorization records.\n\n## Validation\n\n```bash\npnpm --filter @happyvertical/smrt-app-runtime test\npnpm --filter @happyvertical/smrt-app-runtime typecheck\npnpm --filter @happyvertical/smrt-app-runtime build\n```\n"
 }

package/dist/stale-reclaim.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Serialized removal of stale `operation.lock` / `writer.lease` files.
+ *
+ * Deciding a lock is stale (owner pid gone) and unlinking it are two steps,
+ * and POSIX has no "unlink if unchanged". Two reclaimers that both observed
+ * the same dead owner could otherwise interleave so that the slower one
+ * unlinks the live lock the faster one just created (#3371 review R1).
+ *
+ * Every reclamation therefore runs under an exclusive SQLite transaction on
+ * a dedicated mutex database next to the lock. The kernel releases that lock
+ * when its holder dies, so the mutex itself can never go stale, and nothing
+ * on the lock path is renamed or replaced. Under the mutex the reclaimer
+ * re-reads the lock and only unlinks the exact record it judged stale, after
+ * re-checking that its owner is still gone. Acquisition stays a plain
+ * `O_EXCL` create, so record formats are unchanged and readable by the
+ * template's original scripts.
+ */
+/** Mutex database file created in the lock's (private) state directory. */
+export declare const RECLAIM_MUTEX_FILE = ".smrt-lock-reclaim.sqlite";
+/** Outcome of {@link reclaimStaleRecord}. */
+export type ReclaimOutcome = 
+/** The observed stale record was removed by this call. */
+'removed'
+/** The lock no longer exists (another reclaimer removed it). */
+ | 'gone'
+/** The lock now holds a different record, or its owner is live: untouched. */
+ | 'changed';
+/**
+ * Remove `path` only if it still contains exactly `observed` and
+ * `isStale(observed)` still holds, serialized against every other reclaimer.
+ */
+export declare function reclaimStaleRecord(path: string, observed: string, isStale: (contents: string) => boolean): ReclaimOutcome;
+//# sourceMappingURL=stale-reclaim.d.ts.map

package/dist/stale-reclaim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-reclaim.d.ts","sourceRoot":"","sources":["../src/stale-reclaim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAK9D,6CAA6C;AAC7C,MAAM,MAAM,cAAc;AACxB,0DAA0D;AACxD,SAAS;AACX,gEAAgE;GAC9D,MAAM;AACR,8EAA8E;GAC5E,SAAS,CAAC;AAoCd;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACrC,cAAc,CAahB"}

package/dist/state-root.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Private, app-bound state root shared by the running web process and the
+ * `smrt app` operator commands (`writer.lease`, `operation.lock`, onboarding
+ * handoff files).
+ *
+ * The path is derived from the canonical application/data identity so every
+ * process managing one database root shares one lock domain. Moved here from
+ * `@happyvertical/smrt-cli/app` (which re-exports it) so the web process does
+ * not depend on the CLI package; files, names, and error messages are
+ * unchanged from the template's former `scripts/smrt-runtime-identity.mjs`.
+ */
+/** Inputs for the state-root resolvers. */
+export interface ApplicationStateRootOptions {
+    appId: string;
+    dataDirectory?: string;
+    sourceRoot?: string;
+    /** Testable platform override. */
+    platformName?: NodeJS.Platform | string;
+    /** Testable home-directory override. */
+    homeDirectory?: string;
+    /** Testable environment override. */
+    environment?: Record<string, string | undefined>;
+}
+/**
+ * State is derived from the canonical application/data identity. It is not an
+ * independent override because every process and operator command must share
+ * one lock domain for a given database root.
+ */
+export declare function resolveApplicationStateRoot(options: ApplicationStateRootOptions): string;
+/** Owner check seam; production uses the real process uid. */
+export interface StateCustodyOptions {
+    /**
+     * Testable uid override (e.g. to prove a foreign owner is rejected). It can
+     * only substitute a uid; it cannot disable the ownership check.
+     */
+    currentUid?: number;
+}
+/**
+ * Create or verify the private, app-bound state/lock directory.
+ */
+export declare function prepareApplicationStateRoot(options: ApplicationStateRootOptions & StateCustodyOptions): string;
+//# sourceMappingURL=state-root.d.ts.map

package/dist/state-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-root.d.ts","sourceRoot":"","sources":["../src/state-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAgBH,2CAA2C;AAC3C,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;IACxC,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,GACnC,MAAM,CAoBR;AAWD,8DAA8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,2BAA2B,GAAG,mBAAmB,GACzD,MAAM,CAyFR"}

package/dist/sveltekit/handlers.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Mountable runtime routes: liveness health, authorized diagnostics, and the
+ * server-owned session summary for the root layout.
+ */
+import { type RequestHandler } from '@sveltejs/kit';
+import type { RuntimeDiagnostics } from '../runtime-diagnostics.js';
+import type { ApplicationRuntimeDiagnosticsOptions, SmrtSvelteKitRuntime } from './runtime.js';
+/** Explicit permission that grants diagnostics read without the owner role. */
+export declare const RUNTIME_DIAGNOSTICS_READ_PERMISSION = "runtime_diagnostics.read";
+/**
+ * Mount as `src/routes/api/_runtime/health/+server.ts`:
+ * `export const GET = createRuntimeHealthHandler(runtime);`
+ *
+ * Local responses add the application ID, managed process instance, and the
+ * secret-free configuration fingerprint that process managers compare.
+ * Deployed responses expose only schema version, status, and profile.
+ */
+export declare function createRuntimeHealthHandler(runtime: Pick<SmrtSvelteKitRuntime, 'health'>): RequestHandler;
+/** The locals the diagnostics route authorizes against. */
+export interface DiagnosticsPrincipalLocals {
+    readonly user?: {
+        readonly id?: unknown;
+    } | null;
+    readonly membership?: {
+        readonly userId?: unknown;
+        readonly tenantId?: unknown;
+        readonly roleId?: unknown;
+        isActive?: () => boolean;
+    } | null;
+    readonly permissions?: readonly string[];
+    readonly tenantId?: unknown;
+    readonly sessionId?: unknown;
+}
+type DiagnosticsInputValue<T> = T | (() => T);
+export interface RuntimeDiagnosticsHandlerOptions {
+    /** Supplies default diagnostics reading and owner-role lookup. */
+    readonly runtime?: Pick<SmrtSvelteKitRuntime, 'readDiagnostics' | 'classOptions'>;
+    /** Replace the runtime projection (must already be the public allowlist). */
+    readonly readDiagnostics?: () => Promise<RuntimeDiagnostics>;
+    /** Replace the owner-role lookup. Thrown errors deny. */
+    readonly resolveRoleSlug?: (roleId: string) => Promise<string | null>;
+    /** Override where the principal comes from. Defaults to `event.locals`. */
+    readonly resolveLocals?: (event: {
+        readonly locals: unknown;
+    }) => DiagnosticsPrincipalLocals;
+    /** Public tool inventory (sorted/capped by the projector). */
+    readonly toolNames?: DiagnosticsInputValue<readonly string[]>;
+    readonly schemaStatus?: DiagnosticsInputValue<ApplicationRuntimeDiagnosticsOptions['schemaStatus']>;
+    readonly migrationStatus?: DiagnosticsInputValue<ApplicationRuntimeDiagnosticsOptions['migrationStatus']>;
+    readonly workerHeartbeatAt?: () => Date | string | null | undefined;
+    readonly recentErrors?: () => ApplicationRuntimeDiagnosticsOptions['recentErrors'];
+    /** Testable clock. */
+    readonly now?: () => Date;
+}
+/**
+ * Mount as `src/routes/api/_runtime/diagnostics/+server.ts`:
+ * `export const GET = createRuntimeDiagnosticsHandler({ runtime });`
+ *
+ * Authentication and authorization always complete before the private runtime
+ * is read. Authorized callers hold `runtime_diagnostics.read` or the `owner`
+ * role of their active, session-matching membership. Every failure is a
+ * stable `{ schemaVersion: 1, error: { code } }` body.
+ */
+export declare function createRuntimeDiagnosticsHandler(options: RuntimeDiagnosticsHandlerOptions): RequestHandler;
+/** Server-owned session summary for the root layout. */
+export interface SessionLayoutData {
+    readonly session: {
+        readonly authenticated: boolean;
+        /** Tenant authorized by the active session. */
+        readonly activeTenantId: string | null;
+        /** URL-selected tenant candidate; display only, never authorization. */
+        readonly selectedTenantSlug: string | null;
+    };
+}
+/**
+ * Mount as `src/routes/+layout.server.ts`:
+ * `export const load = createSessionLayoutLoad();`
+ */
+export declare function createSessionLayoutLoad(): (event: {
+    readonly locals: unknown;
+}) => SessionLayoutData;
+export {};
+//# sourceMappingURL=handlers.d.ts.map

package/dist/sveltekit/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/sveltekit/handlers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EACV,oCAAoC,EACpC,oBAAoB,EACrB,MAAM,cAAc,CAAC;AAEtB,+EAA+E;AAC/E,eAAO,MAAM,mCAAmC,6BAA6B,CAAC;AAE9E;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAC5C,cAAc,CAEhB;AAED,2DAA2D;AAC3D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,KAAK,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAE9C,MAAM,WAAW,gCAAgC;IAC/C,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CACrB,oBAAoB,EACpB,iBAAiB,GAAG,cAAc,CACnC,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7D,yDAAyD;IACzD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KAC1B,KAAK,0BAA0B,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAC3C,oCAAoC,CAAC,cAAc,CAAC,CACrD,CAAC;IACF,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAC9C,oCAAoC,CAAC,iBAAiB,CAAC,CACxD,CAAC;IACF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,oCAAoC,CAAC,cAAc,CAAC,CAAC;IACnF,sBAAsB;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAQD;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,cAAc,CA+DhB;AAoCD,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAChC,+CAA+C;QAC/C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QACvC,wEAAwE;QACxE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5C,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,KAAK,iBAAiB,CAetB"}

package/dist/sveltekit/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SvelteKit server entry for `@happyvertical/smrt-app-runtime`.
+ *
+ * Server-only: this entry never imports Svelte components or browser code.
+ * `@sveltejs/kit` is an optional peer dependency resolved from the consumer.
+ *
+ * @example
+ * ```ts
+ * // src/hooks.server.ts
+ * import { createSmrtSvelteKitRuntime } from '@happyvertical/smrt-app-runtime/sveltekit';
+ *
+ * export const runtime = createSmrtSvelteKitRuntime();
+ * export const { handle, init } = runtime;
+ * ```
+ */
+export { createRuntimeDiagnosticsHandler, createRuntimeHealthHandler, createSessionLayoutLoad, type DiagnosticsPrincipalLocals, RUNTIME_DIAGNOSTICS_READ_PERMISSION, type RuntimeDiagnosticsHandlerOptions, type SessionLayoutData, } from './handlers.js';
+export { createOwnerSetupPage, DEFAULT_OWNER_SETUP_MESSAGES, isLoopbackAddress, isLoopbackHostname, isLoopbackRequest, OWNER_SETUP_FIELDS, type OwnerSetupActionEvent, type OwnerSetupErrorCode, type OwnerSetupEvent, type OwnerSetupFailure, type OwnerSetupPage, type OwnerSetupPageData, type OwnerSetupPageOptions, } from './owner-setup.js';
+export { type ApplicationRuntimeDiagnosticsOptions, authorizedTenantLocalsHandle, composeHandles, createSmrtSvelteKitRuntime, type ProviderReadinessComponent, type ProviderReadinessFactory, type RuntimeHealthBody, type SmrtRuntimeBoundPrincipal, type SmrtRuntimeLocals, type SmrtRuntimeSessionCookie, type SmrtRuntimeSessionOptions, type SmrtSvelteKitRuntime, type SmrtSvelteKitRuntimeOptions, type WriterLease, type WriterLeaseContext, } from './runtime.js';
+export { createSubdomainTenantSelector, normalizeTenantSelection, type SubdomainTenantSelectorOptions, selectTenantSlug, type TenantSelection, type TenantSelectionEvent, type TenantSelector, } from './tenancy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/sveltekit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,mCAAmC,EACnC,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,oCAAoC,EACzC,4BAA4B,EAC5B,cAAc,EACd,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,8BAA8B,EACnC,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC"}

package/dist/sveltekit/owner-setup.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Server half of the local owner-setup page (`src/routes/setup/+page.server.ts`).
+ *
+ * Owner bootstrap is local-profile only, loopback-only, and single-use. The
+ * runtime stores only an HMAC of the short-lived token; this module never
+ * stores, logs, or returns claim errors, and it re-checks loopback custody on
+ * every request instead of trusting the bind host alone.
+ */
+import type { Cookies } from '@sveltejs/kit';
+import { type ActionFailure } from '@sveltejs/kit';
+import type { LocalOwnerClaimResult } from '../index.js';
+import type { SmrtSvelteKitRuntime } from './runtime.js';
+/** Data returned by the setup page `load`. */
+export interface OwnerSetupPageData {
+    /** False when setup is claimed, disabled (deployed), or not loopback. */
+    readonly available: boolean;
+    /** One-time token from `?token=` (empty unless available). */
+    readonly token: string;
+}
+/** Stable failure codes returned by the setup action. */
+export type OwnerSetupErrorCode = 
+/** Not the local profile (HTTP 404). */
+'setup_disabled'
+/** Request is not from a loopback client on a loopback host (HTTP 403). */
+ | 'setup_unavailable'
+/** Missing token, blank name, or email without `@` (HTTP 400). */
+ | 'setup_invalid_input'
+/** Token wrong, expired, or already used; owner already claimed (HTTP 400). */
+ | 'setup_invalid';
+/** `form` data returned with `fail(status, …)`. */
+export interface OwnerSetupFailure {
+    readonly code: OwnerSetupErrorCode;
+    /** Fixed, secret-free message; never claim error text. */
+    readonly message: string;
+}
+/** Form field names posted to the setup action. */
+export declare const OWNER_SETUP_FIELDS: Readonly<{
+    readonly token: "token";
+    readonly name: "name";
+    readonly email: "email";
+    readonly tenantName: "tenantName";
+}>;
+export declare const DEFAULT_OWNER_SETUP_MESSAGES: Readonly<Record<OwnerSetupErrorCode, string>>;
+/** The request fields the setup page reads. */
+export interface OwnerSetupEvent {
+    readonly url: URL;
+    readonly locals: unknown;
+    getClientAddress(): string;
+}
+export interface OwnerSetupActionEvent extends OwnerSetupEvent {
+    readonly request: Request;
+    readonly cookies: Pick<Cookies, 'set'>;
+}
+export interface OwnerSetupPageOptions {
+    /** Where a signed-in visitor or a successful claim is sent. Default `/`. */
+    readonly redirectTo?: string;
+    /** Replace fixed failure messages (for example app-specific recovery steps). */
+    readonly messages?: Partial<Record<OwnerSetupErrorCode, string>>;
+    /** Override where the signed-in user comes from. Defaults to `locals.user`. */
+    readonly resolveUser?: (event: OwnerSetupEvent) => unknown;
+    /**
+     * Best-effort cleanup after a successful claim (for example removing local
+     * onboarding handoff files). Errors are ignored: the owner and session are
+     * already authoritative and a stale token now fails closed.
+     */
+    readonly onOwnerClaimed?: (result: LocalOwnerClaimResult, event: OwnerSetupActionEvent) => void | Promise<void>;
+}
+export interface OwnerSetupPage {
+    readonly load: (event: OwnerSetupEvent) => Promise<OwnerSetupPageData>;
+    readonly actions: {
+        readonly default: (event: OwnerSetupActionEvent) => Promise<ActionFailure<OwnerSetupFailure>>;
+    };
+}
+/**
+ * Mount as `src/routes/setup/+page.server.ts`:
+ *
+ * ```ts
+ * import { createOwnerSetupPage } from '@happyvertical/smrt-app-runtime/sveltekit';
+ * import { runtime } from '../../hooks.server';
+ *
+ * export const { load, actions } = createOwnerSetupPage(runtime);
+ * ```
+ *
+ * The form posts to the `default` action with fields `token` (hidden),
+ * `name`, `email`, and optional `tenantName`. Success sets the session cookie
+ * and redirects 303; failures return `fail(status, { code, message })`.
+ */
+export declare function createOwnerSetupPage(runtime: Pick<SmrtSvelteKitRuntime, 'resolvedRuntime' | 'localRuntime' | 'sessionCookie'>, options?: OwnerSetupPageOptions): OwnerSetupPage;
+/**
+ * True only when both the peer address and the addressed host are loopback.
+ * The host check rejects tunnels and DNS-rebinding hosts that forward to a
+ * loopback listener; a throwing `getClientAddress` is treated as remote.
+ */
+export declare function isLoopbackRequest(event: {
+    readonly url: URL;
+    getClientAddress(): string;
+}): boolean;
+/** Loopback IP literal: `127.0.0.0/8`, `::1`, or IPv4-mapped `127/8`. */
+export declare function isLoopbackAddress(value: string | null | undefined): boolean;
+/** Loopback host name as SvelteKit reports it in `url.hostname`. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+//# sourceMappingURL=owner-setup.d.ts.map

package/dist/sveltekit/owner-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-setup.d.ts","sourceRoot":"","sources":["../../src/sveltekit/owner-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,yDAAyD;AACzD,MAAM,MAAM,mBAAmB;AAC7B,wCAAwC;AACtC,gBAAgB;AAClB,2EAA2E;GACzE,mBAAmB;AACrB,kEAAkE;GAChE,qBAAqB;AACvB,+EAA+E;GAC7E,eAAe,CAAC;AAEpB,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mDAAmD;AACnD,eAAO,MAAM,kBAAkB;;;;;EAKpB,CAAC;AAEZ,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAOnC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gBAAgB,IAAI,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,qBAAqB,KACzB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,qBAAqB,KACzB,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,IAAI,CACX,oBAAoB,EACpB,iBAAiB,GAAG,cAAc,GAAG,eAAe,CACrD,EACD,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAuFhB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,gBAAgB,IAAI,MAAM,CAAC;CAC5B,GAAG,OAAO,CAQV;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAc3E;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D"}