@loomwork/event-runtime 0.0.0-stage → 0.1.0

package/dist/installOptional.d.ts

@@ -0,0 +1,52 @@
+/**
+ * How a store decorator handles one OPTIONAL SPI method of the store it wraps (ADR 0074
+ * Amendment, L1):
+ *
+ * - `"forward"` — call the inner store's method verbatim (bound to the inner store);
+ * - a function — the decorator's own implementation (it transforms ids, payloads, …);
+ * - `{ refuse: reason }` — deliberately NOT offered, with the reason recorded. The method is
+ *   left uninstalled, so callers see exactly what they see for a store without it.
+ *
+ * What the compiler enforces: every key in `M` is REQUIRED (`-?` strips the `?` a mapped type
+ * over `S` would otherwise inherit from the optional SPI methods). So a decorator whose plan is
+ * `satisfies DecoratorPlan<EventStore, OptionalEventStoreMethod>` fails to compile if it omits
+ * any optional method — including one added to the SPI later, since `OptionalEventStoreMethod`
+ * is derived from the interface. Pinned by `decoratorPlan.typecheck.ts`, which `pnpm typecheck`
+ * checks. What it cannot enforce: that a decorator uses a plan at all — that is the decorator
+ * conformance kit's job, and the `packages/spec` fitness test makes every decorator run it.
+ */
+export type DecoratorPlan<S, M extends keyof S> = {
+    readonly [K in M]-?: "forward" | NonNullable<S[K]> | {
+        readonly refuse: string;
+    };
+};
+/**
+ * Install each optional method of `plan` on `target`, **iff the inner store has it** — so a
+ * capability probe (`if (store.copyPrefix)`) answers exactly as it would against `inner`,
+ * and a decorator never advertises a capability its backend lacks. O(|M|) once, at
+ * construction; zero cost per call (a forward is a bound method, not a trampoline).
+ *
+ * A function entry is bound to `bindTo` when given (a decorator whose implementation uses
+ * `this`), else installed as-is. `{ refuse }` entries are recorded for {@link refusalsOf}.
+ *
+ * Also carries the inner store's structural encryption marker (`keys`) onto `target` when
+ * `target` does not define its own — see {@link ENCRYPTION_MARKER}.
+ */
+export declare function installOptional<S extends object, M extends keyof S>(target: S, inner: S, plan: DecoratorPlan<S, M>, bindTo?: object): void;
+/** The store `target` was built over (recorded by {@link forwardStoreMarkers}), or `undefined`. */
+export declare function decoratedInnerOf(target: object): object | undefined;
+/**
+ * Carry the STRUCTURAL markers other layers read by shape from `inner` up to the decorator `target`
+ * (unless `target` defines its own): the encryption marker `keys`, `sealsWholeState` (ADR 0130 D8) and
+ * the tenant marker `tenantScope` (ADR 0138 H3), the snapshot codec marker `snapshotCodec` (ADR 0141), and record `target` as wrapping `inner`. EVERY store
+ * decorator (event, snapshot, archive) must call this - {@link installOptional} does - or a guard that
+ * reads a marker on the outermost store sees a plain, unscoped one. The decorator conformance kit
+ * asserts it for each decorator in the repo.
+ */
+export declare function forwardStoreMarkers(target: object, inner: object): void;
+/**
+ * The optional methods a decorator deliberately refused through {@link installOptional},
+ * with their reasons. Empty for a store that refused nothing (or did not use the helper).
+ */
+export declare function refusalsOf(store: object): ReadonlyMap<string, string>;
+//# sourceMappingURL=installOptional.d.ts.map

package/dist/installOptional.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installOptional.d.ts","sourceRoot":"","sources":["../src/installOptional.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI;IAChD,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CACjF,CAAC;AAiBF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EACjE,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,CAAC,EACR,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,EACzB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAsBN;AAgBD,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAuBvE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAErE"}

package/dist/installOptional.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installOptional = installOptional;
+exports.decoratedInnerOf = decoratedInnerOf;
+exports.forwardStoreMarkers = forwardStoreMarkers;
+exports.refusalsOf = refusalsOf;
+// Refusals, keyed by the decorated object. A WeakMap so a discarded store takes its entry
+// with it; read back by the decorator conformance kit through `refusalsOf`.
+const refusals = new WeakMap();
+/**
+ * The encryption-boundary marker a store exposes structurally (`EncryptingEventStore.keys`,
+ * `EncryptingSnapshotStore.keys`). `loom doctor` and `LogLifecycle`'s compaction/archive
+ * guard read it by shape, so a decorator stacked ABOVE an encrypting store must carry it up —
+ * otherwise `Coalescing(Encrypting(pg))` looks like a plain store and compaction would write
+ * the decrypted fold to a plaintext snapshot store (ADR 0022 Amendment).
+ */
+const ENCRYPTION_MARKER = "keys";
+/** `EncryptingSnapshotStore.sealsWholeState` (ADR 0130 D8), carried up the same way. */
+const WHOLE_STATE_MARKER = "sealsWholeState";
+/**
+ * Install each optional method of `plan` on `target`, **iff the inner store has it** — so a
+ * capability probe (`if (store.copyPrefix)`) answers exactly as it would against `inner`,
+ * and a decorator never advertises a capability its backend lacks. O(|M|) once, at
+ * construction; zero cost per call (a forward is a bound method, not a trampoline).
+ *
+ * A function entry is bound to `bindTo` when given (a decorator whose implementation uses
+ * `this`), else installed as-is. `{ refuse }` entries are recorded for {@link refusalsOf}.
+ *
+ * Also carries the inner store's structural encryption marker (`keys`) onto `target` when
+ * `target` does not define its own — see {@link ENCRYPTION_MARKER}.
+ */
+function installOptional(target, inner, plan, bindTo) {
+    const writable = target;
+    const source = inner;
+    let refused;
+    for (const method of Object.keys(plan)) {
+        const entry = plan[method];
+        if (typeof entry === "object" && entry !== null) {
+            refused ??= new Map();
+            refused.set(String(method), entry.refuse);
+            continue;
+        }
+        const innerMethod = source[method];
+        if (typeof innerMethod !== "function")
+            continue; // the backend lacks it: so do we
+        if (entry === "forward") {
+            writable[method] = innerMethod.bind(inner);
+        }
+        else if (typeof entry === "function") {
+            writable[method] =
+                bindTo === undefined ? entry : entry.bind(bindTo);
+        }
+    }
+    if (refused !== undefined)
+        refusals.set(target, refused);
+    forwardStoreMarkers(target, inner);
+}
+/** `TenantScopedEventStore.tenantScope` (and the archive/snapshot twins), carried up the same way (ADR 0138 H3). */
+const TENANT_MARKER = "tenantScope";
+/**
+ * ADR 0141 - the snapshot codec a store WRITES (`"none" | "zstd"`), carried up through every snapshot
+ * decorator so the composition root (`defineConfig`) reads what the outermost store really does and can
+ * refuse a mismatch, instead of the opt-in being silently dropped by a wrapper.
+ */
+const CODEC_MARKER = "snapshotCodec";
+// Who a decorator wraps, keyed by the decorator: lets a guard walk a stack whose layers hide their
+// inner store (a closure-built decorator exposes no `inner`). A WeakMap, so it never keeps a store alive.
+const wrapped = new WeakMap();
+/** The store `target` was built over (recorded by {@link forwardStoreMarkers}), or `undefined`. */
+function decoratedInnerOf(target) {
+    return wrapped.get(target);
+}
+/**
+ * Carry the STRUCTURAL markers other layers read by shape from `inner` up to the decorator `target`
+ * (unless `target` defines its own): the encryption marker `keys`, `sealsWholeState` (ADR 0130 D8) and
+ * the tenant marker `tenantScope` (ADR 0138 H3), the snapshot codec marker `snapshotCodec` (ADR 0141), and record `target` as wrapping `inner`. EVERY store
+ * decorator (event, snapshot, archive) must call this - {@link installOptional} does - or a guard that
+ * reads a marker on the outermost store sees a plain, unscoped one. The decorator conformance kit
+ * asserts it for each decorator in the repo.
+ */
+function forwardStoreMarkers(target, inner) {
+    const writable = target;
+    const source = inner;
+    wrapped.set(target, inner);
+    const marker = source[ENCRYPTION_MARKER];
+    if (typeof marker === "object" && marker !== null && writable[ENCRYPTION_MARKER] === undefined) {
+        writable[ENCRYPTION_MARKER] = marker;
+    }
+    // ADR 0130 D8 - a snapshot store that seals its WHOLE state says so structurally; a decorator
+    // above it must not hide that (the doctor / kernel would read a sealed store as plaintext).
+    if (source[WHOLE_STATE_MARKER] === true && writable[WHOLE_STATE_MARKER] === undefined) {
+        writable[WHOLE_STATE_MARKER] = true;
+    }
+    // ADR 0138 H3 - a decorator above a tenant-scoped store is still scoped to that tenant.
+    const tenant = source[TENANT_MARKER];
+    if (typeof tenant === "string" && writable[TENANT_MARKER] === undefined) {
+        writable[TENANT_MARKER] = tenant;
+    }
+    // ADR 0141 - a decorator above a codec-writing snapshot store still writes that codec.
+    const codec = source[CODEC_MARKER];
+    if ((codec === "none" || codec === "zstd") && writable[CODEC_MARKER] === undefined) {
+        writable[CODEC_MARKER] = codec;
+    }
+}
+/**
+ * The optional methods a decorator deliberately refused through {@link installOptional},
+ * with their reasons. Empty for a store that refused nothing (or did not use the helper).
+ */
+function refusalsOf(store) {
+    return refusals.get(store) ?? new Map();
+}
+//# sourceMappingURL=installOptional.js.map

package/dist/installOptional.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installOptional.js","sourceRoot":"","sources":["../src/installOptional.ts"],"names":[],"mappings":";;AAgDA,0CA2BC;AAiBD,4CAEC;AAUD,kDAuBC;AAMD,gCAEC;AAlHD,0FAA0F;AAC1F,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAuC,CAAC;AAEpE;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe,CAC7B,MAAS,EACT,KAAQ,EACR,IAAyB,EACzB,MAAe;IAEf,MAAM,QAAQ,GAAG,MAAsC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAqC,CAAC;IACrD,IAAI,OAAwC,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAQ,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAY,CAAC;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,KAAK,IAAI,GAAG,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAG,KAA4B,CAAC,MAAM,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAqB,CAAC,CAAC;QAClD,IAAI,OAAO,WAAW,KAAK,UAAU;YAAE,SAAS,CAAC,iCAAiC;QAClF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,MAAqB,CAAC,GAAI,WAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,QAAQ,CAAC,MAAqB,CAAC;gBAC7B,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,oHAAoH;AACpH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;GAIG;AACH,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC,mGAAmG;AACnG,0GAA0G;AAC1G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAkB,CAAC;AAE9C,mGAAmG;AACnG,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,MAAc,EAAE,KAAa;IAC/D,MAAM,QAAQ,GAAG,MAAsC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAqC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/F,QAAQ,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;IACvC,CAAC;IACD,8FAA8F;IAC9F,4FAA4F;IAC5F,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACtF,QAAQ,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;IACtC,CAAC;IACD,wFAAwF;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,QAAQ,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;IACnC,CAAC;IACD,uFAAuF;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACnF,QAAQ,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1C,CAAC"}

package/dist/keyUnavailable.d.ts

@@ -0,0 +1,67 @@
+import type { EventEnvelope } from "@loomwork/core";
+/** The stable `code` of {@link KeyUnavailableError}. */
+export declare const KEY_UNAVAILABLE_CODE: "KEY_UNAVAILABLE";
+/**
+ * ADR 0130 residuals D7 - a sealing store holds ciphertext for a subject whose key THIS node's key
+ * store does not have, and the log carries NO `PAYLOAD_SHREDDED` tombstone for it: the node is
+ * misconfigured (a different or empty key store), not erased. It is deliberately not
+ * `PayloadShreddedError`, which stays exclusively the erasure outcome. Lives beside the store error
+ * contract so the kernel can recognise it without depending on the crypto plugin.
+ *
+ * Carries the subject id and stream id, never ciphertext or key material. The kernel translates it
+ * to a denial-shaped `SealedStreamUnreadableError` (operator-only detail `key-unavailable`).
+ */
+export declare class KeyUnavailableError extends Error {
+    readonly subjectId: string;
+    readonly streamId?: string | undefined;
+    /** The stream's workflow id (a plaintext column), so the kernel can word its refusal. */
+    readonly workflowId?: string | undefined;
+    /**
+     * The stream with each sealed field replaced by a placeholder (its status and tip are
+     * plaintext). Lets the erasure lifecycle (`EraseCoordinator`, `exportSubject`) judge a stream
+     * in the ShredIncomplete window (key destroyed, tombstone not yet written). Never ciphertext.
+     */
+    readonly redacted?: readonly EventEnvelope[] | undefined;
+    readonly code: "KEY_UNAVAILABLE";
+    constructor(subjectId: string, streamId?: string | undefined, 
+    /** The stream's workflow id (a plaintext column), so the kernel can word its refusal. */
+    workflowId?: string | undefined, 
+    /**
+     * The stream with each sealed field replaced by a placeholder (its status and tip are
+     * plaintext). Lets the erasure lifecycle (`EraseCoordinator`, `exportSubject`) judge a stream
+     * in the ShredIncomplete window (key destroyed, tombstone not yet written). Never ciphertext.
+     */
+    redacted?: readonly EventEnvelope[] | undefined);
+}
+/** True for a {@link KeyUnavailableError}, by its stable `code` (survives duplicate package copies). */
+export declare function isKeyUnavailable(e: unknown): e is KeyUnavailableError;
+/**
+ * ADR 0130 residuals D7 (round 4) - does this stream carry the DURABLE ERASE INTENT of `subjectId`?
+ * `shredSubject` appends an `ERASURE_PENDING` (an existing, ignorable, pure-audit kernel kind) naming
+ * the key's subject to each affected execution's log BEFORE it destroys the key. It is the only
+ * evidence that distinguishes the ShredIncomplete window (key destroyed, tombstone not yet written:
+ * intent present) from a node that simply never had the key (no intent). `subjectId` omitted accepts
+ * any intent.
+ */
+export declare function recordsErasureIntent(events: readonly Pick<EventEnvelope, "eventType" | "payload">[], subjectId?: string): boolean;
+/**
+ * ADR 0130 D7 (round 5) - proof that the KEY STORE destroyed `subjectId`'s key (`KeyStore.wasDestroyed`,
+ * or the operator's explicit assertion `() => true`). The log proves intent, never destruction.
+ */
+export type DestructionProof = (subjectId: string) => boolean | Promise<boolean>;
+/**
+ * The retry window, decided: a {@link KeyUnavailableError} carrying a redacted view is the genuine
+ * ShredIncomplete window ONLY when that view records this subject's erase intent AND `destroyed`
+ * proves the key store destroyed the key (a dangling intent whose key still lives elsewhere is not
+ * the window). No proof, or a false one, fails closed. Returns the redacted view in that case,
+ * `undefined` otherwise (the caller rethrows).
+ */
+export declare function erasureWindowView(err: unknown, destroyed?: DestructionProof): Promise<readonly EventEnvelope[] | undefined>;
+/**
+ * The ONE gate of the retry window: `err` is a {@link KeyUnavailableError} AND `events` (the
+ * stream's log, redacted or raw) records this subject's erase intent AND `destroyed` proves the key
+ * store destroyed the key. Every read in the window (event log, sealed checkpoint) uses it, so
+ * they cannot drift. No proof, or a false one, fails closed.
+ */
+export declare function isErasureWindow(err: unknown, events: readonly Pick<EventEnvelope, "eventType" | "payload">[], destroyed?: DestructionProof): Promise<boolean>;
+//# sourceMappingURL=keyUnavailable.d.ts.map

package/dist/keyUnavailable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyUnavailable.d.ts","sourceRoot":"","sources":["../src/keyUnavailable.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAG,iBAA0B,CAAC;AAE/D;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE;IAX9C,QAAQ,CAAC,IAAI,oBAAwB;gBAE1B,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,YAAA;IAC1B,yFAAyF;IAChF,UAAU,CAAC,EAAE,MAAM,YAAA;IAC5B;;;;OAIG;IACM,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,YAAA;CAQ/C;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,CAAC,EAAE,EAC/D,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAOT;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAAC,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC,CAG/C;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,SAAS,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,SAAS,CAAC,EAAE,EAC/D,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/keyUnavailable.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyUnavailableError = exports.KEY_UNAVAILABLE_CODE = void 0;
+exports.isKeyUnavailable = isKeyUnavailable;
+exports.recordsErasureIntent = recordsErasureIntent;
+exports.erasureWindowView = erasureWindowView;
+exports.isErasureWindow = isErasureWindow;
+/** The stable `code` of {@link KeyUnavailableError}. */
+exports.KEY_UNAVAILABLE_CODE = "KEY_UNAVAILABLE";
+/**
+ * ADR 0130 residuals D7 - a sealing store holds ciphertext for a subject whose key THIS node's key
+ * store does not have, and the log carries NO `PAYLOAD_SHREDDED` tombstone for it: the node is
+ * misconfigured (a different or empty key store), not erased. It is deliberately not
+ * `PayloadShreddedError`, which stays exclusively the erasure outcome. Lives beside the store error
+ * contract so the kernel can recognise it without depending on the crypto plugin.
+ *
+ * Carries the subject id and stream id, never ciphertext or key material. The kernel translates it
+ * to a denial-shaped `SealedStreamUnreadableError` (operator-only detail `key-unavailable`).
+ */
+class KeyUnavailableError extends Error {
+    subjectId;
+    streamId;
+    workflowId;
+    redacted;
+    code = exports.KEY_UNAVAILABLE_CODE;
+    constructor(subjectId, streamId, 
+    /** The stream's workflow id (a plaintext column), so the kernel can word its refusal. */
+    workflowId, 
+    /**
+     * The stream with each sealed field replaced by a placeholder (its status and tip are
+     * plaintext). Lets the erasure lifecycle (`EraseCoordinator`, `exportSubject`) judge a stream
+     * in the ShredIncomplete window (key destroyed, tombstone not yet written). Never ciphertext.
+     */
+    redacted) {
+        super(`the encryption key for subject "${subjectId}"${streamId ? ` (stream "${streamId}")` : ""} is not available to this node and the log records no erasure (no PAYLOAD_SHREDDED): this node's key store lacks the key. It is not a crypto-shred.`);
+        this.subjectId = subjectId;
+        this.streamId = streamId;
+        this.workflowId = workflowId;
+        this.redacted = redacted;
+        this.name = "KeyUnavailableError";
+        Object.setPrototypeOf(this, KeyUnavailableError.prototype);
+    }
+}
+exports.KeyUnavailableError = KeyUnavailableError;
+/** True for a {@link KeyUnavailableError}, by its stable `code` (survives duplicate package copies). */
+function isKeyUnavailable(e) {
+    return e?.code === exports.KEY_UNAVAILABLE_CODE;
+}
+/**
+ * ADR 0130 residuals D7 (round 4) - does this stream carry the DURABLE ERASE INTENT of `subjectId`?
+ * `shredSubject` appends an `ERASURE_PENDING` (an existing, ignorable, pure-audit kernel kind) naming
+ * the key's subject to each affected execution's log BEFORE it destroys the key. It is the only
+ * evidence that distinguishes the ShredIncomplete window (key destroyed, tombstone not yet written:
+ * intent present) from a node that simply never had the key (no intent). `subjectId` omitted accepts
+ * any intent.
+ */
+function recordsErasureIntent(events, subjectId) {
+    return events.some((e) => e.eventType === "ERASURE_PENDING" &&
+        (subjectId === undefined ||
+            e.payload?.subjectId === subjectId));
+}
+/**
+ * The retry window, decided: a {@link KeyUnavailableError} carrying a redacted view is the genuine
+ * ShredIncomplete window ONLY when that view records this subject's erase intent AND `destroyed`
+ * proves the key store destroyed the key (a dangling intent whose key still lives elsewhere is not
+ * the window). No proof, or a false one, fails closed. Returns the redacted view in that case,
+ * `undefined` otherwise (the caller rethrows).
+ */
+async function erasureWindowView(err, destroyed) {
+    if (!isKeyUnavailable(err) || !err.redacted)
+        return undefined;
+    return (await isErasureWindow(err, err.redacted, destroyed)) ? err.redacted : undefined;
+}
+/**
+ * The ONE gate of the retry window: `err` is a {@link KeyUnavailableError} AND `events` (the
+ * stream's log, redacted or raw) records this subject's erase intent AND `destroyed` proves the key
+ * store destroyed the key. Every read in the window (event log, sealed checkpoint) uses it, so
+ * they cannot drift. No proof, or a false one, fails closed.
+ */
+async function isErasureWindow(err, events, destroyed) {
+    if (!isKeyUnavailable(err))
+        return false;
+    if (!recordsErasureIntent(events, err.subjectId))
+        return false;
+    return destroyed !== undefined && (await destroyed(err.subjectId)) === true;
+}
+//# sourceMappingURL=keyUnavailable.js.map

package/dist/keyUnavailable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyUnavailable.js","sourceRoot":"","sources":["../src/keyUnavailable.ts"],"names":[],"mappings":";;;AAsCA,4CAEC;AAUD,oDAUC;AAeD,8CAMC;AAQD,0CAQC;AA/FD,wDAAwD;AAC3C,QAAA,oBAAoB,GAAG,iBAA0B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAa,mBAAoB,SAAQ,KAAK;IAGjC;IACA;IAEA;IAMA;IAXF,IAAI,GAAG,4BAAoB,CAAC;IACrC,YACW,SAAiB,EACjB,QAAiB;IAC1B,yFAAyF;IAChF,UAAmB;IAC5B;;;;OAIG;IACM,QAAmC;QAE5C,KAAK,CACH,mCAAmC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,aAAa,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,qJAAqJ,CAC/O,CAAC;QAbO,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAS;QAEjB,eAAU,GAAV,UAAU,CAAS;QAMnB,aAAQ,GAAR,QAAQ,CAA2B;QAK5C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;CACF;AApBD,kDAoBC;AAED,wGAAwG;AACxG,SAAgB,gBAAgB,CAAC,CAAU;IACzC,OAAQ,CAA+B,EAAE,IAAI,KAAK,4BAAoB,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,MAA+D,EAC/D,SAAkB;IAElB,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,SAAS,KAAK,iBAAiB;QACjC,CAAC,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,OAA0C,EAAE,SAAS,KAAK,SAAS,CAAC,CAC5E,CAAC;AACJ,CAAC;AAQD;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CACrC,GAAY,EACZ,SAA4B;IAE5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,MAA+D,EAC/D,SAA4B;IAE5B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC;AAC9E,CAAC"}

package/dist/leases.d.ts

@@ -0,0 +1,177 @@
+/**
+ * SPI version for the {@link LeaseStore} contract. Pinned by `runLeaseStoreConformance`.
+ *
+ * 2.0.0 (L28): `expired`'s `now` became optional and MUST default to the store's stamping clock.
+ * MAJOR, not additive: a 1.x store written `expired(now: number)` still type-checks against the
+ * new signature but, handed `undefined`, returns `[]` — recovery silently recovers nothing.
+ *
+ * 2.1.0 (L29): optional `storeNow()` — the store's own clock. Additive: a store without it behaves
+ * exactly as before, and a caller with no `storeNow()` falls back to `Date.now()`.
+ *
+ * 2.2.0 (ADR 0130 D11, heartbeat leases): optional `scope` (who can see this store's leases:
+ * "process" | "host" | "cluster"; absent = unknown, treated as NOT cluster-visible), optional `acquireMany` / `renewMany` (returns the HELD
+ * set) / `releaseMany`, and the `steal` option on `acquire`. Additive: a store without them is
+ * driven through the single-id methods by the caller (correct, just slower). A store that claims
+ * 2.2.0 implements all three batch methods and the steal gate; one that claims 2.1.0 is not asked.
+ */
+export declare const LEASE_STORE_SPI_VERSION = "2.2.0";
+export interface Lease {
+    executionId: string;
+    /** Who holds it. A node id, a pod name, a process uuid — the deployment's vocabulary. */
+    owner: string;
+    /**
+     * Absolute expiry (epoch ms), on the store's clock (the one `expired()` defaults to), not
+     * necessarily the caller's. Past this, the lease is collectable by anyone.
+     */
+    expiresAt: number;
+}
+/**
+ * The proof a caller must hold to `steal` a lease: the fence it won with a CONDITIONAL fence
+ * acquisition (`acquireFenceIf`, i.e. proof the execution is parked). The store cannot verify it
+ * against the event log (the lease store is deliberately a separate, dumb SPI); it can only refuse
+ * a steal that does not even carry one, so a flag cannot be passed by accident.
+ *
+ * The proof is SHAPE-ONLY. Callers MUST pass a fence actually won via `acquireFenceIf` /
+ * `acquireFence` for THIS execution. A bogus steal is a liveness attack, never log corruption:
+ * the live owner's next `renew` fails (`LeaseLostError`), but the fence is the write guard
+ * (ADR 0130 D11 section 4), so the stale owner's appends are still rejected. An explicit `now`
+ * bypasses the expiry gate on every backend (pre-existing): production callers must never pass
+ * `now`, and on Postgres should omit it so the DATABASE clock rules.
+ */
+export interface StealProof {
+    /** The fence value the caller won: a positive safe integer (0 is the inert park token, ADR 0118). */
+    fence: number;
+}
+/** Options for {@link LeaseStore.acquire} / {@link LeaseStore.acquireMany} (SPI 2.2.0). */
+export interface AcquireOptions {
+    /**
+     * Take the lease even though ANOTHER owner holds it unexpired (a slow release left a stale row
+     * behind a driver that has already proved the execution is parked). Valid ONLY with a
+     * {@link StealProof}; anything else (`true`, `{}`, a negative or fractional fence) THROWS
+     * `TypeError` and changes nothing. After a release (no row), a steal is just an acquire. The
+     * displaced owner's next `renew`/`renewMany` reports it lost (`false` / absent).
+     *
+     * Single-id `acquire` ONLY: a fence belongs to one execution, so `acquireMany` REJECTS `steal`
+     * with `TypeError` (nothing changes).
+     */
+    steal?: StealProof;
+}
+export interface LeaseStore {
+    /**
+     * OPTIONAL (SPI 2.2.0): who can observe this store's leases. `"process"`: one process (in-memory);
+     * `"host"`: processes on one machine (a local file); `"cluster"`: every node (a shared server).
+     * Absent means unknown and is treated as NOT cluster-visible. Heartbeat evidence ("a lease
+     * expired, so the driver is gone") holds only if every node reads the same table.
+     */
+    readonly scope?: "process" | "host" | "cluster";
+    /**
+     * Take ownership, or report that someone else has it.
+     *
+     * Returns the lease on success and `null` when another owner holds an unexpired one — that
+     * single `null` is the mutual exclusion "only one node should run this execution" needs.
+     * Re-acquiring a lease you already hold is a renewal, not a conflict: a node that restarts
+     * its own work must not be locked out by its own previous claim.
+     *
+     * An EXPIRED lease is acquirable by anyone, which is the whole point — the previous owner
+     * stopped saying it was alive.
+     */
+    acquire(executionId: string, owner: string, ttlMs: number, now?: number, options?: AcquireOptions): Promise<Lease | null>;
+    /**
+     * OPTIONAL (SPI 2.2.0): `acquire` for many executions in ONE round trip. Returns the leases
+     * granted; an id another owner holds unexpired is simply absent (the batch form of `null`).
+     * Duplicate ids count once. Per id the semantics are exactly {@link acquire}'s, and `now`
+     * applies to the whole batch. `options.steal` THROWS `TypeError` (steals go through `acquire`). Empty input returns `[]` without touching the store.
+     */
+    acquireMany?(executionIds: readonly string[], owner: string, ttlMs: number, now?: number, options?: AcquireOptions): Promise<Lease[]>;
+    /**
+     * OPTIONAL (SPI 2.2.0): `renew` for many executions in one round trip. Returns the HELD set:
+     * the ids whose lease this `owner` still holds after the call (their expiry extended). Every
+     * other id, released, taken over, or never held, is absent, and nothing about it changes: a
+     * renew NEVER resurrects. The returned set is what a keeper diffs against its own to find the
+     * lost ids, so a store must not echo its input.
+     */
+    renewMany?(executionIds: readonly string[], owner: string, ttlMs: number, now?: number): Promise<string[]>;
+    /** OPTIONAL (SPI 2.2.0): `release` for many executions in one round trip; other owners' are untouched. */
+    releaseMany?(executionIds: readonly string[], owner: string): Promise<void>;
+    /**
+     * Extend a lease you hold. `false` means you no longer hold it — someone else took over
+     * after it expired — and a caller that keeps working on `false` is the split-brain this
+     * exists to surface. Never resurrects: renewing an expired lease that another owner has
+     * since taken fails rather than stealing it back.
+     */
+    renew(executionId: string, owner: string, ttlMs: number, now?: number): Promise<boolean>;
+    /**
+     * Leases past their expiry, soonest-expired first. The evidence an execution was orphaned.
+     *
+     * `now` is OPTIONAL (SPI 2.0.0) and an implementation MUST default it to the store's OWN
+     * clock — the same one `acquire`/`renew` stamp `expiresAt` with. Expiry is only meaningful
+     * judged on the clock that stamped it: a caller passing wall-clock `Date.now()` to a store
+     * running on an injected/simulated clock sees every live lease as expired (a
+     * double-execution hazard). Callers with no reason to override the clock
+     * (`recoverAbandoned`) pass `undefined`. An implementation that still declares
+     * `expired(now: number)` compiles, but given `undefined` its comparison is false (`<=
+     * undefined`, SQL `<= NULL`) and it returns `[]`: recovery silently recovers nothing.
+     *
+     * The SQL stores' "own clock" is one clock for every node: SQLite is single-host, so the
+     * process clock is its one clock; Postgres stamps and judges on DATABASE time (L29), so node
+     * skew cannot make a live lease look expired or let a fast node steal one.
+     */
+    expired(now?: number, limit?: number): Promise<Lease[]>;
+    /**
+     * OPTIONAL read: the lease on an execution, or `null` if nothing holds one.
+     *
+     * `expired()` answers "who stopped saying they were alive", which cannot distinguish an
+     * execution someone is actively renewing from one that never had a lease at all. That
+     * distinction is the whole question for `orphanCensus` (#408): a stuck execution with NO
+     * lease is a path nothing is watching, and counting those is how "should the runtime lease
+     * every run" stops being a guess.
+     */
+    get?(executionId: string): Promise<Lease | null>;
+    /**
+     * OPTIONAL (SPI 2.1.0): the store's OWN clock, in epoch ms, the one `expiresAt` is stamped and
+     * `expired()` judged on. A reader that must compare `expiresAt` to "now" outside the store
+     * (`orphanCensus`) asks this rather than assuming its host's `Date.now()`, which for a shared
+     * database (Postgres stamps on DB time) is a different clock. Absent means the store uses the
+     * caller-visible process clock.
+     */
+    storeNow?(): Promise<number>;
+    /** Give it up. Releasing a lease held by someone else is a no-op, never a steal. */
+    release(executionId: string, owner: string): Promise<void>;
+    close(): Promise<void>;
+}
+export interface InMemoryLeaseStoreOptions {
+    /** Injectable clock, as everywhere else in the runtime. Default: `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Map-backed {@link LeaseStore} — the browser-safe / test reference implementation beside the
+ * durable backends. Behaviour is pinned by `runLeaseStoreConformance`.
+ */
+export declare class InMemoryLeaseStore implements LeaseStore {
+    readonly scope: "process";
+    private readonly leases;
+    private readonly now;
+    constructor(options?: InMemoryLeaseStoreOptions);
+    acquire(executionId: string, owner: string, ttlMs: number, now?: number, options?: AcquireOptions): Promise<Lease | null>;
+    acquireMany(executionIds: readonly string[], owner: string, ttlMs: number, now?: number, options?: AcquireOptions): Promise<Lease[]>;
+    renewMany(executionIds: readonly string[], owner: string, ttlMs: number, now?: number): Promise<string[]>;
+    releaseMany(executionIds: readonly string[], owner: string): Promise<void>;
+    renew(executionId: string, owner: string, ttlMs: number, now?: number): Promise<boolean>;
+    expired(now?: number, limit?: number): Promise<Lease[]>;
+    get(executionId: string): Promise<Lease | null>;
+    /** The store's own (injectable) clock: the one `expiresAt` is stamped and judged on (SPI 2.1.0). */
+    storeNow(): Promise<number>;
+    release(executionId: string, owner: string): Promise<void>;
+    close(): Promise<void>;
+}
+/** A zero or negative TTL would make a lease expired on arrival — refuse it at every backend. */
+export declare function assertTtl(ttlMs: number): void;
+/**
+ * The `steal` gate every backend applies BEFORE touching storage: `true` only for a real
+ * {@link StealProof}; `undefined` options or no `steal` is `false`; anything else THROWS
+ * `TypeError` (a flag is never a proof).
+ */
+export declare function assertSteal(options: AcquireOptions | undefined): boolean;
+/** `acquireMany` takes no `steal`: a fence belongs to one execution. THROWS `TypeError`, changing nothing. */
+export declare function assertNoBatchSteal(options: AcquireOptions | undefined): void;
+//# sourceMappingURL=leases.d.ts.map

package/dist/leases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leases.d.ts","sourceRoot":"","sources":["../src/leases.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,MAAM,WAAW,KAAK;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,UAAU;IACzB,qGAAqG;IACrG,KAAK,EAAE,MAAM,CAAC;CACf;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAChD;;;;;;;;;;OAUG;IACH,OAAO,CACL,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzB;;;;;OAKG;IACH,WAAW,CAAC,CACV,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACpB;;;;;;OAMG;IACH,SAAS,CAAC,CACR,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrB,0GAA0G;IAC1G,WAAW,CAAC,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD;;;;;;;;OAQG;IACH,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,oFAAoF;IACpF,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IACnD,QAAQ,CAAC,KAAK,EAAG,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,GAAE,yBAA8B;IAI7C,OAAO,CACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,EAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAWlB,WAAW,CACf,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,EAChB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,EAAE,CAAC;IAWb,SAAS,CACb,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf,OAAO,CAAC,MAAM,EAAE,CAAC;IAQd,WAAW,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E,KAAK,CACT,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf,OAAO,CAAC,OAAO,CAAC;IAQb,OAAO,CAAC,GAAG,SAAa,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAQxD,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAKrD,oGAAoG;IAC9F,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAI3B,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED,iGAAiG;AACjG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAI7C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAUxE;AAED,8GAA8G;AAC9G,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAM5E"}