@mysten-incubation/devstack 0.0.1 → 0.1.0

package/dist/orchestrators/snapshot/restore.mjs

@@ -1,15 +1,19 @@
+import { decodeUnknown, parseJsonText } from "../../substrate/runtime/runtime-decode.mjs";
+import { runtimeControlLockPathForStackRoot } from "../../substrate/runtime/cross-process/command-channel/runtime-control-lock.mjs";
+import { COMMAND_CHANNEL_COMMANDS_FILE_NAME, COMMAND_CHANNEL_EVENTS_FILE_NAME } from "../../substrate/runtime/cross-process/command-channel/channel.mjs";
+import "../../substrate/runtime/cross-process/command-channel/index.mjs";
+import { mintRandomSuffix } from "../../substrate/runtime/random-suffix.mjs";
 import { HostTreeTarError, untarHostTree, validateHostTreeTarEntries } from "../../substrate/runtime/host-tree-tar/index.mjs";
-import { ContributionDocSchema, SnapshotLayout, SnapshotMetadataSchema, containerImagesBundlePath, contributionPath, isRestorableContainerImageName, isSafeSnapshotPathSegment, isSafeSnapshotRelativePath, parseSnapshotId } from "./descriptor.mjs";
+import { ContributionDocSchema, DEPLOY_CACHE_NAMESPACES, SnapshotLayout, SnapshotMetadataSchema, containerImagesBundlePath, contributionPath, isRestorableContainerImageName, isSafeSnapshotPathSegment, isSafeSnapshotRelativePath, parseSnapshotId } from "./descriptor.mjs";
+import { makePhaseFailer } from "./phase-error.mjs";
+import { CACHE_DIR_NAME, SNAPSHOTS_DIR_NAME } from "./wipe.mjs";
 import { readImageBundleTags, verifyImageBundleTags } from "./image-bundle-tags.mjs";
 import { verifyArtifactIntegrity } from "./integrity.mjs";
 import { mergeContributions, runIdentityGuard, runRuntimeIdentityGuard } from "./identity-guard.mjs";
 import { readSnapshotStateDocument, writeSnapshotStateDocument } from "./state-document.mjs";
-import { SNAPSHOTS_DIR_NAME } from "./wipe.mjs";
+import { RESTORE_PENDING_FILE_NAME, RestorePendingDocumentSchema, makePendingMarkerDocument, pendingMarkerPath, removePendingMarker, rewritePendingMarkerContainers, writePendingMarker } from "./pending-marker.mjs";
 import { stageAndSwap } from "../../substrate/runtime/stage-and-swap/index.mjs";
-import { runtimeControlLockPathForStackRoot } from "../../substrate/runtime/cross-process/command-channel/runtime-control-lock.mjs";
-import { COMMAND_CHANNEL_COMMANDS_FILE_NAME, COMMAND_CHANNEL_EVENTS_FILE_NAME } from "../../substrate/runtime/cross-process/command-channel/channel.mjs";
 import { Effect, Exit, FileSystem, Schema, Stream } from "effect";
-import { randomUUID } from "node:crypto";
 //#region src/orchestrators/snapshot/restore.ts
 /** Tagged failure during a restore step. Phase discriminates the
 *  failing step so the user-facing message can point at it. */
@@ -31,6 +35,7 @@ var RestorePhaseError = class extends Schema.TaggedErrorClass()("SnapshotRestore
 		"post-restore-hook",
 		"pre-cleanup",
 		"write-restore-pending",
+		"read-restore-pending",
 		"clear-restore-pending",
 		"missing-subtree-fatal"
 	]),
@@ -38,12 +43,7 @@ var RestorePhaseError = class extends Schema.TaggedErrorClass()("SnapshotRestore
 	detail: Schema.String,
 	cause: Schema.optional(Schema.Defect)
 }) {};
-const failPhase = (phase, detail, plugin) => (cause) => Effect.fail(new RestorePhaseError({
-	phase,
-	plugin,
-	detail,
-	cause
-}));
+const failPhase = makePhaseFailer(RestorePhaseError);
 const failRestore = (phase, detail, plugin) => Effect.fail(new RestorePhaseError({
 	phase,
 	plugin,
@@ -55,6 +55,15 @@ const failImageBundleTagScan = (phase, plugin) => (cause) => Effect.fail(new Res
 	detail: cause.detail,
 	cause
 }));
+/** Project a `SnapshotStateDocumentError` onto a `RestorePhaseError`,
+*  branching by `kind` so a phase classifier never inspects message
+*  substrings. */
+const failStateDocument = (readPhase, writePhase, plugin) => (err) => Effect.fail(new RestorePhaseError({
+	phase: err.kind === "write" ? writePhase : readPhase,
+	plugin,
+	detail: err.detail,
+	cause: err.cause
+}));
 const readMeta = (artifactDir, expectedId) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = `${artifactDir}/${SnapshotLayout.metaFile}`;
@@ -62,29 +71,30 @@ const readMeta = (artifactDir, expectedId) => Effect.gen(function* () {
 		phase: "meta-absent",
 		detail: `snapshot meta.json not found at ${path}`
 	}));
-	const text = yield* fs.readFileString(path).pipe(Effect.catch(failPhase("read-meta", `read meta.json failed at ${path}`)));
-	const raw = yield* Effect.try({
-		try: () => JSON.parse(text),
-		catch: (cause) => new RestorePhaseError({
+	const meta = yield* decodeUnknown(SnapshotMetadataSchema, yield* parseJsonText(yield* fs.readFileString(path).pipe(Effect.catch(failPhase("read-meta", `read meta.json failed at ${path}`))), {
+		source: path,
+		mkError: (issue) => new RestorePhaseError({
 			phase: "meta-corrupt",
 			detail: `meta.json is not valid JSON at ${path}`,
-			cause
+			cause: issue.cause
+		})
+	}), {
+		source: path,
+		mkError: (issue) => new RestorePhaseError({
+			phase: "meta-corrupt",
+			detail: `meta.json failed schema decode at ${path}`,
+			cause: issue.cause
 		})
 	});
-	const meta = yield* Schema.decodeUnknownEffect(SnapshotMetadataSchema)(raw).pipe(Effect.catch((cause) => Effect.fail(new RestorePhaseError({
-		phase: "meta-corrupt",
-		detail: `meta.json failed schema decode at ${path}`,
-		cause
-	}))));
 	const parsedId = parseSnapshotId(meta.id);
 	if (parsedId === null) return yield* failRestore("meta-corrupt", `meta.json contains an unsafe snapshot id: ${meta.id}`);
 	if (parsedId !== expectedId) return yield* failRestore("meta-corrupt", `meta.json id ${meta.id} does not match requested snapshot id ${expectedId}`);
 	return meta;
 }).pipe(Effect.withSpan("orchestrator.snapshot.restore.read-meta"));
-const verifyIntegrity = (artifactDir) => verifyArtifactIntegrity(artifactDir).pipe(Effect.catch((cause) => Effect.fail(new RestorePhaseError({
-	phase: cause instanceof Error && cause.message.includes(SnapshotLayout.integrityFile) ? "read-integrity" : "verify-integrity",
-	detail: cause instanceof Error ? cause.message : `snapshot integrity failed`,
-	cause
+const verifyIntegrity = (artifactDir) => verifyArtifactIntegrity(artifactDir).pipe(Effect.catchTag("SnapshotIntegrityError", (err) => Effect.fail(new RestorePhaseError({
+	phase: err.kind === "missing" ? "read-integrity" : "verify-integrity",
+	detail: err.detail,
+	cause: err.cause
 }))));
 /** Restore must discard the current writable layer even when the live
 *  supervisor still holds a claim for the container. This is
@@ -98,49 +108,54 @@ const removeCapturedContainers = (meta, runtime, runtimeIdentity) => Effect.gen(
 		role: captured.role
 	}).pipe(Effect.catch(failPhase("pre-cleanup", `remove managed containers for ${captured.plugin}/${captured.role} failed`, captured.plugin)));
 }).pipe(Effect.withSpan("orchestrator.snapshot.restore.remove-containers"));
-const RESTORE_PENDING_FILE_NAME = "snapshot.restore-pending.json";
-Schema.Struct({
-	version: Schema.Literal(1),
-	snapshotId: Schema.String,
-	artifactDir: Schema.String,
-	app: Schema.String,
-	stack: Schema.String,
-	network: Schema.String,
-	containers: Schema.Array(Schema.Struct({
-		plugin: Schema.String,
-		role: Schema.String,
-		targetImageName: Schema.String,
-		stagedImageTag: Schema.String
-	}))
+const stagedImageToPendingEntry = (image) => ({
+	plugin: image.captured.plugin,
+	role: image.captured.role,
+	targetImageName: image.captured.imageName,
+	stagedImageTag: image.stagedImageTag,
+	digest: image.stagedRef.digest
 });
 const loadedBundleTags = (bundle) => {
 	const tags = /* @__PURE__ */ new Set();
 	for (const ref of bundle.refs) if (ref.tag !== void 0) tags.add(ref.tag);
 	return tags;
 };
-const mintRestoreStagingTag = () => `devstack-snapshot:restore-${randomUUID().replaceAll("-", "").slice(0, 24)}`;
+const mintRestoreStagingTag = () => `devstack-snapshot:restore-${mintRandomSuffix(24)}`;
+const mapMarkerIoError = (phase) => (err) => Effect.fail(new RestorePhaseError({
+	phase,
+	detail: err.detail,
+	cause: err.cause
+}));
 const writeRestorePendingMarker = (args) => {
 	if (args.stagedImages.length === 0) return Effect.void;
-	const doc = {
-		version: 1,
-		snapshotId: args.meta.id,
+	const doc = makePendingMarkerDocument({
+		meta: args.meta,
 		artifactDir: args.artifactDir,
-		app: args.meta.app,
-		stack: args.meta.stack,
-		network: args.meta.network,
-		containers: args.stagedImages.map((image) => ({
-			plugin: image.captured.plugin,
-			role: image.captured.role,
-			targetImageName: image.captured.imageName,
-			stagedImageTag: image.stagedImageTag
-		}))
-	};
-	return Effect.gen(function* () {
-		yield* (yield* FileSystem.FileSystem).writeFileString(`${args.runtimeRoot}/${RESTORE_PENDING_FILE_NAME}`, `${JSON.stringify(doc, null, 2)}\n`).pipe(Effect.catch(failPhase("write-restore-pending", `write ${RESTORE_PENDING_FILE_NAME} failed`)));
+		containers: args.stagedImages.map(stagedImageToPendingEntry)
 	});
+	return writePendingMarker(args.runtimeRoot, doc).pipe(Effect.catchTag("SnapshotRestorePendingMarkerIoError", mapMarkerIoError("write-restore-pending")));
 };
-const clearRestorePendingMarker = (runtimeRoot) => Effect.gen(function* () {
-	yield* (yield* FileSystem.FileSystem).remove(`${runtimeRoot}/${RESTORE_PENDING_FILE_NAME}`, { force: true }).pipe(Effect.catch(failPhase("clear-restore-pending", `remove ${RESTORE_PENDING_FILE_NAME} failed`)));
+const rewriteRestorePendingMarker = (runtimeRoot, doc, stillPending) => writePendingMarker(runtimeRoot, rewritePendingMarkerContainers(doc, stillPending)).pipe(Effect.catchTag("SnapshotRestorePendingMarkerIoError", mapMarkerIoError("write-restore-pending")));
+const clearRestorePendingMarker = (runtimeRoot) => removePendingMarker(runtimeRoot).pipe(Effect.catchTag("SnapshotRestorePendingMarkerIoError", mapMarkerIoError("clear-restore-pending")));
+const readRestorePendingMarker = (runtimeRoot) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = pendingMarkerPath(runtimeRoot);
+	if (!(yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false))))) return null;
+	return yield* decodeUnknown(RestorePendingDocumentSchema, yield* parseJsonText(yield* fs.readFileString(path).pipe(Effect.catch(failPhase("read-restore-pending", `read ${RESTORE_PENDING_FILE_NAME}`))), {
+		source: path,
+		mkError: (issue) => new RestorePhaseError({
+			phase: "read-restore-pending",
+			detail: `${RESTORE_PENDING_FILE_NAME} is not valid JSON`,
+			cause: issue.cause
+		})
+	}), {
+		source: path,
+		mkError: (issue) => new RestorePhaseError({
+			phase: "read-restore-pending",
+			detail: `${RESTORE_PENDING_FILE_NAME} failed schema decode`,
+			cause: issue.cause
+		})
+	});
 });
 const requirePathSegment = (kind, value, plugin) => isSafeSnapshotPathSegment(value) ? Effect.void : failRestore("preflight", `unsafe snapshot ${kind} path segment: ${value}`, plugin);
 const requireReadableNonEmptyFile = (path, phase, detail, plugin) => Effect.gen(function* () {
@@ -160,22 +175,23 @@ const preflightCapturedContainer = (captured, artifactDir) => Effect.gen(functio
 });
 const preflightContributionDoc = (pluginKey, artifactDir) => Effect.gen(function* () {
 	const path = `${artifactDir}/${contributionPath(pluginKey)}`;
-	const text = yield* (yield* FileSystem.FileSystem).readFileString(path).pipe(Effect.catch(failPhase("read-contribution", `read contribution doc failed at ${path}`, pluginKey)));
-	const raw = yield* Effect.try({
-		try: () => JSON.parse(text),
-		catch: (cause) => new RestorePhaseError({
+	const decoded = yield* decodeUnknown(ContributionDocSchema, yield* parseJsonText(yield* (yield* FileSystem.FileSystem).readFileString(path).pipe(Effect.catch(failPhase("read-contribution", `read contribution doc failed at ${path}`, pluginKey))), {
+		source: path,
+		mkError: (issue) => new RestorePhaseError({
 			phase: "read-contribution",
 			plugin: pluginKey,
 			detail: `contribution doc is not valid JSON at ${path}`,
-			cause
+			cause: issue.cause
+		})
+	}), {
+		source: path,
+		mkError: (issue) => new RestorePhaseError({
+			phase: "read-contribution",
+			plugin: pluginKey,
+			detail: `contribution doc failed schema decode at ${path}`,
+			cause: issue.cause
 		})
 	});
-	const decoded = yield* Schema.decodeUnknownEffect(ContributionDocSchema)(raw).pipe(Effect.catch((cause) => Effect.fail(new RestorePhaseError({
-		phase: "read-contribution",
-		plugin: pluginKey,
-		detail: `contribution doc failed schema decode at ${path}`,
-		cause
-	}))));
 	if (decoded.plugin !== pluginKey) return yield* failRestore("read-contribution", `contribution doc plugin ${decoded.plugin} does not match ${pluginKey}`, pluginKey);
 });
 const preflightArtifact = (meta, artifactDir) => Effect.gen(function* () {
@@ -189,7 +205,7 @@ const preflightArtifact = (meta, artifactDir) => Effect.gen(function* () {
 	}
 	for (const pluginKey of meta.participants) yield* preflightContributionDoc(pluginKey, artifactDir);
 	const statePath = `${artifactDir}/${SnapshotLayout.stateFile}`;
-	if (yield* fs.exists(statePath).pipe(Effect.catch(() => Effect.succeed(false)))) yield* readSnapshotStateDocument(statePath).pipe(Effect.catch(failPhase("read-state", `state.json failed schema validation`)));
+	if (yield* fs.exists(statePath).pipe(Effect.catch(() => Effect.succeed(false)))) yield* readSnapshotStateDocument(statePath).pipe(Effect.catchTag("SnapshotStateDocumentError", failStateDocument("read-state", "expand-state")));
 	if (meta.hostTreeIncluded) {
 		const tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;
 		yield* requireReadableNonEmptyFile(tarPath, "untar-host-tree", "host-tree tar is required");
@@ -245,8 +261,19 @@ const stageLoadedImage = (captured, loadedRef, runtime, registerStagedImage) =>
 	return stagedImage;
 }).pipe(Effect.withSpan("orchestrator.snapshot.restore.stage-image"));
 const cleanupRestoreStagingImages = (runtime, images) => Effect.forEach(images, (image) => runtime.removeImage(image.stagedRef).pipe(Effect.catch((cause) => Effect.logWarning(`remove restore staging image ${image.stagedImageTag} failed during restore cleanup: ${String(cause)}`))), { concurrency: "unbounded" }).pipe(Effect.asVoid);
-const promoteStagedImages = (images, runtime) => Effect.gen(function* () {
-	for (const image of images) yield* runtime.tagImage(image.stagedRef, image.captured.imageName, { removeSourceAfterTag: true }).pipe(Effect.catch(failPhase("retag-image", `tag staged image ${image.stagedImageTag} as ${image.captured.imageName} failed`, image.captured.plugin)));
+/** Promote each staged image to its recorded name, rewriting the
+*  on-disk pending marker after each successful tag. If the loop
+*  fails mid-way the marker reflects exactly which images are still
+*  pending (the failed entry + every entry not yet attempted), so
+*  the supervise-startup `recoverPendingRestore` only has to retry
+*  the remaining set — no scanning Docker for "which targets exist
+*  already?" required. */
+const promoteStagedImages = (images, runtime, runtimeStackRoot, pendingDoc) => Effect.gen(function* () {
+	for (let i = 0; i < images.length; i += 1) {
+		const image = images[i];
+		yield* runtime.tagImage(image.stagedRef, image.captured.imageName, { removeSourceAfterTag: true }).pipe(Effect.catch(failPhase("retag-image", `tag staged image ${image.stagedImageTag} as ${image.captured.imageName} failed`, image.captured.plugin)));
+		if (pendingDoc !== null) yield* rewriteRestorePendingMarker(runtimeStackRoot, pendingDoc, images.slice(i + 1).map(stagedImageToPendingEntry));
+	}
 }).pipe(Effect.withSpan("orchestrator.snapshot.restore.promote-images"));
 const restoreHostTree = (artifactDir, target) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
@@ -287,7 +314,12 @@ const LIVE_RESTORE_PRESERVED_PATHS = [
 	{
 		relativePath: "snapshot.reservation",
 		kind: "file"
-	}
+	},
+	...DEPLOY_CACHE_NAMESPACES.map((namespace) => ({
+		relativePath: `${CACHE_DIR_NAME}/${namespace}`,
+		kind: "directory",
+		overwrite: false
+	}))
 ];
 /**
 * Run the full restore. Bracketed-atomic via `stageAndSwap` at the
@@ -339,11 +371,11 @@ const runRestore = (inputs) => Effect.gen(function* () {
 	yield* runIdentityGuard(meta.identity, live);
 	for (const participant of inputs.participants) if (participant.preRestore) yield* participant.preRestore.pipe(Effect.catch(failPhase("pre-restore-hook", `preRestore failed`, participant.plugin)));
 	yield* preflightArtifact(meta, inputs.artifactDir);
-	const stagedImages = yield* Effect.scoped(Effect.gen(function* () {
+	yield* Effect.scoped(Effect.gen(function* () {
 		const stagedImages = [];
 		let recoveryHandoffComplete = false;
 		yield* Effect.addFinalizer((exit) => Exit.isFailure(exit) && !recoveryHandoffComplete ? cleanupRestoreStagingImages(inputs.runtime, stagedImages) : Effect.void);
-		const swappedImages = yield* stageAndSwap({
+		yield* stageAndSwap({
 			targetPath: inputs.runtimeStackRoot,
 			stagingPath: inputs.runtimeStagingPath,
 			backupPath: inputs.runtimeBackupPath,
@@ -354,8 +386,8 @@ const runRestore = (inputs) => Effect.gen(function* () {
 				const fs = yield* FileSystem.FileSystem;
 				const srcState = `${inputs.artifactDir}/${SnapshotLayout.stateFile}`;
 				if (yield* fs.exists(srcState).pipe(Effect.catch(() => Effect.succeed(false)))) {
-					const stateDoc = yield* readSnapshotStateDocument(srcState).pipe(Effect.catch(failPhase("read-state", `state.json failed schema validation`)));
-					yield* writeSnapshotStateDocument(`${inputs.runtimeStagingPath}/${SnapshotLayout.stateFile}`, stateDoc).pipe(Effect.catch(failPhase("expand-state", `write state.json failed`)));
+					const stateDoc = yield* readSnapshotStateDocument(srcState).pipe(Effect.catchTag("SnapshotStateDocumentError", failStateDocument("read-state", "expand-state")));
+					yield* writeSnapshotStateDocument(`${inputs.runtimeStagingPath}/${SnapshotLayout.stateFile}`, stateDoc).pipe(Effect.catchTag("SnapshotStateDocumentError", failStateDocument("expand-state", "expand-state")));
 				}
 				for (const pluginKey of meta.participants) {
 					const path = `${inputs.artifactDir}/${contributionPath(pluginKey)}`;
@@ -387,18 +419,20 @@ const runRestore = (inputs) => Effect.gen(function* () {
 				return stagedImages;
 			})
 		});
-		recoveryHandoffComplete = true;
-		return swappedImages;
+		if (stagedImages.length > 0) {
+			const pendingDocAfterSwap = yield* readRestorePendingMarker(inputs.runtimeStackRoot);
+			yield* Effect.uninterruptible(Effect.gen(function* () {
+				yield* promoteStagedImages(stagedImages, inputs.runtime, inputs.runtimeStackRoot, pendingDocAfterSwap);
+				yield* removeCapturedContainers(meta, inputs.runtime, inputs.runtimeIdentity);
+				yield* clearRestorePendingMarker(inputs.runtimeStackRoot);
+				recoveryHandoffComplete = true;
+			}));
+		} else recoveryHandoffComplete = true;
 	}));
-	if (stagedImages.length > 0) {
-		yield* promoteStagedImages(stagedImages, inputs.runtime);
-		yield* removeCapturedContainers(meta, inputs.runtime, inputs.runtimeIdentity);
-		yield* clearRestorePendingMarker(inputs.runtimeStackRoot);
-	}
 	for (const participant of inputs.participants) if (participant.postRestore) yield* participant.postRestore.pipe(Effect.catch(failPhase("post-restore-hook", `postRestore failed`, participant.plugin)));
 	return meta;
 }).pipe(Effect.withSpan("orchestrator.snapshot.restore"));
 //#endregion
-export { runRestore };
+export { RestorePhaseError, runRestore };
 
 //# sourceMappingURL=restore.mjs.map

package/dist/orchestrators/snapshot/restore.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"restore.mjs","names":[],"sources":["../../../src/orchestrators/snapshot/restore.ts"],"sourcesContent":["// Restore pipeline.\n//\n// Architecture § Snapshot lifecycle (restore half):\n//\n//   Identity guard (chain identity + plugin contributions)\n//       │   (refuse and stop if mismatch — nothing touched)\n//       ▼\n//   Stage atomic restore in tempdir\n//       │\n//       ▼\n//   Per plugin: expand tar to staging, load committed images\n//       │\n//       ▼\n//   Atomic swap into runtime dir, preserving live control files\n//       │\n//       ▼\n//   snapshot.restored event → next stack acquire picks it up\n//\n// Bracketed-atomic — Tension 9 decision: one outer atomic swap, not\n// per-phase idempotency.\n\nimport { randomUUID } from 'node:crypto';\n\nimport { Effect, Exit, FileSystem, Schema, Stream } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tHostTreeTarError,\n\tuntarHostTree,\n\tvalidateHostTreeTarEntries,\n} from '../../substrate/runtime/host-tree-tar/index.ts';\nimport {\n\tContributionDocSchema,\n\tcontainerImagesBundlePath,\n\tcontributionPath,\n\tSnapshotLayout,\n\tSnapshotMetadataSchema,\n\ttype SnapshotId,\n\ttype CapturedContainer,\n\ttype IdentitySlice,\n\ttype SnapshotMetadata,\n\tisRestorableContainerImageName,\n\tisSafeSnapshotPathSegment,\n\tisSafeSnapshotRelativePath,\n\tparseSnapshotId,\n} from './descriptor.ts';\nimport { verifyArtifactIntegrity } from './integrity.ts';\nimport { readSnapshotStateDocument, writeSnapshotStateDocument } from './state-document.ts';\nimport {\n\tmergeContributions,\n\trunIdentityGuard,\n\trunRuntimeIdentityGuard,\n\ttype IdentityContribution,\n\ttype IdentityContributionConflictError,\n\ttype IdentityGuardError,\n\ttype SnapshotRuntimeIdentity,\n} from './identity-guard.ts';\nimport {\n\tstageAndSwap,\n\ttype StageAndSwapError,\n\ttype StageAndSwapPreservedPath,\n} from '../../substrate/runtime/stage-and-swap/index.ts';\nimport {\n\tCOMMAND_CHANNEL_COMMANDS_FILE_NAME,\n\tCOMMAND_CHANNEL_EVENTS_FILE_NAME,\n\truntimeControlLockPathForStackRoot,\n} from '../../substrate/runtime/cross-process/command-channel/index.ts';\nimport {\n\tImageBundleTagScanError,\n\treadImageBundleTags,\n\tverifyImageBundleTags,\n} from './image-bundle-tags.ts';\nimport { SNAPSHOTS_DIR_NAME } from './wipe.ts';\n\n// -----------------------------------------------------------------------------\n// Errors\n// -----------------------------------------------------------------------------\n\n/** Tagged failure during a restore step. Phase discriminates the\n *  failing step so the user-facing message can point at it. */\nexport class RestorePhaseError extends Schema.TaggedErrorClass<RestorePhaseError>()(\n\t'SnapshotRestorePhaseError',\n\t{\n\t\tphase: Schema.Literals([\n\t\t\t'read-meta',\n\t\t\t'meta-corrupt',\n\t\t\t'meta-absent',\n\t\t\t'read-state',\n\t\t\t'read-contribution',\n\t\t\t'read-integrity',\n\t\t\t'verify-integrity',\n\t\t\t'preflight',\n\t\t\t'pre-restore-hook',\n\t\t\t'untar-host-tree',\n\t\t\t'load-image',\n\t\t\t'retag-image',\n\t\t\t'expand-state',\n\t\t\t'post-restore-hook',\n\t\t\t'pre-cleanup',\n\t\t\t'write-restore-pending',\n\t\t\t'clear-restore-pending',\n\t\t\t'missing-subtree-fatal',\n\t\t]),\n\t\tplugin: Schema.optional(Schema.String),\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\nconst failPhase =\n\t(\n\t\tphase: RestorePhaseError['phase'],\n\t\tdetail: string,\n\t\tplugin?: string,\n\t): ((cause: unknown) => Effect.Effect<never, RestorePhaseError>) =>\n\t(cause) =>\n\t\tEffect.fail(new RestorePhaseError({ phase, plugin, detail, cause }));\n\nconst failRestore = (\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<never, RestorePhaseError> =>\n\tEffect.fail(new RestorePhaseError({ phase, plugin, detail }));\n\nconst failImageBundleTagScan =\n\t(phase: RestorePhaseError['phase'], plugin?: string) =>\n\t(cause: ImageBundleTagScanError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(new RestorePhaseError({ phase, plugin, detail: cause.detail, cause }));\n\n// -----------------------------------------------------------------------------\n// Participants — what restore needs from each plugin\n// -----------------------------------------------------------------------------\n\n/** One plugin's restore-side contributions: a live identity probe\n *  (read fresh from the live stack), an opaque pre-restore validation\n *  hook, and a post-restore hook. Mirrors `SnapshotableDecl`'s\n *  pre/post hook surface but closed over the plugin's key. */\nexport interface RestoreParticipant {\n\treadonly plugin: string;\n\treadonly liveIdentity: Effect.Effect<IdentitySlice>;\n\t/** Pre-restore application-level validation (version compat,\n\t *  side-state). Identity-guard runs FIRST and unilaterally; this\n\t *  is the plugin's extra hook. */\n\treadonly preRestore?: Effect.Effect<void>;\n\t/** Post-restore hook: re-validate, warm caches, etc. */\n\treadonly postRestore?: Effect.Effect<void>;\n}\n\n// -----------------------------------------------------------------------------\n// Metadata read — authoritative; absent / unparseable refuses restore.\n// -----------------------------------------------------------------------------\n\nconst readMeta = (\n\tartifactDir: string,\n\texpectedId: SnapshotId,\n): Effect.Effect<SnapshotMetadata, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = `${artifactDir}/${SnapshotLayout.metaFile}`;\n\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-absent',\n\t\t\t\t\tdetail: `snapshot meta.json not found at ${path}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(Effect.catch(failPhase('read-meta', `read meta.json failed at ${path}`)));\n\t\tconst raw = yield* Effect.try({\n\t\t\ttry: () => JSON.parse(text) as unknown,\n\t\t\tcatch: (cause) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json is not valid JSON at ${path}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tconst meta = yield* Schema.decodeUnknownEffect(SnapshotMetadataSchema)(raw).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\t\tdetail: `meta.json failed schema decode at ${path}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t\tconst parsedId = parseSnapshotId(meta.id);\n\t\tif (parsedId === null) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json contains an unsafe snapshot id: ${meta.id}`,\n\t\t\t);\n\t\t}\n\t\tif (parsedId !== expectedId) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json id ${meta.id} does not match requested snapshot id ${expectedId}`,\n\t\t\t);\n\t\t}\n\t\treturn meta;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.read-meta'));\n\nconst verifyIntegrity = (\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tverifyArtifactIntegrity(artifactDir).pipe(\n\t\tEffect.catch((cause) =>\n\t\t\tEffect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase:\n\t\t\t\t\t\tcause instanceof Error && cause.message.includes(SnapshotLayout.integrityFile)\n\t\t\t\t\t\t\t? 'read-integrity'\n\t\t\t\t\t\t\t: 'verify-integrity',\n\t\t\t\t\tdetail: cause instanceof Error ? cause.message : `snapshot integrity failed`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\n// -----------------------------------------------------------------------------\n// Managed-container removal by label.\n// -----------------------------------------------------------------------------\n\n/** Restore must discard the current writable layer even when the live\n *  supervisor still holds a claim for the container. This is\n *  intentionally separate from orphan sweep, which skips claimed\n *  containers by design. */\nconst removeCapturedContainers = (\n\tmeta: SnapshotMetadata,\n\truntime: ContainerRuntime,\n\truntimeIdentity: SnapshotRuntimeIdentity,\n): Effect.Effect<void, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* runtime\n\t\t\t\t.removeManagedContainers({\n\t\t\t\t\tapp: runtimeIdentity.app,\n\t\t\t\t\tstack: runtimeIdentity.stack,\n\t\t\t\t\tplugin: captured.plugin,\n\t\t\t\t\trole: captured.role,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'pre-cleanup',\n\t\t\t\t\t\t\t`remove managed containers for ${captured.plugin}/${captured.role} failed`,\n\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.remove-containers'));\n\n// -----------------------------------------------------------------------------\n// Post-publish Docker finalization recovery marker.\n// -----------------------------------------------------------------------------\n\nexport const SNAPSHOT_RESTORE_PENDING_VERSION = 1 as const;\nexport const RESTORE_PENDING_FILE_NAME = 'snapshot.restore-pending.json' as const;\n\nexport const RestorePendingDocumentSchema = Schema.Struct({\n\tversion: Schema.Literal(SNAPSHOT_RESTORE_PENDING_VERSION),\n\tsnapshotId: Schema.String,\n\tartifactDir: Schema.String,\n\tapp: Schema.String,\n\tstack: Schema.String,\n\tnetwork: Schema.String,\n\tcontainers: Schema.Array(\n\t\tSchema.Struct({\n\t\t\tplugin: Schema.String,\n\t\t\trole: Schema.String,\n\t\t\ttargetImageName: Schema.String,\n\t\t\tstagedImageTag: Schema.String,\n\t\t}),\n\t),\n});\nexport type RestorePendingDocument = Schema.Schema.Type<typeof RestorePendingDocumentSchema>;\n\ninterface StagedContainerImage {\n\treadonly captured: CapturedContainer;\n\treadonly stagedRef: ImageRef;\n\treadonly stagedImageTag: string;\n}\n\nconst loadedBundleTags = (bundle: { readonly refs: ReadonlyArray<ImageRef> }): Set<string> => {\n\tconst tags = new Set<string>();\n\tfor (const ref of bundle.refs) {\n\t\tif (ref.tag !== undefined) tags.add(ref.tag);\n\t}\n\treturn tags;\n};\n\nconst mintRestoreStagingTag = (): string =>\n\t`devstack-snapshot:restore-${randomUUID().replaceAll('-', '').slice(0, 24)}`;\n\nconst writeRestorePendingMarker = (args: {\n\treadonly runtimeRoot: string;\n\treadonly meta: SnapshotMetadata;\n\treadonly artifactDir: string;\n\treadonly stagedImages: ReadonlyArray<StagedContainerImage>;\n}): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> => {\n\tif (args.stagedImages.length === 0) return Effect.void;\n\tconst doc: RestorePendingDocument = {\n\t\tversion: SNAPSHOT_RESTORE_PENDING_VERSION,\n\t\tsnapshotId: args.meta.id,\n\t\tartifactDir: args.artifactDir,\n\t\tapp: args.meta.app,\n\t\tstack: args.meta.stack,\n\t\tnetwork: args.meta.network,\n\t\tcontainers: args.stagedImages.map((image) => ({\n\t\t\tplugin: image.captured.plugin,\n\t\t\trole: image.captured.role,\n\t\t\ttargetImageName: image.captured.imageName,\n\t\t\tstagedImageTag: image.stagedImageTag,\n\t\t})),\n\t};\n\treturn Effect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tyield* fs\n\t\t\t.writeFileString(\n\t\t\t\t`${args.runtimeRoot}/${RESTORE_PENDING_FILE_NAME}`,\n\t\t\t\t`${JSON.stringify(doc, null, 2)}\\n`,\n\t\t\t)\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('write-restore-pending', `write ${RESTORE_PENDING_FILE_NAME} failed`),\n\t\t\t\t),\n\t\t\t);\n\t});\n};\n\nconst clearRestorePendingMarker = (\n\truntimeRoot: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tyield* fs\n\t\t\t.remove(`${runtimeRoot}/${RESTORE_PENDING_FILE_NAME}`, { force: true })\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('clear-restore-pending', `remove ${RESTORE_PENDING_FILE_NAME} failed`),\n\t\t\t\t),\n\t\t\t);\n\t});\n\n// -----------------------------------------------------------------------------\n// Artifact preflight — no destructive cleanup until required files are present.\n// -----------------------------------------------------------------------------\n\nconst requirePathSegment = (\n\tkind: string,\n\tvalue: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError> =>\n\tisSafeSnapshotPathSegment(value)\n\t\t? Effect.void\n\t\t: failRestore('preflight', `unsafe snapshot ${kind} path segment: ${value}`, plugin);\n\nconst requireReadableNonEmptyFile = (\n\tpath: string,\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst stat = yield* fs\n\t\t\t.stat(path)\n\t\t\t.pipe(Effect.catch(failPhase(phase, `${detail}: stat failed at ${path}`, plugin)));\n\t\tif (stat.size === 0n) {\n\t\t\treturn yield* failRestore(phase, `${detail}: empty file at ${path}`, plugin);\n\t\t}\n\t\tyield* Stream.runDrain(fs.stream(path).pipe(Stream.take(1))).pipe(\n\t\t\tEffect.catch(failPhase(phase, `${detail}: read failed at ${path}`, plugin)),\n\t\t);\n\t});\n\nconst preflightCapturedContainer = (\n\tcaptured: CapturedContainer,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tyield* requirePathSegment('plugin', captured.plugin, captured.plugin);\n\t\tyield* requirePathSegment('role', captured.role, captured.plugin);\n\t\tif (!isSafeSnapshotRelativePath(captured.tarPath)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`unsafe container image tar path: ${captured.tarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tconst expectedTarPath = containerImagesBundlePath();\n\t\tif (captured.tarPath !== expectedTarPath) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container image tar path ${captured.tarPath} does not match canonical bundle ${expectedTarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.imageName)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container imageName is not a restorable Docker tag destination: ${captured.imageName}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.snapshotTag)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container snapshotTag is not a restorable Docker tag source: ${captured.snapshotTag}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tyield* requireReadableNonEmptyFile(\n\t\t\t`${artifactDir}/${captured.tarPath}`,\n\t\t\t'load-image',\n\t\t\t'container image tar is required',\n\t\t\tcaptured.plugin,\n\t\t);\n\t});\n\nconst preflightContributionDoc = (\n\tpluginKey: string,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst path = `${artifactDir}/${contributionPath(pluginKey)}`;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('read-contribution', `read contribution doc failed at ${path}`, pluginKey),\n\t\t\t\t),\n\t\t\t);\n\t\tconst raw = yield* Effect.try({\n\t\t\ttry: () => JSON.parse(text) as unknown,\n\t\t\tcatch: (cause) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc is not valid JSON at ${path}`,\n\t\t\t\t\tcause,\n\t\t\t\t}),\n\t\t});\n\t\tconst decoded = yield* Schema.decodeUnknownEffect(ContributionDocSchema)(raw).pipe(\n\t\t\tEffect.catch((cause) =>\n\t\t\t\tEffect.fail(\n\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\t\tdetail: `contribution doc failed schema decode at ${path}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t\tif (decoded.plugin !== pluginKey) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'read-contribution',\n\t\t\t\t`contribution doc plugin ${decoded.plugin} does not match ${pluginKey}`,\n\t\t\t\tpluginKey,\n\t\t\t);\n\t\t}\n\t});\n\nconst preflightArtifact = (\n\tmeta: SnapshotMetadata,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst seenSnapshotTags = new Map<string, CapturedContainer>();\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* preflightCapturedContainer(captured, artifactDir);\n\t\t\tconst previous = seenSnapshotTags.get(captured.snapshotTag);\n\t\t\tif (previous !== undefined) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'preflight',\n\t\t\t\t\t`duplicate container snapshotTag ${captured.snapshotTag} for ${previous.plugin}/${previous.role} and ${captured.plugin}/${captured.role}`,\n\t\t\t\t\tcaptured.plugin,\n\t\t\t\t);\n\t\t\t}\n\t\t\tseenSnapshotTags.set(captured.snapshotTag, captured);\n\t\t}\n\t\tfor (const pluginKey of meta.participants) {\n\t\t\tyield* preflightContributionDoc(pluginKey, artifactDir);\n\t\t}\n\t\tconst statePath = `${artifactDir}/${SnapshotLayout.stateFile}`;\n\t\tconst stateExists = yield* fs.exists(statePath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (stateExists) {\n\t\t\tyield* readSnapshotStateDocument(statePath).pipe(\n\t\t\t\tEffect.catch(failPhase('read-state', `state.json failed schema validation`)),\n\t\t\t);\n\t\t}\n\t\tif (meta.hostTreeIncluded) {\n\t\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\t\tyield* requireReadableNonEmptyFile(tarPath, 'untar-host-tree', 'host-tree tar is required');\n\t\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\t\tStream.mapError(\n\t\t\t\t\t(cause) =>\n\t\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\t\tstage: 'entry-validation',\n\t\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tyield* validateHostTreeTarEntries(tarStream).pipe(\n\t\t\t\tEffect.catch(failPhase('untar-host-tree', `host-tree tar entry validation failed`)),\n\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.preflight'));\n\n// -----------------------------------------------------------------------------\n// Image load + staged re-tag.\n// -----------------------------------------------------------------------------\n\nconst loadImageBundle = (\n\ttarPath: string,\n\tartifactDir: string,\n\truntime: ContainerRuntime,\n\texpectedSnapshotTags: ReadonlyArray<string>,\n): Effect.Effect<ReadonlyMap<string, ImageRef>, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst fullTarPath = `${artifactDir}/${tarPath}`;\n\t\tconst exists = yield* fs.exists(fullTarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'load-image',\n\t\t\t\t\tdetail: `container image bundle absent at ${fullTarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bundleTags = yield* readImageBundleTags(fullTarPath, tarPath).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tyield* verifyImageBundleTags(tarPath, bundleTags, expectedSnapshotTags).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tconst loaded = yield* runtime\n\t\t\t.loadImage(fs.stream(fullTarPath))\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('load-image', `load container image bundle from ${fullTarPath} failed`),\n\t\t\t\t),\n\t\t\t);\n\t\tconst loadedTags = loadedBundleTags(loaded);\n\t\tconst missing = expectedSnapshotTags.filter((tag) => !loadedTags.has(tag));\n\t\tif (missing.length > 0) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'load-image',\n\t\t\t\t`container image bundle ${tarPath} did not load expected snapshot tags: ${missing.join(', ')}`,\n\t\t\t);\n\t\t}\n\t\tconst refsByTag = new Map<string, ImageRef>();\n\t\tfor (const ref of loaded.refs) {\n\t\t\tif (ref.tag === undefined || !expectedSnapshotTags.includes(ref.tag)) continue;\n\t\t\tif (refsByTag.has(ref.tag)) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'load-image',\n\t\t\t\t\t`container image bundle ${tarPath} loaded duplicate snapshot tag ${ref.tag}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\trefsByTag.set(ref.tag, ref);\n\t\t}\n\t\treturn refsByTag;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.load-image-bundle'));\n\nconst expectedSnapshotTagsByBundle = (\n\tcontainers: ReadonlyArray<CapturedContainer>,\n): ReadonlyMap<string, ReadonlyArray<string>> => {\n\tconst byBundle = new Map<string, string[]>();\n\tfor (const captured of containers) {\n\t\tconst tags = byBundle.get(captured.tarPath);\n\t\tif (tags === undefined) {\n\t\t\tbyBundle.set(captured.tarPath, [captured.snapshotTag]);\n\t\t} else {\n\t\t\ttags.push(captured.snapshotTag);\n\t\t}\n\t}\n\treturn byBundle;\n};\n\nconst stageLoadedImage = (\n\tcaptured: CapturedContainer,\n\tloadedRef: ImageRef,\n\truntime: ContainerRuntime,\n\tregisterStagedImage: (image: StagedContainerImage) => Effect.Effect<void>,\n): Effect.Effect<StagedContainerImage, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tconst stagedImageTag = mintRestoreStagingTag();\n\t\tconst stagedImage: StagedContainerImage = {\n\t\t\tcaptured,\n\t\t\tstagedRef: { digest: loadedRef.digest, tag: stagedImageTag },\n\t\t\tstagedImageTag,\n\t\t};\n\t\tyield* registerStagedImage(stagedImage);\n\t\tyield* runtime\n\t\t\t.tagImage(loadedRef, stagedImageTag, { removeSourceAfterTag: true })\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t`tag restored image ${captured.snapshotTag} as staging ref ${stagedImageTag} failed`,\n\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn stagedImage;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.stage-image'));\n\nconst cleanupRestoreStagingImages = (\n\truntime: ContainerRuntime,\n\timages: ReadonlyArray<StagedContainerImage>,\n): Effect.Effect<void> =>\n\tEffect.forEach(\n\t\timages,\n\t\t(image) =>\n\t\t\truntime\n\t\t\t\t.removeImage(image.stagedRef)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\tEffect.logWarning(\n\t\t\t\t\t\t\t`remove restore staging image ${image.stagedImageTag} failed during restore cleanup: ${String(\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t)}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t{ concurrency: 'unbounded' },\n\t).pipe(Effect.asVoid);\n\nconst promoteStagedImages = (\n\timages: ReadonlyArray<StagedContainerImage>,\n\truntime: ContainerRuntime,\n): Effect.Effect<void, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tfor (const image of images) {\n\t\t\tyield* runtime\n\t\t\t\t.tagImage(image.stagedRef, image.captured.imageName, {\n\t\t\t\t\tremoveSourceAfterTag: true,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t\t`tag staged image ${image.stagedImageTag} as ${image.captured.imageName} failed`,\n\t\t\t\t\t\t\timage.captured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.promote-images'));\n\nconst restoreHostTree = (\n\tartifactDir: string,\n\ttarget: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\tconst exists = yield* fs.exists(tarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'untar-host-tree',\n\t\t\t\t\tdetail: `host-tree tar absent at ${tarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\tStream.mapError(\n\t\t\t\t(cause) =>\n\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\tstage: 'stream-stdin',\n\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tyield* Effect.scoped(untarHostTree(tarStream, { target })).pipe(\n\t\t\tEffect.catch(failPhase('untar-host-tree', `untar ${tarPath} to ${target} failed`)),\n\t\t);\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.host-tree'));\n\nconst LIVE_RESTORE_PRESERVED_PATHS: ReadonlyArray<StageAndSwapPreservedPath> = [\n\t{ relativePath: SNAPSHOTS_DIR_NAME, kind: 'directory' },\n\t{ relativePath: COMMAND_CHANNEL_COMMANDS_FILE_NAME, kind: 'file' },\n\t{ relativePath: COMMAND_CHANNEL_EVENTS_FILE_NAME, kind: 'file' },\n\t{ relativePath: 'roster.json', kind: 'file' },\n\t{ relativePath: 'container-claims.json', kind: 'file' },\n\t{ relativePath: 'snapshot.reservation', kind: 'file' },\n];\n\n// -----------------------------------------------------------------------------\n// Top-level restore — bracketed-atomic via stage-and-swap.\n// -----------------------------------------------------------------------------\n\nexport interface RestoreInputs {\n\treadonly snapshotId: SnapshotId;\n\treadonly artifactDir: string;\n\treadonly runtimeStackRoot: string;\n\treadonly runtimeStagingPath: string;\n\treadonly runtimeBackupPath: string;\n\treadonly participants: ReadonlyArray<RestoreParticipant>;\n\treadonly runtime: ContainerRuntime;\n\treadonly runtimeIdentity: SnapshotRuntimeIdentity;\n}\n\n/**\n * Run the full restore. Bracketed-atomic via `stageAndSwap` at the\n * runtime-root level — external watchers never observe a half-restored\n * tree.\n *\n * Order:\n *   1. Read meta.json (refuse if absent / corrupt — no mutation).\n *   2. Run identity-guard against runtime metadata and merged plugin\n *      contributions (refuse on any disagreement — no mutation).\n *   3. Pre-restore hooks (per-plugin validation; soft errors).\n *   4. Stage:\n *      - Untar host-tree into staging.\n *      - Copy state.json into staging.\n *      - Re-read contribution docs.\n *      - Load image bundles and stage verified snapshot tags.\n *      - Write a restore-pending marker into the staged root.\n *   5. Atomic swap staging → runtime root, preserving live command /\n *      event channel files and other explicit runtime-control files.\n *   6. Promote staged images to recorded refs, then remove captured\n *      managed containers by label. If this fails, the pending marker\n *      remains in the restored root for diagnosis/recovery.\n *   7. Post-restore hooks.\n *\n * The caller is responsible for `acquireReservation`; restore supplies\n * the runtime-control publish lock to `stageAndSwap`.\n */\nexport const runRestore = (\n\tinputs: RestoreInputs,\n): Effect.Effect<\n\tSnapshotMetadata,\n\tRestorePhaseError | IdentityGuardError | IdentityContributionConflictError | StageAndSwapError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'devstack.snapshot.phase': 'restore',\n\t\t\t'devstack.snapshot.artifact': inputs.artifactDir,\n\t\t});\n\n\t\t// 1. Authoritative meta read.\n\t\tconst meta = yield* readMeta(inputs.artifactDir, inputs.snapshotId);\n\t\tyield* verifyIntegrity(inputs.artifactDir);\n\n\t\t// 2. Identity guard — compare the metadata's runtime identity\n\t\t//    and plugin-contributed identity. FAIL-CLOSED before any mutation.\n\t\tyield* runRuntimeIdentityGuard(\n\t\t\t{ app: meta.app, stack: meta.stack, network: meta.network },\n\t\t\tinputs.runtimeIdentity,\n\t\t);\n\t\tconst liveContributions: IdentityContribution[] = [];\n\t\tfor (const participant of inputs.participants) {\n\t\t\tconst slice = yield* participant.liveIdentity;\n\t\t\tliveContributions.push({ plugin: participant.plugin, slice });\n\t\t}\n\t\tconst live = yield* mergeContributions(liveContributions);\n\t\tyield* runIdentityGuard(meta.identity, live);\n\n\t\t// 3. Plugin-level preRestore hooks (run AFTER identity-guard so\n\t\t//    a mismatch refuses without ever calling them).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.preRestore) {\n\t\t\t\tyield* participant.preRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('pre-restore-hook', `preRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tyield* preflightArtifact(meta, inputs.artifactDir);\n\n\t\t// 4. Stage filesystem content and non-destructive Docker image\n\t\t//    refs; atomic swap on success. Until `stageAndSwap`\n\t\t//    succeeds, the restore-pending marker is only in staging, so\n\t\t//    restore owns cleanup for any Docker staging refs it minted.\n\t\tconst stagedImages = yield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst stagedImages: StagedContainerImage[] = [];\n\t\t\t\tlet recoveryHandoffComplete = false;\n\t\t\t\tyield* Effect.addFinalizer((exit) =>\n\t\t\t\t\tExit.isFailure(exit) && !recoveryHandoffComplete\n\t\t\t\t\t\t? cleanupRestoreStagingImages(inputs.runtime, stagedImages)\n\t\t\t\t\t\t: Effect.void,\n\t\t\t\t);\n\t\t\t\tconst swappedImages = yield* stageAndSwap({\n\t\t\t\t\ttargetPath: inputs.runtimeStackRoot,\n\t\t\t\t\tstagingPath: inputs.runtimeStagingPath,\n\t\t\t\t\tbackupPath: inputs.runtimeBackupPath,\n\t\t\t\t\tpreserveFromTarget: LIVE_RESTORE_PRESERVED_PATHS,\n\t\t\t\t\tpublishLockPath: runtimeControlLockPathForStackRoot(inputs.runtimeStackRoot),\n\t\t\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\t\t\t// 4a. Untar host-tree into staging.\n\t\t\t\t\t\tif (meta.hostTreeIncluded) {\n\t\t\t\t\t\t\tyield* restoreHostTree(inputs.artifactDir, inputs.runtimeStagingPath);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4b. Copy state.json into staging.\n\t\t\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\t\t\tconst srcState = `${inputs.artifactDir}/${SnapshotLayout.stateFile}`;\n\t\t\t\t\t\tconst stateExists = yield* fs\n\t\t\t\t\t\t\t.exists(srcState)\n\t\t\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\tif (stateExists) {\n\t\t\t\t\t\t\tconst stateDoc = yield* readSnapshotStateDocument(srcState).pipe(\n\t\t\t\t\t\t\t\tEffect.catch(failPhase('read-state', `state.json failed schema validation`)),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tyield* writeSnapshotStateDocument(\n\t\t\t\t\t\t\t\t`${inputs.runtimeStagingPath}/${SnapshotLayout.stateFile}`,\n\t\t\t\t\t\t\t\tstateDoc,\n\t\t\t\t\t\t\t).pipe(Effect.catch(failPhase('expand-state', `write state.json failed`)));\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4c. Read each contribution doc — the participants'\n\t\t\t\t\t\t//      post-restore hooks may want this; we surface it\n\t\t\t\t\t\t//      via the participant's own state-store reads after\n\t\t\t\t\t\t//      the swap lands.\n\t\t\t\t\t\tfor (const pluginKey of meta.participants) {\n\t\t\t\t\t\t\tconst path = `${inputs.artifactDir}/${contributionPath(pluginKey)}`;\n\t\t\t\t\t\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\t\tif (!exists) {\n\t\t\t\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\t\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\t\t\t\t\t\tdetail: `contribution doc absent at ${path}`,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4d. Load + tag committed images under restore-staging\n\t\t\t\t\t\t//     refs only after all artifact expansion/copy work\n\t\t\t\t\t\t//     has succeeded. The Docker save manifest must match\n\t\t\t\t\t\t//     snapshot metadata exactly before docker load mutates\n\t\t\t\t\t\t//     the daemon; loaded refs then supply the real digest\n\t\t\t\t\t\t//     used for staging tags.\n\t\t\t\t\t\tconst expectedTagsByBundle = expectedSnapshotTagsByBundle(meta.containers);\n\t\t\t\t\t\tconst loadedRefsBySnapshotTag = new Map<string, ImageRef>();\n\t\t\t\t\t\tfor (const [tarPath, expectedTags] of expectedTagsByBundle) {\n\t\t\t\t\t\t\tconst loadedRefs = yield* loadImageBundle(\n\t\t\t\t\t\t\t\ttarPath,\n\t\t\t\t\t\t\t\tinputs.artifactDir,\n\t\t\t\t\t\t\t\tinputs.runtime,\n\t\t\t\t\t\t\t\texpectedTags,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tfor (const [tag, ref] of loadedRefs) {\n\t\t\t\t\t\t\t\tloadedRefsBySnapshotTag.set(tag, ref);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tfor (const captured of meta.containers) {\n\t\t\t\t\t\t\tconst loadedRef = loadedRefsBySnapshotTag.get(captured.snapshotTag);\n\t\t\t\t\t\t\tif (loadedRef === undefined) {\n\t\t\t\t\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t\t\t\t\t'load-image',\n\t\t\t\t\t\t\t\t\t`container image bundle did not return loaded ref for ${captured.snapshotTag}`,\n\t\t\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tyield* stageLoadedImage(captured, loadedRef, inputs.runtime, (image) =>\n\t\t\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t\t\tstagedImages.push(image);\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tyield* writeRestorePendingMarker({\n\t\t\t\t\t\t\truntimeRoot: inputs.runtimeStagingPath,\n\t\t\t\t\t\t\tmeta,\n\t\t\t\t\t\t\tartifactDir: inputs.artifactDir,\n\t\t\t\t\t\t\tstagedImages,\n\t\t\t\t\t\t});\n\t\t\t\t\t\treturn stagedImages;\n\t\t\t\t\t}),\n\t\t\t\t});\n\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\treturn swappedImages;\n\t\t\t}),\n\t\t);\n\n\t\t// 5. Docker finalization happens after filesystem publish. If\n\t\t//    promotion or removal fails, the restored root still carries\n\t\t//    snapshot.restore-pending.json with the staged image refs.\n\t\tif (stagedImages.length > 0) {\n\t\t\tyield* promoteStagedImages(stagedImages, inputs.runtime);\n\t\t\tyield* removeCapturedContainers(meta, inputs.runtime, inputs.runtimeIdentity);\n\t\t\tyield* clearRestorePendingMarker(inputs.runtimeStackRoot);\n\t\t}\n\n\t\t// 6. Post-restore hooks (after the swap lands so plugins read\n\t\t//    fresh state from the runtime root).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.postRestore) {\n\t\t\t\tyield* participant.postRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('post-restore-hook', `postRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\treturn meta;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore'));\n"],"mappings":";;;;;;;;;;;;;;;AAgFA,IAAa,oBAAb,cAAuC,OAAO,kBAAqC,CAClF,6BACA;CACC,OAAO,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,QAAQ,OAAO,SAAS,OAAO,OAAO;CACtC,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CACD,CAAC;AAEF,MAAM,aAEJ,OACA,QACA,YAEA,UACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ;CAAQ;CAAO,CAAC,CAAC;AAEtE,MAAM,eACL,OACA,QACA,WAEA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ;CAAQ,CAAC,CAAC;AAE9D,MAAM,0BACJ,OAAmC,YACnC,UACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ,QAAQ,MAAM;CAAQ;CAAO,CAAC,CAAC;AAyBpF,MAAM,YACL,aACA,eAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,GAAG,YAAY,GAAG,eAAe;AAE9C,KAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEpF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,mCAAmC;EAC3C,CAAC,CACF;CAEF,MAAM,OAAO,OAAO,GAClB,eAAe,KAAK,CACpB,KAAK,OAAO,MAAM,UAAU,aAAa,4BAA4B,OAAO,CAAC,CAAC;CAChF,MAAM,MAAM,OAAO,OAAO,IAAI;EAC7B,WAAW,KAAK,MAAM,KAAK;EAC3B,QAAQ,UACP,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,kCAAkC;GAC1C;GACA,CAAC;EACH,CAAC;CACF,MAAM,OAAO,OAAO,OAAO,oBAAoB,uBAAuB,CAAC,IAAI,CAAC,KAC3E,OAAO,OAAO,UACb,OAAO,KACN,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,qCAAqC;EAC7C;EACA,CAAC,CACF,CACD,CACD;CACD,MAAM,WAAW,gBAAgB,KAAK,GAAG;AACzC,KAAI,aAAa,KAChB,QAAO,OAAO,YACb,gBACA,6CAA6C,KAAK,KAClD;AAEF,KAAI,aAAa,WAChB,QAAO,OAAO,YACb,gBACA,gBAAgB,KAAK,GAAG,wCAAwC,aAChE;AAEF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAEpE,MAAM,mBACL,gBAEA,wBAAwB,YAAY,CAAC,KACpC,OAAO,OAAO,UACb,OAAO,KACN,IAAI,kBAAkB;CACrB,OACC,iBAAiB,SAAS,MAAM,QAAQ,SAAS,eAAe,cAAc,GAC3E,mBACA;CACJ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;CACjD;CACA,CAAC,CACF,CACD,CACD;;;;;AAUF,MAAM,4BACL,MACA,SACA,oBAEA,OAAO,IAAI,aAAa;AACvB,MAAK,MAAM,YAAY,KAAK,WAC3B,QAAO,QACL,wBAAwB;EACxB,KAAK,gBAAgB;EACrB,OAAO,gBAAgB;EACvB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,iCAAiC,SAAS,OAAO,GAAG,SAAS,KAAK,UAClE,SAAS,OACT,CACD,CACD;EAEF,CAAC,KAAK,OAAO,SAAS,kDAAkD,CAAC;AAO5E,MAAa,4BAA4B;AAEG,OAAO,OAAO;CACzD,SAAS,OAAO,QAAA,EAAyC;CACzD,YAAY,OAAO;CACnB,aAAa,OAAO;CACpB,KAAK,OAAO;CACZ,OAAO,OAAO;CACd,SAAS,OAAO;CAChB,YAAY,OAAO,MAClB,OAAO,OAAO;EACb,QAAQ,OAAO;EACf,MAAM,OAAO;EACb,iBAAiB,OAAO;EACxB,gBAAgB,OAAO;EACvB,CAAC,CACF;CACD,CAAC;AASF,MAAM,oBAAoB,WAAoE;CAC7F,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,OAAO,OAAO,KACxB,KAAI,IAAI,QAAQ,KAAA,EAAW,MAAK,IAAI,IAAI,IAAI;AAE7C,QAAO;;AAGR,MAAM,8BACL,6BAA6B,YAAY,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM,GAAG,GAAG;AAE3E,MAAM,6BAA6B,SAKkC;AACpE,KAAI,KAAK,aAAa,WAAW,EAAG,QAAO,OAAO;CAClD,MAAM,MAA8B;EACnC,SAAA;EACA,YAAY,KAAK,KAAK;EACtB,aAAa,KAAK;EAClB,KAAK,KAAK,KAAK;EACf,OAAO,KAAK,KAAK;EACjB,SAAS,KAAK,KAAK;EACnB,YAAY,KAAK,aAAa,KAAK,WAAW;GAC7C,QAAQ,MAAM,SAAS;GACvB,MAAM,MAAM,SAAS;GACrB,iBAAiB,MAAM,SAAS;GAChC,gBAAgB,MAAM;GACtB,EAAE;EACH;AACD,QAAO,OAAO,IAAI,aAAa;AAE9B,UAAO,OADW,WAAW,YAE3B,gBACA,GAAG,KAAK,YAAY,GAAG,6BACvB,GAAG,KAAK,UAAU,KAAK,MAAM,EAAE,CAAC,IAChC,CACA,KACA,OAAO,MACN,UAAU,yBAAyB,SAAS,0BAA0B,SAAS,CAC/E,CACD;GACD;;AAGH,MAAM,6BACL,gBAEA,OAAO,IAAI,aAAa;AAEvB,SAAO,OADW,WAAW,YAE3B,OAAO,GAAG,YAAY,GAAG,6BAA6B,EAAE,OAAO,MAAM,CAAC,CACtE,KACA,OAAO,MACN,UAAU,yBAAyB,UAAU,0BAA0B,SAAS,CAChF,CACD;EACD;AAMH,MAAM,sBACL,MACA,OACA,WAEA,0BAA0B,MAAM,GAC7B,OAAO,OACP,YAAY,aAAa,mBAAmB,KAAK,iBAAiB,SAAS,OAAO;AAEtF,MAAM,+BACL,MACA,OACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;AAI7B,MAAI,OAHgB,GAClB,KAAK,KAAK,CACV,KAAK,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,OAAO,CAAC,CAAC,EAC1E,SAAS,GACjB,QAAO,OAAO,YAAY,OAAO,GAAG,OAAO,kBAAkB,QAAQ,OAAO;AAE7E,QAAO,OAAO,SAAS,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAC5D,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,OAAO,CAAC,CAC3E;EACA;AAEH,MAAM,8BACL,UACA,gBAEA,OAAO,IAAI,aAAa;AACvB,QAAO,mBAAmB,UAAU,SAAS,QAAQ,SAAS,OAAO;AACrE,QAAO,mBAAmB,QAAQ,SAAS,MAAM,SAAS,OAAO;AACjE,KAAI,CAAC,2BAA2B,SAAS,QAAQ,CAChD,QAAO,OAAO,YACb,aACA,oCAAoC,SAAS,WAC7C,SAAS,OACT;CAEF,MAAM,kBAAkB,2BAA2B;AACnD,KAAI,SAAS,YAAY,gBACxB,QAAO,OAAO,YACb,aACA,4BAA4B,SAAS,QAAQ,mCAAmC,mBAChF,SAAS,OACT;AAEF,KAAI,CAAC,+BAA+B,SAAS,UAAU,CACtD,QAAO,OAAO,YACb,aACA,mEAAmE,SAAS,aAC5E,SAAS,OACT;AAEF,KAAI,CAAC,+BAA+B,SAAS,YAAY,CACxD,QAAO,OAAO,YACb,aACA,gEAAgE,SAAS,eACzE,SAAS,OACT;AAEF,QAAO,4BACN,GAAG,YAAY,GAAG,SAAS,WAC3B,cACA,mCACA,SAAS,OACT;EACA;AAEH,MAAM,4BACL,WACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,GAAG,YAAY,GAAG,iBAAiB,UAAU;CAE1D,MAAM,OAAO,QAAO,OADF,WAAW,YAE3B,eAAe,KAAK,CACpB,KACA,OAAO,MACN,UAAU,qBAAqB,mCAAmC,QAAQ,UAAU,CACpF,CACD;CACF,MAAM,MAAM,OAAO,OAAO,IAAI;EAC7B,WAAW,KAAK,MAAM,KAAK;EAC3B,QAAQ,UACP,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,yCAAyC;GACjD;GACA,CAAC;EACH,CAAC;CACF,MAAM,UAAU,OAAO,OAAO,oBAAoB,sBAAsB,CAAC,IAAI,CAAC,KAC7E,OAAO,OAAO,UACb,OAAO,KACN,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ;EACR,QAAQ,4CAA4C;EACpD;EACA,CAAC,CACF,CACD,CACD;AACD,KAAI,QAAQ,WAAW,UACtB,QAAO,OAAO,YACb,qBACA,2BAA2B,QAAQ,OAAO,kBAAkB,aAC5D,UACA;EAED;AAEH,MAAM,qBACL,MACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mCAAmB,IAAI,KAAgC;AAC7D,MAAK,MAAM,YAAY,KAAK,YAAY;AACvC,SAAO,2BAA2B,UAAU,YAAY;EACxD,MAAM,WAAW,iBAAiB,IAAI,SAAS,YAAY;AAC3D,MAAI,aAAa,KAAA,EAChB,QAAO,OAAO,YACb,aACA,mCAAmC,SAAS,YAAY,OAAO,SAAS,OAAO,GAAG,SAAS,KAAK,OAAO,SAAS,OAAO,GAAG,SAAS,QACnI,SAAS,OACT;AAEF,mBAAiB,IAAI,SAAS,aAAa,SAAS;;AAErD,MAAK,MAAM,aAAa,KAAK,aAC5B,QAAO,yBAAyB,WAAW,YAAY;CAExD,MAAM,YAAY,GAAG,YAAY,GAAG,eAAe;AAEnD,KAAI,OADuB,GAAG,OAAO,UAAU,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE9F,QAAO,0BAA0B,UAAU,CAAC,KAC3C,OAAO,MAAM,UAAU,cAAc,sCAAsC,CAAC,CAC5E;AAEF,KAAI,KAAK,kBAAkB;EAC1B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;AACjD,SAAO,4BAA4B,SAAS,mBAAmB,4BAA4B;AAY3F,SAAO,2BAXW,GAAG,OAAO,QAAQ,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;GACpB,OAAO;GACP,WAAW;GACX,QAAQ,gCAAgC;GACxC;GACA,CAAC,CACH,CAEyC,CAAC,CAAC,KAC5C,OAAO,MAAM,UAAU,mBAAmB,wCAAwC,CAAC,CACnF;;EAED,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAMpE,MAAM,mBACL,SACA,aACA,SACA,yBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,GAAG,YAAY,GAAG;AAEtC,KAAI,EAAC,OADiB,GAAG,OAAO,YAAY,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAE3F,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,oCAAoC;EAC5C,CAAC,CACF;AAKF,QAAO,sBAAsB,SAAS,OAHZ,oBAAoB,aAAa,QAAQ,CAAC,KACnE,OAAO,MAAM,uBAAuB,aAAa,CAAC,CAClD,EACiD,qBAAqB,CAAC,KACvE,OAAO,MAAM,uBAAuB,aAAa,CAAC,CAClD;CACD,MAAM,SAAS,OAAO,QACpB,UAAU,GAAG,OAAO,YAAY,CAAC,CACjC,KACA,OAAO,MACN,UAAU,cAAc,oCAAoC,YAAY,SAAS,CACjF,CACD;CACF,MAAM,aAAa,iBAAiB,OAAO;CAC3C,MAAM,UAAU,qBAAqB,QAAQ,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1E,KAAI,QAAQ,SAAS,EACpB,QAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,wCAAwC,QAAQ,KAAK,KAAK,GAC5F;CAEF,MAAM,4BAAY,IAAI,KAAuB;AAC7C,MAAK,MAAM,OAAO,OAAO,MAAM;AAC9B,MAAI,IAAI,QAAQ,KAAA,KAAa,CAAC,qBAAqB,SAAS,IAAI,IAAI,CAAE;AACtE,MAAI,UAAU,IAAI,IAAI,IAAI,CACzB,QAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,iCAAiC,IAAI,MACvE;AAEF,YAAU,IAAI,IAAI,KAAK,IAAI;;AAE5B,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,kDAAkD,CAAC;AAE5E,MAAM,gCACL,eACgD;CAChD,MAAM,2BAAW,IAAI,KAAuB;AAC5C,MAAK,MAAM,YAAY,YAAY;EAClC,MAAM,OAAO,SAAS,IAAI,SAAS,QAAQ;AAC3C,MAAI,SAAS,KAAA,EACZ,UAAS,IAAI,SAAS,SAAS,CAAC,SAAS,YAAY,CAAC;MAEtD,MAAK,KAAK,SAAS,YAAY;;AAGjC,QAAO;;AAGR,MAAM,oBACL,UACA,WACA,SACA,wBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,iBAAiB,uBAAuB;CAC9C,MAAM,cAAoC;EACzC;EACA,WAAW;GAAE,QAAQ,UAAU;GAAQ,KAAK;GAAgB;EAC5D;EACA;AACD,QAAO,oBAAoB,YAAY;AACvC,QAAO,QACL,SAAS,WAAW,gBAAgB,EAAE,sBAAsB,MAAM,CAAC,CACnE,KACA,OAAO,MACN,UACC,eACA,sBAAsB,SAAS,YAAY,kBAAkB,eAAe,UAC5E,SAAS,OACT,CACD,CACD;AACF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,4CAA4C,CAAC;AAEtE,MAAM,+BACL,SACA,WAEA,OAAO,QACN,SACC,UACA,QACE,YAAY,MAAM,UAAU,CAC5B,KACA,OAAO,OAAO,UACb,OAAO,WACN,gCAAgC,MAAM,eAAe,kCAAkC,OACtF,MACA,GACD,CACD,CACD,EACH,EAAE,aAAa,aAAa,CAC5B,CAAC,KAAK,OAAO,OAAO;AAEtB,MAAM,uBACL,QACA,YAEA,OAAO,IAAI,aAAa;AACvB,MAAK,MAAM,SAAS,OACnB,QAAO,QACL,SAAS,MAAM,WAAW,MAAM,SAAS,WAAW,EACpD,sBAAsB,MACtB,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,oBAAoB,MAAM,eAAe,MAAM,MAAM,SAAS,UAAU,UACxE,MAAM,SAAS,OACf,CACD,CACD;EAEF,CAAC,KAAK,OAAO,SAAS,+CAA+C,CAAC;AAEzE,MAAM,mBACL,aACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;AAEjD,KAAI,EAAC,OADiB,GAAG,OAAO,QAAQ,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEvF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,2BAA2B;EACnC,CAAC,CACF;CAEF,MAAM,YAAY,GAAG,OAAO,QAAQ,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;EACpB,OAAO;EACP,WAAW;EACX,QAAQ,gCAAgC;EACxC;EACA,CAAC,CACH,CACD;AACD,QAAO,OAAO,OAAO,cAAc,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,KAC1D,OAAO,MAAM,UAAU,mBAAmB,SAAS,QAAQ,MAAM,OAAO,SAAS,CAAC,CAClF;EACA,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAEpE,MAAM,+BAAyE;CAC9E;EAAE,cAAc;EAAoB,MAAM;EAAa;CACvD;EAAE,cAAc;EAAoC,MAAM;EAAQ;CAClE;EAAE,cAAc;EAAkC,MAAM;EAAQ;CAChE;EAAE,cAAc;EAAe,MAAM;EAAQ;CAC7C;EAAE,cAAc;EAAyB,MAAM;EAAQ;CACvD;EAAE,cAAc;EAAwB,MAAM;EAAQ;CACtD;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CD,MAAa,cACZ,WAMA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;EACjC,2BAA2B;EAC3B,8BAA8B,OAAO;EACrC,CAAC;CAGF,MAAM,OAAO,OAAO,SAAS,OAAO,aAAa,OAAO,WAAW;AACnE,QAAO,gBAAgB,OAAO,YAAY;AAI1C,QAAO,wBACN;EAAE,KAAK,KAAK;EAAK,OAAO,KAAK;EAAO,SAAS,KAAK;EAAS,EAC3D,OAAO,gBACP;CACD,MAAM,oBAA4C,EAAE;AACpD,MAAK,MAAM,eAAe,OAAO,cAAc;EAC9C,MAAM,QAAQ,OAAO,YAAY;AACjC,oBAAkB,KAAK;GAAE,QAAQ,YAAY;GAAQ;GAAO,CAAC;;CAE9D,MAAM,OAAO,OAAO,mBAAmB,kBAAkB;AACzD,QAAO,iBAAiB,KAAK,UAAU,KAAK;AAI5C,MAAK,MAAM,eAAe,OAAO,aAChC,KAAI,YAAY,WACf,QAAO,YAAY,WAAW,KAC7B,OAAO,MAAM,UAAU,oBAAoB,qBAAqB,YAAY,OAAO,CAAC,CACpF;AAIH,QAAO,kBAAkB,MAAM,OAAO,YAAY;CAMlD,MAAM,eAAe,OAAO,OAAO,OAClC,OAAO,IAAI,aAAa;EACvB,MAAM,eAAuC,EAAE;EAC/C,IAAI,0BAA0B;AAC9B,SAAO,OAAO,cAAc,SAC3B,KAAK,UAAU,KAAK,IAAI,CAAC,0BACtB,4BAA4B,OAAO,SAAS,aAAa,GACzD,OAAO,KACV;EACD,MAAM,gBAAgB,OAAO,aAAa;GACzC,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,oBAAoB;GACpB,iBAAiB,mCAAmC,OAAO,iBAAiB;GAC5E,OAAO,OAAO,IAAI,aAAa;AAE9B,QAAI,KAAK,iBACR,QAAO,gBAAgB,OAAO,aAAa,OAAO,mBAAmB;IAGtE,MAAM,KAAK,OAAO,WAAW;IAC7B,MAAM,WAAW,GAAG,OAAO,YAAY,GAAG,eAAe;AAIzD,QAAI,OAHuB,GACzB,OAAO,SAAS,CAChB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAChC;KAChB,MAAM,WAAW,OAAO,0BAA0B,SAAS,CAAC,KAC3D,OAAO,MAAM,UAAU,cAAc,sCAAsC,CAAC,CAC5E;AACD,YAAO,2BACN,GAAG,OAAO,mBAAmB,GAAG,eAAe,aAC/C,SACA,CAAC,KAAK,OAAO,MAAM,UAAU,gBAAgB,0BAA0B,CAAC,CAAC;;AAM3E,SAAK,MAAM,aAAa,KAAK,cAAc;KAC1C,MAAM,OAAO,GAAG,OAAO,YAAY,GAAG,iBAAiB,UAAU;AAEjE,SAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEpF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;MACrB,OAAO;MACP,QAAQ;MACR,QAAQ,8BAA8B;MACtC,CAAC,CACF;;IASH,MAAM,uBAAuB,6BAA6B,KAAK,WAAW;IAC1E,MAAM,0CAA0B,IAAI,KAAuB;AAC3D,SAAK,MAAM,CAAC,SAAS,iBAAiB,sBAAsB;KAC3D,MAAM,aAAa,OAAO,gBACzB,SACA,OAAO,aACP,OAAO,SACP,aACA;AACD,UAAK,MAAM,CAAC,KAAK,QAAQ,WACxB,yBAAwB,IAAI,KAAK,IAAI;;AAGvC,SAAK,MAAM,YAAY,KAAK,YAAY;KACvC,MAAM,YAAY,wBAAwB,IAAI,SAAS,YAAY;AACnE,SAAI,cAAc,KAAA,EACjB,QAAO,OAAO,YACb,cACA,wDAAwD,SAAS,eACjE,SAAS,OACT;AAEF,YAAO,iBAAiB,UAAU,WAAW,OAAO,UAAU,UAC7D,OAAO,WAAW;AACjB,mBAAa,KAAK,MAAM;OACvB,CACF;;AAEF,WAAO,0BAA0B;KAChC,aAAa,OAAO;KACpB;KACA,aAAa,OAAO;KACpB;KACA,CAAC;AACF,WAAO;KACN;GACF,CAAC;AACF,4BAA0B;AAC1B,SAAO;GACN,CACF;AAKD,KAAI,aAAa,SAAS,GAAG;AAC5B,SAAO,oBAAoB,cAAc,OAAO,QAAQ;AACxD,SAAO,yBAAyB,MAAM,OAAO,SAAS,OAAO,gBAAgB;AAC7E,SAAO,0BAA0B,OAAO,iBAAiB;;AAK1D,MAAK,MAAM,eAAe,OAAO,aAChC,KAAI,YAAY,YACf,QAAO,YAAY,YAAY,KAC9B,OAAO,MAAM,UAAU,qBAAqB,sBAAsB,YAAY,OAAO,CAAC,CACtF;AAIH,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,gCAAgC,CAAC"}
+{"version":3,"file":"restore.mjs","names":["writePendingMarkerIo","removePendingMarkerIo"],"sources":["../../../src/orchestrators/snapshot/restore.ts"],"sourcesContent":["// Restore pipeline.\n//\n// Architecture § Snapshot lifecycle (restore half):\n//\n//   Identity guard (chain identity + plugin contributions)\n//       │   (refuse and stop if mismatch — nothing touched)\n//       ▼\n//   Stage atomic restore in tempdir\n//       │\n//       ▼\n//   Per plugin: expand tar to staging, load committed images\n//       │\n//       ▼\n//   Atomic swap into runtime dir, preserving live control files\n//       │\n//       ▼\n//   snapshot.restored event → next stack acquire picks it up\n//\n// Bracketed-atomic — Tension 9 decision: one outer atomic swap, not\n// per-phase idempotency.\n\nimport { mintRandomSuffix } from '../../substrate/runtime/random-suffix.ts';\n\nimport { Effect, Exit, FileSystem, Schema, Stream } from 'effect';\n\nimport type { ContainerRuntime, ImageRef } from '../../contracts/container-runtime.ts';\nimport {\n\tmakePendingMarkerDocument,\n\tpendingMarkerPath,\n\tRestorePendingMarkerIoError,\n\tremovePendingMarker as removePendingMarkerIo,\n\trewritePendingMarkerContainers,\n\twritePendingMarker as writePendingMarkerIo,\n\tRESTORE_PENDING_FILE_NAME,\n\tRestorePendingDocumentSchema,\n\tSNAPSHOT_RESTORE_PENDING_VERSION,\n\ttype RestorePendingContainer,\n\ttype RestorePendingDocument,\n} from './pending-marker.ts';\nimport {\n\tHostTreeTarError,\n\tuntarHostTree,\n\tvalidateHostTreeTarEntries,\n} from '../../substrate/runtime/host-tree-tar/index.ts';\nimport { decodeUnknown, parseJsonText } from '../../substrate/runtime/runtime-decode.ts';\nimport {\n\tContributionDocSchema,\n\tcontainerImagesBundlePath,\n\tcontributionPath,\n\tDEPLOY_CACHE_NAMESPACES,\n\tSnapshotLayout,\n\tSnapshotMetadataSchema,\n\ttype SnapshotId,\n\ttype CapturedContainer,\n\ttype IdentitySlice,\n\ttype SnapshotMetadata,\n\tisRestorableContainerImageName,\n\tisSafeSnapshotPathSegment,\n\tisSafeSnapshotRelativePath,\n\tparseSnapshotId,\n} from './descriptor.ts';\nimport { verifyArtifactIntegrity } from './integrity.ts';\nimport { makePhaseFailer } from './phase-error.ts';\nimport {\n\treadSnapshotStateDocument,\n\twriteSnapshotStateDocument,\n\ttype SnapshotStateDocumentError,\n} from './state-document.ts';\nimport {\n\tmergeContributions,\n\trunIdentityGuard,\n\trunRuntimeIdentityGuard,\n\ttype IdentityContribution,\n\ttype IdentityContributionConflictError,\n\ttype IdentityGuardError,\n\ttype SnapshotRuntimeIdentity,\n} from './identity-guard.ts';\nimport {\n\tstageAndSwap,\n\ttype StageAndSwapError,\n\ttype StageAndSwapPreservedPath,\n} from '../../substrate/runtime/stage-and-swap/index.ts';\nimport {\n\tCOMMAND_CHANNEL_COMMANDS_FILE_NAME,\n\tCOMMAND_CHANNEL_EVENTS_FILE_NAME,\n\truntimeControlLockPathForStackRoot,\n} from '../../substrate/runtime/cross-process/command-channel/index.ts';\nimport {\n\tImageBundleTagScanError,\n\treadImageBundleTags,\n\tverifyImageBundleTags,\n} from './image-bundle-tags.ts';\nimport { CACHE_DIR_NAME, SNAPSHOTS_DIR_NAME } from './wipe.ts';\n\n// -----------------------------------------------------------------------------\n// Errors\n// -----------------------------------------------------------------------------\n\n/** Tagged failure during a restore step. Phase discriminates the\n *  failing step so the user-facing message can point at it. */\nexport class RestorePhaseError extends Schema.TaggedErrorClass<RestorePhaseError>()(\n\t'SnapshotRestorePhaseError',\n\t{\n\t\tphase: Schema.Literals([\n\t\t\t'read-meta',\n\t\t\t'meta-corrupt',\n\t\t\t'meta-absent',\n\t\t\t'read-state',\n\t\t\t'read-contribution',\n\t\t\t'read-integrity',\n\t\t\t'verify-integrity',\n\t\t\t'preflight',\n\t\t\t'pre-restore-hook',\n\t\t\t'untar-host-tree',\n\t\t\t'load-image',\n\t\t\t'retag-image',\n\t\t\t'expand-state',\n\t\t\t'post-restore-hook',\n\t\t\t'pre-cleanup',\n\t\t\t'write-restore-pending',\n\t\t\t'read-restore-pending',\n\t\t\t'clear-restore-pending',\n\t\t\t'missing-subtree-fatal',\n\t\t]),\n\t\tplugin: Schema.optional(Schema.String),\n\t\tdetail: Schema.String,\n\t\tcause: Schema.optional(Schema.Defect),\n\t},\n) {}\n\nconst failPhase = makePhaseFailer(RestorePhaseError);\n\nconst failRestore = (\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<never, RestorePhaseError> =>\n\tEffect.fail(new RestorePhaseError({ phase, plugin, detail }));\n\nconst failImageBundleTagScan =\n\t(phase: RestorePhaseError['phase'], plugin?: string) =>\n\t(cause: ImageBundleTagScanError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(new RestorePhaseError({ phase, plugin, detail: cause.detail, cause }));\n\n/** Project a `SnapshotStateDocumentError` onto a `RestorePhaseError`,\n *  branching by `kind` so a phase classifier never inspects message\n *  substrings. */\nconst failStateDocument =\n\t(\n\t\treadPhase: RestorePhaseError['phase'],\n\t\twritePhase: RestorePhaseError['phase'],\n\t\tplugin?: string,\n\t) =>\n\t(err: SnapshotStateDocumentError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(\n\t\t\tnew RestorePhaseError({\n\t\t\t\tphase: err.kind === 'write' ? writePhase : readPhase,\n\t\t\t\tplugin,\n\t\t\t\tdetail: err.detail,\n\t\t\t\tcause: err.cause,\n\t\t\t}),\n\t\t);\n\n// -----------------------------------------------------------------------------\n// Participants — what restore needs from each plugin\n// -----------------------------------------------------------------------------\n\n/** One plugin's restore-side contributions: a live identity probe\n *  (read fresh from the live stack), an opaque pre-restore validation\n *  hook, and a post-restore hook. Mirrors `SnapshotableDecl`'s\n *  pre/post hook surface but closed over the plugin's key. */\nexport interface RestoreParticipant {\n\treadonly plugin: string;\n\treadonly liveIdentity: Effect.Effect<IdentitySlice>;\n\t/** Pre-restore application-level validation (version compat,\n\t *  side-state). Identity-guard runs FIRST and unilaterally; this\n\t *  is the plugin's extra hook. */\n\treadonly preRestore?: Effect.Effect<void>;\n\t/** Post-restore hook: re-validate, warm caches, etc. */\n\treadonly postRestore?: Effect.Effect<void>;\n}\n\n// -----------------------------------------------------------------------------\n// Metadata read — authoritative; absent / unparseable refuses restore.\n// -----------------------------------------------------------------------------\n\nconst readMeta = (\n\tartifactDir: string,\n\texpectedId: SnapshotId,\n): Effect.Effect<SnapshotMetadata, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = `${artifactDir}/${SnapshotLayout.metaFile}`;\n\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-absent',\n\t\t\t\t\tdetail: `snapshot meta.json not found at ${path}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(Effect.catch(failPhase('read-meta', `read meta.json failed at ${path}`)));\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json is not valid JSON at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst meta = yield* decodeUnknown(SnapshotMetadataSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'meta-corrupt',\n\t\t\t\t\tdetail: `meta.json failed schema decode at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst parsedId = parseSnapshotId(meta.id);\n\t\tif (parsedId === null) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json contains an unsafe snapshot id: ${meta.id}`,\n\t\t\t);\n\t\t}\n\t\tif (parsedId !== expectedId) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'meta-corrupt',\n\t\t\t\t`meta.json id ${meta.id} does not match requested snapshot id ${expectedId}`,\n\t\t\t);\n\t\t}\n\t\treturn meta;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.read-meta'));\n\nconst verifyIntegrity = (\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tverifyArtifactIntegrity(artifactDir).pipe(\n\t\tEffect.catchTag('SnapshotIntegrityError', (err) =>\n\t\t\tEffect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: err.kind === 'missing' ? 'read-integrity' : 'verify-integrity',\n\t\t\t\t\tdetail: err.detail,\n\t\t\t\t\tcause: err.cause,\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t);\n\n// -----------------------------------------------------------------------------\n// Managed-container removal by label.\n// -----------------------------------------------------------------------------\n\n/** Restore must discard the current writable layer even when the live\n *  supervisor still holds a claim for the container. This is\n *  intentionally separate from orphan sweep, which skips claimed\n *  containers by design. */\nconst removeCapturedContainers = (\n\tmeta: SnapshotMetadata,\n\truntime: ContainerRuntime,\n\truntimeIdentity: SnapshotRuntimeIdentity,\n): Effect.Effect<void, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* runtime\n\t\t\t\t.removeManagedContainers({\n\t\t\t\t\tapp: runtimeIdentity.app,\n\t\t\t\t\tstack: runtimeIdentity.stack,\n\t\t\t\t\tplugin: captured.plugin,\n\t\t\t\t\trole: captured.role,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'pre-cleanup',\n\t\t\t\t\t\t\t`remove managed containers for ${captured.plugin}/${captured.role} failed`,\n\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.remove-containers'));\n\n// -----------------------------------------------------------------------------\n// Post-publish Docker finalization recovery marker.\n// -----------------------------------------------------------------------------\n//\n// Recovery contract: see `pending-marker.ts` and `recover-pending.ts`.\n// Restore writes the marker BEFORE the atomic swap, rewrites it after\n// each successful promote in `promoteStagedImages` so a mid-loop\n// crash leaves the marker reflecting exactly which images still need\n// retagging, and clears it once every entry has been promoted. The\n// supervise startup hook re-runs the recovery scanner before any\n// plugin acquire.\n\n// Re-export the marker shapes restored from the dedicated module so\n// downstream tests + the recovery scanner continue to import from\n// the snapshot orchestrator barrel.\nexport {\n\tRESTORE_PENDING_FILE_NAME,\n\tRestorePendingDocumentSchema,\n\tSNAPSHOT_RESTORE_PENDING_VERSION,\n\ttype RestorePendingDocument,\n};\n\ninterface StagedContainerImage {\n\treadonly captured: CapturedContainer;\n\treadonly stagedRef: ImageRef;\n\treadonly stagedImageTag: string;\n}\n\nconst stagedImageToPendingEntry = (image: StagedContainerImage): RestorePendingContainer => ({\n\tplugin: image.captured.plugin,\n\trole: image.captured.role,\n\ttargetImageName: image.captured.imageName,\n\tstagedImageTag: image.stagedImageTag,\n\t// The digest is the loaded image's content-addressed identity\n\t// (carried through `stageLoadedImage` from `loadImageBundle`'s\n\t// docker-load output). Persisting it in the marker lets the\n\t// recovery scanner re-tag from the digest as a fallback when both\n\t// `targetImageName` and `stagedImageTag` have been pruned out of\n\t// the daemon between crash and restart.\n\tdigest: image.stagedRef.digest,\n});\n\nconst loadedBundleTags = (bundle: { readonly refs: ReadonlyArray<ImageRef> }): Set<string> => {\n\tconst tags = new Set<string>();\n\tfor (const ref of bundle.refs) {\n\t\tif (ref.tag !== undefined) tags.add(ref.tag);\n\t}\n\treturn tags;\n};\n\nconst mintRestoreStagingTag = (): string => `devstack-snapshot:restore-${mintRandomSuffix(24)}`;\n\nconst mapMarkerIoError =\n\t(phase: RestorePhaseError['phase']) =>\n\t(err: RestorePendingMarkerIoError): Effect.Effect<never, RestorePhaseError> =>\n\t\tEffect.fail(new RestorePhaseError({ phase, detail: err.detail, cause: err.cause }));\n\nconst writeRestorePendingMarker = (args: {\n\treadonly runtimeRoot: string;\n\treadonly meta: SnapshotMetadata;\n\treadonly artifactDir: string;\n\treadonly stagedImages: ReadonlyArray<StagedContainerImage>;\n}): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> => {\n\tif (args.stagedImages.length === 0) return Effect.void;\n\tconst doc = makePendingMarkerDocument({\n\t\tmeta: args.meta,\n\t\tartifactDir: args.artifactDir,\n\t\tcontainers: args.stagedImages.map(stagedImageToPendingEntry),\n\t});\n\treturn writePendingMarkerIo(args.runtimeRoot, doc).pipe(\n\t\tEffect.catchTag(\n\t\t\t'SnapshotRestorePendingMarkerIoError',\n\t\t\tmapMarkerIoError('write-restore-pending'),\n\t\t),\n\t);\n};\n\nconst rewriteRestorePendingMarker = (\n\truntimeRoot: string,\n\tdoc: RestorePendingDocument,\n\tstillPending: ReadonlyArray<RestorePendingContainer>,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\twritePendingMarkerIo(runtimeRoot, rewritePendingMarkerContainers(doc, stillPending)).pipe(\n\t\tEffect.catchTag(\n\t\t\t'SnapshotRestorePendingMarkerIoError',\n\t\t\tmapMarkerIoError('write-restore-pending'),\n\t\t),\n\t);\n\nconst clearRestorePendingMarker = (\n\truntimeRoot: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tremovePendingMarkerIo(runtimeRoot).pipe(\n\t\tEffect.catchTag(\n\t\t\t'SnapshotRestorePendingMarkerIoError',\n\t\t\tmapMarkerIoError('clear-restore-pending'),\n\t\t),\n\t);\n\nconst readRestorePendingMarker = (\n\truntimeRoot: string,\n): Effect.Effect<RestorePendingDocument | null, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst path = pendingMarkerPath(runtimeRoot);\n\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) return null;\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(Effect.catch(failPhase('read-restore-pending', `read ${RESTORE_PENDING_FILE_NAME}`)));\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-restore-pending',\n\t\t\t\t\tdetail: `${RESTORE_PENDING_FILE_NAME} is not valid JSON`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\treturn yield* decodeUnknown(RestorePendingDocumentSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-restore-pending',\n\t\t\t\t\tdetail: `${RESTORE_PENDING_FILE_NAME} failed schema decode`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t});\n\n// -----------------------------------------------------------------------------\n// Artifact preflight — no destructive cleanup until required files are present.\n// -----------------------------------------------------------------------------\n\nconst requirePathSegment = (\n\tkind: string,\n\tvalue: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError> =>\n\tisSafeSnapshotPathSegment(value)\n\t\t? Effect.void\n\t\t: failRestore('preflight', `unsafe snapshot ${kind} path segment: ${value}`, plugin);\n\nconst requireReadableNonEmptyFile = (\n\tpath: string,\n\tphase: RestorePhaseError['phase'],\n\tdetail: string,\n\tplugin?: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst stat = yield* fs\n\t\t\t.stat(path)\n\t\t\t.pipe(Effect.catch(failPhase(phase, `${detail}: stat failed at ${path}`, plugin)));\n\t\tif (stat.size === 0n) {\n\t\t\treturn yield* failRestore(phase, `${detail}: empty file at ${path}`, plugin);\n\t\t}\n\t\tyield* Stream.runDrain(fs.stream(path).pipe(Stream.take(1))).pipe(\n\t\t\tEffect.catch(failPhase(phase, `${detail}: read failed at ${path}`, plugin)),\n\t\t);\n\t});\n\nconst preflightCapturedContainer = (\n\tcaptured: CapturedContainer,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tyield* requirePathSegment('plugin', captured.plugin, captured.plugin);\n\t\tyield* requirePathSegment('role', captured.role, captured.plugin);\n\t\tif (!isSafeSnapshotRelativePath(captured.tarPath)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`unsafe container image tar path: ${captured.tarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tconst expectedTarPath = containerImagesBundlePath();\n\t\tif (captured.tarPath !== expectedTarPath) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container image tar path ${captured.tarPath} does not match canonical bundle ${expectedTarPath}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.imageName)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container imageName is not a restorable Docker tag destination: ${captured.imageName}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tif (!isRestorableContainerImageName(captured.snapshotTag)) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'preflight',\n\t\t\t\t`container snapshotTag is not a restorable Docker tag source: ${captured.snapshotTag}`,\n\t\t\t\tcaptured.plugin,\n\t\t\t);\n\t\t}\n\t\tyield* requireReadableNonEmptyFile(\n\t\t\t`${artifactDir}/${captured.tarPath}`,\n\t\t\t'load-image',\n\t\t\t'container image tar is required',\n\t\t\tcaptured.plugin,\n\t\t);\n\t});\n\nconst preflightContributionDoc = (\n\tpluginKey: string,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst path = `${artifactDir}/${contributionPath(pluginKey)}`;\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst text = yield* fs\n\t\t\t.readFileString(path)\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('read-contribution', `read contribution doc failed at ${path}`, pluginKey),\n\t\t\t\t),\n\t\t\t);\n\t\tconst raw = yield* parseJsonText(text, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc is not valid JSON at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tconst decoded = yield* decodeUnknown(ContributionDocSchema, raw, {\n\t\t\tsource: path,\n\t\t\tmkError: (issue) =>\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\tdetail: `contribution doc failed schema decode at ${path}`,\n\t\t\t\t\tcause: issue.cause,\n\t\t\t\t}),\n\t\t});\n\t\tif (decoded.plugin !== pluginKey) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'read-contribution',\n\t\t\t\t`contribution doc plugin ${decoded.plugin} does not match ${pluginKey}`,\n\t\t\t\tpluginKey,\n\t\t\t);\n\t\t}\n\t});\n\nconst preflightArtifact = (\n\tmeta: SnapshotMetadata,\n\tartifactDir: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst seenSnapshotTags = new Map<string, CapturedContainer>();\n\t\tfor (const captured of meta.containers) {\n\t\t\tyield* preflightCapturedContainer(captured, artifactDir);\n\t\t\tconst previous = seenSnapshotTags.get(captured.snapshotTag);\n\t\t\tif (previous !== undefined) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'preflight',\n\t\t\t\t\t`duplicate container snapshotTag ${captured.snapshotTag} for ${previous.plugin}/${previous.role} and ${captured.plugin}/${captured.role}`,\n\t\t\t\t\tcaptured.plugin,\n\t\t\t\t);\n\t\t\t}\n\t\t\tseenSnapshotTags.set(captured.snapshotTag, captured);\n\t\t}\n\t\tfor (const pluginKey of meta.participants) {\n\t\t\tyield* preflightContributionDoc(pluginKey, artifactDir);\n\t\t}\n\t\tconst statePath = `${artifactDir}/${SnapshotLayout.stateFile}`;\n\t\tconst stateExists = yield* fs.exists(statePath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (stateExists) {\n\t\t\tyield* readSnapshotStateDocument(statePath).pipe(\n\t\t\t\tEffect.catchTag(\n\t\t\t\t\t'SnapshotStateDocumentError',\n\t\t\t\t\tfailStateDocument('read-state', 'expand-state'),\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tif (meta.hostTreeIncluded) {\n\t\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\t\tyield* requireReadableNonEmptyFile(tarPath, 'untar-host-tree', 'host-tree tar is required');\n\t\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\t\tStream.mapError(\n\t\t\t\t\t(cause) =>\n\t\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\t\tstage: 'entry-validation',\n\t\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tyield* validateHostTreeTarEntries(tarStream).pipe(\n\t\t\t\tEffect.catch(failPhase('untar-host-tree', `host-tree tar entry validation failed`)),\n\t\t\t);\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.preflight'));\n\n// -----------------------------------------------------------------------------\n// Image load + staged re-tag.\n// -----------------------------------------------------------------------------\n\nconst loadImageBundle = (\n\ttarPath: string,\n\tartifactDir: string,\n\truntime: ContainerRuntime,\n\texpectedSnapshotTags: ReadonlyArray<string>,\n): Effect.Effect<ReadonlyMap<string, ImageRef>, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst fullTarPath = `${artifactDir}/${tarPath}`;\n\t\tconst exists = yield* fs.exists(fullTarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'load-image',\n\t\t\t\t\tdetail: `container image bundle absent at ${fullTarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst bundleTags = yield* readImageBundleTags(fullTarPath, tarPath).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tyield* verifyImageBundleTags(tarPath, bundleTags, expectedSnapshotTags).pipe(\n\t\t\tEffect.catch(failImageBundleTagScan('load-image')),\n\t\t);\n\t\tconst loaded = yield* runtime\n\t\t\t.loadImage(fs.stream(fullTarPath))\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase('load-image', `load container image bundle from ${fullTarPath} failed`),\n\t\t\t\t),\n\t\t\t);\n\t\tconst loadedTags = loadedBundleTags(loaded);\n\t\tconst missing = expectedSnapshotTags.filter((tag) => !loadedTags.has(tag));\n\t\tif (missing.length > 0) {\n\t\t\treturn yield* failRestore(\n\t\t\t\t'load-image',\n\t\t\t\t`container image bundle ${tarPath} did not load expected snapshot tags: ${missing.join(', ')}`,\n\t\t\t);\n\t\t}\n\t\tconst refsByTag = new Map<string, ImageRef>();\n\t\tfor (const ref of loaded.refs) {\n\t\t\tif (ref.tag === undefined || !expectedSnapshotTags.includes(ref.tag)) continue;\n\t\t\tif (refsByTag.has(ref.tag)) {\n\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t'load-image',\n\t\t\t\t\t`container image bundle ${tarPath} loaded duplicate snapshot tag ${ref.tag}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\trefsByTag.set(ref.tag, ref);\n\t\t}\n\t\treturn refsByTag;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.load-image-bundle'));\n\nconst expectedSnapshotTagsByBundle = (\n\tcontainers: ReadonlyArray<CapturedContainer>,\n): ReadonlyMap<string, ReadonlyArray<string>> => {\n\tconst byBundle = new Map<string, string[]>();\n\tfor (const captured of containers) {\n\t\tconst tags = byBundle.get(captured.tarPath);\n\t\tif (tags === undefined) {\n\t\t\tbyBundle.set(captured.tarPath, [captured.snapshotTag]);\n\t\t} else {\n\t\t\ttags.push(captured.snapshotTag);\n\t\t}\n\t}\n\treturn byBundle;\n};\n\nconst stageLoadedImage = (\n\tcaptured: CapturedContainer,\n\tloadedRef: ImageRef,\n\truntime: ContainerRuntime,\n\tregisterStagedImage: (image: StagedContainerImage) => Effect.Effect<void>,\n): Effect.Effect<StagedContainerImage, RestorePhaseError> =>\n\tEffect.gen(function* () {\n\t\tconst stagedImageTag = mintRestoreStagingTag();\n\t\tconst stagedImage: StagedContainerImage = {\n\t\t\tcaptured,\n\t\t\tstagedRef: { digest: loadedRef.digest, tag: stagedImageTag },\n\t\t\tstagedImageTag,\n\t\t};\n\t\tyield* registerStagedImage(stagedImage);\n\t\tyield* runtime\n\t\t\t.tagImage(loadedRef, stagedImageTag, { removeSourceAfterTag: true })\n\t\t\t.pipe(\n\t\t\t\tEffect.catch(\n\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t`tag restored image ${captured.snapshotTag} as staging ref ${stagedImageTag} failed`,\n\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t);\n\t\treturn stagedImage;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.stage-image'));\n\nconst cleanupRestoreStagingImages = (\n\truntime: ContainerRuntime,\n\timages: ReadonlyArray<StagedContainerImage>,\n): Effect.Effect<void> =>\n\tEffect.forEach(\n\t\timages,\n\t\t(image) =>\n\t\t\truntime\n\t\t\t\t.removeImage(image.stagedRef)\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch((cause) =>\n\t\t\t\t\t\tEffect.logWarning(\n\t\t\t\t\t\t\t`remove restore staging image ${image.stagedImageTag} failed during restore cleanup: ${String(\n\t\t\t\t\t\t\t\tcause,\n\t\t\t\t\t\t\t)}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t{ concurrency: 'unbounded' },\n\t).pipe(Effect.asVoid);\n\n/** Promote each staged image to its recorded name, rewriting the\n *  on-disk pending marker after each successful tag. If the loop\n *  fails mid-way the marker reflects exactly which images are still\n *  pending (the failed entry + every entry not yet attempted), so\n *  the supervise-startup `recoverPendingRestore` only has to retry\n *  the remaining set — no scanning Docker for \"which targets exist\n *  already?\" required. */\nconst promoteStagedImages = (\n\timages: ReadonlyArray<StagedContainerImage>,\n\truntime: ContainerRuntime,\n\truntimeStackRoot: string,\n\tpendingDoc: RestorePendingDocument | null,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tfor (let i = 0; i < images.length; i += 1) {\n\t\t\tconst image = images[i]!;\n\t\t\tyield* runtime\n\t\t\t\t.tagImage(image.stagedRef, image.captured.imageName, {\n\t\t\t\t\tremoveSourceAfterTag: true,\n\t\t\t\t})\n\t\t\t\t.pipe(\n\t\t\t\t\tEffect.catch(\n\t\t\t\t\t\tfailPhase(\n\t\t\t\t\t\t\t'retag-image',\n\t\t\t\t\t\t\t`tag staged image ${image.stagedImageTag} as ${image.captured.imageName} failed`,\n\t\t\t\t\t\t\timage.captured.plugin,\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t// Rewrite the marker with only the still-pending entries\n\t\t\t// (everything we haven't promoted yet). The final entry's\n\t\t\t// rewrite leaves an empty `containers: []` marker on disk;\n\t\t\t// `clearRestorePendingMarker` removes the file shortly\n\t\t\t// after this function returns.\n\t\t\tif (pendingDoc !== null) {\n\t\t\t\tconst stillPending = images.slice(i + 1).map(stagedImageToPendingEntry);\n\t\t\t\tyield* rewriteRestorePendingMarker(runtimeStackRoot, pendingDoc, stillPending);\n\t\t\t}\n\t\t}\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.promote-images'));\n\nconst restoreHostTree = (\n\tartifactDir: string,\n\ttarget: string,\n): Effect.Effect<void, RestorePhaseError, FileSystem.FileSystem> =>\n\tEffect.gen(function* () {\n\t\tconst fs = yield* FileSystem.FileSystem;\n\t\tconst tarPath = `${artifactDir}/${SnapshotLayout.hostTreeTar}`;\n\t\tconst exists = yield* fs.exists(tarPath).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\tif (!exists) {\n\t\t\treturn yield* Effect.fail(\n\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\tphase: 'untar-host-tree',\n\t\t\t\t\tdetail: `host-tree tar absent at ${tarPath}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tconst tarStream = fs.stream(tarPath).pipe(\n\t\t\tStream.mapError(\n\t\t\t\t(cause) =>\n\t\t\t\t\tnew HostTreeTarError({\n\t\t\t\t\t\tstage: 'stream-stdin',\n\t\t\t\t\t\toperation: 'untar',\n\t\t\t\t\t\tdetail: `read host-tree tar failed at ${tarPath}`,\n\t\t\t\t\t\tcause,\n\t\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t\tyield* Effect.scoped(untarHostTree(tarStream, { target })).pipe(\n\t\t\tEffect.catch(failPhase('untar-host-tree', `untar ${tarPath} to ${target} failed`)),\n\t\t);\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore.host-tree'));\n\nconst LIVE_RESTORE_PRESERVED_PATHS: ReadonlyArray<StageAndSwapPreservedPath> = [\n\t{ relativePath: SNAPSHOTS_DIR_NAME, kind: 'directory' },\n\t{ relativePath: COMMAND_CHANNEL_COMMANDS_FILE_NAME, kind: 'file' },\n\t{ relativePath: COMMAND_CHANNEL_EVENTS_FILE_NAME, kind: 'file' },\n\t{ relativePath: 'roster.json', kind: 'file' },\n\t{ relativePath: 'container-claims.json', kind: 'file' },\n\t{ relativePath: 'snapshot.reservation', kind: 'file' },\n\t// Deploy/mint caches. The snapshot CAPTURES these (DEPLOY_CACHE_NAMESPACES in\n\t// descriptor.ts, tarred in capture.ts), and that captured copy — untarred into\n\t// staging, consistent with the restored chain — WINS (`overwrite: false`).\n\t// This live-side entry is only a FALLBACK: it carries the deploy ids forward\n\t// when staging doesn't already have them (e.g. a `snapshot → wipe → restore`\n\t// where the captured copy IS present, or a pre-capture snapshot where it is\n\t// not). Either way the post-restore boot REUSES the deploy instead of\n\t// re-running it with fresh ids (which would orphan every pre-snapshot object).\n\t// The generic per-call `cache/entry` is NOT a deploy namespace and stays\n\t// dropped (restore.test.ts pins that rollback).\n\t...DEPLOY_CACHE_NAMESPACES.map(\n\t\t(namespace): StageAndSwapPreservedPath => ({\n\t\t\trelativePath: `${CACHE_DIR_NAME}/${namespace}`,\n\t\t\tkind: 'directory',\n\t\t\t// The snapshot-CAPTURED copy (untarred into staging) wins; only fall\n\t\t\t// back to the live copy when staging doesn't carry it (e.g. a snapshot\n\t\t\t// taken before deploy-cache capture existed). Avoids clobbering the\n\t\t\t// snapshot-consistent id with a possibly-drifted live one.\n\t\t\toverwrite: false,\n\t\t}),\n\t),\n];\n\n// -----------------------------------------------------------------------------\n// Top-level restore — bracketed-atomic via stage-and-swap.\n// -----------------------------------------------------------------------------\n\nexport interface RestoreInputs {\n\treadonly snapshotId: SnapshotId;\n\treadonly artifactDir: string;\n\treadonly runtimeStackRoot: string;\n\treadonly runtimeStagingPath: string;\n\treadonly runtimeBackupPath: string;\n\treadonly participants: ReadonlyArray<RestoreParticipant>;\n\treadonly runtime: ContainerRuntime;\n\treadonly runtimeIdentity: SnapshotRuntimeIdentity;\n}\n\n/**\n * Run the full restore. Bracketed-atomic via `stageAndSwap` at the\n * runtime-root level — external watchers never observe a half-restored\n * tree.\n *\n * Order:\n *   1. Read meta.json (refuse if absent / corrupt — no mutation).\n *   2. Run identity-guard against runtime metadata and merged plugin\n *      contributions (refuse on any disagreement — no mutation).\n *   3. Pre-restore hooks (per-plugin validation; soft errors).\n *   4. Stage:\n *      - Untar host-tree into staging.\n *      - Copy state.json into staging.\n *      - Re-read contribution docs.\n *      - Load image bundles and stage verified snapshot tags.\n *      - Write a restore-pending marker into the staged root.\n *   5. Atomic swap staging → runtime root, preserving live command /\n *      event channel files and other explicit runtime-control files.\n *   6. Promote staged images to recorded refs, then remove captured\n *      managed containers by label. If this fails, the pending marker\n *      remains in the restored root for diagnosis/recovery.\n *   7. Post-restore hooks.\n *\n * The caller is responsible for `acquireReservation`; restore supplies\n * the runtime-control publish lock to `stageAndSwap`.\n */\nexport const runRestore = (\n\tinputs: RestoreInputs,\n): Effect.Effect<\n\tSnapshotMetadata,\n\tRestorePhaseError | IdentityGuardError | IdentityContributionConflictError | StageAndSwapError,\n\tFileSystem.FileSystem\n> =>\n\tEffect.gen(function* () {\n\t\tyield* Effect.annotateCurrentSpan({\n\t\t\t'devstack.snapshot.phase': 'restore',\n\t\t\t'devstack.snapshot.artifact': inputs.artifactDir,\n\t\t});\n\n\t\t// 1. Authoritative meta read.\n\t\tconst meta = yield* readMeta(inputs.artifactDir, inputs.snapshotId);\n\t\tyield* verifyIntegrity(inputs.artifactDir);\n\n\t\t// 2. Identity guard — compare the metadata's runtime identity\n\t\t//    and plugin-contributed identity. FAIL-CLOSED before any mutation.\n\t\tyield* runRuntimeIdentityGuard(\n\t\t\t{ app: meta.app, stack: meta.stack, network: meta.network },\n\t\t\tinputs.runtimeIdentity,\n\t\t);\n\t\tconst liveContributions: IdentityContribution[] = [];\n\t\tfor (const participant of inputs.participants) {\n\t\t\tconst slice = yield* participant.liveIdentity;\n\t\t\tliveContributions.push({ plugin: participant.plugin, slice });\n\t\t}\n\t\tconst live = yield* mergeContributions(liveContributions);\n\t\tyield* runIdentityGuard(meta.identity, live);\n\n\t\t// 3. Plugin-level preRestore hooks (run AFTER identity-guard so\n\t\t//    a mismatch refuses without ever calling them).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.preRestore) {\n\t\t\t\tyield* participant.preRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('pre-restore-hook', `preRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tyield* preflightArtifact(meta, inputs.artifactDir);\n\n\t\t// 4. Stage filesystem content and non-destructive Docker image\n\t\t//    refs; atomic swap on success, then promote staged images and\n\t\t//    clear the recovery marker. The inner `Effect.scoped` keeps\n\t\t//    `cleanupRestoreStagingImages` armed across BOTH the\n\t\t//    stage-and-swap build phase AND the post-swap Docker handoff\n\t\t//    (promote → remove containers → clear marker). The handoff\n\t\t//    flag flips only after `clearRestorePendingMarker` returns,\n\t\t//    so a mid-handoff failure (e.g. promotion of image N of M\n\t\t//    refuses) leaves the swapped tree carrying the pending\n\t\t//    marker (re-supervise can detect the broken handoff) AND\n\t\t//    has the inner scope clean the still-tagged staging refs so\n\t\t//    Docker is not littered with orphan `devstack-snapshot:restore-*`\n\t\t//    tags. The post-publish three-step sequence runs under\n\t\t//    `Effect.uninterruptible` so an outer interrupt cannot\n\t\t//    arrive between promote and the marker clear and tear the\n\t\t//    handoff state.\n\t\tyield* Effect.scoped(\n\t\t\tEffect.gen(function* () {\n\t\t\t\tconst stagedImages: StagedContainerImage[] = [];\n\t\t\t\tlet recoveryHandoffComplete = false;\n\t\t\t\tyield* Effect.addFinalizer((exit) =>\n\t\t\t\t\tExit.isFailure(exit) && !recoveryHandoffComplete\n\t\t\t\t\t\t? cleanupRestoreStagingImages(inputs.runtime, stagedImages)\n\t\t\t\t\t\t: Effect.void,\n\t\t\t\t);\n\t\t\t\tyield* stageAndSwap({\n\t\t\t\t\ttargetPath: inputs.runtimeStackRoot,\n\t\t\t\t\tstagingPath: inputs.runtimeStagingPath,\n\t\t\t\t\tbackupPath: inputs.runtimeBackupPath,\n\t\t\t\t\tpreserveFromTarget: LIVE_RESTORE_PRESERVED_PATHS,\n\t\t\t\t\tpublishLockPath: runtimeControlLockPathForStackRoot(inputs.runtimeStackRoot),\n\t\t\t\t\tbuild: Effect.gen(function* () {\n\t\t\t\t\t\t// 4a. Untar host-tree into staging.\n\t\t\t\t\t\tif (meta.hostTreeIncluded) {\n\t\t\t\t\t\t\tyield* restoreHostTree(inputs.artifactDir, inputs.runtimeStagingPath);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4b. Copy state.json into staging.\n\t\t\t\t\t\tconst fs = yield* FileSystem.FileSystem;\n\t\t\t\t\t\tconst srcState = `${inputs.artifactDir}/${SnapshotLayout.stateFile}`;\n\t\t\t\t\t\tconst stateExists = yield* fs\n\t\t\t\t\t\t\t.exists(srcState)\n\t\t\t\t\t\t\t.pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\tif (stateExists) {\n\t\t\t\t\t\t\tconst stateDoc = yield* readSnapshotStateDocument(srcState).pipe(\n\t\t\t\t\t\t\t\tEffect.catchTag(\n\t\t\t\t\t\t\t\t\t'SnapshotStateDocumentError',\n\t\t\t\t\t\t\t\t\tfailStateDocument('read-state', 'expand-state'),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tyield* writeSnapshotStateDocument(\n\t\t\t\t\t\t\t\t`${inputs.runtimeStagingPath}/${SnapshotLayout.stateFile}`,\n\t\t\t\t\t\t\t\tstateDoc,\n\t\t\t\t\t\t\t).pipe(\n\t\t\t\t\t\t\t\tEffect.catchTag(\n\t\t\t\t\t\t\t\t\t'SnapshotStateDocumentError',\n\t\t\t\t\t\t\t\t\tfailStateDocument('expand-state', 'expand-state'),\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4c. Read each contribution doc — the participants'\n\t\t\t\t\t\t//      post-restore hooks may want this; we surface it\n\t\t\t\t\t\t//      via the participant's own state-store reads after\n\t\t\t\t\t\t//      the swap lands.\n\t\t\t\t\t\tfor (const pluginKey of meta.participants) {\n\t\t\t\t\t\t\tconst path = `${inputs.artifactDir}/${contributionPath(pluginKey)}`;\n\t\t\t\t\t\t\tconst exists = yield* fs.exists(path).pipe(Effect.catch(() => Effect.succeed(false)));\n\t\t\t\t\t\t\tif (!exists) {\n\t\t\t\t\t\t\t\treturn yield* Effect.fail(\n\t\t\t\t\t\t\t\t\tnew RestorePhaseError({\n\t\t\t\t\t\t\t\t\t\tphase: 'read-contribution',\n\t\t\t\t\t\t\t\t\t\tplugin: pluginKey,\n\t\t\t\t\t\t\t\t\t\tdetail: `contribution doc absent at ${path}`,\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t// 4d. Load + tag committed images under restore-staging\n\t\t\t\t\t\t//     refs only after all artifact expansion/copy work\n\t\t\t\t\t\t//     has succeeded. The Docker save manifest must match\n\t\t\t\t\t\t//     snapshot metadata exactly before docker load mutates\n\t\t\t\t\t\t//     the daemon; loaded refs then supply the real digest\n\t\t\t\t\t\t//     used for staging tags.\n\t\t\t\t\t\tconst expectedTagsByBundle = expectedSnapshotTagsByBundle(meta.containers);\n\t\t\t\t\t\tconst loadedRefsBySnapshotTag = new Map<string, ImageRef>();\n\t\t\t\t\t\tfor (const [tarPath, expectedTags] of expectedTagsByBundle) {\n\t\t\t\t\t\t\tconst loadedRefs = yield* loadImageBundle(\n\t\t\t\t\t\t\t\ttarPath,\n\t\t\t\t\t\t\t\tinputs.artifactDir,\n\t\t\t\t\t\t\t\tinputs.runtime,\n\t\t\t\t\t\t\t\texpectedTags,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tfor (const [tag, ref] of loadedRefs) {\n\t\t\t\t\t\t\t\tloadedRefsBySnapshotTag.set(tag, ref);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tfor (const captured of meta.containers) {\n\t\t\t\t\t\t\tconst loadedRef = loadedRefsBySnapshotTag.get(captured.snapshotTag);\n\t\t\t\t\t\t\tif (loadedRef === undefined) {\n\t\t\t\t\t\t\t\treturn yield* failRestore(\n\t\t\t\t\t\t\t\t\t'load-image',\n\t\t\t\t\t\t\t\t\t`container image bundle did not return loaded ref for ${captured.snapshotTag}`,\n\t\t\t\t\t\t\t\t\tcaptured.plugin,\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tyield* stageLoadedImage(captured, loadedRef, inputs.runtime, (image) =>\n\t\t\t\t\t\t\t\tEffect.sync(() => {\n\t\t\t\t\t\t\t\t\tstagedImages.push(image);\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tyield* writeRestorePendingMarker({\n\t\t\t\t\t\t\truntimeRoot: inputs.runtimeStagingPath,\n\t\t\t\t\t\t\tmeta,\n\t\t\t\t\t\t\tartifactDir: inputs.artifactDir,\n\t\t\t\t\t\t\tstagedImages,\n\t\t\t\t\t\t});\n\t\t\t\t\t\treturn stagedImages;\n\t\t\t\t\t}),\n\t\t\t\t});\n\n\t\t\t\t// 5. Docker finalization happens after filesystem publish.\n\t\t\t\t//    Promote → remove captured containers → clear marker, all\n\t\t\t\t//    inside the staging-cleanup scope. The pending marker\n\t\t\t\t//    landed in the swapped runtime root as part of the\n\t\t\t\t//    stage-and-swap; `promoteStagedImages` rewrites it after\n\t\t\t\t//    each successful tag so a mid-loop crash leaves the\n\t\t\t\t//    marker reflecting exactly which images still need\n\t\t\t\t//    retagging — `recoverPendingRestore` on the next\n\t\t\t\t//    supervise picks up the breadcrumb. Uninterruptible so\n\t\t\t\t//    an outer interrupt cannot tear the handoff between\n\t\t\t\t//    promote and `clearRestorePendingMarker`.\n\t\t\t\tif (stagedImages.length > 0) {\n\t\t\t\t\tconst pendingDocAfterSwap = yield* readRestorePendingMarker(inputs.runtimeStackRoot);\n\t\t\t\t\tyield* Effect.uninterruptible(\n\t\t\t\t\t\tEffect.gen(function* () {\n\t\t\t\t\t\t\tyield* promoteStagedImages(\n\t\t\t\t\t\t\t\tstagedImages,\n\t\t\t\t\t\t\t\tinputs.runtime,\n\t\t\t\t\t\t\t\tinputs.runtimeStackRoot,\n\t\t\t\t\t\t\t\tpendingDocAfterSwap,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tyield* removeCapturedContainers(meta, inputs.runtime, inputs.runtimeIdentity);\n\t\t\t\t\t\t\tyield* clearRestorePendingMarker(inputs.runtimeStackRoot);\n\t\t\t\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\trecoveryHandoffComplete = true;\n\t\t\t\t}\n\t\t\t}),\n\t\t);\n\n\t\t// 6. Post-restore hooks (after the swap lands so plugins read\n\t\t//    fresh state from the runtime root).\n\t\tfor (const participant of inputs.participants) {\n\t\t\tif (participant.postRestore) {\n\t\t\t\tyield* participant.postRestore.pipe(\n\t\t\t\t\tEffect.catch(failPhase('post-restore-hook', `postRestore failed`, participant.plugin)),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\treturn meta;\n\t}).pipe(Effect.withSpan('orchestrator.snapshot.restore'));\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoGA,IAAa,oBAAb,cAAuC,OAAO,kBAAqC,CAClF,6BACA;CACC,OAAO,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC;CACF,QAAQ,OAAO,SAAS,OAAO,OAAO;CACtC,QAAQ,OAAO;CACf,OAAO,OAAO,SAAS,OAAO,OAAO;CACrC,CACD,CAAC;AAEF,MAAM,YAAY,gBAAgB,kBAAkB;AAEpD,MAAM,eACL,OACA,QACA,WAEA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ;CAAQ,CAAC,CAAC;AAE9D,MAAM,0BACJ,OAAmC,YACnC,UACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO;CAAQ,QAAQ,MAAM;CAAQ;CAAO,CAAC,CAAC;;;;AAKpF,MAAM,qBAEJ,WACA,YACA,YAEA,QACA,OAAO,KACN,IAAI,kBAAkB;CACrB,OAAO,IAAI,SAAS,UAAU,aAAa;CAC3C;CACA,QAAQ,IAAI;CACZ,OAAO,IAAI;CACX,CAAC,CACF;AAyBH,MAAM,YACL,aACA,eAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,GAAG,YAAY,GAAG,eAAe;AAE9C,KAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEpF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,mCAAmC;EAC3C,CAAC,CACF;CAcF,MAAM,OAAO,OAAO,cAAc,wBAAwB,OATvC,cAAc,OAHb,GAClB,eAAe,KAAK,CACpB,KAAK,OAAO,MAAM,UAAU,aAAa,4BAA4B,OAAO,CAAC,CAAC,EACzC;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,kCAAkC;GAC1C,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EAC6D;EAC9D,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,qCAAqC;GAC7C,OAAO,MAAM;GACb,CAAC;EACH,CAAC;CACF,MAAM,WAAW,gBAAgB,KAAK,GAAG;AACzC,KAAI,aAAa,KAChB,QAAO,OAAO,YACb,gBACA,6CAA6C,KAAK,KAClD;AAEF,KAAI,aAAa,WAChB,QAAO,OAAO,YACb,gBACA,gBAAgB,KAAK,GAAG,wCAAwC,aAChE;AAEF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAEpE,MAAM,mBACL,gBAEA,wBAAwB,YAAY,CAAC,KACpC,OAAO,SAAS,2BAA2B,QAC1C,OAAO,KACN,IAAI,kBAAkB;CACrB,OAAO,IAAI,SAAS,YAAY,mBAAmB;CACnD,QAAQ,IAAI;CACZ,OAAO,IAAI;CACX,CAAC,CACF,CACD,CACD;;;;;AAUF,MAAM,4BACL,MACA,SACA,oBAEA,OAAO,IAAI,aAAa;AACvB,MAAK,MAAM,YAAY,KAAK,WAC3B,QAAO,QACL,wBAAwB;EACxB,KAAK,gBAAgB;EACrB,OAAO,gBAAgB;EACvB,QAAQ,SAAS;EACjB,MAAM,SAAS;EACf,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,iCAAiC,SAAS,OAAO,GAAG,SAAS,KAAK,UAClE,SAAS,OACT,CACD,CACD;EAEF,CAAC,KAAK,OAAO,SAAS,kDAAkD,CAAC;AA8B5E,MAAM,6BAA6B,WAA0D;CAC5F,QAAQ,MAAM,SAAS;CACvB,MAAM,MAAM,SAAS;CACrB,iBAAiB,MAAM,SAAS;CAChC,gBAAgB,MAAM;CAOtB,QAAQ,MAAM,UAAU;CACxB;AAED,MAAM,oBAAoB,WAAoE;CAC7F,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,OAAO,OAAO,KACxB,KAAI,IAAI,QAAQ,KAAA,EAAW,MAAK,IAAI,IAAI,IAAI;AAE7C,QAAO;;AAGR,MAAM,8BAAsC,6BAA6B,iBAAiB,GAAG;AAE7F,MAAM,oBACJ,WACA,QACA,OAAO,KAAK,IAAI,kBAAkB;CAAE;CAAO,QAAQ,IAAI;CAAQ,OAAO,IAAI;CAAO,CAAC,CAAC;AAErF,MAAM,6BAA6B,SAKkC;AACpE,KAAI,KAAK,aAAa,WAAW,EAAG,QAAO,OAAO;CAClD,MAAM,MAAM,0BAA0B;EACrC,MAAM,KAAK;EACX,aAAa,KAAK;EAClB,YAAY,KAAK,aAAa,IAAI,0BAA0B;EAC5D,CAAC;AACF,QAAOA,mBAAqB,KAAK,aAAa,IAAI,CAAC,KAClD,OAAO,SACN,uCACA,iBAAiB,wBAAwB,CACzC,CACD;;AAGF,MAAM,+BACL,aACA,KACA,iBAEAA,mBAAqB,aAAa,+BAA+B,KAAK,aAAa,CAAC,CAAC,KACpF,OAAO,SACN,uCACA,iBAAiB,wBAAwB,CACzC,CACD;AAEF,MAAM,6BACL,gBAEAC,oBAAsB,YAAY,CAAC,KAClC,OAAO,SACN,uCACA,iBAAiB,wBAAwB,CACzC,CACD;AAEF,MAAM,4BACL,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,kBAAkB,YAAY;AAE3C,KAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EACxE,QAAO;AAapB,QAAO,OAAO,cAAc,8BAA8B,OATvC,cAAc,OAHb,GAClB,eAAe,KAAK,CACpB,KAAK,OAAO,MAAM,UAAU,wBAAwB,QAAQ,4BAA4B,CAAC,CAAC,EACrD;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,GAAG,0BAA0B;GACrC,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EAC6D;EAC9D,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ,GAAG,0BAA0B;GACrC,OAAO,MAAM;GACb,CAAC;EACH,CAAC;EACD;AAMH,MAAM,sBACL,MACA,OACA,WAEA,0BAA0B,MAAM,GAC7B,OAAO,OACP,YAAY,aAAa,mBAAmB,KAAK,iBAAiB,SAAS,OAAO;AAEtF,MAAM,+BACL,MACA,OACA,QACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;AAI7B,MAAI,OAHgB,GAClB,KAAK,KAAK,CACV,KAAK,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,OAAO,CAAC,CAAC,EAC1E,SAAS,GACjB,QAAO,OAAO,YAAY,OAAO,GAAG,OAAO,kBAAkB,QAAQ,OAAO;AAE7E,QAAO,OAAO,SAAS,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAC5D,OAAO,MAAM,UAAU,OAAO,GAAG,OAAO,mBAAmB,QAAQ,OAAO,CAAC,CAC3E;EACA;AAEH,MAAM,8BACL,UACA,gBAEA,OAAO,IAAI,aAAa;AACvB,QAAO,mBAAmB,UAAU,SAAS,QAAQ,SAAS,OAAO;AACrE,QAAO,mBAAmB,QAAQ,SAAS,MAAM,SAAS,OAAO;AACjE,KAAI,CAAC,2BAA2B,SAAS,QAAQ,CAChD,QAAO,OAAO,YACb,aACA,oCAAoC,SAAS,WAC7C,SAAS,OACT;CAEF,MAAM,kBAAkB,2BAA2B;AACnD,KAAI,SAAS,YAAY,gBACxB,QAAO,OAAO,YACb,aACA,4BAA4B,SAAS,QAAQ,mCAAmC,mBAChF,SAAS,OACT;AAEF,KAAI,CAAC,+BAA+B,SAAS,UAAU,CACtD,QAAO,OAAO,YACb,aACA,mEAAmE,SAAS,aAC5E,SAAS,OACT;AAEF,KAAI,CAAC,+BAA+B,SAAS,YAAY,CACxD,QAAO,OAAO,YACb,aACA,gEAAgE,SAAS,eACzE,SAAS,OACT;AAEF,QAAO,4BACN,GAAG,YAAY,GAAG,SAAS,WAC3B,cACA,mCACA,SAAS,OACT;EACA;AAEH,MAAM,4BACL,WACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,OAAO,GAAG,YAAY,GAAG,iBAAiB,UAAU;CAmB1D,MAAM,UAAU,OAAO,cAAc,uBAAuB,OAVzC,cAAc,QAPb,OADF,WAAW,YAE3B,eAAe,KAAK,CACpB,KACA,OAAO,MACN,UAAU,qBAAqB,mCAAmC,QAAQ,UAAU,CACpF,CACD,EACqC;EACtC,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,yCAAyC;GACjD,OAAO,MAAM;GACb,CAAC;EACH,CAAC,EAC+D;EAChE,QAAQ;EACR,UAAU,UACT,IAAI,kBAAkB;GACrB,OAAO;GACP,QAAQ;GACR,QAAQ,4CAA4C;GACpD,OAAO,MAAM;GACb,CAAC;EACH,CAAC;AACF,KAAI,QAAQ,WAAW,UACtB,QAAO,OAAO,YACb,qBACA,2BAA2B,QAAQ,OAAO,kBAAkB,aAC5D,UACA;EAED;AAEH,MAAM,qBACL,MACA,gBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,mCAAmB,IAAI,KAAgC;AAC7D,MAAK,MAAM,YAAY,KAAK,YAAY;AACvC,SAAO,2BAA2B,UAAU,YAAY;EACxD,MAAM,WAAW,iBAAiB,IAAI,SAAS,YAAY;AAC3D,MAAI,aAAa,KAAA,EAChB,QAAO,OAAO,YACb,aACA,mCAAmC,SAAS,YAAY,OAAO,SAAS,OAAO,GAAG,SAAS,KAAK,OAAO,SAAS,OAAO,GAAG,SAAS,QACnI,SAAS,OACT;AAEF,mBAAiB,IAAI,SAAS,aAAa,SAAS;;AAErD,MAAK,MAAM,aAAa,KAAK,aAC5B,QAAO,yBAAyB,WAAW,YAAY;CAExD,MAAM,YAAY,GAAG,YAAY,GAAG,eAAe;AAEnD,KAAI,OADuB,GAAG,OAAO,UAAU,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,CAE9F,QAAO,0BAA0B,UAAU,CAAC,KAC3C,OAAO,SACN,8BACA,kBAAkB,cAAc,eAAe,CAC/C,CACD;AAEF,KAAI,KAAK,kBAAkB;EAC1B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;AACjD,SAAO,4BAA4B,SAAS,mBAAmB,4BAA4B;AAY3F,SAAO,2BAXW,GAAG,OAAO,QAAQ,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;GACpB,OAAO;GACP,WAAW;GACX,QAAQ,gCAAgC;GACxC;GACA,CAAC,CACH,CAEyC,CAAC,CAAC,KAC5C,OAAO,MAAM,UAAU,mBAAmB,wCAAwC,CAAC,CACnF;;EAED,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAMpE,MAAM,mBACL,SACA,aACA,SACA,yBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,cAAc,GAAG,YAAY,GAAG;AAEtC,KAAI,EAAC,OADiB,GAAG,OAAO,YAAY,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAE3F,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,oCAAoC;EAC5C,CAAC,CACF;AAKF,QAAO,sBAAsB,SAAS,OAHZ,oBAAoB,aAAa,QAAQ,CAAC,KACnE,OAAO,MAAM,uBAAuB,aAAa,CAAC,CAClD,EACiD,qBAAqB,CAAC,KACvE,OAAO,MAAM,uBAAuB,aAAa,CAAC,CAClD;CACD,MAAM,SAAS,OAAO,QACpB,UAAU,GAAG,OAAO,YAAY,CAAC,CACjC,KACA,OAAO,MACN,UAAU,cAAc,oCAAoC,YAAY,SAAS,CACjF,CACD;CACF,MAAM,aAAa,iBAAiB,OAAO;CAC3C,MAAM,UAAU,qBAAqB,QAAQ,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;AAC1E,KAAI,QAAQ,SAAS,EACpB,QAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,wCAAwC,QAAQ,KAAK,KAAK,GAC5F;CAEF,MAAM,4BAAY,IAAI,KAAuB;AAC7C,MAAK,MAAM,OAAO,OAAO,MAAM;AAC9B,MAAI,IAAI,QAAQ,KAAA,KAAa,CAAC,qBAAqB,SAAS,IAAI,IAAI,CAAE;AACtE,MAAI,UAAU,IAAI,IAAI,IAAI,CACzB,QAAO,OAAO,YACb,cACA,0BAA0B,QAAQ,iCAAiC,IAAI,MACvE;AAEF,YAAU,IAAI,IAAI,KAAK,IAAI;;AAE5B,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,kDAAkD,CAAC;AAE5E,MAAM,gCACL,eACgD;CAChD,MAAM,2BAAW,IAAI,KAAuB;AAC5C,MAAK,MAAM,YAAY,YAAY;EAClC,MAAM,OAAO,SAAS,IAAI,SAAS,QAAQ;AAC3C,MAAI,SAAS,KAAA,EACZ,UAAS,IAAI,SAAS,SAAS,CAAC,SAAS,YAAY,CAAC;MAEtD,MAAK,KAAK,SAAS,YAAY;;AAGjC,QAAO;;AAGR,MAAM,oBACL,UACA,WACA,SACA,wBAEA,OAAO,IAAI,aAAa;CACvB,MAAM,iBAAiB,uBAAuB;CAC9C,MAAM,cAAoC;EACzC;EACA,WAAW;GAAE,QAAQ,UAAU;GAAQ,KAAK;GAAgB;EAC5D;EACA;AACD,QAAO,oBAAoB,YAAY;AACvC,QAAO,QACL,SAAS,WAAW,gBAAgB,EAAE,sBAAsB,MAAM,CAAC,CACnE,KACA,OAAO,MACN,UACC,eACA,sBAAsB,SAAS,YAAY,kBAAkB,eAAe,UAC5E,SAAS,OACT,CACD,CACD;AACF,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,4CAA4C,CAAC;AAEtE,MAAM,+BACL,SACA,WAEA,OAAO,QACN,SACC,UACA,QACE,YAAY,MAAM,UAAU,CAC5B,KACA,OAAO,OAAO,UACb,OAAO,WACN,gCAAgC,MAAM,eAAe,kCAAkC,OACtF,MACA,GACD,CACD,CACD,EACH,EAAE,aAAa,aAAa,CAC5B,CAAC,KAAK,OAAO,OAAO;;;;;;;;AAStB,MAAM,uBACL,QACA,SACA,kBACA,eAEA,OAAO,IAAI,aAAa;AACvB,MAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;EAC1C,MAAM,QAAQ,OAAO;AACrB,SAAO,QACL,SAAS,MAAM,WAAW,MAAM,SAAS,WAAW,EACpD,sBAAsB,MACtB,CAAC,CACD,KACA,OAAO,MACN,UACC,eACA,oBAAoB,MAAM,eAAe,MAAM,MAAM,SAAS,UAAU,UACxE,MAAM,SAAS,OACf,CACD,CACD;AAMF,MAAI,eAAe,KAElB,QAAO,4BAA4B,kBAAkB,YADhC,OAAO,MAAM,IAAI,EAAE,CAAC,IAAI,0BACgC,CAAC;;EAG/E,CAAC,KAAK,OAAO,SAAS,+CAA+C,CAAC;AAEzE,MAAM,mBACL,aACA,WAEA,OAAO,IAAI,aAAa;CACvB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,UAAU,GAAG,YAAY,GAAG,eAAe;AAEjD,KAAI,EAAC,OADiB,GAAG,OAAO,QAAQ,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEvF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;EACrB,OAAO;EACP,QAAQ,2BAA2B;EACnC,CAAC,CACF;CAEF,MAAM,YAAY,GAAG,OAAO,QAAQ,CAAC,KACpC,OAAO,UACL,UACA,IAAI,iBAAiB;EACpB,OAAO;EACP,WAAW;EACX,QAAQ,gCAAgC;EACxC;EACA,CAAC,CACH,CACD;AACD,QAAO,OAAO,OAAO,cAAc,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,KAC1D,OAAO,MAAM,UAAU,mBAAmB,SAAS,QAAQ,MAAM,OAAO,SAAS,CAAC,CAClF;EACA,CAAC,KAAK,OAAO,SAAS,0CAA0C,CAAC;AAEpE,MAAM,+BAAyE;CAC9E;EAAE,cAAc;EAAoB,MAAM;EAAa;CACvD;EAAE,cAAc;EAAoC,MAAM;EAAQ;CAClE;EAAE,cAAc;EAAkC,MAAM;EAAQ;CAChE;EAAE,cAAc;EAAe,MAAM;EAAQ;CAC7C;EAAE,cAAc;EAAyB,MAAM;EAAQ;CACvD;EAAE,cAAc;EAAwB,MAAM;EAAQ;CAWtD,GAAG,wBAAwB,KACzB,eAA0C;EAC1C,cAAc,GAAG,eAAe,GAAG;EACnC,MAAM;EAKN,WAAW;EACX,EACD;CACD;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CD,MAAa,cACZ,WAMA,OAAO,IAAI,aAAa;AACvB,QAAO,OAAO,oBAAoB;EACjC,2BAA2B;EAC3B,8BAA8B,OAAO;EACrC,CAAC;CAGF,MAAM,OAAO,OAAO,SAAS,OAAO,aAAa,OAAO,WAAW;AACnE,QAAO,gBAAgB,OAAO,YAAY;AAI1C,QAAO,wBACN;EAAE,KAAK,KAAK;EAAK,OAAO,KAAK;EAAO,SAAS,KAAK;EAAS,EAC3D,OAAO,gBACP;CACD,MAAM,oBAA4C,EAAE;AACpD,MAAK,MAAM,eAAe,OAAO,cAAc;EAC9C,MAAM,QAAQ,OAAO,YAAY;AACjC,oBAAkB,KAAK;GAAE,QAAQ,YAAY;GAAQ;GAAO,CAAC;;CAE9D,MAAM,OAAO,OAAO,mBAAmB,kBAAkB;AACzD,QAAO,iBAAiB,KAAK,UAAU,KAAK;AAI5C,MAAK,MAAM,eAAe,OAAO,aAChC,KAAI,YAAY,WACf,QAAO,YAAY,WAAW,KAC7B,OAAO,MAAM,UAAU,oBAAoB,qBAAqB,YAAY,OAAO,CAAC,CACpF;AAIH,QAAO,kBAAkB,MAAM,OAAO,YAAY;AAkBlD,QAAO,OAAO,OACb,OAAO,IAAI,aAAa;EACvB,MAAM,eAAuC,EAAE;EAC/C,IAAI,0BAA0B;AAC9B,SAAO,OAAO,cAAc,SAC3B,KAAK,UAAU,KAAK,IAAI,CAAC,0BACtB,4BAA4B,OAAO,SAAS,aAAa,GACzD,OAAO,KACV;AACD,SAAO,aAAa;GACnB,YAAY,OAAO;GACnB,aAAa,OAAO;GACpB,YAAY,OAAO;GACnB,oBAAoB;GACpB,iBAAiB,mCAAmC,OAAO,iBAAiB;GAC5E,OAAO,OAAO,IAAI,aAAa;AAE9B,QAAI,KAAK,iBACR,QAAO,gBAAgB,OAAO,aAAa,OAAO,mBAAmB;IAGtE,MAAM,KAAK,OAAO,WAAW;IAC7B,MAAM,WAAW,GAAG,OAAO,YAAY,GAAG,eAAe;AAIzD,QAAI,OAHuB,GACzB,OAAO,SAAS,CAChB,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAChC;KAChB,MAAM,WAAW,OAAO,0BAA0B,SAAS,CAAC,KAC3D,OAAO,SACN,8BACA,kBAAkB,cAAc,eAAe,CAC/C,CACD;AACD,YAAO,2BACN,GAAG,OAAO,mBAAmB,GAAG,eAAe,aAC/C,SACA,CAAC,KACD,OAAO,SACN,8BACA,kBAAkB,gBAAgB,eAAe,CACjD,CACD;;AAMF,SAAK,MAAM,aAAa,KAAK,cAAc;KAC1C,MAAM,OAAO,GAAG,OAAO,YAAY,GAAG,iBAAiB,UAAU;AAEjE,SAAI,EAAC,OADiB,GAAG,OAAO,KAAK,CAAC,KAAK,OAAO,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,EAEpF,QAAO,OAAO,OAAO,KACpB,IAAI,kBAAkB;MACrB,OAAO;MACP,QAAQ;MACR,QAAQ,8BAA8B;MACtC,CAAC,CACF;;IASH,MAAM,uBAAuB,6BAA6B,KAAK,WAAW;IAC1E,MAAM,0CAA0B,IAAI,KAAuB;AAC3D,SAAK,MAAM,CAAC,SAAS,iBAAiB,sBAAsB;KAC3D,MAAM,aAAa,OAAO,gBACzB,SACA,OAAO,aACP,OAAO,SACP,aACA;AACD,UAAK,MAAM,CAAC,KAAK,QAAQ,WACxB,yBAAwB,IAAI,KAAK,IAAI;;AAGvC,SAAK,MAAM,YAAY,KAAK,YAAY;KACvC,MAAM,YAAY,wBAAwB,IAAI,SAAS,YAAY;AACnE,SAAI,cAAc,KAAA,EACjB,QAAO,OAAO,YACb,cACA,wDAAwD,SAAS,eACjE,SAAS,OACT;AAEF,YAAO,iBAAiB,UAAU,WAAW,OAAO,UAAU,UAC7D,OAAO,WAAW;AACjB,mBAAa,KAAK,MAAM;OACvB,CACF;;AAEF,WAAO,0BAA0B;KAChC,aAAa,OAAO;KACpB;KACA,aAAa,OAAO;KACpB;KACA,CAAC;AACF,WAAO;KACN;GACF,CAAC;AAaF,MAAI,aAAa,SAAS,GAAG;GAC5B,MAAM,sBAAsB,OAAO,yBAAyB,OAAO,iBAAiB;AACpF,UAAO,OAAO,gBACb,OAAO,IAAI,aAAa;AACvB,WAAO,oBACN,cACA,OAAO,SACP,OAAO,kBACP,oBACA;AACD,WAAO,yBAAyB,MAAM,OAAO,SAAS,OAAO,gBAAgB;AAC7E,WAAO,0BAA0B,OAAO,iBAAiB;AACzD,8BAA0B;KACzB,CACF;QAED,2BAA0B;GAE1B,CACF;AAID,MAAK,MAAM,eAAe,OAAO,aAChC,KAAI,YAAY,YACf,QAAO,YAAY,YAAY,KAC9B,OAAO,MAAM,UAAU,qBAAqB,sBAAsB,YAAY,OAAO,CAAC,CACtF;AAIH,QAAO;EACN,CAAC,KAAK,OAAO,SAAS,gCAAgC,CAAC"}