@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/wakeAcceptanceReconciliation.js

@@ -0,0 +1,289 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { link, lstat, open, readFile, realpath, rename, stat, unlink } from "node:fs/promises";
+import path from "node:path";
+import { clearDeadHostRegistrations, hostRegistrationDigest, listHostRegistrations } from "./storeCoordination.js";
+export const OFFLINE_RECONCILIATION_VERSION = "noopolis.daimon.offline-transition-reconciliation.v1";
+export const OFFLINE_RECONCILIATION_BLOCKED_CODE = "offline_reconciliation_required";
+const MAX_BYTES = 16_384;
+const RECEIPT_VERSION = "noopolis.daimon.offline-transition-reconciliation-receipt.v1";
+export const OFFLINE_RECONCILIATION_REQUEST_SCHEMA = {
+    $schema: "https://json-schema.org/draft/2020-12/schema", $id: OFFLINE_RECONCILIATION_VERSION, type: "object", additionalProperties: false,
+    required: ["version", "agent_id", "delivery_id", "store", "lock", "attestation"], properties: {
+        version: { const: OFFLINE_RECONCILIATION_VERSION }, agent_id: { type: "string", minLength: 1, maxLength: MAX_BYTES }, delivery_id: { type: "string", minLength: 1, maxLength: MAX_BYTES },
+        store: { type: "object", additionalProperties: false, required: ["dev", "ino"], properties: { dev: { type: "integer", minimum: 1 }, ino: { type: "integer", minimum: 1 } } },
+        lock: { type: "object", additionalProperties: false, required: ["dev", "ino", "owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"], properties: { dev: { type: "integer", minimum: 1 }, ino: { type: "integer", minimum: 1 }, owner_id: { type: "string" }, generation: { type: "string" }, pid: { type: "integer", minimum: 1 }, process_start: { type: "string" }, boot_id: { type: "string" }, pid_namespace_dev: { type: "integer", minimum: 1 }, pid_namespace_ino: { type: "integer", minimum: 1 } } },
+        attestation: { type: "object", additionalProperties: false, required: ["version", "authority_id", "attestation_id", "state", "proof"], properties: { version: { const: "noopolis.deployment.container-quiescence.v1" }, authority_id: { type: "string", minLength: 1, maxLength: MAX_BYTES }, attestation_id: { type: "string", minLength: 1, maxLength: MAX_BYTES }, state: { enum: ["absent", "quiescent"] }, proof: { type: "string", minLength: 1, maxLength: MAX_BYTES } } }
+    }
+};
+/** Deployment-only: caller must exclusively mount the private store offline. */
+export async function reconcileOfflineWakeTransition(value, options) {
+    try {
+        const request = parseOfflineTransitionReconciliationRequest(value);
+        const root = await openStore(options.storePath, request.store);
+        try {
+            const lease = await acquireLease(root.path, root.directory, await (options.leaseIdentity ?? currentLeaseIdentity)(), options.leaseLiveness ?? leaseIsAlive);
+            if (lease === undefined)
+                return blocked();
+            try {
+                const target = lockPath(root.path, request.agent_id, request.delivery_id);
+                const receiptPath = receiptFile(root.path, request);
+                let receipt = await readReceiptOptional(receiptPath);
+                if (receipt !== undefined && receipt.request_digest !== digest(request))
+                    return blocked();
+                if (receipt?.state === "reconciled")
+                    return publicReceipt(receipt);
+                const context = authorizationContext(request, await listHostRegistrations(root.path));
+                const proof = await options.verifyDeploymentAttestation(context, request.attestation).catch(() => { throw new OfflineTransitionReconciliationBlockedError(); });
+                if (!sameProofReceipt(proof, context))
+                    throw new OfflineTransitionReconciliationBlockedError();
+                const cleared = await clearDeadHostRegistrations(root.path, root.directory, lease, options.hostLiveness ?? leaseIsAlive, new Set(proof.authorized_registration_digests)).catch(() => undefined);
+                if (cleared === undefined)
+                    return blocked();
+                await assertStore(root, request.store);
+                await assertRecord(recordPath(root.path, request.agent_id, request.delivery_id), request);
+                if (receipt === undefined)
+                    receipt = await writeReceipt(receiptPath, { version: RECEIPT_VERSION, reconciliation_id: randomUUID(), request_digest: digest(request), state: "prepared", reconciled_at: "", cleared_registration_digests: [] }, root.directory);
+                const lock = await readLockOptional(target);
+                if (lock !== undefined) {
+                    if (!same(lock, request.lock) || !same(await lstat(target), request.lock))
+                        throw new OfflineTransitionReconciliationBlockedError();
+                    await assertStore(root, request.store);
+                    await assertRecord(recordPath(root.path, request.agent_id, request.delivery_id), request);
+                    await unlink(target);
+                    await root.directory.sync();
+                }
+                const reconciled = { ...receipt, state: "reconciled", reconciled_at: new Date().toISOString(), cleared_registration_digests: uniqueDigests([...receipt.cleared_registration_digests, ...cleared]) };
+                await replaceReceipt(receiptPath, reconciled, root.directory);
+                return publicReceipt(reconciled);
+            }
+            finally {
+                await releaseLease(lease, root.directory, root.path);
+            }
+        }
+        finally {
+            await root.directory.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof OfflineTransitionReconciliationBlockedError)
+            return blocked();
+        throw error;
+    }
+}
+export function parseOfflineTransitionReconciliationRequest(value) {
+    const root = strictRecord(value, ["version", "agent_id", "delivery_id", "store", "lock", "attestation"]);
+    if (text(root.version) !== OFFLINE_RECONCILIATION_VERSION)
+        throw new TypeError("offline reconciliation version is unsupported");
+    const store = strictRecord(root.store, ["dev", "ino"]);
+    const lock = strictRecord(root.lock, ["dev", "ino", "owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"]);
+    const attestation = strictRecord(root.attestation, ["version", "authority_id", "attestation_id", "state", "proof"]);
+    const state = text(attestation.state);
+    if (text(attestation.version) !== "noopolis.deployment.container-quiescence.v1" || (state !== "absent" && state !== "quiescent"))
+        throw new TypeError("offline reconciliation attestation is invalid");
+    const parsedLock = { dev: positive(lock.dev), ino: positive(lock.ino), owner_id: uuid(lock.owner_id), generation: uuid(lock.generation), pid: positive(lock.pid), process_start: nonBlank(lock.process_start), boot_id: nonBlank(lock.boot_id), pid_namespace_dev: positive(lock.pid_namespace_dev), pid_namespace_ino: positive(lock.pid_namespace_ino) };
+    return { version: OFFLINE_RECONCILIATION_VERSION, agent_id: nonBlank(root.agent_id), delivery_id: nonBlank(root.delivery_id), store: { dev: positive(store.dev), ino: positive(store.ino) }, lock: parsedLock, attestation: { version: "noopolis.deployment.container-quiescence.v1", authority_id: nonBlank(attestation.authority_id), attestation_id: nonBlank(attestation.attestation_id), state, proof: nonBlank(attestation.proof) } };
+}
+export class OfflineTransitionReconciliationBlockedError extends Error {
+    code = OFFLINE_RECONCILIATION_BLOCKED_CODE;
+    constructor() { super("offline transition reconciliation is blocked"); }
+}
+/** Normal hosts may start only after the durable offline lease is absent. */
+export async function assertOfflineReconciliationLeaseAvailable(root) { if (await readLeaseOptional(path.join(root, ".offline-reconciliation.lock")) !== undefined)
+    throw new OfflineTransitionReconciliationBlockedError(); }
+async function openStore(root, expected) {
+    if (!path.isAbsolute(root))
+        throw new OfflineTransitionReconciliationBlockedError();
+    await assertNoLinks(root);
+    const before = await lstat(root);
+    if (!before.isDirectory() || before.isSymbolicLink() || before.uid !== process.getuid?.() || (before.mode & 0o777) !== 0o700 || !same(before, expected))
+        throw new OfflineTransitionReconciliationBlockedError();
+    const directory = await open(root, constants.O_RDONLY | directoryFlag() | noFollow());
+    try {
+        const canonical = await realpath(root);
+        if (!same(await directory.stat(), expected))
+            throw new OfflineTransitionReconciliationBlockedError();
+        return { path: canonical, directory };
+    }
+    catch (error) {
+        await directory.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function assertStore(root, expected) { await assertNoLinks(root.path); if (!same(await lstat(root.path), expected) || !same(await root.directory.stat(), expected) || await realpath(root.path) !== root.path)
+    throw new OfflineTransitionReconciliationBlockedError(); }
+/**
+ * Publishes `value` at `target` only if `target` does not already exist, and
+ * only ever under complete, fsynced content — the name never appears holding a
+ * partial or zero-byte document, which `readLease` would otherwise accept as a
+ * safe file and then fail to `JSON.parse`.
+ *
+ * `link(2)` is mandatory here and `rename(2)` is FORBIDDEN. rename overwrites
+ * its destination unconditionally, so two acquirers that both pass the
+ * (non-atomic) `readLeaseOptional` pre-check would both publish and both
+ * believe they hold the exclusive offline-reconciliation lease. link fails with
+ * EEXIST when the target exists, which is the mutual exclusion `acquireLease`
+ * converts into a blocked result. Exported solely so that contract can be
+ * asserted directly; it is not re-exported from `./index.ts`.
+ */
+export async function publishExclusive(target, value, directory) { const temp = `${target}.${randomUUID()}`; try {
+    await writeNew(temp, value);
+    await link(temp, target);
+    await directory.sync();
+}
+finally {
+    await unlink(temp).catch(() => undefined);
+} }
+async function acquireLease(root, directory, owner, liveness) { const target = path.join(root, ".offline-reconciliation.lock"); const current = await readLeaseOptional(target); if (current !== undefined) {
+    if (!sameNamespace(current, owner) || await liveness(current))
+        return undefined;
+    await unlink(target);
+    await directory.sync();
+} try {
+    await publishExclusive(target, owner, directory);
+    return owner;
+}
+catch (error) {
+    if (error.code === "EEXIST")
+        return undefined;
+    throw error;
+} }
+async function releaseLease(lease, directory, root) { const target = path.join(root, ".offline-reconciliation.lock"); const current = await readLease(target); if (!sameLease(current, lease))
+    throw new OfflineTransitionReconciliationBlockedError(); await unlink(target); await directory.sync(); }
+function lockPath(root, agent, delivery) { return path.join(root, `${createHash("sha256").update(`${agent}\u0000${delivery}`).digest("hex")}.transition-lock`); }
+function recordPath(root, agent, delivery) { return path.join(root, `${createHash("sha256").update(`${agent}\u0000${delivery}`).digest("hex")}.json`); }
+function receiptFile(root, request) { return path.join(root, `.reconcile-${createHash("sha256").update(JSON.stringify({ store: request.store, lock: request.lock })).digest("hex")}.json`); }
+function digest(request) { return createHash("sha256").update(JSON.stringify(request)).digest("hex"); }
+function authorizationContext(request, stale_host_registrations) { return { version: "noopolis.daimon.offline-transition-authorization-context.v1", deployment_identity: request.attestation.authority_id, deployment_state: request.attestation.state, nonce: request.attestation.attestation_id, request_digest: digest({ request, stale_host_registrations }), agent_id: request.agent_id, delivery_id: request.delivery_id, store: request.store, lock: request.lock, stale_host_registrations }; }
+function sameProofReceipt(value, context) { try {
+    const proof = strictRecord(value, ["request_digest", "nonce", "exclusive_store", "authorized_registration_digests"]);
+    return text(proof.request_digest) === context.request_digest && text(proof.nonce) === context.nonce && proof.exclusive_store === true && Array.isArray(proof.authorized_registration_digests) && proof.authorized_registration_digests.every((item) => /^[a-f0-9]{64}$/u.test(text(item))) && proof.authorized_registration_digests.every((item) => context.stale_host_registrations.some((host) => hostRegistrationDigest(host) === item));
+}
+catch {
+    return false;
+} }
+async function readLock(file) { const entry = await lstat(file); if (!safeFile(entry))
+    throw new OfflineTransitionReconciliationBlockedError(); const value = strictRecord(JSON.parse((await readFile(file)).toString("utf8")), ["owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"]); return { dev: Number(entry.dev), ino: Number(entry.ino), owner_id: uuid(value.owner_id), generation: uuid(value.generation), pid: positive(value.pid), process_start: nonBlank(value.process_start), boot_id: nonBlank(value.boot_id), pid_namespace_dev: positive(value.pid_namespace_dev), pid_namespace_ino: positive(value.pid_namespace_ino) }; }
+async function readLease(file) { const entry = await lstat(file); if (!safeFile(entry))
+    throw new OfflineTransitionReconciliationBlockedError(); const value = strictRecord(JSON.parse((await readFile(file)).toString("utf8")), ["owner_id", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"]); return { owner_id: uuid(value.owner_id), pid: positive(value.pid), process_start: nonBlank(value.process_start), boot_id: nonBlank(value.boot_id), pid_namespace_dev: positive(value.pid_namespace_dev), pid_namespace_ino: positive(value.pid_namespace_ino) }; }
+async function readLeaseOptional(file) { try {
+    return await readLease(file);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} }
+async function readLockOptional(file) { try {
+    return await readLock(file);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} }
+async function assertRecord(file, request) { const entry = await lstat(file).catch(() => { throw new OfflineTransitionReconciliationBlockedError(); }); if (!safeFile(entry))
+    throw new OfflineTransitionReconciliationBlockedError(); const value = JSON.parse((await readFile(file)).toString("utf8")); if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new OfflineTransitionReconciliationBlockedError(); const record = value; if (record.agent_id !== request.agent_id || record.delivery_id !== request.delivery_id)
+    throw new OfflineTransitionReconciliationBlockedError(); }
+async function readReceiptOptional(file) { try {
+    const entry = await lstat(file);
+    if (!safeFile(entry))
+        throw new OfflineTransitionReconciliationBlockedError();
+    const value = strictRecord(JSON.parse((await readFile(file)).toString("utf8")), ["version", "reconciliation_id", "request_digest", "state", "reconciled_at", "cleared_registration_digests"]);
+    const state = text(value.state);
+    const cleared_registration_digests = digests(value.cleared_registration_digests);
+    if (text(value.version) !== RECEIPT_VERSION || (state !== "prepared" && state !== "reconciled") || !/^[a-f0-9]{64}$/u.test(text(value.request_digest)))
+        throw new OfflineTransitionReconciliationBlockedError();
+    const receipt = { version: RECEIPT_VERSION, reconciliation_id: uuid(value.reconciliation_id), request_digest: text(value.request_digest), state, reconciled_at: text(value.reconciled_at), cleared_registration_digests };
+    if (state === "prepared" && receipt.reconciled_at)
+        throw new OfflineTransitionReconciliationBlockedError();
+    if (state === "reconciled" && !receipt.reconciled_at)
+        throw new OfflineTransitionReconciliationBlockedError();
+    return receipt;
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} }
+async function writeReceipt(target, receipt, directory) { const temp = `${target}.${randomUUID()}`; try {
+    await writeNew(temp, receipt);
+    await link(temp, target);
+    await directory.sync();
+    return receipt;
+}
+catch (error) {
+    if (error.code === "EEXIST")
+        throw new OfflineTransitionReconciliationBlockedError();
+    throw error;
+}
+finally {
+    await unlink(temp).catch(() => undefined);
+} }
+async function replaceReceipt(target, receipt, directory) { const temp = `${target}.${randomUUID()}`; try {
+    await writeNew(temp, receipt);
+    await rename(temp, target);
+    await directory.sync();
+}
+finally {
+    await unlink(temp).catch(() => undefined);
+} }
+async function writeNew(file, value) { const handle = await open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow(), 0o600); try {
+    await handle.writeFile(JSON.stringify(value));
+    await handle.sync();
+}
+finally {
+    await handle.close();
+} }
+function publicReceipt(receipt) { return receipt; }
+function blocked() { return { version: OFFLINE_RECONCILIATION_VERSION, state: "blocked", code: OFFLINE_RECONCILIATION_BLOCKED_CODE }; }
+function strictRecord(value, keys) { if (value === null || typeof value !== "object" || Array.isArray(value) || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null))
+    throw new TypeError("offline reconciliation request is invalid"); const result = Object.create(null); for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string")
+        throw new TypeError("offline reconciliation request is invalid");
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+        throw new TypeError("offline reconciliation request is invalid");
+    result[key] = descriptor.value;
+} if (Object.keys(result).length !== keys.length || keys.some((key) => !Object.hasOwn(result, key)))
+    throw new TypeError("offline reconciliation request is invalid"); return result; }
+function text(value) { if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > MAX_BYTES)
+    throw new TypeError("offline reconciliation request is invalid"); return value; }
+function nonBlank(value) { const result = text(value); if (!result.trim())
+    throw new TypeError("offline reconciliation request is invalid"); return result; }
+function uuid(value) { const result = nonBlank(value); if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(result))
+    throw new TypeError("offline reconciliation request is invalid"); return result; }
+function positive(value) { if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1)
+    throw new TypeError("offline reconciliation request is invalid"); return value; }
+function digests(value) { if (!Array.isArray(value) || value.length > 128 || value.some((item) => !/^[a-f0-9]{64}$/u.test(text(item))))
+    throw new OfflineTransitionReconciliationBlockedError(); return uniqueDigests(value); }
+function uniqueDigests(values) { return [...new Set(values)].sort(); }
+function same(left, right) { return Number(left.dev) === right.dev && Number(left.ino) === right.ino; }
+function sameNamespace(left, right) { return left.pid_namespace_dev === right.pid_namespace_dev && left.pid_namespace_ino === right.pid_namespace_ino; }
+function sameLease(left, right) { return left.owner_id === right.owner_id && left.pid === right.pid && left.process_start === right.process_start && left.boot_id === right.boot_id && sameNamespace(left, right); }
+function safeFile(entry) { return entry.isFile() && !entry.isSymbolicLink() && Number(entry.uid) === process.getuid?.() && (Number(entry.mode) & 0o777) === 0o600 && Number(entry.size) <= MAX_BYTES; }
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }
+function directoryFlag() { return constants.O_DIRECTORY ?? 0; }
+async function assertNoLinks(target) { let current = path.parse(target).root; for (const part of path.relative(current, target).split(path.sep).filter(Boolean)) {
+    current = path.join(current, part);
+    if ((await lstat(current)).isSymbolicLink() && current !== "/var")
+        throw new OfflineTransitionReconciliationBlockedError();
+} }
+async function currentLeaseIdentity() { if (process.platform !== "linux")
+    throw new OfflineTransitionReconciliationBlockedError(); const boot_id = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim(); const namespace = await stat("/proc/self/ns/pid"); const process_start = await linuxProcessStart(process.pid); if (!boot_id || !Number.isSafeInteger(Number(namespace.dev)) || !Number.isSafeInteger(Number(namespace.ino)))
+    throw new OfflineTransitionReconciliationBlockedError(); return { owner_id: randomUUID(), pid: process.pid, process_start, boot_id, pid_namespace_dev: Number(namespace.dev), pid_namespace_ino: Number(namespace.ino) }; }
+async function leaseIsAlive(lease) { if (process.platform !== "linux")
+    throw new OfflineTransitionReconciliationBlockedError(); const namespace = await stat("/proc/self/ns/pid"); if (!sameNamespace(lease, { pid_namespace_dev: Number(namespace.dev), pid_namespace_ino: Number(namespace.ino) }))
+    throw new OfflineTransitionReconciliationBlockedError(); const boot = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim(); if (!boot)
+    throw new OfflineTransitionReconciliationBlockedError(); if (boot !== lease.boot_id)
+    return false; try {
+    return await linuxProcessStart(lease.pid) === lease.process_start;
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return false;
+    throw new OfflineTransitionReconciliationBlockedError();
+} }
+async function linuxProcessStart(pid) { const statText = await readFile(`/proc/${pid}/stat`, "utf8"); const close = statText.lastIndexOf(")"); const start = statText.slice(close + 2).trim().split(/\s+/u)[19]; if (close < 0 || start === undefined || !/^\d+$/u.test(start))
+    throw new OfflineTransitionReconciliationBlockedError(); return start; }

package/dist/runtime/wakeAcceptanceRecord.d.ts

@@ -0,0 +1,25 @@
+import { type OrganizationRuntimeWakeAcceptance, type OrganizationRuntimeWakeAcceptanceRequest, type OrganizationRuntimeWakeReceiptStatus, type WakeReceiptCode, type WakeReceiptState } from "./wakeAcceptanceTypes.js";
+export type StoredWakeAcceptanceRecord = Readonly<{
+    acceptance_id: string;
+    agent_id: string;
+    delivery_id: string;
+    request_digest: string;
+    event: OrganizationRuntimeWakeAcceptanceRequest["event"];
+    state: WakeReceiptState;
+    /** Set only through native scheduler acceptance; absent means a real delivery instant. */
+    native_schedule?: true;
+    accepted_at: string;
+    updated_at: string;
+    claim_generation?: string;
+    execution_id?: string;
+    deferred?: boolean;
+    execution_error?: string;
+    code?: WakeReceiptCode;
+    text?: string;
+}>;
+export declare function publicAcceptance(record: StoredWakeAcceptanceRecord): OrganizationRuntimeWakeAcceptance;
+export declare function publicStatus(record: StoredWakeAcceptanceRecord): OrganizationRuntimeWakeReceiptStatus;
+export declare function parseStoredWakeAcceptance(value: unknown): StoredWakeAcceptanceRecord;
+/** Private failure diagnostic, surfaced through the existing availability error. */
+export declare function sanitizeExecutionError(value: string): string;
+//# sourceMappingURL=wakeAcceptanceRecord.d.ts.map

package/dist/runtime/wakeAcceptanceRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceRecord.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceRecord.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IACrF,KAAK,EAAE,wCAAwC,CAAC,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAClF,0FAA0F;IAC1F,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAChL,CAAC,CAAC;AAEH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,GAAG,iCAAiC,CAEtG;AACD,wBAAgB,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,oCAAoC,CAErG;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CA2BpF;AAMD,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D"}

package/dist/runtime/wakeAcceptanceRecord.js

@@ -0,0 +1,58 @@
+import { redactCredentialText } from "../core/credentialRedaction.js";
+import { WAKE_ACCEPTANCE_VERSION, WAKE_RECEIPT_STATUS_VERSION, parseWakeAcceptanceRequest, sanitizeWakeCompletionText, wakeAcceptanceDigest } from "./wakeAcceptanceTypes.js";
+export function publicAcceptance(record) {
+    return { version: WAKE_ACCEPTANCE_VERSION, acceptance_id: record.acceptance_id, agent_id: record.agent_id, delivery_id: record.delivery_id, request_digest: record.request_digest, state: "accepted", accepted_at: record.accepted_at };
+}
+export function publicStatus(record) {
+    return { version: WAKE_RECEIPT_STATUS_VERSION, acceptance_id: record.acceptance_id, agent_id: record.agent_id, delivery_id: record.delivery_id, request_digest: record.request_digest, state: record.state, accepted_at: record.accepted_at, updated_at: record.updated_at, ...(record.execution_id === undefined ? {} : { execution_id: record.execution_id }), ...(record.deferred === undefined ? {} : { deferred: record.deferred }), ...(record.code === undefined ? {} : { code: record.code }), ...(record.text === undefined ? {} : { text: record.text }) };
+}
+export function parseStoredWakeAcceptance(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new Error("wake acceptance record is invalid");
+    const record = value;
+    const keys = ["acceptance_id", "agent_id", "delivery_id", "request_digest", "event", "state", "accepted_at", "updated_at", "claim_generation", "execution_id", "deferred", "execution_error", "code", "text", "native_schedule"];
+    if (Object.keys(record).some((key) => !keys.includes(key)))
+        throw new Error("wake acceptance record is invalid");
+    const parsed = parseWakeAcceptanceRequest({ token: undefined, agent_id: string(record.agent_id), delivery_id: string(record.delivery_id), event: record.event });
+    if (record.native_schedule !== undefined && (record.native_schedule !== true || parsed.event.kind !== "schedule"))
+        throw new Error("wake acceptance schedule provenance is invalid");
+    const state = string(record.state);
+    if (!["accepted", "running", "completed", "failed", "stopped"].includes(state))
+        throw new Error("wake acceptance record is invalid");
+    const code = record.code === undefined ? undefined : string(record.code);
+    const claimGeneration = record.claim_generation === undefined ? undefined : string(record.claim_generation);
+    const executionId = record.execution_id === undefined ? undefined : string(record.execution_id);
+    if (executionId !== undefined && !uuid(executionId) || record.deferred !== undefined && typeof record.deferred !== "boolean")
+        throw new Error("wake acceptance attention state is invalid");
+    const executionError = record.execution_error === undefined ? undefined : sanitizeExecutionError(string(record.execution_error));
+    if (executionError === "" || record.execution_error !== undefined && Buffer.byteLength(string(record.execution_error)) > MAX_EXECUTION_ERROR_BYTES)
+        throw new Error("wake acceptance execution error is invalid");
+    const completionText = record.text === undefined ? undefined : sanitizeWakeCompletionText(string(record.text));
+    if (claimGeneration !== undefined && !uuid(claimGeneration))
+        throw new Error("wake acceptance record is invalid");
+    if (code !== undefined && !["engine_failed", "host_stopped", "host_stopping", "queued_wake_stopped", "active_wake_aborted", "queue_full", "unknown_agent"].includes(code))
+        throw new Error("wake acceptance record is invalid");
+    // `accepted` is the one non-terminal state a record can be arrived at FROM an ended
+    // execution: the dispatcher returns an undisposed delivery there for restart, and the
+    // outcome that returned it is the only account of why. `running` and `completed` still
+    // refuse a code, where one would be nonsense rather than evidence.
+    if ((state === "running" || state === "completed") && code !== undefined)
+        throw new Error("wake acceptance record is invalid");
+    if ((state === "failed" || state === "stopped") && code === undefined)
+        throw new Error("wake acceptance record is invalid");
+    if ((state !== "completed" && state !== "failed" && completionText !== undefined) || completionText !== record.text)
+        throw new Error("wake acceptance record is invalid");
+    if (string(record.request_digest) !== wakeAcceptanceDigest(parsed) || !uuid(string(record.acceptance_id)))
+        throw new Error("wake acceptance record is invalid");
+    return { acceptance_id: string(record.acceptance_id), agent_id: parsed.agent_id, delivery_id: parsed.delivery_id, request_digest: string(record.request_digest), event: parsed.event, state, accepted_at: timestamp(record.accepted_at), updated_at: timestamp(record.updated_at), ...(record.native_schedule === true ? { native_schedule: true } : {}), ...(claimGeneration === undefined ? {} : { claim_generation: claimGeneration }), ...(executionId === undefined ? {} : { execution_id: executionId }), ...(record.deferred === undefined ? {} : { deferred: record.deferred }), ...(code === undefined ? {} : { code }), ...(completionText === undefined ? {} : { text: completionText }), ...(executionError === undefined ? {} : { execution_error: executionError }) };
+}
+function string(value) { if (typeof value !== "string")
+    throw new Error("wake acceptance record is invalid"); return value; }
+function timestamp(value) { const result = string(value); if (Number.isNaN(Date.parse(result)) || new Date(result).toISOString() !== result)
+    throw new Error("wake acceptance record is invalid"); return result; }
+function uuid(value) { return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value); }
+const MAX_EXECUTION_ERROR_BYTES = 2048;
+/** Private failure diagnostic, surfaced through the existing availability error. */
+export function sanitizeExecutionError(value) {
+    return redactCredentialText(value, [], MAX_EXECUTION_ERROR_BYTES).trim();
+}

package/dist/runtime/wakeAcceptanceRetention.d.ts

@@ -0,0 +1,36 @@
+export declare const TERMINAL_RECEIPT_IDEMPOTENCY_HORIZON = 2048;
+export declare const WAKE_ACCEPTANCE_COMPACTION_THRESHOLD = 2112;
+export declare const MAX_WAKE_ACCEPTANCE_RECORDS = 2176;
+/**
+ * How long a delivery may sit in `accepted` before the store stops it.
+ *
+ * Inbox agents return every delivery they did not dispose of to `accepted`
+ * (deferred), and a failed execution keeps its batch for retry. Nothing ever
+ * ended either, so by 2026-10-05 213 deliveries up to two weeks old sat in the
+ * queue, were re-offered on every wake, and kept the store at its bound. A
+ * day is longer than any delivery stays actionable in a daily organization: at
+ * two days, deliveries from 2026-10-05 were still being retried — and failing —
+ * through 10-07's edition. The dispatcher stops an expired delivery
+ * `queued_wake_stopped` the first time it meets one and says so on stderr
+ * (`attentionDispatcher.ts`), rather than leaving it hidden until compaction.
+ */
+export declare const STALE_QUEUED_DELIVERY_MS: number;
+export type RetentionCandidate = Readonly<{
+    file: string;
+    state: "accepted" | "running" | "completed" | "failed" | "stopped";
+    updatedAt: string;
+    acceptedAt?: string;
+    acceptanceId: string;
+}>;
+/** Queued, unclaimed deliveries accepted before the staleness horizon. Running or claimed work never qualifies. */
+export declare function staleQueuedFilesToStop(records: readonly (RetentionCandidate & Readonly<{
+    claimed: boolean;
+}>)[], nowMs: number): readonly string[];
+/**
+ * Active work is never eligible. The newest terminal receipts survive up to the
+ * idempotency horizon, but never so many that active work plus kept receipts
+ * still sits at the compaction threshold: a horizon that ignores active work
+ * lets parked deliveries hold the store at its bound with nothing to compact.
+ */
+export declare function terminalFilesToCompact(records: readonly RetentionCandidate[]): readonly string[];
+//# sourceMappingURL=wakeAcceptanceRetention.d.ts.map

package/dist/runtime/wakeAcceptanceRetention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceRetention.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceRetention.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAC1D,eAAO,MAAM,oCAAoC,OAAQ,CAAC;AAC1D,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAAC;AAEH,mHAAmH;AACnH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,kBAAkB,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAIlJ;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,MAAM,EAAE,CAOhG"}

package/dist/runtime/wakeAcceptanceRetention.js

@@ -0,0 +1,38 @@
+export const TERMINAL_RECEIPT_IDEMPOTENCY_HORIZON = 2_048;
+export const WAKE_ACCEPTANCE_COMPACTION_THRESHOLD = 2_112;
+export const MAX_WAKE_ACCEPTANCE_RECORDS = 2_176;
+/**
+ * How long a delivery may sit in `accepted` before the store stops it.
+ *
+ * Inbox agents return every delivery they did not dispose of to `accepted`
+ * (deferred), and a failed execution keeps its batch for retry. Nothing ever
+ * ended either, so by 2026-10-05 213 deliveries up to two weeks old sat in the
+ * queue, were re-offered on every wake, and kept the store at its bound. A
+ * day is longer than any delivery stays actionable in a daily organization: at
+ * two days, deliveries from 2026-10-05 were still being retried — and failing —
+ * through 10-07's edition. The dispatcher stops an expired delivery
+ * `queued_wake_stopped` the first time it meets one and says so on stderr
+ * (`attentionDispatcher.ts`), rather than leaving it hidden until compaction.
+ */
+export const STALE_QUEUED_DELIVERY_MS = 24 * 60 * 60_000;
+/** Queued, unclaimed deliveries accepted before the staleness horizon. Running or claimed work never qualifies. */
+export function staleQueuedFilesToStop(records, nowMs) {
+    return records
+        .filter((record) => record.state === "accepted" && !record.claimed && record.acceptedAt !== undefined && Date.parse(record.acceptedAt) <= nowMs - STALE_QUEUED_DELIVERY_MS)
+        .map((record) => record.file);
+}
+/**
+ * Active work is never eligible. The newest terminal receipts survive up to the
+ * idempotency horizon, but never so many that active work plus kept receipts
+ * still sits at the compaction threshold: a horizon that ignores active work
+ * lets parked deliveries hold the store at its bound with nothing to compact.
+ */
+export function terminalFilesToCompact(records) {
+    if (records.length < WAKE_ACCEPTANCE_COMPACTION_THRESHOLD)
+        return [];
+    const terminal = records
+        .filter((record) => record.state === "completed" || record.state === "failed" || record.state === "stopped")
+        .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt) || right.acceptanceId.localeCompare(left.acceptanceId));
+    const keep = Math.max(0, Math.min(TERMINAL_RECEIPT_IDEMPOTENCY_HORIZON, WAKE_ACCEPTANCE_COMPACTION_THRESHOLD - 1 - (records.length - terminal.length)));
+    return terminal.slice(keep).map((record) => record.file);
+}

package/dist/runtime/wakeAcceptanceStore.d.ts

@@ -0,0 +1,113 @@
+import { type TransitionLock } from "./wakeAcceptanceProcessIdentity.js";
+import { type OrganizationRuntimeWakeAcceptanceRequest, type OrganizationRuntimeWakeReceiptStatus, type WakeReceiptCode, type WakeReceiptState } from "./wakeAcceptanceTypes.js";
+import { type StoredWakeAcceptanceRecord } from "./wakeAcceptanceRecord.js";
+type Stored = StoredWakeAcceptanceRecord;
+type ActivityRow = OrganizationRuntimeWakeReceiptStatus & Readonly<{
+    active: boolean;
+    queue_position?: number;
+    execution_error?: string;
+}>;
+export type WakeExecutionClaim = Readonly<{
+    acceptance_id: string;
+    owner_id: string;
+    generation: string;
+    expires_at: string;
+    acceptance_ids?: readonly string[];
+    execution_id?: string;
+}>;
+export type WakeExecutionClaimResult = Readonly<{
+    state: "acquired";
+    claim: WakeExecutionClaim;
+}> | Readonly<{
+    state: "held";
+    retry_at: string;
+}> | Readonly<{
+    state: "terminal";
+}>;
+export type WakeAcceptanceStoreTestOptions = Readonly<{
+    claimTtlMs?: number;
+    afterFinalLockAssertion?: () => Promise<void>;
+    nowForTest?: () => number;
+    ownerLiveness?: (lock: TransitionLock) => Promise<boolean>;
+    processIdentity?: () => Promise<Omit<TransitionLock, "owner_id" | "generation">>;
+}>;
+/** Durable, private idempotency authority; callers must pre-create its 0700 root. */
+export declare class WakeAcceptanceStore {
+    private readonly root;
+    private readonly directory;
+    private readonly identity;
+    private readonly registration;
+    private readonly claimTtlMs;
+    private readonly now;
+    private readonly owner;
+    private readonly ownerLiveness;
+    private readonly afterFinalLockAssertion?;
+    private mutations;
+    private readonly index;
+    private onRecordRead?;
+    private claimTransitionLockTiming?;
+    private constructor();
+    static open(root: string, options?: WakeAcceptanceStoreTestOptions): Promise<WakeAcceptanceStore>;
+    accept(request: OrganizationRuntimeWakeAcceptanceRequest, nativeSchedule?: boolean): Promise<{
+        readonly record: Stored;
+        readonly created: boolean;
+    }>;
+    private acceptNow;
+    status(acceptanceId: string): Promise<OrganizationRuntimeWakeReceiptStatus | undefined>;
+    activity(): Promise<readonly Omit<ActivityRow, "execution_error">[]>;
+    /** Internal availability view; diagnostics never enter the public receipt wire. */
+    activityWithExecutionErrors(): Promise<readonly ActivityRow[]>;
+    private activityRows;
+    recoverable(agentIds: ReadonlySet<string>, onStale?: (record: Stored) => void): Promise<readonly Stored[]>;
+    transition(acceptanceId: string, state: WakeReceiptState, code?: WakeReceiptCode): Promise<Stored>;
+    /** Fuse race seam: never stops a record that was claimed after enumeration. */
+    transitionAcceptedToStopped(acceptanceId: string, code?: "host_stopping" | "queued_wake_stopped"): Promise<Stored>;
+    acquireClaim(acceptanceId: string, ownerId: string, acceptanceIds?: readonly string[], executionId?: string): Promise<WakeExecutionClaimResult>;
+    claimHeartbeatIntervalMs(): number;
+    renewClaim(acceptanceId: string, claim: WakeExecutionClaim): Promise<WakeExecutionClaim>;
+    /** `text` carries the completion output on success and the engine failure cause on failure. */
+    transitionClaimed(acceptanceId: string, claim: WakeExecutionClaim, state: WakeReceiptState, code?: WakeReceiptCode, completedText?: string, attention?: {
+        execution_id?: string;
+        deferred?: boolean;
+        clear_execution?: boolean;
+        execution_error?: string | null;
+    }): Promise<Stored>;
+    releaseClaim(claim: WakeExecutionClaim): Promise<void>;
+    releaseClaims(ownerId: string): Promise<void>;
+    private transitionNow;
+    close(): Promise<void>;
+    private serialize;
+    private findByAcceptanceId;
+    private pathForAcceptanceId;
+    private claimFor;
+    private lockFor;
+    private acquireTransitionLock;
+    private assertTransitionLock;
+    private releaseTransitionLock;
+    private fileFor;
+    private files;
+    private claimFiles;
+    private readOptional;
+    private read;
+    private readClaimOptional;
+    private readClaim;
+    private readLockOptional;
+    private readLock;
+    private transitionNowClaimed;
+    private compactTerminalRecords;
+    private writeNew;
+    private replace;
+    private replaceValue;
+    private verify;
+}
+export declare class WakeInboxFullError extends Error {
+    constructor(message?: string);
+}
+export declare class WakeAcceptanceConflictError extends Error {
+    constructor();
+}
+export { WakeExecutionClaimLostError, WakeTransitionLockContentionError } from "./wakeAcceptanceClaimDiagnostics.js";
+/** A container boundary requires deployment-authorized offline reconciliation. */
+export { WakeTransitionLockBlockedError } from "./wakeAcceptanceProcessIdentity.js";
+export { publicAcceptance } from "./wakeAcceptanceRecord.js";
+//# sourceMappingURL=wakeAcceptanceStore.d.ts.map

package/dist/runtime/wakeAcceptanceStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceStore.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAKhK,OAAO,EAIL,KAAK,wCAAwC,EAC7C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAqF,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAK/J,KAAK,MAAM,GAAG,0BAA0B,CAAC;AACzC,KAAK,WAAW,GAAG,oCAAoC,GAAG,QAAQ,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC3I,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC1L,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC,CAAC;AAEpL,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC;AAIvS,qFAAqF;AACrF,qBAAa,mBAAmB;IAKV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAoC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAqB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAAyB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAgB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAmD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA8C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAJ5d,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,YAAY,CAAC,CAAyB;IAC9C,OAAO,CAAC,yBAAyB,CAAC,CAAmD;IACrF,OAAO;WAGM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAyB3G,MAAM,CAAC,OAAO,EAAE,wCAAwC,EAAE,cAAc,UAAQ,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;YAGpI,SAAS;IA6BjB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC;IAIvF,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,CAAC;IAC1E,mFAAmF;IAC7E,2BAA2B,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC;YACtD,YAAY;IAcpB,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAchH,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAGlG,+EAA+E;IAC/E,2BAA2B,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,GAAE,eAAe,GAAG,qBAAuC,GAAG,OAAO,CAAC,MAAM,CAAC;IAUnI,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA8B/I,wBAAwB,IAAI,MAAM;IAClC,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAaxF,+FAA+F;IAC/F,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAkCnR,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAS/B,aAAa;IAQrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5B,OAAO,CAAC,SAAS;YAKH,kBAAkB;YAKlB,mBAAmB;IAKjC,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,OAAO;YACD,qBAAqB;YAerB,oBAAoB;YAIpB,qBAAqB;IAKnC,OAAO,CAAC,OAAO;YAGD,KAAK;YAOL,UAAU;YACV,YAAY;YACZ,IAAI;YAQJ,iBAAiB;YACjB,SAAS;YAcT,gBAAgB;YAChB,QAAQ;YAWR,oBAAoB;YAMpB,sBAAsB;YAatB,QAAQ;YAIR,OAAO;YACP,YAAY;YAIZ,MAAM;CAMrB;AACD,qBAAa,kBAAmB,SAAQ,KAAK;gBAAe,OAAO,SAAuE;CAAuB;AACjK,qBAAa,2BAA4B,SAAQ,KAAK;;CAAoF;AAC1I,OAAO,EAAE,2BAA2B,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AACrH,kFAAkF;AAClF,OAAO,EAAE,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC"}