@optimystic/db-p2p 0.13.5 → 0.14.1

package/dist/src/reactivity/recover-transport.js

@@ -0,0 +1,308 @@
+/**
+ * Reactivity recover RPC transport — the live libp2p backfill/resume recovery protocol
+ * (`docs/reactivity.md` §Backfill RPC, §Resume).
+ *
+ * This is the **pull** companion to the one-way notify transport: a subscriber that detected a gap (or
+ * woke from sleep) asks a serving cohort member "what did I miss?" and is brought current. The protocol is
+ * **request-reply** — one {@link RecoverRequestV1} frame out, one {@link RecoverReplyV1} frame back over a
+ * single stream — so it rides the cohort-topic {@link requestResponse} / {@link handleRequestResponse}
+ * helpers (NOT the one-way notify helpers, which would desync the dialer).
+ *
+ * Two pieces live here, both decoupled from the live node assembly so they unit-test in isolation:
+ *
+ *  - {@link Libp2pReactivityRecoverTransport} — the **outbound** side. Supplies the two db-core seams
+ *    (`BackfillTransport` / `ResumeTransport`) against one node: pick a target (sticky cohort-hint primary
+ *    first for the one-RT happy path, else a cohort-walk member), frame the request, exchange it over the
+ *    recover protocol, and return the inner reply. The wire exchange is injected as a {@link RecoverDialer}
+ *    so the target-selection + framing logic tests without a real socket; {@link createLibp2pRecoverDialer}
+ *    is the production libp2p-backed implementation.
+ *  - {@link createRecoverRequestHandler} / {@link registerRecoverHandler} — the **inbound** serve handler.
+ *    Decode (bounded) → verify the request's peer-key signature against the dialing peer → reject a
+ *    replay/stale request → resolve the live `PushState` → `serveBackfill` / `serveResume` → reply. Any
+ *    failure produces **no reply** (the stream aborts) rather than throwing out of the handler.
+ *
+ * ## Dial-target encoding bridge (load-bearing)
+ *
+ * The sticky {@link import("@optimystic/db-core").ReactivityCohortHint}`.primary` is **base64url of
+ * cohort member-id bytes** (`base64url(utf8(peerIdString))`), per its db-core JSDoc, whereas
+ * {@link requestResponse} needs a `peerIdFromString`-parseable peer-id **string**. Feeding the raw
+ * base64url straight to `peerIdFromString` throws → the dial is swallowed → recovery silently never
+ * reaches the cohort. {@link decodeCohortHintTarget} pins the conversion
+ * (`bytesToPeerIdString(b64urlToBytes(primary))`); the `resolveCohort` walk, by contrast, already returns
+ * peer-id strings (the cohort-topic `CohortPeerResolver` space) and is used as-is.
+ */
+import { peerIdFromString } from "@libp2p/peer-id";
+import { b64urlToBytes, bytesToB64url, reactivityTopicId, serveBackfill, serveResume, backfillSigningPayload, resumeSigningPayload, encodeRecoverRequestV1, decodeRecoverRequestV1, encodeRecoverReplyV1, decodeRecoverReplyV1, } from "@optimystic/db-core";
+import { requestResponse, handleRequestResponse, DEFAULT_STREAM_MAX_BYTES } from "../cohort-topic/stream-util.js";
+import { verifyPeerSig, signPeerSig } from "../cohort-topic/peer-sig.js";
+import { peerIdToBytes, bytesToPeerIdString } from "../cohort-topic/peer-codec.js";
+import { PROTOCOL_REACTIVITY_RECOVER } from "./protocols.js";
+import { createLogger } from "../logger.js";
+const log = createLogger("reactivity-recover");
+/**
+ * Decode a sticky-cohort-hint `primary` (base64url of member-id bytes = `base64url(utf8(peerIdString))`)
+ * back to the dialable peer-id string. The inverse trap of feeding the raw value to `peerIdFromString`
+ * (which expects a peer-id string, not base64url-of-its-utf8) — pinned by the dial-target encoding test.
+ */
+export function decodeCohortHintTarget(primary) {
+    return bytesToPeerIdString(b64urlToBytes(primary));
+}
+/**
+ * Build the subscriber's recover request signers from the node's libp2p Ed25519 private key.
+ *
+ * This resolves the recover wiring's one design point: the subscription-manager `signBackfill` /
+ * `signResume` ports are **synchronous** (`(unsigned) => string`) — the db-core driver builds the
+ * unsigned image internally, so a pre-signed value is impossible — but libp2p `PrivateKey.sign` is
+ * **async**. Rather than make the seam (and `createBackfillRequester`'s `sign`, a db-core change) async,
+ * sign with the synchronous {@link signPeerSig} (noble, over the raw Ed25519 seed) over db-core's
+ * canonical signing payloads. The produced signature verifies on the serving side under
+ * {@link verifyPeerSig} over the same bytes (both noble, RFC8032), so the round trip is symmetric.
+ */
+export function createRecoverRequestSigners(privateKey) {
+    return {
+        signBackfill: (unsigned) => bytesToB64url(signPeerSig(privateKey, backfillSigningPayload(unsigned))),
+        signResume: (unsigned) => bytesToB64url(signPeerSig(privateKey, resumeSigningPayload(unsigned))),
+    };
+}
+// --- outbound transport ---
+/**
+ * Thrown out of {@link Libp2pReactivityRecoverTransport.backfillTransport} / `resumeTransport` when the
+ * dialed cohort answered with a `kind: "rotated"` recover reply: the outgoing tail this request reached has
+ * rotated and is draining, so it bounced the request to the new tree (`docs/reactivity.md` §Tail rotation).
+ * It carries the {@link RotationRedirectV1} so the subscription manager can move itself to the successor.
+ *
+ * A `kind: "rotated"` reply is **terminal** for the cohort-walk — the dialed member spoke authoritatively for
+ * the cohort, so the transport stops rather than falling through to the next target (contrast a *dial
+ * failure*, which still falls through). The subscriber honors it like a notification-driven rotation.
+ */
+export class RotationRedirectError extends Error {
+    /** The drain-window redirect the serving cohort returned (`newTailId` / `newTopicId` / `effectiveAtRevision`). */
+    redirect;
+    constructor(redirect) {
+        super(`reactivity recover: cohort rotated to tail ${redirect.newTailId} (effectiveAtRevision ${redirect.effectiveAtRevision})`);
+        this.name = "RotationRedirectError";
+        this.redirect = redirect;
+    }
+}
+/** Build the production libp2p-backed {@link RecoverDialer} over {@link requestResponse}. */
+export function createLibp2pRecoverDialer(node, recoverProtocol = PROTOCOL_REACTIVITY_RECOVER, maxBytes = DEFAULT_STREAM_MAX_BYTES) {
+    return {
+        exchange: (target, frame) => requestResponse(node, peerIdFromString(target), recoverProtocol, frame, maxBytes),
+    };
+}
+/**
+ * The outbound recover transport: one instance per node, exposing the two db-core function seams against it.
+ * Each returned transport dials the **sticky primary first** (one round trip after a brief flap), falling
+ * back to a **cohort-walk** member on a dial failure (any member that holds the topic's gossiped `PushState`
+ * can answer). A kind mismatch or all-targets-failed surfaces as a rejection so the caller's retry/escalation
+ * policy (the subscription manager's backfill escalation, or `manager.resume()`'s caller) takes over.
+ */
+export class Libp2pReactivityRecoverTransport {
+    dialer;
+    selfPeerId;
+    cohortHintCache;
+    resolveCohort;
+    maxBytes;
+    constructor(options) {
+        this.dialer = options.dialer;
+        this.selfPeerId = options.selfPeerId;
+        this.cohortHintCache = options.cohortHintCache;
+        this.resolveCohort = options.resolveCohort;
+        this.maxBytes = options.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    }
+    /** The db-core {@link BackfillTransport} for `(topicId, collectionId)` — frames + dials a signed {@link BackfillV1}. */
+    backfillTransport(topicId, collectionId) {
+        return async (req) => {
+            const frame = encodeRecoverRequestV1({ v: 1, kind: "backfill", backfill: req }, this.maxBytes);
+            const reply = await this.exchange("backfill", frame, topicId, collectionId);
+            if (reply.backfillReply === undefined) {
+                throw new Error("reactivity recover: backfill reply missing its body");
+            }
+            return reply.backfillReply;
+        };
+    }
+    /** The {@link ResumeTransport} for `(topicId, collectionId)` — frames + dials a signed {@link ResumeV1}. */
+    resumeTransport(topicId, collectionId) {
+        return async (req) => {
+            const frame = encodeRecoverRequestV1({ v: 1, kind: "resume", resume: req }, this.maxBytes);
+            const reply = await this.exchange("resume", frame, topicId, collectionId);
+            if (reply.resumeReply === undefined) {
+                throw new Error("reactivity recover: resume reply missing its body");
+            }
+            return reply.resumeReply;
+        };
+    }
+    /**
+     * Exchange one recover frame with the first reachable target: sticky primary, then each cohort-walk
+     * member. A **dial failure** falls through to the next candidate; a successful dial is **terminal** (the
+     * member answered for the cohort) — a `kind: "rotated"` redirect throws {@link RotationRedirectError}, and
+     * a reply decoding to the wrong `kind` is a protocol error. Throws when no candidate succeeds.
+     */
+    async exchange(kind, frame, topicId, collectionId) {
+        const targets = this.selectTargets(topicId, collectionId);
+        if (targets.length === 0) {
+            throw new Error("reactivity recover: no serving cohort target resolved");
+        }
+        let lastErr;
+        for (const target of targets) {
+            let replyFrame;
+            try {
+                replyFrame = await this.dialer.exchange(target, frame);
+            }
+            catch (err) {
+                lastErr = err; // dial failure → fall back to the next candidate (sticky → walk)
+                log("recover dial to %s failed, trying next target: %o", target, err);
+                continue;
+            }
+            const reply = decodeRecoverReplyV1(replyFrame, this.maxBytes); // a decode failure here is terminal
+            // A rotated cohort answered authoritatively: surface the redirect and stop the walk (terminal, never
+            // a fallthrough — the dialed member spoke for the cohort).
+            if (reply.kind === "rotated") {
+                throw new RotationRedirectError(reply.rotated);
+            }
+            if (reply.kind !== kind) {
+                throw new Error(`reactivity recover: reply kind "${reply.kind}" does not match request kind "${kind}"`);
+            }
+            return reply;
+        }
+        throw lastErr ?? new Error("reactivity recover: all targets failed");
+    }
+    /**
+     * Ordered dial candidates for a recover: the sticky primary (decoded from its base64url-of-bytes form)
+     * first, then the cohort-walk members. Self is never dialed (a co-located serve is the node wiring's
+     * concern), and duplicates collapse.
+     */
+    selectTargets(topicId, collectionId) {
+        const seen = new Set();
+        const targets = [];
+        const add = (target) => {
+            if (target === undefined || target === this.selfPeerId || seen.has(target)) {
+                return;
+            }
+            seen.add(target);
+            targets.push(target);
+        };
+        const hint = this.cohortHintCache.get(collectionId);
+        if (hint?.primary !== undefined) {
+            try {
+                add(decodeCohortHintTarget(hint.primary));
+            }
+            catch (err) {
+                log("recover: malformed sticky primary for %s, skipping to cohort-walk: %o", collectionId, err);
+            }
+        }
+        for (const member of this.resolveCohort(topicId)) {
+            add(member);
+        }
+        return targets;
+    }
+}
+/**
+ * Verify the request's peer-key signature against the dialing peer, then admit it through the freshness +
+ * anti-replay guard. The dialing peer's id **is** the signer (no signer-id field on the wire); the signature
+ * bytes are the anti-replay key (globally unique + authenticated). Returns `false` (reject, no reply) on a
+ * bad signature, a stale/future timestamp, or a replay.
+ */
+function verifyAndAdmit(deps, signerId, payload, signatureB64, timestamp, now) {
+    const signature = b64urlToBytes(signatureB64);
+    if (!verifyPeerSig(signerId, payload, signature)) {
+        log("recover serve: signature verification failed for %s (no reply)", signerId);
+        return false;
+    }
+    if (!deps.replayGuard.accept(signature, peerIdToBytes(signerId), timestamp, now)) {
+        log("recover serve: replay/stale request from %s (no reply)", signerId);
+        return false;
+    }
+    return true;
+}
+/**
+ * Serve a backfill from the collection's current served tail, or `undefined` if this node serves none. When
+ * the node serves **only** the outgoing (draining) tail, `rotationFor` returns the drain redirect and the
+ * reply is `kind: "rotated"` instead — a best-effort secondary path (the primary mechanism for an active
+ * subscriber is notify-driven detection). Once both tails coexist `pushStateForCollection` resolves the new
+ * tail, so the redirect is emitted only while the old tail is the sole served state (see §Tail rotation).
+ */
+function serveBackfillReply(deps, req, now) {
+    const maxBytes = deps.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    const redirect = deps.rotationFor?.({ collectionId: req.collectionId }, now);
+    if (redirect !== undefined) {
+        return encodeRecoverReplyV1({ v: 1, kind: "rotated", rotated: redirect }, maxBytes);
+    }
+    const ps = deps.pushStateForCollection(req.collectionId);
+    if (ps === undefined) {
+        return undefined; // not a serving member for this collection → no reply (subscriber walks/chain-reads)
+    }
+    const backfillReply = serveBackfill(ps.replayBuffer, req, ps.collectionId);
+    return encodeRecoverReplyV1({ v: 1, kind: "backfill", backfillReply }, maxBytes);
+}
+/**
+ * Serve a resume against the live `PushState`. A resume reaching the **outgoing (draining)** tail — its
+ * `latestKnownTailId` anchors a topic this node has marked rotated — is answered with the drain redirect
+ * (`kind: "rotated"`), moving the subscriber to the new tree. Otherwise prefer the exact topic the request's
+ * `latestKnownTailId` anchors (so a non-rotated subscriber classifies into backfill/checkpoint/out_of_window);
+ * if this node no longer serves that tail's topic, fall back to the collection's current tail so the cohort
+ * can still answer `tail_rotated` (its `currentTailId` differs from the request's stale tail) or, for a span
+ * that crosses a rotation, serve from the new tail's `inheritedCheckpoint`. `undefined` ⇒ no served state.
+ */
+function serveResumeReply(deps, req, now) {
+    const maxBytes = deps.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    const staleTopic = reactivityTopicId(b64urlToBytes(req.latestKnownTailId));
+    const redirect = deps.rotationFor?.({ topicId: staleTopic, collectionId: req.collectionId }, now);
+    if (redirect !== undefined) {
+        return encodeRecoverReplyV1({ v: 1, kind: "rotated", rotated: redirect }, maxBytes);
+    }
+    const ps = deps.pushStateFor(staleTopic) ?? deps.pushStateForCollection(req.collectionId);
+    if (ps === undefined) {
+        return undefined;
+    }
+    const resumeReply = serveResume(req, {
+        buffer: ps.replayBuffer,
+        checkpoint: ps.checkpoint,
+        inheritedCheckpoint: ps.inheritedCheckpoint,
+        currentTailId: ps.tailIdAtJoin,
+        currentRevision: ps.lastRevision,
+        rotationRevision: ps.lastRevision,
+        expectedCollectionId: ps.collectionId,
+    });
+    return encodeRecoverReplyV1({ v: 1, kind: "resume", resumeReply }, maxBytes);
+}
+/**
+ * Build the recover serve callback for {@link handleRequestResponse}: it returns the reply frame, or
+ * `undefined` for **no reply** (a decode/verify/replay/resolve failure aborts the stream). It never throws
+ * out of the handler.
+ */
+export function createRecoverRequestHandler(deps) {
+    const maxBytes = deps.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    const clock = deps.clock ?? (() => Date.now());
+    return (frame, fromPeer) => {
+        try {
+            const req = decodeRecoverRequestV1(frame, maxBytes);
+            const signerId = fromPeer.toString();
+            const now = clock();
+            if (req.kind === "backfill") {
+                const b = req.backfill;
+                if (b === undefined || !verifyAndAdmit(deps, signerId, backfillSigningPayload(b), b.signature, b.timestamp, now)) {
+                    return Promise.resolve(undefined);
+                }
+                return Promise.resolve(serveBackfillReply(deps, b, now));
+            }
+            const r = req.resume;
+            if (r === undefined || !verifyAndAdmit(deps, signerId, resumeSigningPayload(r), r.signature, r.timestamp, now)) {
+                return Promise.resolve(undefined);
+            }
+            return Promise.resolve(serveResumeReply(deps, r, now));
+        }
+        catch (err) {
+            // A malformed/foreign request (decode failure, foreign collectionId from serve*) must never throw
+            // out of the stream handler: log + no reply (the stream aborts, the subscriber falls back).
+            log("recover serve: dropping request (no reply): %o", err);
+            return Promise.resolve(undefined);
+        }
+    };
+}
+/** Register the inbound recover protocol handler on `node` (request-reply over the recover protocol). */
+export function registerRecoverHandler(node, protocol, deps) {
+    const maxBytes = deps.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    handleRequestResponse(node, protocol, createRecoverRequestHandler(deps), maxBytes);
+}
+//# sourceMappingURL=recover-transport.js.map

package/dist/src/reactivity/recover-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recover-transport.js","sourceRoot":"","sources":["../../../src/reactivity/recover-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACN,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GAapB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAClH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,OAAO,mBAAmB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAsB;IACjE,OAAO;QACN,YAAY,EAAE,CAAC,QAA0B,EAAU,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9H,UAAU,EAAE,CAAC,QAAwB,EAAU,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;KACxH,CAAC;AACH,CAAC;AAED,6BAA6B;AAE7B;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC/C,kHAAkH;IACzG,QAAQ,CAAqB;IACtC,YAAY,QAA4B;QACvC,KAAK,CAAC,8CAA8C,QAAQ,CAAC,SAAS,yBAAyB,QAAQ,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAChI,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;CACD;AAQD,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,kBAA0B,2BAA2B,EAAE,WAAmB,wBAAwB;IACzJ,OAAO;QACN,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,CAAC;KAC9G,CAAC;AACH,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3B,MAAM,CAAgB;IACtB,UAAU,CAAS;IACnB,eAAe,CAAwB;IACvC,aAAa,CAAoC;IACjD,QAAQ,CAAS;IAElC,YAAY,OAAgD;QAC3D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,CAAC;IAED,wHAAwH;IACxH,iBAAiB,CAAC,OAAmB,EAAE,YAAoB;QAC1D,OAAO,KAAK,EAAE,GAAe,EAA4B,EAAE;YAC1D,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC;QAC5B,CAAC,CAAC;IACH,CAAC;IAED,4GAA4G;IAC5G,eAAe,CAAC,OAAmB,EAAE,YAAoB;QACxD,OAAO,KAAK,EAAE,GAAa,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC1E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,KAAK,CAAC,WAAW,CAAC;QAC1B,CAAC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ,CAAC,IAAiB,EAAE,KAAiB,EAAE,OAAmB,EAAE,YAAoB;QACrG,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAgB,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,UAAsB,CAAC;YAC3B,IAAI,CAAC;gBACJ,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,OAAO,GAAG,GAAG,CAAC,CAAC,iEAAiE;gBAChF,GAAG,CAAC,mDAAmD,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBACtE,SAAS;YACV,CAAC;YACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,oCAAoC;YACnG,qGAAqG;YACrG,2DAA2D;YAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,IAAI,kCAAkC,IAAI,GAAG,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,IAAI,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtE,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,OAAmB,EAAE,YAAoB;QAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,MAA0B,EAAQ,EAAE;YAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,OAAO;YACR,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACJ,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,uEAAuE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,CAAC;QACb,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;CACD;AA2BD;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAsB,EAAE,QAAgB,EAAE,OAAmB,EAAE,YAAoB,EAAE,SAAiB,EAAE,GAAW;IAC1I,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,gEAAgE,EAAE,QAAQ,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,wDAAwD,EAAE,QAAQ,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAsB,EAAE,GAAe,EAAE,GAAW;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,oBAAoB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC,CAAC,qFAAqF;IACxG,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IAC3E,OAAO,oBAAoB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAsB,EAAE,GAAa,EAAE,GAAW;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC3D,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,oBAAoB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1F,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,MAAM,EAAE,EAAE,CAAC,YAAY;QACvB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,mBAAmB,EAAE,EAAE,CAAC,mBAAmB;QAC3C,aAAa,EAAE,EAAE,CAAC,YAAY;QAC9B,eAAe,EAAE,EAAE,CAAC,YAAY;QAChC,gBAAgB,EAAE,EAAE,CAAC,YAAY;QACjC,oBAAoB,EAAE,EAAE,CAAC,YAAY;KACrC,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAsB;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,KAAiB,EAAE,QAAgB,EAAmC,EAAE;QAC/E,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClH,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;YACrB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAChH,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,kGAAkG;YAClG,4FAA4F;YAC5F,GAAG,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACF,CAAC,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,QAAgB,EAAE,IAAsB;IAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC3D,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,2BAA2B,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC"}

package/dist/src/reactivity/rotation-rereg-scheduler.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Reactivity — tail-rotation re-registration timer host seam (`docs/reactivity.md` §Tail rotation step 3).
+ *
+ * The {@link import("./subscription-manager.js").ReactivitySubscriptionManager} surfaces a
+ * {@link import("./subscription-manager.js").RotationNotice} **once per successor tail** (both the
+ * notify-driven pre-announce and the recover-driven `RotationRedirectError` converge on the same
+ * `surfaceRotation` seam), but it neither schedules the timer nor performs the move. This host component
+ * does: it consumes a notice, schedules a one-shot timer for `max(0, plan.fireAt - now())`, and on fire
+ * invokes an injected `reRegister(plan)` seam that re-subscribes the watcher at the rotated tree. The node
+ * composition that constructs the manager + binds this scheduler to its `onRotation` observer lives in
+ * `reactivity-rotation-host-wiring-e2e`; this module is the standalone, unit-testable piece.
+ *
+ * **Where the stagger lives.** The spread that keeps the new tail from being flooded is entirely in
+ * `plan.fireAt`, drawn by the **manager's** `rejoinJitter`. This scheduler only *consumes* `plan.fireAt`; it
+ * never sees the jitter. The manager uses the *single*-subscriber planner `planReRegistration` →
+ * `RejoinJitter.scheduleRejoin`, which draws a **uniform** offset `now + ⌊U[0, T_rejoin_jitter)⌋` — so the
+ * load-bearing knob for this path is the **window** `T_rejoin_jitter` (default 30 s), not a `capPromote`. Each
+ * subscriber jitters independently, giving the new tail an inbound rate of ≈ `subscribers / T_rejoin_jitter`
+ * in expectation; the burst is absorbed on the *receiving* side by the new tail cohort's `cap_promote_fast`
+ * fast-promotion (a cohort-topic promotion mechanism — see `docs/reactivity.md` §Tail rotation rotation-cost
+ * and the Worked scenario), which is independent of the jitter's `capPromote`.
+ *
+ * Note that `RejoinJitter`'s `capPromote` is consulted **only** by the *wave* planner
+ * `scheduleWave` / `planReRegistrationWave` (a single host staggering a whole wave with a hard per-window
+ * ceiling — used by the mesh harness, not by the production manager). If the composing site
+ * (`reactivity-rotation-host-wiring-e2e`) ever switches the manager onto the wave planner, *then* it must
+ * build the jitter as `createRejoinJitter({ capPromote: DEFAULT_CAP_PROMOTE_FAST })` (= 32), since the default
+ * `createRejoinJitter()` cap is the cohort-failure `cap_promote = 64`. For the current single-planner path,
+ * setting `capPromote` has **no effect** on `fireAt`.
+ *
+ * **Determinism.** An injected `setTimer(fn, delayMs) => cancel` and `now()` clock make the scheduler
+ * testable with a fake clock (no wall clock). They default to a production binding: an **unref'd**
+ * `setTimeout`/`clearTimeout` and `Date.now`. The unref is load-bearing — an idle re-registration timer must
+ * not pin an otherwise-idle process, mirroring the push-state-gossip driver's unref'd timer
+ * ({@link import("./push-state-gossip.js").ReactivityPushStateGossipDriver}).
+ *
+ * **Idempotence.** De-duped by successor `newTopicId` (base64url): a second notice for a successor already
+ * scheduled or fired is ignored. The manager already fires once per successor (its `rotationHandledFor`
+ * guard), but a redirect and a pre-announce can surface the **same** successor near-simultaneously, so the
+ * scheduler is independently idempotent. The de-dupe ledger (`seen`) survives the timer fire (so a late
+ * re-surface of an already-fired successor stays a no-op), which on the normal schedule→fire path would let it
+ * grow without bound across a long-lived, fast-rotating subscription. It is therefore **bounded**: capped at
+ * `SEEN_LEDGER_CAP` entries with oldest-first eviction (insertion order), and eviction **never** drops a key
+ * still in `pending` — that would break the "every pending key ∈ `seen`" invariant and could let a duplicate
+ * notice for a pending successor arm a second timer over the live one. A re-surface older than the cap (≥ cap
+ * distinct successors later) degrades to at most one harmless, idempotent re-register.
+ *
+ * **Chained rotation OLD→A→B** before A's timer fires → A and B are distinct successors → two independent
+ * timers; **both may fire**. Re-registering at A and then immediately rotating A→B is self-correcting via the
+ * manager's `rotationHandledFor` guard, so a superseded timer is intentionally **not** cancelled (a
+ * superseded re-register is harmless and rare).
+ */
+import { type ReRegistrationPlan } from "@optimystic/db-core";
+import type { RotationNotice } from "./subscription-manager.js";
+/**
+ * Upper bound on the idempotence ledger (`seen`). Far above any realistic count of *concurrently-pending*
+ * successors (single digits: 1 in the normal case, a handful across a chained rotation), so it never evicts a
+ * still-live entry in practice while keeping the ledger's memory to tens of KB of short base64url strings at the
+ * ceiling. Tunable — raising it widens the late-re-surface de-dupe window at a proportional memory cost.
+ * Exported for the regression test that asserts the bound; production callers don't read it.
+ */
+export declare const SEEN_LEDGER_CAP = 1024;
+/** Cancel handle returned by an injected timer; cancels a not-yet-fired timer (safe no-op after fire/cancel). */
+export type RotationTimerCancel = () => void;
+/** Construction inputs for a {@link RotationReRegistrationScheduler}. */
+export interface RotationReRegistrationSchedulerOptions {
+    /**
+     * Perform the actual move: re-subscribe the watcher at the rotated tree (the new `topicId`, carrying the
+     * plan's `lastRevision`). A rejection is isolated + logged — a failed move must never throw out of the
+     * timer callback. Not retried this pass (see the class doc).
+     */
+    readonly reRegister: (plan: ReRegistrationPlan) => Promise<void>;
+    /**
+     * Schedule a one-shot timer; returns a cancel handle. Defaults to an **unref'd** `setTimeout`. Tests inject
+     * a fake timer queue for determinism.
+     */
+    readonly setTimer?: (fn: () => void, delayMs: number) => RotationTimerCancel;
+    /** Clock (Unix ms). Defaults to `Date.now`; tests inject a fake clock. */
+    readonly now?: () => number;
+}
+/**
+ * Hosts the per-successor one-shot timers that move a subscriber to the rotated tree. Construct one per
+ * subscription manager and bind {@link schedule} to the manager's
+ * {@link import("./subscription-manager.js").ReactivitySubscriptionManagerOptions.onRotation} observer.
+ *
+ * See the module doc for where the re-registration stagger actually lives (the manager's `rejoinJitter`; this
+ * scheduler only consumes `plan.fireAt`, it does not draw it).
+ */
+export declare class RotationReRegistrationScheduler {
+    private readonly reRegister;
+    private readonly setTimer;
+    private readonly now;
+    /** Successors with a still-pending timer, keyed by base64url `newTopicId` → its cancel handle. */
+    private readonly pending;
+    /**
+     * Successors recently scheduled (pending **or** already fired) — the idempotence ledger that survives fire.
+     * Insertion-ordered and **bounded** at {@link SEEN_LEDGER_CAP}: {@link evictSeenOverCap} drops the oldest
+     * non-pending entries once over cap (never a still-pending key — see that method's doc).
+     */
+    private readonly seen;
+    private stopped;
+    constructor(options: RotationReRegistrationSchedulerOptions);
+    /** Successors with a timer still pending (not yet fired/cancelled). Diagnostic / test seam. */
+    get pendingCount(): number;
+    /**
+     * Size of the idempotence ledger (pending + recently-fired-and-retained). Diagnostic / test seam; the
+     * regression test asserts this stays ≤ {@link SEEN_LEDGER_CAP} under unbounded sequential rotations.
+     */
+    get seenCount(): number;
+    /**
+     * Schedule the re-registration timer for a rotation notice. De-duped by successor `newTopicId`: a second
+     * notice for an already-scheduled-or-fired successor is a no-op (a redirect and a pre-announce can surface
+     * the same successor). The delay is `max(0, plan.fireAt - now())`, so a `fireAt` already in the past fires
+     * on the next tick (clamped to 0, never negative). A no-op once {@link stop} has run.
+     */
+    schedule(notice: RotationNotice): void;
+    /**
+     * Cancel a single pending timer (by successor `newTopicId`) or, when called with no argument, **all**
+     * pending timers (teardown). Cancelling an already-fired or unknown successor is a safe no-op. A cancelled
+     * successor is forgotten (dropped from the idempotence ledger), so a later notice for it would reschedule;
+     * use {@link stop} for permanent teardown.
+     */
+    cancel(newTopicId?: Uint8Array): void;
+    /**
+     * Stop the scheduler permanently (teardown): cancel every pending timer and refuse all further scheduling
+     * and firing. A timer that races `stop` (its callback already queued) finds the `stopped` gate and never
+     * invokes `reRegister`. Idempotent.
+     */
+    stop(): void;
+    /**
+     * Bound the idempotence ledger: evict the oldest entries (insertion order) that are **not** still pending,
+     * until back within {@link SEEN_LEDGER_CAP}. Never evicts a pending key — that would break the "every pending
+     * key ∈ `seen`" invariant and could double-fire a successor whose later duplicate notice then re-armed a timer
+     * over the live one. If every over-cap entry is somehow still pending (`pending.size > cap` — not reachable in
+     * practice, since pending successors are the most recently scheduled), the loop bails and the ledger is left to
+     * grow with `pending` this round; it returns within cap as soon as those timers fire and a later schedule runs.
+     */
+    private evictSeenOverCap;
+    /** Timer callback: drop the pending entry, then invoke the isolated re-registration (unless stopped). */
+    private fire;
+}
+//# sourceMappingURL=rotation-rereg-scheduler.d.ts.map

package/dist/src/reactivity/rotation-rereg-scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-rereg-scheduler.d.ts","sourceRoot":"","sources":["../../../src/reactivity/rotation-rereg-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAKhE;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,iHAAiH;AACjH,MAAM,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC;AAc7C,yEAAyE;AACzE,MAAM,WAAW,sCAAsC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,mBAAmB,CAAC;IAC7E,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,+BAA+B;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8C;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2D;IACpF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,kGAAkG;IAClG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAClE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,sCAAsC;IAM3D,+FAA+F;IAC/F,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAwBtC;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI;IAkBrC;;;;OAIG;IACH,IAAI,IAAI,IAAI;IASZ;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IAiBxB,yGAAyG;IACzG,OAAO,CAAC,IAAI;CAmBZ"}