@secondlayer/shared 7.7.0 → 7.9.0

package/dist/src/archive/derived-stage-report.d.ts

@@ -0,0 +1,99 @@
+/**
+* Derived-stage acceptance — what each service reads, writes, and needs
+* beyond the canonical archive.
+*
+* The canonical archive rebuilds `blocks`, `transactions`, and `events`
+* deterministically from R2 alone. Every stage downstream of those tables
+* (decoders, subgraphs, subscription delivery) has its own inputs, outputs,
+* and rebuild requirements — and an operator restoring from the archive
+* needs to know exactly which of those it also needs to source, replay, or
+* re-derive.
+*
+* This module defines the reporting shape. Each producer/service declares
+* itself once (a `ServiceManifest`) and the aggregator emits one report per
+* service to `reports/derived/<service>.json`. Stateful verification —
+* actually re-running the service and comparing outputs — is Phase 4 work
+* (see P4.10 effect manifests, P4.13 stateful deep verify); this shape is
+* what Phase 4 will populate.
+*
+* The report answers three operator questions:
+*   1. What canonical inputs does this service consume? (archive suffices)
+*   2. What external inputs does it need? (RPC endpoints, envelope journal,
+*      contract source, ORACLE feeds — anything not in the archive)
+*   3. If I restore from R2 alone, can this service resume? If not, what
+*      is missing?
+*
+* Silence is the failure mode we most want to prevent: a service that ships
+* without a manifest is a service whose rebuild story is undocumented.
+* `assertAllServicesDeclared()` fails a build when a known service is missing.
+*/
+declare const DERIVED_STAGE_REPORT_SCHEMA_VERSION: 1;
+type ServiceKind = "decoder" | "subgraph-runtime" | "subscription-runtime" | "protocol-producer";
+type CanonicalInput = "blocks" | "transactions" | "events";
+interface ExternalInput {
+	/** Short name for the dependency: `stacks-node-rpc`, `hiro-extended-api`,
+	*  `observer-journal`, `contract-source-registry`, etc. */
+	name: string;
+	/** Why the archive can't provide this. One sentence. */
+	reason: string;
+	/** Where an operator can source it. `bundled-stacks`, `own-node`,
+	*  `hiro-public-api`, `re-derive-from-events`, `manual-import`. */
+	source: string;
+	/** True if the archive supplies enough to re-derive this dependency
+	*  without a live external source. Rare but happens (e.g. contract ABIs
+	*  derivable from `transactions.raw_tx`). */
+	rebuildable_from_archive: boolean;
+}
+interface Output {
+	/** Table/topic/queue name in the operator's runtime. */
+	target: string;
+	/** How the operator verifies this output — e.g. `row-count`,
+	*  `semantic-digest`, `effect-manifest`, `dlq-empty`. */
+	verification: string;
+}
+interface ServiceManifest {
+	name: string;
+	kind: ServiceKind;
+	description: string;
+	canonical_inputs: CanonicalInput[];
+	external_inputs: ExternalInput[];
+	outputs: Output[];
+	/**
+	* Explicit judgment on whether R2 alone can rebuild this service.
+	* `false` REQUIRES `external_inputs` to name what else is needed.
+	*/
+	r2_alone_can_rebuild: boolean;
+	/** When true, this service can only replay forward from a starting point
+	*  the operator supplies (e.g. a webhook consumer's last-delivered id).
+	*  Publish it, don't hide it. */
+	requires_operator_state: boolean;
+	/** Repo path where the service lives, for cross-reference. */
+	source_path: string;
+}
+interface DerivedStageReport {
+	schema_version: typeof DERIVED_STAGE_REPORT_SCHEMA_VERSION;
+	generated_at: string;
+	services: ServiceManifest[];
+}
+/**
+* Compose a report from a set of registered manifests. Sorts services by name
+* so the JSON is stable across runs — a re-emit with unchanged manifests
+* produces byte-identical output, so an operator can diff two archive
+* publish cycles cleanly.
+*/
+declare function buildDerivedStageReport(manifests: ReadonlyArray<ServiceManifest>, generatedAt: string): DerivedStageReport;
+type ManifestValidationIssue = {
+	name: string
+	problem: string
+};
+/**
+* Enforce the invariants the report shape leaves ambiguous:
+*   - `r2_alone_can_rebuild: false` REQUIRES at least one external input.
+*     Otherwise the report claims a rebuild gap it can't explain, which is
+*     worse than declaring nothing.
+*   - Names are unique — a duplicate is almost always a copy-paste that
+*     silently shadows the earlier declaration.
+*   - Every canonical_input is a real dataset name.
+*/
+declare function validateServiceManifests(manifests: ReadonlyArray<ServiceManifest>): ManifestValidationIssue[];
+export { validateServiceManifests, buildDerivedStageReport, ServiceManifest, ServiceKind, Output, ManifestValidationIssue, ExternalInput, DerivedStageReport, DERIVED_STAGE_REPORT_SCHEMA_VERSION, CanonicalInput };

package/dist/src/archive/derived-stage-report.js

@@ -0,0 +1,64 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/archive/derived-stage-report.ts
+var DERIVED_STAGE_REPORT_SCHEMA_VERSION = 1;
+function buildDerivedStageReport(manifests, generatedAt) {
+  const sorted = [...manifests].sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    schema_version: DERIVED_STAGE_REPORT_SCHEMA_VERSION,
+    generated_at: generatedAt,
+    services: sorted
+  };
+}
+function validateServiceManifests(manifests) {
+  const issues = [];
+  const seen = new Set;
+  const canonicalDatasets = new Set([
+    "blocks",
+    "transactions",
+    "events"
+  ]);
+  for (const m of manifests) {
+    if (seen.has(m.name)) {
+      issues.push({ name: m.name, problem: "duplicate service name" });
+    }
+    seen.add(m.name);
+    if (!m.r2_alone_can_rebuild && m.external_inputs.length === 0) {
+      issues.push({
+        name: m.name,
+        problem: "declares r2_alone_can_rebuild=false but lists no external_inputs — the gap is undocumented"
+      });
+    }
+    for (const input of m.canonical_inputs) {
+      if (!canonicalDatasets.has(input)) {
+        issues.push({
+          name: m.name,
+          problem: `canonical_inputs contains unknown dataset: ${String(input)}`
+        });
+      }
+    }
+  }
+  return issues;
+}
+export {
+  validateServiceManifests,
+  buildDerivedStageReport,
+  DERIVED_STAGE_REPORT_SCHEMA_VERSION
+};
+
+//# debugId=C79406F0A3036B1164756E2164756E21
+//# sourceMappingURL=derived-stage-report.js.map

package/dist/src/archive/derived-stage-report.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/archive/derived-stage-report.ts"],
+  "sourcesContent": [
+    "/**\n * Derived-stage acceptance — what each service reads, writes, and needs\n * beyond the canonical archive.\n *\n * The canonical archive rebuilds `blocks`, `transactions`, and `events`\n * deterministically from R2 alone. Every stage downstream of those tables\n * (decoders, subgraphs, subscription delivery) has its own inputs, outputs,\n * and rebuild requirements — and an operator restoring from the archive\n * needs to know exactly which of those it also needs to source, replay, or\n * re-derive.\n *\n * This module defines the reporting shape. Each producer/service declares\n * itself once (a `ServiceManifest`) and the aggregator emits one report per\n * service to `reports/derived/<service>.json`. Stateful verification —\n * actually re-running the service and comparing outputs — is Phase 4 work\n * (see P4.10 effect manifests, P4.13 stateful deep verify); this shape is\n * what Phase 4 will populate.\n *\n * The report answers three operator questions:\n *   1. What canonical inputs does this service consume? (archive suffices)\n *   2. What external inputs does it need? (RPC endpoints, envelope journal,\n *      contract source, ORACLE feeds — anything not in the archive)\n *   3. If I restore from R2 alone, can this service resume? If not, what\n *      is missing?\n *\n * Silence is the failure mode we most want to prevent: a service that ships\n * without a manifest is a service whose rebuild story is undocumented.\n * `assertAllServicesDeclared()` fails a build when a known service is missing.\n */\n\nexport const DERIVED_STAGE_REPORT_SCHEMA_VERSION = 1 as const;\n\nexport type ServiceKind =\n\t| \"decoder\"\n\t| \"subgraph-runtime\"\n\t| \"subscription-runtime\"\n\t| \"protocol-producer\";\n\nexport type CanonicalInput = \"blocks\" | \"transactions\" | \"events\";\n\nexport interface ExternalInput {\n\t/** Short name for the dependency: `stacks-node-rpc`, `hiro-extended-api`,\n\t *  `observer-journal`, `contract-source-registry`, etc. */\n\tname: string;\n\t/** Why the archive can't provide this. One sentence. */\n\treason: string;\n\t/** Where an operator can source it. `bundled-stacks`, `own-node`,\n\t *  `hiro-public-api`, `re-derive-from-events`, `manual-import`. */\n\tsource: string;\n\t/** True if the archive supplies enough to re-derive this dependency\n\t *  without a live external source. Rare but happens (e.g. contract ABIs\n\t *  derivable from `transactions.raw_tx`). */\n\trebuildable_from_archive: boolean;\n}\n\nexport interface Output {\n\t/** Table/topic/queue name in the operator's runtime. */\n\ttarget: string;\n\t/** How the operator verifies this output — e.g. `row-count`,\n\t *  `semantic-digest`, `effect-manifest`, `dlq-empty`. */\n\tverification: string;\n}\n\nexport interface ServiceManifest {\n\tname: string;\n\tkind: ServiceKind;\n\tdescription: string;\n\tcanonical_inputs: CanonicalInput[];\n\texternal_inputs: ExternalInput[];\n\toutputs: Output[];\n\t/**\n\t * Explicit judgment on whether R2 alone can rebuild this service.\n\t * `false` REQUIRES `external_inputs` to name what else is needed.\n\t */\n\tr2_alone_can_rebuild: boolean;\n\t/** When true, this service can only replay forward from a starting point\n\t *  the operator supplies (e.g. a webhook consumer's last-delivered id).\n\t *  Publish it, don't hide it. */\n\trequires_operator_state: boolean;\n\t/** Repo path where the service lives, for cross-reference. */\n\tsource_path: string;\n}\n\nexport interface DerivedStageReport {\n\tschema_version: typeof DERIVED_STAGE_REPORT_SCHEMA_VERSION;\n\tgenerated_at: string;\n\tservices: ServiceManifest[];\n}\n\n/**\n * Compose a report from a set of registered manifests. Sorts services by name\n * so the JSON is stable across runs — a re-emit with unchanged manifests\n * produces byte-identical output, so an operator can diff two archive\n * publish cycles cleanly.\n */\nexport function buildDerivedStageReport(\n\tmanifests: ReadonlyArray<ServiceManifest>,\n\tgeneratedAt: string,\n): DerivedStageReport {\n\tconst sorted = [...manifests].sort((a, b) => a.name.localeCompare(b.name));\n\treturn {\n\t\tschema_version: DERIVED_STAGE_REPORT_SCHEMA_VERSION,\n\t\tgenerated_at: generatedAt,\n\t\tservices: sorted,\n\t};\n}\n\nexport type ManifestValidationIssue = {\n\tname: string;\n\tproblem: string;\n};\n\n/**\n * Enforce the invariants the report shape leaves ambiguous:\n *   - `r2_alone_can_rebuild: false` REQUIRES at least one external input.\n *     Otherwise the report claims a rebuild gap it can't explain, which is\n *     worse than declaring nothing.\n *   - Names are unique — a duplicate is almost always a copy-paste that\n *     silently shadows the earlier declaration.\n *   - Every canonical_input is a real dataset name.\n */\nexport function validateServiceManifests(\n\tmanifests: ReadonlyArray<ServiceManifest>,\n): ManifestValidationIssue[] {\n\tconst issues: ManifestValidationIssue[] = [];\n\tconst seen = new Set<string>();\n\tconst canonicalDatasets: ReadonlySet<CanonicalInput> = new Set([\n\t\t\"blocks\",\n\t\t\"transactions\",\n\t\t\"events\",\n\t]);\n\tfor (const m of manifests) {\n\t\tif (seen.has(m.name)) {\n\t\t\tissues.push({ name: m.name, problem: \"duplicate service name\" });\n\t\t}\n\t\tseen.add(m.name);\n\t\tif (!m.r2_alone_can_rebuild && m.external_inputs.length === 0) {\n\t\t\tissues.push({\n\t\t\t\tname: m.name,\n\t\t\t\tproblem:\n\t\t\t\t\t\"declares r2_alone_can_rebuild=false but lists no external_inputs — the gap is undocumented\",\n\t\t\t});\n\t\t}\n\t\tfor (const input of m.canonical_inputs) {\n\t\t\tif (!canonicalDatasets.has(input)) {\n\t\t\t\tissues.push({\n\t\t\t\t\tname: m.name,\n\t\t\t\t\tproblem: `canonical_inputs contains unknown dataset: ${String(input)}`,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t}\n\treturn issues;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;AA8BO,IAAM,sCAAsC;AAiE5C,SAAS,uBAAuB,CACtC,WACA,aACqB;AAAA,EACrB,MAAM,SAAS,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,EACzE,OAAO;AAAA,IACN,gBAAgB;AAAA,IAChB,cAAc;AAAA,IACd,UAAU;AAAA,EACX;AAAA;AAiBM,SAAS,wBAAwB,CACvC,WAC4B;AAAA,EAC5B,MAAM,SAAoC,CAAC;AAAA,EAC3C,MAAM,OAAO,IAAI;AAAA,EACjB,MAAM,oBAAiD,IAAI,IAAI;AAAA,IAC9D;AAAA,IACA;AAAA,IACA;AAAA,EACD,CAAC;AAAA,EACD,WAAW,KAAK,WAAW;AAAA,IAC1B,IAAI,KAAK,IAAI,EAAE,IAAI,GAAG;AAAA,MACrB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,yBAAyB,CAAC;AAAA,IAChE;AAAA,IACA,KAAK,IAAI,EAAE,IAAI;AAAA,IACf,IAAI,CAAC,EAAE,wBAAwB,EAAE,gBAAgB,WAAW,GAAG;AAAA,MAC9D,OAAO,KAAK;AAAA,QACX,MAAM,EAAE;AAAA,QACR,SACC;AAAA,MACF,CAAC;AAAA,IACF;AAAA,IACA,WAAW,SAAS,EAAE,kBAAkB;AAAA,MACvC,IAAI,CAAC,kBAAkB,IAAI,KAAK,GAAG;AAAA,QAClC,OAAO,KAAK;AAAA,UACX,MAAM,EAAE;AAAA,UACR,SAAS,8CAA8C,OAAO,KAAK;AAAA,QACpE,CAAC;AAAA,MACF;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "C79406F0A3036B1164756E2164756E21",
+  "names": []
+}

package/dist/src/archive/disk-guard.d.ts

@@ -0,0 +1,46 @@
+/**
+* Free-space guard for bulk archive jobs.
+*
+* Twice on 2026-08-12 a bulk job filled the disk that production Postgres
+* shares: a backfill died at 9.2M/14.4M rows on ENOSPC, and a restore died at
+* 86% of events. Prod survived both, but only just — 2.9GB free with the
+* indexer still ingesting.
+*
+* The failure mode that makes this worth guarding rather than monitoring: the
+* nightly `pg_basebackup` transiently consumes ~150GB, so a job that starts
+* with comfortable headroom can still hit the wall an hour later. Checking
+* once at startup is not enough; the check has to be repeated as the job runs.
+*
+* Waiting is the right response, not failing. The spike passes, and an
+* archive job that pauses for twenty minutes is strictly better than one that
+* dies at 86% or, worse, takes the database down with it.
+*/
+type DiskSpace = {
+	freeBytes: number
+	totalBytes: number
+};
+declare function readDiskSpace(path: string): Promise<DiskSpace>;
+type DiskGuardOptions = {
+	/** Any path on the filesystem to watch. */
+	path: string
+	/** Pause below this many bytes free. */
+	minFreeBytes?: number
+	/** How long to wait between re-checks while paused. */
+	pollMs?: number
+	/** Give up after this long rather than pausing forever. */
+	maxWaitMs?: number
+	onPause?: (free: DiskSpace, waitedMs: number) => void
+	sleep?: (ms: number) => Promise<void>
+	readSpace?: (path: string) => Promise<DiskSpace>
+};
+declare class DiskSpaceExhausted extends Error {
+	constructor(free: number, required: number, waitedMs: number);
+}
+/**
+* Block until there is enough headroom, or throw after `maxWaitMs`.
+*
+* Call this between units of work — before each partition, not once at the
+* start — because the pressure that matters arrives mid-job.
+*/
+declare function waitForDiskSpace(options: DiskGuardOptions): Promise<void>;
+export { waitForDiskSpace, readDiskSpace, DiskSpaceExhausted, DiskSpace, DiskGuardOptions };

package/dist/src/archive/disk-guard.js

@@ -0,0 +1,69 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/archive/disk-guard.ts
+import { statfs } from "node:fs/promises";
+async function readDiskSpace(path) {
+  const stats = await statfs(path);
+  return {
+    freeBytes: stats.bavail * stats.bsize,
+    totalBytes: stats.blocks * stats.bsize
+  };
+}
+var DEFAULT_MIN_FREE_BYTES = 100 * 1024 ** 3;
+var DEFAULT_POLL_MS = 60000;
+var DEFAULT_MAX_WAIT_MS = 2 * 3600000;
+var MAX_THRESHOLD_FRACTION_OF_DISK = 0.25;
+function effectiveThreshold(configured, totalBytes) {
+  if (!Number.isFinite(totalBytes) || totalBytes <= 0)
+    return configured;
+  return Math.min(configured, totalBytes * MAX_THRESHOLD_FRACTION_OF_DISK);
+}
+
+class DiskSpaceExhausted extends Error {
+  constructor(free, required, waitedMs) {
+    super(`only ${(free / 1024 ** 3).toFixed(1)}GB free (need ${(required / 1024 ** 3).toFixed(1)}GB) after waiting ${Math.round(waitedMs / 60000)}m`);
+    this.name = "DiskSpaceExhausted";
+  }
+}
+async function waitForDiskSpace(options) {
+  const minFree = options.minFreeBytes ?? DEFAULT_MIN_FREE_BYTES;
+  const pollMs = options.pollMs ?? DEFAULT_POLL_MS;
+  const maxWaitMs = options.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+  const readSpace = options.readSpace ?? readDiskSpace;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let waited = 0;
+  while (true) {
+    const space = await readSpace(options.path);
+    const threshold = effectiveThreshold(minFree, space.totalBytes);
+    if (space.freeBytes >= threshold)
+      return;
+    if (waited >= maxWaitMs) {
+      throw new DiskSpaceExhausted(space.freeBytes, threshold, waited);
+    }
+    options.onPause?.(space, waited);
+    await sleep(pollMs);
+    waited += pollMs;
+  }
+}
+export {
+  waitForDiskSpace,
+  readDiskSpace,
+  DiskSpaceExhausted
+};
+
+//# debugId=F49523DF35B78F5364756E2164756E21
+//# sourceMappingURL=disk-guard.js.map

package/dist/src/archive/disk-guard.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/archive/disk-guard.ts"],
+  "sourcesContent": [
+    "import { statfs } from \"node:fs/promises\";\n\n/**\n * Free-space guard for bulk archive jobs.\n *\n * Twice on 2026-08-12 a bulk job filled the disk that production Postgres\n * shares: a backfill died at 9.2M/14.4M rows on ENOSPC, and a restore died at\n * 86% of events. Prod survived both, but only just — 2.9GB free with the\n * indexer still ingesting.\n *\n * The failure mode that makes this worth guarding rather than monitoring: the\n * nightly `pg_basebackup` transiently consumes ~150GB, so a job that starts\n * with comfortable headroom can still hit the wall an hour later. Checking\n * once at startup is not enough; the check has to be repeated as the job runs.\n *\n * Waiting is the right response, not failing. The spike passes, and an\n * archive job that pauses for twenty minutes is strictly better than one that\n * dies at 86% or, worse, takes the database down with it.\n */\n\nexport type DiskSpace = { freeBytes: number; totalBytes: number };\n\nexport async function readDiskSpace(path: string): Promise<DiskSpace> {\n\tconst stats = await statfs(path);\n\treturn {\n\t\tfreeBytes: stats.bavail * stats.bsize,\n\t\ttotalBytes: stats.blocks * stats.bsize,\n\t};\n}\n\nexport type DiskGuardOptions = {\n\t/** Any path on the filesystem to watch. */\n\tpath: string;\n\t/** Pause below this many bytes free. */\n\tminFreeBytes?: number;\n\t/** How long to wait between re-checks while paused. */\n\tpollMs?: number;\n\t/** Give up after this long rather than pausing forever. */\n\tmaxWaitMs?: number;\n\tonPause?: (free: DiskSpace, waitedMs: number) => void;\n\tsleep?: (ms: number) => Promise<void>;\n\treadSpace?: (path: string) => Promise<DiskSpace>;\n};\n\n/** 100GB: comfortably above the ~39GB an export needs plus the backup spike. */\nconst DEFAULT_MIN_FREE_BYTES = 100 * 1024 ** 3;\nconst DEFAULT_POLL_MS = 60_000;\nconst DEFAULT_MAX_WAIT_MS = 2 * 3_600_000;\n/**\n * A threshold larger than a share of the whole disk is unsatisfiable, not\n * protective: on a 14GB CI runner or a modest VPS, demanding 100GB free would\n * block forever waiting for space that machine can never have. The absolute\n * default is tuned for the production host; this keeps it from becoming a wall\n * everywhere else.\n */\nconst MAX_THRESHOLD_FRACTION_OF_DISK = 0.25;\n\nfunction effectiveThreshold(configured: number, totalBytes: number): number {\n\tif (!Number.isFinite(totalBytes) || totalBytes <= 0) return configured;\n\treturn Math.min(configured, totalBytes * MAX_THRESHOLD_FRACTION_OF_DISK);\n}\n\nexport class DiskSpaceExhausted extends Error {\n\tconstructor(free: number, required: number, waitedMs: number) {\n\t\tsuper(\n\t\t\t`only ${(free / 1024 ** 3).toFixed(1)}GB free (need ${(required / 1024 ** 3).toFixed(1)}GB) after waiting ${Math.round(waitedMs / 60_000)}m`,\n\t\t);\n\t\tthis.name = \"DiskSpaceExhausted\";\n\t}\n}\n\n/**\n * Block until there is enough headroom, or throw after `maxWaitMs`.\n *\n * Call this between units of work — before each partition, not once at the\n * start — because the pressure that matters arrives mid-job.\n */\nexport async function waitForDiskSpace(\n\toptions: DiskGuardOptions,\n): Promise<void> {\n\tconst minFree = options.minFreeBytes ?? DEFAULT_MIN_FREE_BYTES;\n\tconst pollMs = options.pollMs ?? DEFAULT_POLL_MS;\n\tconst maxWaitMs = options.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;\n\tconst readSpace = options.readSpace ?? readDiskSpace;\n\tconst sleep =\n\t\toptions.sleep ??\n\t\t((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));\n\n\tlet waited = 0;\n\twhile (true) {\n\t\tconst space = await readSpace(options.path);\n\t\tconst threshold = effectiveThreshold(minFree, space.totalBytes);\n\t\tif (space.freeBytes >= threshold) return;\n\t\tif (waited >= maxWaitMs) {\n\t\t\tthrow new DiskSpaceExhausted(space.freeBytes, threshold, waited);\n\t\t}\n\t\toptions.onPause?.(space, waited);\n\t\tawait sleep(pollMs);\n\t\twaited += pollMs;\n\t}\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAsBA,eAAsB,aAAa,CAAC,MAAkC;AAAA,EACrE,MAAM,QAAQ,MAAM,OAAO,IAAI;AAAA,EAC/B,OAAO;AAAA,IACN,WAAW,MAAM,SAAS,MAAM;AAAA,IAChC,YAAY,MAAM,SAAS,MAAM;AAAA,EAClC;AAAA;AAkBD,IAAM,yBAAyB,MAAM,QAAQ;AAC7C,IAAM,kBAAkB;AACxB,IAAM,sBAAsB,IAAI;AAQhC,IAAM,iCAAiC;AAEvC,SAAS,kBAAkB,CAAC,YAAoB,YAA4B;AAAA,EAC3E,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc;AAAA,IAAG,OAAO;AAAA,EAC5D,OAAO,KAAK,IAAI,YAAY,aAAa,8BAA8B;AAAA;AAAA;AAGjE,MAAM,2BAA2B,MAAM;AAAA,EAC7C,WAAW,CAAC,MAAc,UAAkB,UAAkB;AAAA,IAC7D,MACC,SAAS,OAAO,QAAQ,GAAG,QAAQ,CAAC,mBAAmB,WAAW,QAAQ,GAAG,QAAQ,CAAC,sBAAsB,KAAK,MAAM,WAAW,KAAM,IACzI;AAAA,IACA,KAAK,OAAO;AAAA;AAEd;AAQA,eAAsB,gBAAgB,CACrC,SACgB;AAAA,EAChB,MAAM,UAAU,QAAQ,gBAAgB;AAAA,EACxC,MAAM,SAAS,QAAQ,UAAU;AAAA,EACjC,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,YAAY,QAAQ,aAAa;AAAA,EACvC,MAAM,QACL,QAAQ,UACP,CAAC,OAAe,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,EAExE,IAAI,SAAS;AAAA,EACb,OAAO,MAAM;AAAA,IACZ,MAAM,QAAQ,MAAM,UAAU,QAAQ,IAAI;AAAA,IAC1C,MAAM,YAAY,mBAAmB,SAAS,MAAM,UAAU;AAAA,IAC9D,IAAI,MAAM,aAAa;AAAA,MAAW;AAAA,IAClC,IAAI,UAAU,WAAW;AAAA,MACxB,MAAM,IAAI,mBAAmB,MAAM,WAAW,WAAW,MAAM;AAAA,IAChE;AAAA,IACA,QAAQ,UAAU,OAAO,MAAM;AAAA,IAC/B,MAAM,MAAM,MAAM;AAAA,IAClB,UAAU;AAAA,EACX;AAAA;",
+  "debugId": "F49523DF35B78F5364756E2164756E21",
+  "names": []
+}

package/dist/src/archive/key-registry.d.ts

@@ -0,0 +1,52 @@
+/**\\n* Trust root for the canonical archive.\\n*\\n* Day-to-day signing uses an ONLINE key that lives on the publishing host, so\\n* it is exposed to every risk that host is. The archive's actual trust anchor\\n* is an OFFLINE ROOT key that never touches a server: it signs a registry of\\n* online keys, and nothing else. A consumer pins the root public key, verifies\\n* the registry against it, and only then decides whether a manifest's signature\\n* means anything.\\n*\\n* The distinction that makes rotation survivable:\\n*\\n*   retired / rotated → the key stops signing NEW objects, but everything it\\n*                       signed while valid stays valid. Without this, every\\n*                       rotation would invalidate the entire published history.\\n*   compromised       → every signature by that key is suspect, including\\n*                       historical ones, because an attacker holding the key\\n*                       could have backdated anything.\\n*\\n* Those two cases look identical in a naive "is this key current?" check, and\\n* conflating them either destroys your history on every rotation or accepts\\n* forgeries after a leak.\\n*/
+declare const KEY_REGISTRY_SCHEMA_VERSION = 1;
+type KeyStatus = "active" | "retired" | "compromised";
+type RegisteredKey = {
+	key_id: string
+	public_key_pem: string
+	status: KeyStatus
+	/** ISO timestamp this key became valid for signing. */
+	valid_from: string
+	/** ISO timestamp it stopped signing. Null while active. */
+	valid_until: string | null
+	/** For `compromised`: the moment trust is withdrawn. Everything this key
+	*  signed is suspect regardless of when, so this is provenance, not a
+	*  validity bound. */
+	compromised_at?: string
+};
+type KeyRegistry = {
+	schema_version: typeof KEY_REGISTRY_SCHEMA_VERSION
+	network: string
+	keys: RegisteredKey[]
+	updated_at: string
+	/** Root signature over the registry minus this envelope. */
+	signature?: string
+	root_key_id?: string
+};
+type KeyTrustResult = {
+	trusted: boolean
+	/** Machine-readable so callers can map to exit codes and messages. */
+	reason: "trusted" | "registry-unsigned" | "registry-signature-invalid" | "unknown-key" | "key-compromised" | "signed-outside-validity"
+	detail: string
+};
+/** The exact bytes the root signature covers: the registry minus its envelope. */
+declare function canonicalRegistryPayload(registry: KeyRegistry): string;
+/**
+* Verify the registry itself against the pinned root public key. Everything
+* downstream is meaningless if this fails — an attacker who can serve a
+* registry can otherwise nominate their own signing key.
+*/
+declare function verifyRegistry(registry: KeyRegistry, rootPublicKeyPem: string): KeyTrustResult;
+/**
+* Decide whether an object signed by `keyId` at `signedAt` should be trusted.
+*
+* `signedAt` is the object's own generation time, NOT now — that is what lets a
+* rotated key keep vouching for what it signed while it was valid.
+*/
+declare function checkKeyTrust(registry: KeyRegistry, keyId: string, signedAt: string): KeyTrustResult;
+/** Look up a key's public PEM for signature verification. */
+declare function publicKeyFor(registry: KeyRegistry, keyId: string): string | undefined;
+/** Derive the registry entry id for a public key, so operators cannot mislabel
+*  a key by hand-editing the registry. */
+declare function keyIdFor(publicKeyPem: string): string;
+export { verifyRegistry, publicKeyFor, keyIdFor, checkKeyTrust, canonicalRegistryPayload, RegisteredKey, KeyTrustResult, KeyStatus, KeyRegistry, KEY_REGISTRY_SCHEMA_VERSION };

package/dist/src/archive/key-registry.js

@@ -0,0 +1,168 @@
+import { createRequire } from "node:module";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/crypto/ed25519.ts
+var exports_ed25519 = {};
+__export(exports_ed25519, {
+  verifyEd25519: () => verifyEd25519,
+  signEd25519: () => signEd25519,
+  publicKeyPemFromPrivate: () => publicKeyPemFromPrivate,
+  loadEd25519PublicKey: () => loadEd25519PublicKey,
+  loadEd25519PrivateKey: () => loadEd25519PrivateKey,
+  generateEd25519KeyPair: () => generateEd25519KeyPair,
+  ed25519KeyId: () => ed25519KeyId
+});
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign as nodeSign,
+  verify as nodeVerify
+} from "node:crypto";
+function generateEd25519KeyPair() {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  return {
+    privateKeyPem: privateKey.export({ format: "pem", type: "pkcs8" }).toString(),
+    publicKeyPem: publicKey.export({ format: "pem", type: "spki" }).toString()
+  };
+}
+function loadEd25519PrivateKey(pem) {
+  return createPrivateKey(pem);
+}
+function loadEd25519PublicKey(pem) {
+  return createPublicKey(pem);
+}
+function publicKeyPemFromPrivate(privateKeyPem) {
+  return createPublicKey(createPrivateKey(privateKeyPem)).export({ format: "pem", type: "spki" }).toString();
+}
+function ed25519KeyId(publicKeyPem) {
+  const der = createPublicKey(publicKeyPem).export({
+    format: "der",
+    type: "spki"
+  });
+  return createHash("sha256").update(der).digest("base64url").slice(0, 16);
+}
+function signEd25519(payload, privateKey) {
+  return nodeSign(null, Buffer.from(payload, "utf8"), privateKey).toString("base64");
+}
+function verifyEd25519(payload, signatureBase64, publicKey) {
+  try {
+    return nodeVerify(null, Buffer.from(payload, "utf8"), publicKey, Buffer.from(signatureBase64, "base64"));
+  } catch {
+    return false;
+  }
+}
+
+// src/archive/key-registry.ts
+var KEY_REGISTRY_SCHEMA_VERSION = 1;
+function canonicalRegistryPayload(registry) {
+  const { signature: _s, root_key_id: _r, ...rest } = registry;
+  return JSON.stringify(rest);
+}
+function verifyRegistry(registry, rootPublicKeyPem) {
+  if (!registry.signature) {
+    return {
+      trusted: false,
+      reason: "registry-unsigned",
+      detail: "key registry carries no root signature"
+    };
+  }
+  let valid = false;
+  try {
+    valid = verifyEd25519(canonicalRegistryPayload(registry), registry.signature, loadEd25519PublicKey(rootPublicKeyPem));
+  } catch (err) {
+    return {
+      trusted: false,
+      reason: "registry-signature-invalid",
+      detail: err instanceof Error ? err.message : "root verification failed"
+    };
+  }
+  return valid ? {
+    trusted: true,
+    reason: "trusted",
+    detail: "registry verified against root"
+  } : {
+    trusted: false,
+    reason: "registry-signature-invalid",
+    detail: "registry signature does not match the pinned root key"
+  };
+}
+function checkKeyTrust(registry, keyId, signedAt) {
+  const key = registry.keys.find((k) => k.key_id === keyId);
+  if (!key) {
+    return {
+      trusted: false,
+      reason: "unknown-key",
+      detail: `key ${keyId} is not in the registry`
+    };
+  }
+  if (key.status === "compromised") {
+    return {
+      trusted: false,
+      reason: "key-compromised",
+      detail: `key ${keyId} was compromised${key.compromised_at ? ` (${key.compromised_at})` : ""}; every signature it made is suspect`
+    };
+  }
+  const signedTime = Date.parse(signedAt);
+  const from = Date.parse(key.valid_from);
+  if (Number.isNaN(signedTime) || Number.isNaN(from)) {
+    return {
+      trusted: false,
+      reason: "signed-outside-validity",
+      detail: "unparseable timestamp on the object or the key"
+    };
+  }
+  if (signedTime < from) {
+    return {
+      trusted: false,
+      reason: "signed-outside-validity",
+      detail: `object predates key validity (${signedAt} < ${key.valid_from})`
+    };
+  }
+  if (key.valid_until !== null) {
+    const until = Date.parse(key.valid_until);
+    if (!Number.isNaN(until) && signedTime > until) {
+      return {
+        trusted: false,
+        reason: "signed-outside-validity",
+        detail: `object postdates key retirement (${signedAt} > ${key.valid_until})`
+      };
+    }
+  }
+  return {
+    trusted: true,
+    reason: "trusted",
+    detail: key.status === "active" ? `signed by active key ${keyId}` : `signed by ${keyId} while it was valid (now ${key.status})`
+  };
+}
+function publicKeyFor(registry, keyId) {
+  return registry.keys.find((k) => k.key_id === keyId)?.public_key_pem;
+}
+function keyIdFor(publicKeyPem) {
+  return ed25519KeyId(publicKeyPem);
+}
+export {
+  verifyRegistry,
+  publicKeyFor,
+  keyIdFor,
+  checkKeyTrust,
+  canonicalRegistryPayload,
+  KEY_REGISTRY_SCHEMA_VERSION
+};
+
+//# debugId=06FAC7E08C33616364756E2164756E21
+//# sourceMappingURL=key-registry.js.map

package/dist/src/archive/key-registry.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/crypto/ed25519.ts", "../src/archive/key-registry.ts"],
+  "sourcesContent": [
+    "import {\n\ttype KeyObject,\n\tcreateHash,\n\tcreatePrivateKey,\n\tcreatePublicKey,\n\tgenerateKeyPairSync,\n\tsign as nodeSign,\n\tverify as nodeVerify,\n} from \"node:crypto\";\n\n/**\n * Asymmetric ed25519 signing for Streams response proofs.\n *\n * Asymmetric (not HMAC) so the proof is real: only the server holds the private\n * key, and any consumer verifies with the published public key — no shared\n * secret to leak. ed25519 uses node's `sign`/`verify` with a `null` algorithm.\n * Keys are PEM (PKCS8 private / SPKI public) for env transport; load once and\n * reuse the KeyObject on hot paths.\n */\n\nexport function generateEd25519KeyPair(): {\n\tprivateKeyPem: string;\n\tpublicKeyPem: string;\n} {\n\tconst { privateKey, publicKey } = generateKeyPairSync(\"ed25519\");\n\treturn {\n\t\tprivateKeyPem: privateKey\n\t\t\t.export({ format: \"pem\", type: \"pkcs8\" })\n\t\t\t.toString(),\n\t\tpublicKeyPem: publicKey.export({ format: \"pem\", type: \"spki\" }).toString(),\n\t};\n}\n\nexport function loadEd25519PrivateKey(pem: string): KeyObject {\n\treturn createPrivateKey(pem);\n}\n\nexport function loadEd25519PublicKey(pem: string): KeyObject {\n\treturn createPublicKey(pem);\n}\n\nexport function publicKeyPemFromPrivate(privateKeyPem: string): string {\n\treturn createPublicKey(createPrivateKey(privateKeyPem))\n\t\t.export({ format: \"pem\", type: \"spki\" })\n\t\t.toString();\n}\n\n/** Stable short id for a public key (rotation hint via X-Signature-KeyId). */\nexport function ed25519KeyId(publicKeyPem: string): string {\n\tconst der = createPublicKey(publicKeyPem).export({\n\t\tformat: \"der\",\n\t\ttype: \"spki\",\n\t});\n\treturn createHash(\"sha256\").update(der).digest(\"base64url\").slice(0, 16);\n}\n\nexport function signEd25519(payload: string, privateKey: KeyObject): string {\n\treturn nodeSign(null, Buffer.from(payload, \"utf8\"), privateKey).toString(\n\t\t\"base64\",\n\t);\n}\n\nexport function verifyEd25519(\n\tpayload: string,\n\tsignatureBase64: string,\n\tpublicKey: KeyObject,\n): boolean {\n\ttry {\n\t\treturn nodeVerify(\n\t\t\tnull,\n\t\t\tBuffer.from(payload, \"utf8\"),\n\t\t\tpublicKey,\n\t\t\tBuffer.from(signatureBase64, \"base64\"),\n\t\t);\n\t} catch {\n\t\treturn false;\n\t}\n}\n",
+    "import {\n\ted25519KeyId,\n\tloadEd25519PublicKey,\n\tverifyEd25519,\n} from \"../crypto/ed25519.ts\";\n\n/**\n * Trust root for the canonical archive.\n *\n * Day-to-day signing uses an ONLINE key that lives on the publishing host, so\n * it is exposed to every risk that host is. The archive's actual trust anchor\n * is an OFFLINE ROOT key that never touches a server: it signs a registry of\n * online keys, and nothing else. A consumer pins the root public key, verifies\n * the registry against it, and only then decides whether a manifest's signature\n * means anything.\n *\n * The distinction that makes rotation survivable:\n *\n *   retired / rotated → the key stops signing NEW objects, but everything it\n *                       signed while valid stays valid. Without this, every\n *                       rotation would invalidate the entire published history.\n *   compromised       → every signature by that key is suspect, including\n *                       historical ones, because an attacker holding the key\n *                       could have backdated anything.\n *\n * Those two cases look identical in a naive \"is this key current?\" check, and\n * conflating them either destroys your history on every rotation or accepts\n * forgeries after a leak.\n */\n\nexport const KEY_REGISTRY_SCHEMA_VERSION = 1;\n\nexport type KeyStatus = \"active\" | \"retired\" | \"compromised\";\n\nexport type RegisteredKey = {\n\tkey_id: string;\n\tpublic_key_pem: string;\n\tstatus: KeyStatus;\n\t/** ISO timestamp this key became valid for signing. */\n\tvalid_from: string;\n\t/** ISO timestamp it stopped signing. Null while active. */\n\tvalid_until: string | null;\n\t/** For `compromised`: the moment trust is withdrawn. Everything this key\n\t *  signed is suspect regardless of when, so this is provenance, not a\n\t *  validity bound. */\n\tcompromised_at?: string;\n};\n\nexport type KeyRegistry = {\n\tschema_version: typeof KEY_REGISTRY_SCHEMA_VERSION;\n\tnetwork: string;\n\tkeys: RegisteredKey[];\n\tupdated_at: string;\n\t/** Root signature over the registry minus this envelope. */\n\tsignature?: string;\n\troot_key_id?: string;\n};\n\nexport type KeyTrustResult = {\n\ttrusted: boolean;\n\t/** Machine-readable so callers can map to exit codes and messages. */\n\treason:\n\t\t| \"trusted\"\n\t\t| \"registry-unsigned\"\n\t\t| \"registry-signature-invalid\"\n\t\t| \"unknown-key\"\n\t\t| \"key-compromised\"\n\t\t| \"signed-outside-validity\";\n\tdetail: string;\n};\n\n/** The exact bytes the root signature covers: the registry minus its envelope. */\nexport function canonicalRegistryPayload(registry: KeyRegistry): string {\n\tconst { signature: _s, root_key_id: _r, ...rest } = registry;\n\treturn JSON.stringify(rest);\n}\n\n/**\n * Verify the registry itself against the pinned root public key. Everything\n * downstream is meaningless if this fails — an attacker who can serve a\n * registry can otherwise nominate their own signing key.\n */\nexport function verifyRegistry(\n\tregistry: KeyRegistry,\n\trootPublicKeyPem: string,\n): KeyTrustResult {\n\tif (!registry.signature) {\n\t\treturn {\n\t\t\ttrusted: false,\n\t\t\treason: \"registry-unsigned\",\n\t\t\tdetail: \"key registry carries no root signature\",\n\t\t};\n\t}\n\tlet valid = false;\n\ttry {\n\t\tvalid = verifyEd25519(\n\t\t\tcanonicalRegistryPayload(registry),\n\t\t\tregistry.signature,\n\t\t\tloadEd25519PublicKey(rootPublicKeyPem),\n\t\t);\n\t} catch (err) {\n\t\treturn {\n\t\t\ttrusted: false,\n\t\t\treason: \"registry-signature-invalid\",\n\t\t\tdetail: err instanceof Error ? err.message : \"root verification failed\",\n\t\t};\n\t}\n\treturn valid\n\t\t? {\n\t\t\t\ttrusted: true,\n\t\t\t\treason: \"trusted\",\n\t\t\t\tdetail: \"registry verified against root\",\n\t\t\t}\n\t\t: {\n\t\t\t\ttrusted: false,\n\t\t\t\treason: \"registry-signature-invalid\",\n\t\t\t\tdetail: \"registry signature does not match the pinned root key\",\n\t\t\t};\n}\n\n/**\n * Decide whether an object signed by `keyId` at `signedAt` should be trusted.\n *\n * `signedAt` is the object's own generation time, NOT now — that is what lets a\n * rotated key keep vouching for what it signed while it was valid.\n */\nexport function checkKeyTrust(\n\tregistry: KeyRegistry,\n\tkeyId: string,\n\tsignedAt: string,\n): KeyTrustResult {\n\tconst key = registry.keys.find((k) => k.key_id === keyId);\n\tif (!key) {\n\t\treturn {\n\t\t\ttrusted: false,\n\t\t\treason: \"unknown-key\",\n\t\t\tdetail: `key ${keyId} is not in the registry`,\n\t\t};\n\t}\n\tif (key.status === \"compromised\") {\n\t\treturn {\n\t\t\ttrusted: false,\n\t\t\treason: \"key-compromised\",\n\t\t\tdetail: `key ${keyId} was compromised${key.compromised_at ? ` (${key.compromised_at})` : \"\"}; every signature it made is suspect`,\n\t\t};\n\t}\n\n\tconst signedTime = Date.parse(signedAt);\n\tconst from = Date.parse(key.valid_from);\n\tif (Number.isNaN(signedTime) || Number.isNaN(from)) {\n\t\treturn {\n\t\t\ttrusted: false,\n\t\t\treason: \"signed-outside-validity\",\n\t\t\tdetail: \"unparseable timestamp on the object or the key\",\n\t\t};\n\t}\n\tif (signedTime < from) {\n\t\treturn {\n\t\t\ttrusted: false,\n\t\t\treason: \"signed-outside-validity\",\n\t\t\tdetail: `object predates key validity (${signedAt} < ${key.valid_from})`,\n\t\t};\n\t}\n\tif (key.valid_until !== null) {\n\t\tconst until = Date.parse(key.valid_until);\n\t\tif (!Number.isNaN(until) && signedTime > until) {\n\t\t\treturn {\n\t\t\t\ttrusted: false,\n\t\t\t\treason: \"signed-outside-validity\",\n\t\t\t\tdetail: `object postdates key retirement (${signedAt} > ${key.valid_until})`,\n\t\t\t};\n\t\t}\n\t}\n\n\t// A retired key that was valid at signing time is fine — that is the whole\n\t// point of recording a validity window rather than a boolean.\n\treturn {\n\t\ttrusted: true,\n\t\treason: \"trusted\",\n\t\tdetail:\n\t\t\tkey.status === \"active\"\n\t\t\t\t? `signed by active key ${keyId}`\n\t\t\t\t: `signed by ${keyId} while it was valid (now ${key.status})`,\n\t};\n}\n\n/** Look up a key's public PEM for signature verification. */\nexport function publicKeyFor(\n\tregistry: KeyRegistry,\n\tkeyId: string,\n): string | undefined {\n\treturn registry.keys.find((k) => k.key_id === keyId)?.public_key_pem;\n}\n\n/** Derive the registry entry id for a public key, so operators cannot mislabel\n *  a key by hand-editing the registry. */\nexport function keyIdFor(publicKeyPem: string): string {\n\treturn ed25519KeyId(publicKeyPem);\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMC;AAAA,YACA;AAAA;AAaM,SAAS,sBAAsB,GAGpC;AAAA,EACD,QAAQ,YAAY,cAAc,oBAAoB,SAAS;AAAA,EAC/D,OAAO;AAAA,IACN,eAAe,WACb,OAAO,EAAE,QAAQ,OAAO,MAAM,QAAQ,CAAC,EACvC,SAAS;AAAA,IACX,cAAc,UAAU,OAAO,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC,EAAE,SAAS;AAAA,EAC1E;AAAA;AAGM,SAAS,qBAAqB,CAAC,KAAwB;AAAA,EAC7D,OAAO,iBAAiB,GAAG;AAAA;AAGrB,SAAS,oBAAoB,CAAC,KAAwB;AAAA,EAC5D,OAAO,gBAAgB,GAAG;AAAA;AAGpB,SAAS,uBAAuB,CAAC,eAA+B;AAAA,EACtE,OAAO,gBAAgB,iBAAiB,aAAa,CAAC,EACpD,OAAO,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC,EACtC,SAAS;AAAA;AAIL,SAAS,YAAY,CAAC,cAA8B;AAAA,EAC1D,MAAM,MAAM,gBAAgB,YAAY,EAAE,OAAO;AAAA,IAChD,QAAQ;AAAA,IACR,MAAM;AAAA,EACP,CAAC;AAAA,EACD,OAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,WAAW,EAAE,MAAM,GAAG,EAAE;AAAA;AAGjE,SAAS,WAAW,CAAC,SAAiB,YAA+B;AAAA,EAC3E,OAAO,SAAS,MAAM,OAAO,KAAK,SAAS,MAAM,GAAG,UAAU,EAAE,SAC/D,QACD;AAAA;AAGM,SAAS,aAAa,CAC5B,SACA,iBACA,WACU;AAAA,EACV,IAAI;AAAA,IACH,OAAO,WACN,MACA,OAAO,KAAK,SAAS,MAAM,GAC3B,WACA,OAAO,KAAK,iBAAiB,QAAQ,CACtC;AAAA,IACC,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;;;AC7CF,IAAM,8BAA8B;AA0CpC,SAAS,wBAAwB,CAAC,UAA+B;AAAA,EACvE,QAAQ,WAAW,IAAI,aAAa,OAAO,SAAS;AAAA,EACpD,OAAO,KAAK,UAAU,IAAI;AAAA;AAQpB,SAAS,cAAc,CAC7B,UACA,kBACiB;AAAA,EACjB,IAAI,CAAC,SAAS,WAAW;AAAA,IACxB,OAAO;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,IACT;AAAA,EACD;AAAA,EACA,IAAI,QAAQ;AAAA,EACZ,IAAI;AAAA,IACH,QAAQ,cACP,yBAAyB,QAAQ,GACjC,SAAS,WACT,qBAAqB,gBAAgB,CACtC;AAAA,IACC,OAAO,KAAK;AAAA,IACb,OAAO;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ,eAAe,QAAQ,IAAI,UAAU;AAAA,IAC9C;AAAA;AAAA,EAED,OAAO,QACJ;AAAA,IACA,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,QAAQ;AAAA,EACT,IACC;AAAA,IACA,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,QAAQ;AAAA,EACT;AAAA;AASI,SAAS,aAAa,CAC5B,UACA,OACA,UACiB;AAAA,EACjB,MAAM,MAAM,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,WAAW,KAAK;AAAA,EACxD,IAAI,CAAC,KAAK;AAAA,IACT,OAAO;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,IAChB;AAAA,EACD;AAAA,EACA,IAAI,IAAI,WAAW,eAAe;AAAA,IACjC,OAAO;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ,OAAO,wBAAwB,IAAI,iBAAiB,KAAK,IAAI,oBAAoB;AAAA,IAC1F;AAAA,EACD;AAAA,EAEA,MAAM,aAAa,KAAK,MAAM,QAAQ;AAAA,EACtC,MAAM,OAAO,KAAK,MAAM,IAAI,UAAU;AAAA,EACtC,IAAI,OAAO,MAAM,UAAU,KAAK,OAAO,MAAM,IAAI,GAAG;AAAA,IACnD,OAAO;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,IACT;AAAA,EACD;AAAA,EACA,IAAI,aAAa,MAAM;AAAA,IACtB,OAAO;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ,iCAAiC,cAAc,IAAI;AAAA,IAC5D;AAAA,EACD;AAAA,EACA,IAAI,IAAI,gBAAgB,MAAM;AAAA,IAC7B,MAAM,QAAQ,KAAK,MAAM,IAAI,WAAW;AAAA,IACxC,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,aAAa,OAAO;AAAA,MAC/C,OAAO;AAAA,QACN,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ,oCAAoC,cAAc,IAAI;AAAA,MAC/D;AAAA,IACD;AAAA,EACD;AAAA,EAIA,OAAO;AAAA,IACN,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,QACC,IAAI,WAAW,WACZ,wBAAwB,UACxB,aAAa,iCAAiC,IAAI;AAAA,EACvD;AAAA;AAIM,SAAS,YAAY,CAC3B,UACA,OACqB;AAAA,EACrB,OAAO,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,WAAW,KAAK,GAAG;AAAA;AAKhD,SAAS,QAAQ,CAAC,cAA8B;AAAA,EACtD,OAAO,aAAa,YAAY;AAAA;",
+  "debugId": "06FAC7E08C33616364756E2164756E21",
+  "names": []
+}