@sentropic/h2a 0.85.25 → 0.87.0

package/dist/runtime/mirror/index.js

@@ -4,6 +4,9 @@
  * P1: instances only. Core stays dep-free; this lives in @sentropic/h2a.
  */
 export { buildInstanceMirror, H2A_MIRROR_BODY_KIND } from "./build.js";
+export { MIRROR_ENDPOINT_PLAN, MIRROR_INTERESTS_PLAN, MIRROR_PRESENCE_PLAN, MIRROR_REGISTRATION_PLAN, MIRROR_SUBAGENT_PLAN, MIRROR_TEST_HOOKS, MIRROR_VERSION_PLAN, MIRROR_WORKSPACE_PLAN, sanitizeActorForMirror, sanitizePresenceForMirror, sanitizeRegistrationForMirror, sanitizeSubagentForMirror, sanitizeWorkspaceRefForMirror, unclassifiedMirrorFields } from "./sanitize.js";
 export { acceptMirrorEnvelope } from "./accept.js";
+export { INGEST_NARROWERS, createNarrowingTally, droppedKeyPaths, narrowIngestedPresence, narrowIngestedRegistration, narrowIngestedSubagent } from "./ingest.js";
 export { mirrorServerForStore, mirrorRejectionStatus } from "./serve.js";
+export { createMirrorPushRunner, isPushableHttpUrl, mirrorPushGloballyDisabled, redactEndpoint, runMirrorPushDaemon, sanitizeForLog, DEFAULT_MIRROR_AUTH_FAILURE_LIMIT, DEFAULT_MIRROR_BUILD_FAILURE_LIMIT, DEFAULT_MIRROR_PUSH_INTERVAL_MS, DEFAULT_MIRROR_REJECT_LIMIT, MIN_MIRROR_PUSH_INTERVAL_MS, MIRROR_PUSH_BACKOFF_BASE_MS, MIRROR_PUSH_BACKOFF_MAX_MS, MIRROR_PUSH_BUILD_FAILED_MESSAGE, MIRROR_PUSH_INVALID_URL_MESSAGE, MIRROR_PUSH_JITTER_FRACTION, MIRROR_PUSH_OFF_ENV, MIRROR_PUSH_REENROLLMENT_MESSAGE, MIRROR_PUSH_REJECTED_MESSAGE } from "./push-daemon.js";
 //# sourceMappingURL=index.js.map

package/dist/runtime/mirror/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/mirror/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EAIrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/mirror/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EASzB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EAIrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,iCAAiC,EACjC,kCAAkC,EAClC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,gCAAgC,EAChC,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,gCAAgC,EAChC,4BAA4B,EAW7B,MAAM,kBAAkB,CAAC"}

package/dist/runtime/mirror/ingest.d.ts

@@ -0,0 +1,109 @@
+import type { H2AInstanceMirrorBody } from "./build.js";
+import { sanitizePresenceForMirror, sanitizeRegistrationForMirror, sanitizeSubagentForMirror, type H2AMirroredRegistration as SanitizedRegistration, type H2AMirroredSession as SanitizedSession, type H2AMirroredSubagentBinding as SanitizedSubagentBinding } from "./sanitize.js";
+/**
+ * An ingest-only nominal marker. The send-side types deliberately describe the
+ * shape of a serializable record, so raw local records with extra fields are
+ * structurally assignable to them. Callbacks need a stronger guarantee: only a
+ * value returned by one of this module's narrowers may reach a store writer.
+ *
+ * `declare` keeps the marker type-only: it never becomes a field in a mirrored
+ * record or on disk. The casts below are the sole fabrication points.
+ */
+declare const MIRROR_INGEST_NARROWED: unique symbol;
+export type H2AMirroredRegistration = SanitizedRegistration & {
+    readonly [MIRROR_INGEST_NARROWED]: true;
+};
+export type H2AMirroredSession = SanitizedSession & {
+    readonly [MIRROR_INGEST_NARROWED]: true;
+};
+export type H2AMirroredSubagentBinding = SanitizedSubagentBinding & {
+    readonly [MIRROR_INGEST_NARROWED]: true;
+};
+/**
+ * Members of the mirror body that carry RECORDS — i.e. whose type is an array of
+ * objects. `kind` (a string literal) and `seq` (a number) are excluded by the
+ * conditional, so the map below is not asked to narrow a scalar.
+ *
+ * `-?` strips optionality before the test, so `presence?` and `subagents?` are
+ * required entries in the map: an OPTIONAL member is still a member that lands
+ * records when it is present, and the ratchet must not be dodgeable by adding a
+ * `?`.
+ */
+export type MirrorBodyRecordMember = {
+    [K in keyof H2AInstanceMirrorBody]-?: NonNullable<H2AInstanceMirrorBody[K]> extends readonly object[] ? K : never;
+}[keyof H2AInstanceMirrorBody];
+/**
+ * The narrowing applied to each record-carrying body member on arrival.
+ *
+ * This map is not documentation — it is the only route by which a record reaches
+ * a store writer, so deleting an entry breaks the build at its use site rather
+ * than silently disabling a boundary. Each value is the SEND-side function,
+ * reused verbatim; see the module header for why there is no ingest-side copy.
+ */
+export declare const INGEST_NARROWERS: {
+    registrations: typeof sanitizeRegistrationForMirror;
+    presence: typeof sanitizePresenceForMirror;
+    subagents: typeof sanitizeSubagentForMirror;
+};
+/** Narrow an arriving registration to the fields the mirror boundary permits. */
+export declare function narrowIngestedRegistration(registration: Parameters<typeof INGEST_NARROWERS.registrations>[0]): H2AMirroredRegistration;
+/** Narrow an arriving presence record to the fields the mirror boundary permits. */
+export declare function narrowIngestedPresence(session: Parameters<typeof INGEST_NARROWERS.presence>[0]): H2AMirroredSession;
+/** Narrow an arriving subagent binding to the fields the mirror boundary permits. */
+export declare function narrowIngestedSubagent(binding: Parameters<typeof INGEST_NARROWERS.subagents>[0]): H2AMirroredSubagentBinding;
+/** What narrowing removed from one mirror push. */
+export interface MirrorNarrowingReport {
+    /** Records that lost at least one key path. Zero ⇒ the sender is up to date. */
+    readonly records: number;
+    /** Sorted, de-duplicated key paths that were dropped. Names only, never values. */
+    readonly fields: readonly string[];
+}
+/**
+ * Key paths present in `before` and absent from `after` — i.e. what the plans
+ * actually removed.
+ *
+ * Deliberately an OBSERVATION of the narrowing rather than a second reading of
+ * the plans. Re-deriving "what is withheld" from `MIRROR_*_PLAN` here would
+ * reintroduce the duplication this module exists to avoid, and would miss the
+ * two things the plans do not express as withheld fields at all: nested
+ * composites rebuilt by their own plan (`workspace.path` is withheld by
+ * `WORKSPACE_PLAN`, not by `PRESENCE_PLAN`), and endpoints removed by the scheme
+ * filter, which is not a field classification at all. Diffing catches both for
+ * free and cannot drift from the plans, because it has no opinion of its own.
+ *
+ * ── EXACT WHERE IT MATTERS, INDICATIVE WHERE IT DOES NOT ───────────────────
+ *
+ * This value is a DIAGNOSTIC — it gates nothing and authorizes nothing — so it is
+ * worth being precise about which parts are load-bearing:
+ *
+ *  - **Exact**: whether the list is empty. It is empty iff narrowing removed no
+ *    key path, which is the property the operator signal rests on. Object keys
+ *    and array-length shrinkage are both compared directly.
+ *  - **Exact**: object key paths, at every depth (`workspace.path`,
+ *    `launchContext`).
+ *  - **Indicative**: an index inside an array path. Elements are compared
+ *    positionally, and the endpoint scheme filter REMOVES elements, so after a
+ *    filtered element the survivors shift left and `endpoints[0].x` names a
+ *    position, not a stable address. The length-shrink marker `endpoints[]` is
+ *    exact; the per-element paths after it are a hint. Today this is moot —
+ *    `ENDPOINT_PLAN` withholds nothing, so a surviving element loses no keys —
+ *    and it is written down so that stops being an accident.
+ *
+ * `null`/`undefined` in `before` are not reported: `applyPlan` omits them by
+ * design, so treating an absent-because-empty field as "dropped" would report
+ * every optional field a sender left unset and drown the real signal.
+ */
+export declare function droppedKeyPaths(before: unknown, after: unknown, prefix?: string): string[];
+/**
+ * Accumulates {@link MirrorNarrowingReport} across the records of one push.
+ *
+ * Stateful on purpose and scoped to a single envelope: `accept.ts` is otherwise
+ * pure, and this keeps the impurity in one named, obviously-per-request object
+ * instead of threading counters through the accept logic.
+ */
+export declare function createNarrowingTally(): {
+    note: (before: unknown, after: unknown) => void;
+    report: () => MirrorNarrowingReport;
+};
+export {};
+//# sourceMappingURL=ingest.d.ts.map

package/dist/runtime/mirror/ingest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/ingest.ts"],"names":[],"mappings":"AAiGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,uBAAuB,IAAI,qBAAqB,EACrD,KAAK,kBAAkB,IAAI,gBAAgB,EAC3C,KAAK,0BAA0B,IAAI,wBAAwB,EAC5D,MAAM,eAAe,CAAC;AAEvB;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,sBAAsB,EAAE,OAAO,MAAM,CAAC;AAEpD,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG;IAC5D,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;CACzC,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG;IAClD,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;CACzC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAAG;IAClE,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;CACzC,CAAC;AAgBF;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;KAClC,CAAC,IAAI,MAAM,qBAAqB,CAAC,CAAC,GAAG,WAAW,CAC/C,qBAAqB,CAAC,CAAC,CAAC,CACzB,SAAS,SAAS,MAAM,EAAE,GACvB,CAAC,GACD,KAAK;CACV,CAAC,MAAM,qBAAqB,CAAC,CAAC;AAE/B;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;CAIoD,CAAC;AAElF,iFAAiF;AACjF,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GACjE,uBAAuB,CAEzB;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GACvD,kBAAkB,CAEpB;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GACxD,0BAA0B,CAE5B;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,SAAK,GAAG,MAAM,EAAE,CAuBtF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAChD,MAAM,EAAE,MAAM,qBAAqB,CAAC;CACrC,CAYA"}

package/dist/runtime/mirror/ingest.js

@@ -0,0 +1,117 @@
+import { sanitizePresenceForMirror, sanitizeRegistrationForMirror, sanitizeSubagentForMirror } from "./sanitize.js";
+/**
+ * The narrowing applied to each record-carrying body member on arrival.
+ *
+ * This map is not documentation — it is the only route by which a record reaches
+ * a store writer, so deleting an entry breaks the build at its use site rather
+ * than silently disabling a boundary. Each value is the SEND-side function,
+ * reused verbatim; see the module header for why there is no ingest-side copy.
+ */
+export const INGEST_NARROWERS = {
+    registrations: sanitizeRegistrationForMirror,
+    presence: sanitizePresenceForMirror,
+    subagents: sanitizeSubagentForMirror
+};
+/** Narrow an arriving registration to the fields the mirror boundary permits. */
+export function narrowIngestedRegistration(registration) {
+    return INGEST_NARROWERS.registrations(registration);
+}
+/** Narrow an arriving presence record to the fields the mirror boundary permits. */
+export function narrowIngestedPresence(session) {
+    return INGEST_NARROWERS.presence(session);
+}
+/** Narrow an arriving subagent binding to the fields the mirror boundary permits. */
+export function narrowIngestedSubagent(binding) {
+    return INGEST_NARROWERS.subagents(binding);
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Key paths present in `before` and absent from `after` — i.e. what the plans
+ * actually removed.
+ *
+ * Deliberately an OBSERVATION of the narrowing rather than a second reading of
+ * the plans. Re-deriving "what is withheld" from `MIRROR_*_PLAN` here would
+ * reintroduce the duplication this module exists to avoid, and would miss the
+ * two things the plans do not express as withheld fields at all: nested
+ * composites rebuilt by their own plan (`workspace.path` is withheld by
+ * `WORKSPACE_PLAN`, not by `PRESENCE_PLAN`), and endpoints removed by the scheme
+ * filter, which is not a field classification at all. Diffing catches both for
+ * free and cannot drift from the plans, because it has no opinion of its own.
+ *
+ * ── EXACT WHERE IT MATTERS, INDICATIVE WHERE IT DOES NOT ───────────────────
+ *
+ * This value is a DIAGNOSTIC — it gates nothing and authorizes nothing — so it is
+ * worth being precise about which parts are load-bearing:
+ *
+ *  - **Exact**: whether the list is empty. It is empty iff narrowing removed no
+ *    key path, which is the property the operator signal rests on. Object keys
+ *    and array-length shrinkage are both compared directly.
+ *  - **Exact**: object key paths, at every depth (`workspace.path`,
+ *    `launchContext`).
+ *  - **Indicative**: an index inside an array path. Elements are compared
+ *    positionally, and the endpoint scheme filter REMOVES elements, so after a
+ *    filtered element the survivors shift left and `endpoints[0].x` names a
+ *    position, not a stable address. The length-shrink marker `endpoints[]` is
+ *    exact; the per-element paths after it are a hint. Today this is moot —
+ *    `ENDPOINT_PLAN` withholds nothing, so a surviving element loses no keys —
+ *    and it is written down so that stops being an accident.
+ *
+ * `null`/`undefined` in `before` are not reported: `applyPlan` omits them by
+ * design, so treating an absent-because-empty field as "dropped" would report
+ * every optional field a sender left unset and drown the real signal.
+ */
+export function droppedKeyPaths(before, after, prefix = "") {
+    const dropped = [];
+    if (Array.isArray(before)) {
+        if (!Array.isArray(after))
+            return prefix ? [prefix] : [];
+        if (after.length < before.length)
+            dropped.push(`${prefix}[]`);
+        for (let i = 0; i < Math.min(before.length, after.length); i += 1) {
+            dropped.push(...droppedKeyPaths(before[i], after[i], `${prefix}[${i}]`));
+        }
+        return dropped;
+    }
+    if (isPlainObject(before)) {
+        if (!isPlainObject(after))
+            return prefix ? [prefix] : [];
+        for (const [key, value] of Object.entries(before)) {
+            // Absent-and-empty is how `applyPlan` represents "nothing to send", not a
+            // removal. Reporting it would make every unset optional field look stale.
+            if (value === undefined || value === null)
+                continue;
+            const path = prefix ? `${prefix}.${key}` : key;
+            if (!(key in after))
+                dropped.push(path);
+            else
+                dropped.push(...droppedKeyPaths(value, after[key], path));
+        }
+        return dropped;
+    }
+    return dropped;
+}
+/**
+ * Accumulates {@link MirrorNarrowingReport} across the records of one push.
+ *
+ * Stateful on purpose and scoped to a single envelope: `accept.ts` is otherwise
+ * pure, and this keeps the impurity in one named, obviously-per-request object
+ * instead of threading counters through the accept logic.
+ */
+export function createNarrowingTally() {
+    let records = 0;
+    const fields = new Set();
+    return {
+        note: (before, after) => {
+            const paths = droppedKeyPaths(before, after);
+            if (paths.length === 0)
+                return;
+            records += 1;
+            for (const path of paths)
+                fields.add(path);
+        },
+        report: () => ({ records, fields: [...fields].sort() })
+    };
+}
+//# sourceMappingURL=ingest.js.map

package/dist/runtime/mirror/ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.js","sourceRoot":"","sources":["../../../src/runtime/mirror/ingest.ts"],"names":[],"mappings":"AAkGA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EAI1B,MAAM,eAAe,CAAC;AAuDvB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,aAAa,EAAE,6BAA6B;IAC5C,QAAQ,EAAE,yBAAyB;IACnC,SAAS,EAAE,yBAAyB;CAC2C,CAAC;AAElF,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CACxC,YAAkE;IAElE,OAAO,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAA4B,CAAC;AACjF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CACpC,OAAwD;IAExD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAuB,CAAC;AAClE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,sBAAsB,CACpC,OAAyD;IAEzD,OAAO,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAA+B,CAAC;AAC3E,CAAC;AAUD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe,EAAE,KAAc,EAAE,MAAM,GAAG,EAAE;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;QAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,0EAA0E;YAC1E,0EAA0E;YAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YACpD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/C,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACnC,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAIlC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAC/B,OAAO,IAAI,CAAC,CAAC;YACb,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/runtime/mirror/push-daemon.d.ts

@@ -0,0 +1,376 @@
+/**
+ * EVO-13 / feed-contract P1 step 4a — the mirror push as an OPT-IN live daemon.
+ *
+ * `h2a remote mirror` is a ONE-SHOT push (build → sign → POST once). The
+ * ratified feed contract
+ * (`docs/superpowers/specs/2026-07-24-h2a-feed-contract-for-sentropic.md`,
+ * Part C) needs that same push to run continuously on a 15–30s beat, so the
+ * hosted read-only store stays warm for a UI that only ever pulls. A laptop
+ * behind NAT cannot accept inbound, so the data path must be push — the daemon
+ * is the pipeline, not a new trust boundary.
+ *
+ * This module changes NOTHING about what is pushed. It wraps the existing
+ * one-shot cycle (`buildInstanceMirror` → `sendRemoteEnvelope`) in the same
+ * supervisor idioms already shipped for the L1 objective loop
+ * (`runtime/loop/supervisor.ts`): opt-in only, a global kill-switch, an
+ * injectable clock, a drainable abort signal, and a per-beat summary that is
+ * observability — never control. The signed-envelope trust boundary, the
+ * payload shape, the sequence fencing and the accept-side verification are
+ * untouched.
+ *
+ * Safety properties, in the order they matter:
+ *
+ *  - OPT-IN, NEVER DEFAULT-ON. Nothing here runs unless a caller explicitly
+ *    asks for an interval. `h2a remote mirror` with no `--interval-ms` still
+ *    takes the byte-identical one-shot path it took before this module existed.
+ *    The global kill-switch `H2A_MIRROR_PUSH_OFF` hard-disables the loop even
+ *    when a unit file or an operator asked for it — checked before the FIRST
+ *    cycle, so a frozen daemon never emits a single request.
+ *
+ *  - AUTH FAILURE STOPS, IT DOES NOT RETRY FOREVER. A 401/403 means the
+ *    receiving side does not trust this instance's signing key (never enrolled,
+ *    revoked, or — the live case today — the agent re-anchored and mints a
+ *    different keypair than the one enrolled). No amount of retrying fixes
+ *    that: it needs a human re-enrollment ceremony. So consecutive auth
+ *    rejections are backed off and then the daemon STOPS with an actionable
+ *    message, instead of hammering a rejecting endpoint indefinitely. Only a
+ *    genuinely accepted push (`ok`) clears the counter — a transient error in
+ *    between does NOT, because "network flap between two 401s" must not be a
+ *    way to loop forever against a server that is refusing us.
+ *
+ *  - NO OVERLAP. The daemon cannot overlap itself: it awaits each cycle before
+ *    scheduling the next, so a slow push delays the next beat rather than
+ *    stacking on top of it (and the slot arithmetic below then skips the beats
+ *    that were missed). The exported runner ALSO carries an in-flight guard, for
+ *    the different case of two concurrent callers sharing one runner: the second
+ *    gets `skipped-overlap` without building or sending anything. That guard is
+ *    defence for external callers, not what protects the daemon's own loop.
+ *
+ *  - NO DRIFT. Cycles are scheduled against a monotonic slot anchor
+ *    (`anchor + n × interval`), not by sleeping a fixed interval after each
+ *    cycle, so per-cycle duration does not accumulate into lateness. Slots
+ *    already in the past are skipped rather than fired back-to-back. A small
+ *    bounded jitter de-synchronises several agents pushing to one endpoint.
+ *
+ *  - TRANSIENT ERRORS KEEP LOOPING. A network throw, a 5xx or a 429 is the
+ *    endpoint's problem, not ours: exponential backoff (capped), then carry on.
+ *
+ *  - A STATUS MUST NOT BE WIDER THAN ITS EVIDENCE. The dividing line for every
+ *    stop rule above is "can this self-heal": a network outage can, a refused
+ *    key / a refused request / a root that cannot build this instance's mirror
+ *    cannot. The non-self-healing cases therefore TERMINATE rather than idle,
+ *    because idling would make this process the dishonest layer. Consider a
+ *    wrong `H2A_ROOT`: nothing is ever sent, so the feed downstream correctly
+ *    starts reporting those rows `stale` once `mirroredAt` stops advancing —
+ *    while `systemctl status` would still read `active (running)`. The two
+ *    layers would disagree and the only honest signal would be the one FURTHEST
+ *    from the operator, in a UI nobody is watching. The signal nearest the fault
+ *    has to be at least as honest as the far one, so we exit 1 and say why.
+ *    Correspondingly, the per-cycle line reports what the push CONTAINED (seq +
+ *    counts), so a successful push of an empty mirror is never mistaken for a
+ *    healthy feed.
+ *
+ *  - DRAINABLE. `signal` is honored before each cycle and inside every sleep,
+ *    so SIGTERM stops promptly instead of finishing the schedule.
+ *
+ *  - LOGS ARE SAFE BY CONSTRUCTION. The per-cycle line carries an outcome, an
+ *    HTTP status, a closed-vocabulary rejection reason and a redacted endpoint.
+ *    It NEVER carries key material, a token, a request body or a response body.
+ *    Everything free-form (an error message) goes through `sanitizeForLog`.
+ */
+import type { H2AEnvelope } from "@sentropic/h2a";
+/**
+ * Default beat. The ratified contract asks for 15–30s; 20s sits in the middle
+ * and keeps a UI's worst-case staleness under the 90s presence keepalive
+ * window, so a `stale` row means the pipeline really is down.
+ */
+export declare const DEFAULT_MIRROR_PUSH_INTERVAL_MS = 20000;
+/**
+ * Floor the CLI enforces on `--interval-ms`. The library itself accepts any
+ * positive interval (tests drive it at millisecond speed against a fake
+ * transport); the operator-facing surface refuses anything that would hammer a
+ * hosted endpoint faster than the contract's own range.
+ */
+export declare const MIN_MIRROR_PUSH_INTERVAL_MS = 5000;
+/** Bounded de-synchronisation jitter, as a fraction of the interval (±10%). */
+export declare const MIRROR_PUSH_JITTER_FRACTION = 0.1;
+/** First transient-failure backoff; doubles per consecutive failure. */
+export declare const MIRROR_PUSH_BACKOFF_BASE_MS = 5000;
+/** Backoff ceiling — a long outage retries every 5 min, not every 5 hours. */
+export declare const MIRROR_PUSH_BACKOFF_MAX_MS = 300000;
+/**
+ * How many CONSECUTIVE auth rejections are tolerated (each backed off) before
+ * the daemon stops. 3 absorbs a key-rotation race on the accept side while
+ * still stopping in well under a minute of real rejection.
+ */
+export declare const DEFAULT_MIRROR_AUTH_FAILURE_LIMIT = 3;
+/**
+ * How many CONSECUTIVE non-auth rejections (a 4xx that is not 401/403) are
+ * tolerated before the daemon stops. Some of these genuinely self-heal — a
+ * stale-sequence or replay rejection clears as `seq` advances — which is why the
+ * budget is looser than the auth one. But a permanently malformed request or a
+ * wrong path returning 404 will never heal, and retrying it forever is the same
+ * failure mode as retrying a refused key: a unit that reads "active (running)"
+ * while pushing nothing. 5 tolerates a real fencing race, then stops.
+ */
+export declare const DEFAULT_MIRROR_REJECT_LIMIT = 5;
+/**
+ * How many CONSECUTIVE local build failures are tolerated before the daemon
+ * stops. `buildInstanceMirror` throwing means this root does not know this
+ * instance — overwhelmingly because `H2A_ROOT` points somewhere the agent never
+ * registered, the misconfiguration the shipped unit file explicitly warns about.
+ * A wrong root NEVER self-heals, and looping on it forever is the worst possible
+ * failure shape: no request is ever sent, yet `systemctl status` reads
+ * `active (running)` indefinitely, so monitoring keyed on systemd state reads
+ * green while the feed is dead. It must terminate loudly instead. 5 leaves room
+ * for a genuinely transient race (an agent re-registering, a root being created).
+ *
+ * The contract-level argument (from the feed contract's own architect): in this
+ * failure mode the feed WOULD report `stale` correctly, because `mirroredAt` stops
+ * advancing — so the honest signal exists, but only at the layer furthest from the
+ * operator. Idling here would ship a daemon that claims health next to a contract
+ * written specifically to refuse claiming it.
+ */
+export declare const DEFAULT_MIRROR_BUILD_FAILURE_LIMIT = 5;
+/** Name of the global kill-switch env var. */
+export declare const MIRROR_PUSH_OFF_ENV = "H2A_MIRROR_PUSH_OFF";
+/**
+ * Global kill-switch for the live mirror push. When `H2A_MIRROR_PUSH_OFF` is
+ * set to any non-empty, non-"0"/"false" value, NO mirror push daemon runs
+ * anywhere, regardless of flags or unit files. Same semantics as
+ * `H2A_LOOP_AUTOTICK_OFF` for the objective-loop supervisor — one lever to
+ * freeze the pipeline without editing any invocation.
+ */
+export declare function mirrorPushGloballyDisabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Emitted when the daemon stops because the endpoint keeps rejecting the request
+ * itself (not the key). Like the auth stop, retrying cannot fix a permanently
+ * malformed request or a wrong path.
+ */
+export declare const MIRROR_PUSH_REJECTED_MESSAGE: string;
+/**
+ * Emitted when the daemon is asked to push to something that is not a usable
+ * http(s) endpoint. Returned BEFORE any cycle runs, because a URL `fetch` cannot
+ * even parse would otherwise be retried forever as a transient network failure.
+ */
+/**
+ * Emitted when the daemon stops because it cannot even BUILD a mirror locally.
+ * Names the likely cause, because this failure never reaches the network and so
+ * leaves no server-side trace for the operator to correlate against.
+ */
+export declare const MIRROR_PUSH_BUILD_FAILED_MESSAGE: string;
+export declare const MIRROR_PUSH_INVALID_URL_MESSAGE: string;
+/**
+ * The actionable message emitted when the daemon stops on repeated auth
+ * rejection. Deliberately explicit: the failure is NOT retryable and the
+ * operator must know exactly which human act unblocks it.
+ */
+export declare const MIRROR_PUSH_REENROLLMENT_MESSAGE: string;
+/** What one cycle did. `skipped-overlap` performed no build and no request. */
+export type MirrorPushOutcome = "ok" | "auth-rejected" | "rejected" | "transient" | "build-failed" | "skipped-overlap";
+/**
+ * Why the daemon returned. Every reason is a clean, intentional stop — the
+ * daemon never falls out of its loop by accident.
+ *
+ * `auth-stop`, `reject-stop`, `build-stop` and `config-invalid` are the four
+ * that need a human act; they are exactly the reasons that carry a `message`,
+ * and the CLI turns any `message` into exit 1 so systemd keeps the unit stopped.
+ * `log-unavailable` is a CLEAN stop (no message, exit 0): the status sink went
+ * away — a piped stdout closed — so the daemon stops rather than keep pushing
+ * with no way to report what it is doing.
+ */
+export type MirrorPushStopReason = "max-cycles" | "aborted" | "kill-switch" | "auth-stop" | "reject-stop" | "build-stop" | "config-invalid" | "log-unavailable";
+export interface MirrorPushCycleResult {
+    readonly outcome: MirrorPushOutcome;
+    /** HTTP status, when a request actually completed. */
+    readonly status?: number;
+    /** Closed-vocabulary accept-side rejection reason, when the body carried one. */
+    readonly reason?: string;
+    /** Sanitized error text for `transient` / `build-failed`. Never secrets. */
+    readonly error?: string;
+    readonly durationMs: number;
+    /**
+     * What the pushed envelope actually CONTAINED. All non-secret: a monotonic
+     * sequence number and three cardinalities, never a body.
+     *
+     * Without these, a `200` says only "the endpoint accepted something" — a valid
+     * root whose instance has no live sessions pushes `presence: []` every cycle
+     * and logs a perfectly healthy `ok`, while the hosted UI shows nothing. These
+     * make "successfully pushed nothing" distinguishable from "pushed the mirror".
+     */
+    readonly payload?: MirrorPushPayloadShape;
+}
+/** Non-secret shape of one pushed mirror: what it carried, never its content. */
+export interface MirrorPushPayloadShape {
+    /** Per-instance monotonic sequence the receiver fences on. */
+    readonly seq?: number;
+    readonly registrations: number;
+    readonly presence: number;
+    readonly subagents: number;
+}
+/** The one-line-per-cycle status record. Safe to journal verbatim. */
+export interface MirrorPushCycleLog {
+    readonly cycle: number;
+    readonly at: string;
+    readonly instance: string;
+    /** Redacted endpoint: scheme + host + path only. No query, no userinfo. */
+    readonly endpoint: string;
+    readonly outcome: MirrorPushOutcome;
+    readonly status?: number;
+    readonly reason?: string;
+    readonly error?: string;
+    readonly durationMs: number;
+    /** Sleep before the next cycle. Absent when the daemon is stopping. */
+    readonly nextInMs?: number;
+    /** Consecutive auth rejections so far — 0 unless the key is being refused. */
+    readonly authFailures?: number;
+    /** Consecutive non-auth rejections so far — 0 unless the request is refused. */
+    readonly rejections?: number;
+    /** Consecutive local build failures so far — 0 unless the root is wrong. */
+    readonly buildFailures?: number;
+    /** Sequence number of the pushed envelope (fencing anchor). */
+    readonly seq?: number;
+    /** How many registrations the pushed mirror carried. */
+    readonly registrations?: number;
+    /** How many presence sessions it carried — 0 means "pushed an empty mirror". */
+    readonly presence?: number;
+    /** How many subagent bindings it carried. */
+    readonly subagents?: number;
+}
+export interface MirrorPushDaemonSummary {
+    readonly cycles: number;
+    /** Cycles the endpoint accepted (2xx). */
+    readonly ok: number;
+    /** Cycles that did not push successfully (any non-ok, non-skipped outcome). */
+    readonly failures: number;
+    /**
+     * Cycles skipped because a previous push was still in flight. Always 0 for the
+     * daemon itself, which awaits each cycle and therefore cannot overlap itself;
+     * non-zero only when a `runner` is shared with another concurrent caller.
+     */
+    readonly skippedOverlap: number;
+    /** Consecutive auth rejections at stop time. */
+    readonly authFailures: number;
+    /** Consecutive non-auth rejections at stop time. */
+    readonly rejections: number;
+    /** Consecutive local build failures at stop time. */
+    readonly buildFailures: number;
+    /**
+     * Times the status sink (`onCycle`) threw. Never affects the push itself —
+     * observability failures are counted, not propagated — but a non-zero value
+     * means the journal is an incomplete record of what this daemon did.
+     */
+    readonly logFailures: number;
+    readonly stopReason: MirrorPushStopReason;
+    /**
+     * The actionable instruction for a stop that needs a human act. Present on
+     * exactly the four such stops — `auth-stop`
+     * ({@link MIRROR_PUSH_REENROLLMENT_MESSAGE}), `reject-stop`
+     * ({@link MIRROR_PUSH_REJECTED_MESSAGE}), `build-stop`
+     * ({@link MIRROR_PUSH_BUILD_FAILED_MESSAGE}) and `config-invalid`
+     * ({@link MIRROR_PUSH_INVALID_URL_MESSAGE}) — and absent on the clean stops
+     * (`max-cycles`, `aborted`, `kill-switch`, `log-unavailable`). Its presence is
+     * what the CLI keys exit 1 on, so systemd's `RestartPreventExitStatus=1` keeps
+     * the unit stopped instead of restarting into the same wall.
+     */
+    readonly message?: string;
+}
+/** Builds the (unsigned) mirror envelope for a given clock reading. */
+export type MirrorEnvelopeBuilder = (nowMs: number) => H2AEnvelope;
+/** Signs + POSTs the envelope. Injected in tests; never a real socket there. */
+export type MirrorEnvelopeSender = (url: string, envelope: H2AEnvelope, options: {
+    by: string;
+    privateKeyPem: string;
+}) => Promise<{
+    status: number;
+    body: unknown;
+}>;
+/**
+ * Strip anything that could be secret out of free-form text before it is
+ * logged. Defence in depth: nothing here is SUPPOSED to see key material, but a
+ * thrown error can carry whatever the thrower put in it, and this daemon holds a
+ * private key in memory. PEM blocks, bearer tokens and token-ish query params
+ * are replaced; the result is length-capped so a giant blob cannot be smuggled
+ * out one line at a time.
+ */
+export declare function sanitizeForLog(text: string): string;
+/**
+ * True when `url` is something a push could actually reach: parseable, and
+ * http(s). Anything else — an unfilled placeholder, a typo, a `file:` or `ws:`
+ * scheme — makes `fetch` throw a parse error that would otherwise be classified
+ * as a retryable network failure and retried forever.
+ */
+export declare function isPushableHttpUrl(url: string | undefined): boolean;
+/**
+ * Reduce a URL to scheme + host + path. Drops query and userinfo, which are the
+ * two places a credential can hide in a URL, and keeps enough for an operator to
+ * recognise which endpoint is being pushed to.
+ */
+export declare function redactEndpoint(url: string): string;
+export interface MirrorPushRunnerOptions {
+    /** h2a root the mirror is built from. */
+    readonly root: string;
+    /** Endpoint to POST the signed envelope to. */
+    readonly url: string;
+    /** Instance whose registration + presence is mirrored (also the signer). */
+    readonly instance: string;
+    /** Signer's ed25519 private-key PEM. Never logged, never sent. */
+    readonly privateKeyPem: string;
+    /** Injectable clock (ms). Default `Date.now`. */
+    readonly now?: () => number;
+    /** Injectable envelope builder. Default the real `buildInstanceMirror`. */
+    readonly buildImpl?: MirrorEnvelopeBuilder;
+    /** Injectable transport. Default the real `sendRemoteEnvelope`. */
+    readonly sendImpl?: MirrorEnvelopeSender;
+}
+/**
+ * Create the guarded one-cycle runner: build → sign → POST once, classified.
+ *
+ * The returned function is the ONLY thing that touches the network. It carries an
+ * in-flight guard for CONCURRENT callers of the same runner: while one cycle is
+ * running, a second call returns `skipped-overlap` immediately without building
+ * an envelope or issuing a request. (The daemon itself awaits each cycle, so it
+ * never trips this guard on its own — see the module header.) Exposed so a caller
+ * or a test can drive single cycles without the timer loop, exactly as
+ * `runSupervisorBeat` is exposed next to `runLoopSupervisor`.
+ *
+ * Never throws: every failure is classified into a {@link MirrorPushOutcome}.
+ */
+export declare function createMirrorPushRunner(options: MirrorPushRunnerOptions): () => Promise<MirrorPushCycleResult>;
+export interface MirrorPushDaemonOptions extends MirrorPushRunnerOptions {
+    /** Beat interval. Default {@link DEFAULT_MIRROR_PUSH_INTERVAL_MS}. */
+    readonly intervalMs?: number;
+    /** Stop after this many cycles (testing / bounded ops runs). */
+    readonly max?: number;
+    /** Abort to stop the daemon between cycles and inside every sleep. */
+    readonly signal?: AbortSignal;
+    /** Environment for the kill-switch. Default `process.env`. */
+    readonly env?: NodeJS.ProcessEnv;
+    /** Injectable randomness for the jitter. Default `Math.random`. */
+    readonly random?: () => number;
+    /** Injectable sleep, so tests advance a fake clock instead of waiting. */
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    /** Consecutive auth rejections tolerated. Default {@link DEFAULT_MIRROR_AUTH_FAILURE_LIMIT}. */
+    readonly authFailureLimit?: number;
+    /** Consecutive non-auth rejections tolerated. Default {@link DEFAULT_MIRROR_REJECT_LIMIT}. */
+    readonly rejectLimit?: number;
+    /** Consecutive local build failures tolerated. Default {@link DEFAULT_MIRROR_BUILD_FAILURE_LIMIT}. */
+    readonly buildFailureLimit?: number;
+    readonly backoffBaseMs?: number;
+    readonly backoffMaxMs?: number;
+    /** Pre-built runner (shares one overlap guard across callers). */
+    readonly runner?: () => Promise<MirrorPushCycleResult>;
+    /** Called once per cycle with the safe status line. */
+    readonly onCycle?: (log: MirrorPushCycleLog) => void | Promise<void>;
+}
+/**
+ * Run the live mirror push until `signal` aborts, `max` cycles elapse, or the
+ * endpoint has refused this key often enough to stop (see
+ * {@link MIRROR_PUSH_REENROLLMENT_MESSAGE}).
+ *
+ * This is what the systemd `--user` unit runs. It is NEVER on any default code
+ * path: no caller reaches it without an explicit interval, and the kill-switch
+ * short-circuits it before the first request.
+ */
+export declare function runMirrorPushDaemon(options: MirrorPushDaemonOptions): Promise<MirrorPushDaemonSummary>;
+//# sourceMappingURL=push-daemon.d.ts.map

package/dist/runtime/mirror/push-daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-daemon.d.ts","sourceRoot":"","sources":["../../../src/runtime/mirror/push-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMlD;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,wEAAwE;AACxE,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,SAAU,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,IAAI,CAAC;AAEpD,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAKT;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,QAIgG,CAAC;AAE1I;;;;GAIG;AACH;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,QAI6D,CAAC;AAE3G,eAAO,MAAM,+BAA+B,QAG+B,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,QAKC,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GACzB,IAAI,GACJ,eAAe,GACf,UAAU,GACV,WAAW,GACX,cAAc,GACd,iBAAiB,CAAC;AAEtB;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAC5B,YAAY,GACZ,SAAS,GACT,aAAa,GACb,WAAW,GACX,aAAa,GACb,YAAY,GACZ,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC;AAEnE,gFAAgF;AAChF,MAAM,MAAM,oBAAoB,GAAG,CACjC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,KAC3C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAiBhD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBnD;AAiED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAoBD,MAAM,WAAW,uBAAuB;IACtC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CAC1C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,MAAM,OAAO,CAAC,qBAAqB,CAAC,CA0EtC;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,gGAAgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvD,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,uBAAuB,CAAC,CAmNlC"}