@sentropic/h2a 0.85.25 → 0.87.0

package/dist/runtime/mirror/push-daemon.js

@@ -0,0 +1,644 @@
+/**
+ * EVO-13 / feed-contract P1 step 4a — the mirror push as an OPT-IN live daemon.
+ *
+ * `h2a remote mirror` is a ONE-SHOT push (build → sign → POST once). The
+ * ratified feed contract
+ * (`docs/superpowers/specs/2026-07-24-h2a-feed-contract-for-sentropic.md`,
+ * Part C) needs that same push to run continuously on a 15–30s beat, so the
+ * hosted read-only store stays warm for a UI that only ever pulls. A laptop
+ * behind NAT cannot accept inbound, so the data path must be push — the daemon
+ * is the pipeline, not a new trust boundary.
+ *
+ * This module changes NOTHING about what is pushed. It wraps the existing
+ * one-shot cycle (`buildInstanceMirror` → `sendRemoteEnvelope`) in the same
+ * supervisor idioms already shipped for the L1 objective loop
+ * (`runtime/loop/supervisor.ts`): opt-in only, a global kill-switch, an
+ * injectable clock, a drainable abort signal, and a per-beat summary that is
+ * observability — never control. The signed-envelope trust boundary, the
+ * payload shape, the sequence fencing and the accept-side verification are
+ * untouched.
+ *
+ * Safety properties, in the order they matter:
+ *
+ *  - OPT-IN, NEVER DEFAULT-ON. Nothing here runs unless a caller explicitly
+ *    asks for an interval. `h2a remote mirror` with no `--interval-ms` still
+ *    takes the byte-identical one-shot path it took before this module existed.
+ *    The global kill-switch `H2A_MIRROR_PUSH_OFF` hard-disables the loop even
+ *    when a unit file or an operator asked for it — checked before the FIRST
+ *    cycle, so a frozen daemon never emits a single request.
+ *
+ *  - AUTH FAILURE STOPS, IT DOES NOT RETRY FOREVER. A 401/403 means the
+ *    receiving side does not trust this instance's signing key (never enrolled,
+ *    revoked, or — the live case today — the agent re-anchored and mints a
+ *    different keypair than the one enrolled). No amount of retrying fixes
+ *    that: it needs a human re-enrollment ceremony. So consecutive auth
+ *    rejections are backed off and then the daemon STOPS with an actionable
+ *    message, instead of hammering a rejecting endpoint indefinitely. Only a
+ *    genuinely accepted push (`ok`) clears the counter — a transient error in
+ *    between does NOT, because "network flap between two 401s" must not be a
+ *    way to loop forever against a server that is refusing us.
+ *
+ *  - NO OVERLAP. The daemon cannot overlap itself: it awaits each cycle before
+ *    scheduling the next, so a slow push delays the next beat rather than
+ *    stacking on top of it (and the slot arithmetic below then skips the beats
+ *    that were missed). The exported runner ALSO carries an in-flight guard, for
+ *    the different case of two concurrent callers sharing one runner: the second
+ *    gets `skipped-overlap` without building or sending anything. That guard is
+ *    defence for external callers, not what protects the daemon's own loop.
+ *
+ *  - NO DRIFT. Cycles are scheduled against a monotonic slot anchor
+ *    (`anchor + n × interval`), not by sleeping a fixed interval after each
+ *    cycle, so per-cycle duration does not accumulate into lateness. Slots
+ *    already in the past are skipped rather than fired back-to-back. A small
+ *    bounded jitter de-synchronises several agents pushing to one endpoint.
+ *
+ *  - TRANSIENT ERRORS KEEP LOOPING. A network throw, a 5xx or a 429 is the
+ *    endpoint's problem, not ours: exponential backoff (capped), then carry on.
+ *
+ *  - A STATUS MUST NOT BE WIDER THAN ITS EVIDENCE. The dividing line for every
+ *    stop rule above is "can this self-heal": a network outage can, a refused
+ *    key / a refused request / a root that cannot build this instance's mirror
+ *    cannot. The non-self-healing cases therefore TERMINATE rather than idle,
+ *    because idling would make this process the dishonest layer. Consider a
+ *    wrong `H2A_ROOT`: nothing is ever sent, so the feed downstream correctly
+ *    starts reporting those rows `stale` once `mirroredAt` stops advancing —
+ *    while `systemctl status` would still read `active (running)`. The two
+ *    layers would disagree and the only honest signal would be the one FURTHEST
+ *    from the operator, in a UI nobody is watching. The signal nearest the fault
+ *    has to be at least as honest as the far one, so we exit 1 and say why.
+ *    Correspondingly, the per-cycle line reports what the push CONTAINED (seq +
+ *    counts), so a successful push of an empty mirror is never mistaken for a
+ *    healthy feed.
+ *
+ *  - DRAINABLE. `signal` is honored before each cycle and inside every sleep,
+ *    so SIGTERM stops promptly instead of finishing the schedule.
+ *
+ *  - LOGS ARE SAFE BY CONSTRUCTION. The per-cycle line carries an outcome, an
+ *    HTTP status, a closed-vocabulary rejection reason and a redacted endpoint.
+ *    It NEVER carries key material, a token, a request body or a response body.
+ *    Everything free-form (an error message) goes through `sanitizeForLog`.
+ */
+import { createLocalStore } from "../local-files/index.js";
+import { sendRemoteEnvelope } from "../remote/client.js";
+import { buildInstanceMirror } from "./build.js";
+/**
+ * Default beat. The ratified contract asks for 15–30s; 20s sits in the middle
+ * and keeps a UI's worst-case staleness under the 90s presence keepalive
+ * window, so a `stale` row means the pipeline really is down.
+ */
+export const DEFAULT_MIRROR_PUSH_INTERVAL_MS = 20_000;
+/**
+ * Floor the CLI enforces on `--interval-ms`. The library itself accepts any
+ * positive interval (tests drive it at millisecond speed against a fake
+ * transport); the operator-facing surface refuses anything that would hammer a
+ * hosted endpoint faster than the contract's own range.
+ */
+export const MIN_MIRROR_PUSH_INTERVAL_MS = 5_000;
+/** Bounded de-synchronisation jitter, as a fraction of the interval (±10%). */
+export const MIRROR_PUSH_JITTER_FRACTION = 0.1;
+/** First transient-failure backoff; doubles per consecutive failure. */
+export const MIRROR_PUSH_BACKOFF_BASE_MS = 5_000;
+/** Backoff ceiling — a long outage retries every 5 min, not every 5 hours. */
+export const MIRROR_PUSH_BACKOFF_MAX_MS = 300_000;
+/**
+ * How many CONSECUTIVE auth rejections are tolerated (each backed off) before
+ * the daemon stops. 3 absorbs a key-rotation race on the accept side while
+ * still stopping in well under a minute of real rejection.
+ */
+export const DEFAULT_MIRROR_AUTH_FAILURE_LIMIT = 3;
+/**
+ * How many CONSECUTIVE non-auth rejections (a 4xx that is not 401/403) are
+ * tolerated before the daemon stops. Some of these genuinely self-heal — a
+ * stale-sequence or replay rejection clears as `seq` advances — which is why the
+ * budget is looser than the auth one. But a permanently malformed request or a
+ * wrong path returning 404 will never heal, and retrying it forever is the same
+ * failure mode as retrying a refused key: a unit that reads "active (running)"
+ * while pushing nothing. 5 tolerates a real fencing race, then stops.
+ */
+export const DEFAULT_MIRROR_REJECT_LIMIT = 5;
+/**
+ * How many CONSECUTIVE local build failures are tolerated before the daemon
+ * stops. `buildInstanceMirror` throwing means this root does not know this
+ * instance — overwhelmingly because `H2A_ROOT` points somewhere the agent never
+ * registered, the misconfiguration the shipped unit file explicitly warns about.
+ * A wrong root NEVER self-heals, and looping on it forever is the worst possible
+ * failure shape: no request is ever sent, yet `systemctl status` reads
+ * `active (running)` indefinitely, so monitoring keyed on systemd state reads
+ * green while the feed is dead. It must terminate loudly instead. 5 leaves room
+ * for a genuinely transient race (an agent re-registering, a root being created).
+ *
+ * The contract-level argument (from the feed contract's own architect): in this
+ * failure mode the feed WOULD report `stale` correctly, because `mirroredAt` stops
+ * advancing — so the honest signal exists, but only at the layer furthest from the
+ * operator. Idling here would ship a daemon that claims health next to a contract
+ * written specifically to refuse claiming it.
+ */
+export const DEFAULT_MIRROR_BUILD_FAILURE_LIMIT = 5;
+/** Name of the global kill-switch env var. */
+export const MIRROR_PUSH_OFF_ENV = "H2A_MIRROR_PUSH_OFF";
+/**
+ * Global kill-switch for the live mirror push. When `H2A_MIRROR_PUSH_OFF` is
+ * set to any non-empty, non-"0"/"false" value, NO mirror push daemon runs
+ * anywhere, regardless of flags or unit files. Same semantics as
+ * `H2A_LOOP_AUTOTICK_OFF` for the objective-loop supervisor — one lever to
+ * freeze the pipeline without editing any invocation.
+ */
+export function mirrorPushGloballyDisabled(env = process.env) {
+    const v = env[MIRROR_PUSH_OFF_ENV];
+    if (v === undefined)
+        return false;
+    const norm = v.trim().toLowerCase();
+    return norm !== "" && norm !== "0" && norm !== "false";
+}
+/**
+ * Emitted when the daemon stops because the endpoint keeps rejecting the request
+ * itself (not the key). Like the auth stop, retrying cannot fix a permanently
+ * malformed request or a wrong path.
+ */
+export const MIRROR_PUSH_REJECTED_MESSAGE = "mirror push STOPPED: the endpoint rejected this mirror on every attempt with a 4xx that is not an auth failure. " +
+    "The request itself is being refused, so retrying cannot fix it — check that --url points at the ingester's mirror path " +
+    "(a wrong path typically answers 404) and that this instance's clock is accurate (a skewed clock is refused as expired/future). " +
+    "The per-cycle status lines carry the endpoint and the rejection reason. Nothing further will be pushed until the daemon is restarted.";
+/**
+ * Emitted when the daemon is asked to push to something that is not a usable
+ * http(s) endpoint. Returned BEFORE any cycle runs, because a URL `fetch` cannot
+ * even parse would otherwise be retried forever as a transient network failure.
+ */
+/**
+ * Emitted when the daemon stops because it cannot even BUILD a mirror locally.
+ * Names the likely cause, because this failure never reaches the network and so
+ * leaves no server-side trace for the operator to correlate against.
+ */
+export const MIRROR_PUSH_BUILD_FAILED_MESSAGE = "mirror push STOPPED: this h2a root does not know the instance being mirrored, on every attempt. " +
+    "Nothing was ever sent, and this cannot self-heal by retrying. " +
+    "Check that --instance names an instance registered in THIS root and that H2A_ROOT / --root points at the root where that agent actually registers " +
+    "(h2a discover --root <root> lists them). Nothing further will be pushed until the daemon is restarted.";
+export const MIRROR_PUSH_INVALID_URL_MESSAGE = "mirror push NOT STARTED: the push target is not a usable http(s) URL, so no request could ever succeed. " +
+    "Set --url to the ingester's full mirror endpoint (for example https://host/h2a/mirror). " +
+    "If this is a systemd unit, its ExecStart placeholder was not filled in.";
+/**
+ * The actionable message emitted when the daemon stops on repeated auth
+ * rejection. Deliberately explicit: the failure is NOT retryable and the
+ * operator must know exactly which human act unblocks it.
+ */
+export const MIRROR_PUSH_REENROLLMENT_MESSAGE = "mirror push STOPPED: the endpoint rejected this instance's signing key (HTTP 401/403) on every attempt. " +
+    "This is not a transient error and retrying cannot fix it — the key is not enrolled on the receiving side " +
+    "(never enrolled, revoked, or the agent re-anchored and now signs with a different keypair). " +
+    "RE-ENROLLMENT IS REQUIRED: enroll this instance's CURRENT public key on the receiving side, then restart the daemon. " +
+    "Nothing further will be pushed until then.";
+/** Accept-side rejection vocabulary (`runtime/mirror/accept.ts`). */
+const MIRROR_REJECTION_REASONS = new Set([
+    "malformed",
+    "not-mirror",
+    "no-signature",
+    "unauthorized-key",
+    "bad-signature",
+    "invalid-timestamp",
+    "expired",
+    "future",
+    "replayed",
+    "stale-sequence",
+    "instance-key-mismatch"
+]);
+/**
+ * Strip anything that could be secret out of free-form text before it is
+ * logged. Defence in depth: nothing here is SUPPOSED to see key material, but a
+ * thrown error can carry whatever the thrower put in it, and this daemon holds a
+ * private key in memory. PEM blocks, bearer tokens and token-ish query params
+ * are replaced; the result is length-capped so a giant blob cannot be smuggled
+ * out one line at a time.
+ */
+export function sanitizeForLog(text) {
+    return (text
+        .replace(/-----BEGIN[\s\S]*?-----END[^-]*-----/g, "[redacted-key]")
+        .replace(/-----BEGIN[\s\S]*/g, "[redacted-key]")
+        // URL userinfo (https://user:password@host) anywhere in free-form text.
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[redacted]@")
+        .replace(/\b(bearer|basic)\s+[\w.\-+/=]+/gi, "$1 [redacted]")
+        // Credential-ish parameters. The name prefix is matched explicitly rather
+        // than with `\b`, because `\b` does not fire after an underscore — which
+        // let every `access_token=` / `session_key=` form through untouched.
+        .replace(/([\w.-]*(?:token|key|secret|password|passwd|signature|credential)s?)=([^&\s]+)/gi, "$1=[redacted]")
+        // HEADER form (`X-Api-Key: literal`, `cookie: sid=…`). The `name=value`
+        // rule above cannot see these, because the delimiter is a colon.
+        .replace(/^([ \t]*[\w-]*(?:token|key|secret|password|passwd|auth|authorization|cookie|credential)s?)[ \t]*:[ \t]*\S.*$/gim, "$1: [redacted]")
+        .slice(0, 300));
+}
+/**
+ * Text of a caught value, for a value that is NOT guaranteed to be an `Error`.
+ * A rejection can carry anything — a string, an object, `undefined` from a bare
+ * `Promise.reject()` — and this daemon's whole contract is that a cycle never
+ * throws. Reading `.message` off a non-Error would itself throw, escape the
+ * classifier, and land in the CLI's unsanitized fatal handler.
+ *
+ * EVERY read is inside the `try`, deliberately. Accessing `.message` is not a
+ * safe operation: it can be a getter that throws (including on a real `Error`
+ * subclass), so a guard that only wraps the `String()` fallback still lets a
+ * hostile object escape. The whole inspection is therefore fallible-by-default.
+ */
+function errorText(error) {
+    try {
+        if (error instanceof Error && typeof error.message === "string")
+            return error.message;
+        const message = error?.message;
+        if (typeof message === "string")
+            return message;
+        return String(error);
+    }
+    catch {
+        // A hostile `message` getter or `toString` still must not break the cycle.
+        return "[unrepresentable error]";
+    }
+}
+/**
+ * True when a logging failure means the status sink is GONE for good rather than
+ * momentarily unhappy — a closed or destroyed stream. A piped stdout that the
+ * reader closed (`| head -3`, a journald restart) surfaces as EPIPE and never
+ * reopens, so the honest response is to stop, not to keep pushing unobservably.
+ */
+function isClosedStreamError(error) {
+    let code;
+    try {
+        code = error?.code;
+    }
+    catch {
+        return false;
+    }
+    return code === "EPIPE" || code === "ERR_STREAM_DESTROYED" || code === "ERR_STREAM_WRITE_AFTER_END";
+}
+/**
+ * Read the non-secret shape of the envelope about to be pushed: its sequence
+ * number and the cardinality of each collection. Never its contents. Defensive
+ * about shape, because a caller can inject any `buildImpl`.
+ */
+function payloadShapeOf(envelope) {
+    const body = envelope.body;
+    const count = (v) => (Array.isArray(v) ? v.length : 0);
+    return {
+        ...(typeof body?.seq === "number" ? { seq: body.seq } : {}),
+        registrations: count(body?.registrations),
+        presence: count(body?.presence),
+        subagents: count(body?.subagents)
+    };
+}
+/**
+ * True when `url` is something a push could actually reach: parseable, and
+ * http(s). Anything else — an unfilled placeholder, a typo, a `file:` or `ws:`
+ * scheme — makes `fetch` throw a parse error that would otherwise be classified
+ * as a retryable network failure and retried forever.
+ */
+export function isPushableHttpUrl(url) {
+    if (typeof url !== "string" || url.trim() === "")
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
+/**
+ * Reduce a URL to scheme + host + path. Drops query and userinfo, which are the
+ * two places a credential can hide in a URL, and keeps enough for an operator to
+ * recognise which endpoint is being pushed to.
+ */
+export function redactEndpoint(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}${u.pathname}`;
+    }
+    catch {
+        return "[unparseable-url]";
+    }
+}
+/** True for a status that means "your key is not trusted here". */
+function isAuthRejection(status) {
+    return status === 401 || status === 403;
+}
+/** True for a status worth retrying: server-side or rate-limit. */
+function isTransientStatus(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+/** Pull the closed-vocabulary rejection reason out of an accept-side body. */
+function rejectionReasonOf(body) {
+    if (!body || typeof body !== "object")
+        return undefined;
+    const reason = body.reason;
+    if (typeof reason === "string" && MIRROR_REJECTION_REASONS.has(reason))
+        return reason;
+    return undefined;
+}
+/**
+ * Create the guarded one-cycle runner: build → sign → POST once, classified.
+ *
+ * The returned function is the ONLY thing that touches the network. It carries an
+ * in-flight guard for CONCURRENT callers of the same runner: while one cycle is
+ * running, a second call returns `skipped-overlap` immediately without building
+ * an envelope or issuing a request. (The daemon itself awaits each cycle, so it
+ * never trips this guard on its own — see the module header.) Exposed so a caller
+ * or a test can drive single cycles without the timer loop, exactly as
+ * `runSupervisorBeat` is exposed next to `runLoopSupervisor`.
+ *
+ * Never throws: every failure is classified into a {@link MirrorPushOutcome}.
+ */
+export function createMirrorPushRunner(options) {
+    const nowFn = options.now ?? (() => Date.now());
+    const build = options.buildImpl ??
+        ((nowMs) => buildInstanceMirror(createLocalStore({ root: options.root }), options.instance, nowMs));
+    const send = options.sendImpl ?? sendRemoteEnvelope;
+    let inFlight = false;
+    return async function runCycle() {
+        // OVERLAP GUARD: a slow push must not stack. Checked before any work, so a
+        // skipped cycle costs nothing and, crucially, sends nothing.
+        if (inFlight)
+            return { outcome: "skipped-overlap", durationMs: 0 };
+        inFlight = true;
+        const startedAt = nowFn();
+        try {
+            let envelope;
+            try {
+                envelope = build(startedAt);
+            }
+            catch (error) {
+                // Local build failure (e.g. the instance is not in this root's
+                // registry). Not fatal: an agent can re-register, so we back off and
+                // keep looping rather than tearing the daemon down. No request was made.
+                return {
+                    outcome: "build-failed",
+                    error: sanitizeForLog(errorText(error)),
+                    durationMs: nowFn() - startedAt
+                };
+            }
+            // Read once, before the send, so the shape is reported even for a failed
+            // push (the envelope is what WAS attempted).
+            const payload = payloadShapeOf(envelope);
+            let status;
+            let body;
+            try {
+                const res = await send(options.url, envelope, {
+                    by: options.instance,
+                    privateKeyPem: options.privateKeyPem
+                });
+                status = res.status;
+                body = res.body;
+            }
+            catch (error) {
+                // Transport threw: DNS, refused, TLS, timeout. Retryable.
+                return {
+                    outcome: "transient",
+                    error: sanitizeForLog(errorText(error)),
+                    durationMs: nowFn() - startedAt,
+                    payload
+                };
+            }
+            const durationMs = nowFn() - startedAt;
+            const reason = rejectionReasonOf(body);
+            if (status >= 200 && status < 300) {
+                return { outcome: "ok", status, durationMs, payload };
+            }
+            if (isAuthRejection(status)) {
+                // The key itself is refused. Counted toward the stop budget.
+                return { outcome: "auth-rejected", status, ...(reason ? { reason } : {}), durationMs, payload };
+            }
+            if (isTransientStatus(status)) {
+                return { outcome: "transient", status, ...(reason ? { reason } : {}), durationMs, payload };
+            }
+            // Other 4xx: a rejected envelope (stale sequence, replay, clock skew).
+            // Some of these self-heal as the sequence advances, so we keep looping —
+            // but backed off, so a permanently malformed push is not a hot loop.
+            return { outcome: "rejected", status, ...(reason ? { reason } : {}), durationMs, payload };
+        }
+        finally {
+            inFlight = false;
+        }
+    };
+}
+/** Abort-aware sleep. Resolves early (does not reject) when aborted. */
+function delay(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted)
+            return resolve();
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            resolve();
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/**
+ * Run the live mirror push until `signal` aborts, `max` cycles elapse, or the
+ * endpoint has refused this key often enough to stop (see
+ * {@link MIRROR_PUSH_REENROLLMENT_MESSAGE}).
+ *
+ * This is what the systemd `--user` unit runs. It is NEVER on any default code
+ * path: no caller reaches it without an explicit interval, and the kill-switch
+ * short-circuits it before the first request.
+ */
+export async function runMirrorPushDaemon(options) {
+    const env = options.env ?? process.env;
+    const nowFn = options.now ?? (() => Date.now());
+    const random = options.random ?? (() => Math.random());
+    const sleep = options.sleep ?? delay;
+    const intervalMs = options.intervalMs && options.intervalMs > 0
+        ? options.intervalMs
+        : DEFAULT_MIRROR_PUSH_INTERVAL_MS;
+    const authLimit = options.authFailureLimit && options.authFailureLimit > 0
+        ? options.authFailureLimit
+        : DEFAULT_MIRROR_AUTH_FAILURE_LIMIT;
+    const rejectLimit = options.rejectLimit && options.rejectLimit > 0
+        ? options.rejectLimit
+        : DEFAULT_MIRROR_REJECT_LIMIT;
+    const buildLimit = options.buildFailureLimit && options.buildFailureLimit > 0
+        ? options.buildFailureLimit
+        : DEFAULT_MIRROR_BUILD_FAILURE_LIMIT;
+    const backoffBase = options.backoffBaseMs && options.backoffBaseMs > 0
+        ? options.backoffBaseMs
+        : MIRROR_PUSH_BACKOFF_BASE_MS;
+    const backoffMax = options.backoffMaxMs && options.backoffMaxMs > 0
+        ? options.backoffMaxMs
+        : MIRROR_PUSH_BACKOFF_MAX_MS;
+    const endpoint = redactEndpoint(options.url);
+    let cycles = 0;
+    let ok = 0;
+    let failures = 0;
+    let skippedOverlap = 0;
+    let authFailures = 0;
+    let rejections = 0;
+    let buildFailures = 0;
+    let logFailures = 0;
+    let consecutiveFailures = 0;
+    const finish = (stopReason, message) => ({
+        cycles,
+        ok,
+        failures,
+        skippedOverlap,
+        authFailures,
+        rejections,
+        buildFailures,
+        logFailures,
+        stopReason,
+        ...(message ? { message } : {})
+    });
+    // KILL-SWITCH, checked BEFORE the first cycle: a frozen daemon must not emit
+    // a single request, not even one.
+    if (mirrorPushGloballyDisabled(env))
+        return finish("kill-switch");
+    if (options.signal?.aborted)
+        return finish("aborted");
+    // A target `fetch` cannot even parse would throw a parse TypeError that this
+    // daemon would classify as a retryable network failure and retry forever. Stop
+    // before the first cycle instead — the CLI refuses such a URL up front, but the
+    // library is public API and must not be loopable into that state either.
+    if (!isPushableHttpUrl(options.url)) {
+        return finish("config-invalid", MIRROR_PUSH_INVALID_URL_MESSAGE);
+    }
+    const runCycle = options.runner ?? createMirrorPushRunner(options);
+    // Monotonic slot anchor — cycle n is due at `anchor + n × intervalMs`, so a
+    // slow cycle does not push every later cycle late (no drift). Re-anchored
+    // after a backoff, whose delay is deliberate rather than lateness.
+    let anchor = nowFn();
+    let slot = 0;
+    for (;;) {
+        // Re-checked each cycle so a mutated environment freezes an already-running
+        // daemon at the next beat instead of only at (re)start.
+        if (mirrorPushGloballyDisabled(env))
+            return finish("kill-switch");
+        if (options.signal?.aborted)
+            return finish("aborted");
+        const result = await runCycle();
+        cycles += 1;
+        if (result.outcome === "skipped-overlap") {
+            skippedOverlap += 1;
+        }
+        else if (result.outcome === "ok") {
+            ok += 1;
+            consecutiveFailures = 0;
+            // Only a genuinely ACCEPTED push clears either stop budget.
+            authFailures = 0;
+            rejections = 0;
+            buildFailures = 0;
+        }
+        else {
+            failures += 1;
+            consecutiveFailures += 1;
+            if (result.outcome === "auth-rejected")
+                authFailures += 1;
+            if (result.outcome === "rejected")
+                rejections += 1;
+            if (result.outcome === "build-failed")
+                buildFailures += 1;
+        }
+        /**
+         * Emit the status line. OBSERVABILITY MUST NOT BREAK THE PIPELINE: `onCycle`
+         * is caller-supplied and writes to a stream the caller owns, so it can throw
+         * — the common case being EPIPE once a piped stdout closes (`| head -3`, a
+         * journald restart). Unguarded, that rejection escaped the daemon into the
+         * CLI's raw fatal handler and pinned the unit `failed` with a message
+         * matching none of the documented stops.
+         *
+         * A dead sink is not a reason to keep pushing blind, though: a closed stream
+         * never reopens, so we stop CLEANLY (exit 0, no message) instead of running
+         * unobservable. Any other logging error is counted and ignored.
+         *
+         * Returns false when the caller should stop.
+         */
+        const emit = async (nextInMs) => {
+            if (!options.onCycle)
+                return true;
+            try {
+                await options.onCycle({
+                    cycle: cycles,
+                    at: new Date(nowFn()).toISOString(),
+                    instance: options.instance,
+                    endpoint,
+                    outcome: result.outcome,
+                    ...(result.status !== undefined ? { status: result.status } : {}),
+                    ...(result.reason ? { reason: result.reason } : {}),
+                    ...(result.error ? { error: result.error } : {}),
+                    durationMs: result.durationMs,
+                    ...(result.payload?.seq !== undefined ? { seq: result.payload.seq } : {}),
+                    ...(result.payload
+                        ? {
+                            registrations: result.payload.registrations,
+                            presence: result.payload.presence,
+                            subagents: result.payload.subagents
+                        }
+                        : {}),
+                    ...(nextInMs !== undefined ? { nextInMs } : {}),
+                    authFailures,
+                    rejections,
+                    buildFailures
+                });
+                return true;
+            }
+            catch (error) {
+                logFailures += 1;
+                return !isClosedStreamError(error);
+            }
+        };
+        // AUTH STOP: the budget is spent, so stop instead of hammering a server
+        // that is refusing this key. Backoff already happened between attempts.
+        if (authFailures >= authLimit) {
+            await emit(undefined);
+            return finish("auth-stop", MIRROR_PUSH_REENROLLMENT_MESSAGE);
+        }
+        // REJECT STOP: the same reasoning for a request the endpoint keeps refusing
+        // on non-auth grounds. A looser budget, because a fencing rejection can
+        // genuinely clear — but not an unbounded one, because a wrong path cannot.
+        if (rejections >= rejectLimit) {
+            await emit(undefined);
+            return finish("reject-stop", MIRROR_PUSH_REJECTED_MESSAGE);
+        }
+        // BUILD STOP: we cannot even assemble a mirror. Nothing was sent and nothing
+        // will be, so idling `active (running)` forever would report green while the
+        // feed is dead. A wrong H2A_ROOT never self-heals — terminate loudly.
+        if (buildFailures >= buildLimit) {
+            await emit(undefined);
+            return finish("build-stop", MIRROR_PUSH_BUILD_FAILED_MESSAGE);
+        }
+        if (options.max !== undefined && cycles >= options.max) {
+            await emit(undefined);
+            return finish("max-cycles");
+        }
+        if (options.signal?.aborted) {
+            await emit(undefined);
+            return finish("aborted");
+        }
+        // Schedule the next cycle: backoff after a failure, otherwise the next
+        // monotonic slot with bounded jitter.
+        let waitMs;
+        if (consecutiveFailures > 0) {
+            const exp = Math.min(backoffMax, backoffBase * 2 ** (consecutiveFailures - 1));
+            waitMs = Math.max(0, Math.round(exp * (1 + MIRROR_PUSH_JITTER_FRACTION * (random() * 2 - 1))));
+            // The backoff wait is intentional, so the drift anchor restarts from here.
+            anchor = nowFn() + waitMs;
+            slot = 0;
+        }
+        else {
+            slot += 1;
+            let due = anchor + slot * intervalMs;
+            // A cycle that overran one or more whole slots must not fire the missed
+            // ones back-to-back: skip straight to the next slot in the future.
+            while (due <= nowFn()) {
+                slot += 1;
+                due = anchor + slot * intervalMs;
+            }
+            const jitter = intervalMs * MIRROR_PUSH_JITTER_FRACTION * (random() * 2 - 1);
+            waitMs = Math.max(0, Math.round(due - nowFn() + jitter));
+        }
+        // A dead status sink stops the daemon cleanly rather than leaving it to push
+        // where nobody can see what it is doing.
+        if (!(await emit(waitMs)))
+            return finish("log-unavailable");
+        await sleep(waitMs, options.signal);
+        if (options.signal?.aborted)
+            return finish("aborted");
+    }
+}
+//# sourceMappingURL=push-daemon.js.map

package/dist/runtime/mirror/push-daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-daemon.js","sourceRoot":"","sources":["../../../src/runtime/mirror/push-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,wEAAwE;AACxE,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAEpD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,kHAAkH;IAClH,yHAAyH;IACzH,iIAAiI;IACjI,uIAAuI,CAAC;AAE1I;;;;GAIG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,kGAAkG;IAClG,gEAAgE;IAChE,oJAAoJ;IACpJ,wGAAwG,CAAC;AAE3G,MAAM,CAAC,MAAM,+BAA+B,GAC1C,0GAA0G;IAC1G,0FAA0F;IAC1F,yEAAyE,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,0GAA0G;IAC1G,2GAA2G;IAC3G,8FAA8F;IAC9F,uHAAuH;IACvH,4CAA4C,CAAC;AA6I/C,qEAAqE;AACrE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,WAAW;IACX,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,SAAS;IACT,QAAQ;IACR,UAAU;IACV,gBAAgB;IAChB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,CACL,IAAI;SACD,OAAO,CAAC,uCAAuC,EAAE,gBAAgB,CAAC;SAClE,OAAO,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;QAChD,wEAAwE;SACvE,OAAO,CAAC,qCAAqC,EAAE,eAAe,CAAC;SAC/D,OAAO,CAAC,kCAAkC,EAAE,eAAe,CAAC;QAC7D,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;SACpE,OAAO,CACN,kFAAkF,EAClF,eAAe,CAChB;QACD,wEAAwE;QACxE,iEAAiE;SAChE,OAAO,CACN,iHAAiH,EACjH,gBAAgB,CACjB;SACA,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC;QACH,IAAI,KAAK,YAAY,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QACtF,MAAM,OAAO,GAAI,KAAkD,EAAE,OAAO,CAAC;QAC7E,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,yBAAyB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAI,KAA+C,EAAE,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,4BAA4B,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAqB;IAC3C,MAAM,IAAI,GAAI,QAA+B,CAAC,IAOjC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,mEAAmE;AACnE,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;IACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtF,OAAO,SAAS,CAAC;AACnB,CAAC;AAmBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GACT,OAAO,CAAC,SAAS;QACjB,CAAC,CAAC,KAAa,EAAe,EAAE,CAC9B,mBAAmB,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IAEpD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,KAAK,UAAU,QAAQ;QAC5B,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACnE,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,QAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,+DAA+D;gBAC/D,qEAAqE;gBACrE,yEAAyE;gBACzE,OAAO;oBACL,OAAO,EAAE,cAAc;oBACvB,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;oBACvC,UAAU,EAAE,KAAK,EAAE,GAAG,SAAS;iBAChC,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAEzC,IAAI,MAAc,CAAC;YACnB,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE;oBAC5C,EAAE,EAAE,OAAO,CAAC,QAAQ;oBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACpB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0DAA0D;gBAC1D,OAAO;oBACL,OAAO,EAAE,WAAW;oBACpB,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;oBACvC,UAAU,EAAE,KAAK,EAAE,GAAG,SAAS;oBAC/B,OAAO;iBACR,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;YACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACxD,CAAC;YACD,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,6DAA6D;gBAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAClG,CAAC;YACD,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC9F,CAAC;YACD,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7F,CAAC;gBAAS,CAAC;YACT,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AA6BD,wEAAwE;AACxE,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,SAAS,OAAO;YACd,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC;QAC1C,CAAC,CAAC,OAAO,CAAC,UAAU;QACpB,CAAC,CAAC,+BAA+B,CAAC;IACtC,MAAM,SAAS,GACb,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,GAAG,CAAC;QACtD,CAAC,CAAC,OAAO,CAAC,gBAAgB;QAC1B,CAAC,CAAC,iCAAiC,CAAC;IACxC,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,GAAG,CAAC;QAC5C,CAAC,CAAC,OAAO,CAAC,WAAW;QACrB,CAAC,CAAC,2BAA2B,CAAC;IAClC,MAAM,UAAU,GACd,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,GAAG,CAAC;QACxD,CAAC,CAAC,OAAO,CAAC,iBAAiB;QAC3B,CAAC,CAAC,kCAAkC,CAAC;IACzC,MAAM,WAAW,GACf,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC;QAChD,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,2BAA2B,CAAC;IAClC,MAAM,UAAU,GACd,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC;QAC9C,CAAC,CAAC,OAAO,CAAC,YAAY;QACtB,CAAC,CAAC,0BAA0B,CAAC;IACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,CACb,UAAgC,EAChC,OAAgB,EACS,EAAE,CAAC,CAAC;QAC7B,MAAM;QACN,EAAE;QACF,QAAQ;QACR,cAAc;QACd,YAAY;QACZ,UAAU;QACV,aAAa;QACb,WAAW;QACX,UAAU;QACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,kCAAkC;IAClC,IAAI,0BAA0B,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;IACrB,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,SAAS,CAAC;QACR,4EAA4E;QAC5E,wDAAwD;QACxD,IAAI,0BAA0B,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,CAAC;QAEZ,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YACzC,cAAc,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACnC,EAAE,IAAI,CAAC,CAAC;YACR,mBAAmB,GAAG,CAAC,CAAC;YACxB,4DAA4D;YAC5D,YAAY,GAAG,CAAC,CAAC;YACjB,UAAU,GAAG,CAAC,CAAC;YACf,aAAa,GAAG,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,QAAQ,IAAI,CAAC,CAAC;YACd,mBAAmB,IAAI,CAAC,CAAC;YACzB,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe;gBAAE,YAAY,IAAI,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;gBAAE,UAAU,IAAI,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;gBAAE,aAAa,IAAI,CAAC,CAAC;QAC5D,CAAC;QAED;;;;;;;;;;;;;WAaG;QACH,MAAM,IAAI,GAAG,KAAK,EAAE,QAAiB,EAAoB,EAAE;YACzD,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,OAAO,CAAC;oBACpB,KAAK,EAAE,MAAM;oBACb,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;oBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ;oBACR,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,GAAG,CAAC,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC;4BACE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa;4BAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;4BACjC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;yBACpC;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,YAAY;oBACZ,UAAU;oBACV,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,IAAI,CAAC,CAAC;gBACjB,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QAC/D,CAAC;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,aAAa,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QAED,uEAAuE;QACvE,sCAAsC;QACtC,IAAI,MAAc,CAAC;QACnB,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,GAAG,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,2BAA2B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/F,2EAA2E;YAC3E,MAAM,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;YAC1B,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,GAAG,UAAU,CAAC;YACrC,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,CAAC;gBACV,GAAG,GAAG,MAAM,GAAG,IAAI,GAAG,UAAU,CAAC;YACnC,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,GAAG,2BAA2B,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7E,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,6EAA6E;QAC7E,yCAAyC;QACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}