@tangle-network/agent-app 0.45.33 → 0.45.35

package/dist/spend/index.d.ts

@@ -252,6 +252,98 @@ interface SpendOwnershipSummary {
      */
     readonly foreignSandboxIds: readonly string[];
 }
+/**
+ * The stretch of time a reconciliation pass covers — the same window the
+ * product's own ledger fetch was scoped to.
+ *
+ * Declared by the caller rather than derived from the rows, because deriving it
+ * from the rows is circular: a feed that returns nothing would produce a
+ * zero-width window that expects nothing and certifies itself.
+ */
+interface SpendWindow {
+    /** Inclusive start, epoch ms. */
+    readonly startAt: number;
+    /** Inclusive end, epoch ms. */
+    readonly endAt: number;
+}
+/**
+ * One box's life, measured against a reconciliation window.
+ *
+ * The live interval is `[createdAt, horizon]`, where the horizon is the SAME one
+ * `computeExpectedCeiling` derives — so a box cannot count as live for the
+ * expectation check and dead for the ceiling check.
+ */
+interface SpendBoxLiveness {
+    readonly sandboxId: string;
+    readonly workspaceId: string;
+    /** First instant the box could have been billable. */
+    readonly liveFrom: number;
+    /** Last instant it could have been, evaluated at the window's end. */
+    readonly liveUntil: number;
+    /** Which fact closed the interval — the ceiling's own vocabulary. */
+    readonly basis: CeilingBasis;
+    /** True when any of that life fell inside the window. */
+    readonly overlaps: boolean;
+    /** How much of it did, in ms. Zero for a box that did not overlap. */
+    readonly liveMsInWindow: number;
+    /**
+     * True when the overlap is long enough that a settlement should have landed.
+     * A box that came up moments before the window closed is live but not yet
+     * expected — settlement lags provisioning, and demanding a row inside that lag
+     * would report the platform's ordinary queue as a defect.
+     */
+    readonly expectSettlement: boolean;
+}
+/**
+ * What this pass EXPECTED to be billed for — present on every report, including
+ * a clean one, for the same reason {@link SpendOwnershipSummary} is: "nothing
+ * fired" and "nothing was expected" and "nothing could be expected" are three
+ * different answers and a report that cannot tell them apart is the failure this
+ * closes.
+ */
+interface SpendExpectationSummary {
+    /**
+     * False when the caller declared no window, or the store cannot list its
+     * boxes. The pass then cannot say what it expected — which is reported, never
+     * rounded down to a clean bill.
+     */
+    readonly declared: boolean;
+    readonly window: SpendWindow | null;
+    /** Live ms inside the window before a settlement is expected of a box. */
+    readonly graceMs: number;
+    /** Boxes whose life overlapped the window at all. */
+    readonly liveBoxes: number;
+    /** Of those, the ones live long enough that a settlement should have landed. */
+    readonly expectedBoxes: number;
+    /** Of those, the ones at least one settlement this pass claimed did land against. */
+    readonly settledBoxes: number;
+    /**
+     * The expected boxes nothing settled against, in full — the exhibit list for
+     * "the check stopped checking", and an expectation a reader cannot audit is
+     * one they have to take on trust.
+     */
+    readonly unsettledSandboxIds: readonly string[];
+}
+/**
+ * How much this pass is entitled to claim about the bill.
+ *
+ * `ok` is gated on this, which is what makes an examined-nobody pass
+ * structurally incapable of rendering as a clean bill.
+ */
+type SpendCoverage = 
+/** The pass examined this product's settlements, or knows what it expected. */
+'verified'
+/**
+ * Expectation was declared and no box was live long enough to expect a bill.
+ * Zero settlements is the RIGHT answer — an idle product, not a defect, and
+ * the one case in which a pass that examined nobody is still clean.
+ */
+ | 'nothing-expected'
+/**
+ * The pass examined none of this product's settlements and cannot say what it
+ * expected. The CHECK is suspect, not the bill.
+ */
+ | 'unverified';
 /** The parts of a settlement reference id, once parsed. */
 interface SettlementReference {
     /** `stop` | `compute` | `egress` | `gpu-lease` | anything the platform adds. */
@@ -284,7 +376,18 @@ type SpendCheckId =
 /** A spend window far above the trailing median — the burst shape of a defect. */
  | 'velocity'
 /** The balance the product observes has gone below its floor. */
- | 'negative-balance';
+ | 'negative-balance'
+/**
+ * The product expected settlements and saw none — the only check whose
+ * subject is the CHECK rather than the bill.
+ *
+ * Every other rule is driven by a settlement row, so all of them go quiet
+ * together when the rows stop arriving: an empty ledger fetch, a stale
+ * ownership rule that excludes every box, an expectation ledger naming
+ * nobody. This is the rule that fires when the others cannot, and it reads as
+ * "do not trust this report" rather than "dispute this charge".
+ */
+ | 'silent-ledger';
 declare const SPEND_CHECKS: readonly SpendCheckId[];
 /**
  * One discrepancy, with every number the rule compared.
@@ -316,15 +419,34 @@ interface SpendFinding {
     readonly windowNanoUsd: number | null;
     readonly trailingMedianNanoUsd: number | null;
     readonly velocityRatio: number | null;
+    /** `velocity` and `silent-ledger` — the window the finding is about. */
     readonly windowStartAt: number | null;
+    readonly windowEndAt: number | null;
     /** `negative-balance` — the observed balance and the floor it broke. */
     readonly balanceNanoUsd: number | null;
     readonly balanceFloorNanoUsd: number | null;
+    /** `silent-ledger` — how many boxes were expected to settle, and how many did. */
+    readonly expectedBoxes: number | null;
+    readonly settledBoxes: number | null;
+    /** `silent-ledger`, per-box form — how long that box was live inside the window. */
+    readonly liveMsInWindow: number | null;
 }
 /** What one reconciliation pass concluded. */
 interface SpendReport {
-    /** True when nothing fired. `ok === findings.length === 0`. */
+    /**
+     * True when nothing fired AND the pass earned the right to say so:
+     * `findings.length === 0 && coverage !== 'unverified'`.
+     *
+     * The second half is not decoration. Every rule but `silent-ledger` is driven
+     * by a settlement row, so a pass that read no rows — an empty ledger fetch, a
+     * stale ownership rule excluding every box, an expectation ledger naming
+     * nobody — fires nothing and used to report a clean bill. `coverage` is what
+     * makes that shape unrepresentable, and it holds even when a caller skips the
+     * `silent-ledger` check: the skip removes the finding, never the verdict.
+     */
     readonly ok: boolean;
+    /** How much this pass is entitled to claim. See {@link SpendCoverage}. */
+    readonly coverage: SpendCoverage;
     readonly findings: readonly SpendFinding[];
     readonly checksRun: readonly SpendCheckId[];
     /** Rows the pass read, including the ones no rule looked at. */
@@ -337,6 +459,8 @@ interface SpendReport {
     readonly creditedNanoUsd: number;
     /** What this pass claimed as its own, and what it excluded as another product's. */
     readonly ownership: SpendOwnershipSummary;
+    /** What this pass expected to be billed for, and what did not arrive. */
+    readonly expectation: SpendExpectationSummary;
     /** The instant the pass treated as "now". */
     readonly asOf: number;
 }
@@ -428,6 +552,137 @@ declare function ownedByBillingKeys(keyIds: readonly string[]): SpendOwnershipRu
  */
 declare function decideBoxOwnership(rule: SpendOwnershipRule, sandboxId: string, rows: readonly SettlementRow[]): SpendOwnershipVerdict;
 
+/**
+ * Expectation liveness: what the product BELIEVES it should have been billed for.
+ *
+ * ## The hole this closes
+ *
+ * `reconcileSpend` compares settlements against expectations, and every one of
+ * its rules is driven by a settlement row. That makes it able to answer exactly
+ * one direction of the question:
+ *
+ * > were we billed for something we did not ask for, or for more than allowed?
+ *
+ * It cannot answer the other direction — *were we NOT billed for something we
+ * DID ask for* — because with no row there is nothing to iterate. Three real
+ * shapes fall straight through that hole and every one of them renders as a
+ * clean bill:
+ *
+ * - the expectation ledger names no box, so the pass examines nobody → `ok:true`;
+ * - the billing endpoint quietly starts returning zero rows → `ok:true`,
+ *   `rowsExamined:0`;
+ * - a stale or rotated key list excludes every box → `ok:true` with everything
+ *   `foreign`.
+ *
+ * In all three the check stopped checking while looking green. That is the exact
+ * failure class the module exists to prevent, reproduced inside the module.
+ *
+ * ## The discriminator, and why it is not a new store
+ *
+ * The expectation ledger already records the only fact needed: when the product
+ * first saw a box (`createdAt`), the last work it observed (`lastActivityAt`),
+ * and any stop or delete it knows about. Those are precisely the inputs
+ * {@link computeExpectedCeiling} already folds into a horizon — the latest
+ * instant a box could still have been billable. So a box's LIVE INTERVAL is
+ * `[createdAt, horizon]`, derived from the same fold the ceiling uses rather
+ * than from a second, drift-prone definition of "running".
+ *
+ * A box whose live interval overlaps the reconciliation window is a box the
+ * product expected to be billed for. The absence of a settlement against it is
+ * then a first-class outcome, not silence.
+ *
+ * ## Why the grace period is load-bearing
+ *
+ * Settlement lags provisioning. A box that came up ninety seconds before the
+ * window closed has no settlement yet and never should have — expecting one
+ * would manufacture a finding out of the platform's ordinary queue behaviour.
+ * So expectation is asserted only for boxes with at least
+ * {@link DEFAULT_EXPECTATION_GRACE_MS} of live time INSIDE the window, which is
+ * the platform's own declared-normal settlement lag (see the constant).
+ *
+ * The asymmetry the rest of the module runs on holds here too, but it points the
+ * other way and that is deliberate: an over-tight liveness derivation produces a
+ * false ALARM about the check, never a false clean bill. Nothing in this file
+ * can make a report cleaner than it would otherwise be.
+ */
+/**
+ * How much live time a box needs inside the window before a settlement is
+ * EXPECTED for it. 15 minutes.
+ *
+ * Same number and same justification as {@link DEFAULT_CEILING_TOLERANCE_MS},
+ * arrived at from the other side: the platform's runbook clears a compute
+ * settlement incident when `/health computeSettlement.oldestAgeSeconds` is "back
+ * under 900", so 900 s is lag the platform has already declared normal. A box
+ * live for less than that inside the window may legitimately have settled
+ * nothing yet, and demanding a row for it would report the platform's own queue
+ * as a defect.
+ *
+ * A caller parameter, because a product reconciling a very short window must
+ * shrink it or the window expects nothing at all.
+ */
+declare const DEFAULT_EXPECTATION_GRACE_MS = 900000;
+/** Options for {@link boxLivenessInWindow}. */
+interface BoxLivenessOptions {
+    /** Live ms inside the window before a settlement is expected. Default {@link DEFAULT_EXPECTATION_GRACE_MS}. */
+    readonly graceMs?: number;
+}
+/** Reject a window that cannot be reconciled, rather than examining nobody inside it. */
+declare function assertSpendWindow(window: SpendWindow): void;
+/**
+ * One box's live interval, and whether the product should have been billed for
+ * it inside this window.
+ *
+ * The live interval's end is {@link computeExpectedCeiling}'s horizon evaluated
+ * at the window's end — the SAME derivation the ceiling check uses, so a box
+ * cannot be considered live here and dead there. `toleranceMs` is zero because
+ * tolerance is slack allowed to the PLATFORM's clock, and widening a box's life
+ * by it would expect settlements for boxes that were already gone.
+ */
+declare function boxLivenessInWindow(record: SpendBoxRecord, window: SpendWindow, options?: BoxLivenessOptions): SpendBoxLiveness;
+/** Why {@link assessAllExcluded} answered the way it did. */
+type AllExcludedBasis = 
+/** Not every box was excluded — the pass examined some of this product's own. */
+'not-all-excluded'
+/** Boxes of this product's were live in the window, so an all-foreign pass is wrong. */
+ | 'expected-boxes-live'
+/** Expectation was declared and nothing was live: an idle product, not a defect. */
+ | 'nothing-expected'
+/** No expectation was declared, so the question cannot be answered. Fails closed. */
+ | 'not-declared';
+/** {@link assessAllExcluded}'s verdict, with the reason a pager message needs. */
+interface AllExcludedAssessment {
+    /** True when the caller should raise. */
+    readonly pathological: boolean;
+    readonly basis: AllExcludedBasis;
+    /** One sentence naming the numbers behind the verdict. */
+    readonly reason: string;
+}
+/**
+ * Should "we saw settlements but none of them were ours" page a human?
+ *
+ * Consumers raise this pathology on `boxesExamined > 0 && ownedBoxes === 0`.
+ * That shape has two completely different causes and the naive test cannot tell
+ * them apart:
+ *
+ * - an ownership rule that has gone stale — a rotated key, a new deployment key
+ *   nobody added — so every one of the product's OWN boxes now reads as a
+ *   sibling's. The check has stopped checking.
+ * - a product that was legitimately idle while a sibling settled on the same
+ *   wallet. Nothing is wrong, and paging on it pages EVERY day the product is
+ *   quiet, which is how a real alert gets muted.
+ *
+ * The discriminator is expectation liveness: did this product have a box alive
+ * during the window? Only then is an all-excluded pass pathological.
+ *
+ * Fails closed when no expectation was declared — that is today's behaviour, and
+ * a pass that cannot answer the question must not answer it optimistically. The
+ * `reason` says so, and the fix (declare `window`, implement `listLiveBetween`)
+ * is in the string a human reads.
+ */
+declare function assessAllExcluded(report: SpendReport): AllExcludedAssessment;
+/** The expectation summary a pass that declared none reports. Loud, never absent. */
+declare function undeclaredExpectation(graceMs: number): SpendExpectationSummary;
+
 /**
  * Persistence seam for the expectation ledger — the product implements it over
  * its own tables.
@@ -449,6 +704,30 @@ interface SpendLedgerStorePort {
      *  statement as the record, or ignore them if the table has no extra columns. */
     insert(record: SpendBoxRecord, extras?: Record<string, unknown>): Promise<SpendBoxRecord>;
     update(sandboxId: string, patch: SpendBoxPatch): Promise<SpendBoxRecord | null>;
+    /**
+     * OPTIONAL — every box that could have been live during the window.
+     *
+     * This is the one capability that lets a reconciliation answer "were we NOT
+     * billed for something we DID ask for". Without it the pass is driven entirely
+     * by settlement rows, so a feed that returns nothing fires nothing and reads
+     * as a clean bill. Omitting it is safe and additive: the pass reports
+     * `expectation.declared: false` and refuses to certify a bill it could not
+     * check (see {@link SpendReport.coverage}).
+     *
+     * **It may over-return.** The reconciler re-derives liveness itself with
+     * `boxLivenessInWindow`, so a store that returns every row it has is correct,
+     * merely slower. That is deliberate: the definition of "live" must live in one
+     * place, not once per product's SQL. The intended predicate is the coarse one
+     * a WHERE clause can express —
+     *
+     * ```sql
+     * WHERE created_at <= :endAt AND (deleted_at IS NULL OR deleted_at >= :startAt)
+     * ```
+     *
+     * — and the exact answer (idle timeout, max lifetime, stop, open detached run)
+     * is the reconciler's.
+     */
+    listLiveBetween?(window: SpendWindow): Promise<readonly SpendBoxRecord[]>;
 }
 /**
  * Apply one fold step. Exported so a SQL implementation and an in-memory one
@@ -697,6 +976,27 @@ interface ReconcileSpendOptions {
     readonly workspaceId?: string;
     /** Checks to leave out of this pass. */
     readonly skip?: readonly SpendCheckId[];
+    /**
+     * The stretch of time these `rows` were fetched for.
+     *
+     * Declaring it — together with a store that implements `listLiveBetween` — is
+     * what lets the pass answer the direction every settlement-driven rule is
+     * blind to: *were we NOT billed for something we DID ask for*. The expectation
+     * ledger already holds the answer; nothing new is stored for it.
+     *
+     * Omitting it is additive and changes no existing finding. It is not silent:
+     * `report.expectation.declared` is `false`, `formatSpendReport` prints
+     * `expectation: NOT DECLARED` above the findings, and a pass that also
+     * examined none of this product's settlements reports `coverage: 'unverified'`
+     * and cannot render as a clean bill.
+     */
+    readonly window?: SpendWindow;
+    /**
+     * Live ms a box needs inside the window before a settlement is EXPECTED of it.
+     * Default {@link DEFAULT_EXPECTATION_GRACE_MS} (15 min — the platform's own
+     * declared-normal settlement lag). Shrink it for a short window.
+     */
+    readonly expectationGraceMs?: number;
 }
 /**
  * Diff what the platform charged against what the product believes it asked for.
@@ -842,4 +1142,4 @@ declare function formatSpendReport(report: SpendReport): string;
 /** The report as a plain JSON value, for an alerting pipeline. */
 declare function spendReportToJson(report: SpendReport): string;
 
-export { type BilledDurationBasis, type BoxRateResolver, type CeilingBasis, type ComputeBudget, ComputeBudgetExceededError, type ComputeBudgetRefusal, type ComputeExpectedCeilingOptions, DEFAULT_CEILING_TOLERANCE_MS, type ExpectedCeiling, type InMemorySpendLedgerStore, type ObserveSandboxInput, type ObservedBalance, type ReconcileSpendOptions, SPEND_CHECKS, type SandboxSpendHooksOptions, type SandboxSpendSeam, type SettlementReference, type SettlementRow, type SpendBoxPatch, type SpendBoxRecord, type SpendCheckId, type SpendFinding, type SpendLedger, type SpendLedgerOptions, type SpendLedgerStorePort, type SpendOwnershipCandidate, type SpendOwnershipRule, type SpendOwnershipSummary, type SpendOwnershipVerdict, type SpendProvisionObservation, type SpendReport, type VelocityOptions, assertComputeBudget, chargeNanoUsd, computeExpectedCeiling, createInMemorySpendLedgerStore, createSandboxSpendHooks, createSpendLedger, decideBoxOwnership, foldSpendBoxRecord, formatSpendReport, isCharge, ownedByBillingKeys, parseSandboxGroupKey, parseSettlementReference, reconcileSpend, settlementSandboxId, spendReportToJson };
+export { type AllExcludedAssessment, type AllExcludedBasis, type BilledDurationBasis, type BoxLivenessOptions, type BoxRateResolver, type CeilingBasis, type ComputeBudget, ComputeBudgetExceededError, type ComputeBudgetRefusal, type ComputeExpectedCeilingOptions, DEFAULT_CEILING_TOLERANCE_MS, DEFAULT_EXPECTATION_GRACE_MS, type ExpectedCeiling, type InMemorySpendLedgerStore, type ObserveSandboxInput, type ObservedBalance, type ReconcileSpendOptions, SPEND_CHECKS, type SandboxSpendHooksOptions, type SandboxSpendSeam, type SettlementReference, type SettlementRow, type SpendBoxLiveness, type SpendBoxPatch, type SpendBoxRecord, type SpendCheckId, type SpendCoverage, type SpendExpectationSummary, type SpendFinding, type SpendLedger, type SpendLedgerOptions, type SpendLedgerStorePort, type SpendOwnershipCandidate, type SpendOwnershipRule, type SpendOwnershipSummary, type SpendOwnershipVerdict, type SpendProvisionObservation, type SpendReport, type SpendWindow, type VelocityOptions, assertComputeBudget, assertSpendWindow, assessAllExcluded, boxLivenessInWindow, chargeNanoUsd, computeExpectedCeiling, createInMemorySpendLedgerStore, createSandboxSpendHooks, createSpendLedger, decideBoxOwnership, foldSpendBoxRecord, formatSpendReport, isCharge, ownedByBillingKeys, parseSandboxGroupKey, parseSettlementReference, reconcileSpend, settlementSandboxId, spendReportToJson, undeclaredExpectation };

package/dist/spend/index.js

@@ -1,6 +1,10 @@
 import {
   DEFAULT_CEILING_TOLERANCE_MS,
+  DEFAULT_EXPECTATION_GRACE_MS,
   SPEND_CHECKS,
+  assertSpendWindow,
+  assessAllExcluded,
+  boxLivenessInWindow,
   chargeNanoUsd,
   computeExpectedCeiling,
   decideBoxOwnership,
@@ -11,8 +15,9 @@ import {
   parseSettlementReference,
   reconcileSpend,
   settlementSandboxId,
-  spendReportToJson
-} from "../chunk-5LC2VXH5.js";
+  spendReportToJson,
+  undeclaredExpectation
+} from "../chunk-TRWJ5CRT.js";
 
 // src/spend/store.ts
 function foldSpendBoxRecord(record, patch) {
@@ -61,6 +66,11 @@ function createInMemorySpendLedgerStore() {
       rows.set(sandboxId, next);
       return structuredClone(next);
     },
+    async listLiveBetween(window) {
+      return [...rows.values()].filter(
+        (row) => row.createdAt <= window.endAt && (row.deletedAt === null || row.deletedAt >= window.startAt)
+      ).map((row) => structuredClone(row));
+    },
     records() {
       return [...rows.values()].map((row) => structuredClone(row));
     },
@@ -179,8 +189,12 @@ function createSandboxSpendHooks(options) {
 export {
   ComputeBudgetExceededError,
   DEFAULT_CEILING_TOLERANCE_MS,
+  DEFAULT_EXPECTATION_GRACE_MS,
   SPEND_CHECKS,
   assertComputeBudget,
+  assertSpendWindow,
+  assessAllExcluded,
+  boxLivenessInWindow,
   chargeNanoUsd,
   computeExpectedCeiling,
   createInMemorySpendLedgerStore,
@@ -195,6 +209,7 @@ export {
   parseSettlementReference,
   reconcileSpend,
   settlementSandboxId,
-  spendReportToJson
+  spendReportToJson,
+  undeclaredExpectation
 };
 //# sourceMappingURL=index.js.map

package/dist/spend/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/spend/store.ts","../../src/spend/budget.ts"],"sourcesContent":["import type { SpendBoxPatch, SpendBoxRecord } from './types'\n\n/**\n * Persistence seam for the expectation ledger — the product implements it over\n * its own tables.\n *\n * Deliberately NOT compare-and-set, unlike `MissionStorePort`. A mission has one\n * serialized owner and a lost write corrupts a state machine; a box record is a\n * MONOTONIC FOLD (activity takes a max, a detached-run id joins or leaves a set,\n * delete is set-once) so concurrent writers converge no matter what order they\n * land in. The worst a lost race can do here is leave `lastActivityAt` behind\n * the truth — which makes the derived ceiling TIGHTER, so the failure mode is a\n * false alarm a human dismisses, never a missed charge. That asymmetry is the\n * whole reason the fold is shaped this way.\n *\n * `update` returns null when the row does not exist, never a throw.\n */\nexport interface SpendLedgerStorePort {\n  load(sandboxId: string): Promise<SpendBoxRecord | null>\n  /** `extras` are the opaque product-column values — write them in the SAME\n   *  statement as the record, or ignore them if the table has no extra columns. */\n  insert(record: SpendBoxRecord, extras?: Record<string, unknown>): Promise<SpendBoxRecord>\n  update(sandboxId: string, patch: SpendBoxPatch): Promise<SpendBoxRecord | null>\n}\n\n/**\n * Apply one fold step. Exported so a SQL implementation and an in-memory one\n * reach the same record, and so a product can unit-test its own store against\n * the canonical answer.\n *\n * The two rules worth stating out loud:\n *\n * - `observedActivityAt` only ever moves `lastActivityAt` FORWARD. A replayed\n *   or out-of-order event cannot rewind the ceiling.\n * - activity later than a recorded `stoppedAt` CLEARS the stop. A box that\n *   worked after the product thought it stopped is running again, and keeping\n *   the stale stop would make the ceiling too tight — inventing an over-ceiling\n *   finding out of the product's own bookkeeping rather than the platform's.\n */\nexport function foldSpendBoxRecord(record: SpendBoxRecord, patch: SpendBoxPatch): SpendBoxRecord {\n  let lastActivityAt = record.lastActivityAt\n  let stoppedAt = record.stoppedAt\n  let openDetachedRunIds = record.openDetachedRunIds\n\n  if (patch.observedActivityAt !== undefined) {\n    lastActivityAt = Math.max(lastActivityAt, patch.observedActivityAt)\n    if (stoppedAt !== null && patch.observedActivityAt > stoppedAt) stoppedAt = null\n  }\n  if (patch.openDetachedRunAdd !== undefined && !openDetachedRunIds.includes(patch.openDetachedRunAdd)) {\n    openDetachedRunIds = [...openDetachedRunIds, patch.openDetachedRunAdd]\n  }\n  if (patch.openDetachedRunRemove !== undefined) {\n    openDetachedRunIds = openDetachedRunIds.filter((id) => id !== patch.openDetachedRunRemove)\n  }\n  if (patch.stoppedAt !== undefined) {\n    // Latest-wins, but never behind observed activity: a stop we are told about\n    // that predates work we watched is not the stop that closed this box.\n    stoppedAt = patch.stoppedAt >= lastActivityAt ? patch.stoppedAt : stoppedAt\n  }\n\n  return {\n    ...record,\n    lastActivityAt,\n    stoppedAt,\n    openDetachedRunIds,\n    // Set-once: a deleted sandbox id never comes back, so a second observation\n    // is a duplicate delivery, not a second deletion.\n    deletedAt: record.deletedAt ?? patch.deletedAt ?? null,\n  }\n}\n\n/** An in-memory store that also lets a test inspect and force state. */\nexport interface InMemorySpendLedgerStore extends SpendLedgerStorePort {\n  /** Every record, insertion order. */\n  records(): SpendBoxRecord[]\n  /** Unguarded direct write — simulates a crash-shaped or platform-seeded row. */\n  put(record: SpendBoxRecord): void\n}\n\n/** Create an in-memory expectation ledger. Production writers use the same port. */\nexport function createInMemorySpendLedgerStore(): InMemorySpendLedgerStore {\n  const rows = new Map<string, SpendBoxRecord>()\n  return {\n    async load(sandboxId) {\n      const row = rows.get(sandboxId)\n      return row ? structuredClone(row) : null\n    },\n    async insert(record) {\n      const stored = structuredClone(record)\n      rows.set(record.sandboxId, stored)\n      return structuredClone(stored)\n    },\n    async update(sandboxId, patch) {\n      const current = rows.get(sandboxId)\n      if (!current) return null\n      const next = foldSpendBoxRecord(current, patch)\n      rows.set(sandboxId, next)\n      return structuredClone(next)\n    },\n    records() {\n      return [...rows.values()].map((row) => structuredClone(row))\n    },\n    put(record) {\n      rows.set(record.sandboxId, structuredClone(record))\n    },\n  }\n}\n\n/** What the product tells the ledger when it first sees a box. */\nexport interface ObserveSandboxInput {\n  readonly sandboxId: string\n  readonly workspaceId: string\n  /** The idle timeout the product asked the platform for, seconds. */\n  readonly idleTimeoutSeconds: number\n  /** The max lifetime the product asked for, seconds, when it asked for one. */\n  readonly maxLifetimeSeconds?: number | null\n  /** Defaults to the ledger's clock. */\n  readonly at?: number\n}\n\nexport interface SpendLedgerOptions {\n  readonly store: SpendLedgerStorePort\n  /** Injectable clock (epoch ms). Default `Date.now`. */\n  readonly now?: () => number\n  /** Product columns written verbatim on every insert. */\n  readonly extras?: Record<string, unknown>\n}\n\n/**\n * The recording half of spend verification: the product's own account of what\n * it asked the platform for.\n *\n * Every method is best-effort from the caller's point of view — a product wires\n * these into paths that must not fail because bookkeeping failed. They still\n * reject on a store error rather than swallowing it, so a caller that wants\n * fire-and-forget says so at the call site (`/sandbox`'s hook does).\n */\nexport interface SpendLedger {\n  /**\n   * Record that a box exists and is billable from now. Inserts on first sight,\n   * and otherwise records activity — reuse and resume are both \"the platform is\n   * charging for this box again\", and the record's own existence is what\n   * distinguishes them, so no caller has to know which happened.\n   */\n  observeSandbox(input: ObserveSandboxInput): Promise<SpendBoxRecord>\n  /** Record that the product saw this box do work. */\n  recordActivity(sandboxId: string, at?: number): Promise<SpendBoxRecord | null>\n  /**\n   * Record that the product handed the platform work it will NOT watch finish.\n   * Until the matching end is recorded, this box's ceiling cannot rest on\n   * observed activity — see `computeExpectedCeiling`.\n   */\n  recordDetachedRunStarted(sandboxId: string, runId: string, at?: number): Promise<SpendBoxRecord | null>\n  /** Record that a detached run was confirmed finished. */\n  recordDetachedRunEnded(sandboxId: string, runId: string, at?: number): Promise<SpendBoxRecord | null>\n  /** Record that the product knows this box stopped. */\n  recordStopped(sandboxId: string, at?: number): Promise<SpendBoxRecord | null>\n  /** Record that the product knows this box was deleted. */\n  recordDeleted(sandboxId: string, at?: number): Promise<SpendBoxRecord | null>\n}\n\n/** Create the recording half over a product-supplied store. */\nexport function createSpendLedger(options: SpendLedgerOptions): SpendLedger {\n  const { store } = options\n  const clock = options.now ?? Date.now\n\n  return {\n    async observeSandbox(input) {\n      const at = input.at ?? clock()\n      const existing = await store.load(input.sandboxId)\n      if (existing) {\n        const updated = await store.update(input.sandboxId, { observedActivityAt: at })\n        return updated ?? existing\n      }\n      return await store.insert(\n        {\n          sandboxId: input.sandboxId,\n          workspaceId: input.workspaceId,\n          createdAt: at,\n          idleTimeoutSeconds: input.idleTimeoutSeconds,\n          maxLifetimeSeconds: input.maxLifetimeSeconds ?? null,\n          lastActivityAt: at,\n          openDetachedRunIds: [],\n          stoppedAt: null,\n          deletedAt: null,\n        },\n        options.extras,\n      )\n    },\n    async recordActivity(sandboxId, at) {\n      return await store.update(sandboxId, { observedActivityAt: at ?? clock() })\n    },\n    async recordDetachedRunStarted(sandboxId, runId, at) {\n      return await store.update(sandboxId, {\n        observedActivityAt: at ?? clock(),\n        openDetachedRunAdd: runId,\n      })\n    },\n    async recordDetachedRunEnded(sandboxId, runId, at) {\n      return await store.update(sandboxId, {\n        observedActivityAt: at ?? clock(),\n        openDetachedRunRemove: runId,\n      })\n    },\n    async recordStopped(sandboxId, at) {\n      return await store.update(sandboxId, { stoppedAt: at ?? clock() })\n    },\n    async recordDeleted(sandboxId, at) {\n      return await store.update(sandboxId, { deletedAt: at ?? clock() })\n    },\n  }\n}\n","import type { SpendLedger } from './store'\n\n/** Why provisioning was refused, with every number the decision used. */\nexport interface ComputeBudgetRefusal {\n  readonly workspaceId: string\n  /** The cap, unsigned nanodollars. */\n  readonly limitNanoUsd: number\n  /** Cumulative settled compute spend for this workspace, unsigned nanodollars. */\n  readonly settledNanoUsd: number\n  /** How far past the cap it already is. */\n  readonly overageNanoUsd: number\n  readonly at: number\n}\n\n/**\n * Provisioning refused because the workspace is already past its compute cap.\n *\n * Correctable by design: every number the decision used is on the error, so a\n * product can render \"this workspace has spent $X of its $Y compute budget\" and\n * an operator can raise the cap or investigate without reading logs.\n *\n * This is the failure mode the module exists to produce. A platform billing\n * defect that used to end in a silent negative balance now ends in provisioning\n * stopping and something loud happening instead.\n */\nexport class ComputeBudgetExceededError extends Error {\n  readonly workspaceId: string\n  readonly limitNanoUsd: number\n  readonly settledNanoUsd: number\n  readonly overageNanoUsd: number\n\n  constructor(refusal: ComputeBudgetRefusal) {\n    super(\n      `Compute budget exceeded for workspace ${refusal.workspaceId}: ` +\n        `$${(refusal.settledNanoUsd / 1_000_000_000).toFixed(2)} settled against a cap of ` +\n        `$${(refusal.limitNanoUsd / 1_000_000_000).toFixed(2)} ` +\n        `(over by $${(refusal.overageNanoUsd / 1_000_000_000).toFixed(2)}). ` +\n        'No sandbox was provisioned. Raise the cap or reconcile the spend before retrying.',\n    )\n    this.name = 'ComputeBudgetExceededError'\n    this.workspaceId = refusal.workspaceId\n    this.limitNanoUsd = refusal.limitNanoUsd\n    this.settledNanoUsd = refusal.settledNanoUsd\n    this.overageNanoUsd = refusal.overageNanoUsd\n  }\n}\n\n/**\n * A per-workspace cap on sandbox compute.\n *\n * `/billing`'s budget primitive caps MODEL keys, and it works because the\n * platform enforces the cap at the key it minted. Sandbox compute has no such\n * key: a box bills the shared company wallet, so nothing upstream refuses. This\n * carries the same shape to the one place a consumer can still act — the moment\n * before it asks for another box.\n *\n * `settledNanoUsd` is a callback rather than a number because the authority is\n * the platform ledger, not this package: the product reads the same rows it\n * hands the reconciler. Cache it if the read is expensive; a cap is a\n * coarse-grained control and a slightly stale total still refuses.\n */\nexport interface ComputeBudget {\n  /** The cap, unsigned nanodollars. */\n  readonly limitNanoUsd: number\n  /** Cumulative settled compute spend for the workspace, unsigned nanodollars. */\n  readonly settledNanoUsd: (workspaceId: string) => Promise<number> | number\n  /**\n   * Called on every refusal, before the error is thrown. This is the alert\n   * seam: a refusal nobody hears is a product that silently stopped working.\n   */\n  readonly onRefusal?: (refusal: ComputeBudgetRefusal) => void\n  /** Injectable clock (epoch ms). Default `Date.now`. */\n  readonly now?: () => number\n}\n\n/**\n * Throw {@link ComputeBudgetExceededError} when the workspace is already past\n * its cap. Returns normally — and reads nothing — when no budget is configured.\n *\n * Deliberately a pre-check against spend ALREADY SETTLED, not a reservation\n * against spend about to happen: settlement lags provisioning by design (the\n * platform's durable settlement queue), so there is no instant at which a\n * consumer could hold an accurate running total. The cap therefore overshoots by\n * at most the unsettled tail, which is bounded by the box's own idle timeout.\n * A cap that refuses one box late is worth far more than one that cannot be\n * implemented honestly.\n */\nexport async function assertComputeBudget(\n  budget: ComputeBudget | undefined,\n  workspaceId: string,\n): Promise<void> {\n  if (!budget) return\n  const settledNanoUsd = await budget.settledNanoUsd(workspaceId)\n  if (settledNanoUsd < budget.limitNanoUsd) return\n\n  const refusal: ComputeBudgetRefusal = {\n    workspaceId,\n    limitNanoUsd: budget.limitNanoUsd,\n    settledNanoUsd,\n    overageNanoUsd: settledNanoUsd - budget.limitNanoUsd,\n    at: (budget.now ?? Date.now)(),\n  }\n  budget.onRefusal?.(refusal)\n  throw new ComputeBudgetExceededError(refusal)\n}\n\n// ── the /sandbox seam ─────────────────────────────────────────────────────────\n\n/**\n * What `/sandbox` reports once a box is provisioned, reused or resumed.\n *\n * Structurally identical to `SandboxProvisionedObservation` in `/sandbox`, and\n * deliberately re-declared rather than imported: `/spend` composes `/sandbox`,\n * so a type import in the other direction would invert the dependency. The two\n * are pinned together by a compile-time assignment in this module's tests.\n */\nexport interface SpendProvisionObservation {\n  readonly workspaceId: string\n  readonly userId?: string\n  readonly sandboxId: string\n  readonly boxKey?: string | undefined\n  readonly idleTimeoutSeconds: number\n  readonly maxLifetimeSeconds?: number | undefined\n  readonly at: number\n}\n\n/**\n * The optional seam `EnsureWorkspaceSandboxOptions.spend` and the turn\n * primitives' `spend` option both accept. One object, wired in both places.\n */\nexport interface SandboxSpendSeam {\n  beforeProvision?(input: { workspaceId: string; userId?: string }): Promise<void> | void\n  onProvisioned?(observation: SpendProvisionObservation): Promise<void> | void\n  /** Synchronous by contract — it sits on the turn path. See `createSandboxSpendHooks`. */\n  onActivity?(input: { sandboxId: string; at: number }): void\n}\n\nexport interface SandboxSpendHooksOptions {\n  /** Records box lifecycle. Omit to run the budget guard alone. */\n  readonly ledger?: SpendLedger\n  /** Refuses provisioning past a cap. Omit to record alone. */\n  readonly budget?: ComputeBudget\n  /**\n   * Called when RECORDING fails. Recording is best-effort — a bookkeeping\n   * failure must never take down the provisioning it is bookkeeping — so this\n   * is the only place such a failure is visible. A refusal is NOT routed here;\n   * refusals throw, by design.\n   */\n  readonly onError?: (error: unknown) => void\n}\n\n/**\n * Build the object to hand `ensureWorkspaceSandbox`'s `spend` option.\n *\n * Wiring it is the entire adoption cost: one field, and the product's boxes are\n * both budget-capped and recorded.\n */\nexport function createSandboxSpendHooks(options: SandboxSpendHooksOptions): SandboxSpendSeam {\n  const { ledger, budget, onError } = options\n  return {\n    async beforeProvision(input) {\n      await assertComputeBudget(budget, input.workspaceId)\n    },\n    async onProvisioned(observation) {\n      if (!ledger) return\n      try {\n        await ledger.observeSandbox({\n          sandboxId: observation.sandboxId,\n          workspaceId: observation.workspaceId,\n          idleTimeoutSeconds: observation.idleTimeoutSeconds,\n          maxLifetimeSeconds: observation.maxLifetimeSeconds ?? null,\n          at: observation.at,\n        })\n      } catch (err) {\n        onError?.(err)\n      }\n    },\n    onActivity(input) {\n      if (!ledger) return\n      // The turn path calls this synchronously and does not await it, so the\n      // promise is settled here rather than escaping as an unhandled rejection.\n      // Recording activity is a monotonic max, so a write that lands late — or\n      // out of order against another turn's — still converges.\n      void ledger.recordActivity(input.sandboxId, input.at).catch((err: unknown) => onError?.(err))\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuCO,SAAS,mBAAmB,QAAwB,OAAsC;AAC/F,MAAI,iBAAiB,OAAO;AAC5B,MAAI,YAAY,OAAO;AACvB,MAAI,qBAAqB,OAAO;AAEhC,MAAI,MAAM,uBAAuB,QAAW;AAC1C,qBAAiB,KAAK,IAAI,gBAAgB,MAAM,kBAAkB;AAClE,QAAI,cAAc,QAAQ,MAAM,qBAAqB,UAAW,aAAY;AAAA,EAC9E;AACA,MAAI,MAAM,uBAAuB,UAAa,CAAC,mBAAmB,SAAS,MAAM,kBAAkB,GAAG;AACpG,yBAAqB,CAAC,GAAG,oBAAoB,MAAM,kBAAkB;AAAA,EACvE;AACA,MAAI,MAAM,0BAA0B,QAAW;AAC7C,yBAAqB,mBAAmB,OAAO,CAAC,OAAO,OAAO,MAAM,qBAAqB;AAAA,EAC3F;AACA,MAAI,MAAM,cAAc,QAAW;AAGjC,gBAAY,MAAM,aAAa,iBAAiB,MAAM,YAAY;AAAA,EACpE;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,WAAW,OAAO,aAAa,MAAM,aAAa;AAAA,EACpD;AACF;AAWO,SAAS,iCAA2D;AACzE,QAAM,OAAO,oBAAI,IAA4B;AAC7C,SAAO;AAAA,IACL,MAAM,KAAK,WAAW;AACpB,YAAM,MAAM,KAAK,IAAI,SAAS;AAC9B,aAAO,MAAM,gBAAgB,GAAG,IAAI;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,YAAM,SAAS,gBAAgB,MAAM;AACrC,WAAK,IAAI,OAAO,WAAW,MAAM;AACjC,aAAO,gBAAgB,MAAM;AAAA,IAC/B;AAAA,IACA,MAAM,OAAO,WAAW,OAAO;AAC7B,YAAM,UAAU,KAAK,IAAI,SAAS;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,OAAO,mBAAmB,SAAS,KAAK;AAC9C,WAAK,IAAI,WAAW,IAAI;AACxB,aAAO,gBAAgB,IAAI;AAAA,IAC7B;AAAA,IACA,UAAU;AACR,aAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,gBAAgB,GAAG,CAAC;AAAA,IAC7D;AAAA,IACA,IAAI,QAAQ;AACV,WAAK,IAAI,OAAO,WAAW,gBAAgB,MAAM,CAAC;AAAA,IACpD;AAAA,EACF;AACF;AAwDO,SAAS,kBAAkB,SAA0C;AAC1E,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAElC,SAAO;AAAA,IACL,MAAM,eAAe,OAAO;AAC1B,YAAM,KAAK,MAAM,MAAM,MAAM;AAC7B,YAAM,WAAW,MAAM,MAAM,KAAK,MAAM,SAAS;AACjD,UAAI,UAAU;AACZ,cAAM,UAAU,MAAM,MAAM,OAAO,MAAM,WAAW,EAAE,oBAAoB,GAAG,CAAC;AAC9E,eAAO,WAAW;AAAA,MACpB;AACA,aAAO,MAAM,MAAM;AAAA,QACjB;AAAA,UACE,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,WAAW;AAAA,UACX,oBAAoB,MAAM;AAAA,UAC1B,oBAAoB,MAAM,sBAAsB;AAAA,UAChD,gBAAgB;AAAA,UAChB,oBAAoB,CAAC;AAAA,UACrB,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,MAAM,eAAe,WAAW,IAAI;AAClC,aAAO,MAAM,MAAM,OAAO,WAAW,EAAE,oBAAoB,MAAM,MAAM,EAAE,CAAC;AAAA,IAC5E;AAAA,IACA,MAAM,yBAAyB,WAAW,OAAO,IAAI;AACnD,aAAO,MAAM,MAAM,OAAO,WAAW;AAAA,QACnC,oBAAoB,MAAM,MAAM;AAAA,QAChC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,uBAAuB,WAAW,OAAO,IAAI;AACjD,aAAO,MAAM,MAAM,OAAO,WAAW;AAAA,QACnC,oBAAoB,MAAM,MAAM;AAAA,QAChC,uBAAuB;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,cAAc,WAAW,IAAI;AACjC,aAAO,MAAM,MAAM,OAAO,WAAW,EAAE,WAAW,MAAM,MAAM,EAAE,CAAC;AAAA,IACnE;AAAA,IACA,MAAM,cAAc,WAAW,IAAI;AACjC,aAAO,MAAM,MAAM,OAAO,WAAW,EAAE,WAAW,MAAM,MAAM,EAAE,CAAC;AAAA,IACnE;AAAA,EACF;AACF;;;AC1LO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA+B;AACzC;AAAA,MACE,yCAAyC,QAAQ,WAAW,OACrD,QAAQ,iBAAiB,KAAe,QAAQ,CAAC,CAAC,+BAClD,QAAQ,eAAe,KAAe,QAAQ,CAAC,CAAC,eACvC,QAAQ,iBAAiB,KAAe,QAAQ,CAAC,CAAC;AAAA,IAEpE;AACA,SAAK,OAAO;AACZ,SAAK,cAAc,QAAQ;AAC3B,SAAK,eAAe,QAAQ;AAC5B,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB,QAAQ;AAAA,EAChC;AACF;AA0CA,eAAsB,oBACpB,QACA,aACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,iBAAiB,MAAM,OAAO,eAAe,WAAW;AAC9D,MAAI,iBAAiB,OAAO,aAAc;AAE1C,QAAM,UAAgC;AAAA,IACpC;AAAA,IACA,cAAc,OAAO;AAAA,IACrB;AAAA,IACA,gBAAgB,iBAAiB,OAAO;AAAA,IACxC,KAAK,OAAO,OAAO,KAAK,KAAK;AAAA,EAC/B;AACA,SAAO,YAAY,OAAO;AAC1B,QAAM,IAAI,2BAA2B,OAAO;AAC9C;AAqDO,SAAS,wBAAwB,SAAqD;AAC3F,QAAM,EAAE,QAAQ,QAAQ,QAAQ,IAAI;AACpC,SAAO;AAAA,IACL,MAAM,gBAAgB,OAAO;AAC3B,YAAM,oBAAoB,QAAQ,MAAM,WAAW;AAAA,IACrD;AAAA,IACA,MAAM,cAAc,aAAa;AAC/B,UAAI,CAAC,OAAQ;AACb,UAAI;AACF,cAAM,OAAO,eAAe;AAAA,UAC1B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB,oBAAoB,YAAY;AAAA,UAChC,oBAAoB,YAAY,sBAAsB;AAAA,UACtD,IAAI,YAAY;AAAA,QAClB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU,GAAG;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW,OAAO;AAChB,UAAI,CAAC,OAAQ;AAKb,WAAK,OAAO,eAAe,MAAM,WAAW,MAAM,EAAE,EAAE,MAAM,CAAC,QAAiB,UAAU,GAAG,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/spend/store.ts","../../src/spend/budget.ts"],"sourcesContent":["import type { SpendBoxPatch, SpendBoxRecord, SpendWindow } from './types'\n\n/**\n * Persistence seam for the expectation ledger — the product implements it over\n * its own tables.\n *\n * Deliberately NOT compare-and-set, unlike `MissionStorePort`. A mission has one\n * serialized owner and a lost write corrupts a state machine; a box record is a\n * MONOTONIC FOLD (activity takes a max, a detached-run id joins or leaves a set,\n * delete is set-once) so concurrent writers converge no matter what order they\n * land in. The worst a lost race can do here is leave `lastActivityAt` behind\n * the truth — which makes the derived ceiling TIGHTER, so the failure mode is a\n * false alarm a human dismisses, never a missed charge. That asymmetry is the\n * whole reason the fold is shaped this way.\n *\n * `update` returns null when the row does not exist, never a throw.\n */\nexport interface SpendLedgerStorePort {\n  load(sandboxId: string): Promise<SpendBoxRecord | null>\n  /** `extras` are the opaque product-column values — write them in the SAME\n   *  statement as the record, or ignore them if the table has no extra columns. */\n  insert(record: SpendBoxRecord, extras?: Record<string, unknown>): Promise<SpendBoxRecord>\n  update(sandboxId: string, patch: SpendBoxPatch): Promise<SpendBoxRecord | null>\n  /**\n   * OPTIONAL — every box that could have been live during the window.\n   *\n   * This is the one capability that lets a reconciliation answer \"were we NOT\n   * billed for something we DID ask for\". Without it the pass is driven entirely\n   * by settlement rows, so a feed that returns nothing fires nothing and reads\n   * as a clean bill. Omitting it is safe and additive: the pass reports\n   * `expectation.declared: false` and refuses to certify a bill it could not\n   * check (see {@link SpendReport.coverage}).\n   *\n   * **It may over-return.** The reconciler re-derives liveness itself with\n   * `boxLivenessInWindow`, so a store that returns every row it has is correct,\n   * merely slower. That is deliberate: the definition of \"live\" must live in one\n   * place, not once per product's SQL. The intended predicate is the coarse one\n   * a WHERE clause can express —\n   *\n   * ```sql\n   * WHERE created_at <= :endAt AND (deleted_at IS NULL OR deleted_at >= :startAt)\n   * ```\n   *\n   * — and the exact answer (idle timeout, max lifetime, stop, open detached run)\n   * is the reconciler's.\n   */\n  listLiveBetween?(window: SpendWindow): Promise<readonly SpendBoxRecord[]>\n}\n\n/**\n * Apply one fold step. Exported so a SQL implementation and an in-memory one\n * reach the same record, and so a product can unit-test its own store against\n * the canonical answer.\n *\n * The two rules worth stating out loud:\n *\n * - `observedActivityAt` only ever moves `lastActivityAt` FORWARD. A replayed\n *   or out-of-order event cannot rewind the ceiling.\n * - activity later than a recorded `stoppedAt` CLEARS the stop. A box that\n *   worked after the product thought it stopped is running again, and keeping\n *   the stale stop would make the ceiling too tight — inventing an over-ceiling\n *   finding out of the product's own bookkeeping rather than the platform's.\n */\nexport function foldSpendBoxRecord(record: SpendBoxRecord, patch: SpendBoxPatch): SpendBoxRecord {\n  let lastActivityAt = record.lastActivityAt\n  let stoppedAt = record.stoppedAt\n  let openDetachedRunIds = record.openDetachedRunIds\n\n  if (patch.observedActivityAt !== undefined) {\n    lastActivityAt = Math.max(lastActivityAt, patch.observedActivityAt)\n    if (stoppedAt !== null && patch.observedActivityAt > stoppedAt) stoppedAt = null\n  }\n  if (patch.openDetachedRunAdd !== undefined && !openDetachedRunIds.includes(patch.openDetachedRunAdd)) {\n    openDetachedRunIds = [...openDetachedRunIds, patch.openDetachedRunAdd]\n  }\n  if (patch.openDetachedRunRemove !== undefined) {\n    openDetachedRunIds = openDetachedRunIds.filter((id) => id !== patch.openDetachedRunRemove)\n  }\n  if (patch.stoppedAt !== undefined) {\n    // Latest-wins, but never behind observed activity: a stop we are told about\n    // that predates work we watched is not the stop that closed this box.\n    stoppedAt = patch.stoppedAt >= lastActivityAt ? patch.stoppedAt : stoppedAt\n  }\n\n  return {\n    ...record,\n    lastActivityAt,\n    stoppedAt,\n    openDetachedRunIds,\n    // Set-once: a deleted sandbox id never comes back, so a second observation\n    // is a duplicate delivery, not a second deletion.\n    deletedAt: record.deletedAt ?? patch.deletedAt ?? null,\n  }\n}\n\n/** An in-memory store that also lets a test inspect and force state. */\nexport interface InMemorySpendLedgerStore extends SpendLedgerStorePort {\n  /** Every record, insertion order. */\n  records(): SpendBoxRecord[]\n  /** Unguarded direct write — simulates a crash-shaped or platform-seeded row. */\n  put(record: SpendBoxRecord): void\n}\n\n/** Create an in-memory expectation ledger. Production writers use the same port. */\nexport function createInMemorySpendLedgerStore(): InMemorySpendLedgerStore {\n  const rows = new Map<string, SpendBoxRecord>()\n  return {\n    async load(sandboxId) {\n      const row = rows.get(sandboxId)\n      return row ? structuredClone(row) : null\n    },\n    async insert(record) {\n      const stored = structuredClone(record)\n      rows.set(record.sandboxId, stored)\n      return structuredClone(stored)\n    },\n    async update(sandboxId, patch) {\n      const current = rows.get(sandboxId)\n      if (!current) return null\n      const next = foldSpendBoxRecord(current, patch)\n      rows.set(sandboxId, next)\n      return structuredClone(next)\n    },\n    async listLiveBetween(window) {\n      // Deliberately the COARSE predicate a product's SQL can express, not the\n      // exact one: the idle-timeout / max-lifetime / detached-run derivation is\n      // the reconciler's, and this over-returning is what proves the reconciler\n      // re-filters rather than trusting whatever a store hands it.\n      return [...rows.values()]\n        .filter(\n          (row) =>\n            row.createdAt <= window.endAt && (row.deletedAt === null || row.deletedAt >= window.startAt),\n        )\n        .map((row) => structuredClone(row))\n    },\n    records() {\n      return [...rows.values()].map((row) => structuredClone(row))\n    },\n    put(record) {\n      rows.set(record.sandboxId, structuredClone(record))\n    },\n  }\n}\n\n/** What the product tells the ledger when it first sees a box. */\nexport interface ObserveSandboxInput {\n  readonly sandboxId: string\n  readonly workspaceId: string\n  /** The idle timeout the product asked the platform for, seconds. */\n  readonly idleTimeoutSeconds: number\n  /** The max lifetime the product asked for, seconds, when it asked for one. */\n  readonly maxLifetimeSeconds?: number | null\n  /** Defaults to the ledger's clock. */\n  readonly at?: number\n}\n\nexport interface SpendLedgerOptions {\n  readonly store: SpendLedgerStorePort\n  /** Injectable clock (epoch ms). Default `Date.now`. */\n  readonly now?: () => number\n  /** Product columns written verbatim on every insert. */\n  readonly extras?: Record<string, unknown>\n}\n\n/**\n * The recording half of spend verification: the product's own account of what\n * it asked the platform for.\n *\n * Every method is best-effort from the caller's point of view — a product wires\n * these into paths that must not fail because bookkeeping failed. They still\n * reject on a store error rather than swallowing it, so a caller that wants\n * fire-and-forget says so at the call site (`/sandbox`'s hook does).\n */\nexport interface SpendLedger {\n  /**\n   * Record that a box exists and is billable from now. Inserts on first sight,\n   * and otherwise records activity — reuse and resume are both \"the platform is\n   * charging for this box again\", and the record's own existence is what\n   * distinguishes them, so no caller has to know which happened.\n   */\n  observeSandbox(input: ObserveSandboxInput): Promise<SpendBoxRecord>\n  /** Record that the product saw this box do work. */\n  recordActivity(sandboxId: string, at?: number): Promise<SpendBoxRecord | null>\n  /**\n   * Record that the product handed the platform work it will NOT watch finish.\n   * Until the matching end is recorded, this box's ceiling cannot rest on\n   * observed activity — see `computeExpectedCeiling`.\n   */\n  recordDetachedRunStarted(sandboxId: string, runId: string, at?: number): Promise<SpendBoxRecord | null>\n  /** Record that a detached run was confirmed finished. */\n  recordDetachedRunEnded(sandboxId: string, runId: string, at?: number): Promise<SpendBoxRecord | null>\n  /** Record that the product knows this box stopped. */\n  recordStopped(sandboxId: string, at?: number): Promise<SpendBoxRecord | null>\n  /** Record that the product knows this box was deleted. */\n  recordDeleted(sandboxId: string, at?: number): Promise<SpendBoxRecord | null>\n}\n\n/** Create the recording half over a product-supplied store. */\nexport function createSpendLedger(options: SpendLedgerOptions): SpendLedger {\n  const { store } = options\n  const clock = options.now ?? Date.now\n\n  return {\n    async observeSandbox(input) {\n      const at = input.at ?? clock()\n      const existing = await store.load(input.sandboxId)\n      if (existing) {\n        const updated = await store.update(input.sandboxId, { observedActivityAt: at })\n        return updated ?? existing\n      }\n      return await store.insert(\n        {\n          sandboxId: input.sandboxId,\n          workspaceId: input.workspaceId,\n          createdAt: at,\n          idleTimeoutSeconds: input.idleTimeoutSeconds,\n          maxLifetimeSeconds: input.maxLifetimeSeconds ?? null,\n          lastActivityAt: at,\n          openDetachedRunIds: [],\n          stoppedAt: null,\n          deletedAt: null,\n        },\n        options.extras,\n      )\n    },\n    async recordActivity(sandboxId, at) {\n      return await store.update(sandboxId, { observedActivityAt: at ?? clock() })\n    },\n    async recordDetachedRunStarted(sandboxId, runId, at) {\n      return await store.update(sandboxId, {\n        observedActivityAt: at ?? clock(),\n        openDetachedRunAdd: runId,\n      })\n    },\n    async recordDetachedRunEnded(sandboxId, runId, at) {\n      return await store.update(sandboxId, {\n        observedActivityAt: at ?? clock(),\n        openDetachedRunRemove: runId,\n      })\n    },\n    async recordStopped(sandboxId, at) {\n      return await store.update(sandboxId, { stoppedAt: at ?? clock() })\n    },\n    async recordDeleted(sandboxId, at) {\n      return await store.update(sandboxId, { deletedAt: at ?? clock() })\n    },\n  }\n}\n","import type { SpendLedger } from './store'\n\n/** Why provisioning was refused, with every number the decision used. */\nexport interface ComputeBudgetRefusal {\n  readonly workspaceId: string\n  /** The cap, unsigned nanodollars. */\n  readonly limitNanoUsd: number\n  /** Cumulative settled compute spend for this workspace, unsigned nanodollars. */\n  readonly settledNanoUsd: number\n  /** How far past the cap it already is. */\n  readonly overageNanoUsd: number\n  readonly at: number\n}\n\n/**\n * Provisioning refused because the workspace is already past its compute cap.\n *\n * Correctable by design: every number the decision used is on the error, so a\n * product can render \"this workspace has spent $X of its $Y compute budget\" and\n * an operator can raise the cap or investigate without reading logs.\n *\n * This is the failure mode the module exists to produce. A platform billing\n * defect that used to end in a silent negative balance now ends in provisioning\n * stopping and something loud happening instead.\n */\nexport class ComputeBudgetExceededError extends Error {\n  readonly workspaceId: string\n  readonly limitNanoUsd: number\n  readonly settledNanoUsd: number\n  readonly overageNanoUsd: number\n\n  constructor(refusal: ComputeBudgetRefusal) {\n    super(\n      `Compute budget exceeded for workspace ${refusal.workspaceId}: ` +\n        `$${(refusal.settledNanoUsd / 1_000_000_000).toFixed(2)} settled against a cap of ` +\n        `$${(refusal.limitNanoUsd / 1_000_000_000).toFixed(2)} ` +\n        `(over by $${(refusal.overageNanoUsd / 1_000_000_000).toFixed(2)}). ` +\n        'No sandbox was provisioned. Raise the cap or reconcile the spend before retrying.',\n    )\n    this.name = 'ComputeBudgetExceededError'\n    this.workspaceId = refusal.workspaceId\n    this.limitNanoUsd = refusal.limitNanoUsd\n    this.settledNanoUsd = refusal.settledNanoUsd\n    this.overageNanoUsd = refusal.overageNanoUsd\n  }\n}\n\n/**\n * A per-workspace cap on sandbox compute.\n *\n * `/billing`'s budget primitive caps MODEL keys, and it works because the\n * platform enforces the cap at the key it minted. Sandbox compute has no such\n * key: a box bills the shared company wallet, so nothing upstream refuses. This\n * carries the same shape to the one place a consumer can still act — the moment\n * before it asks for another box.\n *\n * `settledNanoUsd` is a callback rather than a number because the authority is\n * the platform ledger, not this package: the product reads the same rows it\n * hands the reconciler. Cache it if the read is expensive; a cap is a\n * coarse-grained control and a slightly stale total still refuses.\n */\nexport interface ComputeBudget {\n  /** The cap, unsigned nanodollars. */\n  readonly limitNanoUsd: number\n  /** Cumulative settled compute spend for the workspace, unsigned nanodollars. */\n  readonly settledNanoUsd: (workspaceId: string) => Promise<number> | number\n  /**\n   * Called on every refusal, before the error is thrown. This is the alert\n   * seam: a refusal nobody hears is a product that silently stopped working.\n   */\n  readonly onRefusal?: (refusal: ComputeBudgetRefusal) => void\n  /** Injectable clock (epoch ms). Default `Date.now`. */\n  readonly now?: () => number\n}\n\n/**\n * Throw {@link ComputeBudgetExceededError} when the workspace is already past\n * its cap. Returns normally — and reads nothing — when no budget is configured.\n *\n * Deliberately a pre-check against spend ALREADY SETTLED, not a reservation\n * against spend about to happen: settlement lags provisioning by design (the\n * platform's durable settlement queue), so there is no instant at which a\n * consumer could hold an accurate running total. The cap therefore overshoots by\n * at most the unsettled tail, which is bounded by the box's own idle timeout.\n * A cap that refuses one box late is worth far more than one that cannot be\n * implemented honestly.\n */\nexport async function assertComputeBudget(\n  budget: ComputeBudget | undefined,\n  workspaceId: string,\n): Promise<void> {\n  if (!budget) return\n  const settledNanoUsd = await budget.settledNanoUsd(workspaceId)\n  if (settledNanoUsd < budget.limitNanoUsd) return\n\n  const refusal: ComputeBudgetRefusal = {\n    workspaceId,\n    limitNanoUsd: budget.limitNanoUsd,\n    settledNanoUsd,\n    overageNanoUsd: settledNanoUsd - budget.limitNanoUsd,\n    at: (budget.now ?? Date.now)(),\n  }\n  budget.onRefusal?.(refusal)\n  throw new ComputeBudgetExceededError(refusal)\n}\n\n// ── the /sandbox seam ─────────────────────────────────────────────────────────\n\n/**\n * What `/sandbox` reports once a box is provisioned, reused or resumed.\n *\n * Structurally identical to `SandboxProvisionedObservation` in `/sandbox`, and\n * deliberately re-declared rather than imported: `/spend` composes `/sandbox`,\n * so a type import in the other direction would invert the dependency. The two\n * are pinned together by a compile-time assignment in this module's tests.\n */\nexport interface SpendProvisionObservation {\n  readonly workspaceId: string\n  readonly userId?: string\n  readonly sandboxId: string\n  readonly boxKey?: string | undefined\n  readonly idleTimeoutSeconds: number\n  readonly maxLifetimeSeconds?: number | undefined\n  readonly at: number\n}\n\n/**\n * The optional seam `EnsureWorkspaceSandboxOptions.spend` and the turn\n * primitives' `spend` option both accept. One object, wired in both places.\n */\nexport interface SandboxSpendSeam {\n  beforeProvision?(input: { workspaceId: string; userId?: string }): Promise<void> | void\n  onProvisioned?(observation: SpendProvisionObservation): Promise<void> | void\n  /** Synchronous by contract — it sits on the turn path. See `createSandboxSpendHooks`. */\n  onActivity?(input: { sandboxId: string; at: number }): void\n}\n\nexport interface SandboxSpendHooksOptions {\n  /** Records box lifecycle. Omit to run the budget guard alone. */\n  readonly ledger?: SpendLedger\n  /** Refuses provisioning past a cap. Omit to record alone. */\n  readonly budget?: ComputeBudget\n  /**\n   * Called when RECORDING fails. Recording is best-effort — a bookkeeping\n   * failure must never take down the provisioning it is bookkeeping — so this\n   * is the only place such a failure is visible. A refusal is NOT routed here;\n   * refusals throw, by design.\n   */\n  readonly onError?: (error: unknown) => void\n}\n\n/**\n * Build the object to hand `ensureWorkspaceSandbox`'s `spend` option.\n *\n * Wiring it is the entire adoption cost: one field, and the product's boxes are\n * both budget-capped and recorded.\n */\nexport function createSandboxSpendHooks(options: SandboxSpendHooksOptions): SandboxSpendSeam {\n  const { ledger, budget, onError } = options\n  return {\n    async beforeProvision(input) {\n      await assertComputeBudget(budget, input.workspaceId)\n    },\n    async onProvisioned(observation) {\n      if (!ledger) return\n      try {\n        await ledger.observeSandbox({\n          sandboxId: observation.sandboxId,\n          workspaceId: observation.workspaceId,\n          idleTimeoutSeconds: observation.idleTimeoutSeconds,\n          maxLifetimeSeconds: observation.maxLifetimeSeconds ?? null,\n          at: observation.at,\n        })\n      } catch (err) {\n        onError?.(err)\n      }\n    },\n    onActivity(input) {\n      if (!ledger) return\n      // The turn path calls this synchronously and does not await it, so the\n      // promise is settled here rather than escaping as an unhandled rejection.\n      // Recording activity is a monotonic max, so a write that lands late — or\n      // out of order against another turn's — still converges.\n      void ledger.recordActivity(input.sandboxId, input.at).catch((err: unknown) => onError?.(err))\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA+DO,SAAS,mBAAmB,QAAwB,OAAsC;AAC/F,MAAI,iBAAiB,OAAO;AAC5B,MAAI,YAAY,OAAO;AACvB,MAAI,qBAAqB,OAAO;AAEhC,MAAI,MAAM,uBAAuB,QAAW;AAC1C,qBAAiB,KAAK,IAAI,gBAAgB,MAAM,kBAAkB;AAClE,QAAI,cAAc,QAAQ,MAAM,qBAAqB,UAAW,aAAY;AAAA,EAC9E;AACA,MAAI,MAAM,uBAAuB,UAAa,CAAC,mBAAmB,SAAS,MAAM,kBAAkB,GAAG;AACpG,yBAAqB,CAAC,GAAG,oBAAoB,MAAM,kBAAkB;AAAA,EACvE;AACA,MAAI,MAAM,0BAA0B,QAAW;AAC7C,yBAAqB,mBAAmB,OAAO,CAAC,OAAO,OAAO,MAAM,qBAAqB;AAAA,EAC3F;AACA,MAAI,MAAM,cAAc,QAAW;AAGjC,gBAAY,MAAM,aAAa,iBAAiB,MAAM,YAAY;AAAA,EACpE;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,WAAW,OAAO,aAAa,MAAM,aAAa;AAAA,EACpD;AACF;AAWO,SAAS,iCAA2D;AACzE,QAAM,OAAO,oBAAI,IAA4B;AAC7C,SAAO;AAAA,IACL,MAAM,KAAK,WAAW;AACpB,YAAM,MAAM,KAAK,IAAI,SAAS;AAC9B,aAAO,MAAM,gBAAgB,GAAG,IAAI;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,QAAQ;AACnB,YAAM,SAAS,gBAAgB,MAAM;AACrC,WAAK,IAAI,OAAO,WAAW,MAAM;AACjC,aAAO,gBAAgB,MAAM;AAAA,IAC/B;AAAA,IACA,MAAM,OAAO,WAAW,OAAO;AAC7B,YAAM,UAAU,KAAK,IAAI,SAAS;AAClC,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,OAAO,mBAAmB,SAAS,KAAK;AAC9C,WAAK,IAAI,WAAW,IAAI;AACxB,aAAO,gBAAgB,IAAI;AAAA,IAC7B;AAAA,IACA,MAAM,gBAAgB,QAAQ;AAK5B,aAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EACrB;AAAA,QACC,CAAC,QACC,IAAI,aAAa,OAAO,UAAU,IAAI,cAAc,QAAQ,IAAI,aAAa,OAAO;AAAA,MACxF,EACC,IAAI,CAAC,QAAQ,gBAAgB,GAAG,CAAC;AAAA,IACtC;AAAA,IACA,UAAU;AACR,aAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,gBAAgB,GAAG,CAAC;AAAA,IAC7D;AAAA,IACA,IAAI,QAAQ;AACV,WAAK,IAAI,OAAO,WAAW,gBAAgB,MAAM,CAAC;AAAA,IACpD;AAAA,EACF;AACF;AAwDO,SAAS,kBAAkB,SAA0C;AAC1E,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAElC,SAAO;AAAA,IACL,MAAM,eAAe,OAAO;AAC1B,YAAM,KAAK,MAAM,MAAM,MAAM;AAC7B,YAAM,WAAW,MAAM,MAAM,KAAK,MAAM,SAAS;AACjD,UAAI,UAAU;AACZ,cAAM,UAAU,MAAM,MAAM,OAAO,MAAM,WAAW,EAAE,oBAAoB,GAAG,CAAC;AAC9E,eAAO,WAAW;AAAA,MACpB;AACA,aAAO,MAAM,MAAM;AAAA,QACjB;AAAA,UACE,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,WAAW;AAAA,UACX,oBAAoB,MAAM;AAAA,UAC1B,oBAAoB,MAAM,sBAAsB;AAAA,UAChD,gBAAgB;AAAA,UAChB,oBAAoB,CAAC;AAAA,UACrB,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,IACA,MAAM,eAAe,WAAW,IAAI;AAClC,aAAO,MAAM,MAAM,OAAO,WAAW,EAAE,oBAAoB,MAAM,MAAM,EAAE,CAAC;AAAA,IAC5E;AAAA,IACA,MAAM,yBAAyB,WAAW,OAAO,IAAI;AACnD,aAAO,MAAM,MAAM,OAAO,WAAW;AAAA,QACnC,oBAAoB,MAAM,MAAM;AAAA,QAChC,oBAAoB;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,uBAAuB,WAAW,OAAO,IAAI;AACjD,aAAO,MAAM,MAAM,OAAO,WAAW;AAAA,QACnC,oBAAoB,MAAM,MAAM;AAAA,QAChC,uBAAuB;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,IACA,MAAM,cAAc,WAAW,IAAI;AACjC,aAAO,MAAM,MAAM,OAAO,WAAW,EAAE,WAAW,MAAM,MAAM,EAAE,CAAC;AAAA,IACnE;AAAA,IACA,MAAM,cAAc,WAAW,IAAI;AACjC,aAAO,MAAM,MAAM,OAAO,WAAW,EAAE,WAAW,MAAM,MAAM,EAAE,CAAC;AAAA,IACnE;AAAA,EACF;AACF;;;AC9NO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA+B;AACzC;AAAA,MACE,yCAAyC,QAAQ,WAAW,OACrD,QAAQ,iBAAiB,KAAe,QAAQ,CAAC,CAAC,+BAClD,QAAQ,eAAe,KAAe,QAAQ,CAAC,CAAC,eACvC,QAAQ,iBAAiB,KAAe,QAAQ,CAAC,CAAC;AAAA,IAEpE;AACA,SAAK,OAAO;AACZ,SAAK,cAAc,QAAQ;AAC3B,SAAK,eAAe,QAAQ;AAC5B,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB,QAAQ;AAAA,EAChC;AACF;AA0CA,eAAsB,oBACpB,QACA,aACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,iBAAiB,MAAM,OAAO,eAAe,WAAW;AAC9D,MAAI,iBAAiB,OAAO,aAAc;AAE1C,QAAM,UAAgC;AAAA,IACpC;AAAA,IACA,cAAc,OAAO;AAAA,IACrB;AAAA,IACA,gBAAgB,iBAAiB,OAAO;AAAA,IACxC,KAAK,OAAO,OAAO,KAAK,KAAK;AAAA,EAC/B;AACA,SAAO,YAAY,OAAO;AAC1B,QAAM,IAAI,2BAA2B,OAAO;AAC9C;AAqDO,SAAS,wBAAwB,SAAqD;AAC3F,QAAM,EAAE,QAAQ,QAAQ,QAAQ,IAAI;AACpC,SAAO;AAAA,IACL,MAAM,gBAAgB,OAAO;AAC3B,YAAM,oBAAoB,QAAQ,MAAM,WAAW;AAAA,IACrD;AAAA,IACA,MAAM,cAAc,aAAa;AAC/B,UAAI,CAAC,OAAQ;AACb,UAAI;AACF,cAAM,OAAO,eAAe;AAAA,UAC1B,WAAW,YAAY;AAAA,UACvB,aAAa,YAAY;AAAA,UACzB,oBAAoB,YAAY;AAAA,UAChC,oBAAoB,YAAY,sBAAsB;AAAA,UACtD,IAAI,YAAY;AAAA,QAClB,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,kBAAU,GAAG;AAAA,MACf;AAAA,IACF;AAAA,IACA,WAAW,OAAO;AAChB,UAAI,CAAC,OAAQ;AAKb,WAAK,OAAO,eAAe,MAAM,WAAW,MAAM,EAAE,EAAE,MAAM,CAAC,QAAiB,UAAU,GAAG,CAAC;AAAA,IAC9F;AAAA,EACF;AACF;","names":[]}