@tokenfactory/acc-runner 0.40.26 → 0.40.28

package/dist/git-auth/controller.js

@@ -0,0 +1,83 @@
+export const DEFAULT_GIT_AUTH_FAILURE_THRESHOLD = 2;
+export class GitAuthController {
+    deps;
+    threshold;
+    _degraded = false;
+    _consecutiveAuthFailures = 0;
+    _peakConsecutive = 0;
+    _lastDetail = "";
+    constructor(deps) {
+        this.deps = deps;
+        this.threshold = Math.max(1, Math.floor(deps.threshold ?? DEFAULT_GIT_AUTH_FAILURE_THRESHOLD));
+    }
+    get degraded() {
+        return this._degraded;
+    }
+    get consecutiveAuthFailures() {
+        return this._consecutiveAuthFailures;
+    }
+    snapshot() {
+        return {
+            degraded: this._degraded,
+            consecutiveAuthFailures: this._consecutiveAuthFailures,
+            lastDetail: this._lastDetail,
+        };
+    }
+    /**
+     * Run one probe, fold the result into the state machine, and fire the
+     * transition callback when (and only when) the degraded state flips. Never
+     * rejects: a throwing probe is treated as transient and a throwing callback is
+     * swallowed (best-effort emit).
+     */
+    async check() {
+        let result;
+        try {
+            result = await this.deps.probe();
+        }
+        catch (err) {
+            result = {
+                ok: false,
+                failureClass: "transient",
+                detail: err?.message?.split(/\r?\n/)[0] ?? String(err),
+            };
+        }
+        this._lastDetail = result.detail;
+        await this.apply(result);
+        return result;
+    }
+    async apply(result) {
+        if (result.ok) {
+            const failuresBeforeRecovery = this._peakConsecutive;
+            this._consecutiveAuthFailures = 0;
+            this._peakConsecutive = 0;
+            if (this._degraded) {
+                this._degraded = false;
+                await this.fire(() => this.deps.onRecovered?.({ failuresBeforeRecovery, detail: result.detail }));
+            }
+            return;
+        }
+        if (result.failureClass === "auth") {
+            this._consecutiveAuthFailures += 1;
+            this._peakConsecutive = Math.max(this._peakConsecutive, this._consecutiveAuthFailures);
+            if (!this._degraded && this._consecutiveAuthFailures >= this.threshold) {
+                this._degraded = true;
+                await this.fire(() => this.deps.onDegraded?.({
+                    consecutiveFailures: this._consecutiveAuthFailures,
+                    detail: result.detail,
+                }));
+            }
+        }
+        // transient failure: leave counters + degraded state untouched. A network
+        // blip while healthy stays healthy; while degraded, only a real success
+        // (above) recovers — never a transient blip.
+    }
+    async fire(fn) {
+        try {
+            await fn();
+        }
+        catch {
+            /* best-effort emit — never wedge the probe loop on a callback error. */
+        }
+    }
+}
+//# sourceMappingURL=controller.js.map

package/dist/git-auth/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/git-auth/controller.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAgCpD,MAAM,OAAO,iBAAiB;IAOC;IANZ,SAAS,CAAS;IAC3B,SAAS,GAAG,KAAK,CAAC;IAClB,wBAAwB,GAAG,CAAC,CAAC;IAC7B,gBAAgB,GAAG,CAAC,CAAC;IACrB,WAAW,GAAG,EAAE,CAAC;IAEzB,YAA6B,IAA2B;QAA3B,SAAI,GAAJ,IAAI,CAAuB;QACtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,kCAAkC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACvC,CAAC;IAED,QAAQ;QACN,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,uBAAuB,EAAE,IAAI,CAAC,wBAAwB;YACtD,UAAU,EAAE,IAAI,CAAC,WAAW;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,WAAW;gBACzB,MAAM,EAAG,GAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC;aAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,MAA0B;QAC5C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACrD,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;YAC1B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACnB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,wBAAwB,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACtB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACrB,mBAAmB,EAAE,IAAI,CAAC,wBAAwB;oBAClD,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6CAA6C;IAC/C,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,EAA8B;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;CACF"}

package/dist/git-auth/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * GIT-AUTH-ALERT: runner git-credential health — classify auth-class transport
+ * failures, probe the base clone's credential (masked), and drive a degraded
+ * state machine so watch.ts can pause task-lane claiming instead of churning
+ * doomed claim→fail→requeue cycles when a token expires.
+ */
+export { classifyGitFetchError, isGitAuthFailure, GIT_AUTH_FAILURE_PATTERNS, type GitFetchFailureClass, } from "./classify.js";
+export { makeGitAuthProbe, maskGitCredentials, type GitAuthProbe, type GitAuthProbeResult, type DefaultProbeOptions, } from "./probe.js";
+export { GitAuthController, DEFAULT_GIT_AUTH_FAILURE_THRESHOLD, type GitAuthControllerDeps, type GitAuthDegradedInfo, type GitAuthRecoveredInfo, type GitAuthSnapshot, } from "./controller.js";
+/** Runner-emitted audit verbs. The alerts tick (api/_lib/alerts-git-auth.ts) */
+/** scans these to derive currently-degraded machines and page the operator. */
+export declare const RUNNER_GIT_AUTH_FAILED_VERB = "runner.git_auth_failed";
+export declare const RUNNER_GIT_AUTH_RECOVERED_VERB = "runner.git_auth_recovered";
+//# sourceMappingURL=index.d.ts.map

package/dist/git-auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kCAAkC,EAClC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AACpE,eAAO,MAAM,8BAA8B,8BAA8B,CAAC"}

package/dist/git-auth/index.js

@@ -0,0 +1,14 @@
+/**
+ * GIT-AUTH-ALERT: runner git-credential health — classify auth-class transport
+ * failures, probe the base clone's credential (masked), and drive a degraded
+ * state machine so watch.ts can pause task-lane claiming instead of churning
+ * doomed claim→fail→requeue cycles when a token expires.
+ */
+export { classifyGitFetchError, isGitAuthFailure, GIT_AUTH_FAILURE_PATTERNS, } from "./classify.js";
+export { makeGitAuthProbe, maskGitCredentials, } from "./probe.js";
+export { GitAuthController, DEFAULT_GIT_AUTH_FAILURE_THRESHOLD, } from "./controller.js";
+/** Runner-emitted audit verbs. The alerts tick (api/_lib/alerts-git-auth.ts) */
+/** scans these to derive currently-degraded machines and page the operator. */
+export const RUNNER_GIT_AUTH_FAILED_VERB = "runner.git_auth_failed";
+export const RUNNER_GIT_AUTH_RECOVERED_VERB = "runner.git_auth_recovered";
+//# sourceMappingURL=index.js.map

package/dist/git-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/git-auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,GAE1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAInB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,kCAAkC,GAKnC,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2BAA2B,CAAC"}

package/dist/git-auth/probe.d.ts

@@ -0,0 +1,34 @@
+import { type GitFetchFailureClass } from "./classify.js";
+export interface GitAuthProbeResult {
+    /** True when the ls-remote succeeded (the credential is valid). */
+    ok: boolean;
+    /** null when ok; otherwise how the failure was classified. */
+    failureClass: GitFetchFailureClass | null;
+    /** Masked, credential-safe one-line summary — safe to log/emit/display. */
+    detail: string;
+}
+/** The injectable seam. Production uses `defaultGitAuthProbe`; tests fake it. */
+export type GitAuthProbe = () => Promise<GitAuthProbeResult>;
+/**
+ * Redact credential material from arbitrary git output. Covers:
+ *   - userinfo in URLs:  scheme://user:token@host  →  scheme://***@host
+ *   - GitHub token shapes anywhere: ghp_/gho_/ghu_/ghs_/ghr_…, github_pat_…
+ * Idempotent and never throws; a masked-but-imperfect string is preferred to
+ * leaking, so callers can mask defensively at every boundary.
+ */
+export declare function maskGitCredentials(input: string): string;
+export interface DefaultProbeOptions {
+    /** The local clone to probe (its `origin` remote carries the credential). */
+    repoPath: string;
+    /** Test seam — overrides the git invocation. */
+    run?: (repoPath: string, args: string[]) => Promise<{
+        stdout: string;
+    }>;
+}
+/**
+ * Build a `GitAuthProbe` bound to a repo path. `GIT_TERMINAL_PROMPT=0` is forced
+ * on so a missing credential fails FAST with "terminal prompts disabled" instead
+ * of hanging waiting for an interactive username/password.
+ */
+export declare function makeGitAuthProbe(opts: DefaultProbeOptions): GitAuthProbe;
+//# sourceMappingURL=probe.d.ts.map

package/dist/git-auth/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../src/git-auth/probe.ts"],"names":[],"mappings":"AAaA,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASxD;AAQD,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzE;AAeD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAmBxE"}

package/dist/git-auth/probe.js

@@ -0,0 +1,72 @@
+/**
+ * GIT-AUTH-ALERT: a masked, read-only git-credential health probe.
+ *
+ * Runs `git ls-remote --heads origin` in the runner's base clone — a dry-run
+ * that touches the remote (so an expired/revoked token 403s exactly as a real
+ * fetch would) but transfers no objects, so it is cheap enough to run every 60s
+ * both to DETECT the initial failure and to poll for RECOVERY. The result is a
+ * three-way `{ ok, failureClass, detail }` where `detail` is ALWAYS masked so no
+ * credential material (a token embedded in the remote URL, a `x-access-token:…`
+ * pair, a raw PAT) can reach a log line, an activity event, or `doctor` output.
+ */
+import { execa } from "execa";
+import { buildEnv } from "../bin-resolve.js";
+import { classifyGitFetchError } from "./classify.js";
+/**
+ * Redact credential material from arbitrary git output. Covers:
+ *   - userinfo in URLs:  scheme://user:token@host  →  scheme://***@host
+ *   - GitHub token shapes anywhere: ghp_/gho_/ghu_/ghs_/ghr_…, github_pat_…
+ * Idempotent and never throws; a masked-but-imperfect string is preferred to
+ * leaking, so callers can mask defensively at every boundary.
+ */
+export function maskGitCredentials(input) {
+    if (!input)
+        return input;
+    let out = input;
+    // scheme://userinfo@host — strip everything between the scheme and the '@'.
+    out = out.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1***@");
+    // Bare GitHub token shapes that might appear outside a URL (e.g. in an error).
+    out = out.replace(/\bgh[posru]_[A-Za-z0-9]{16,}\b/g, "***");
+    out = out.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "***");
+    return out;
+}
+/** First non-empty line of a message, masked and length-bounded. */
+function summarize(raw) {
+    const firstLine = raw.split(/\r?\n/).find((l) => l.trim().length > 0) ?? raw;
+    return maskGitCredentials(firstLine.trim()).slice(0, 300);
+}
+async function defaultRun(repoPath, args) {
+    // GIT_TERMINAL_PROMPT=0 → a missing credential fails FAST with "terminal
+    // prompts disabled" instead of blocking on an interactive username/password.
+    const { stdout } = await execa("git", args, {
+        cwd: repoPath,
+        env: { ...buildEnv(), GIT_TERMINAL_PROMPT: "0" },
+    });
+    return { stdout };
+}
+/**
+ * Build a `GitAuthProbe` bound to a repo path. `GIT_TERMINAL_PROMPT=0` is forced
+ * on so a missing credential fails FAST with "terminal prompts disabled" instead
+ * of hanging waiting for an interactive username/password.
+ */
+export function makeGitAuthProbe(opts) {
+    const run = opts.run ?? defaultRun;
+    return async () => {
+        try {
+            await run(opts.repoPath, ["ls-remote", "--heads", "origin"]);
+            return { ok: true, failureClass: null, detail: "ls-remote origin ok" };
+        }
+        catch (err) {
+            const failureClass = classifyGitFetchError(err);
+            const message = err?.stderr ??
+                err?.message ??
+                String(err);
+            return {
+                ok: false,
+                failureClass,
+                detail: summarize(typeof message === "string" ? message : String(message)),
+            };
+        }
+    };
+}
+//# sourceMappingURL=probe.js.map

package/dist/git-auth/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/git-auth/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAA6B,MAAM,eAAe,CAAC;AAcjF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,4EAA4E;IAC5E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;IACnE,+EAA+E;IAC/E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;IAC5D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IAC7E,OAAO,kBAAkB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AASD,KAAK,UAAU,UAAU,CACvB,QAAgB,EAChB,IAAc;IAEd,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QAC1C,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAyB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GACV,GAA+C,EAAE,MAAM;gBACvD,GAAa,EAAE,OAAO;gBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY;gBACZ,MAAM,EAAE,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/watch.d.ts

@@ -7,9 +7,11 @@ import { runTask, type RunTaskController } from "./task-runner.js";
 import { type ReviewAssignment, type ReviewerOutcome } from "./runtime/reviewer.js";
 import { type SingletonLock } from "./runtime/singleton.js";
 import { type SelfUpgradeResult, type SelfUpdate426Result } from "./runtime/self-upgrade.js";
+import { GitAuthController, type GitAuthProbe } from "./git-auth/index.js";
 import { ResumeController, type ResumeControllerDeps } from "./capacity/resume-controller.js";
 import { AccountProbeScheduler } from "./engines/account-probe.js";
 import { type FleetChatServingHandle } from "./watch-chat/wire.js";
+import { ClaimDeadman, type HeartbeatDeadmanFields } from "./claim-deadman/index.js";
 import type { EngineAccountIdentity } from "./engines/types.js";
 import type { StoredSession } from "./types.js";
 import { RefreshReuseDetectedError, classifyHeartbeatError, nextHeartbeatDelayMs, type HeartbeatErrorKind } from "./runtime/auth-lifecycle.js";
@@ -86,6 +88,37 @@ export interface WatchOptions {
      * hook drives it deterministically. Knob: `claim_backstop_interval_ms`.
      */
     claimBackstopIntervalMs?: number;
+    /**
+     * CLAIM-DEADMAN: wedge threshold (ms). Work is pending
+     * and no claim has landed for this long → the claim channel is wedged; escalate
+     * to a full Realtime-client rebuild, then DB-poll fallback. Defaults to 120000
+     * (120s, > the 90s claim watchdog so the cheaper resubscribe fires first).
+     * Tests set a tiny value to observe the escalation ladder without real waits.
+     */
+    claimDeadmanWedgeMs?: number;
+    /**
+     * CLAIM-DEADMAN: deadman evaluation cadence (ms). How often the watch loop
+     * reads its pending-dispatch and runs the deadman tick. Defaults to 30000.
+     * Tests set a large value so only the `claimDeadmanOnce()` hook drives it.
+     */
+    claimDeadmanCheckMs?: number;
+    /**
+     * CLAIM-DEADMAN: minimum gap between escalation steps (ms) so a rebuild gets
+     * time to take effect before the next step. Defaults to 15000.
+     */
+    claimDeadmanRebuildGraceMs?: number;
+    /**
+     * CLAIM-DEADMAN: full Realtime-client rebuilds attempted before degrading to
+     * DB-poll fallback claiming. Defaults to 2.
+     */
+    claimDeadmanMaxRebuilds?: number;
+    /**
+     * CLAIM-DEADMAN: degraded DB-poll fallback cadence (ms). Once the rebuild
+     * budget is spent the runner claims by polling the claim path directly at this
+     * interval — degraded but functional — until the backlog drains. Defaults to
+     * 15000. Tests set a tiny value to observe fallback claiming without real waits.
+     */
+    claimDeadmanFallbackPollMs?: number;
     /** Returns a controller for tests; production wiring uses the default. */
     taskRunnerFactory?: typeof runTask;
     /** v0.6.2: review handler injection for tests. Defaults to runReview. */
@@ -194,6 +227,23 @@ export interface WatchOptions {
      * guard.
      */
     enforceSingleton?: boolean;
+    /**
+     * GIT-AUTH-ALERT: cadence (ms) of the git-credential health probe. Defaults to
+     * 60s. Tests set a large value so only the `gitAuthProbeOnce()` hook drives it.
+     */
+    gitAuthProbeIntervalMs?: number;
+    /**
+     * GIT-AUTH-ALERT: consecutive auth-class probe failures before the runner
+     * trips the degraded `git_auth_failed` state. Defaults to 2 (the spec bar).
+     */
+    gitAuthFailureThreshold?: number;
+    /**
+     * GIT-AUTH-ALERT: injectable probe seam. Production builds an `ls-remote`
+     * probe bound to the base clone (cfg.worktreeRepoPath ?? cfg.repoPath); tests
+     * inject a fake to drive the state machine without shelling out to git. When
+     * neither this nor a base repo path is available the probe loop is disabled.
+     */
+    gitAuthProbe?: GitAuthProbe;
 }
 /**
  * v0.12.0 (T-52-7): resolve ACC_RUNNER_IDLE_TTL_MIN into ms. Returns null
@@ -228,6 +278,19 @@ export interface WatchHandle {
      * from the backstop timer.
      */
     claimBackstopOnce(): Promise<void>;
+    /**
+     * CLAIM-DEADMAN test hook: forces one deadman evaluation
+     * (read pending-dispatch → tick → rebuild/fallback/none) and resolves when it
+     * finishes. Production drives this from the deadman timer.
+     */
+    claimDeadmanOnce(): Promise<void>;
+    /**
+     * GIT-AUTH-ALERT test hook: forces one git-credential health probe and
+     * resolves when it finishes (including any degraded/recovered emit). Resolves
+     * to `false` when the probe loop is disabled (no base repo path). Production
+     * drives this from the probe timer.
+     */
+    gitAuthProbeOnce(): Promise<boolean>;
     /** v0.10 T-49-2: number of tasks currently executing. Useful for tests. */
     runningCount(): number;
 }
@@ -278,6 +341,38 @@ interface WatchState {
     claimBackstopTimer: NodeJS.Timeout;
     claimBackstopIntervalMs: number;
     backstopScanning: boolean;
+    /**
+     * CLAIM-DEADMAN: dead-man switch for a wedged claim
+     * channel. `claimDeadman` is the pure state machine; `claimDeadmanTimer` drives
+     * its evaluation every `claimDeadmanCheckMs`; `claimDeadmanChecking` is the
+     * single-flight guard. `deadmanRebuilding` guards the full Realtime-client
+     * rebuild. `deadmanFallbackTimer` runs the degraded DB-poll claim loop at
+     * `deadmanFallbackPollMs` once the rebuild budget is spent (null when not
+     * degraded). `lastHeartbeatDeadmanFields` caches the pending-dispatch/suspect
+     * the heartbeat response carried (null until the server extension lands, in
+     * which case the deadman falls back to the assigned-queued read).
+     */
+    claimDeadman: ClaimDeadman;
+    claimDeadmanTimer: NodeJS.Timeout;
+    claimDeadmanCheckMs: number;
+    claimDeadmanChecking: boolean;
+    deadmanRebuilding: boolean;
+    deadmanFallbackTimer: NodeJS.Timeout | null;
+    deadmanFallbackPollMs: number;
+    lastHeartbeatDeadmanFields: HeartbeatDeadmanFields | null;
+    /**
+     * GIT-AUTH-ALERT: the git-credential health state machine + its timer.
+     * `gitAuthController` is null when the probe loop is disabled (no base repo
+     * path resolvable, or in tests that don't opt in). `gitAuthFailed` mirrors the
+     * controller's degraded flag so pump() can read it synchronously (like the
+     * capacity flags) to pause task-lane claiming. `gitAuthChecking` is the
+     * single-flight guard so a slow probe can't overlap itself.
+     */
+    gitAuthController: GitAuthController | null;
+    gitAuthTimer: NodeJS.Timeout | null;
+    gitAuthProbeIntervalMs: number;
+    gitAuthChecking: boolean;
+    gitAuthFailed: boolean;
     /**
      * v0.68 (T-68-1): realtime channel-health recovery. The `.subscribe`
      * status callback previously handled ONLY `SUBSCRIBED`; a `CHANNEL_ERROR`
@@ -481,6 +576,23 @@ interface WatchState {
 }
 export declare function resubscribeChannel(state: WatchState, factory: typeof runTask): Promise<void>;
 export declare function reassertRunningClaims(state: WatchState): Promise<void>;
+/**
+ * CLAIM-DEADMAN: parse the pending-dispatch fields off a `heartbeat_runner`
+ * response. Tolerant of a scalar row, a single-row array, or null (today's
+ * void return) — returns null unless a numeric `pending_dispatch` is present, so
+ * a pre-extension server leaves the deadman on its assigned-queued read.
+ */
+export declare function parseHeartbeatDeadmanFields(data: unknown): HeartbeatDeadmanFields | null;
+/**
+ * CLAIM-DEADMAN: tear down + FULLY REBUILD the Realtime client — not just a
+ * resubscribe. The v0.68 resubscribe / v0.73 watchdog both remove+re-add a
+ * channel on the SAME Supabase client, so a wedged underlying socket / Realtime
+ * instance survives them (the incident's failure mode). This discards the whole
+ * client and builds a fresh one around the same JWT + realtime config (mirrors
+ * doRefresh/doFailover's client rebuild, minus the token change), then recovers
+ * anything the dead channel missed. Single-flight via `deadmanRebuilding`.
+ */
+export declare function rebuildRealtimeClient(state: WatchState, factory: typeof runTask, attempt: number): Promise<void>;
 export declare function watchCommand(options?: WatchOptions): Promise<WatchHandle>;
 /**
  * PA-11C-SIGTERM-REQUEUE: graceful shutdown handler for SIGINT/SIGTERM.

package/dist/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAK9F,OAAO,EAAE,qBAAqB,EAAmB,MAAM,4BAA4B,CAAC;AAKpF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAEtB,oBAAoB,EAEpB,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,CAAC;AA4EF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,OAAO,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;QAAE,QAAQ,EAAE,oBAAoB,CAAA;KAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,KAAK,eAAe,GAAG,CACrB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;IAAE,QAAQ,EAAE,oBAAoB,CAAA;CAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,UAAU,UAAU;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;IAC1B,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;IAChC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;;OAOG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AAuID,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;AAshBD,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwsBnF;AA8QD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AA6LD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,IAAI,CACL,oBAAoB,EACpB,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO,CACjF,CA6GA"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,EAIjB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAK9F,OAAO,EAAE,qBAAqB,EAAmB,MAAM,4BAA4B,CAAC;AAKpF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,YAAY,EAQZ,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAEtB,oBAAoB,EAEpB,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAoGF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,OAAO,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;QAAE,QAAQ,EAAE,oBAAoB,CAAA;KAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,KAAK,eAAe,GAAG,CACrB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;IAAE,QAAQ,EAAE,oBAAoB,CAAA;CAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,UAAU,UAAU;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;IAC1B,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;IAChC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0BAA0B,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC1D;;;;;;;OAOG;IACH,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;;OAOG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AA8ID,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;AA0VD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,GACZ,sBAAsB,GAAG,IAAI,CAS/B;AAsCD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAsDf;AAuUD,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAmwBnF;AAwRD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AAkSD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,IAAI,CACL,oBAAoB,EACpB,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO,CACjF,CA6GA"}