effect-agent 0.1.0-beta.12 → 0.1.0-beta.121

package/dist/durable/DurableFailpoint.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DurableFailpoint.mjs","names":[],"sources":["../../src/durable/DurableFailpoint.ts"],"sourcesContent":["import { Context, Effect, Layer, Schema } from \"effect\";\n\n/**\n * Coordinator-owned failpoint locations (plan §Failpoints). Locations normally sit immediately\n * AFTER one durable mutation of the six-step coordinator flow, so a fault injected there\n * simulates a crash between two durable steps; the matching BEFORE boundary of each mutation is\n * owned by the storage adapters (`ledger:*:before`, `append:before`, ...), giving every durable\n * mutation a failpoint on both sides (change discipline). Run-start append also exposes its\n * BEFORE boundary here to distinguish a fresh clock from a committed clock in crash tests.\n *\n * The `subagent:*` family covers every durable mutation of the S2 establishment/join protocol\n * including reservation, request append, child admission, child readiness,\n * start-link append, sibling per-call settles at the suspension seam, the `waitingForChild`\n * suspension, child abort propagation, the atomic join batch, and both reservation-release\n * transitions.\n */\nexport const DurableRuntimeFailpointLocation = Schema.Literals([\n  \"submit:after-admit\",\n  \"submit:after-materialize\",\n  \"claim:after-claim\",\n  \"input:after-canonical-append\",\n  \"run:before-start-append\",\n  \"run:after-start-append\",\n  \"run:before-duration-append\",\n  \"run:after-duration-append\",\n  \"turn:after-canonical-append\",\n  \"turn:after-response-append\",\n  \"turn:after-results-append\",\n  \"compaction:before-canonical-append\",\n  \"compaction:after-canonical-append\",\n  \"checkpoint:before-save\",\n  \"checkpoint:after-save\",\n  \"tools:after-prepared-append\",\n  \"tools:before-prepared-append\",\n  \"tools:before-unavailable-append\",\n  \"tools:after-unavailable-append\",\n  \"policy:before-reservation-append\",\n  \"policy:after-reservation-append\",\n  \"step:after-step-append\",\n  \"approval:after-request-append\",\n  \"approval:after-suspend\",\n  \"join:after-claim\",\n  \"join:after-canonical-append\",\n  \"resolve:after-intent\",\n  \"terminalize:after-reserve\",\n  \"terminalize:after-canonical-append\",\n  \"abort:after-intent\",\n  \"subagent:after-reserve\",\n  \"subagent:after-request-append\",\n  \"subagent:after-admit\",\n  \"subagent:after-child-ready\",\n  \"subagent:after-start-append\",\n  \"subagent:after-sibling-settle\",\n  \"subagent:after-suspend\",\n  \"subagent:after-child-abort-intent\",\n  \"subagent:before-join-append\",\n  \"subagent:after-join-append\",\n  \"subagent:after-release-pending\",\n  \"subagent:after-release\",\n  \"worker:before-stop-append\",\n  \"worker:after-stop-append\",\n  \"worker:before-stop-seal\",\n  \"worker:after-stop-seal\",\n  \"worker:before-source-append\",\n  \"worker:after-source-append\",\n  \"worker:before-origin-append\",\n  \"worker:after-origin-append\",\n  \"worker:before-completion-append\",\n  \"worker:after-completion-append\",\n  \"worker:before-subtree-append\",\n  \"worker:after-subtree-append\",\n  \"worker:before-report-append\",\n  \"worker:after-report-append\",\n  \"worker:before-report-delivery\",\n  \"worker:after-report-delivery\",\n  \"update:before-canonical-append\",\n  \"update:after-canonical-append\",\n  \"update:before-delivery-insert\",\n  \"update:after-delivery-insert\",\n]);\n\nexport type DurableRuntimeFailpointLocation = typeof DurableRuntimeFailpointLocation.Type;\n\n/** Injected coordinator fault. Reaching the caller means the preceding durable step committed. */\nexport class DurableRuntimeFailpointError extends Schema.TaggedError<DurableRuntimeFailpointError>()(\n  \"DurableRuntimeFailpointError\",\n  {\n    location: DurableRuntimeFailpointLocation,\n  },\n) {}\n\nexport type DurableRuntimeFailpointHandler = (\n  location: DurableRuntimeFailpointLocation,\n) => Effect.Effect<void, DurableRuntimeFailpointError>;\n\nconst noFailpoint: DurableRuntimeFailpointHandler = () => Effect.void;\n\n/**\n * Explicit fault-injection authority used at durable coordinator step boundaries. The process\n * crash harness (WP5) maps a hit to `process.exit`; in-process tests fail the step with the\n * typed `DurableRuntimeFailpointError` instead.\n */\nexport class DurableRuntimeFailpoint extends Context.Service<\n  DurableRuntimeFailpoint,\n  {\n    readonly hit: DurableRuntimeFailpointHandler;\n  }\n>()(\"@effect-agent/thread/DurableRuntimeFailpoint\") {\n  /** Production default: no fault injection. */\n  static readonly layer = Layer.succeed(this)({ hit: noFailpoint });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAa,kCAAkC,OAAO,SAAS;CAC7D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAKD,IAAa,+BAAb,cAAkD,OAAO,YAA0C,CAAC,CAClG,gCACA,EACE,UAAU,gCACZ,CACF,CAAC,CAAC,CAAC;AAMH,MAAM,oBAAoD,OAAO;;;;;;AAOjE,IAAa,0BAAb,cAA6C,QAAQ,QAKnD,CAAC,CAAC,8CAA8C,CAAC,CAAC;;CAElD,OAAgB,QAAQ,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC;AAClE"}

package/dist/durable/DurableFailpointTestControl.d.mts

@@ -0,0 +1,14 @@
+import { i as DurableRuntimeFailpointHandler, n as DurableRuntimeFailpoint } from "../DurableFailpoint-Cnr3wx1L.mjs";
+import { Context, Effect, Layer } from "effect";
+//#region src/durable/DurableFailpointTestControl.d.ts
+declare const DurableRuntimeFailpointTestControl_base: Context.ServiceClass<DurableRuntimeFailpointTestControl, "@effect-agent/thread/DurableRuntimeFailpointTestControl", {
+  readonly clear: Effect.Effect<void>;
+  readonly setHandler: (handler: DurableRuntimeFailpointHandler) => Effect.Effect<void>;
+}>;
+/** Test-only control for replacing the active coordinator failpoint handler. */
+export declare class DurableRuntimeFailpointTestControl extends DurableRuntimeFailpointTestControl_base {
+  /** Reusable test Layer with a control service backed by the same handler Ref. */
+  static readonly layer: Layer.Layer<DurableRuntimeFailpoint | DurableRuntimeFailpointTestControl, never, never>;
+}
+//#endregion
+//# sourceMappingURL=DurableFailpointTestControl.d.mts.map

package/dist/durable/DurableFailpointTestControl.mjs

@@ -0,0 +1,19 @@
+import { DurableRuntimeFailpoint } from "./DurableFailpoint.mjs";
+import { Context, Effect, Layer, Ref } from "effect";
+//#region src/durable/DurableFailpointTestControl.ts
+const noFailpoint = () => Effect.void;
+/** Test-only control for replacing the active coordinator failpoint handler. */
+var DurableRuntimeFailpointTestControl = class DurableRuntimeFailpointTestControl extends Context.Service()("@effect-agent/thread/DurableRuntimeFailpointTestControl") {
+	/** Reusable test Layer with a control service backed by the same handler Ref. */
+	static layer = Layer.effectContext(Effect.gen(function* () {
+		const handler = yield* Ref.make(noFailpoint);
+		return Context.make(DurableRuntimeFailpoint, DurableRuntimeFailpoint.of({ hit: (location) => Ref.get(handler).pipe(Effect.flatMap((current) => current(location))) })).pipe(Context.add(DurableRuntimeFailpointTestControl, DurableRuntimeFailpointTestControl.of({
+			clear: Ref.set(handler, noFailpoint),
+			setHandler: (next) => Ref.set(handler, next)
+		})));
+	}));
+};
+//#endregion
+export { DurableRuntimeFailpointTestControl };
+
+//# sourceMappingURL=DurableFailpointTestControl.mjs.map

package/dist/durable/DurableFailpointTestControl.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DurableFailpointTestControl.mjs","names":[],"sources":["../../src/durable/DurableFailpointTestControl.ts"],"sourcesContent":["import { Context, Effect, Layer, Ref } from \"effect\";\n\nimport {\n  DurableRuntimeFailpoint,\n  type DurableRuntimeFailpointHandler,\n} from \"./DurableFailpoint.ts\";\n\nconst noFailpoint: DurableRuntimeFailpointHandler = () => Effect.void;\n\n/** Test-only control for replacing the active coordinator failpoint handler. */\nexport class DurableRuntimeFailpointTestControl extends Context.Service<\n  DurableRuntimeFailpointTestControl,\n  {\n    readonly clear: Effect.Effect<void>;\n    readonly setHandler: (handler: DurableRuntimeFailpointHandler) => Effect.Effect<void>;\n  }\n>()(\"@effect-agent/thread/DurableRuntimeFailpointTestControl\") {\n  /** Reusable test Layer with a control service backed by the same handler Ref. */\n  static readonly layer = Layer.effectContext(\n    Effect.gen(function* () {\n      const handler = yield* Ref.make<DurableRuntimeFailpointHandler>(noFailpoint);\n\n      return Context.make(\n        DurableRuntimeFailpoint,\n        DurableRuntimeFailpoint.of({\n          hit: (location) => Ref.get(handler).pipe(Effect.flatMap((current) => current(location))),\n        }),\n      ).pipe(\n        Context.add(\n          DurableRuntimeFailpointTestControl,\n          DurableRuntimeFailpointTestControl.of({\n            clear: Ref.set(handler, noFailpoint),\n            setHandler: (next) => Ref.set(handler, next),\n          }),\n        ),\n      );\n    }),\n  );\n}\n"],"mappings":";;;AAOA,MAAM,oBAAoD,OAAO;;AAGjE,IAAa,qCAAb,MAAa,2CAA2C,QAAQ,QAM9D,CAAC,CAAC,yDAAyD,CAAC,CAAC;;CAE7D,OAAgB,QAAQ,MAAM,cAC5B,OAAO,IAAI,aAAa;EACtB,MAAM,UAAU,OAAO,IAAI,KAAqC,WAAW;EAE3E,OAAO,QAAQ,KACb,yBACA,wBAAwB,GAAG,EACzB,MAAM,aAAa,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,OAAO,SAAS,YAAY,QAAQ,QAAQ,CAAC,CAAC,EACzF,CAAC,CACH,CAAC,CAAC,KACA,QAAQ,IACN,oCACA,mCAAmC,GAAG;GACpC,OAAO,IAAI,IAAI,SAAS,WAAW;GACnC,aAAa,SAAS,IAAI,IAAI,SAAS,IAAI;EAC7C,CAAC,CACH,CACF;CACF,CAAC,CACH;AACF"}

package/dist/durable/EventSource.d.mts

@@ -0,0 +1,2 @@
+import { a as makeEventSource, i as NormalizedEvent, r as EventSources, t as EventSource } from "../EventSource-CnlZ3Kma.mjs";
+export { EventSource, EventSources, NormalizedEvent, makeEventSource };

package/dist/durable/EventSource.mjs

@@ -0,0 +1,65 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { PersistedJson } from "./Records.mjs";
+import { SubscriptionSourceError } from "./Subscription.mjs";
+import { Context, Effect, Schema } from "effect";
+//#region src/durable/EventSource.ts
+var EventSource_exports = /* @__PURE__ */ __exportAll({
+	EventSources: () => EventSources,
+	makeEventSource: () => makeEventSource
+});
+var EventSources = class extends Context.Service()("@effect-agent/thread/EventSources") {};
+const invalid = () => SubscriptionSourceError.make({
+	code: "source-schema",
+	retryable: false
+});
+/**
+* Capture the source's explicit Effect dependencies at host assembly. Matching and key functions
+* must be pure and bounded under this exact semantic version.
+* The returned source accepts Schema-encoded values at intake and management boundaries.
+* Each operation owns a fresh Scope for its callbacks and codecs; captured host services
+* retain their host lifetime. Operation resources finalize on success, failure, or interruption.
+*/
+const makeEventSource = Effect.fn("Thread.makeEventSource")(function* (options) {
+	const services = yield* Effect.context();
+	const encode = (schema, value) => Schema.encodeEffect(schema)(value).pipe(Effect.flatMap(Schema.decodeUnknownEffect(PersistedJson)), Effect.mapError(invalid));
+	const normalized = Effect.fn("EventSource.normalized")(function* (event) {
+		const occurredAtMillis = options.occurredAtMillis?.(event);
+		return {
+			eventId: options.identity(event),
+			...occurredAtMillis === void 0 ? {} : { occurredAtMillis },
+			matchingKey: options.eventKey(event),
+			payload: yield* encode(options.event, event)
+		};
+	});
+	const normalize = (value) => Schema.decodeUnknownEffect(PersistedJson)(value).pipe(Effect.flatMap(Schema.decodeUnknownEffect(options.event)), Effect.mapError(invalid), Effect.flatMap(normalized), Effect.scoped, Effect.provideContext(services));
+	const parameters = (value) => Effect.gen(function* () {
+		yield* Schema.decodeUnknownEffect(PersistedJson)(value).pipe(Effect.mapError(invalid));
+		const decoded = yield* Schema.decodeUnknownEffect(options.parameters)(value).pipe(Effect.mapError(invalid));
+		return {
+			parameters: yield* encode(options.parameters, decoded),
+			matchingKey: options.parameterKey(decoded)
+		};
+	}).pipe(Effect.scoped, Effect.provideContext(services));
+	const matches = (event, subscription) => Effect.gen(function* () {
+		const e = yield* Schema.decodeEffect(options.event)(event.payload).pipe(Effect.mapError(invalid));
+		const p = yield* Schema.decodeEffect(options.parameters)(subscription.configuration.parameters).pipe(Effect.mapError(invalid));
+		return options.matches(e, p);
+	}).pipe(Effect.scoped, Effect.provideContext(services));
+	const reconcile = options.reconcile;
+	return {
+		source: options.source,
+		continuity: options.continuity,
+		parameters,
+		normalize,
+		matches,
+		...reconcile === void 0 ? {} : { reconcile: (subscription) => Effect.gen(function* () {
+			const p = yield* Schema.decodeEffect(options.parameters)(subscription.configuration.parameters).pipe(Effect.mapError(invalid));
+			const event = yield* reconcile(p);
+			return event === null ? null : yield* normalized(event);
+		}).pipe(Effect.scoped, Effect.provideContext(services)) }
+	};
+});
+//#endregion
+export { EventSources, makeEventSource, EventSource_exports as t };
+
+//# sourceMappingURL=EventSource.mjs.map

package/dist/durable/EventSource.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EventSource.mjs","names":[],"sources":["../../src/durable/EventSource.ts"],"sourcesContent":["import { Context, Effect, Schema, type Scope } from \"effect\";\n\nimport { PersistedJson } from \"./Records.ts\";\nimport {\n  type AcceptedEvent,\n  type EventSourceVersion,\n  type SubscriptionRecord,\n  SubscriptionSourceError,\n} from \"./Subscription.ts\";\n\nexport interface NormalizedEvent {\n  readonly eventId: string;\n  readonly occurredAtMillis?: number;\n  readonly matchingKey: string;\n  readonly payload: PersistedJson;\n}\n\n/** Runtime-only versioned behavior. Never persist this object or silently replace its version. */\nexport interface EventSource {\n  readonly source: EventSourceVersion;\n  readonly continuity: string;\n  readonly parameters: (\n    value: unknown,\n  ) => Effect.Effect<\n    { readonly parameters: PersistedJson; readonly matchingKey: string },\n    SubscriptionSourceError\n  >;\n  readonly normalize: (value: unknown) => Effect.Effect<NormalizedEvent, SubscriptionSourceError>;\n  readonly matches: (\n    event: AcceptedEvent,\n    subscription: SubscriptionRecord,\n  ) => Effect.Effect<boolean, SubscriptionSourceError>;\n  readonly reconcile?: (\n    subscription: SubscriptionRecord,\n  ) => Effect.Effect<NormalizedEvent | null, SubscriptionSourceError>;\n}\n\nexport class EventSources extends Context.Service<\n  EventSources,\n  {\n    readonly sources: ReadonlyArray<EventSource>;\n  }\n>()(\"@effect-agent/thread/EventSources\") {}\n\nconst invalid = () => SubscriptionSourceError.make({ code: \"source-schema\", retryable: false });\n\n/**\n * Capture the source's explicit Effect dependencies at host assembly. Matching and key functions\n * must be pure and bounded under this exact semantic version.\n * The returned source accepts Schema-encoded values at intake and management boundaries.\n * Each operation owns a fresh Scope for its callbacks and codecs; captured host services\n * retain their host lifetime. Operation resources finalize on success, failure, or interruption.\n */\nexport const makeEventSource = Effect.fn(\"Thread.makeEventSource\")(function* <\n  Event extends Schema.Top,\n  Parameters extends Schema.Top,\n  R = never,\n>(options: {\n  readonly source: EventSourceVersion;\n  readonly continuity: string;\n  readonly event: Event;\n  readonly parameters: Parameters;\n  readonly identity: (event: Event[\"Type\"]) => string;\n  /** Authenticated source time, stable across delivery retries; required for bounded retention. */\n  readonly occurredAtMillis?: (event: Event[\"Type\"]) => number | undefined;\n  readonly eventKey: (event: Event[\"Type\"]) => string;\n  readonly parameterKey: (parameters: Parameters[\"Type\"]) => string;\n  readonly matches: (event: Event[\"Type\"], parameters: Parameters[\"Type\"]) => boolean;\n  readonly reconcile?: (\n    parameters: Parameters[\"Type\"],\n  ) => Effect.Effect<Event[\"Type\"] | null, SubscriptionSourceError, R>;\n}): Effect.fn.Return<\n  EventSource,\n  never,\n  Exclude<\n    | R\n    | Event[\"DecodingServices\"]\n    | Event[\"EncodingServices\"]\n    | Parameters[\"DecodingServices\"]\n    | Parameters[\"EncodingServices\"],\n    Scope.Scope\n  >\n> {\n  const services =\n    yield* Effect.context<\n      Exclude<\n        | R\n        | Event[\"DecodingServices\"]\n        | Event[\"EncodingServices\"]\n        | Parameters[\"DecodingServices\"]\n        | Parameters[\"EncodingServices\"],\n        Scope.Scope\n      >\n    >();\n\n  const encode = <S extends Schema.Top>(schema: S, value: S[\"Type\"]) =>\n    Schema.encodeEffect(schema)(value).pipe(\n      Effect.flatMap(Schema.decodeUnknownEffect(PersistedJson)),\n      Effect.mapError(invalid),\n    );\n\n  const normalized = Effect.fn(\"EventSource.normalized\")(function* (event: Event[\"Type\"]) {\n    const occurredAtMillis = options.occurredAtMillis?.(event);\n\n    return {\n      eventId: options.identity(event),\n      ...(occurredAtMillis === undefined ? {} : { occurredAtMillis }),\n      matchingKey: options.eventKey(event),\n      payload: yield* encode(options.event, event),\n    };\n  });\n\n  const normalize: EventSource[\"normalize\"] = (value) =>\n    Schema.decodeUnknownEffect(PersistedJson)(value).pipe(\n      Effect.flatMap(Schema.decodeUnknownEffect(options.event)),\n      Effect.mapError(invalid),\n      Effect.flatMap(normalized),\n      Effect.scoped,\n      Effect.provideContext(services),\n    );\n\n  const parameters: EventSource[\"parameters\"] = (value) =>\n    Effect.gen(function* () {\n      yield* Schema.decodeUnknownEffect(PersistedJson)(value).pipe(Effect.mapError(invalid));\n\n      const decoded = yield* Schema.decodeUnknownEffect(options.parameters)(value).pipe(\n        Effect.mapError(invalid),\n      );\n\n      return {\n        parameters: yield* encode(options.parameters, decoded),\n        matchingKey: options.parameterKey(decoded),\n      };\n    }).pipe(Effect.scoped, Effect.provideContext(services));\n\n  const matches: EventSource[\"matches\"] = (event, subscription) =>\n    Effect.gen(function* () {\n      const e = yield* Schema.decodeEffect(options.event)(event.payload).pipe(\n        Effect.mapError(invalid),\n      );\n\n      const p = yield* Schema.decodeEffect(options.parameters)(\n        subscription.configuration.parameters,\n      ).pipe(Effect.mapError(invalid));\n\n      return options.matches(e, p);\n    }).pipe(Effect.scoped, Effect.provideContext(services));\n\n  const reconcile = options.reconcile;\n\n  return {\n    source: options.source,\n    continuity: options.continuity,\n    parameters,\n    normalize,\n    matches,\n    ...(reconcile === undefined\n      ? {}\n      : {\n          reconcile: (subscription: SubscriptionRecord) =>\n            Effect.gen(function* () {\n              const p = yield* Schema.decodeEffect(options.parameters)(\n                subscription.configuration.parameters,\n              ).pipe(Effect.mapError(invalid));\n\n              const event = yield* reconcile(p);\n\n              return event === null ? null : yield* normalized(event);\n            }).pipe(Effect.scoped, Effect.provideContext(services)),\n        }),\n  };\n});\n"],"mappings":";;;;;;;;;AAqCA,IAAa,eAAb,cAAkC,QAAQ,QAKxC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC;AAE1C,MAAM,gBAAgB,wBAAwB,KAAK;CAAE,MAAM;CAAiB,WAAW;AAAM,CAAC;;;;;;;;AAS9F,MAAa,kBAAkB,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAIjE,SAyBA;CACA,MAAM,WACJ,OAAO,OAAO,QASZ;CAEJ,MAAM,UAAgC,QAAW,UAC/C,OAAO,aAAa,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KACjC,OAAO,QAAQ,OAAO,oBAAoB,aAAa,CAAC,GACxD,OAAO,SAAS,OAAO,CACzB;CAEF,MAAM,aAAa,OAAO,GAAG,wBAAwB,CAAC,CAAC,WAAW,OAAsB;EACtF,MAAM,mBAAmB,QAAQ,mBAAmB,KAAK;EAEzD,OAAO;GACL,SAAS,QAAQ,SAAS,KAAK;GAC/B,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC7D,aAAa,QAAQ,SAAS,KAAK;GACnC,SAAS,OAAO,OAAO,QAAQ,OAAO,KAAK;EAC7C;CACF,CAAC;CAED,MAAM,aAAuC,UAC3C,OAAO,oBAAoB,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAC/C,OAAO,QAAQ,OAAO,oBAAoB,QAAQ,KAAK,CAAC,GACxD,OAAO,SAAS,OAAO,GACvB,OAAO,QAAQ,UAAU,GACzB,OAAO,QACP,OAAO,eAAe,QAAQ,CAChC;CAEF,MAAM,cAAyC,UAC7C,OAAO,IAAI,aAAa;EACtB,OAAO,OAAO,oBAAoB,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;EAErF,MAAM,UAAU,OAAO,OAAO,oBAAoB,QAAQ,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3E,OAAO,SAAS,OAAO,CACzB;EAEA,OAAO;GACL,YAAY,OAAO,OAAO,QAAQ,YAAY,OAAO;GACrD,aAAa,QAAQ,aAAa,OAAO;EAC3C;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,eAAe,QAAQ,CAAC;CAExD,MAAM,WAAmC,OAAO,iBAC9C,OAAO,IAAI,aAAa;EACtB,MAAM,IAAI,OAAO,OAAO,aAAa,QAAQ,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KACjE,OAAO,SAAS,OAAO,CACzB;EAEA,MAAM,IAAI,OAAO,OAAO,aAAa,QAAQ,UAAU,CAAC,CACtD,aAAa,cAAc,UAC7B,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;EAE/B,OAAO,QAAQ,QAAQ,GAAG,CAAC;CAC7B,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,eAAe,QAAQ,CAAC;CAExD,MAAM,YAAY,QAAQ;CAE1B,OAAO;EACL,QAAQ,QAAQ;EAChB,YAAY,QAAQ;EACpB;EACA;EACA;EACA,GAAI,cAAc,KAAA,IACd,CAAC,IACD,EACE,YAAY,iBACV,OAAO,IAAI,aAAa;GACtB,MAAM,IAAI,OAAO,OAAO,aAAa,QAAQ,UAAU,CAAC,CACtD,aAAa,cAAc,UAC7B,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;GAE/B,MAAM,QAAQ,OAAO,UAAU,CAAC;GAEhC,OAAO,UAAU,OAAO,OAAO,OAAO,WAAW,KAAK;EACxD,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,eAAe,QAAQ,CAAC,EAC1D;CACN;AACF,CAAC"}

package/dist/durable/GitHubWorkflowSource.d.mts

@@ -0,0 +1,185 @@
+import { r as Principal } from "../Receipt-BAHyigAF.mjs";
+import "../Records-D88mgvyS.mjs";
+import { E as SubscriptionSourceError } from "../Subscription-CRteOKRf.mjs";
+import { t as EventSource } from "../EventSource-CnlZ3Kma.mjs";
+import { SubscriptionFailure, SubscriptionIntake } from "./Subscriptions.mjs";
+import { Context, Effect, Layer, Redacted, Schema } from "effect";
+import { HttpClient } from "effect/unstable/http";
+//#region src/durable/GitHubWorkflowSource.d.ts
+/** One repository whose identity and credentials are selected by the host. */
+export declare const GitHubRepository: Schema.declareConstructor<{
+  readonly id: number;
+  readonly owner: string;
+  readonly name: string;
+}, {
+  readonly id: number;
+  readonly owner: string;
+  readonly name: string;
+}, readonly [Schema.Struct<{
+  readonly id: Schema.Int;
+  readonly owner: Schema.NonEmptyString;
+  readonly name: Schema.NonEmptyString;
+}>], {
+  readonly id: number;
+  readonly owner: string;
+  readonly name: string;
+}>;
+export type GitHubRepository = typeof GitHubRepository.Type;
+/** Exact workflow attempt requested by an Agent through a host-permitted source. */
+export declare const GitHubWorkflowRunWatch: Schema.declareConstructor<{
+  readonly runId: number;
+  readonly attempt: number;
+  readonly expectedHeadSha: string;
+}, {
+  readonly runId: number;
+  readonly attempt: number;
+  readonly expectedHeadSha: string;
+}, readonly [Schema.Struct<{
+  readonly runId: Schema.Int;
+  readonly attempt: Schema.Int;
+  readonly expectedHeadSha: Schema.String;
+}>], {
+  readonly runId: number;
+  readonly attempt: number;
+  readonly expectedHeadSha: string;
+}>;
+export type GitHubWorkflowRunWatch = typeof GitHubWorkflowRunWatch.Type;
+/**
+ * Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery
+ * IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.
+ */
+export declare const GitHubWorkflowRunCompletion: Schema.declareConstructor<{
+  readonly repositoryId: number;
+  readonly runId: number;
+  readonly attempt: number;
+  readonly headSha: string;
+  readonly conclusion: string;
+}, {
+  readonly repositoryId: number;
+  readonly runId: number;
+  readonly attempt: number;
+  readonly headSha: string;
+  readonly conclusion: string;
+}, readonly [Schema.Struct<{
+  readonly repositoryId: Schema.Int;
+  readonly runId: Schema.Int;
+  readonly attempt: Schema.Int;
+  readonly headSha: Schema.String;
+  readonly conclusion: Schema.NonEmptyString;
+}>], {
+  readonly repositoryId: number;
+  readonly runId: number;
+  readonly attempt: number;
+  readonly headSha: string;
+  readonly conclusion: string;
+}>;
+export type GitHubWorkflowRunCompletion = typeof GitHubWorkflowRunCompletion.Type;
+export declare const GitHubWorkflowRunWebhook: Schema.Struct<{
+  readonly action: Schema.Literal<"completed">;
+  readonly repository: Schema.Struct<{
+    readonly id: Schema.Int;
+  }>;
+  readonly workflow_run: Schema.Struct<{
+    readonly id: Schema.Int;
+    readonly run_attempt: Schema.Int;
+    readonly head_sha: Schema.String;
+    readonly status: Schema.NonEmptyString;
+    readonly conclusion: Schema.NullOr<Schema.NonEmptyString>;
+    readonly repository: Schema.Struct<{
+      readonly id: Schema.Int;
+    }>;
+  }>;
+}>;
+export type GitHubWorkflowRunWebhook = typeof GitHubWorkflowRunWebhook.Type;
+export declare const GitHubWorkflowRunAttempt: Schema.Struct<{
+  readonly id: Schema.Int;
+  readonly run_attempt: Schema.Int;
+  readonly head_sha: Schema.String;
+  readonly status: Schema.NonEmptyString;
+  readonly conclusion: Schema.NullOr<Schema.NonEmptyString>;
+  readonly repository: Schema.Struct<{
+    readonly id: Schema.Int;
+  }>;
+}>;
+export type GitHubWorkflowRunAttempt = typeof GitHubWorkflowRunAttempt.Type;
+export declare const GitHubWorkflowRunSourceVersion: {
+  readonly name: "github-workflow-run-completed";
+  readonly version: "1";
+};
+declare const GitHubWorkflowRunsError_base: Schema.Class<GitHubWorkflowRunsError, Schema.TaggedStruct<"GitHubWorkflowRunsError", {
+  readonly reason: Schema.Literals<readonly ["rate-limited", "unavailable", "unauthorized", "not-found", "invalid-response"]>;
+  readonly retryable: Schema.Boolean;
+}>, import("effect/Cause").YieldableError>;
+export declare class GitHubWorkflowRunsError extends GitHubWorkflowRunsError_base {}
+export interface GitHubWorkflowRunAttemptRequest {
+  readonly repository: GitHubRepository;
+  readonly runId: number;
+  readonly attempt: number;
+}
+declare const GitHubWorkflowRuns_base: Context.ServiceClass<GitHubWorkflowRuns, "@effect-agent/thread/GitHubWorkflowRuns", {
+  readonly getAttempt: (request: GitHubWorkflowRunAttemptRequest) => Effect.Effect<GitHubWorkflowRunAttempt, GitHubWorkflowRunsError>;
+}>;
+/**
+ * Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read
+ * the exact attempt endpoint; the source never receives or persists a credential.
+ */
+export declare class GitHubWorkflowRuns extends GitHubWorkflowRuns_base {}
+export interface GitHubWorkflowRunsHttpOptions {
+  /** Repository this credentialed adapter is authorized to read. */
+  readonly repository: GitHubRepository;
+  readonly token: Redacted.Redacted<string>;
+  readonly apiUrl?: string | undefined;
+  readonly userAgent?: string | undefined;
+}
+/**
+ * GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.
+ * It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.
+ */
+export declare const githubWorkflowRunsHttpLayer: (options: GitHubWorkflowRunsHttpOptions) => Layer.Layer<GitHubWorkflowRuns, GitHubWorkflowRunsError, HttpClient.HttpClient>;
+export interface GitHubWorkflowRunSourceOptions {
+  readonly repository: GitHubRepository;
+}
+/**
+ * Build the exact-attempt completion source, shared by all destination Agents in this partition.
+ * Reconciliation depends on GitHub retaining a readable exact attempt.
+ */
+export declare const makeGitHubWorkflowRunSource: (options: GitHubWorkflowRunSourceOptions) => Effect.Effect<EventSource, SubscriptionSourceError, GitHubWorkflowRuns>;
+declare const GitHubWebhookVerificationError_base: Schema.Class<GitHubWebhookVerificationError, Schema.TaggedStruct<"GitHubWebhookVerificationError", {
+  readonly reason: Schema.Literals<readonly ["invalid-signature", "invalid-event", "invalid-payload", "payload-too-large", "crypto-unavailable"]>;
+}>, import("effect/Cause").YieldableError>;
+export declare class GitHubWebhookVerificationError extends GitHubWebhookVerificationError_base {}
+declare const GitHubWebhookSignatureVerifier_base: Context.ServiceClass<GitHubWebhookSignatureVerifier, "@effect-agent/thread/GitHubWebhookSignatureVerifier", {
+  readonly verify: (body: Uint8Array, signature: string) => Effect.Effect<void, GitHubWebhookVerificationError>;
+}>;
+/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */
+export declare class GitHubWebhookSignatureVerifier extends GitHubWebhookSignatureVerifier_base {}
+/** Narrow host WebCrypto capability used for GitHub HMAC-SHA256 verification. */
+export interface GitHubWebhookSubtleCrypto<Key> {
+  readonly importKey: (format: "raw", keyData: ArrayBuffer, algorithm: {
+    readonly name: "HMAC";
+    readonly hash: "SHA-256";
+  }, extractable: false, usages: ["verify"]) => PromiseLike<Key>;
+  readonly verify: (algorithm: "HMAC", key: Key, signature: ArrayBuffer, data: ArrayBuffer) => PromiseLike<boolean>;
+}
+/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */
+export declare const webCryptoGitHubWebhookSignatureVerifierLayer: <Key>(secret: Redacted.Redacted<string>, subtle: GitHubWebhookSubtleCrypto<Key>) => Layer.Layer<GitHubWebhookSignatureVerifier>;
+export interface VerifiedGitHubWorkflowRunWebhookRequest {
+  readonly body: Uint8Array;
+  readonly eventHeader: string | undefined;
+  readonly signatureHeader: string | undefined;
+  readonly principal: Principal;
+}
+/**
+ * Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to
+ * durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.
+ */
+export declare const acceptVerifiedGitHubWorkflowRunWebhook: (request: VerifiedGitHubWorkflowRunWebhookRequest) => Effect.Effect<{
+  readonly partition: {
+    readonly tenantId: string;
+    readonly address: string;
+  };
+  readonly eventId: string;
+  readonly acceptedAtMillis: number;
+}, GitHubWebhookVerificationError | SubscriptionFailure, GitHubWebhookSignatureVerifier | SubscriptionIntake>;
+//#endregion
+//# sourceMappingURL=GitHubWorkflowSource.d.mts.map

package/dist/durable/GitHubWorkflowSource.mjs

@@ -0,0 +1,209 @@
+import { u as strictSchema } from "../FailureDiagnostic-BElLOoED.mjs";
+import { SubscriptionSourceError } from "./Subscription.mjs";
+import { makeEventSource } from "./EventSource.mjs";
+import { SubscriptionIntake } from "./Subscriptions.mjs";
+import { ByteSize, Context, Effect, Encoding, Layer, Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest, HttpIncomingMessage } from "effect/unstable/http";
+//#region src/durable/GitHubWorkflowSource.ts
+const PositiveId = Schema.Int.check(Schema.isGreaterThan(0));
+const GitHubName = Schema.NonEmptyString.check(Schema.isMaxLength(100), Schema.isPattern(/^[A-Za-z0-9_.-]+$/));
+const GitCommitSha = Schema.String.check(Schema.isPattern(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/));
+const GitHubConclusion = Schema.NonEmptyString.check(Schema.isMaxLength(64));
+const GitHubStatus = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+/** One repository whose identity and credentials are selected by the host. */
+const GitHubRepository = Schema.Struct({
+	id: PositiveId,
+	owner: GitHubName,
+	name: GitHubName
+}).pipe(strictSchema);
+/** Exact workflow attempt requested by an Agent through a host-permitted source. */
+const GitHubWorkflowRunWatch = Schema.Struct({
+	runId: PositiveId,
+	attempt: PositiveId,
+	expectedHeadSha: GitCommitSha
+}).pipe(strictSchema);
+/**
+* Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery
+* IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.
+*/
+const GitHubWorkflowRunCompletion = Schema.Struct({
+	repositoryId: PositiveId,
+	runId: PositiveId,
+	attempt: PositiveId,
+	headSha: GitCommitSha,
+	conclusion: GitHubConclusion
+}).pipe(strictSchema);
+const GitHubWorkflowRunWire = Schema.Struct({
+	id: PositiveId,
+	run_attempt: PositiveId,
+	head_sha: GitCommitSha,
+	status: GitHubStatus,
+	conclusion: Schema.NullOr(GitHubConclusion),
+	repository: Schema.Struct({ id: PositiveId })
+});
+const GitHubWorkflowRunWebhook = Schema.Struct({
+	action: Schema.Literal("completed"),
+	repository: Schema.Struct({ id: PositiveId }),
+	workflow_run: GitHubWorkflowRunWire
+});
+const GitHubWorkflowRunAttempt = GitHubWorkflowRunWire;
+const GitHubWorkflowRunSourceVersion = {
+	name: "github-workflow-run-completed",
+	version: "1"
+};
+var GitHubWorkflowRunsError = class extends Schema.TaggedError()("GitHubWorkflowRunsError", {
+	reason: Schema.Literals([
+		"rate-limited",
+		"unavailable",
+		"unauthorized",
+		"not-found",
+		"invalid-response"
+	]),
+	retryable: Schema.Boolean
+}) {};
+/**
+* Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read
+* the exact attempt endpoint; the source never receives or persists a credential.
+*/
+var GitHubWorkflowRuns = class extends Context.Service()("@effect-agent/thread/GitHubWorkflowRuns") {};
+const httpFailure = (reason, retryable) => GitHubWorkflowRunsError.make({
+	reason,
+	retryable
+});
+/**
+* GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.
+* It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.
+*/
+const githubWorkflowRunsHttpLayer = (options) => Layer.effect(GitHubWorkflowRuns, Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	const permittedRepository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: "error" })(options.repository).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const getAttempt = Effect.fn("GitHubWorkflowRuns.getAttempt")(function* (request) {
+		const repository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: "error" })(request.repository).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+		if (repository.id !== permittedRepository.id || repository.owner !== permittedRepository.owner || repository.name !== permittedRepository.name) return yield* httpFailure("unauthorized", false);
+		const watch = yield* Schema.decodeEffect(GitHubWorkflowRunWatch, { onExcessProperty: "error" })({
+			runId: request.runId,
+			attempt: request.attempt,
+			expectedHeadSha: "0".repeat(40)
+		}).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+		const url = `${apiUrl}/repos/${repository.owner}/${repository.name}/actions/runs/${String(watch.runId)}/attempts/${String(watch.attempt)}`;
+		const response = yield* client.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeaders({
+			Accept: "application/vnd.github+json",
+			"X-GitHub-Api-Version": "2026-03-10",
+			"User-Agent": options.userAgent ?? "effect-agent-subscriptions"
+		}), HttpClientRequest.bearerToken(options.token))).pipe(Effect.mapError(() => httpFailure("unavailable", true)));
+		if (response.status === 429 || response.status === 403 && (response.headers["x-ratelimit-remaining"] === "0" || response.headers["retry-after"] !== void 0)) return yield* httpFailure("rate-limited", true);
+		if (response.status === 401 || response.status === 403) return yield* httpFailure("unauthorized", false);
+		if (response.status === 404) return yield* httpFailure("not-found", true);
+		if (response.status < 200 || response.status >= 300) return yield* httpFailure("unavailable", response.status >= 500);
+		return yield* response.json.pipe(Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.mebibytes(1)), Effect.mapError(() => httpFailure("invalid-response", false)), Effect.flatMap(Schema.decodeUnknownEffect(GitHubWorkflowRunAttempt)), Effect.mapError(() => httpFailure("invalid-response", false)));
+	});
+	return GitHubWorkflowRuns.of({ getAttempt });
+}));
+const sourceError = (code, retryable) => SubscriptionSourceError.make({
+	code,
+	retryable
+});
+const completionIdentity = (completion) => `github-workflow-run:${String(completion.repositoryId)}:${String(completion.runId)}:${String(completion.attempt)}:completed`;
+const watchIdentity = (repositoryId, watch) => `github-workflow-run:${String(repositoryId)}:${String(watch.runId)}:${String(watch.attempt)}:completed`;
+const completionFromWire = Effect.fn("GitHubWorkflowRun.completionFromWire")(function* (repository, watch, wire) {
+	if (wire.repository.id !== repository.id || wire.id !== watch.runId || wire.run_attempt !== watch.attempt || wire.head_sha !== watch.expectedHeadSha) return yield* sourceError("github-identity-mismatch", false);
+	if (wire.status !== "completed") return null;
+	if (wire.conclusion === null) return yield* sourceError("github-completed-without-conclusion", false);
+	return GitHubWorkflowRunCompletion.make({
+		repositoryId: repository.id,
+		runId: wire.id,
+		attempt: wire.run_attempt,
+		headSha: wire.head_sha,
+		conclusion: wire.conclusion
+	});
+});
+/**
+* Build the exact-attempt completion source, shared by all destination Agents in this partition.
+* Reconciliation depends on GitHub retaining a readable exact attempt.
+*/
+const makeGitHubWorkflowRunSource = Effect.fn("makeGitHubWorkflowRunSource")(function* (options) {
+	const repository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: "error" })(options.repository).pipe(Effect.mapError(() => sourceError("github-repository-configuration", false)));
+	const runs = yield* GitHubWorkflowRuns;
+	return yield* makeEventSource({
+		source: GitHubWorkflowRunSourceVersion,
+		continuity: "Webhook delivery is not replayed by GitHub; reconciliation can recover only while the exact workflow run attempt remains readable and authorized.",
+		event: GitHubWorkflowRunCompletion.check(Schema.makeFilter((completion) => completion.repositoryId === repository.id, { title: "GitHub completion belongs to the host-bound repository" })),
+		parameters: GitHubWorkflowRunWatch,
+		identity: completionIdentity,
+		eventKey: completionIdentity,
+		parameterKey: (watch) => watchIdentity(repository.id, watch),
+		matches: (completion, watch) => completion.repositoryId === repository.id && completion.runId === watch.runId && completion.attempt === watch.attempt && completion.headSha === watch.expectedHeadSha,
+		reconcile: (watch) => runs.getAttempt({
+			repository,
+			runId: watch.runId,
+			attempt: watch.attempt
+		}).pipe(Effect.mapError((error) => sourceError(`github-${error.reason}`, error.retryable)), Effect.flatMap((wire) => completionFromWire(repository, watch, wire)))
+	});
+});
+var GitHubWebhookVerificationError = class extends Schema.TaggedError()("GitHubWebhookVerificationError", { reason: Schema.Literals([
+	"invalid-signature",
+	"invalid-event",
+	"invalid-payload",
+	"payload-too-large",
+	"crypto-unavailable"
+]) }) {};
+/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */
+var GitHubWebhookSignatureVerifier = class extends Context.Service()("@effect-agent/thread/GitHubWebhookSignatureVerifier") {};
+/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */
+const webCryptoGitHubWebhookSignatureVerifierLayer = (secret, subtle) => Layer.effect(GitHubWebhookSignatureVerifier, Effect.sync(() => {
+	const verify = Effect.fn("GitHubWebhookSignatureVerifier.verify")(function* (body, signature) {
+		if (!/^sha256=[0-9a-f]{64}$/.test(signature)) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-signature" });
+		const signatureBytes = yield* Effect.fromResult(Encoding.decodeHex(signature.slice(7))).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: "invalid-signature" })));
+		const keyBytes = new TextEncoder().encode(Redacted.value(secret));
+		const keyBuffer = new ArrayBuffer(keyBytes.byteLength);
+		new Uint8Array(keyBuffer).set(keyBytes);
+		const key = yield* Effect.tryPromise({
+			try: () => subtle.importKey("raw", keyBuffer, {
+				name: "HMAC",
+				hash: "SHA-256"
+			}, false, ["verify"]),
+			catch: () => GitHubWebhookVerificationError.make({ reason: "crypto-unavailable" })
+		});
+		const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);
+		new Uint8Array(signatureBuffer).set(signatureBytes);
+		const bodyBuffer = new ArrayBuffer(body.byteLength);
+		new Uint8Array(bodyBuffer).set(body);
+		if (!(yield* Effect.tryPromise({
+			try: () => subtle.verify("HMAC", key, signatureBuffer, bodyBuffer),
+			catch: () => GitHubWebhookVerificationError.make({ reason: "crypto-unavailable" })
+		}))) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-signature" });
+	});
+	return GitHubWebhookSignatureVerifier.of({ verify });
+}));
+/**
+* Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to
+* durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.
+*/
+const acceptVerifiedGitHubWorkflowRunWebhook = Effect.fn("acceptVerifiedGitHubWorkflowRunWebhook")(function* (request) {
+	if (request.body.byteLength > 1048576) return yield* GitHubWebhookVerificationError.make({ reason: "payload-too-large" });
+	if (request.eventHeader !== "workflow_run" || request.signatureHeader === void 0) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-event" });
+	yield* (yield* GitHubWebhookSignatureVerifier).verify(request.body, request.signatureHeader);
+	const text = yield* Effect.try({
+		try: () => new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(request.body),
+		catch: () => GitHubWebhookVerificationError.make({ reason: "invalid-payload" })
+	});
+	const webhook = yield* Schema.decodeEffect(Schema.fromJsonString(GitHubWorkflowRunWebhook))(text).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: "invalid-payload" })));
+	if (webhook.repository.id !== webhook.workflow_run.repository.id) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-payload" });
+	if (webhook.workflow_run.status !== "completed" || webhook.workflow_run.conclusion === null) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-payload" });
+	const completion = GitHubWorkflowRunCompletion.make({
+		repositoryId: webhook.repository.id,
+		runId: webhook.workflow_run.id,
+		attempt: webhook.workflow_run.run_attempt,
+		headSha: webhook.workflow_run.head_sha,
+		conclusion: webhook.workflow_run.conclusion
+	});
+	return yield* (yield* SubscriptionIntake).accept(request.principal, GitHubWorkflowRunSourceVersion, completion);
+});
+//#endregion
+export { GitHubRepository, GitHubWebhookSignatureVerifier, GitHubWebhookVerificationError, GitHubWorkflowRunAttempt, GitHubWorkflowRunCompletion, GitHubWorkflowRunSourceVersion, GitHubWorkflowRunWatch, GitHubWorkflowRunWebhook, GitHubWorkflowRuns, GitHubWorkflowRunsError, acceptVerifiedGitHubWorkflowRunWebhook, githubWorkflowRunsHttpLayer, makeGitHubWorkflowRunSource, webCryptoGitHubWebhookSignatureVerifierLayer };
+
+//# sourceMappingURL=GitHubWorkflowSource.mjs.map

package/dist/durable/GitHubWorkflowSource.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubWorkflowSource.mjs","names":[],"sources":["../../src/durable/GitHubWorkflowSource.ts"],"sourcesContent":["import { Context, Effect, Encoding, ByteSize, Layer, Redacted, Schema } from \"effect\";\nimport { HttpClient, HttpIncomingMessage, HttpClientRequest } from \"effect/unstable/http\";\n\nimport { strictSchema } from \"../core/internal/strict-schema.ts\";\nimport { makeEventSource, type EventSource } from \"./EventSource.ts\";\nimport type { Principal } from \"./SubmissionLedger.ts\";\nimport type { EventAcknowledgement } from \"./Subscription.ts\";\nimport { SubscriptionSourceError } from \"./Subscription.ts\";\nimport { SubscriptionIntake } from \"./Subscriptions.ts\";\n\nconst PositiveId = Schema.Int.check(Schema.isGreaterThan(0));\n\nconst GitHubName = Schema.NonEmptyString.check(\n  Schema.isMaxLength(100),\n  Schema.isPattern(/^[A-Za-z0-9_.-]+$/),\n);\n\nconst GitCommitSha = Schema.String.check(Schema.isPattern(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/));\nconst GitHubConclusion = Schema.NonEmptyString.check(Schema.isMaxLength(64));\nconst GitHubStatus = Schema.NonEmptyString.check(Schema.isMaxLength(32));\n\n/** One repository whose identity and credentials are selected by the host. */\nexport const GitHubRepository = Schema.Struct({\n  id: PositiveId,\n  owner: GitHubName,\n  name: GitHubName,\n}).pipe(strictSchema);\n\nexport type GitHubRepository = typeof GitHubRepository.Type;\n\n/** Exact workflow attempt requested by an Agent through a host-permitted source. */\nexport const GitHubWorkflowRunWatch = Schema.Struct({\n  runId: PositiveId,\n  attempt: PositiveId,\n  expectedHeadSha: GitCommitSha,\n}).pipe(strictSchema);\n\nexport type GitHubWorkflowRunWatch = typeof GitHubWorkflowRunWatch.Type;\n\n/**\n * Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery\n * IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.\n */\nexport const GitHubWorkflowRunCompletion = Schema.Struct({\n  repositoryId: PositiveId,\n  runId: PositiveId,\n  attempt: PositiveId,\n  headSha: GitCommitSha,\n  conclusion: GitHubConclusion,\n}).pipe(strictSchema);\n\nexport type GitHubWorkflowRunCompletion = typeof GitHubWorkflowRunCompletion.Type;\n\n// Provider wire payloads intentionally project the fields we own. GitHub adds many fields and\n// may add more; canonical values below remain strict after this projection.\nconst GitHubWorkflowRunWire = Schema.Struct({\n  id: PositiveId,\n  run_attempt: PositiveId,\n  head_sha: GitCommitSha,\n  status: GitHubStatus,\n  conclusion: Schema.NullOr(GitHubConclusion),\n  repository: Schema.Struct({ id: PositiveId }),\n});\n\nexport const GitHubWorkflowRunWebhook = Schema.Struct({\n  action: Schema.Literal(\"completed\"),\n  repository: Schema.Struct({ id: PositiveId }),\n  workflow_run: GitHubWorkflowRunWire,\n});\n\nexport type GitHubWorkflowRunWebhook = typeof GitHubWorkflowRunWebhook.Type;\n\nexport const GitHubWorkflowRunAttempt = GitHubWorkflowRunWire;\nexport type GitHubWorkflowRunAttempt = typeof GitHubWorkflowRunAttempt.Type;\n\nexport const GitHubWorkflowRunSourceVersion = {\n  name: \"github-workflow-run-completed\",\n  version: \"1\",\n} as const;\n\nexport class GitHubWorkflowRunsError extends Schema.TaggedError<GitHubWorkflowRunsError>()(\n  \"GitHubWorkflowRunsError\",\n  {\n    reason: Schema.Literals([\n      \"rate-limited\",\n      \"unavailable\",\n      \"unauthorized\",\n      \"not-found\",\n      \"invalid-response\",\n    ]),\n    retryable: Schema.Boolean,\n  },\n) {}\n\nexport interface GitHubWorkflowRunAttemptRequest {\n  readonly repository: GitHubRepository;\n  readonly runId: number;\n  readonly attempt: number;\n}\n\n/**\n * Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read\n * the exact attempt endpoint; the source never receives or persists a credential.\n */\nexport class GitHubWorkflowRuns extends Context.Service<\n  GitHubWorkflowRuns,\n  {\n    readonly getAttempt: (\n      request: GitHubWorkflowRunAttemptRequest,\n    ) => Effect.Effect<GitHubWorkflowRunAttempt, GitHubWorkflowRunsError>;\n  }\n>()(\"@effect-agent/thread/GitHubWorkflowRuns\") {}\n\nexport interface GitHubWorkflowRunsHttpOptions {\n  /** Repository this credentialed adapter is authorized to read. */\n  readonly repository: GitHubRepository;\n  readonly token: Redacted.Redacted<string>;\n  readonly apiUrl?: string | undefined;\n  readonly userAgent?: string | undefined;\n}\n\nconst httpFailure = (\n  reason: GitHubWorkflowRunsError[\"reason\"],\n  retryable: boolean,\n): GitHubWorkflowRunsError => GitHubWorkflowRunsError.make({ reason, retryable });\n\n/**\n * GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.\n * It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.\n */\nexport const githubWorkflowRunsHttpLayer = (\n  options: GitHubWorkflowRunsHttpOptions,\n): Layer.Layer<GitHubWorkflowRuns, GitHubWorkflowRunsError, HttpClient.HttpClient> =>\n  Layer.effect(\n    GitHubWorkflowRuns,\n    Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const permittedRepository = yield* Schema.decodeEffect(GitHubRepository, {\n        onExcessProperty: \"error\",\n      })(options.repository).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n      const apiUrl = (options.apiUrl ?? \"https://api.github.com\").replace(/\\/$/, \"\");\n\n      const getAttempt = Effect.fn(\"GitHubWorkflowRuns.getAttempt\")(function* (\n        request: GitHubWorkflowRunAttemptRequest,\n      ) {\n        const repository = yield* Schema.decodeEffect(GitHubRepository, {\n          onExcessProperty: \"error\",\n        })(request.repository).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n        if (\n          repository.id !== permittedRepository.id ||\n          repository.owner !== permittedRepository.owner ||\n          repository.name !== permittedRepository.name\n        ) {\n          return yield* httpFailure(\"unauthorized\", false);\n        }\n\n        const watch = yield* Schema.decodeEffect(GitHubWorkflowRunWatch, {\n          onExcessProperty: \"error\",\n        })({\n          runId: request.runId,\n          attempt: request.attempt,\n          expectedHeadSha: \"0\".repeat(40),\n        }).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n        const url = `${apiUrl}/repos/${repository.owner}/${repository.name}/actions/runs/${String(watch.runId)}/attempts/${String(watch.attempt)}`;\n\n        const response = yield* client\n          .execute(\n            HttpClientRequest.get(url).pipe(\n              HttpClientRequest.setHeaders({\n                Accept: \"application/vnd.github+json\",\n                \"X-GitHub-Api-Version\": \"2026-03-10\",\n                \"User-Agent\": options.userAgent ?? \"effect-agent-subscriptions\",\n              }),\n              HttpClientRequest.bearerToken(options.token),\n            ),\n          )\n          .pipe(Effect.mapError(() => httpFailure(\"unavailable\", true)));\n\n        if (\n          response.status === 429 ||\n          (response.status === 403 &&\n            (response.headers[\"x-ratelimit-remaining\"] === \"0\" ||\n              response.headers[\"retry-after\"] !== undefined))\n        ) {\n          return yield* httpFailure(\"rate-limited\", true);\n        }\n        if (response.status === 401 || response.status === 403) {\n          return yield* httpFailure(\"unauthorized\", false);\n        }\n        if (response.status === 404) return yield* httpFailure(\"not-found\", true);\n        if (response.status < 200 || response.status >= 300) {\n          return yield* httpFailure(\"unavailable\", response.status >= 500);\n        }\n\n        return yield* response.json.pipe(\n          Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.mebibytes(1)),\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n          Effect.flatMap(Schema.decodeUnknownEffect(GitHubWorkflowRunAttempt)),\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n        );\n      });\n\n      return GitHubWorkflowRuns.of({ getAttempt });\n    }),\n  );\n\nconst sourceError = (code: string, retryable: boolean) =>\n  SubscriptionSourceError.make({ code, retryable });\n\nconst completionIdentity = (completion: GitHubWorkflowRunCompletion): string =>\n  `github-workflow-run:${String(completion.repositoryId)}:${String(completion.runId)}:${String(completion.attempt)}:completed`;\n\nconst watchIdentity = (repositoryId: number, watch: GitHubWorkflowRunWatch): string =>\n  `github-workflow-run:${String(repositoryId)}:${String(watch.runId)}:${String(watch.attempt)}:completed`;\n\nconst completionFromWire = Effect.fn(\"GitHubWorkflowRun.completionFromWire\")(function* (\n  repository: GitHubRepository,\n  watch: GitHubWorkflowRunWatch,\n  wire: GitHubWorkflowRunAttempt,\n) {\n  if (\n    wire.repository.id !== repository.id ||\n    wire.id !== watch.runId ||\n    wire.run_attempt !== watch.attempt ||\n    wire.head_sha !== watch.expectedHeadSha\n  ) {\n    return yield* sourceError(\"github-identity-mismatch\", false);\n  }\n  if (wire.status !== \"completed\") return null;\n  if (wire.conclusion === null) {\n    return yield* sourceError(\"github-completed-without-conclusion\", false);\n  }\n\n  return GitHubWorkflowRunCompletion.make({\n    repositoryId: repository.id,\n    runId: wire.id,\n    attempt: wire.run_attempt,\n    headSha: wire.head_sha,\n    conclusion: wire.conclusion,\n  });\n});\n\nexport interface GitHubWorkflowRunSourceOptions {\n  readonly repository: GitHubRepository;\n}\n\n/**\n * Build the exact-attempt completion source, shared by all destination Agents in this partition.\n * Reconciliation depends on GitHub retaining a readable exact attempt.\n */\nexport const makeGitHubWorkflowRunSource = Effect.fn(\"makeGitHubWorkflowRunSource\")(function* (\n  options: GitHubWorkflowRunSourceOptions,\n): Effect.fn.Return<EventSource, SubscriptionSourceError, GitHubWorkflowRuns> {\n  const repository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: \"error\" })(\n    options.repository,\n  ).pipe(Effect.mapError(() => sourceError(\"github-repository-configuration\", false)));\n\n  const runs = yield* GitHubWorkflowRuns;\n\n  return yield* makeEventSource({\n    source: GitHubWorkflowRunSourceVersion,\n    continuity:\n      \"Webhook delivery is not replayed by GitHub; reconciliation can recover only while the exact workflow run attempt remains readable and authorized.\",\n    event: GitHubWorkflowRunCompletion.check(\n      Schema.makeFilter((completion) => completion.repositoryId === repository.id, {\n        title: \"GitHub completion belongs to the host-bound repository\",\n      }),\n    ),\n    parameters: GitHubWorkflowRunWatch,\n    identity: completionIdentity,\n    eventKey: completionIdentity,\n    parameterKey: (watch) => watchIdentity(repository.id, watch),\n    matches: (completion, watch) =>\n      completion.repositoryId === repository.id &&\n      completion.runId === watch.runId &&\n      completion.attempt === watch.attempt &&\n      completion.headSha === watch.expectedHeadSha,\n    reconcile: (watch) =>\n      runs.getAttempt({ repository, runId: watch.runId, attempt: watch.attempt }).pipe(\n        Effect.mapError((error) => sourceError(`github-${error.reason}`, error.retryable)),\n        Effect.flatMap((wire) => completionFromWire(repository, watch, wire)),\n      ),\n  });\n});\n\nexport class GitHubWebhookVerificationError extends Schema.TaggedError<GitHubWebhookVerificationError>()(\n  \"GitHubWebhookVerificationError\",\n  {\n    reason: Schema.Literals([\n      \"invalid-signature\",\n      \"invalid-event\",\n      \"invalid-payload\",\n      \"payload-too-large\",\n      \"crypto-unavailable\",\n    ]),\n  },\n) {}\n\n/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */\nexport class GitHubWebhookSignatureVerifier extends Context.Service<\n  GitHubWebhookSignatureVerifier,\n  {\n    readonly verify: (\n      body: Uint8Array,\n      signature: string,\n    ) => Effect.Effect<void, GitHubWebhookVerificationError>;\n  }\n>()(\"@effect-agent/thread/GitHubWebhookSignatureVerifier\") {}\n\n/** Narrow host WebCrypto capability used for GitHub HMAC-SHA256 verification. */\nexport interface GitHubWebhookSubtleCrypto<Key> {\n  readonly importKey: (\n    format: \"raw\",\n    keyData: ArrayBuffer,\n    algorithm: { readonly name: \"HMAC\"; readonly hash: \"SHA-256\" },\n    extractable: false,\n    usages: [\"verify\"],\n  ) => PromiseLike<Key>;\n  readonly verify: (\n    algorithm: \"HMAC\",\n    key: Key,\n    signature: ArrayBuffer,\n    data: ArrayBuffer,\n  ) => PromiseLike<boolean>;\n}\n\n/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */\nexport const webCryptoGitHubWebhookSignatureVerifierLayer = <Key>(\n  secret: Redacted.Redacted<string>,\n  subtle: GitHubWebhookSubtleCrypto<Key>,\n): Layer.Layer<GitHubWebhookSignatureVerifier> =>\n  Layer.effect(\n    GitHubWebhookSignatureVerifier,\n    Effect.sync(() => {\n      const verify = Effect.fn(\"GitHubWebhookSignatureVerifier.verify\")(function* (\n        body: Uint8Array,\n        signature: string,\n      ) {\n        if (!/^sha256=[0-9a-f]{64}$/.test(signature)) {\n          return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" });\n        }\n\n        const signatureBytes = yield* Effect.fromResult(\n          Encoding.decodeHex(signature.slice(\"sha256=\".length)),\n        ).pipe(\n          Effect.mapError(() =>\n            GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" }),\n          ),\n        );\n\n        const keyBytes = new TextEncoder().encode(Redacted.value(secret));\n        const keyBuffer = new ArrayBuffer(keyBytes.byteLength);\n\n        new Uint8Array(keyBuffer).set(keyBytes);\n\n        const key = yield* Effect.tryPromise({\n          try: () =>\n            subtle.importKey(\"raw\", keyBuffer, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n              \"verify\",\n            ]),\n          catch: () => GitHubWebhookVerificationError.make({ reason: \"crypto-unavailable\" }),\n        });\n\n        const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n\n        new Uint8Array(signatureBuffer).set(signatureBytes);\n        const bodyBuffer = new ArrayBuffer(body.byteLength);\n\n        new Uint8Array(bodyBuffer).set(body);\n\n        const valid = yield* Effect.tryPromise({\n          try: () => subtle.verify(\"HMAC\", key, signatureBuffer, bodyBuffer),\n          catch: () => GitHubWebhookVerificationError.make({ reason: \"crypto-unavailable\" }),\n        });\n\n        if (!valid) {\n          return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" });\n        }\n      });\n\n      return GitHubWebhookSignatureVerifier.of({ verify });\n    }),\n  );\n\nexport interface VerifiedGitHubWorkflowRunWebhookRequest {\n  readonly body: Uint8Array;\n  readonly eventHeader: string | undefined;\n  readonly signatureHeader: string | undefined;\n  readonly principal: Principal;\n}\n\n/**\n * Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to\n * durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.\n */\nexport const acceptVerifiedGitHubWorkflowRunWebhook = Effect.fn(\n  \"acceptVerifiedGitHubWorkflowRunWebhook\",\n)(function* (\n  request: VerifiedGitHubWorkflowRunWebhookRequest,\n): Effect.fn.Return<\n  EventAcknowledgement,\n  | GitHubWebhookVerificationError\n  | Effect.Error<ReturnType<SubscriptionIntake[\"Service\"][\"accept\"]>>,\n  GitHubWebhookSignatureVerifier | SubscriptionIntake\n> {\n  if (request.body.byteLength > 1024 * 1024) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"payload-too-large\" });\n  }\n  if (request.eventHeader !== \"workflow_run\" || request.signatureHeader === undefined) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-event\" });\n  }\n  const verifier = yield* GitHubWebhookSignatureVerifier;\n\n  yield* verifier.verify(request.body, request.signatureHeader);\n\n  const text = yield* Effect.try({\n    try: () => new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: false }).decode(request.body),\n    catch: () => GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" }),\n  });\n\n  const webhook = yield* Schema.decodeEffect(Schema.fromJsonString(GitHubWorkflowRunWebhook))(\n    text,\n  ).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" })));\n\n  if (webhook.repository.id !== webhook.workflow_run.repository.id) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" });\n  }\n  if (webhook.workflow_run.status !== \"completed\" || webhook.workflow_run.conclusion === null) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" });\n  }\n\n  const completion = GitHubWorkflowRunCompletion.make({\n    repositoryId: webhook.repository.id,\n    runId: webhook.workflow_run.id,\n    attempt: webhook.workflow_run.run_attempt,\n    headSha: webhook.workflow_run.head_sha,\n    conclusion: webhook.workflow_run.conclusion,\n  });\n\n  const intake = yield* SubscriptionIntake;\n\n  return yield* intake.accept(request.principal, GitHubWorkflowRunSourceVersion, completion);\n});\n"],"mappings":";;;;;;;AAUA,MAAM,aAAa,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAE3D,MAAM,aAAa,OAAO,eAAe,MACvC,OAAO,YAAY,GAAG,GACtB,OAAO,UAAU,mBAAmB,CACtC;AAEA,MAAM,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC;AAC5F,MAAM,mBAAmB,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC3E,MAAM,eAAe,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;;AAGvE,MAAa,mBAAmB,OAAO,OAAO;CAC5C,IAAI;CACJ,OAAO;CACP,MAAM;AACR,CAAC,CAAC,CAAC,KAAK,YAAY;;AAKpB,MAAa,yBAAyB,OAAO,OAAO;CAClD,OAAO;CACP,SAAS;CACT,iBAAiB;AACnB,CAAC,CAAC,CAAC,KAAK,YAAY;;;;;AAQpB,MAAa,8BAA8B,OAAO,OAAO;CACvD,cAAc;CACd,OAAO;CACP,SAAS;CACT,SAAS;CACT,YAAY;AACd,CAAC,CAAC,CAAC,KAAK,YAAY;AAMpB,MAAM,wBAAwB,OAAO,OAAO;CAC1C,IAAI;CACJ,aAAa;CACb,UAAU;CACV,QAAQ;CACR,YAAY,OAAO,OAAO,gBAAgB;CAC1C,YAAY,OAAO,OAAO,EAAE,IAAI,WAAW,CAAC;AAC9C,CAAC;AAED,MAAa,2BAA2B,OAAO,OAAO;CACpD,QAAQ,OAAO,QAAQ,WAAW;CAClC,YAAY,OAAO,OAAO,EAAE,IAAI,WAAW,CAAC;CAC5C,cAAc;AAChB,CAAC;AAID,MAAa,2BAA2B;AAGxC,MAAa,iCAAiC;CAC5C,MAAM;CACN,SAAS;AACX;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CACE,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;;;;AAYH,IAAa,qBAAb,cAAwC,QAAQ,QAO9C,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;AAUhD,MAAM,eACJ,QACA,cAC4B,wBAAwB,KAAK;CAAE;CAAQ;AAAU,CAAC;;;;;AAMhF,MAAa,+BACX,YAEA,MAAM,OACJ,oBACA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO,WAAW;CAEjC,MAAM,sBAAsB,OAAO,OAAO,aAAa,kBAAkB,EACvE,kBAAkB,QACpB,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;CAEzF,MAAM,UAAU,QAAQ,UAAU,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE7E,MAAM,aAAa,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC5D,SACA;EACA,MAAM,aAAa,OAAO,OAAO,aAAa,kBAAkB,EAC9D,kBAAkB,QACpB,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;EAEzF,IACE,WAAW,OAAO,oBAAoB,MACtC,WAAW,UAAU,oBAAoB,SACzC,WAAW,SAAS,oBAAoB,MAExC,OAAO,OAAO,YAAY,gBAAgB,KAAK;EAGjD,MAAM,QAAQ,OAAO,OAAO,aAAa,wBAAwB,EAC/D,kBAAkB,QACpB,CAAC,CAAC,CAAC;GACD,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,iBAAiB,IAAI,OAAO,EAAE;EAChC,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;EAErE,MAAM,MAAM,GAAG,OAAO,SAAS,WAAW,MAAM,GAAG,WAAW,KAAK,gBAAgB,OAAO,MAAM,KAAK,EAAE,YAAY,OAAO,MAAM,OAAO;EAEvI,MAAM,WAAW,OAAO,OACrB,QACC,kBAAkB,IAAI,GAAG,CAAC,CAAC,KACzB,kBAAkB,WAAW;GAC3B,QAAQ;GACR,wBAAwB;GACxB,cAAc,QAAQ,aAAa;EACrC,CAAC,GACD,kBAAkB,YAAY,QAAQ,KAAK,CAC7C,CACF,CAAC,CACA,KAAK,OAAO,eAAe,YAAY,eAAe,IAAI,CAAC,CAAC;EAE/D,IACE,SAAS,WAAW,OACnB,SAAS,WAAW,QAClB,SAAS,QAAQ,6BAA6B,OAC7C,SAAS,QAAQ,mBAAmB,KAAA,IAExC,OAAO,OAAO,YAAY,gBAAgB,IAAI;EAEhD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,OAAO,YAAY,gBAAgB,KAAK;EAEjD,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,aAAa,IAAI;EACxE,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAC9C,OAAO,OAAO,YAAY,eAAe,SAAS,UAAU,GAAG;EAGjE,OAAO,OAAO,SAAS,KAAK,KAC1B,OAAO,eAAe,oBAAoB,aAAa,SAAS,UAAU,CAAC,CAAC,GAC5E,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,GAC5D,OAAO,QAAQ,OAAO,oBAAoB,wBAAwB,CAAC,GACnE,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAC9D;CACF,CAAC;CAED,OAAO,mBAAmB,GAAG,EAAE,WAAW,CAAC;AAC7C,CAAC,CACH;AAEF,MAAM,eAAe,MAAc,cACjC,wBAAwB,KAAK;CAAE;CAAM;AAAU,CAAC;AAElD,MAAM,sBAAsB,eAC1B,uBAAuB,OAAO,WAAW,YAAY,EAAE,GAAG,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,WAAW,OAAO,EAAE;AAEnH,MAAM,iBAAiB,cAAsB,UAC3C,uBAAuB,OAAO,YAAY,EAAE,GAAG,OAAO,MAAM,KAAK,EAAE,GAAG,OAAO,MAAM,OAAO,EAAE;AAE9F,MAAM,qBAAqB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC3E,YACA,OACA,MACA;CACA,IACE,KAAK,WAAW,OAAO,WAAW,MAClC,KAAK,OAAO,MAAM,SAClB,KAAK,gBAAgB,MAAM,WAC3B,KAAK,aAAa,MAAM,iBAExB,OAAO,OAAO,YAAY,4BAA4B,KAAK;CAE7D,IAAI,KAAK,WAAW,aAAa,OAAO;CACxC,IAAI,KAAK,eAAe,MACtB,OAAO,OAAO,YAAY,uCAAuC,KAAK;CAGxE,OAAO,4BAA4B,KAAK;EACtC,cAAc,WAAW;EACzB,OAAO,KAAK;EACZ,SAAS,KAAK;EACd,SAAS,KAAK;EACd,YAAY,KAAK;CACnB,CAAC;AACH,CAAC;;;;;AAUD,MAAa,8BAA8B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAClF,SAC4E;CAC5E,MAAM,aAAa,OAAO,OAAO,aAAa,kBAAkB,EAAE,kBAAkB,QAAQ,CAAC,CAAC,CAC5F,QAAQ,UACV,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,mCAAmC,KAAK,CAAC,CAAC;CAEnF,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,gBAAgB;EAC5B,QAAQ;EACR,YACE;EACF,OAAO,4BAA4B,MACjC,OAAO,YAAY,eAAe,WAAW,iBAAiB,WAAW,IAAI,EAC3E,OAAO,yDACT,CAAC,CACH;EACA,YAAY;EACZ,UAAU;EACV,UAAU;EACV,eAAe,UAAU,cAAc,WAAW,IAAI,KAAK;EAC3D,UAAU,YAAY,UACpB,WAAW,iBAAiB,WAAW,MACvC,WAAW,UAAU,MAAM,SAC3B,WAAW,YAAY,MAAM,WAC7B,WAAW,YAAY,MAAM;EAC/B,YAAY,UACV,KAAK,WAAW;GAAE;GAAY,OAAO,MAAM;GAAO,SAAS,MAAM;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,UAAU,MAAM,SAAS,CAAC,GACjF,OAAO,SAAS,SAAS,mBAAmB,YAAY,OAAO,IAAI,CAAC,CACtE;CACJ,CAAC;AACH,CAAC;AAED,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,iCAAb,cAAoD,QAAQ,QAQ1D,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC;;AAoB5D,MAAa,gDACX,QACA,WAEA,MAAM,OACJ,gCACA,OAAO,WAAW;CAChB,MAAM,SAAS,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAChE,MACA,WACA;EACA,IAAI,CAAC,wBAAwB,KAAK,SAAS,GACzC,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;EAGnF,MAAM,iBAAiB,OAAO,OAAO,WACnC,SAAS,UAAU,UAAU,MAAM,CAAgB,CAAC,CACtD,CAAC,CAAC,KACA,OAAO,eACL,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC,CACrE,CACF;EAEA,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,MAAM,MAAM,CAAC;EAChE,MAAM,YAAY,IAAI,YAAY,SAAS,UAAU;EAErD,IAAI,WAAW,SAAS,CAAC,CAAC,IAAI,QAAQ;EAEtC,MAAM,MAAM,OAAO,OAAO,WAAW;GACnC,WACE,OAAO,UAAU,OAAO,WAAW;IAAE,MAAM;IAAQ,MAAM;GAAU,GAAG,OAAO,CAC3E,QACF,CAAC;GACH,aAAa,+BAA+B,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EACnF,CAAC;EAED,MAAM,kBAAkB,IAAI,YAAY,eAAe,UAAU;EAEjE,IAAI,WAAW,eAAe,CAAC,CAAC,IAAI,cAAc;EAClD,MAAM,aAAa,IAAI,YAAY,KAAK,UAAU;EAElD,IAAI,WAAW,UAAU,CAAC,CAAC,IAAI,IAAI;EAOnC,IAAI,EAAC,OALgB,OAAO,WAAW;GACrC,WAAW,OAAO,OAAO,QAAQ,KAAK,iBAAiB,UAAU;GACjE,aAAa,+BAA+B,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EACnF,CAAC,IAGC,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;CAErF,CAAC;CAED,OAAO,+BAA+B,GAAG,EAAE,OAAO,CAAC;AACrD,CAAC,CACH;;;;;AAaF,MAAa,yCAAyC,OAAO,GAC3D,wCACF,CAAC,CAAC,WACA,SAMA;CACA,IAAI,QAAQ,KAAK,aAAa,SAC5B,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;CAEnF,IAAI,QAAQ,gBAAgB,kBAAkB,QAAQ,oBAAoB,KAAA,GACxE,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,gBAAgB,CAAC;CAI/E,QAAO,OAFiB,+BAAA,CAER,OAAO,QAAQ,MAAM,QAAQ,eAAe;CAE5D,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WAAW,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,QAAQ,IAAI;EAC1F,aAAa,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAChF,CAAC;CAED,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,eAAe,wBAAwB,CAAC,CAAC,CACzF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC,CAAC,CAAC;CAEhG,IAAI,QAAQ,WAAW,OAAO,QAAQ,aAAa,WAAW,IAC5D,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAEjF,IAAI,QAAQ,aAAa,WAAW,eAAe,QAAQ,aAAa,eAAe,MACrF,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAGjF,MAAM,aAAa,4BAA4B,KAAK;EAClD,cAAc,QAAQ,WAAW;EACjC,OAAO,QAAQ,aAAa;EAC5B,SAAS,QAAQ,aAAa;EAC9B,SAAS,QAAQ,aAAa;EAC9B,YAAY,QAAQ,aAAa;CACnC,CAAC;CAID,OAAO,QAAO,OAFQ,mBAAA,CAED,OAAO,QAAQ,WAAW,gCAAgC,UAAU;AAC3F,CAAC"}