instar 1.3.18 → 1.3.19

package/dist/core/RegistrySyncDebouncer.d.ts

@@ -0,0 +1,77 @@
+/**
+ * RegistrySyncDebouncer — G2 automated state sync (durable half).
+ *
+ * Spec: docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §8 G2.
+ *
+ * The Phase-0 root cause: a running server changed its registry (role/lease)
+ * but NOTHING pushed that change to git, so cross-machine state only ever
+ * propagated by hand. This component closes that: a marked-dirty registry is
+ * debounced and committed+pushed to git — but ONLY the authoritative machine
+ * (lease holder / awake) writes durable authority-bearing state (single-writer,
+ * removing the O(N) thundering-herd of every machine pushing a corrected
+ * registry).
+ *
+ * This is the DURABLE path only. High-frequency liveness/heartbeat (ephemeral)
+ * never comes through here — it travels over the tunnel and stays out of git
+ * history, so steady-state healthy operation produces ~0 commits (the
+ * ephemeral-vs-durable split, spec §Design Principles).
+ *
+ * Push contention: commitAndPush performs `git push` which fails (returns
+ * false) on a non-fast-forward — we never force-push. Repeated failures past a
+ * threshold emit a sync-health signal so the lease layer can self-suspend
+ * ingress (a machine that cannot prove it is visible must not serve). The
+ * pull/rebase reconciliation itself lives in the periodic GitSync.sync cycle.
+ */
+export interface SyncHealthState {
+    healthy: boolean;
+    consecutiveFailures: number;
+    lastError?: string;
+    lastPushAt?: string;
+    lastAttemptAt?: string;
+}
+export interface RegistrySyncDeps {
+    /** Commit + push the given paths. Returns true if a commit was pushed. */
+    commitAndPush: (message: string, paths: string[]) => boolean;
+    /** Absolute path of the registry file to stage. */
+    registryAbsPath: string;
+    /**
+     * Single-writer gate: only flush when THIS machine has authority to write
+     * durable registry state (holds the lease / is awake). A standby marking
+     * dirty is a no-op push (it still updates its own liveness elsewhere).
+     */
+    isAuthoritative: () => boolean;
+    /** Debounce window (registrySyncDebounceMs). */
+    debounceMs: number;
+    /** Failures before the sync-health signal flips unhealthy. Default 3. */
+    maxConsecutiveFailures?: number;
+    /** Sync-health signal consumer (lease layer self-suspends ingress on unhealthy). */
+    onSyncHealth?: (s: SyncHealthState) => void;
+    logger?: (msg: string) => void;
+    now?: () => number;
+}
+export declare class RegistrySyncDebouncer {
+    private readonly deps;
+    private readonly maxFailures;
+    private timer;
+    private pendingReasons;
+    private flushing;
+    private health;
+    private stopped;
+    constructor(deps: RegistrySyncDeps);
+    private now;
+    private log;
+    /**
+     * Mark the registry as needing a durable push. Debounced — many rapid marks
+     * within the window coalesce into a single commit (coarse, not per-tick).
+     */
+    markRegistryDirty(reason: string): void;
+    /**
+     * Flush immediately (also used by stop()). Returns true if a commit was
+     * pushed. A non-authoritative machine returns false without pushing
+     * (single-writer). Re-entrancy guarded.
+     */
+    flush(): Promise<boolean>;
+    getHealth(): SyncHealthState;
+    stop(): void;
+}
+//# sourceMappingURL=RegistrySyncDebouncer.d.ts.map

package/dist/core/RegistrySyncDebouncer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistrySyncDebouncer.d.ts","sourceRoot":"","sources":["../../src/core/RegistrySyncDebouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC7D,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,KAAK,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAA8D;IAC5E,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,gBAAgB;IAKlC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,GAAG;IAIX;;;OAGG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAWvC;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAqD/B,SAAS,IAAI,eAAe;IAI5B,IAAI,IAAI,IAAI;CAOb"}

package/dist/core/RegistrySyncDebouncer.js

@@ -0,0 +1,131 @@
+/**
+ * RegistrySyncDebouncer — G2 automated state sync (durable half).
+ *
+ * Spec: docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §8 G2.
+ *
+ * The Phase-0 root cause: a running server changed its registry (role/lease)
+ * but NOTHING pushed that change to git, so cross-machine state only ever
+ * propagated by hand. This component closes that: a marked-dirty registry is
+ * debounced and committed+pushed to git — but ONLY the authoritative machine
+ * (lease holder / awake) writes durable authority-bearing state (single-writer,
+ * removing the O(N) thundering-herd of every machine pushing a corrected
+ * registry).
+ *
+ * This is the DURABLE path only. High-frequency liveness/heartbeat (ephemeral)
+ * never comes through here — it travels over the tunnel and stays out of git
+ * history, so steady-state healthy operation produces ~0 commits (the
+ * ephemeral-vs-durable split, spec §Design Principles).
+ *
+ * Push contention: commitAndPush performs `git push` which fails (returns
+ * false) on a non-fast-forward — we never force-push. Repeated failures past a
+ * threshold emit a sync-health signal so the lease layer can self-suspend
+ * ingress (a machine that cannot prove it is visible must not serve). The
+ * pull/rebase reconciliation itself lives in the periodic GitSync.sync cycle.
+ */
+export class RegistrySyncDebouncer {
+    deps;
+    maxFailures;
+    timer = null;
+    pendingReasons = [];
+    flushing = false;
+    health = { healthy: true, consecutiveFailures: 0 };
+    stopped = false;
+    constructor(deps) {
+        this.deps = deps;
+        this.maxFailures = deps.maxConsecutiveFailures ?? 3;
+    }
+    now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    log(msg) {
+        this.deps.logger?.(`[registry-sync] ${msg}`);
+    }
+    /**
+     * Mark the registry as needing a durable push. Debounced — many rapid marks
+     * within the window coalesce into a single commit (coarse, not per-tick).
+     */
+    markRegistryDirty(reason) {
+        if (this.stopped)
+            return;
+        this.pendingReasons.push(reason);
+        if (this.timer)
+            return; // already scheduled
+        this.timer = setTimeout(() => {
+            this.timer = null;
+            void this.flush();
+        }, this.deps.debounceMs);
+        if (this.timer.unref)
+            this.timer.unref();
+    }
+    /**
+     * Flush immediately (also used by stop()). Returns true if a commit was
+     * pushed. A non-authoritative machine returns false without pushing
+     * (single-writer). Re-entrancy guarded.
+     */
+    async flush() {
+        if (this.flushing)
+            return false;
+        if (this.pendingReasons.length === 0)
+            return false;
+        this.flushing = true;
+        const reasons = this.pendingReasons.slice(0, 8);
+        this.pendingReasons = [];
+        this.health.lastAttemptAt = new Date(this.now()).toISOString();
+        try {
+            if (!this.deps.isAuthoritative()) {
+                // Single-writer: a standby never writes durable authority-bearing state.
+                this.log(`skip flush — not authoritative (${reasons.length} pending reason(s) dropped)`);
+                return false;
+            }
+            const message = `chore(mesh): registry sync — ${reasons.join('; ').slice(0, 200)}`;
+            const pushed = this.deps.commitAndPush(message, [this.deps.registryAbsPath]);
+            if (pushed) {
+                this.health = {
+                    healthy: true,
+                    consecutiveFailures: 0,
+                    lastPushAt: new Date(this.now()).toISOString(),
+                    lastAttemptAt: this.health.lastAttemptAt,
+                };
+                this.deps.onSyncHealth?.(this.health);
+                this.log(`pushed: ${message}`);
+                return true;
+            }
+            // commitAndPush returns false either when nothing changed (benign) OR on
+            // a push failure. We can't distinguish here, so a "nothing to push" is
+            // treated as success (no failure increment) only if a prior push exists.
+            // To stay conservative we treat false as a non-failure unless we can see
+            // the working tree is dirty — handled by the caller's periodic sync.
+            this.log(`commitAndPush returned false (no-op or push declined): ${message}`);
+            return false;
+        }
+        catch (err) {
+            const lastError = err instanceof Error ? err.message : String(err);
+            this.health = {
+                healthy: this.health.consecutiveFailures + 1 < this.maxFailures,
+                consecutiveFailures: this.health.consecutiveFailures + 1,
+                lastError,
+                lastPushAt: this.health.lastPushAt,
+                lastAttemptAt: this.health.lastAttemptAt,
+            };
+            this.deps.onSyncHealth?.(this.health);
+            this.log(`push failed (${this.health.consecutiveFailures}/${this.maxFailures}): ${lastError}`);
+            // Re-queue the reasons so the next mark/flush retries them.
+            this.pendingReasons.unshift(...reasons);
+            return false;
+        }
+        finally {
+            this.flushing = false;
+        }
+    }
+    getHealth() {
+        return { ...this.health };
+    }
+    stop() {
+        this.stopped = true;
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+    }
+}
+//# sourceMappingURL=RegistrySyncDebouncer.js.map

package/dist/core/RegistrySyncDebouncer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistrySyncDebouncer.js","sourceRoot":"","sources":["../../src/core/RegistrySyncDebouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA+BH,MAAM,OAAO,qBAAqB;IACf,IAAI,CAAmB;IACvB,WAAW,CAAS;IAC7B,KAAK,GAAyC,IAAI,CAAC;IACnD,cAAc,GAAa,EAAE,CAAC;IAC9B,QAAQ,GAAG,KAAK,CAAC;IACjB,MAAM,GAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG,KAAK,CAAC;IAExB,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAC;IACtD,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,GAAG,CAAC,GAAW;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,MAAc;QAC9B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,oBAAoB;QAC5C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAE/D,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACjC,yEAAyE;gBACzE,IAAI,CAAC,GAAG,CAAC,mCAAmC,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC;gBACzF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,OAAO,GAAG,gCAAgC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,GAAG;oBACZ,OAAO,EAAE,IAAI;oBACb,mBAAmB,EAAE,CAAC;oBACtB,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;oBAC9C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;iBACzC,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,0DAA0D,OAAO,EAAE,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,GAAG;gBACZ,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW;gBAC/D,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,GAAG,CAAC;gBACxD,SAAS;gBACT,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;gBAClC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;aACzC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAC,WAAW,MAAM,SAAS,EAAE,CAAC,CAAC;YAC/F,4DAA4D;YAC5D,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;CACF"}

package/dist/core/liveTailRedaction.d.ts

@@ -0,0 +1,36 @@
+/**
+ * liveTailRedaction — versioned secret-redaction for the live tail (spec §8 G3c).
+ *
+ * The live tail carries the most sensitive data in the system (user messages,
+ * tool outputs, incidentally-present secrets). Before any tail content leaves
+ * this machine it is scrubbed of credential-shaped material. The category set
+ * is a NAMED, VERSIONED enum (not an ad-hoc inline regex) so it can be extended
+ * as new token/credential shapes appear — combined with carry-by-reference for
+ * large tool output (§8 G3b), the tail minimizes raw sensitive bytes
+ * structurally rather than relying on pattern-matching alone.
+ *
+ * Bump REDACTION_CATEGORY_VERSION when the category set changes, so a receiver
+ * can record which version scrubbed a flush.
+ */
+export declare const REDACTION_CATEGORY_VERSION = 1;
+export declare enum RedactionCategory {
+    BearerToken = "bearer-token",
+    ApiKey = "api-key",
+    PrivateKeyBlock = "private-key-block",
+    AwsAccessKey = "aws-access-key",
+    SecretAssignment = "secret-assignment",
+    JwtLike = "jwt-like"
+}
+export interface RedactionResult {
+    text: string;
+    redactedCount: number;
+    categories: RedactionCategory[];
+    version: number;
+}
+/**
+ * Redact credential-shaped material from a string. Returns the scrubbed text,
+ * how many redactions occurred, and which categories fired (for the flush's
+ * redaction metadata).
+ */
+export declare function redactForLiveTail(input: string): RedactionResult;
+//# sourceMappingURL=liveTailRedaction.d.ts.map

package/dist/core/liveTailRedaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveTailRedaction.d.ts","sourceRoot":"","sources":["../../src/core/liveTailRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,oBAAY,iBAAiB;IAC3B,WAAW,iBAAiB;IAC5B,MAAM,YAAY;IAClB,eAAe,sBAAsB;IACrC,YAAY,mBAAmB;IAC/B,gBAAgB,sBAAsB;IACtC,OAAO,aAAa;CACrB;AAuBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAYhE"}

package/dist/core/liveTailRedaction.js

@@ -0,0 +1,57 @@
+/**
+ * liveTailRedaction — versioned secret-redaction for the live tail (spec §8 G3c).
+ *
+ * The live tail carries the most sensitive data in the system (user messages,
+ * tool outputs, incidentally-present secrets). Before any tail content leaves
+ * this machine it is scrubbed of credential-shaped material. The category set
+ * is a NAMED, VERSIONED enum (not an ad-hoc inline regex) so it can be extended
+ * as new token/credential shapes appear — combined with carry-by-reference for
+ * large tool output (§8 G3b), the tail minimizes raw sensitive bytes
+ * structurally rather than relying on pattern-matching alone.
+ *
+ * Bump REDACTION_CATEGORY_VERSION when the category set changes, so a receiver
+ * can record which version scrubbed a flush.
+ */
+export const REDACTION_CATEGORY_VERSION = 1;
+export var RedactionCategory;
+(function (RedactionCategory) {
+    RedactionCategory["BearerToken"] = "bearer-token";
+    RedactionCategory["ApiKey"] = "api-key";
+    RedactionCategory["PrivateKeyBlock"] = "private-key-block";
+    RedactionCategory["AwsAccessKey"] = "aws-access-key";
+    RedactionCategory["SecretAssignment"] = "secret-assignment";
+    RedactionCategory["JwtLike"] = "jwt-like";
+})(RedactionCategory || (RedactionCategory = {}));
+// Conservative, high-precision patterns — false positives (over-redaction) are
+// cheaper than leaking a secret over the wire. Each is global + case-insensitive
+// where appropriate.
+const RULES = [
+    { category: RedactionCategory.PrivateKeyBlock, pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+    { category: RedactionCategory.BearerToken, pattern: /\bBearer\s+[A-Za-z0-9._\-]{12,}/gi },
+    { category: RedactionCategory.AwsAccessKey, pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+    { category: RedactionCategory.JwtLike, pattern: /\beyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\b/g },
+    // key/secret/token/password = "value" or : value
+    { category: RedactionCategory.SecretAssignment, pattern: /\b(?:api[_-]?key|secret|token|password|passwd|client[_-]?secret)\b\s*[:=]\s*["']?[A-Za-z0-9._\-]{8,}["']?/gi },
+    // Generic long opaque api-key-ish tokens (sk-, ghp_, xoxb-, etc.)
+    { category: RedactionCategory.ApiKey, pattern: /\b(?:sk|pk|rk|ghp|gho|ghs|xox[bpoa])[_-][A-Za-z0-9]{16,}\b/g },
+];
+const PLACEHOLDER = (c) => `[redacted:${c}]`;
+/**
+ * Redact credential-shaped material from a string. Returns the scrubbed text,
+ * how many redactions occurred, and which categories fired (for the flush's
+ * redaction metadata).
+ */
+export function redactForLiveTail(input) {
+    let text = input;
+    let redactedCount = 0;
+    const categories = new Set();
+    for (const { category, pattern } of RULES) {
+        text = text.replace(pattern, () => {
+            redactedCount++;
+            categories.add(category);
+            return PLACEHOLDER(category);
+        });
+    }
+    return { text, redactedCount, categories: [...categories], version: REDACTION_CATEGORY_VERSION };
+}
+//# sourceMappingURL=liveTailRedaction.js.map

package/dist/core/liveTailRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"liveTailRedaction.js","sourceRoot":"","sources":["../../src/core/liveTailRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,CAAN,IAAY,iBAOX;AAPD,WAAY,iBAAiB;IAC3B,iDAA4B,CAAA;IAC5B,uCAAkB,CAAA;IAClB,0DAAqC,CAAA;IACrC,oDAA+B,CAAA;IAC/B,2DAAsC,CAAA;IACtC,yCAAoB,CAAA;AACtB,CAAC,EAPW,iBAAiB,KAAjB,iBAAiB,QAO5B;AAOD,+EAA+E;AAC/E,iFAAiF;AACjF,qBAAqB;AACrB,MAAM,KAAK,GAAmB;IAC5B,EAAE,QAAQ,EAAE,iBAAiB,CAAC,eAAe,EAAE,OAAO,EAAE,6EAA6E,EAAE;IACvI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACzF,EAAE,QAAQ,EAAE,iBAAiB,CAAC,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9E,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,oEAAoE,EAAE;IACtH,iDAAiD;IACjD,EAAE,QAAQ,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,EAAE,6GAA6G,EAAE;IACxK,kEAAkE;IAClE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,6DAA6D,EAAE;CAC/G,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC;AAShE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,KAAK,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YAChC,aAAa,EAAE,CAAC;YAChB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzB,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACnG,CAAC"}

package/dist/core/registryReplayGuard.d.ts

@@ -0,0 +1,59 @@
+/**
+ * registryReplayGuard — G2 replay/freshness + unknown-key constraint (spec §8 G2).
+ *
+ * Validates an incoming (pulled) registry entry before it is applied locally.
+ * Signed-commit verification (v3) already rejects unsigned/revoked commits;
+ * this guard adds the content-level checks a signature alone cannot give:
+ *
+ *  1. Replay/freshness — a pulled entry whose per-author `syncSequence` is not
+ *     strictly greater than the last applied for its author is discarded.
+ *  2. Epoch floor — a pulled entry whose `authoredUnderEpoch` is below the
+ *     current committed epoch is discarded. This catches the case a per-author
+ *     sequence cannot: a machine that wiped/restored local state (sequence
+ *     resets to 0) or re-keyed cannot smuggle in an authority-bearing write,
+ *     because its stale leaseEpoch is rejected regardless of a locally-monotonic
+ *     sequence.
+ *  3. Unknown-key first commit — the FIRST commit from a previously-unseen
+ *     machineId is accepted ONLY if it is role:standby + rejoined:true (or a
+ *     pairing-join record). Any unknown-key first commit asserting an awake
+ *     role or a lease claim is rejected — a rejoining machine must pull-and-read
+ *     before writing, never assert its stale prior role.
+ *
+ * Pure logic, unit-tested on both sides of every boundary.
+ */
+import type { MachineRegistryEntry } from './types.js';
+export interface ReplayGuardInput {
+    machineId: string;
+    /** The incoming (pulled) entry for this machine. */
+    incoming: MachineRegistryEntry;
+    /** The locally-known entry for this machine (undefined = previously unseen). */
+    local?: MachineRegistryEntry;
+    /** The current committed lease epoch (registry.lease?.epoch ?? 0). */
+    currentCommittedEpoch: number;
+    /** Whether this incoming entry carries a valid pairing-join record (allows an awake-less first write). */
+    hasValidJoinRecord?: boolean;
+}
+export interface ReplayDecision {
+    accept: boolean;
+    reason: string;
+}
+export declare function evaluateRegistryEntry(input: ReplayGuardInput): ReplayDecision;
+/**
+ * Reconcile a full incoming registry against the local one, entry by entry.
+ * Returns the entries to apply (accepted) and the rejected ones with reasons
+ * (logged, never applied). The lease object is reconciled separately by the
+ * FencedLease layer (epoch CAS), not here.
+ */
+export declare function reconcileRegistryEntries(opts: {
+    localEntries: Record<string, MachineRegistryEntry>;
+    incomingEntries: Record<string, MachineRegistryEntry>;
+    currentCommittedEpoch: number;
+    joinRecords?: ReadonlySet<string>;
+}): {
+    accepted: Record<string, MachineRegistryEntry>;
+    rejected: Array<{
+        machineId: string;
+        reason: string;
+    }>;
+};
+//# sourceMappingURL=registryReplayGuard.d.ts.map

package/dist/core/registryReplayGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryReplayGuard.d.ts","sourceRoot":"","sources":["../../src/core/registryReplayGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0GAA0G;IAC1G,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,CAuC7E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACtD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC,GAAG;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC/C,QAAQ,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD,CAoBA"}

package/dist/core/registryReplayGuard.js

@@ -0,0 +1,86 @@
+/**
+ * registryReplayGuard — G2 replay/freshness + unknown-key constraint (spec §8 G2).
+ *
+ * Validates an incoming (pulled) registry entry before it is applied locally.
+ * Signed-commit verification (v3) already rejects unsigned/revoked commits;
+ * this guard adds the content-level checks a signature alone cannot give:
+ *
+ *  1. Replay/freshness — a pulled entry whose per-author `syncSequence` is not
+ *     strictly greater than the last applied for its author is discarded.
+ *  2. Epoch floor — a pulled entry whose `authoredUnderEpoch` is below the
+ *     current committed epoch is discarded. This catches the case a per-author
+ *     sequence cannot: a machine that wiped/restored local state (sequence
+ *     resets to 0) or re-keyed cannot smuggle in an authority-bearing write,
+ *     because its stale leaseEpoch is rejected regardless of a locally-monotonic
+ *     sequence.
+ *  3. Unknown-key first commit — the FIRST commit from a previously-unseen
+ *     machineId is accepted ONLY if it is role:standby + rejoined:true (or a
+ *     pairing-join record). Any unknown-key first commit asserting an awake
+ *     role or a lease claim is rejected — a rejoining machine must pull-and-read
+ *     before writing, never assert its stale prior role.
+ *
+ * Pure logic, unit-tested on both sides of every boundary.
+ */
+export function evaluateRegistryEntry(input) {
+    const { incoming, local, currentCommittedEpoch, hasValidJoinRecord } = input;
+    // ── Unknown-key first commit constraint ───────────────────────────
+    if (!local) {
+        if (hasValidJoinRecord) {
+            return { accept: true, reason: 'unknown-key-with-valid-join-record' };
+        }
+        const isStandby = incoming.role === 'standby';
+        const isRejoin = incoming.rejoined === true;
+        if (isStandby && isRejoin) {
+            return { accept: true, reason: 'unknown-key-standby-rejoin' };
+        }
+        return {
+            accept: false,
+            reason: `unknown-key-first-commit must be standby+rejoined (got role=${incoming.role}, rejoined=${incoming.rejoined})`,
+        };
+    }
+    // ── Replay/freshness (per-author monotonic sequence) ──────────────
+    const localSeq = local.syncSequence ?? -1;
+    const incomingSeq = incoming.syncSequence ?? -1;
+    if (incomingSeq <= localSeq) {
+        return {
+            accept: false,
+            reason: `stale-sync-sequence (incoming ${incomingSeq} <= local ${localSeq})`,
+        };
+    }
+    // ── Epoch floor (catches wiped/re-keyed sequence reset) ───────────
+    const authoredUnder = incoming.authoredUnderEpoch ?? 0;
+    if (authoredUnder < currentCommittedEpoch) {
+        return {
+            accept: false,
+            reason: `below-epoch-floor (authoredUnderEpoch ${authoredUnder} < committed ${currentCommittedEpoch})`,
+        };
+    }
+    return { accept: true, reason: 'fresh' };
+}
+/**
+ * Reconcile a full incoming registry against the local one, entry by entry.
+ * Returns the entries to apply (accepted) and the rejected ones with reasons
+ * (logged, never applied). The lease object is reconciled separately by the
+ * FencedLease layer (epoch CAS), not here.
+ */
+export function reconcileRegistryEntries(opts) {
+    const accepted = {};
+    const rejected = [];
+    for (const [machineId, incoming] of Object.entries(opts.incomingEntries)) {
+        const decision = evaluateRegistryEntry({
+            machineId,
+            incoming,
+            local: opts.localEntries[machineId],
+            currentCommittedEpoch: opts.currentCommittedEpoch,
+            hasValidJoinRecord: opts.joinRecords?.has(machineId) ?? false,
+        });
+        if (decision.accept) {
+            accepted[machineId] = incoming;
+        }
+        else {
+            rejected.push({ machineId, reason: decision.reason });
+        }
+    }
+    return { accepted, rejected };
+}
+//# sourceMappingURL=registryReplayGuard.js.map

package/dist/core/registryReplayGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryReplayGuard.js","sourceRoot":"","sources":["../../src/core/registryReplayGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAqBH,MAAM,UAAU,qBAAqB,CAAC,KAAuB;IAC3D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAE7E,qEAAqE;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC5C,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAChE,CAAC;QACD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,+DAA+D,QAAQ,CAAC,IAAI,cAAc,QAAQ,CAAC,QAAQ,GAAG;SACvH,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,iCAAiC,WAAW,aAAa,QAAQ,GAAG;SAC7E,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,MAAM,aAAa,GAAG,QAAQ,CAAC,kBAAkB,IAAI,CAAC,CAAC;IACvD,IAAI,aAAa,GAAG,qBAAqB,EAAE,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,yCAAyC,aAAa,gBAAgB,qBAAqB,GAAG;SACvG,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAKxC;IAIC,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAiD,EAAE,CAAC;IAElE,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACrC,SAAS;YACT,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;YACnC,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,kBAAkB,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK;SAC9D,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,QAAQ,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/core/seamlessnessConfig.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Cross-Machine Seamlessness — config resolution + invariant validation.
+ *
+ * Spec: docs/specs/CROSS-MACHINE-SEAMLESSNESS-SPEC.md §9 (Tunability).
+ *
+ * Resolves the optional `multiMachine` seamlessness knobs to concrete values
+ * with sane 2-machine-personal-use defaults, auto-derives the standby pull
+ * cadence, and enforces the cross-knob invariants. A violating config is
+ * REJECTED with a clear message rather than degrading silently — so a user
+ * widening `ingressHeartbeatMs` (which widens `leaseTtlMs`) cannot quietly
+ * invalidate the RPO bound the spec promises (§3).
+ */
+import type { MultiMachineConfig } from './types.js';
+/**
+ * The mesh protocol version this build speaks. A machine below this version
+ * is ineligible for the awake lease during a seamless handoff (spec §11
+ * partial-migration safety). Bump only on a breaking coordination change.
+ */
+export declare const SEAMLESSNESS_PROTOCOL_VERSION = 1;
+/** Fully-resolved seamlessness knobs (every field concrete). */
+export interface ResolvedSeamlessnessConfig {
+    ingressHeartbeatMs: number;
+    registrySyncDebounceMs: number;
+    standbyPullIntervalMs: number;
+    failoverThresholdMs: number;
+    leaseTtlMs: number;
+    liveTailTransport: 'tunnel' | 'git';
+    liveTailMaxStalenessMs: number;
+    liveTailPushRateMs: number;
+    liveTailOutOfOrderTimeoutMs: number;
+    liveTailMaxBytesPerTopic: number;
+    handoffAckTimeoutMs: number;
+    minHandoffIntervalMs: number;
+    splitBrainEscalationCooldownMs: number;
+    handoffBar: 'near-instant' | 'relaxed';
+    maxProcessingMs: number;
+    protocolVersion: number;
+}
+export declare class SeamlessnessConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * Resolve the failover threshold (ms) from the existing config field.
+ * `failoverTimeoutMinutes` is the canonical knob; default 15 min.
+ * Nullish-coalescing (not ||) so an explicit 0 isn't clobbered — but 0 is
+ * itself invalid and caught by validation.
+ */
+export declare function resolveFailoverThresholdMs(mm?: MultiMachineConfig): number;
+/**
+ * Resolve all seamlessness knobs to concrete values. Auto-derives
+ * `standbyPullIntervalMs` (failoverThresholdMs/4) and the tail/lease-linked
+ * defaults. Does NOT validate — call validateSeamlessnessInvariants() after.
+ */
+export declare function resolveSeamlessnessConfig(mm?: MultiMachineConfig): ResolvedSeamlessnessConfig;
+/**
+ * Validate the cross-knob invariants (spec §9). Returns the list of
+ * violations (empty = valid). Callers that want hard-rejection use
+ * assertSeamlessnessInvariants().
+ *
+ * Invariants:
+ *  1. standbyPullIntervalMs < failoverThresholdMs / 3
+ *     — a standby must pull often enough to notice a dead holder well
+ *       before the failover threshold, or failover races stale data.
+ *  2. standbyPullIntervalMs < leaseTtlMs
+ *     — a standby must refresh its git-committed epoch view at least once
+ *       per lease lifetime, or it decides max(tunnel,git) on a stale git floor.
+ *  3. liveTailPushRateMs ≤ liveTailMaxStalenessMs
+ *     — the holder must push tail flushes at least as often as the RPO bound,
+ *       or the promised RPO is unachievable.
+ *  Plus basic positivity (a 0/negative cadence is never valid).
+ */
+export declare function validateSeamlessnessInvariants(c: ResolvedSeamlessnessConfig): string[];
+/**
+ * Resolve + validate in one step, throwing SeamlessnessConfigError on any
+ * invariant violation. Use at server startup so a bad config is rejected
+ * loudly rather than degrading silently.
+ */
+export declare function assertSeamlessnessInvariants(mm?: MultiMachineConfig): ResolvedSeamlessnessConfig;
+//# sourceMappingURL=seamlessnessConfig.d.ts.map

package/dist/core/seamlessnessConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seamlessnessConfig.d.ts","sourceRoot":"","sources":["../../src/core/seamlessnessConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,QAAQ,GAAG,KAAK,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;IACpC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,8BAA8B,EAAE,MAAM,CAAC;IACvC,UAAU,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,0BAA0B,CA+B7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,0BAA0B,GAAG,MAAM,EAAE,CAqCtF;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,CAAC,EAAE,kBAAkB,GAAG,0BAA0B,CAUhG"}