iterate 0.3.0 → 0.4.0

package/dist/itx-session-sjud8GiT.mjs

@@ -1,534 +0,0 @@
-import { t as apiWebSocketUrl } from "./api-url-B6404M82.mjs";
-import { newWebSocketRpcSession } from "@iterate-com/capnweb";
-//#region src/itx/itx-session.ts
-/**
-* itx-session — the framework-free half of the itx client: ONE WebSocket per
-* process (browser tab, TUI, phone), connected to an OS deployment's `/api`,
-* `authenticate()`d into a **Session** (the catalog that vends project itxs via
-* `session.projects.get(slug)`), and kept alive through transport gaps.
-*
-* React never appears in this module. The hooks in ../sdk/itx/react.ts are a thin
-* binding over the exact surface exported here (`subscribeSession` +
-* `currentSnapshot` feed `useSyncExternalStore`; everything else is shared
-* verbatim), so a non-React consumer — a node script, a future runtime —
-* gets the same one-socket semantics by importing `iterate/client`.
-*
-* WHERE THE CONNECTION TARGET COMES FROM
-*   • In a browser, nothing to configure: the keeper connects
-*     `window.location`'s `/api` and authenticates with the session cookie
-*     riding the WebSocket handshake.
-*   • Anywhere else (the chat TUI, tests, scripts that want the KEEPER rather
-*     than the one-shot node dial), call {@link configureIterateSession} with a
-*     base URL and credentials. Calling it again for the same deployment
-*     refreshes the credential source without disturbing the socket; changing
-*     deployments deliberately replaces the socket. The runtime's global
-*     WebSocket carries the dial — node ≥ 22, bun, and React Native all satisfy
-*     capnweb's WebSocket needs.
-*
-* ───────────────────────────────────────────────────────────────────────────
-* THE SESSION MODEL — one socket, generations, invisible reconnect
-* ───────────────────────────────────────────────────────────────────────────
-*
-*  • ONE WebSocket for the whole process, kept in module state (so in a
-*    browser it persists across client-side navigation). One connection attempt is a
-*    GENERATION ({@link Generation}): its WebSocket and its connecting
-*    promise. The session is the AWAITED `authenticate()` result — one settled
-*    stub identity shared by the snapshot, imperative awaiters, and the
-*    project-stub cache (resolving with the raw pipelined RpcPromise would
-*    fork identities: native promises assimilate thenables). The connection timeout
-*    spans the whole handshake (TCP/TLS/upgrade AND authenticate), and a REAL
-*    auth rejection over a working socket is terminal — it surfaces from the
-*    connecting promise instead of looping.
-*
-*  • RECONNECT IS INVISIBLE. Readers see an immutable {@link Snapshot};
-*    `snapshot.session` holds the LAST live session and is kept across a
-*    transport gap. Before the FIRST session, awaiters share the STABLE
-*    {@link firstConnect} promise, which survives failed connection attempts (paced
-*    reconnects happen behind it; an individual attempt's rejection never reaches a suspended
-*    React tree) and rejects only on a TERMINAL failure. Kept-across-the-gap
-*    applies to TRANSPORT gaps only: a terminal auth rejection on a reconnect is
-*    an AUTHORITY loss — the halted snapshot drops the (already dead) session
-*    so the real error surfaces instead of zombie stubs.
-*
-*  • PROJECT STUBS ARE SESSION-OWNED. `session.projects.get` allocates a
-*    capnweb import-table entry, so deriving stubs ad hoc (or inside React
-*    renders that may be discarded) would leak them. The module
-*    {@link projectStubCaches} WeakMap keyed by the session stub caches one
-*    real stub per (session, slug); a retired generation disposes them. The
-*    stub stays the REAL capnweb stub (a lazy wrapper that awaited the session
-*    per call would break pipelining — capnweb fork v0.8.0), and its identity
-*    changes exactly once per successful reconnect.
-*
-*  • TRANSPORT HEALTH IS SOCKET-OWNED and GENERATION-GUARDED. A half-open
-*    socket (laptop sleep, network switch — no `close` event) is detected by
-*    one verifier per generation ({@link verifyTransport}: periodic +
-*    visibility/online probes, two-strike). Consumers REPORT suspicion
-*    ({@link reportTransportSuspicion}); they never close the shared socket
-*    themselves. Only two failed probes against the SAME generation retire it,
-*    and {@link reconnectIfCurrent} is a compare-and-swap on generation OBJECT
-*    IDENTITY — a late verdict against a superseded generation can never close
-*    its healthy successor. {@link reconnectIterateSession} is the separate,
-*    deliberate *semantic* reset (new claims after create/unlock).
-*/
-let explicitConfig;
-/**
-* Point the keeper at a deployment explicitly — the non-browser entry into the
-* one-socket model (the chat TUI, React Native, keeper-based scripts). Repeating
-* the same target updates its credential source without disturbing the live
-* socket. A different target retires the old deployment immediately and connects
-* the new one, so authority can never cross deployments. In a browser this is
-* optional (the default is `window.location`'s `/api` with cookie auth).
-*/
-function configureIterateSession(config) {
-	const targetChanged = explicitConfig !== void 0 && apiWebSocketUrl(explicitConfig.baseUrl).href !== apiWebSocketUrl(config.baseUrl).href;
-	explicitConfig = config;
-	if (!targetChanged || current === void 0) return;
-	const generation = current;
-	current = void 0;
-	retireGeneration(generation);
-	const retiredSession = snapshot?.session;
-	snapshot = void 0;
-	if (retiredSession !== void 0) disposeSession(retiredSession);
-	consecutiveConnectionFailures = 0;
-	if (firstConnect === void 0) {
-		firstConnect = Promise.withResolvers();
-		firstConnect.promise.catch(() => {});
-	}
-	startConnectionAttempt();
-}
-function resolveConnectionTarget() {
-	return {
-		url: apiWebSocketUrl(explicitConfig?.baseUrl ?? (typeof window === "undefined" ? missingConnectionTarget() : window.location.href)),
-		credentials: explicitConfig?.credentials || { type: "from-server-cookie" }
-	};
-}
-function missingConnectionTarget() {
-	throw new Error("itx has no connection target: in a browser the session connects to the page's /api (never during SSR — render itx consumers under an `ssr: false` route or <ClientOnly>); anywhere else call configureIterateSession({ baseUrl, credentials }) before connecting.");
-}
-const CONNECTION_TIMEOUT_MS = 15e3;
-const RECONNECT_BACKOFF_MIN_MS = 250;
-const RECONNECT_BACKOFF_MAX_MS = 1e4;
-/**
-* How often a live transport (the socket verifier) and a mounted subscription
-* (the watchdog) prove they are not silently dead. ONE shared cadence: the two
-* checks deliberately use the same value, so a change here moves both.
-*/
-const LIVENESS_INTERVAL_MS = 45e3;
-/** A probe slower than this counts as a strike (two strikes ⇒ half-open). */
-const LIVENESS_TIMEOUT_MS = 1e4;
-let current;
-let snapshot;
-let generationCounter = 0;
-/** Consecutive connects that died before establishing a session — the backoff input. */
-let consecutiveConnectionFailures = 0;
-/**
-* The promise first-load callers share until the FIRST session exists. One
-* stable promise across connection attempt retries: a connection attempt that closes before opening rejects
-* its own `connecting` promise (imperative awaiters fail fast) but must NOT
-* reject a suspended React tree — React replays a suspended (never-committed)
-* component against the thenable it first used, so a rejected first promise
-* would surface in the error boundary even though a paced reconnect is already
-* underway. It rejects only on a TERMINAL failure (authenticate answered with
-* a real application error over a working socket).
-*/
-let firstConnect;
-const listeners = /* @__PURE__ */ new Set();
-const subscribeSession = (onChange) => {
-	listeners.add(onChange);
-	return () => void listeners.delete(onChange);
-};
-/**
-* One real project stub per (session, slug), cached in module state so a
-* caller's lifecycle (React renders that may be discarded, repeated
-* imperative calls) can't leak undisposed capnweb import entries (see module
-* header). Keyed by the session stub identity, so it is implicitly scoped to a
-* generation and torn down with it. `slug` may be a slug or a `prj_…` id —
-* `session.projects.get` accepts either.
-*/
-const projectStubCaches = /* @__PURE__ */ new WeakMap();
-function projectStubFor(session, slug) {
-	let cache = projectStubCaches.get(session);
-	if (cache === void 0) {
-		cache = /* @__PURE__ */ new Map();
-		projectStubCaches.set(session, cache);
-	}
-	let stub = cache.get(slug);
-	if (stub === void 0) {
-		stub = session.projects.get(slug);
-		cache.set(slug, stub);
-	}
-	return stub;
-}
-/** getSnapshot for useSyncExternalStore: stable between transitions; connects when idle. */
-function currentSnapshot() {
-	if (current === void 0) startConnectionAttempt();
-	return snapshot;
-}
-const serverSnapshot = () => missingConnectionTarget();
-/**
-* Ensure a live-or-connecting session and return its connecting promise. The
-* imperative sibling of the React `useIterateSession()`: for handlers,
-* `mutationFn`s, scripts, and lazy closures. Same one socket the hooks use.
-* After a TERMINAL auth rejection this keeps returning that failure (the
-* halted generation — see Generation.failed) until {@link reconnectIterateSession}.
-*/
-function connectIterateSession() {
-	return (current ?? startConnectionAttempt()).connecting;
-}
-/**
-* The project itx for a slug (or `prj_…` id), imperatively. Pipelines through
-* the returned promise — `(await connectItx(slug)).streams.get(path)`. Returns
-* the session-owned cached stub, re-derived automatically after a reconnect.
-*/
-function connectItx(slug) {
-	return connectIterateSession().then((session) => projectStubFor(session, slug));
-}
-function startConnectionAttempt() {
-	const target = resolveConnectionTarget();
-	const id = ++generationCounter;
-	const { promise, resolve, reject } = Promise.withResolvers();
-	promise.catch(() => {});
-	const generation = {
-		ws: void 0,
-		rpcRoot: void 0,
-		connecting: promise,
-		rejectConnecting: reject,
-		ping: void 0,
-		liveness: void 0,
-		verifying: false,
-		failed: false
-	};
-	current = generation;
-	const priorSession = snapshot?.session;
-	if (priorSession === void 0 && firstConnect === void 0) {
-		firstConnect = Promise.withResolvers();
-		firstConnect.promise.catch(() => {});
-	}
-	setSnapshot({
-		generation: id,
-		session: priorSession,
-		connecting: firstConnect?.promise ?? promise
-	});
-	/** Authentication established a session: publish it and retire the predecessor. */
-	const publish = (root, ping) => {
-		consecutiveConnectionFailures = 0;
-		generation.ping = ping;
-		generation.liveness = setInterval(() => {
-			if (current === generation) verifyTransport(generation);
-		}, LIVENESS_INTERVAL_MS);
-		const retiring = snapshot?.session;
-		setSnapshot({
-			generation: id,
-			session: root,
-			connecting: promise
-		});
-		resolve(root);
-		firstConnect?.resolve(root);
-		firstConnect = void 0;
-		if (retiring !== void 0) disposeSession(retiring);
-	};
-	const beginWebSocketConnection = () => {
-		if (current !== generation) {
-			reject(/* @__PURE__ */ new Error("itx WebSocket closed before connecting"));
-			return;
-		}
-		const ws = new WebSocket(target.url.href);
-		generation.ws = ws;
-		let established = false;
-		const timeout = setTimeout(() => {
-			if (current !== generation || established) return;
-			current = void 0;
-			consecutiveConnectionFailures += 1;
-			reject(/* @__PURE__ */ new Error("itx WebSocket closed before connecting"));
-			retireGeneration(generation);
-			startConnectionAttempt();
-		}, CONNECTION_TIMEOUT_MS);
-		ws.addEventListener("open", () => {
-			if (current !== generation) {
-				clearTimeout(timeout);
-				ws.close();
-				return;
-			}
-			const unauthenticated = newWebSocketRpcSession(ws);
-			generation.rpcRoot = unauthenticated;
-			(async () => {
-				let root;
-				try {
-					const credentialProvider = target.credentials;
-					if (typeof credentialProvider === "function") {
-						const authenticate = async (forceRefresh) => await unauthenticated.authenticate(await credentialProvider({ forceRefresh }));
-						try {
-							root = await authenticate(false);
-						} catch (error) {
-							if (!(error instanceof Error) || !/auth|token|unauthorized|401/i.test(error.message)) throw error;
-							root = await authenticate(true);
-						}
-					} else root = await unauthenticated.authenticate(credentialProvider);
-				} catch (error) {
-					clearTimeout(timeout);
-					if (current !== generation) return;
-					if (isItxTransportError(error)) {
-						ws.close();
-						return;
-					}
-					const terminal = error instanceof Error ? error : new Error(String(error));
-					generation.failed = true;
-					reject(terminal);
-					firstConnect?.reject(terminal);
-					firstConnect = void 0;
-					const zombieSession = snapshot?.session;
-					setSnapshot({
-						generation: id,
-						session: void 0,
-						connecting: promise
-					});
-					if (zombieSession !== void 0) disposeSession(zombieSession);
-					retireGeneration(generation);
-					return;
-				}
-				clearTimeout(timeout);
-				if (current !== generation) {
-					root[Symbol.dispose]?.();
-					ws.close();
-					return;
-				}
-				established = true;
-				publish(root, async () => {
-					await root.__describe();
-				});
-			})();
-		});
-		ws.addEventListener("close", () => {
-			clearTimeout(timeout);
-			const wasCurrent = current === generation && !generation.failed;
-			disposeGeneration(generation);
-			if (wasCurrent) {
-				if (!established) consecutiveConnectionFailures += 1;
-				current = void 0;
-				startConnectionAttempt();
-			}
-			reject(/* @__PURE__ */ new Error("itx WebSocket closed before connecting"));
-		});
-	};
-	const delay = consecutiveConnectionFailures <= 1 ? 0 : Math.min(RECONNECT_BACKOFF_MAX_MS, RECONNECT_BACKOFF_MIN_MS * 2 ** Math.min(consecutiveConnectionFailures - 2, 6));
-	if (delay === 0) beginWebSocketConnection();
-	else setTimeout(beginWebSocketConnection, delay);
-	return generation;
-}
-function setSnapshot(next) {
-	snapshot = next;
-	for (const listener of listeners) listener();
-}
-/**
-* Release a generation's TRANSPORT resources — its liveness timer. Naturally
-* idempotent, and it does NOT close the socket or dispose the session stub: the
-* session is retired separately, by its successor's publish (see the open
-* handler), so invisible reconnect never hands out a disposed stub. Safe to
-* call from the `close` handler without re-entering it.
-*/
-function disposeGeneration(generation) {
-	if (generation.liveness !== void 0) clearInterval(generation.liveness);
-	generation.liveness = void 0;
-}
-/** Dispose a retired session's project-stub cache and the session stub itself. */
-function disposeSession(session) {
-	const cache = projectStubCaches.get(session);
-	if (cache) for (const stub of cache.values()) stub[Symbol.dispose]?.();
-	session[Symbol.dispose]?.();
-}
-/**
-* FORCED retirement (a reconnect, not an observed close): release resources,
-* abort capnweb through its bootstrap stub, then ask the socket to close.
-* Disposing the bootstrap synchronously rejects every pending and future call;
-* relying on WebSocket.close() alone is insufficient because a half-open socket
-* may never finish its close handshake or fire `close`. Callers set
-* `current = undefined` FIRST, so any close event won't auto-reconnect (reconnecting
-* is the caller's job).
-*/
-function retireGeneration(generation) {
-	disposeGeneration(generation);
-	generation.rejectConnecting(/* @__PURE__ */ new Error("itx WebSocket closed before connecting"));
-	generation.rpcRoot?.[Symbol.dispose]?.();
-	generation.rpcRoot = void 0;
-	generation.ws?.close();
-}
-/**
-* Report that the shared transport may be half-open (a call hung). Consumers —
-* the subscription watchdog, any long-lived reader — call this instead of
-* closing the socket themselves — {@link verifyTransport} probes and, only on
-* two strikes against the SAME generation, retires it. A stale report is a
-* no-op.
-*/
-function reportTransportSuspicion() {
-	const generation = current;
-	if (generation?.ping === void 0) return;
-	verifyTransport(generation);
-}
-async function verifyTransport(generation) {
-	if (generation.verifying || current !== generation || generation.ping === void 0) return;
-	generation.verifying = true;
-	try {
-		const probeOnce = () => Promise.race([generation.ping().then(() => "alive", (error) => isItxTransportError(error) ? "strike" : "alive"), new Promise((resolve) => setTimeout(() => resolve("strike"), LIVENESS_TIMEOUT_MS))]);
-		let verdict = await probeOnce();
-		if (verdict === "strike" && current === generation) verdict = await probeOnce();
-		if (verdict === "strike") reconnectIfCurrent(generation);
-	} finally {
-		generation.verifying = false;
-	}
-}
-/**
-* Retire + reconnect the transport, but ONLY if `generation` still owns the slot —
-* the compare-and-swap that stops a late verdict (a probe that timed out on a
-* corpse) from closing the healthy successor another path already connected.
-*/
-function reconnectIfCurrent(generation) {
-	if (current !== generation) return;
-	current = void 0;
-	retireGeneration(generation);
-	startConnectionAttempt();
-}
-/**
-* The SEMANTIC reset (not a transport reconnect): drop the live socket and connection attempt
-* a fresh one so the next reads run under the caller's CURRENT claims. Call
-* after creating a project or unlocking admin — the live socket carries the
-* connect-time principal. React callers that need already-cached data refreshed
-* should also `invalidateQueries({ queryKey: ["itx"] })`.
-*/
-function reconnectIterateSession() {
-	const generation = current;
-	if (generation !== void 0) {
-		current = void 0;
-		retireGeneration(generation);
-	}
-	consecutiveConnectionFailures = 0;
-	startConnectionAttempt();
-}
-/**
-* Revive only a generation parked by a terminal authentication failure. This
-* is the imperative retry boundary for query/mutation clients: calling it
-* before a repeated operation lets refreshed credentials dial again without
-* disturbing a healthy or merely reconnecting session.
-*/
-function retryFailedIterateSession() {
-	if (current?.failed) reconnectIterateSession();
-}
-/**
-* Release the current transport and authority without reconnecting. Intended
-* for process-local lifecycle boundaries such as signing out of a native app;
-* mounted consumers should be removed in the same transition. The explicit
-* deployment configuration remains, so a later connect can dial it again.
-*/
-function disconnectIterateSession() {
-	const generation = current;
-	current = void 0;
-	if (generation !== void 0) retireGeneration(generation);
-	const retiredSession = snapshot?.session;
-	snapshot = void 0;
-	if (retiredSession !== void 0) disposeSession(retiredSession);
-	firstConnect?.reject(/* @__PURE__ */ new Error("itx session disconnected"));
-	firstConnect = void 0;
-	consecutiveConnectionFailures = 0;
-}
-/**
-* The four — and only four — transport-close rejections a caller may treat as
-* "the socket died, retry on a fresh one": our own connection-closed rejection, capnweb's
-* two WebSocket aborts (`Peer closed WebSocket: <code> <reason>` and
-* `WebSocket connection failed.`), and capnweb's exact local-shutdown error
-* from our forced bootstrap disposal. Deliberately NARROW: an
-* application/auth/validation error that merely mentions "WebSocket" must never
-* be mistaken for a transport failure and retried. This is the one discriminant
-* shared by the query retry, the subscribe retry, and the liveness verifier.
-*/
-function isItxTransportError(error) {
-	const message = error instanceof Error ? error.message : String(error);
-	return message.includes("itx WebSocket closed before connecting") || message.includes("Peer closed WebSocket") || message.includes("WebSocket connection failed") || message.includes("RPC session was shut down by disposing the main stub");
-}
-if (typeof document !== "undefined") {
-	document.addEventListener("visibilitychange", () => {
-		if (document.visibilityState === "visible") reportTransportSuspicion();
-	});
-	window.addEventListener("online", () => reportTransportSuspicion());
-}
-const PING_TIMED_OUT = Symbol("itx-ping-timed-out");
-/**
-* Release a push connection completely: `close()` closes the server side
-* (already-dead is fine — the rejection is swallowed), then
-* `[Symbol.dispose]` frees the caller-owned stub. One helper because
-* forgetting either half leaks (see {@link ItxRecoverableConnectionHandle}).
-*/
-function releaseItxConnection(handle) {
-	Promise.resolve().then(() => handle.close()).catch(() => {}).finally(() => handle[Symbol.dispose]?.());
-}
-/**
-* Poll a push connection's `ping()` until it stops answering `true`, then
-* recover. Server pushes fail SILENTLY: a dead Durable Object or half-open TCP
-* stops delivering with no client-visible signal, so a consumer can show
-* "live" forever while stale. The watchdog checks on an interval and — because
-* those are exactly when sockets die — when a browser tab becomes visible or
-* comes online (in runtimes without those signals, the interval carries it).
-*
-*   `dead`      → ping answered `false` or REJECTED: the socket works but the
-*                 server-side connection is gone (DO restart / dropped
-*                 callback). Recovery opens it again on the same socket.
-*   `timed-out` → ping never answered: the shared WebSocket is half-open. The
-*                 watchdog REPORTS the suspicion to the socket-owned verifier
-*                 ({@link reportTransportSuspicion}) — it never closes the socket
-*                 itself — and the holder opens again once the generation
-*                 reconnects.
-*/
-function watchItxConnection(ping, onDead) {
-	let stopped = false;
-	let checking = false;
-	const report = (reason) => {
-		if (stopped) return;
-		stop();
-		if (reason === "timed-out") reportTransportSuspicion();
-		onDead();
-	};
-	const pingOnce = () => {
-		const timeout = new Promise((resolve) => setTimeout(() => resolve(PING_TIMED_OUT), LIVENESS_TIMEOUT_MS));
-		return Promise.race([Promise.resolve(ping()), timeout]);
-	};
-	const check = async () => {
-		if (stopped || checking) return;
-		checking = true;
-		try {
-			let alive;
-			try {
-				alive = await pingOnce();
-				if (alive === PING_TIMED_OUT && !stopped) alive = await pingOnce();
-			} catch {
-				report("dead");
-				return;
-			}
-			if (alive === PING_TIMED_OUT) report("timed-out");
-			else if (alive !== true) report("dead");
-		} finally {
-			checking = false;
-		}
-	};
-	const inBrowser = typeof document !== "undefined";
-	const onVisible = () => {
-		if (document.visibilityState === "visible") check();
-	};
-	const onOnline = () => void check();
-	const interval = setInterval(() => void check(), LIVENESS_INTERVAL_MS);
-	if (inBrowser) {
-		document.addEventListener("visibilitychange", onVisible);
-		window.addEventListener("online", onOnline);
-	}
-	const stop = () => {
-		if (stopped) return;
-		stopped = true;
-		clearInterval(interval);
-		if (inBrowser) {
-			document.removeEventListener("visibilitychange", onVisible);
-			window.removeEventListener("online", onOnline);
-		}
-	};
-	return stop;
-}
-//#endregion
-export { disconnectIterateSession as a, reconnectIterateSession as c, retryFailedIterateSession as d, serverSnapshot as f, currentSnapshot as i, releaseItxConnection as l, watchItxConnection as m, connectIterateSession as n, isItxTransportError as o, subscribeSession as p, connectItx as r, projectStubFor as s, configureIterateSession as t, reportTransportSuspicion as u };
-
-//# sourceMappingURL=itx-session-sjud8GiT.mjs.map

package/dist/itx-session-sjud8GiT.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"itx-session-sjud8GiT.mjs","names":[],"sources":["../src/itx/itx-session.ts"],"sourcesContent":["/**\n * itx-session — the framework-free half of the itx client: ONE WebSocket per\n * process (browser tab, TUI, phone), connected to an OS deployment's `/api`,\n * `authenticate()`d into a **Session** (the catalog that vends project itxs via\n * `session.projects.get(slug)`), and kept alive through transport gaps.\n *\n * React never appears in this module. The hooks in ../sdk/itx/react.ts are a thin\n * binding over the exact surface exported here (`subscribeSession` +\n * `currentSnapshot` feed `useSyncExternalStore`; everything else is shared\n * verbatim), so a non-React consumer — a node script, a future runtime —\n * gets the same one-socket semantics by importing `iterate/client`.\n *\n * WHERE THE CONNECTION TARGET COMES FROM\n *   • In a browser, nothing to configure: the keeper connects\n *     `window.location`'s `/api` and authenticates with the session cookie\n *     riding the WebSocket handshake.\n *   • Anywhere else (the chat TUI, tests, scripts that want the KEEPER rather\n *     than the one-shot node dial), call {@link configureIterateSession} with a\n *     base URL and credentials. Calling it again for the same deployment\n *     refreshes the credential source without disturbing the socket; changing\n *     deployments deliberately replaces the socket. The runtime's global\n *     WebSocket carries the dial — node ≥ 22, bun, and React Native all satisfy\n *     capnweb's WebSocket needs.\n *\n * ───────────────────────────────────────────────────────────────────────────\n * THE SESSION MODEL — one socket, generations, invisible reconnect\n * ───────────────────────────────────────────────────────────────────────────\n *\n *  • ONE WebSocket for the whole process, kept in module state (so in a\n *    browser it persists across client-side navigation). One connection attempt is a\n *    GENERATION ({@link Generation}): its WebSocket and its connecting\n *    promise. The session is the AWAITED `authenticate()` result — one settled\n *    stub identity shared by the snapshot, imperative awaiters, and the\n *    project-stub cache (resolving with the raw pipelined RpcPromise would\n *    fork identities: native promises assimilate thenables). The connection timeout\n *    spans the whole handshake (TCP/TLS/upgrade AND authenticate), and a REAL\n *    auth rejection over a working socket is terminal — it surfaces from the\n *    connecting promise instead of looping.\n *\n *  • RECONNECT IS INVISIBLE. Readers see an immutable {@link Snapshot};\n *    `snapshot.session` holds the LAST live session and is kept across a\n *    transport gap. Before the FIRST session, awaiters share the STABLE\n *    {@link firstConnect} promise, which survives failed connection attempts (paced\n *    reconnects happen behind it; an individual attempt's rejection never reaches a suspended\n *    React tree) and rejects only on a TERMINAL failure. Kept-across-the-gap\n *    applies to TRANSPORT gaps only: a terminal auth rejection on a reconnect is\n *    an AUTHORITY loss — the halted snapshot drops the (already dead) session\n *    so the real error surfaces instead of zombie stubs.\n *\n *  • PROJECT STUBS ARE SESSION-OWNED. `session.projects.get` allocates a\n *    capnweb import-table entry, so deriving stubs ad hoc (or inside React\n *    renders that may be discarded) would leak them. The module\n *    {@link projectStubCaches} WeakMap keyed by the session stub caches one\n *    real stub per (session, slug); a retired generation disposes them. The\n *    stub stays the REAL capnweb stub (a lazy wrapper that awaited the session\n *    per call would break pipelining — capnweb fork v0.8.0), and its identity\n *    changes exactly once per successful reconnect.\n *\n *  • TRANSPORT HEALTH IS SOCKET-OWNED and GENERATION-GUARDED. A half-open\n *    socket (laptop sleep, network switch — no `close` event) is detected by\n *    one verifier per generation ({@link verifyTransport}: periodic +\n *    visibility/online probes, two-strike). Consumers REPORT suspicion\n *    ({@link reportTransportSuspicion}); they never close the shared socket\n *    themselves. Only two failed probes against the SAME generation retire it,\n *    and {@link reconnectIfCurrent} is a compare-and-swap on generation OBJECT\n *    IDENTITY — a late verdict against a superseded generation can never close\n *    its healthy successor. {@link reconnectIterateSession} is the separate,\n *    deliberate *semantic* reset (new claims after create/unlock).\n */\nimport { newWebSocketRpcSession, type RpcStub } from \"@iterate-com/capnweb\";\nimport type {\n  ItxAuthCredentials,\n  Project,\n  Session,\n  UnauthenticatedOs,\n} from \"../itx-api.generated.ts\";\nimport { apiWebSocketUrl } from \"./api-url.ts\";\n\n// A handle is a capnweb `RpcStub` — a chainable proxy over the contract\n// interface. `authenticate()` / `projects.get()` return an `RpcPromise` (a stub\n// that is *also* awaitable); an RpcPromise is assignable to the plain RpcStub,\n// so the pipelined calls narrow to these without a cast. `RpcStub<Session>` (not\n// the awaitable RpcPromise) keeps `Promise<SessionStub>` from nesting.\n\n/** The Session catalog (what `authenticate()` returns): vends project itxs. */\nexport type SessionStub = RpcStub<Session>;\n/** A project capability handle — `session.projects.get(slug)`. */\nexport type ProjectStub = RpcStub<Project>;\nexport type { ProjectStub as Itx };\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The connection target: browser defaults, or an explicit configuration.\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type IterateSessionConfig = {\n  /** OS deployment base URL, e.g. `https://os.iterate.com`; `/api` is appended. */\n  baseUrl: string;\n  /**\n   * How `authenticate()` identifies the caller. A provider is resolved for\n   * every dial, so rotating credentials stay fresh across transport reconnects.\n   * If authentication rejects with an auth-shaped error, providers get one\n   * forced-refresh attempt before the failure becomes terminal. Default: the\n   * browser session cookie.\n   */\n  credentials?:\n    | ItxAuthCredentials\n    | ((options: { forceRefresh: boolean }) => ItxAuthCredentials | Promise<ItxAuthCredentials>);\n};\n\nlet explicitConfig: IterateSessionConfig | undefined;\n\n/**\n * Point the keeper at a deployment explicitly — the non-browser entry into the\n * one-socket model (the chat TUI, React Native, keeper-based scripts). Repeating\n * the same target updates its credential source without disturbing the live\n * socket. A different target retires the old deployment immediately and connects\n * the new one, so authority can never cross deployments. In a browser this is\n * optional (the default is `window.location`'s `/api` with cookie auth).\n */\nexport function configureIterateSession(config: IterateSessionConfig): void {\n  const targetChanged =\n    explicitConfig !== undefined &&\n    apiWebSocketUrl(explicitConfig.baseUrl).href !== apiWebSocketUrl(config.baseUrl).href;\n  explicitConfig = config;\n  if (!targetChanged || current === undefined) return;\n\n  const generation = current;\n  current = undefined;\n  retireGeneration(generation);\n  const retiredSession = snapshot?.session;\n  snapshot = undefined;\n  if (retiredSession !== undefined) disposeSession(retiredSession);\n  consecutiveConnectionFailures = 0;\n  // Connect now so mounted hooks see one coherent target transition rather than\n  // retaining the previous deployment until their next read.\n  if (firstConnect === undefined) {\n    firstConnect = Promise.withResolvers<SessionStub>();\n    void firstConnect.promise.catch(() => {});\n  }\n  startConnectionAttempt();\n}\n\nfunction resolveConnectionTarget(): {\n  url: URL;\n  credentials: NonNullable<IterateSessionConfig[\"credentials\"]>;\n} {\n  const base =\n    explicitConfig?.baseUrl ??\n    (typeof window === \"undefined\" ? missingConnectionTarget() : window.location.href);\n  return {\n    url: apiWebSocketUrl(base),\n    credentials: explicitConfig?.credentials || { type: \"from-server-cookie\" },\n  };\n}\n\nfunction missingConnectionTarget(): never {\n  throw new Error(\n    \"itx has no connection target: in a browser the session connects to the page's /api \" +\n      \"(never during SSR — render itx consumers under an `ssr: false` route or <ClientOnly>); \" +\n      \"anywhere else call configureIterateSession({ baseUrl, credentials }) before connecting.\",\n  );\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The one socket: a single live WebSocket per process, in module state.\n// ─────────────────────────────────────────────────────────────────────────────\n\nconst CONNECTION_TIMEOUT_MS = 15_000;\n// Pace reconnects after a WebSocket closes before authentication. Without it, a\n// fast-REFUSING endpoint (offline after mobile resume, dev-server restart)\n// loops connect → instant close → reconnect with zero delay, unbounded. The wait\n// lives inside the connecting promise, so `use()` semantics are unchanged.\nconst RECONNECT_BACKOFF_MIN_MS = 250;\nconst RECONNECT_BACKOFF_MAX_MS = 10_000;\n/**\n * How often a live transport (the socket verifier) and a mounted subscription\n * (the watchdog) prove they are not silently dead. ONE shared cadence: the two\n * checks deliberately use the same value, so a change here moves both.\n */\nconst LIVENESS_INTERVAL_MS = 45_000;\n/** A probe slower than this counts as a strike (two strikes ⇒ half-open). */\nconst LIVENESS_TIMEOUT_MS = 10_000;\n\n/**\n * One connection attempt = one WebSocket lifetime. OBJECT IDENTITY is the\n * compare-and-swap token that makes every reconnect verdict identity-safe\n * (`current === generation` — only the CURRENT generation may be retired or\n * published). `connecting` settles with the session once `authenticate()`\n * returns over the open socket; `ping` doubles as the \"session established\"\n * marker.\n */\ntype Generation = {\n  ws: WebSocket | undefined;\n  /**\n   * The capnweb bootstrap stub owns the whole RPC session. Disposing it aborts\n   * every pending import immediately, which is stronger than WebSocket.close()\n   * on a half-open socket (that close handshake may never produce an event).\n   */\n  rpcRoot: RpcStub<UnauthenticatedOs> | undefined;\n  connecting: Promise<SessionStub>;\n  /** Settles an imperative waiter if forced retirement happens before publish. */\n  rejectConnecting: (reason?: unknown) => void;\n  /** One cheap authenticated round trip proving the transport is alive. */\n  ping: (() => Promise<void>) | undefined;\n  liveness: ReturnType<typeof setInterval> | undefined;\n  /** Single-flight latch for {@link verifyTransport}, per generation. */\n  verifying: boolean;\n  /**\n   * HALTED after a terminal auth rejection: the generation keeps owning the\n   * slot (so a render can never trigger another connection attempt — every re-render of an\n   * always-mounted hook reads {@link currentSnapshot}, which connects when the\n   * slot is empty, and the failure's own setState re-renders: an unbounded\n   * socket storm otherwise) and its close handler must not reconnect. Only an\n   * explicit {@link reconnectIterateSession} (or a page load) revives.\n   */\n  failed: boolean;\n};\n\n/**\n * The immutable value readers see (React reads it via `useSyncExternalStore` +\n * `use()`). Replaced wholesale on every transition, always BEFORE listeners are\n * notified, so a concurrent render can never tear. `session` is the last live\n * session and survives transport gaps — that is what makes reconnect\n * invisible. `generation` is a monotonic number whose only job is being the\n * reconnect dep for the React layer's reconnect-aware effect (the CAS is\n * generation object identity, not this number). `connecting` is what\n * first-load callers await/suspend on: before the FIRST session it is the\n * stable {@link firstConnect} promise (survives closed-before-open retries\n * without rejecting a suspended tree); afterwards `session` is always defined.\n */\ntype Snapshot = {\n  generation: number;\n  session: SessionStub | undefined;\n  connecting: Promise<SessionStub>;\n};\n\nlet current: Generation | undefined;\nlet snapshot: Snapshot | undefined;\nlet generationCounter = 0;\n/** Consecutive connects that died before establishing a session — the backoff input. */\nlet consecutiveConnectionFailures = 0;\n/**\n * The promise first-load callers share until the FIRST session exists. One\n * stable promise across connection attempt retries: a connection attempt that closes before opening rejects\n * its own `connecting` promise (imperative awaiters fail fast) but must NOT\n * reject a suspended React tree — React replays a suspended (never-committed)\n * component against the thenable it first used, so a rejected first promise\n * would surface in the error boundary even though a paced reconnect is already\n * underway. It rejects only on a TERMINAL failure (authenticate answered with\n * a real application error over a working socket).\n */\nlet firstConnect: PromiseWithResolvers<SessionStub> | undefined;\n\nconst listeners = new Set<() => void>();\nexport const subscribeSession = (onChange: () => void) => {\n  listeners.add(onChange);\n  return () => void listeners.delete(onChange);\n};\n\n/**\n * One real project stub per (session, slug), cached in module state so a\n * caller's lifecycle (React renders that may be discarded, repeated\n * imperative calls) can't leak undisposed capnweb import entries (see module\n * header). Keyed by the session stub identity, so it is implicitly scoped to a\n * generation and torn down with it. `slug` may be a slug or a `prj_…` id —\n * `session.projects.get` accepts either.\n */\nconst projectStubCaches = new WeakMap<SessionStub, Map<string, ProjectStub>>();\n\nexport function projectStubFor(session: SessionStub, slug: string): ProjectStub {\n  let cache = projectStubCaches.get(session);\n  if (cache === undefined) {\n    cache = new Map();\n    projectStubCaches.set(session, cache);\n  }\n  let stub = cache.get(slug);\n  if (stub === undefined) {\n    stub = session.projects.get(slug);\n    cache.set(slug, stub);\n  }\n  return stub;\n}\n\n/** getSnapshot for useSyncExternalStore: stable between transitions; connects when idle. */\nexport function currentSnapshot(): Snapshot {\n  // `startConnectionAttempt()` sets `current` synchronously, so this fires at most once per idle\n  // window (first load, or after a retry exhausted its own reconnect) — never a\n  // per-render loop.\n  if (current === undefined) startConnectionAttempt();\n  return snapshot!;\n}\n\nexport const serverSnapshot = (): never => missingConnectionTarget();\n\n/**\n * Ensure a live-or-connecting session and return its connecting promise. The\n * imperative sibling of the React `useIterateSession()`: for handlers,\n * `mutationFn`s, scripts, and lazy closures. Same one socket the hooks use.\n * After a TERMINAL auth rejection this keeps returning that failure (the\n * halted generation — see Generation.failed) until {@link reconnectIterateSession}.\n */\nexport function connectIterateSession(): Promise<SessionStub> {\n  // No runtime guard here: `startConnectionAttempt()` resolves its target first thing, so an\n  // unconfigured non-browser call throws the no-target error synchronously.\n  return (current ?? startConnectionAttempt()).connecting;\n}\n\n/**\n * The project itx for a slug (or `prj_…` id), imperatively. Pipelines through\n * the returned promise — `(await connectItx(slug)).streams.get(path)`. Returns\n * the session-owned cached stub, re-derived automatically after a reconnect.\n */\nexport function connectItx(slug: string): Promise<ProjectStub> {\n  return connectIterateSession().then((session) => projectStubFor(session, slug));\n}\n\nfunction startConnectionAttempt(): Generation {\n  const target = resolveConnectionTarget();\n\n  const id = ++generationCounter;\n  const { promise, resolve, reject } = Promise.withResolvers<SessionStub>();\n  // Keep an internal handler so a connection attempt that rejects with no live awaiter never\n  // surfaces as an unhandledrejection — real `connectIterateSession()` awaiters still observe it.\n  void promise.catch(() => {});\n  const generation: Generation = {\n    ws: undefined,\n    rpcRoot: undefined,\n    connecting: promise,\n    rejectConnecting: reject,\n    ping: undefined,\n    liveness: undefined,\n    verifying: false,\n    failed: false,\n  };\n  current = generation;\n  // Keep showing the last session while the new generation connects (invisible\n  // reconnect). Before the FIRST session, awaiters must share the stable\n  // first-connect promise (see {@link firstConnect}) — never one attempt's promise\n  // whose closed-before-open rejection React would replay into an error boundary.\n  const priorSession = snapshot?.session;\n  if (priorSession === undefined && firstConnect === undefined) {\n    firstConnect = Promise.withResolvers<SessionStub>();\n    void firstConnect.promise.catch(() => {});\n  }\n  setSnapshot({\n    generation: id,\n    session: priorSession,\n    connecting: firstConnect?.promise ?? promise,\n  });\n\n  /** Authentication established a session: publish it and retire the predecessor. */\n  const publish = (root: SessionStub, ping: () => Promise<void>) => {\n    consecutiveConnectionFailures = 0;\n    generation.ping = ping;\n    generation.liveness = setInterval(() => {\n      if (current === generation) void verifyTransport(generation);\n    }, LIVENESS_INTERVAL_MS);\n    // Retire the PREVIOUS published session — exactly once, now that its\n    // successor is live. It was kept alive through the reconnect gap so\n    // useIterateSession()/useItx() never handed out a disposed stub; dispose its\n    // project-stub cache + the stub itself only here.\n    //\n    // Safe even though this runs the same turn as setSnapshot (before React\n    // commits the re-render whose subscription cleanups unsubscribe): a\n    // successor only connects after `current` was cleared, and every path clears\n    // it AFTER closing the prior socket (the close handler, reconnectIfCurrent,\n    // reconnectIterateSession). So the prior transport is ALWAYS already closed\n    // here — its subscriptions are already dead (capnweb rejects on close) and\n    // their unsubscribe cleanups are catch-wrapped. This releases already-dead\n    // local refs, never a live subscription.\n    const retiring = snapshot?.session;\n    setSnapshot({ generation: id, session: root, connecting: promise });\n    resolve(root);\n    firstConnect?.resolve(root);\n    firstConnect = undefined;\n    if (retiring !== undefined) disposeSession(retiring);\n  };\n\n  const beginWebSocketConnection = () => {\n    // Superseded while waiting out the backoff: this attempt no longer owns the\n    // slot — settle and let the current attempt continue.\n    if (current !== generation) {\n      reject(new Error(\"itx WebSocket closed before connecting\"));\n      return;\n    }\n    const ws = new WebSocket(target.url.href);\n    generation.ws = ws;\n    let established = false;\n    // The timeout spans TCP/TLS/upgrade AND the authenticate\n    // round trip — so a server that accepts the socket but never answers\n    // authenticate call, so an unanswered authenticate becomes a paced reconnect.\n    const timeout = setTimeout(() => {\n      // Do not delegate progress to `close`: a half-open socket can accept the\n      // close request without ever firing a close event. Settle this attempt,\n      // abort its RPC session, and start a new connection attempt here.\n      if (current !== generation || established) return;\n      current = undefined;\n      consecutiveConnectionFailures += 1;\n      reject(new Error(\"itx WebSocket closed before connecting\"));\n      retireGeneration(generation);\n      startConnectionAttempt();\n    }, CONNECTION_TIMEOUT_MS);\n\n    ws.addEventListener(\"open\", () => {\n      // Generation CAS: a superseded generation's late `open` (its successor was\n      // already connected) must never publish over the live one. Close and bail.\n      if (current !== generation) {\n        clearTimeout(timeout);\n        ws.close();\n        return;\n      }\n      // ONE awaited authenticate: its result is THE session identity — the same\n      // settled stub for the snapshot, the imperative promise, and the\n      // project-stub cache. (Resolving with the raw pipelined RpcPromise would\n      // fork identities: a native promise ASSIMILATES a thenable, so imperative\n      // awaiters would receive the pulled resolution while the snapshot held the\n      // RpcPromise — two WeakMap keys, doubled project stubs, and a\n      // disposeSession that misses half of them.) In a browser the default\n      // credentials ride the session cookie on the handshake; configured\n      // consumers authenticate with their explicit credentials.\n      const unauthenticated = newWebSocketRpcSession<UnauthenticatedOs>(ws);\n      generation.rpcRoot = unauthenticated;\n      void (async () => {\n        let root: SessionStub;\n        try {\n          // The runtime value IS a session stub (same callable surface); the\n          // cast bridges capnweb's Awaited-type nesting (`Stubify<Session>`\n          // re-wraps every member in promise types) back to the nominal handle.\n          // This is the module's ONE cast, at the identity boundary.\n          const credentialProvider = target.credentials;\n          if (typeof credentialProvider === \"function\") {\n            const authenticate = async (forceRefresh: boolean) =>\n              (await unauthenticated.authenticate(\n                await credentialProvider({ forceRefresh }),\n              )) as unknown as SessionStub;\n            try {\n              root = await authenticate(false);\n            } catch (error) {\n              if (\n                !(error instanceof Error) ||\n                !/auth|token|unauthorized|401/i.test(error.message)\n              ) {\n                throw error;\n              }\n              root = await authenticate(true);\n            }\n          } else {\n            root = (await unauthenticated.authenticate(\n              credentialProvider,\n            )) as unknown as SessionStub;\n          }\n        } catch (error) {\n          clearTimeout(timeout);\n          if (current !== generation) return;\n          if (isItxTransportError(error)) {\n            // The socket died mid-handshake; the close handler owns recovery.\n            ws.close();\n            return;\n          }\n          // The server ANSWERED with a real application error (bad principal,\n          // rejected handshake): this connection attempt is terminally failed. Surface it to\n          // imperative awaiters AND the suspended tree — retrying would loop.\n          // Reject BEFORE closing: the close handler's generic connection-closed\n          // rejection must never mask the real error. Then HALT: the failed\n          // generation keeps owning the slot (see Generation.failed) so a\n          // render can't storm fresh connects; publish the halted snapshot so\n          // effects observe one final generation and settle in \"error\".\n          //\n          // The halted snapshot carries NO session. Keeping the last session is\n          // the invisible-reconnect move for TRANSPORT gaps — but this is an\n          // AUTHORITY loss (claims revoked / signed out elsewhere): the prior\n          // session's socket is already closed and no reconnect will revive it, so\n          // handing it out would wedge hooks on zombie stubs whose calls fail\n          // with transport-shaped errors while the real auth error never\n          // surfaces. Dropping it makes useIterateSession() re-throw the\n          // terminal error to the boundary; the prior session's refs are\n          // released here (they were dead already).\n          const terminal = error instanceof Error ? error : new Error(String(error));\n          generation.failed = true;\n          reject(terminal);\n          firstConnect?.reject(terminal);\n          firstConnect = undefined;\n          const zombieSession = snapshot?.session;\n          setSnapshot({ generation: id, session: undefined, connecting: promise });\n          if (zombieSession !== undefined) disposeSession(zombieSession);\n          retireGeneration(generation);\n          return;\n        }\n        clearTimeout(timeout);\n        if (current !== generation) {\n          // Superseded while authenticating: never publish; release the stub.\n          (root as Partial<Disposable>)[Symbol.dispose]?.();\n          ws.close();\n          return;\n        }\n        established = true;\n        publish(root, async () => {\n          // Any round trip proves the transport. Probe the already-authorized\n          // Session capability: re-running authenticate would needlessly\n          // re-verify the cookie/token (and can cross into the auth worker)\n          // every 45 seconds per tab merely to test socket health.\n          await root.__describe();\n        });\n      })();\n    });\n\n    ws.addEventListener(\"close\", () => {\n      clearTimeout(timeout);\n      // A HALTED generation stays the owner: its socket closing must not\n      // reconnect (that would restart the terminal-auth loop it exists to stop).\n      const wasCurrent = current === generation && !generation.failed;\n      // The socket is already closed — release resources WITHOUT re-closing it\n      // (that would re-enter this handler); disposeGeneration is idempotent.\n      disposeGeneration(generation);\n      if (wasCurrent) {\n        // A connection attempt that never established a session counts toward backoff; a\n        // post-establish death is a transient to recover from immediately.\n        if (!established) consecutiveConnectionFailures += 1;\n        current = undefined;\n        // With a live session in hand this is the INVISIBLE reconnect\n        // (the snapshot keeps showing it); with none it keeps first-load\n        // callers on the stable first-connect promise — a paced retry, never\n        // a wedge or an error boundary.\n        startConnectionAttempt();\n      }\n      // Once a connection attempt has resolved this is a no-op; a connection attempt that closed BEFORE\n      // establishing rejects so imperative `connectIterateSession()` awaiters fail fast.\n      reject(new Error(\"itx WebSocket closed before connecting\"));\n    });\n  };\n\n  // The FIRST retry is immediate (a one-off blip should recover instantly);\n  // pacing kicks in from the second consecutive failure — that's the storm.\n  const delay =\n    consecutiveConnectionFailures <= 1\n      ? 0\n      : Math.min(\n          RECONNECT_BACKOFF_MAX_MS,\n          RECONNECT_BACKOFF_MIN_MS * 2 ** Math.min(consecutiveConnectionFailures - 2, 6),\n        );\n  if (delay === 0) beginWebSocketConnection();\n  else setTimeout(beginWebSocketConnection, delay);\n  return generation;\n}\n\nfunction setSnapshot(next: Snapshot): void {\n  // Replace the immutable snapshot, then wake readers — always in this order so\n  // a concurrent render can't observe listeners firing against a stale value.\n  snapshot = next;\n  for (const listener of listeners) listener();\n}\n\n/**\n * Release a generation's TRANSPORT resources — its liveness timer. Naturally\n * idempotent, and it does NOT close the socket or dispose the session stub: the\n * session is retired separately, by its successor's publish (see the open\n * handler), so invisible reconnect never hands out a disposed stub. Safe to\n * call from the `close` handler without re-entering it.\n */\nfunction disposeGeneration(generation: Generation): void {\n  if (generation.liveness !== undefined) clearInterval(generation.liveness);\n  generation.liveness = undefined;\n}\n\n/** Dispose a retired session's project-stub cache and the session stub itself. */\nfunction disposeSession(session: SessionStub): void {\n  const cache = projectStubCaches.get(session);\n  if (cache) for (const stub of cache.values()) (stub as Partial<Disposable>)[Symbol.dispose]?.();\n  (session as Partial<Disposable>)[Symbol.dispose]?.();\n}\n\n/**\n * FORCED retirement (a reconnect, not an observed close): release resources,\n * abort capnweb through its bootstrap stub, then ask the socket to close.\n * Disposing the bootstrap synchronously rejects every pending and future call;\n * relying on WebSocket.close() alone is insufficient because a half-open socket\n * may never finish its close handshake or fire `close`. Callers set\n * `current = undefined` FIRST, so any close event won't auto-reconnect (reconnecting\n * is the caller's job).\n */\nfunction retireGeneration(generation: Generation): void {\n  disposeGeneration(generation);\n  generation.rejectConnecting(new Error(\"itx WebSocket closed before connecting\"));\n  generation.rpcRoot?.[Symbol.dispose]?.();\n  generation.rpcRoot = undefined;\n  generation.ws?.close();\n}\n\n/**\n * Report that the shared transport may be half-open (a call hung). Consumers —\n * the subscription watchdog, any long-lived reader — call this instead of\n * closing the socket themselves — {@link verifyTransport} probes and, only on\n * two strikes against the SAME generation, retires it. A stale report is a\n * no-op.\n */\nexport function reportTransportSuspicion(): void {\n  const generation = current;\n  // An attempt still awaiting authentication owns its connection timeout; nothing to verify.\n  if (generation?.ping === undefined) return;\n  void verifyTransport(generation);\n}\n\nasync function verifyTransport(generation: Generation): Promise<void> {\n  // Single-flight PER GENERATION, not process-wide: a probe still racing on a\n  // retired generation (its ping hung and never settled) must not block\n  // verifying the fresh successor.\n  if (generation.verifying || current !== generation || generation.ping === undefined) return;\n  generation.verifying = true;\n  try {\n    // A probe is a STRIKE only when the transport itself failed — a timeout, or\n    // a rejection classified as a transport close. Any other rejection means the\n    // socket ANSWERED (an application/auth error came back over it), so the\n    // transport is alive. Rejections are caught here, never left unhandled.\n    const probeOnce = (): Promise<\"alive\" | \"strike\"> =>\n      Promise.race([\n        generation.ping!().then(\n          () => \"alive\" as const,\n          (error: unknown) =>\n            (isItxTransportError(error) ? \"strike\" : \"alive\") as \"alive\" | \"strike\",\n        ),\n        new Promise<\"strike\">((resolve) =>\n          setTimeout(() => resolve(\"strike\"), LIVENESS_TIMEOUT_MS),\n        ),\n      ]);\n    // Two-strike: one slow answer is a busy server, not a dead socket.\n    let verdict = await probeOnce();\n    if (verdict === \"strike\" && current === generation) verdict = await probeOnce();\n    if (verdict === \"strike\") reconnectIfCurrent(generation);\n  } finally {\n    generation.verifying = false;\n  }\n}\n\n/**\n * Retire + reconnect the transport, but ONLY if `generation` still owns the slot —\n * the compare-and-swap that stops a late verdict (a probe that timed out on a\n * corpse) from closing the healthy successor another path already connected.\n */\nfunction reconnectIfCurrent(generation: Generation): void {\n  if (current !== generation) return;\n  current = undefined; // FIRST: the close retireGeneration triggers must not auto-reconnect\n  retireGeneration(generation);\n  startConnectionAttempt();\n}\n\n/**\n * The SEMANTIC reset (not a transport reconnect): drop the live socket and connection attempt\n * a fresh one so the next reads run under the caller's CURRENT claims. Call\n * after creating a project or unlocking admin — the live socket carries the\n * connect-time principal. React callers that need already-cached data refreshed\n * should also `invalidateQueries({ queryKey: [\"itx\"] })`.\n */\nexport function reconnectIterateSession(): void {\n  const generation = current;\n  if (generation !== undefined) {\n    current = undefined; // FIRST: the close retireGeneration triggers must not auto-reconnect\n    retireGeneration(generation);\n  }\n  // A deliberate reset connects NOW: clear any backoff inherited from earlier\n  // closed-before-open failures so the new-claims socket doesn't wait out a\n  // transient storm that's already irrelevant.\n  consecutiveConnectionFailures = 0;\n  startConnectionAttempt();\n}\n\n/**\n * Revive only a generation parked by a terminal authentication failure. This\n * is the imperative retry boundary for query/mutation clients: calling it\n * before a repeated operation lets refreshed credentials dial again without\n * disturbing a healthy or merely reconnecting session.\n */\nexport function retryFailedIterateSession(): void {\n  if (current?.failed) reconnectIterateSession();\n}\n\n/**\n * Release the current transport and authority without reconnecting. Intended\n * for process-local lifecycle boundaries such as signing out of a native app;\n * mounted consumers should be removed in the same transition. The explicit\n * deployment configuration remains, so a later connect can dial it again.\n */\nexport function disconnectIterateSession(): void {\n  const generation = current;\n  current = undefined;\n  if (generation !== undefined) retireGeneration(generation);\n  const retiredSession = snapshot?.session;\n  snapshot = undefined;\n  if (retiredSession !== undefined) disposeSession(retiredSession);\n  firstConnect?.reject(new Error(\"itx session disconnected\"));\n  firstConnect = undefined;\n  consecutiveConnectionFailures = 0;\n}\n\n/**\n * The four — and only four — transport-close rejections a caller may treat as\n * \"the socket died, retry on a fresh one\": our own connection-closed rejection, capnweb's\n * two WebSocket aborts (`Peer closed WebSocket: <code> <reason>` and\n * `WebSocket connection failed.`), and capnweb's exact local-shutdown error\n * from our forced bootstrap disposal. Deliberately NARROW: an\n * application/auth/validation error that merely mentions \"WebSocket\" must never\n * be mistaken for a transport failure and retried. This is the one discriminant\n * shared by the query retry, the subscribe retry, and the liveness verifier.\n */\nexport function isItxTransportError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return (\n    message.includes(\"itx WebSocket closed before connecting\") ||\n    message.includes(\"Peer closed WebSocket\") ||\n    message.includes(\"WebSocket connection failed\") ||\n    message.includes(\"RPC session was shut down by disposing the main stub\")\n  );\n}\n\n// Baseline half-open recovery for the whole browser tab: on the moments\n// transports die (waking a tab, coming back online), verify the current socket.\n// Connection watchdogs recover their own callbacks faster; this\n// covers a query-only page whose socket nobody else probes. Non-browser\n// runtimes have no equivalent signal — their timers carry the whole story.\nif (typeof document !== \"undefined\") {\n  // Becoming visible → verify (a tab going hidden shouldn't trigger a probe).\n  document.addEventListener(\"visibilitychange\", () => {\n    if (document.visibilityState === \"visible\") reportTransportSuspicion();\n  });\n  // Connectivity returning → verify UNCONDITIONALLY: a backgrounded tab must\n  // recover a half-open socket when the network comes back, not wait for focus.\n  window.addEventListener(\"online\", () => reportTransportSuspicion());\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Push-connection liveness: the handle shape + the watchdog that polls it.\n// ─────────────────────────────────────────────────────────────────────────────\n\nconst PING_TIMED_OUT = Symbol(\"itx-ping-timed-out\");\n\n/**\n * The common lifecycle used by reconnecting stream and live-state clients.\n * Concrete APIs adapt their own handle (`StreamConnectionHandle.close()` or\n * `LiveStateSubscriptionHandle.unsubscribe()`) to `close()`. Real handles are\n * capnweb stubs and therefore Disposable: `close()` closes the server-side\n * resource, while `[Symbol.dispose]` releases the caller-owned stub —\n * on the process-long shared socket, skipping the dispose leaks one\n * import-table entry per subscribe cycle, so holders always do both.\n */\nexport type ItxRecoverableConnectionHandle = {\n  ping(): boolean | Promise<boolean>;\n  close(): unknown;\n  [Symbol.dispose]?(): void;\n};\n\n/**\n * Release a push connection completely: `close()` closes the server side\n * (already-dead is fine — the rejection is swallowed), then\n * `[Symbol.dispose]` frees the caller-owned stub. One helper because\n * forgetting either half leaks (see {@link ItxRecoverableConnectionHandle}).\n */\nexport function releaseItxConnection(handle: ItxRecoverableConnectionHandle): void {\n  void Promise.resolve()\n    .then(() => handle.close())\n    .catch(() => {})\n    .finally(() => handle[Symbol.dispose]?.());\n}\n\n/**\n * Poll a push connection's `ping()` until it stops answering `true`, then\n * recover. Server pushes fail SILENTLY: a dead Durable Object or half-open TCP\n * stops delivering with no client-visible signal, so a consumer can show\n * \"live\" forever while stale. The watchdog checks on an interval and — because\n * those are exactly when sockets die — when a browser tab becomes visible or\n * comes online (in runtimes without those signals, the interval carries it).\n *\n *   `dead`      → ping answered `false` or REJECTED: the socket works but the\n *                 server-side connection is gone (DO restart / dropped\n *                 callback). Recovery opens it again on the same socket.\n *   `timed-out` → ping never answered: the shared WebSocket is half-open. The\n *                 watchdog REPORTS the suspicion to the socket-owned verifier\n *                 ({@link reportTransportSuspicion}) — it never closes the socket\n *                 itself — and the holder opens again once the generation\n *                 reconnects.\n */\nexport function watchItxConnection(\n  ping: () => boolean | Promise<boolean>,\n  onDead: () => void,\n): () => void {\n  let stopped = false;\n  let checking = false;\n\n  // The reason stays internal: on \"timed-out\" the watchdog itself reports the\n  // transport suspicion; either way the caller's only move is to open again.\n  const report = (reason: \"dead\" | \"timed-out\") => {\n    if (stopped) return;\n    stop();\n    if (reason === \"timed-out\") reportTransportSuspicion();\n    onDead();\n  };\n\n  const pingOnce = () => {\n    const timeout = new Promise<typeof PING_TIMED_OUT>((resolve) =>\n      setTimeout(() => resolve(PING_TIMED_OUT), LIVENESS_TIMEOUT_MS),\n    );\n    return Promise.race([Promise.resolve(ping()), timeout]);\n  };\n\n  const check = async () => {\n    if (stopped || checking) return;\n    checking = true;\n    try {\n      let alive: boolean | typeof PING_TIMED_OUT;\n      try {\n        alive = await pingOnce();\n        // One slow answer is a busy/cold DO, not a dead socket — two-strike.\n        if (alive === PING_TIMED_OUT && !stopped) alive = await pingOnce();\n      } catch {\n        report(\"dead\");\n        return;\n      }\n      if (alive === PING_TIMED_OUT) report(\"timed-out\");\n      else if (alive !== true) report(\"dead\");\n    } finally {\n      checking = false;\n    }\n  };\n\n  // Browser wake signals (guarded: node/TUI runs interval-only). Becoming\n  // visible → check (going hidden shouldn't). Connectivity returning → check\n  // UNCONDITIONALLY, so a backgrounded tab holding a live subscription recovers\n  // a half-open socket when the network comes back, not on next focus.\n  const inBrowser = typeof document !== \"undefined\";\n  const onVisible = () => {\n    if (document.visibilityState === \"visible\") void check();\n  };\n  const onOnline = () => void check();\n  const interval = setInterval(() => void check(), LIVENESS_INTERVAL_MS);\n  if (inBrowser) {\n    document.addEventListener(\"visibilitychange\", onVisible);\n    window.addEventListener(\"online\", onOnline);\n  }\n\n  const stop = () => {\n    if (stopped) return;\n    stopped = true;\n    clearInterval(interval);\n    if (inBrowser) {\n      document.removeEventListener(\"visibilitychange\", onVisible);\n      window.removeEventListener(\"online\", onOnline);\n    }\n  };\n  return stop;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6GA,IAAI;;;;;;;;;AAUJ,SAAgB,wBAAwB,QAAoC;CAC1E,MAAM,gBACJ,mBAAmB,KAAA,KACnB,gBAAgB,eAAe,OAAO,CAAC,CAAC,SAAS,gBAAgB,OAAO,OAAO,CAAC,CAAC;CACnF,iBAAiB;CACjB,IAAI,CAAC,iBAAiB,YAAY,KAAA,GAAW;CAE7C,MAAM,aAAa;CACnB,UAAU,KAAA;CACV,iBAAiB,UAAU;CAC3B,MAAM,iBAAiB,UAAU;CACjC,WAAW,KAAA;CACX,IAAI,mBAAmB,KAAA,GAAW,eAAe,cAAc;CAC/D,gCAAgC;CAGhC,IAAI,iBAAiB,KAAA,GAAW;EAC9B,eAAe,QAAQ,cAA2B;EAClD,aAAkB,QAAQ,YAAY,CAAC,CAAC;CAC1C;CACA,uBAAuB;AACzB;AAEA,SAAS,0BAGP;CAIA,OAAO;EACL,KAAK,gBAHL,gBAAgB,YACf,OAAO,WAAW,cAAc,wBAAwB,IAAI,OAAO,SAAS,KAEpD;EACzB,aAAa,gBAAgB,eAAe,EAAE,MAAM,qBAAqB;CAC3E;AACF;AAEA,SAAS,0BAAiC;CACxC,MAAM,IAAI,MACR,mQAGF;AACF;AAMA,MAAM,wBAAwB;AAK9B,MAAM,2BAA2B;AACjC,MAAM,2BAA2B;;;;;;AAMjC,MAAM,uBAAuB;;AAE7B,MAAM,sBAAsB;AAuD5B,IAAI;AACJ,IAAI;AACJ,IAAI,oBAAoB;;AAExB,IAAI,gCAAgC;;;;;;;;;;;AAWpC,IAAI;AAEJ,MAAM,4BAAY,IAAI,IAAgB;AACtC,MAAa,oBAAoB,aAAyB;CACxD,UAAU,IAAI,QAAQ;CACtB,aAAa,KAAK,UAAU,OAAO,QAAQ;AAC7C;;;;;;;;;AAUA,MAAM,oCAAoB,IAAI,QAA+C;AAE7E,SAAgB,eAAe,SAAsB,MAA2B;CAC9E,IAAI,QAAQ,kBAAkB,IAAI,OAAO;CACzC,IAAI,UAAU,KAAA,GAAW;EACvB,wBAAQ,IAAI,IAAI;EAChB,kBAAkB,IAAI,SAAS,KAAK;CACtC;CACA,IAAI,OAAO,MAAM,IAAI,IAAI;CACzB,IAAI,SAAS,KAAA,GAAW;EACtB,OAAO,QAAQ,SAAS,IAAI,IAAI;EAChC,MAAM,IAAI,MAAM,IAAI;CACtB;CACA,OAAO;AACT;;AAGA,SAAgB,kBAA4B;CAI1C,IAAI,YAAY,KAAA,GAAW,uBAAuB;CAClD,OAAO;AACT;AAEA,MAAa,uBAA8B,wBAAwB;;;;;;;;AASnE,SAAgB,wBAA8C;CAG5D,QAAQ,WAAW,uBAAuB,EAAA,CAAG;AAC/C;;;;;;AAOA,SAAgB,WAAW,MAAoC;CAC7D,OAAO,sBAAsB,CAAC,CAAC,MAAM,YAAY,eAAe,SAAS,IAAI,CAAC;AAChF;AAEA,SAAS,yBAAqC;CAC5C,MAAM,SAAS,wBAAwB;CAEvC,MAAM,KAAK,EAAE;CACb,MAAM,EAAE,SAAS,SAAS,WAAW,QAAQ,cAA2B;CAGxE,QAAa,YAAY,CAAC,CAAC;CAC3B,MAAM,aAAyB;EAC7B,IAAI,KAAA;EACJ,SAAS,KAAA;EACT,YAAY;EACZ,kBAAkB;EAClB,MAAM,KAAA;EACN,UAAU,KAAA;EACV,WAAW;EACX,QAAQ;CACV;CACA,UAAU;CAKV,MAAM,eAAe,UAAU;CAC/B,IAAI,iBAAiB,KAAA,KAAa,iBAAiB,KAAA,GAAW;EAC5D,eAAe,QAAQ,cAA2B;EAClD,aAAkB,QAAQ,YAAY,CAAC,CAAC;CAC1C;CACA,YAAY;EACV,YAAY;EACZ,SAAS;EACT,YAAY,cAAc,WAAW;CACvC,CAAC;;CAGD,MAAM,WAAW,MAAmB,SAA8B;EAChE,gCAAgC;EAChC,WAAW,OAAO;EAClB,WAAW,WAAW,kBAAkB;GACtC,IAAI,YAAY,YAAY,gBAAqB,UAAU;EAC7D,GAAG,oBAAoB;EAcvB,MAAM,WAAW,UAAU;EAC3B,YAAY;GAAE,YAAY;GAAI,SAAS;GAAM,YAAY;EAAQ,CAAC;EAClE,QAAQ,IAAI;EACZ,cAAc,QAAQ,IAAI;EAC1B,eAAe,KAAA;EACf,IAAI,aAAa,KAAA,GAAW,eAAe,QAAQ;CACrD;CAEA,MAAM,iCAAiC;EAGrC,IAAI,YAAY,YAAY;GAC1B,uBAAO,IAAI,MAAM,wCAAwC,CAAC;GAC1D;EACF;EACA,MAAM,KAAK,IAAI,UAAU,OAAO,IAAI,IAAI;EACxC,WAAW,KAAK;EAChB,IAAI,cAAc;EAIlB,MAAM,UAAU,iBAAiB;GAI/B,IAAI,YAAY,cAAc,aAAa;GAC3C,UAAU,KAAA;GACV,iCAAiC;GACjC,uBAAO,IAAI,MAAM,wCAAwC,CAAC;GAC1D,iBAAiB,UAAU;GAC3B,uBAAuB;EACzB,GAAG,qBAAqB;EAExB,GAAG,iBAAiB,cAAc;GAGhC,IAAI,YAAY,YAAY;IAC1B,aAAa,OAAO;IACpB,GAAG,MAAM;IACT;GACF;GAUA,MAAM,kBAAkB,uBAA0C,EAAE;GACpE,WAAW,UAAU;GACrB,CAAM,YAAY;IAChB,IAAI;IACJ,IAAI;KAKF,MAAM,qBAAqB,OAAO;KAClC,IAAI,OAAO,uBAAuB,YAAY;MAC5C,MAAM,eAAe,OAAO,iBACzB,MAAM,gBAAgB,aACrB,MAAM,mBAAmB,EAAE,aAAa,CAAC,CAC3C;MACF,IAAI;OACF,OAAO,MAAM,aAAa,KAAK;MACjC,SAAS,OAAO;OACd,IACE,EAAE,iBAAiB,UACnB,CAAC,+BAA+B,KAAK,MAAM,OAAO,GAElD,MAAM;OAER,OAAO,MAAM,aAAa,IAAI;MAChC;KACF,OACE,OAAQ,MAAM,gBAAgB,aAC5B,kBACF;IAEJ,SAAS,OAAO;KACd,aAAa,OAAO;KACpB,IAAI,YAAY,YAAY;KAC5B,IAAI,oBAAoB,KAAK,GAAG;MAE9B,GAAG,MAAM;MACT;KACF;KAmBA,MAAM,WAAW,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;KACzE,WAAW,SAAS;KACpB,OAAO,QAAQ;KACf,cAAc,OAAO,QAAQ;KAC7B,eAAe,KAAA;KACf,MAAM,gBAAgB,UAAU;KAChC,YAAY;MAAE,YAAY;MAAI,SAAS,KAAA;MAAW,YAAY;KAAQ,CAAC;KACvE,IAAI,kBAAkB,KAAA,GAAW,eAAe,aAAa;KAC7D,iBAAiB,UAAU;KAC3B;IACF;IACA,aAAa,OAAO;IACpB,IAAI,YAAY,YAAY;KAE1B,KAA8B,OAAO,QAAQ,GAAG;KAChD,GAAG,MAAM;KACT;IACF;IACA,cAAc;IACd,QAAQ,MAAM,YAAY;KAKxB,MAAM,KAAK,WAAW;IACxB,CAAC;GACH,EAAA,CAAG;EACL,CAAC;EAED,GAAG,iBAAiB,eAAe;GACjC,aAAa,OAAO;GAGpB,MAAM,aAAa,YAAY,cAAc,CAAC,WAAW;GAGzD,kBAAkB,UAAU;GAC5B,IAAI,YAAY;IAGd,IAAI,CAAC,aAAa,iCAAiC;IACnD,UAAU,KAAA;IAKV,uBAAuB;GACzB;GAGA,uBAAO,IAAI,MAAM,wCAAwC,CAAC;EAC5D,CAAC;CACH;CAIA,MAAM,QACJ,iCAAiC,IAC7B,IACA,KAAK,IACH,0BACA,2BAA2B,KAAK,KAAK,IAAI,gCAAgC,GAAG,CAAC,CAC/E;CACN,IAAI,UAAU,GAAG,yBAAyB;MACrC,WAAW,0BAA0B,KAAK;CAC/C,OAAO;AACT;AAEA,SAAS,YAAY,MAAsB;CAGzC,WAAW;CACX,KAAK,MAAM,YAAY,WAAW,SAAS;AAC7C;;;;;;;;AASA,SAAS,kBAAkB,YAA8B;CACvD,IAAI,WAAW,aAAa,KAAA,GAAW,cAAc,WAAW,QAAQ;CACxE,WAAW,WAAW,KAAA;AACxB;;AAGA,SAAS,eAAe,SAA4B;CAClD,MAAM,QAAQ,kBAAkB,IAAI,OAAO;CAC3C,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,OAAO,GAAG,KAA8B,OAAO,QAAQ,GAAG;CAC9F,QAAiC,OAAO,QAAQ,GAAG;AACrD;;;;;;;;;;AAWA,SAAS,iBAAiB,YAA8B;CACtD,kBAAkB,UAAU;CAC5B,WAAW,iCAAiB,IAAI,MAAM,wCAAwC,CAAC;CAC/E,WAAW,UAAU,OAAO,QAAQ,GAAG;CACvC,WAAW,UAAU,KAAA;CACrB,WAAW,IAAI,MAAM;AACvB;;;;;;;;AASA,SAAgB,2BAAiC;CAC/C,MAAM,aAAa;CAEnB,IAAI,YAAY,SAAS,KAAA,GAAW;CACpC,gBAAqB,UAAU;AACjC;AAEA,eAAe,gBAAgB,YAAuC;CAIpE,IAAI,WAAW,aAAa,YAAY,cAAc,WAAW,SAAS,KAAA,GAAW;CACrF,WAAW,YAAY;CACvB,IAAI;EAKF,MAAM,kBACJ,QAAQ,KAAK,CACX,WAAW,KAAM,CAAC,CAAC,WACX,UACL,UACE,oBAAoB,KAAK,IAAI,WAAW,OAC7C,GACA,IAAI,SAAmB,YACrB,iBAAiB,QAAQ,QAAQ,GAAG,mBAAmB,CACzD,CACF,CAAC;EAEH,IAAI,UAAU,MAAM,UAAU;EAC9B,IAAI,YAAY,YAAY,YAAY,YAAY,UAAU,MAAM,UAAU;EAC9E,IAAI,YAAY,UAAU,mBAAmB,UAAU;CACzD,UAAU;EACR,WAAW,YAAY;CACzB;AACF;;;;;;AAOA,SAAS,mBAAmB,YAA8B;CACxD,IAAI,YAAY,YAAY;CAC5B,UAAU,KAAA;CACV,iBAAiB,UAAU;CAC3B,uBAAuB;AACzB;;;;;;;;AASA,SAAgB,0BAAgC;CAC9C,MAAM,aAAa;CACnB,IAAI,eAAe,KAAA,GAAW;EAC5B,UAAU,KAAA;EACV,iBAAiB,UAAU;CAC7B;CAIA,gCAAgC;CAChC,uBAAuB;AACzB;;;;;;;AAQA,SAAgB,4BAAkC;CAChD,IAAI,SAAS,QAAQ,wBAAwB;AAC/C;;;;;;;AAQA,SAAgB,2BAAiC;CAC/C,MAAM,aAAa;CACnB,UAAU,KAAA;CACV,IAAI,eAAe,KAAA,GAAW,iBAAiB,UAAU;CACzD,MAAM,iBAAiB,UAAU;CACjC,WAAW,KAAA;CACX,IAAI,mBAAmB,KAAA,GAAW,eAAe,cAAc;CAC/D,cAAc,uBAAO,IAAI,MAAM,0BAA0B,CAAC;CAC1D,eAAe,KAAA;CACf,gCAAgC;AAClC;;;;;;;;;;;AAYA,SAAgB,oBAAoB,OAAyB;CAC3D,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACrE,OACE,QAAQ,SAAS,wCAAwC,KACzD,QAAQ,SAAS,uBAAuB,KACxC,QAAQ,SAAS,6BAA6B,KAC9C,QAAQ,SAAS,sDAAsD;AAE3E;AAOA,IAAI,OAAO,aAAa,aAAa;CAEnC,SAAS,iBAAiB,0BAA0B;EAClD,IAAI,SAAS,oBAAoB,WAAW,yBAAyB;CACvE,CAAC;CAGD,OAAO,iBAAiB,gBAAgB,yBAAyB,CAAC;AACpE;AAMA,MAAM,iBAAiB,OAAO,oBAAoB;;;;;;;AAuBlD,SAAgB,qBAAqB,QAA8C;CACjF,QAAa,QAAQ,CAAC,CACnB,WAAW,OAAO,MAAM,CAAC,CAAC,CAC1B,YAAY,CAAC,CAAC,CAAC,CACf,cAAc,OAAO,OAAO,QAAQ,GAAG,CAAC;AAC7C;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,mBACd,MACA,QACY;CACZ,IAAI,UAAU;CACd,IAAI,WAAW;CAIf,MAAM,UAAU,WAAiC;EAC/C,IAAI,SAAS;EACb,KAAK;EACL,IAAI,WAAW,aAAa,yBAAyB;EACrD,OAAO;CACT;CAEA,MAAM,iBAAiB;EACrB,MAAM,UAAU,IAAI,SAAgC,YAClD,iBAAiB,QAAQ,cAAc,GAAG,mBAAmB,CAC/D;EACA,OAAO,QAAQ,KAAK,CAAC,QAAQ,QAAQ,KAAK,CAAC,GAAG,OAAO,CAAC;CACxD;CAEA,MAAM,QAAQ,YAAY;EACxB,IAAI,WAAW,UAAU;EACzB,WAAW;EACX,IAAI;GACF,IAAI;GACJ,IAAI;IACF,QAAQ,MAAM,SAAS;IAEvB,IAAI,UAAU,kBAAkB,CAAC,SAAS,QAAQ,MAAM,SAAS;GACnE,QAAQ;IACN,OAAO,MAAM;IACb;GACF;GACA,IAAI,UAAU,gBAAgB,OAAO,WAAW;QAC3C,IAAI,UAAU,MAAM,OAAO,MAAM;EACxC,UAAU;GACR,WAAW;EACb;CACF;CAMA,MAAM,YAAY,OAAO,aAAa;CACtC,MAAM,kBAAkB;EACtB,IAAI,SAAS,oBAAoB,WAAW,MAAW;CACzD;CACA,MAAM,iBAAiB,KAAK,MAAM;CAClC,MAAM,WAAW,kBAAkB,KAAK,MAAM,GAAG,oBAAoB;CACrE,IAAI,WAAW;EACb,SAAS,iBAAiB,oBAAoB,SAAS;EACvD,OAAO,iBAAiB,UAAU,QAAQ;CAC5C;CAEA,MAAM,aAAa;EACjB,IAAI,SAAS;EACb,UAAU;EACV,cAAc,QAAQ;EACtB,IAAI,WAAW;GACb,SAAS,oBAAoB,oBAAoB,SAAS;GAC1D,OAAO,oBAAoB,UAAU,QAAQ;EAC/C;CACF;CACA,OAAO;AACT"}