looply-cli 0.0.0-stage → 0.2.0

package/dist/syncing-ledger.d.ts

@@ -0,0 +1,45 @@
+import type { AnyEvent } from '@looply/core';
+import type { AnyEventInput } from './ledger-store';
+/**
+ * A ledger that also ships what it writes.
+ *
+ * Without this a run was complete and correct and entirely invisible: every
+ * transition landed in `.looply/state/events.jsonl` and nothing ever left the
+ * machine, so the phone showed a project that never moved. The runner should not
+ * know a server exists, so the wiring goes here rather than into the runner.
+ *
+ * Local first, always. The append to disk is the record; the upload is a copy.
+ * If shipping fails the run carries on and the events wait — which is the same
+ * rule the daemon follows, for the same reason.
+ */
+export interface AppendOnlyLedger {
+    append(input: AnyEventInput): Promise<AnyEvent>;
+}
+export interface EventSink {
+    enqueue(event: AnyEvent): void;
+}
+export declare class SyncingLedger implements AppendOnlyLedger {
+    private readonly inner;
+    private readonly sink;
+    /** Never fatal: a broken sink must not stop a run that is otherwise fine. */
+    private readonly onSinkError?;
+    constructor(inner: AppendOnlyLedger, sink: EventSink, 
+    /** Never fatal: a broken sink must not stop a run that is otherwise fine. */
+    onSinkError?: ((e: Error) => void) | undefined);
+    append(input: AnyEventInput): Promise<AnyEvent>;
+}
+/**
+ * The error reporter every construction site passes.
+ *
+ * `onSinkError` is optional and nobody passed one, so the catch above was a
+ * silent drop: the event stayed on disk, never reached the phone, and the user
+ * saw a project that had simply stopped moving — the exact failure this class
+ * was written to prevent.
+ *
+ * Said once, on the first failure. This is the append path of a run that may
+ * last hours, and a line per event would be a second, louder way of failing to
+ * reach the server; `Daemon.enqueue` holds its overflow notice back for the
+ * same reason. What is worth saying is that the stream broke, not how often.
+ */
+export declare function logSinkErrorOnce(log: (line: string) => void): (e: Error) => void;
+//# sourceMappingURL=syncing-ledger.d.ts.map

package/dist/syncing-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncing-ledger.d.ts","sourceRoot":"","sources":["../src/syncing-ledger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,aAAc,YAAW,gBAAgB;IAElD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAHZ,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,SAAS;IAChC,6EAA6E;IAC5D,WAAW,CAAC,GAAE,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,aAAA;IAG7C,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;CAStD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAUhF"}

package/dist/syncing-ledger.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SyncingLedger = void 0;
+exports.logSinkErrorOnce = logSinkErrorOnce;
+class SyncingLedger {
+    inner;
+    sink;
+    onSinkError;
+    constructor(inner, sink, 
+    /** Never fatal: a broken sink must not stop a run that is otherwise fine. */
+    onSinkError) {
+        this.inner = inner;
+        this.sink = sink;
+        this.onSinkError = onSinkError;
+    }
+    async append(input) {
+        const event = await this.inner.append(input);
+        try {
+            this.sink.enqueue(event);
+        }
+        catch (e) {
+            this.onSinkError?.(e);
+        }
+        return event;
+    }
+}
+exports.SyncingLedger = SyncingLedger;
+/**
+ * The error reporter every construction site passes.
+ *
+ * `onSinkError` is optional and nobody passed one, so the catch above was a
+ * silent drop: the event stayed on disk, never reached the phone, and the user
+ * saw a project that had simply stopped moving — the exact failure this class
+ * was written to prevent.
+ *
+ * Said once, on the first failure. This is the append path of a run that may
+ * last hours, and a line per event would be a second, louder way of failing to
+ * reach the server; `Daemon.enqueue` holds its overflow notice back for the
+ * same reason. What is worth saying is that the stream broke, not how often.
+ */
+function logSinkErrorOnce(log) {
+    let said = false;
+    return (e) => {
+        if (said)
+            return;
+        said = true;
+        // `enqueue` is somebody else's code and a throw need not be an Error.
+        const why = e instanceof Error ? e.message : String(e);
+        log(`sync    : an event did not reach the stream (${why}) — it stays on disk.`);
+        log('          Your phone may show a gap; the ledger on this machine is complete.');
+    };
+}
+//# sourceMappingURL=syncing-ledger.js.map

package/dist/syncing-ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncing-ledger.js","sourceRoot":"","sources":["../src/syncing-ledger.ts"],"names":[],"mappings":";;;AAwDA,4CAUC;AA1CD,MAAa,aAAa;IAEL;IACA;IAEA;IAJnB,YACmB,KAAuB,EACvB,IAAe;IAChC,6EAA6E;IAC5D,WAAgC;QAHhC,UAAK,GAAL,KAAK,CAAkB;QACvB,SAAI,GAAJ,IAAI,CAAW;QAEf,gBAAW,GAAX,WAAW,CAAqB;IAChD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,EAAE,CAAC,CAAU,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAjBD,sCAiBC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAAC,GAA2B;IAC1D,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,CAAC,CAAC,EAAE,EAAE;QACX,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,GAAG,IAAI,CAAC;QACZ,sEAAsE;QACtE,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,gDAAgD,GAAG,uBAAuB,CAAC,CAAC;QAChF,GAAG,CAAC,8EAA8E,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}

package/dist/temp-fixtures.d.ts

@@ -0,0 +1,68 @@
+/**
+ * A TEST FIXTURE OWNS THE TEMP DIRECTORIES IT CREATES, AND REMOVES EXACTLY
+ * THOSE.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS EXISTS, MEASURED RATHER THAN SUPPOSED.
+ *
+ * 🔴 THE SUITES LEAKED 23,604 TEMP DIRECTORIES — about 8 GB — AND IT TOOK A GATE
+ * DOWN. `mkdtempSync` was called in ninety files and twenty-three of them
+ * created more directories than they removed; thirteen had no cleanup hook at
+ * all. The accumulation filled the disk mid-gate, `ENOSPC` truncated a jest
+ * transform-cache entry as it was being written, and the next run failed with a
+ * parse error at line 1 of a source file nobody had touched. Three separate
+ * symptoms, one owner.
+ *
+ * ⚠️ THE FIX IS OWNERSHIP, NOT A SWEEPER. A background cleaner that deleted old
+ * directories by age or by name prefix would be guessing about files it did not
+ * create — and the one thing worse than a leak is a cleaner that removes
+ * somebody else's live fixture because it looked old. Every path this removes is
+ * one it returned from `make`.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY IT TOUCHES NO TEST-FRAMEWORK GLOBAL.
+ *
+ * ⚠️ IT DOES NOT CALL `afterAll` ITSELF, AND THAT IS DELIBERATE TWICE OVER.
+ *
+ * First, a module that registers a lifecycle hook at import time hides the
+ * hook from the file that needs to be responsible for it: the spec declares
+ * `afterAll(() => tmp.cleanup())` in its own body, where a reader looking for
+ * "what cleans this up" will find it.
+ *
+ * Second, this file is ordinary source and stays free of `describe`/`it`/
+ * `afterAll`. A helper that called them would have to live in a `.spec.ts` to
+ * get the globals — and a `.spec.ts` imported by another suite executes its
+ * module body in that suite's worker, so any `describe` it declares would be
+ * registered into every importing suite. The controls for this helper live in
+ * `temp-fixtures.spec.ts`; the helper itself is importable from anywhere.
+ */
+export interface OwnedTempDirs {
+    /**
+     * Create a temp directory under the OS temp root and take ownership of it.
+     *
+     * The prefix is `mkdtemp`'s, so the returned path always ends in six random
+     * characters and two calls with the same prefix are two different
+     * directories.
+     */
+    make(prefix: string): string;
+    /** The paths this fixture created and has not yet removed, in creation order. */
+    readonly owned: readonly string[];
+    /**
+     * Remove exactly the directories this fixture created, and forget them.
+     *
+     * ⚠️ SAFE TO CALL TWICE, and safe to call when nothing was created — a spec
+     * that throws before its first `make` still runs its `afterAll`.
+     *
+     * ⚠️ AND IT NEVER THROWS. A directory a live process still holds open on
+     * Windows cannot be removed, and a fixture that threw from its own cleanup
+     * would turn a passing suite red for a housekeeping failure. The paths it
+     * could not remove come back in `failed` so a caller that wants to assert on
+     * them can.
+     */
+    cleanup(): {
+        readonly removed: number;
+        readonly failed: readonly string[];
+    };
+}
+export declare function ownedTempDirs(): OwnedTempDirs;
+//# sourceMappingURL=temp-fixtures.d.ts.map

package/dist/temp-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-fixtures.d.ts","sourceRoot":"","sources":["../src/temp-fixtures.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,OAAO,IAAI;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC7E;AAED,wBAAgB,aAAa,IAAI,aAAa,CA6B7C"}

package/dist/temp-fixtures.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ownedTempDirs = ownedTempDirs;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+function ownedTempDirs() {
+    const owned = [];
+    return {
+        make(prefix) {
+            const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), prefix));
+            owned.push(dir);
+            return dir;
+        },
+        get owned() {
+            return [...owned];
+        },
+        cleanup() {
+            const failed = [];
+            let removed = 0;
+            // Drained rather than iterated: a second call must not retry a path this
+            // one already removed, and a throw mid-loop must not leave the list half
+            // consumed in a way that hides what is still owned.
+            const mine = owned.splice(0, owned.length);
+            for (const dir of mine) {
+                try {
+                    (0, node_fs_1.rmSync)(dir, { recursive: true, force: true, maxRetries: 2 });
+                    removed += 1;
+                }
+                catch {
+                    failed.push(dir);
+                }
+            }
+            return { removed, failed };
+        },
+    };
+}
+//# sourceMappingURL=temp-fixtures.js.map

package/dist/temp-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-fixtures.js","sourceRoot":"","sources":["../src/temp-fixtures.ts"],"names":[],"mappings":";;AAqEA,sCA6BC;AAlGD,qCAA8C;AAC9C,qCAAiC;AACjC,yCAAiC;AAmEjC,SAAgB,aAAa;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,OAAO;QACL,IAAI,CAAC,MAAc;YACjB,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,OAAO;YACL,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,yEAAyE;YACzE,yEAAyE;YACzE,oDAAoD;YACpD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,IAAA,gBAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/token-window.d.ts

@@ -0,0 +1,84 @@
+import { type SpendRecord } from './spend-ledger';
+/**
+ * WHAT A WINDOW OF WORK COST IN TOKENS, AND WHETHER THAT CAN BE SAID AT ALL.
+ *
+ * 🔴 THE FIGURES WERE RECORDED AND NOBODY READ THEM. `inputTokens` and
+ * `outputTokens` have been parsed out of every envelope and written onto every
+ * spend row since they were added, and the only reader of that ledger sums
+ * `usd`. The two cache counts were not even parsed — `costOf` stopped one line
+ * short of them — so the question "did this night pay again for context it
+ * already had" had no answer anywhere, which is the capability audit's E-05.
+ *
+ * ⚠️ THE MONEY RULE, UNCHANGED, RATHER THAN A SOFTER SECOND ONE. `spendInWindow`
+ * reports `usd: null` the moment one charged row in the window is silent,
+ * because adding up the rows that did report and calling it the total is "a
+ * number that looks like a measurement and is not one". The same applies here
+ * and for the same reason — the audit says any context-reuse figure "would be
+ * an estimate, and must be labelled so" — and a reader who has learned the rule
+ * once does not have to learn a second one that behaves differently.
+ *
+ * ⚠️ EACH FIGURE REFUSES SEPARATELY. A provider may report input and output and
+ * say nothing about its cache, and that is not a reason to throw away the two
+ * numbers it did give. So `input` can be a number while `cacheRead` is null.
+ *
+ * ⚠️ AND `null` IS NEVER LEFT BARE. `invocations` and `reported` travel with it,
+ * so "cannot say" always arrives with the count that explains it.
+ *
+ * ⚠️ THIS IS NOT ON CORE'S `Spend`. That type feeds `withinEnvelope`, which is a
+ * CEILING — a safety decision about money and concurrency. Widening a safety
+ * type to carry a reporting figure is how a reporting bug becomes a ceiling
+ * bug, so this is its own view over the same records.
+ */
+/**
+ * The window used when a machine declares no envelope of its own.
+ *
+ * Eight hours: a night, which is the unit this system is about. It lives here
+ * rather than in the command so the figure and the rule that governs it stay
+ * in one file.
+ */
+export declare const DEFAULT_TOKEN_WINDOW_MS: number;
+export interface TokenTotals {
+    /** Null when one charged invocation in the window did not report this figure. */
+    readonly input: number | null;
+    readonly output: number | null;
+    readonly cacheRead: number | null;
+    readonly cacheWrite: number | null;
+    /** Charged invocations in the window — what the figures above are over. */
+    readonly invocations: number;
+    /** How many of those reported each figure, so a null is never mysterious. */
+    readonly reported: {
+        readonly input: number;
+        readonly output: number;
+        readonly cacheRead: number;
+        readonly cacheWrite: number;
+    };
+}
+export type TokenView = {
+    readonly ok: true;
+    readonly tokens: TokenTotals;
+} | {
+    readonly ok: false;
+    readonly because: string;
+};
+/**
+ * A row that represents work actually done.
+ *
+ * Reservations and cancellations are money-shaped bookkeeping — a hold placed
+ * and a hold released — and neither ever carried a token count. Counting them
+ * as silent invocations would make every window unmeasurable for a reason that
+ * has nothing to do with what a provider reported.
+ */
+export declare function isChargedInvocation(r: SpendRecord): boolean;
+export declare function totalsOf(records: readonly SpendRecord[]): TokenTotals;
+/** The window ending now, read from this machine's spend ledger. */
+export declare function tokensInWindow(now: number, windowMs: number, home?: string): TokenView;
+/**
+ * The one line `looply doctor` prints.
+ *
+ * It never prints a bare number for a figure it cannot stand behind, and it
+ * never prints "cannot say" without the count that explains it — a reader who
+ * is told a figure is unavailable deserves to know whether that is because
+ * nothing ran or because their provider is quiet.
+ */
+export declare function tokenLine(view: TokenView, windowMs: number): string;
+//# sourceMappingURL=token-window.d.ts.map

package/dist/token-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-window.d.ts","sourceRoot":"","sources":["../src/token-window.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAqB,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAE3D;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CA0CrE;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,SAAS,CAWjG;AAKD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiBnE"}

package/dist/token-window.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TOKEN_WINDOW_MS = void 0;
+exports.isChargedInvocation = isChargedInvocation;
+exports.totalsOf = totalsOf;
+exports.tokensInWindow = tokensInWindow;
+exports.tokenLine = tokenLine;
+const node_os_1 = require("node:os");
+const spend_ledger_1 = require("./spend-ledger");
+/**
+ * WHAT A WINDOW OF WORK COST IN TOKENS, AND WHETHER THAT CAN BE SAID AT ALL.
+ *
+ * 🔴 THE FIGURES WERE RECORDED AND NOBODY READ THEM. `inputTokens` and
+ * `outputTokens` have been parsed out of every envelope and written onto every
+ * spend row since they were added, and the only reader of that ledger sums
+ * `usd`. The two cache counts were not even parsed — `costOf` stopped one line
+ * short of them — so the question "did this night pay again for context it
+ * already had" had no answer anywhere, which is the capability audit's E-05.
+ *
+ * ⚠️ THE MONEY RULE, UNCHANGED, RATHER THAN A SOFTER SECOND ONE. `spendInWindow`
+ * reports `usd: null` the moment one charged row in the window is silent,
+ * because adding up the rows that did report and calling it the total is "a
+ * number that looks like a measurement and is not one". The same applies here
+ * and for the same reason — the audit says any context-reuse figure "would be
+ * an estimate, and must be labelled so" — and a reader who has learned the rule
+ * once does not have to learn a second one that behaves differently.
+ *
+ * ⚠️ EACH FIGURE REFUSES SEPARATELY. A provider may report input and output and
+ * say nothing about its cache, and that is not a reason to throw away the two
+ * numbers it did give. So `input` can be a number while `cacheRead` is null.
+ *
+ * ⚠️ AND `null` IS NEVER LEFT BARE. `invocations` and `reported` travel with it,
+ * so "cannot say" always arrives with the count that explains it.
+ *
+ * ⚠️ THIS IS NOT ON CORE'S `Spend`. That type feeds `withinEnvelope`, which is a
+ * CEILING — a safety decision about money and concurrency. Widening a safety
+ * type to carry a reporting figure is how a reporting bug becomes a ceiling
+ * bug, so this is its own view over the same records.
+ */
+/**
+ * The window used when a machine declares no envelope of its own.
+ *
+ * Eight hours: a night, which is the unit this system is about. It lives here
+ * rather than in the command so the figure and the rule that governs it stay
+ * in one file.
+ */
+exports.DEFAULT_TOKEN_WINDOW_MS = 8 * 60 * 60 * 1000;
+/**
+ * A row that represents work actually done.
+ *
+ * Reservations and cancellations are money-shaped bookkeeping — a hold placed
+ * and a hold released — and neither ever carried a token count. Counting them
+ * as silent invocations would make every window unmeasurable for a reason that
+ * has nothing to do with what a provider reported.
+ */
+function isChargedInvocation(r) {
+    return r.kind === undefined || r.kind === 'spend' || r.kind === 'settlement';
+}
+function totalsOf(records) {
+    const fields = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens'];
+    const sums = {
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheWriteTokens: 0,
+    };
+    const said = {
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheWriteTokens: 0,
+    };
+    let invocations = 0;
+    for (const r of records) {
+        if (!isChargedInvocation(r))
+            continue;
+        invocations += 1;
+        for (const f of fields) {
+            const v = r[f];
+            if (typeof v === 'number' && Number.isFinite(v) && v >= 0) {
+                sums[f] += v;
+                said[f] += 1;
+            }
+        }
+    }
+    // Complete or nothing, per figure. An empty window is complete and zero:
+    // nothing ran, which is a fact rather than a gap.
+    const total = (f) => (said[f] === invocations ? sums[f] : null);
+    return {
+        input: total('inputTokens'),
+        output: total('outputTokens'),
+        cacheRead: total('cacheReadTokens'),
+        cacheWrite: total('cacheWriteTokens'),
+        invocations,
+        reported: {
+            input: said.inputTokens,
+            output: said.outputTokens,
+            cacheRead: said.cacheReadTokens,
+            cacheWrite: said.cacheWriteTokens,
+        },
+    };
+}
+/** The window ending now, read from this machine's spend ledger. */
+function tokensInWindow(now, windowMs, home = (0, node_os_1.homedir)()) {
+    const read = (0, spend_ledger_1.readSpend)(home);
+    if (!read.ok)
+        return { ok: false, because: read.because };
+    const since = now - windowMs;
+    // The same bounds `spendInWindow` uses: a row stamped later than this
+    // reader's clock is still somebody's, and excluding it flatters the machine.
+    const inWindow = read.records.filter((r) => {
+        const at = Date.parse(r.at);
+        return Number.isFinite(at) && at >= since;
+    });
+    return { ok: true, tokens: totalsOf(inWindow) };
+}
+const thousands = (n) => n >= 1_000_000 ? `${(n / 1_000_000).toFixed(1)}M` : n >= 1_000 ? `${Math.round(n / 1_000)}k` : String(n);
+/**
+ * The one line `looply doctor` prints.
+ *
+ * It never prints a bare number for a figure it cannot stand behind, and it
+ * never prints "cannot say" without the count that explains it — a reader who
+ * is told a figure is unavailable deserves to know whether that is because
+ * nothing ran or because their provider is quiet.
+ */
+function tokenLine(view, windowMs) {
+    if (!view.ok)
+        return `tokens  : cannot be read — ${view.because}`;
+    const t = view.tokens;
+    const hours = Math.round(windowMs / 3_600_000);
+    const over = `last ${hours}h`;
+    if (t.invocations === 0)
+        return `tokens  : ${over} — nothing has run`;
+    const fig = (label, v, said) => v === null ? `${label} not reported by ${t.invocations - said} of ${t.invocations}` : `${label} ${thousands(v)}`;
+    return (`tokens  : ${over}, ${t.invocations} invocation${t.invocations === 1 ? '' : 's'} — ` +
+        [
+            fig('in', t.input, t.reported.input),
+            fig('out', t.output, t.reported.output),
+            fig('cache read', t.cacheRead, t.reported.cacheRead),
+            fig('cache written', t.cacheWrite, t.reported.cacheWrite),
+        ].join(' · '));
+}
+//# sourceMappingURL=token-window.js.map

package/dist/token-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-window.js","sourceRoot":"","sources":["../src/token-window.ts"],"names":[],"mappings":";;;AAwEA,kDAEC;AAED,4BA0CC;AAGD,wCAWC;AAaD,8BAiBC;AAlKD,qCAAkC;AAClC,iDAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAuB1D;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,CAAc;IAChD,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;AAC/E,CAAC;AAED,SAAgB,QAAQ,CAAC,OAA+B;IACtD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,CAAU,CAAC;IAC/F,MAAM,IAAI,GAA4C;QACpD,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,CAAC;KACpB,CAAC;IACF,MAAM,IAAI,GAA4C;QACpD,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,CAAC;KACpB,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,SAAS;QACtC,WAAW,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxG,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC;QACnC,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC;QACrC,WAAW;QACX,QAAQ,EAAE;YACR,KAAK,EAAE,IAAI,CAAC,WAAW;YACvB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,SAAS,EAAE,IAAI,CAAC,eAAe;YAC/B,UAAU,EAAE,IAAI,CAAC,gBAAgB;SAClC;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,cAAc,CAAC,GAAW,EAAE,QAAgB,EAAE,OAAe,IAAA,iBAAO,GAAE;IACpF,MAAM,IAAI,GAAG,IAAA,wBAAS,EAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,GAAG,GAAG,QAAQ,CAAC;IAC7B,sEAAsE;IACtE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CACtC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAE3G;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,IAAe,EAAE,QAAgB;IACzD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,8BAA8B,IAAI,CAAC,OAAO,EAAE,CAAC;IAClE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,KAAK,GAAG,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC;QAAE,OAAO,aAAa,IAAI,oBAAoB,CAAC;IACtE,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,CAAgB,EAAE,IAAY,EAAU,EAAE,CACpE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC,WAAW,GAAG,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,OAAO,CACL,aAAa,IAAI,KAAK,CAAC,CAAC,WAAW,cAAc,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK;QACpF;YACE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACvC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC1D,CAAC,IAAI,CAAC,KAAK,CAAC,CACd,CAAC;AACJ,CAAC"}

package/dist/tool-bridge.d.ts

@@ -0,0 +1,177 @@
+import { type SharedGrantDeps } from './shared-grants';
+import { type ToolchainResult } from './toolchain-mirror';
+import { type ToolName, type ToolResponse } from './tool-protocol';
+import { type UntrustedExecutionBackend } from './untrusted-exec';
+import { type ToolCallRecorder } from './tool-call-record';
+import { type ActionRequest, type BuildActionErrorCode, type TrustedActionContext } from '@looply/core';
+/** The worker script, somewhere the container can read and cannot write. */
+export declare function toolWorkerRoot(deps?: ToolBridgeDeps): string;
+/**
+ * Put the worker where a contained process can read it.
+ *
+ * READ ONLY, and keyed by content. The worker is the one thing in this design
+ * that runs with the container's grants, so a directory the container could
+ * write would be a directory it could replace the worker in — which is the same
+ * as having no worker policy at all.
+ */
+export declare function ensureToolWorker(deps?: ToolBridgeDeps): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    because: string;
+};
+export interface ToolBridgeDeps {
+    backend?: UntrustedExecutionBackend;
+    toolchain?: () => ToolchainResult;
+    /** Overridable so tests never write to the shared worker root. */
+    workerRoot?: string;
+    /** Overridable so a test can point at a different worker build. */
+    workerSource?: string;
+    now?: () => number;
+    /** Per-call ceiling. A worker that hangs must not hang the session. */
+    timeoutMs?: number;
+    /**
+     * Who this run is and what it is working on.
+     *
+     * Absent means no action can be proposed at all — fail closed rather than
+     * invent an identity, because the identity is half of what an approval is
+     * about.
+     */
+    actionContext?: TrustedActionContext;
+    /**
+     * Where what was served is written down (the audit's G-05).
+     *
+     * Absent means nothing is kept — which is every caller that has no run to
+     * attach it to, and is byte for byte what this did before the record existed.
+     * See `tool-call-record.ts` for why the run id is the switch.
+     */
+    record?: ToolCallRecorder;
+    /**
+     * F43: WHERE THE SHARED-GRANT LEDGER AND ITS LOCK LIVE — the machine's, handed
+     * over by the trusted launcher (`mcp-main.ts`).
+     *
+     * Absent means `homedir()`, and inside a provider session that is the sterile
+     * session directory: every role kept its own ledger and its own lock, so an
+     * agent's grant was serialised against no other grant (`icacls` is a
+     * read-modify-write of one DACL) and was released by nothing — retirement reads
+     * the machine ledger only.
+     */
+    sharedGrants?: SharedGrantDeps;
+}
+/** What one role is allowed to ask for. */
+export interface ToolPolicy {
+    readonly role: string;
+    readonly tools: readonly ToolName[];
+}
+/**
+ * The seam a consequential tool will one day arrive through.
+ *
+ * A tool that can push, deploy or send does NOT get an executor here. It gets
+ * this: the model describes what it wants, Looply turns that into a structured
+ * request with an exact fingerprint, and the request goes off to be approved by
+ * a person. Nothing in this phase can carry any of them out, and there is no
+ * approval state — that is the next slice.
+ *
+ * WHAT THE MODEL DOES NOT SUPPLY. The project and the actor come from the run
+ * that is executing, injected below. A model that could name its own project
+ * would make "approve this for project A" authorise something in project B, and
+ * one that could name its own actor would be able to sign as a person.
+ */
+export type ActionOutcome = {
+    readonly ok: true;
+    readonly request: ActionRequest;
+} | {
+    readonly ok: false;
+    readonly code: BuildActionErrorCode | 'no_context';
+    readonly because: string;
+};
+export interface ToolBridge {
+    call(req: unknown): Promise<ToolResponse>;
+    /**
+     * Describe a consequential action as data. Executes nothing, stores nothing.
+     *
+     * `type` and `payload` are model input and are validated to death; the
+     * trusted context is the run's own and is never taken from either.
+     */
+    proposeAction(type: unknown, payload: unknown, note?: string): ActionOutcome;
+    /** What has been spent so far, for tests and for logging. */
+    spent(): {
+        calls: number;
+        bytesRead: number;
+        bytesWritten: number;
+    };
+}
+/**
+ * A bridge for one project and one role.
+ *
+ * The budget is per bridge, which is per provider invocation. It exists because
+ * the model may call tools as many times as it likes inside one session and
+ * nobody is watching the loop. It is NOT the Goal or autonomy budget — those
+ * count provider invocations and belong to Phase 6, which this must not touch.
+ */
+export declare function makeToolBridge(projectDir: string, policy: ToolPolicy, deps?: ToolBridgeDeps): ToolBridge;
+/**
+ * What each role may call.
+ *
+ * LEAST PRIVILEGE BY ROLE, derived from what each one actually does rather than
+ * granted by habit. The implementer changes code, so it edits and writes. The
+ * verifier and the scanner form a judgement about code that already exists;
+ * neither has ever needed to change it, and giving them write access would be
+ * handing out authority nothing asked for.
+ *
+ * Nobody gets a shell. There is no tool here that runs anything at all —
+ * project code is executed in exactly one place, the gate, under Looply's own
+ * orchestration and never at the model's request.
+ */
+export declare const TOOL_POLICIES: {
+    readonly implementer: {
+        readonly role: "implementer";
+        readonly tools: readonly ["read", "glob", "grep", "edit", "write"];
+    };
+    readonly verifier: {
+        readonly role: "verifier";
+        readonly tools: readonly ["read", "glob", "grep"];
+    };
+    readonly scanner: {
+        readonly role: "scanner";
+        readonly tools: readonly ["read", "glob", "grep"];
+    };
+    /**
+     * THE BRAIN. READ, GLOB, GREP — AND NOTHING THAT CHANGES ANYTHING.
+     *
+     * 🔴 IT PROPOSES; IT NEVER ACTS. A brain that could `edit` would be a second
+     * implementer with none of the first one's gate, and a brain that could
+     * `write` would be able to manufacture the very evidence its proposals are
+     * checked against. The narrowest role in the table is the one belonging to
+     * the only component that reasons.
+     *
+     * ⚠️ ENFORCED TWICE, LIKE THE OTHER THREE — once where the policy is applied
+     * and once at the bridge — because a single check is a single line to delete.
+     */
+    readonly brain: {
+        readonly role: "brain";
+        readonly tools: readonly ["read", "glob", "grep"];
+    };
+    /**
+     * THE PROVER. READ, GLOB, GREP — THE SECOND KEY GRADES THE TREE; IT NEVER TOUCHES IT.
+     *
+     * 🔴 IT WAS LENT THE IMPLEMENTER'S TRANSPORT. `run-cmd.ts` handed `runProver`
+     * the same invoke as the round, so the prover ran with `edit` and `write` —
+     * while its own prompt told it "read-only access … you must not modify
+     * anything". The prompt asked; nothing enforced. MEASURED, LIVE, 2026-09-24
+     * (LIVE-1 run 2): the prover's bridge was launched as role `implementer` with
+     * `mcp__looply__edit,mcp__looply__write` allowed, between a GREEN gate and
+     * the commit — the one window in a round where a write is kept without being
+     * gated — and its spend was booked as the implementer's.
+     *
+     * ⚠️ ENFORCED TWICE, LIKE THE OTHERS: the allowlist on the provider's
+     * command line, and the bridge, which refuses a tool the role does not hold.
+     */
+    readonly prover: {
+        readonly role: "prover";
+        readonly tools: readonly ["read", "glob", "grep"];
+    };
+};
+export type ToolRole = keyof typeof TOOL_POLICIES;
+//# sourceMappingURL=tool-bridge.d.ts.map

package/dist/tool-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-bridge.d.ts","sourceRoot":"","sources":["../src/tool-bridge.ts"],"names":[],"mappings":"AAWA,OAAO,EAAsB,KAAK,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAKL,KAAK,QAAQ,EAEb,KAAK,YAAY,EAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AAwCtB,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,GAAE,cAAmB,GAAG,MAAM,CAEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoBvH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,eAAe,CAAC;IAClC,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;CAChC;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzG,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IAC7E,6DAA6D;IAC7D,KAAK,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACrE;AAkDD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,cAAmB,GACxB,UAAU,CA0IZ;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;IAIxB;;;;;;;;;;;OAWG;;;;;IAEH;;;;;;;;;;;;;;OAcG;;;;;CAE0C,CAAC;AAEhD,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,aAAa,CAAC"}