looply-cli 0.0.0-stage → 0.2.0

package/dist/untrusted-gate.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTAINMENT_PREFLIGHT_STEP = void 0;
+exports.makeUntrustedGateRunner = makeUntrustedGateRunner;
+exports.makeContainmentPreflight = makeContainmentPreflight;
+const toolchain_mirror_1 = require("./toolchain-mirror");
+const node_path_1 = require("node:path");
+const exec_domains_1 = require("./exec-domains");
+const untrusted_exec_1 = require("./untrusted-exec");
+const shared_grants_1 = require("./shared-grants");
+/**
+ * A {@link CommandRunner} that runs each step contained.
+ *
+ * `projectDir` is both the worktree granted to the container and the cwd the
+ * step runs in, so a step can never be executed against a directory other than
+ * the one it was written for.
+ */
+function makeUntrustedGateRunner(projectDir, deps = {}) {
+    const backend = deps.backend ?? new untrusted_exec_1.AppContainerBackend();
+    const now = deps.now ?? (() => Date.now());
+    const ensureToolchain = deps.toolchain ?? (() => (0, toolchain_mirror_1.ensureToolchainMirror)());
+    const shell = deps.shell ?? (0, node_path_1.join)((0, untrusted_exec_1.systemRoot)(), 'System32', 'cmd.exe');
+    return async (cmd, timeoutMs) => {
+        const started = now();
+        // The runtime the step will use, copied where the container can reach it.
+        // Without this there is no `node` inside the container at all, so a
+        // toolchain that cannot be mirrored is a step that cannot run — never a
+        // step that quietly runs on the host instead.
+        const tools = ensureToolchain();
+        if (!tools.ok) {
+            return {
+                ok: false,
+                // The step did not run. Not the project's fault, so not the item's bill.
+                unavailable: true,
+                timedOut: false,
+                ms: now() - started,
+                output: `this step did not run: no contained toolchain — ${tools.because}`,
+            };
+        }
+        /*
+         * The shared toolchain is granted under the shared-grant lock, before the
+         * launch and outside it — the critical section is one ACL write, never a
+         * gate step. An identity that already holds it does no work here at all.
+         */
+        const shared = await (0, shared_grants_1.ensureSharedAccess)(backend instanceof untrusted_exec_1.AppContainerBackend ? backend : null, (0, untrusted_exec_1.containerName)('gate', projectDir), (0, exec_domains_1.sharedGrantPaths)(tools.path));
+        if (!shared.ok) {
+            return {
+                ok: false,
+                // The step did not run, and not for the project's reasons.
+                unavailable: true,
+                timedOut: false,
+                ms: now() - started,
+                output: `this step did not run: the shared toolchain grant failed — ${shared.because}`,
+            };
+        }
+        const out = await backend.run({
+            kind: 'gate',
+            projectKey: projectDir,
+            executable: shell,
+            // The step is a shell line by contract, so it is handed to the shell as
+            // one argument rather than split — splitting it here would change what
+            // every existing project's gate means.
+            argv: ['/d', '/s', '/c', cmd],
+            // `cmd /s /c "<line>"` — one pair of quotes that cmd strips, leaving the
+            // line verbatim. Quoting each argument by C-runtime rules would escape
+            // the step's own quotes into something cmd cannot read.
+            rawCommandLine: `"${shell}" /d /s /c "${cmd}"`,
+            cwd: projectDir,
+            env: (0, exec_domains_1.buildUntrustedGateEnv)(projectDir, tools.path),
+            // Run-OWNED paths only. The shared toolchain was granted above, under the
+            // shared-grant lock, so it is not re-granted per launch — that per-launch
+            // grant is what accumulated one permanent ACE per identity.
+            grants: (0, exec_domains_1.untrustedGrants)('gate', projectDir),
+            protect: (0, exec_domains_1.protectedPaths)(projectDir),
+            // A test suite that needs the network is reaching outside the change it
+            // is meant to be checking.
+            network: 'none',
+            timeoutMs,
+        });
+        if (!out.ok) {
+            return {
+                ok: false,
+                // Same class as the missing toolchain above: containment could not be
+                // made, so nothing about the project was measured.
+                unavailable: true,
+                timedOut: false,
+                ms: now() - started,
+                output: `this step did not run: untrusted execution was unavailable ` +
+                    `(${out.reason} at ${out.stage}) — ${out.because}`,
+            };
+        }
+        return {
+            ok: out.exitCode === 0 && !out.timedOut,
+            // The status itself, not only the verdict folded from it: a rejected
+            // candidate's evidence records "exited 2", never just "failed".
+            exitCode: out.exitCode,
+            timedOut: out.timedOut,
+            ms: now() - started,
+            // Interleaved the way the previous runner reported it, so existing
+            // diagnostics read the same.
+            output: `${out.stdout}${out.stderr}`,
+        };
+    };
+}
+/**
+ * The step a containment preflight runs.
+ *
+ * A `rem` is cmd.exe's comment: it starts, does nothing and exits 0. What is
+ * being measured is not the command — it is whether a container could be made
+ * to run one in at all.
+ */
+exports.CONTAINMENT_PREFLIGHT_STEP = 'rem looply-containment-preflight';
+/**
+ * ASK WHETHER A CONTAINER CAN ACTUALLY BE MADE, BEFORE PAYING FOR A MODEL TURN.
+ *
+ * `AppContainerBackend.probe()` answers a strictly earlier question. It returns
+ * as soon as a profile can be created or derived, and never reaches the grant,
+ * protect or launch stages — measured on one machine in one script: `probe`
+ * returned ok while a real `run` failed at `grant`, and again at `launch`.
+ * So a green probe does not mean a gate step can run.
+ *
+ * This runs the real thing through the real runner: same backend, same `gate`
+ * profile, same `unavailable` flag, same classification. There is no new
+ * vocabulary and no second code path to keep honest.
+ *
+ * ⚠️ THE GRANT SET IS DELIBERATELY SMALL, and this is not a shortcut. Granting
+ * the toolchain mirror propagates an inheritable ACE across 166 MB — measured at
+ * ~6.5 s against ~0.57 s for the project directory alone — and it proves nothing
+ * the small grant does not. Anyone "making the preflight faithful" by reusing
+ * `untrustedGrants` buys a 10x cost for no signal.
+ *
+ * ⚠️ IT COVERS THE `gate` PROFILE ONLY. The tool bridge uses `kind:'agent'`, a
+ * different profile from a different `CreateAppContainerProfile` call. A machine
+ * that can make neither is caught; one that can make the gate's and not the
+ * agent's is not. Closing that needs a second preflight through the bridge's own
+ * backend seam, and it is not this change.
+ */
+function makeContainmentPreflight(projectDir, deps = {}) {
+    const backend = deps.backend ?? new untrusted_exec_1.AppContainerBackend();
+    const now = deps.now ?? (() => Date.now());
+    const ensureToolchain = deps.toolchain ?? (() => (0, toolchain_mirror_1.ensureToolchainMirror)());
+    const shell = 
+    // ⚠️ DOUBLED. `'C:\Windows'` is the RELATIVE path `C:Windows` — `\W` is not
+    // an escape, so the backslash is dropped and `isAbsolute` is false. This
+    // repository has a suite named for that bug, and the first version of this
+    // line reintroduced it by copying the one above and losing the escape.
+    deps.shell ?? (0, node_path_1.join)((0, untrusted_exec_1.systemRoot)(), 'System32', 'cmd.exe');
+    return async () => {
+        const started = now();
+        // Asked first, exactly as the gate runner asks it: a machine with no
+        // mirrored runtime cannot run a step either, and must give the same answer.
+        const tools = ensureToolchain();
+        if (!tools.ok) {
+            return {
+                ok: false,
+                unavailable: true,
+                timedOut: false,
+                ms: now() - started,
+                output: `containment preflight: no contained toolchain — ${tools.because}`,
+            };
+        }
+        const out = await backend.run({
+            kind: 'gate',
+            projectKey: projectDir,
+            executable: shell,
+            argv: ['/d', '/s', '/c', exports.CONTAINMENT_PREFLIGHT_STEP],
+            rawCommandLine: `"${shell}" /d /s /c "${exports.CONTAINMENT_PREFLIGHT_STEP}"`,
+            cwd: projectDir,
+            env: (0, exec_domains_1.buildUntrustedGateEnv)(projectDir, tools.path),
+            /**
+             * THE PROJECT DIRECTORY AND THE PROTECT LIST ARE NOT OPTIONAL.
+             *
+             * The first version granted only the contained root and passed an empty
+             * protect list — a directory the daemon had `mkdirSync`'d microseconds
+             * earlier under its own `%TEMP%`, which it therefore always owns and can
+             * always ACL. So the grant failure this preflight exists to catch was one
+             * it could not reproduce, and the protect stage — which fails CLOSED on
+             * any path it cannot ACL, and which Phase 0 taught to include the resolved
+             * gitdir, `<super>/.git/modules/<name>` for a submodule — was invisible to
+             * it.
+             *
+             * ⚠️ THE TOOLCHAIN MIRROR STAYS OUT, and that is the documented gap
+             * rather than a claim of parity: its inheritable ACE propagates across
+             * 166 MB, ~6.5 s against ~0.57 s. So `doctor` and `run` CAN still disagree
+             * about a machine that fails only on the mirror.
+             */
+            grants: [
+                { path: projectDir, write: true },
+                { path: (0, exec_domains_1.containedRoot)('gate', projectDir), write: true },
+            ],
+            protect: (0, exec_domains_1.protectedPaths)(projectDir),
+            network: 'none',
+            timeoutMs: 30_000,
+        });
+        if (!out.ok) {
+            return {
+                ok: false,
+                unavailable: true,
+                timedOut: false,
+                ms: now() - started,
+                output: `containment preflight: a container could not be made ` +
+                    `(${out.reason} at ${out.stage}) — ${out.because}`,
+            };
+        }
+        /**
+         * ⚠️ READ `exitCode` AND `timedOut`, exactly as the gate runner above does.
+         *
+         * The first version returned `{ok:true, timedOut:false}` unconditionally, so
+         * a container that launched and was then killed at the child ceiling was
+         * reported as a HEALTHY environment — and its timeout was not merely
+         * unreported but denied.
+         */
+        if (out.exitCode !== 0 || out.timedOut) {
+            return {
+                ok: false,
+                unavailable: true,
+                timedOut: out.timedOut,
+                ms: now() - started,
+                output: `containment preflight: a container was made but its process did not complete ` +
+                    `(exit ${out.exitCode}${out.timedOut ? ', timed out' : ''})`,
+            };
+        }
+        return { ok: true, timedOut: false, ms: now() - started };
+    };
+}
+//# sourceMappingURL=untrusted-gate.js.map

package/dist/untrusted-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-gate.js","sourceRoot":"","sources":["../src/untrusted-gate.ts"],"names":[],"mappings":";;;AAsDA,0DAiGC;AAoCD,4DA6FC;AAxRD,yDAAiF;AACjF,yCAAiC;AAEjC,iDAMwB;AACxB,qDAK0B;AAC1B,mDAAqE;AA+BrE;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,UAAkB,EAClB,OAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,oCAAmB,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,wCAAqB,GAAE,CAAC,CAAC;IAC1E,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,IAAA,gBAAI,EAAC,IAAA,2BAAU,GAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAE1D,OAAO,KAAK,EAAE,GAAW,EAAE,SAAiB,EAA0B,EAAE;QACtE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,8CAA8C;QAC9C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,yEAAyE;gBACzE,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,KAAK;gBACf,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;gBACnB,MAAM,EAAE,mDAAmD,KAAK,CAAC,OAAO,EAAE;aAC3E,CAAC;QACJ,CAAC;QACD;;;;WAIG;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,kCAAkB,EACrC,OAAO,YAAY,oCAAmB,CAAC,CAAC,CAAE,OAAgC,CAAC,CAAC,CAAC,IAAI,EACjF,IAAA,8BAAa,EAAC,MAAM,EAAE,UAAU,CAAC,EACjC,IAAA,+BAAgB,EAAC,KAAK,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,2DAA2D;gBAC3D,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,KAAK;gBACf,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;gBACnB,MAAM,EAAE,8DAA8D,MAAM,CAAC,OAAO,EAAE;aACvF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK;YACjB,wEAAwE;YACxE,uEAAuE;YACvE,uCAAuC;YACvC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;YAC7B,yEAAyE;YACzE,uEAAuE;YACvE,wDAAwD;YACxD,cAAc,EAAE,IAAI,KAAK,eAAe,GAAG,GAAG;YAC9C,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,IAAA,oCAAqB,EAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;YAClD,0EAA0E;YAC1E,0EAA0E;YAC1E,4DAA4D;YAC5D,MAAM,EAAE,IAAA,8BAAe,EAAC,MAAM,EAAE,UAAU,CAAC;YAC3C,OAAO,EAAE,IAAA,6BAAc,EAAC,UAAU,CAAC;YACnC,wEAAwE;YACxE,2BAA2B;YAC3B,OAAO,EAAE,MAAM;YACf,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,sEAAsE;gBACtE,mDAAmD;gBACnD,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,KAAK;gBACf,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;gBACnB,MAAM,EACJ,6DAA6D;oBAC7D,IAAI,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YACvC,qEAAqE;YACrE,gEAAgE;YAChE,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;YACnB,mEAAmE;YACnE,6BAA6B;YAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,kCAAkC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,wBAAwB,CACtC,UAAkB,EAClB,OAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,oCAAmB,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,wCAAqB,GAAE,CAAC,CAAC;IAC1E,MAAM,KAAK;IACT,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,CAAC,KAAK,IAAI,IAAA,gBAAI,EAAC,IAAA,2BAAU,GAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAE1D,OAAO,KAAK,IAA4B,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;QACtB,qEAAqE;QACrE,4EAA4E;QAC5E,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,KAAK;gBACf,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;gBACnB,MAAM,EAAE,mDAAmD,KAAK,CAAC,OAAO,EAAE;aAC3E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,kCAA0B,CAAC;YACpD,cAAc,EAAE,IAAI,KAAK,eAAe,kCAA0B,GAAG;YACrE,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,IAAA,oCAAqB,EAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;YAClD;;;;;;;;;;;;;;;;eAgBG;YACH,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;gBACjC,EAAE,IAAI,EAAE,IAAA,4BAAa,EAAC,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;aACzD;YACD,OAAO,EAAE,IAAA,6BAAc,EAAC,UAAU,CAAC;YACnC,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,KAAK;gBACf,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;gBACnB,MAAM,EACJ,uDAAuD;oBACvD,IAAI,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE;aACrD,CAAC;QACJ,CAAC;QACD;;;;;;;WAOG;QACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,WAAW,EAAE,IAAI;gBACjB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO;gBACnB,MAAM,EACJ,+EAA+E;oBAC/E,SAAS,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG;aAC/D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC"}

package/dist/uploader.d.ts

@@ -0,0 +1,153 @@
+import { type AnyEvent } from '@looply/core';
+/**
+ * The event uploader — the machine half of DESIGN §12 case 23: server unreachable
+ * for an hour → events buffer locally, replay in order, no gaps.
+ *
+ * The ledger on disk is the truth; the server is a mirror that may lag. This
+ * class owns the lag: events are enqueued as the ledger appends them, and
+ * `flush()` ships them in `(runId, seq)` order. A transport failure is an
+ * *outcome*, never a throw — the run must keep working while the server is away,
+ * so the failed batch and everything after it stay buffered and the next flush
+ * resumes exactly where this one stopped.
+ *
+ * Resume is driven by the server's own acknowledgements: every ingest response
+ * carries `cursors`, the highest seq the server now holds per run. Anything at
+ * or below that head is dropped locally instead of re-sent. After a process
+ * restart the caller primes those cursors (or simply replays the ledger —
+ * ingest is idempotent on `(runId, seq)`, so overlap is duplicates, not damage).
+ *
+ * The buffer is capped (`DEFAULT_BUFFER_LIMIT`): case 23 says an hour offline,
+ * not a week, and memory is the one resource whose exhaustion ends the run the
+ * buffering was protecting.
+ */
+/** Mirror of the server's `IngestResult` — the ack a successful POST returns. */
+export interface IngestAck {
+    accepted: number;
+    duplicates: number;
+    rejected: number;
+    /** Highest seq the server now holds per run — the cursor this class trusts. */
+    cursors: Record<string, number>;
+}
+/** Injected transport: one POST to `/v1/projects/:id/events`. Throws on failure. */
+export interface UploadTransport {
+    post(projectId: string, events: readonly AnyEvent[]): Promise<IngestAck>;
+}
+export interface FlushResult {
+    /** Events the server's ledger now holds — its own `accepted + duplicates`. */
+    delivered: number;
+    /**
+     * Events the server took but did not account for, cumulative.
+     *
+     * A 200 is not proof of storage. The server drops a malformed event, and
+     * silently drops one addressed to a different project than the URL — for a
+     * long time that was *every* event a run produced, and this class reported
+     * complete delivery of all of them. Anything a POST does not account for
+     * lands here so it can be said out loud instead of inferred from a phone that
+     * never moves.
+     */
+    unacked?: number;
+    /** Events dropped locally because the server's head already covers their seq. */
+    skipped: number;
+    /** Events still waiting after this flush — non-zero only on `error`. */
+    buffered: number;
+    /** Present when the transport failed; the unsent tail is retained, not lost. */
+    error?: string;
+    /** Present when the cap has thrown events away; cumulative, not per-flush. */
+    dropped?: number;
+}
+/**
+ * How many events may wait for a server that is not answering.
+ *
+ * A round emits on the order of tens of events, so this holds a long outage —
+ * many hours of running — before anything is thrown away. It exists because
+ * "buffer until the server returns" and "never end the run" cannot both be
+ * unconditional: an uploader with no ceiling turns a network outage into an
+ * out-of-memory kill, which loses the *whole* run rather than a prefix of its
+ * mirror. The ledger on disk is still complete either way.
+ */
+export declare const DEFAULT_BUFFER_LIMIT = 5000;
+export declare class EventUploader {
+    private readonly projectId;
+    private readonly transport;
+    /** Server rejects batches over 1000; stay comfortably under it. */
+    private readonly batchSize;
+    /** Ceiling on buffered events; the oldest go first once it is reached. */
+    private readonly capacity;
+    private buffer;
+    private readonly acked;
+    /**
+     * The greatest seq per run below which nothing is missing.
+     *
+     * Deliberately not `acked`. The server's ack reports the highest seq in the
+     * batch it just stored, which says nothing about the seqs *before* it — and
+     * those can be absent for reasons the server cannot see. The buffer sheds the
+     * oldest events when it overflows, so a long outage ships `[3, 4, 5]` and is
+     * told "you are up to 5" while 0, 1 and 2 were never sent at all. There is a
+     * green test asserting exactly that shape.
+     *
+     * Persisting `acked` would therefore write down a cursor covering events the
+     * server has never seen, and replay would skip them for ever. This head only
+     * advances one seq at a time, over a batch the server accounted for in full,
+     * and stops dead at the first gap.
+     */
+    private readonly durable;
+    private droppedCount;
+    private unackedCount;
+    constructor(projectId: string, transport: UploadTransport, 
+    /** Server rejects batches over 1000; stay comfortably under it. */
+    batchSize?: number, 
+    /** Ceiling on buffered events; the oldest go first once it is reached. */
+    capacity?: number);
+    /**
+     * Queue one event for the next flush. Cheap; call from the ledger append path.
+     *
+     * At capacity the *oldest* event goes, not the newest. The phone is watching
+     * for what is happening now — the round in flight, a question waiting on an
+     * answer — so the tail is what has to survive; and the head is the part a
+     * replay of the on-disk ledger can put back, since ingest is idempotent on
+     * `(runId, seq)`. Dropping is a reported loss, never a silent one.
+     */
+    enqueue(event: AnyEvent): void;
+    /** Events thrown away because the buffer was full, since this uploader started. */
+    dropped(): number;
+    /** Events a POST took but did not account for, since this uploader started. */
+    unacked(): number;
+    /**
+     * Seed the heads after a restart, so a replayed ledger skips what the server
+     * already holds.
+     *
+     * Both heads, from the same number: what came out of `cursor.json` is a
+     * durable gapless prefix, so it is simultaneously the last thing known held
+     * and a point with nothing missing behind it. Seeding only `acked` would let
+     * the next flush advance a durable head from -1 and re-send the whole run;
+     * seeding only `durable` would re-send everything the skip filter should drop.
+     */
+    prime(cursors: Record<string, number>): void;
+    /** Highest seq the server has acknowledged for a run, or -1 when unknown. */
+    ackedHead(runId: string): number;
+    /** Events waiting for the next flush. */
+    pending(): number;
+    /**
+     * Ship everything buffered, in `(runId, seq)` order, in batches.
+     *
+     * Order matters even though ingest dedupes: a batch that fails mid-flush must
+     * leave the server holding a *prefix* of each run, so the acknowledged head is
+     * always an honest resume point. Sending out of order would let a later seq
+     * land before an earlier one, and a crash in between would read as a gap.
+     */
+    flush(): Promise<FlushResult>;
+    private mergeCursor;
+    /**
+     * Walk a fully-accounted batch and extend each run's gapless head.
+     *
+     * One seq at a time, in order, stopping at the first number that is not the
+     * next one. A batch of `[3, 4, 5]` for a run whose head is -1 moves nothing:
+     * 0, 1 and 2 were never sent, and no ack can make it safe to skip them.
+     */
+    private advanceDurable;
+    /** Highest gapless seq the server is known to hold for a run, or -1. */
+    durableHead(runId: string): number;
+    /** What is safe to write to `cursor.json`. Never `acked` — see the field. */
+    durableCursors(): Record<string, number>;
+}
+//# sourceMappingURL=uploader.d.ts.map

package/dist/uploader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploader.d.ts","sourceRoot":"","sources":["../src/uploader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,QAAQ,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAE1C,qBAAa,aAAa;IAuBtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ;IA3B3B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAK;gBAGN,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,eAAe;IAC3C,mEAAmE;IAClD,SAAS,SAAM;IAChC,0EAA0E;IACzD,QAAQ,SAAuB;IAGlD;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI;IAQ9B,mFAAmF;IACnF,OAAO,IAAI,MAAM;IAIjB,+EAA+E;IAC/E,OAAO,IAAI,MAAM;IAIjB;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAO5C,6EAA6E;IAC7E,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIhC,yCAAyC;IACzC,OAAO,IAAI,MAAM;IAIjB;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC;IAiEnC,OAAO,CAAC,WAAW;IAInB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAStB,wEAAwE;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIlC,6EAA6E;IAC7E,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAGzC"}

package/dist/uploader.js

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventUploader = exports.DEFAULT_BUFFER_LIMIT = void 0;
+const core_1 = require("@looply/core");
+/**
+ * How many events may wait for a server that is not answering.
+ *
+ * A round emits on the order of tens of events, so this holds a long outage —
+ * many hours of running — before anything is thrown away. It exists because
+ * "buffer until the server returns" and "never end the run" cannot both be
+ * unconditional: an uploader with no ceiling turns a network outage into an
+ * out-of-memory kill, which loses the *whole* run rather than a prefix of its
+ * mirror. The ledger on disk is still complete either way.
+ */
+exports.DEFAULT_BUFFER_LIMIT = 5_000;
+class EventUploader {
+    projectId;
+    transport;
+    batchSize;
+    capacity;
+    buffer = [];
+    acked = new Map();
+    /**
+     * The greatest seq per run below which nothing is missing.
+     *
+     * Deliberately not `acked`. The server's ack reports the highest seq in the
+     * batch it just stored, which says nothing about the seqs *before* it — and
+     * those can be absent for reasons the server cannot see. The buffer sheds the
+     * oldest events when it overflows, so a long outage ships `[3, 4, 5]` and is
+     * told "you are up to 5" while 0, 1 and 2 were never sent at all. There is a
+     * green test asserting exactly that shape.
+     *
+     * Persisting `acked` would therefore write down a cursor covering events the
+     * server has never seen, and replay would skip them for ever. This head only
+     * advances one seq at a time, over a batch the server accounted for in full,
+     * and stops dead at the first gap.
+     */
+    durable = new Map();
+    droppedCount = 0;
+    unackedCount = 0;
+    constructor(projectId, transport, 
+    /** Server rejects batches over 1000; stay comfortably under it. */
+    batchSize = 500, 
+    /** Ceiling on buffered events; the oldest go first once it is reached. */
+    capacity = exports.DEFAULT_BUFFER_LIMIT) {
+        this.projectId = projectId;
+        this.transport = transport;
+        this.batchSize = batchSize;
+        this.capacity = capacity;
+    }
+    /**
+     * Queue one event for the next flush. Cheap; call from the ledger append path.
+     *
+     * At capacity the *oldest* event goes, not the newest. The phone is watching
+     * for what is happening now — the round in flight, a question waiting on an
+     * answer — so the tail is what has to survive; and the head is the part a
+     * replay of the on-disk ledger can put back, since ingest is idempotent on
+     * `(runId, seq)`. Dropping is a reported loss, never a silent one.
+     */
+    enqueue(event) {
+        this.buffer.push(event);
+        while (this.buffer.length > this.capacity) {
+            this.buffer.shift();
+            this.droppedCount += 1;
+        }
+    }
+    /** Events thrown away because the buffer was full, since this uploader started. */
+    dropped() {
+        return this.droppedCount;
+    }
+    /** Events a POST took but did not account for, since this uploader started. */
+    unacked() {
+        return this.unackedCount;
+    }
+    /**
+     * Seed the heads after a restart, so a replayed ledger skips what the server
+     * already holds.
+     *
+     * Both heads, from the same number: what came out of `cursor.json` is a
+     * durable gapless prefix, so it is simultaneously the last thing known held
+     * and a point with nothing missing behind it. Seeding only `acked` would let
+     * the next flush advance a durable head from -1 and re-send the whole run;
+     * seeding only `durable` would re-send everything the skip filter should drop.
+     */
+    prime(cursors) {
+        for (const [runId, seq] of Object.entries(cursors)) {
+            this.mergeCursor(runId, seq);
+            if (seq > this.durableHead(runId))
+                this.durable.set(runId, seq);
+        }
+    }
+    /** Highest seq the server has acknowledged for a run, or -1 when unknown. */
+    ackedHead(runId) {
+        return this.acked.get(runId) ?? -1;
+    }
+    /** Events waiting for the next flush. */
+    pending() {
+        return this.buffer.length;
+    }
+    /**
+     * Ship everything buffered, in `(runId, seq)` order, in batches.
+     *
+     * Order matters even though ingest dedupes: a batch that fails mid-flush must
+     * leave the server holding a *prefix* of each run, so the acknowledged head is
+     * always an honest resume point. Sending out of order would let a later seq
+     * land before an earlier one, and a crash in between would read as a gap.
+     */
+    async flush() {
+        const ordered = (0, core_1.sortEvents)(this.buffer);
+        let skipped = 0;
+        const fresh = [];
+        for (const e of ordered) {
+            if (e.seq <= this.ackedHead(e.runId))
+                skipped += 1;
+            else
+                fresh.push(e);
+        }
+        // Two counters, deliberately. `sent` walks the batches and is the only
+        // thing the loop may advance on; `delivered` is how many of those the
+        // server accounted for. They were one variable, which was fine only while
+        // every batch counted as fully delivered — the moment a batch could be
+        // partially accounted for, a server that kept nothing stopped advancing the
+        // cursor and this loop re-sent the same batch forever.
+        let sent = 0;
+        let delivered = 0;
+        while (sent < fresh.length) {
+            const batch = fresh.slice(sent, sent + this.batchSize);
+            let ack;
+            try {
+                ack = await this.transport.post(this.projectId, batch);
+            }
+            catch (e) {
+                // Keep the unsent tail — including this batch — for the next flush.
+                // Losing it here is exactly the gap case 23 exists to prevent.
+                this.buffer = fresh.slice(sent);
+                return {
+                    delivered,
+                    skipped,
+                    buffered: this.buffer.length,
+                    error: e instanceof Error ? e.message : String(e),
+                    ...(this.droppedCount > 0 ? { dropped: this.droppedCount } : {}),
+                    ...(this.unackedCount > 0 ? { unacked: this.unackedCount } : {}),
+                };
+            }
+            for (const [runId, seq] of Object.entries(ack.cursors))
+                this.mergeCursor(runId, seq);
+            // `accepted + duplicates` is exactly "events the server's ledger now
+            // holds": one it stored this time, one it already had. Everything else —
+            // malformed, addressed elsewhere, or dropped for a reason the ack does
+            // not name — is a loss, and counting it as delivered is how a run could
+            // upload its entire life to a server that kept none of it and still
+            // report success. `rejected` deliberately does NOT count as delivered:
+            // the server telling us it threw something away is not storage.
+            const accounted = Math.min(ack.accepted + ack.duplicates, batch.length);
+            this.unackedCount += batch.length - accounted;
+            delivered += accounted;
+            sent += batch.length;
+            // Only a batch the server accounted for in full says anything about which
+            // individual events landed. A partial one names a count, not a set, so
+            // there is no seq it makes safe to skip.
+            if (accounted === batch.length)
+                this.advanceDurable(batch);
+        }
+        this.buffer = [];
+        return {
+            delivered,
+            skipped,
+            buffered: 0,
+            ...(this.droppedCount > 0 ? { dropped: this.droppedCount } : {}),
+            ...(this.unackedCount > 0 ? { unacked: this.unackedCount } : {}),
+        };
+    }
+    mergeCursor(runId, seq) {
+        if (seq > this.ackedHead(runId))
+            this.acked.set(runId, seq);
+    }
+    /**
+     * Walk a fully-accounted batch and extend each run's gapless head.
+     *
+     * One seq at a time, in order, stopping at the first number that is not the
+     * next one. A batch of `[3, 4, 5]` for a run whose head is -1 moves nothing:
+     * 0, 1 and 2 were never sent, and no ack can make it safe to skip them.
+     */
+    advanceDurable(batch) {
+        for (const e of batch) {
+            const head = this.durableHead(e.runId);
+            if (e.seq <= head)
+                continue;
+            if (e.seq !== head + 1)
+                continue;
+            this.durable.set(e.runId, e.seq);
+        }
+    }
+    /** Highest gapless seq the server is known to hold for a run, or -1. */
+    durableHead(runId) {
+        return this.durable.get(runId) ?? -1;
+    }
+    /** What is safe to write to `cursor.json`. Never `acked` — see the field. */
+    durableCursors() {
+        return Object.fromEntries(this.durable);
+    }
+}
+exports.EventUploader = EventUploader;
+//# sourceMappingURL=uploader.js.map

package/dist/uploader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploader.js","sourceRoot":"","sources":["../src/uploader.ts"],"names":[],"mappings":";;;AAAA,uCAAyD;AA8DzD;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAE1C,MAAa,aAAa;IAuBL;IACA;IAEA;IAEA;IA3BX,MAAM,GAAe,EAAE,CAAC;IACf,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD;;;;;;;;;;;;;;OAcG;IACc,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,YAAY,GAAG,CAAC,CAAC;IACjB,YAAY,GAAG,CAAC,CAAC;IAEzB,YACmB,SAAiB,EACjB,SAA0B;IAC3C,mEAAmE;IAClD,YAAY,GAAG;IAChC,0EAA0E;IACzD,WAAW,4BAAoB;QAL/B,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAiB;QAE1B,cAAS,GAAT,SAAS,CAAM;QAEf,aAAQ,GAAR,QAAQ,CAAuB;IAC/C,CAAC;IAEJ;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAe;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,+EAA+E;IAC/E,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAA+B;QACnC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,SAAS,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,IAAA,iBAAU,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC;;gBAC9C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,4EAA4E;QAC5E,uDAAuD;QACvD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,GAAc,CAAC;YACnB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,oEAAoE;gBACpE,+DAA+D;gBAC/D,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO;oBACL,SAAS;oBACT,OAAO;oBACP,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC5B,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBACjD,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAErF,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9C,SAAS,IAAI,SAAS,CAAC;YACvB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YAErB,0EAA0E;YAC1E,uEAAuE;YACvE,yCAAyC;YACzC,IAAI,SAAS,KAAK,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO;YACL,SAAS;YACT,OAAO;YACP,QAAQ,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,KAAa,EAAE,GAAW;QAC5C,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,KAA0B;QAC/C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI;gBAAE,SAAS;YAC5B,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC;gBAAE,SAAS;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,WAAW,CAAC,KAAa;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,6EAA6E;IAC7E,cAAc;QACZ,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AA3LD,sCA2LC"}