niceeval 0.13.3 → 0.13.4-canary.39

package/dist/sandbox/docker-task-build-cache.cjs

@@ -0,0 +1,532 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.liveTaskBuildCacheAdminService = void 0;
+exports.observeDockerBuildKitCapacity = observeDockerBuildKitCapacity;
+exports.listDockerCacheDomains = listDockerCacheDomains;
+exports.dockerTaskBuildAuthorityFingerprint = dockerTaskBuildAuthorityFingerprint;
+exports.makeTaskBuildCacheService = makeTaskBuildCacheService;
+exports.inventoryTaskBuildDomain = inventoryTaskBuildDomain;
+exports.planTaskBuildGc = planTaskBuildGc;
+exports.applyTaskBuildGc = applyTaskBuildGc;
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+const node_sqlite_1 = require("node:sqlite");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+const MINIMUM_AGE_MS = 24 * 60 * 60 * 1000;
+const MAX_TASK_BUILD_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+const PLAN_TTL_MS = 15 * 60 * 1000;
+function domainIdFor(ownerId, daemonId, storageDriver, sentinelId) {
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(`docker-images\0${ownerId}\0${daemonId}\0${storageDriver}\0${sentinelId}`)
+        .digest("hex").slice(0, 24);
+}
+function inventoryState(actual, expected, leases) {
+    return actual !== expected ? "unverified" : leases > 0 ? "active-leased" : "cold-reusable";
+}
+function passesGcAgePolicy(row, now) {
+    const lastUse = Date.parse(row.last_successful_use_at ?? row.created_at);
+    return Date.parse(row.protected_until) <= now && now - lastUse >= MAX_TASK_BUILD_AGE_MS;
+}
+function canonicalDigest(value) {
+    return (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function digestPlan(plan) {
+    return canonicalDigest(plan);
+}
+function entryEvidence(row) {
+    return {
+        buildKey: row.build_key,
+        imageId: row.image_id,
+        manifestDigest: row.manifest_digest,
+        generation: row.generation,
+        createdAt: row.created_at,
+        lastSuccessfulUseAt: row.last_successful_use_at,
+        protectedUntil: row.protected_until,
+    };
+}
+function stateRoot() {
+    const base = process.env.XDG_STATE_HOME ?? (0, node_path_1.join)((0, node_os_1.homedir)(), ".local", "state");
+    return (0, node_path_1.join)(base, "niceeval", "cache", "v2", "domains");
+}
+async function docker(args, dockerSocketPath) {
+    const connection = dockerSocketPath === undefined ? [] : ["--host", `unix://${dockerSocketPath}`];
+    const result = await execFileAsync("docker", [...connection, ...args], { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
+    return result.stdout.trim();
+}
+function decimalBytes(value) {
+    if (typeof value !== "string")
+        return null;
+    const match = /^([0-9]+(?:\.[0-9]+)?)\s*([kmgtp]?b)$/iu.exec(value.trim());
+    if (match === null)
+        return null;
+    const power = ["b", "kb", "mb", "gb", "tb", "pb"].indexOf(match[2].toLowerCase());
+    return power < 0 ? null : Math.round(Number(match[1]) * 1000 ** power);
+}
+async function observeDockerBuildKitCapacity() {
+    const output = await docker(["system", "df", "--format", "json"]);
+    const rows = output.split(/\r?\n/u).filter(Boolean).map((line) => JSON.parse(line));
+    const build = rows.find((row) => row.Type === "Build Cache");
+    const reclaimable = typeof build?.Reclaimable === "string" ? build.Reclaimable.trim().split(/\s+/u)[0] : undefined;
+    return Object.freeze({
+        scope: "provider",
+        providerFamily: "docker",
+        backendKind: "buildkit",
+        state: "unverified",
+        observedAt: new Date().toISOString(),
+        totalBytes: decimalBytes(build?.Size),
+        reclaimableEstimateBytes: decimalBytes(reclaimable),
+        reason: "shared-builder-unattributed",
+    });
+}
+async function openDomain(dockerSocketPath) {
+    if (dockerSocketPath !== undefined)
+        throw new Error("managed Docker cache requires the default local Unix socket");
+    const root = stateRoot();
+    (0, node_fs_1.mkdirSync)(root, { recursive: true, mode: 0o700 });
+    const ownerPath = (0, node_path_1.join)(root, "owner-id");
+    let ownerId;
+    try {
+        ownerId = (0, node_fs_1.readFileSync)(ownerPath, "utf8").trim();
+    }
+    catch {
+        ownerId = (0, node_crypto_1.randomUUID)();
+        const temporary = `${ownerPath}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+        (0, node_fs_1.writeFileSync)(temporary, `${ownerId}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        try {
+            (0, node_fs_1.renameSync)(temporary, ownerPath);
+        }
+        catch {
+            ownerId = (0, node_fs_1.readFileSync)(ownerPath, "utf8").trim();
+        }
+    }
+    const sentinelName = `niceeval-cache-${(0, node_crypto_1.createHash)("sha256").update(ownerId).digest("hex").slice(0, 16)}`;
+    const sentinelLabel = "io.niceeval.cache-domain";
+    let sentinelId;
+    try {
+        sentinelId = await docker(["volume", "inspect", "--format", `{{index .Labels \"${sentinelLabel}\"}}`, sentinelName]);
+    }
+    catch {
+        sentinelId = (0, node_crypto_1.randomUUID)();
+        await docker(["volume", "create", "--label", `${sentinelLabel}=${sentinelId}`, sentinelName]);
+        sentinelId = await docker(["volume", "inspect", "--format", `{{index .Labels \"${sentinelLabel}\"}}`, sentinelName]);
+    }
+    if (sentinelId.length === 0 || sentinelId === "<no value>")
+        throw new Error(`Docker cache sentinel ${sentinelName} has no managed identity`);
+    const daemonId = await docker(["info", "--format", "{{.ID}}"], dockerSocketPath);
+    const storageDriver = await docker(["info", "--format", "{{.Driver}}"], dockerSocketPath);
+    const domainId = domainIdFor(ownerId, daemonId, storageDriver, sentinelId);
+    const backendIdentity = (0, node_crypto_1.createHash)("sha256").update(`${daemonId}\0${storageDriver}\0${sentinelId}`).digest("hex");
+    const directory = (0, node_path_1.join)(stateRoot(), domainId);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    const db = new node_sqlite_1.DatabaseSync((0, node_path_1.join)(directory, "registry.sqlite"));
+    db.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;");
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS entries (
+      build_key TEXT PRIMARY KEY,
+      tag TEXT NOT NULL,
+      image_id TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      last_successful_use_at TEXT,
+      protected_until TEXT NOT NULL,
+      manifest_digest TEXT NOT NULL,
+      generation INTEGER NOT NULL,
+      operation_id TEXT NOT NULL,
+      state TEXT NOT NULL CHECK(state IN ('indexed','deleting','tombstoned','unverified'))
+    );
+    CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS leases (
+      lease_id TEXT PRIMARY KEY,
+      build_key TEXT NOT NULL REFERENCES entries(build_key),
+      holder_pid INTEGER NOT NULL,
+      holder_boot_id TEXT NOT NULL,
+      holder_process_start TEXT NOT NULL,
+      generation INTEGER NOT NULL,
+      created_at TEXT NOT NULL,
+      heartbeat_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS roots (
+      root_id TEXT PRIMARY KEY,
+      build_key TEXT NOT NULL REFERENCES entries(build_key),
+      generation INTEGER NOT NULL,
+      holder_boot_id TEXT NOT NULL,
+      holder_pid INTEGER NOT NULL,
+      holder_process_start TEXT NOT NULL,
+      state TEXT NOT NULL CHECK(state IN ('prepared','active')),
+      created_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS gc_plans (
+      plan_id TEXT PRIMARY KEY,
+      created_at TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      digest TEXT NOT NULL,
+      outcome TEXT
+    );
+  `);
+    const epochRow = db.prepare("SELECT value FROM metadata WHERE key = 'authorityEpoch'").get();
+    const authorityEpoch = epochRow?.value ?? (0, node_crypto_1.randomUUID)();
+    db.prepare("INSERT OR IGNORE INTO metadata(key, value) VALUES ('authorityEpoch', ?)").run(authorityEpoch);
+    db.prepare("INSERT OR IGNORE INTO metadata(key, value) VALUES ('safetyRevision', '1')").run();
+    const catalog = new node_sqlite_1.DatabaseSync((0, node_path_1.join)(root, "catalog.sqlite"));
+    catalog.exec(`
+    PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
+    CREATE TABLE IF NOT EXISTS domains (
+      domain_id TEXT PRIMARY KEY,
+      provider_family TEXT NOT NULL,
+      admin_protocol_version INTEGER NOT NULL,
+      backend_kind TEXT NOT NULL,
+      first_verified_at TEXT NOT NULL,
+      last_verified_at TEXT NOT NULL,
+      last_state TEXT NOT NULL
+    );
+  `);
+    const verifiedAt = new Date().toISOString();
+    catalog.prepare(`
+    INSERT INTO domains(domain_id, provider_family, admin_protocol_version, backend_kind, first_verified_at, last_verified_at, last_state)
+    VALUES (?, 'docker', 1, 'docker-images', ?, ?, 'verified-managed')
+    ON CONFLICT(domain_id) DO UPDATE SET last_verified_at=excluded.last_verified_at, last_state='verified-managed'
+  `).run(domainId, verifiedAt, verifiedAt);
+    catalog.close();
+    return { domainId, ownerId, authorityEpoch, backendIdentity, db };
+}
+async function listDockerCacheDomains() {
+    const current = await openDomain();
+    current.db.close();
+    const catalog = new node_sqlite_1.DatabaseSync((0, node_path_1.join)(stateRoot(), "catalog.sqlite"), { readOnly: true });
+    const rows = catalog.prepare("SELECT domain_id, provider_family, admin_protocol_version, backend_kind FROM domains ORDER BY first_verified_at, domain_id").all();
+    catalog.close();
+    return rows.map((row) => ({
+        providerFamily: "docker",
+        adminProtocolVersion: row.admin_protocol_version,
+        domainId: row.domain_id,
+        backendKind: row.backend_kind,
+        state: row.domain_id === current.domainId ? "verified-managed" : "unavailable",
+    }));
+}
+async function dockerTaskBuildAuthorityFingerprint() {
+    const domain = await openDomain();
+    domain.db.close();
+    return domain.domainId;
+}
+async function imageId(tag, dockerSocketPath) {
+    try {
+        return await docker(["image", "inspect", "--format", "{{.Id}}", tag], dockerSocketPath);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function hasContainerReference(image, dockerSocketPath) {
+    return (await docker(["ps", "-a", "--filter", `ancestor=${image}`, "--quiet"], dockerSocketPath)).length > 0;
+}
+function holderIdentity(pid = process.pid) {
+    const bootId = (0, node_fs_1.readFileSync)("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const stat = (0, node_fs_1.readFileSync)(`/proc/${pid}/stat`, "utf8").trim();
+    const processStart = stat.slice(stat.lastIndexOf(")") + 2).split(/\s+/u)[19];
+    if (bootId.length === 0 || processStart === undefined)
+        throw new Error("cannot verify local process identity");
+    return { bootId, processStart };
+}
+function processIdentityIsLive(pid, bootId, processStart) {
+    try {
+        const actual = holderIdentity(pid);
+        return actual.bootId === bootId && actual.processStart === processStart;
+    }
+    catch {
+        return false;
+    }
+}
+class LiveTaskBuildCacheSession {
+    async lookup(buildKey, tag, manifestDigest, dockerSocketPath) {
+        const domain = await openDomain(dockerSocketPath);
+        const row = domain.db.prepare("SELECT * FROM entries WHERE build_key = ? AND state = 'indexed'").get(buildKey);
+        if (row === undefined || row.tag !== tag || row.manifest_digest !== manifestDigest) {
+            domain.db.close();
+            return false;
+        }
+        const actual = await imageId(tag, dockerSocketPath);
+        if (actual === undefined || actual !== row.image_id) {
+            domain.db.prepare("UPDATE entries SET state = 'unverified' WHERE build_key = ?").run(buildKey);
+            domain.db.close();
+            return false;
+        }
+        domain.db.close();
+        return true;
+    }
+    async publish(buildKey, tag, manifestDigest, operationId, dockerSocketPath) {
+        const actual = await imageId(tag, dockerSocketPath);
+        if (actual === undefined)
+            throw new Error(`built image ${tag} is absent after build`);
+        const domain = await openDomain(dockerSocketPath);
+        const now = new Date();
+        domain.db.prepare(`
+      INSERT INTO entries(build_key, tag, image_id, created_at, last_successful_use_at, protected_until, manifest_digest, generation, operation_id, state)
+      VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, 'indexed')
+      ON CONFLICT(build_key) DO UPDATE SET
+        tag=excluded.tag, image_id=excluded.image_id, created_at=excluded.created_at,
+        last_successful_use_at=excluded.last_successful_use_at,
+        protected_until=excluded.protected_until, manifest_digest=excluded.manifest_digest,
+        generation=CASE WHEN entries.operation_id = excluded.operation_id THEN entries.generation ELSE entries.generation + 1 END,
+        operation_id=excluded.operation_id, state='indexed'
+    `).run(buildKey, tag, actual, now.toISOString(), now.toISOString(), new Date(now.getTime() + MINIMUM_AGE_MS).toISOString(), manifestDigest, operationId);
+        domain.db.prepare("UPDATE metadata SET value = CAST(value AS INTEGER) + 1 WHERE key = 'safetyRevision'").run();
+        domain.db.close();
+    }
+    async acquireUse(buildKey, tag, manifestDigest, dockerSocketPath) {
+        const domain = await openDomain(dockerSocketPath);
+        const row = domain.db.prepare("SELECT * FROM entries WHERE build_key = ? AND state = 'indexed'").get(buildKey);
+        if (row === undefined || row.tag !== tag || row.manifest_digest !== manifestDigest || await imageId(tag, dockerSocketPath) !== row.image_id) {
+            domain.db.close();
+            throw new Error(`Docker task-build artifact ${buildKey.slice(0, 12)} is no longer available`);
+        }
+        const leaseId = (0, node_crypto_1.randomUUID)();
+        const rootId = (0, node_crypto_1.randomUUID)();
+        const now = new Date().toISOString();
+        const holder = holderIdentity();
+        domain.db.exec("BEGIN IMMEDIATE");
+        try {
+            domain.db.prepare("INSERT INTO leases(lease_id, build_key, holder_pid, holder_boot_id, holder_process_start, generation, created_at, heartbeat_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
+                .run(leaseId, buildKey, process.pid, holder.bootId, holder.processStart, row.generation, now, now);
+            domain.db.prepare("INSERT INTO roots(root_id, build_key, generation, holder_boot_id, holder_pid, holder_process_start, state, created_at) VALUES (?, ?, ?, ?, ?, ?, 'prepared', ?)")
+                .run(rootId, buildKey, row.generation, holder.bootId, process.pid, holder.processStart, now);
+            domain.db.prepare("UPDATE roots SET state = 'active' WHERE root_id = ? AND state = 'prepared'").run(rootId);
+            domain.db.prepare("UPDATE entries SET last_successful_use_at = ? WHERE build_key = ?").run(now, buildKey);
+            domain.db.exec("COMMIT");
+        }
+        catch (cause) {
+            domain.db.exec("ROLLBACK");
+            domain.db.close();
+            throw cause;
+        }
+        let released = false;
+        const heartbeat = setInterval(() => {
+            if (released)
+                return;
+            try {
+                domain.db.prepare("UPDATE leases SET heartbeat_at = ? WHERE lease_id = ?").run(new Date().toISOString(), leaseId);
+            }
+            catch {
+                // The holder identity and durable root remain authoritative; reconciliation will classify an unreadable registry as unverified.
+            }
+        }, 30000);
+        heartbeat.unref();
+        return { release() {
+                if (released)
+                    return;
+                released = true;
+                clearInterval(heartbeat);
+                domain.db.exec("BEGIN IMMEDIATE");
+                try {
+                    domain.db.prepare("DELETE FROM roots WHERE root_id = ?").run(rootId);
+                    domain.db.prepare("DELETE FROM leases WHERE lease_id = ?").run(leaseId);
+                    domain.db.exec("COMMIT");
+                }
+                catch (cause) {
+                    domain.db.exec("ROLLBACK");
+                    throw cause;
+                }
+                domain.db.close();
+            } };
+    }
+}
+function makeTaskBuildCacheService() {
+    return new LiveTaskBuildCacheSession();
+}
+function liveLeaseCount(db, buildKey) {
+    const rows = db.prepare("SELECT lease_id, holder_pid, holder_boot_id, holder_process_start FROM leases WHERE build_key = ?").all(buildKey);
+    let live = 0;
+    for (const row of rows) {
+        if (processIdentityIsLive(row.holder_pid, row.holder_boot_id, row.holder_process_start)) {
+            live += 1;
+        }
+        else {
+            db.prepare("DELETE FROM leases WHERE lease_id = ?").run(row.lease_id);
+        }
+    }
+    return live;
+}
+function liveRootCount(db, buildKey) {
+    const rows = db.prepare("SELECT root_id, holder_pid, holder_boot_id, holder_process_start FROM roots WHERE build_key = ?").all(buildKey);
+    let live = 0;
+    for (const row of rows) {
+        if (processIdentityIsLive(row.holder_pid, row.holder_boot_id, row.holder_process_start))
+            live += 1;
+        else
+            db.prepare("DELETE FROM roots WHERE root_id = ?").run(row.root_id);
+    }
+    return live;
+}
+async function inventoryTaskBuildDomain(dockerSocketPath) {
+    const domain = await openDomain(dockerSocketPath);
+    const rows = domain.db.prepare("SELECT * FROM entries ORDER BY COALESCE(last_successful_use_at, created_at), created_at, build_key").all();
+    const entries = [];
+    for (const row of rows) {
+        const actual = await imageId(row.tag, dockerSocketPath);
+        const leases = liveLeaseCount(domain.db, row.build_key) + liveRootCount(domain.db, row.build_key);
+        entries.push({
+            buildKey: row.build_key,
+            tag: row.tag,
+            imageId: row.image_id,
+            createdAt: row.created_at,
+            lastSuccessfulUseAt: row.last_successful_use_at,
+            protectedUntil: row.protected_until,
+            state: inventoryState(actual, row.image_id, leases),
+        });
+    }
+    domain.db.close();
+    return { domainId: domain.domainId, providerFamily: "docker", backendKind: "docker-images", state: "verified-managed", entries };
+}
+async function planTaskBuildGc(domainId) {
+    const domain = await openDomain();
+    if (domain.domainId !== domainId) {
+        domain.db.close();
+        throw new Error(`unknown Docker image cache domain ${domainId}`);
+    }
+    const now = new Date();
+    const candidates = [];
+    const rows = domain.db.prepare("SELECT * FROM entries WHERE state = 'indexed' ORDER BY COALESCE(last_successful_use_at, created_at), created_at, build_key").all();
+    for (const row of rows) {
+        if (!passesGcAgePolicy(row, now.getTime()))
+            continue;
+        if (liveLeaseCount(domain.db, row.build_key) > 0)
+            continue;
+        if (liveRootCount(domain.db, row.build_key) > 0)
+            continue;
+        if (await imageId(row.tag) !== row.image_id)
+            continue;
+        if (await hasContainerReference(row.image_id))
+            continue;
+        const evidence = entryEvidence(row);
+        candidates.push({
+            buildKey: row.build_key,
+            tag: row.tag,
+            imageId: row.image_id,
+            manifestDigest: row.manifest_digest,
+            generation: row.generation,
+            evidenceDigest: canonicalDigest(evidence),
+            ruleId: "max-age/task-build",
+        });
+    }
+    const revision = Number(domain.db.prepare("SELECT value FROM metadata WHERE key = 'safetyRevision'").get().value);
+    const unsigned = {
+        schemaVersion: 1,
+        planId: (0, node_crypto_1.randomUUID)(),
+        domainId,
+        ownerId: domain.ownerId,
+        backendIdentity: domain.backendIdentity,
+        authorityEpoch: domain.authorityEpoch,
+        policyVersion: 1,
+        registrySafetyRevision: revision,
+        observedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + PLAN_TTL_MS).toISOString(),
+        candidates,
+    };
+    const plan = { ...unsigned, planDigest: digestPlan(unsigned) };
+    domain.db.prepare("INSERT INTO gc_plans(plan_id, created_at, expires_at, payload, digest) VALUES (?, ?, ?, ?, ?)")
+        .run(plan.planId, plan.observedAt, plan.expiresAt, JSON.stringify(plan), plan.planDigest);
+    domain.db.close();
+    return plan;
+}
+async function applyTaskBuildGc(domainId, planId) {
+    const domain = await openDomain();
+    if (domain.domainId !== domainId) {
+        domain.db.close();
+        throw new Error(`unknown Docker image cache domain ${domainId}`);
+    }
+    const saved = domain.db.prepare("SELECT expires_at, payload, digest, outcome FROM gc_plans WHERE plan_id = ?").get(planId);
+    if (saved === undefined) {
+        domain.db.close();
+        throw new Error(`unknown GC plan ${planId}`);
+    }
+    if (saved.outcome !== null) {
+        const outcome = JSON.parse(saved.outcome);
+        domain.db.close();
+        return outcome;
+    }
+    if (Date.parse(saved.expires_at) < Date.now()) {
+        domain.db.close();
+        throw new Error(`GC plan ${planId} expired`);
+    }
+    const plan = JSON.parse(saved.payload);
+    const { planDigest: persistedPlanDigest, ...unsigned } = plan;
+    if (saved.digest !== persistedPlanDigest || digestPlan(unsigned) !== persistedPlanDigest) {
+        domain.db.close();
+        throw new Error(`GC plan ${planId} is corrupt`);
+    }
+    if (plan.domainId !== domain.domainId ||
+        plan.ownerId !== domain.ownerId ||
+        plan.backendIdentity !== domain.backendIdentity ||
+        plan.authorityEpoch !== domain.authorityEpoch ||
+        plan.policyVersion !== 1) {
+        domain.db.close();
+        throw new Error(`GC plan ${planId} authority changed`);
+    }
+    const outcomes = [];
+    for (const candidate of plan.candidates) {
+        domain.db.exec("BEGIN IMMEDIATE");
+        let row;
+        try {
+            row = domain.db.prepare("SELECT * FROM entries WHERE build_key = ?").get(candidate.buildKey);
+            if (row === undefined || (row.state !== "indexed" && row.state !== "deleting") || row.image_id !== candidate.imageId ||
+                row.manifest_digest !== candidate.manifestDigest || row.generation !== candidate.generation ||
+                canonicalDigest(entryEvidence(row)) !== candidate.evidenceDigest ||
+                liveLeaseCount(domain.db, candidate.buildKey) > 0 || liveRootCount(domain.db, candidate.buildKey) > 0) {
+                domain.db.exec("ROLLBACK");
+                outcomes.push({ buildKey: candidate.buildKey, status: "skipped", reason: "entry-lease-root-or-generation-changed" });
+                continue;
+            }
+            domain.db.prepare("UPDATE entries SET state = 'deleting' WHERE build_key = ? AND generation = ? AND state IN ('indexed','deleting')")
+                .run(candidate.buildKey, candidate.generation);
+            domain.db.exec("COMMIT");
+        }
+        catch (cause) {
+            domain.db.exec("ROLLBACK");
+            outcomes.push({ buildKey: candidate.buildKey, status: "failed", reason: cause instanceof Error ? cause.message : String(cause) });
+            continue;
+        }
+        const actual = await imageId(row.tag);
+        if (actual === undefined) {
+            domain.db.prepare("UPDATE entries SET state = 'tombstoned' WHERE build_key = ? AND generation = ? AND state = 'deleting'")
+                .run(candidate.buildKey, candidate.generation);
+            outcomes.push({ buildKey: candidate.buildKey, status: "already-absent", reason: "provider-confirmed-absent" });
+            continue;
+        }
+        if (actual !== candidate.imageId || await hasContainerReference(candidate.imageId)) {
+            domain.db.prepare("UPDATE entries SET state = 'indexed' WHERE build_key = ? AND generation = ? AND state = 'deleting'")
+                .run(candidate.buildKey, candidate.generation);
+            outcomes.push({ buildKey: candidate.buildKey, status: "skipped", reason: "resource-or-reference-changed" });
+            continue;
+        }
+        try {
+            await docker(["image", "rm", candidate.imageId]);
+            if (await imageId(row.tag) !== undefined || await hasContainerReference(candidate.imageId)) {
+                domain.db.prepare("UPDATE entries SET state = 'unverified' WHERE build_key = ? AND generation = ? AND state = 'deleting'")
+                    .run(candidate.buildKey, candidate.generation);
+                outcomes.push({ buildKey: candidate.buildKey, status: "failed", reason: "image-still-present" });
+                continue;
+            }
+            domain.db.prepare("UPDATE entries SET state = 'tombstoned' WHERE build_key = ? AND generation = ? AND state = 'deleting'")
+                .run(candidate.buildKey, candidate.generation);
+            outcomes.push({ buildKey: candidate.buildKey, status: "deleted", reason: "max-age/task-build" });
+        }
+        catch (cause) {
+            domain.db.prepare("UPDATE entries SET state = 'unverified' WHERE build_key = ? AND generation = ? AND state = 'deleting'")
+                .run(candidate.buildKey, candidate.generation);
+            outcomes.push({ buildKey: candidate.buildKey, status: "failed", reason: cause instanceof Error ? cause.message : String(cause) });
+        }
+    }
+    const result = { planId, domainId, outcomes };
+    domain.db.prepare("UPDATE gc_plans SET outcome = ? WHERE plan_id = ?").run(JSON.stringify(result), planId);
+    domain.db.close();
+    return result;
+}
+exports.liveTaskBuildCacheAdminService = Object.freeze({
+    inventory: inventoryTaskBuildDomain,
+    planGc: planTaskBuildGc,
+    applyGc: applyTaskBuildGc,
+});
+//# sourceMappingURL=docker-task-build-cache.cjs.map

package/dist/sandbox/docker-task-build-cache.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-task-build-cache.js","sourceRoot":"","sources":["docker-task-build-cache.ts"],"names":[],"mappings":";;;AAgIA,sEAeC;AAkHD,wDAkBC;AACD,kFAIC;AA+HD,8DAEC;AAmCD,4DAmBC;AACD,0CAoDC;AAUD,4CAqGC;AAnnBD,6CAAqD;AACrD,2DAA8C;AAC9C,qCAA6E;AAC7E,qCAAkC;AAClC,yCAAiC;AACjC,yCAAsC;AACtC,6CAA2C;AAE3C,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAC1C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAsEnC,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB,EAAE,aAAqB,EAAE,UAAkB;IAC7F,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACtB,MAAM,CAAC,kBAAkB,OAAO,KAAK,QAAQ,KAAK,aAAa,KAAK,UAAU,EAAE,CAAC;SACjF,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,cAAc,CAAC,MAA0B,EAAE,QAAgB,EAAE,MAAc;IAChF,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;AAC/F,CAAC;AACD,SAAS,iBAAiB,CAAC,GAAa,EAAE,GAAW;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,IAAI,qBAAqB,CAAC;AAC5F,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,UAAU,CAAC,IAAyC;IACzD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AACD,SAAS,aAAa,CAAC,GAAa;IAChC,OAAO;QACH,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,cAAc,EAAE,GAAG,CAAC,eAAe;QACnC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,mBAAmB,EAAE,GAAG,CAAC,sBAAsB;QAC/C,cAAc,EAAE,GAAG,CAAC,eAAe;KACtC,CAAC;AACN,CAAC;AACD,SAAS,SAAS;IACd,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC5D,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,IAAuB,EAAE,gBAAyB;IACpE,MAAM,UAAU,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,gBAAgB,EAAE,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACzH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AACD,SAAS,YAAY,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,IAAI,CAAC;IAChB,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC;AAC3E,CAAC;AACM,KAAK,UAAU,6BAA6B;IAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnH,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,UAAU;QACjB,cAAc,EAAE,QAAQ;QACxB,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC;QACrC,wBAAwB,EAAE,YAAY,CAAC,WAAW,CAAC;QACnD,MAAM,EAAE,6BAA6B;KACxC,CAAC,CAAC;AACP,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,gBAAyB;IAC/C,IAAI,gBAAgB,KAAK,SAAS;QAC9B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAA,mBAAS,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACD,OAAO,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,CAAC;QACH,OAAO,GAAG,IAAA,wBAAU,GAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,wBAAU,GAAE,MAAM,CAAC;QACpE,IAAA,uBAAa,EAAC,SAAS,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC;YACD,IAAA,oBAAU,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC;YACH,OAAO,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACzG,MAAM,aAAa,GAAG,0BAA0B,CAAC;IACjD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACD,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,aAAa,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,CAAC;QACH,UAAU,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC1B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QAC9F,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,aAAa,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,KAAK,YAAY;QACtD,MAAM,IAAI,KAAK,CAAC,yBAAyB,YAAY,0BAA0B,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,aAAa,KAAK,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClH,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,0BAAY,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAChE,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IACrF,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CT,CAAC,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAE7E,CAAC;IACd,MAAM,cAAc,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAA,wBAAU,GAAE,CAAC;IACvD,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1G,EAAE,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,0BAAY,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;GAWd,CAAC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,CAAC,OAAO,CAAC;;;;GAIjB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACtE,CAAC;AACM,KAAK,UAAU,sBAAsB;IACxC,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,IAAI,0BAAY,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,4HAA4H,CAAC,CAAC,GAAG,EAK5J,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtB,cAAc,EAAE,QAAQ;QACxB,oBAAoB,EAAE,GAAG,CAAC,sBAAsB;QAChD,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,KAAK,EAAE,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa;KACjF,CAAC,CAAC,CAAC;AACR,CAAC;AACM,KAAK,UAAU,mCAAmC;IACrD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC,QAAQ,CAAC;AAC3B,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,gBAAyB;IACzD,IAAI,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,CAAC;QACH,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AACD,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,gBAAyB;IACzE,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,KAAK,EAAE,EAAE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACjH,CAAC;AACD,SAAS,cAAc,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IAIrC,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,SAAS;QACjD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AACD,SAAS,qBAAqB,CAAC,GAAW,EAAE,MAAc,EAAE,YAAoB;IAC5E,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,MAAM,yBAAyB;IAC3B,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,GAAW,EAAE,cAAsB,EAAE,gBAAyB;QACzF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAyB,CAAC;QACvI,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,KAAK,cAAc,EAAE,CAAC;YACjF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/F,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,GAAW,EAAE,cAAsB,EAAE,WAAmB,EAAE,gBAAyB;QAC/G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS;YACpB,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;KASrB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACrJ,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/G,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,GAAW,EAAE,cAAsB,EAAE,gBAAyB;QAG7F,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAyB,CAAC;QACvI,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,KAAK,cAAc,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1I,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClC,IAAI,CAAC;YACD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,iKAAiK,CAAC;iBAC/K,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACvG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,iKAAiK,CAAC;iBAC/K,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YACjG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5G,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1G,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,IAAI,QAAQ;gBACR,OAAO;YACX,IAAI,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,CAAC;gBACH,gIAAgI;YACpI,CAAC;QACL,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO;gBACR,IAAI,QAAQ;oBACR,OAAO;gBACX,QAAQ,GAAG,IAAI,CAAC;gBAChB,aAAa,CAAC,SAAS,CAAC,CAAC;gBACzB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAClC,IAAI,CAAC;oBACD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACrE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACxE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO,KAAK,EAAE,CAAC;oBACX,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC3B,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACtB,CAAC,EAAE,CAAC;IACZ,CAAC;CACJ;AACD,SAAgB,yBAAyB;IACrC,OAAO,IAAI,yBAAyB,EAAE,CAAC;AAC3C,CAAC;AACD,SAAS,cAAc,CAAC,EAAgB,EAAE,QAAgB;IACtD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,mGAAmG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAKvI,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACtF,IAAI,IAAI,CAAC,CAAC;QACd,CAAC;aACI,CAAC;YACF,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACD,SAAS,aAAa,CAAC,EAAgB,EAAE,QAAgB;IACrD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,iGAAiG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAKrI,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,oBAAoB,CAAC;YACnF,IAAI,IAAI,CAAC,CAAC;;YAEV,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AACM,KAAK,UAAU,wBAAwB,CAAC,gBAAyB;IACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,oGAAoG,CAAC,CAAC,GAAG,EAA2B,CAAC;IACpK,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,mBAAmB,EAAE,GAAG,CAAC,sBAAsB;YAC/C,cAAc,EAAE,GAAG,CAAC,eAAe;YACnC,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;SACtD,CAAC,CAAC;IACP,CAAC;IACD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;AACrI,CAAC;AACM,KAAK,UAAU,eAAe,CAAC,QAAgB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,UAAU,GAA4C,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,4HAA4H,CAAC,CAAC,GAAG,EAA2B,CAAC;IAC5L,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACtC,SAAS;QACb,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YAC5C,SAAS;QACb,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;YAC3C,SAAS;QACb,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,QAAQ;YACvC,SAAS;QACb,IAAI,MAAM,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzC,SAAS;QACb,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,cAAc,EAAE,GAAG,CAAC,eAAe;YACnC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,cAAc,EAAE,eAAe,CAAC,QAAQ,CAAC;YACzC,MAAM,EAAE,oBAAoB;SAC/B,CAAC,CAAC;IACP,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,EAEvG,CAAC,KAAK,CAAC,CAAC;IACV,MAAM,QAAQ,GAAwC;QAClD,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,IAAA,wBAAU,GAAE;QACpB,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,CAAC;QAChB,sBAAsB,EAAE,QAAQ;QAChC,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE;QAC9D,UAAU;KACb,CAAC;IACF,MAAM,IAAI,GAAoB,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,+FAA+F,CAAC;SAC7G,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,IAAI,CAAC;AAChB,CAAC;AAUM,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IACnE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,GAAG,CAAC,MAAM,CAK5G,CAAC;IACd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAC1D,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,mBAAmB,EAAE,CAAC;QACvF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,aAAa,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;QACjC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAC/B,IAAI,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;QAC/C,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAC7C,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAIT,EAAE,CAAC;IACR,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAClC,IAAI,GAAyB,CAAC;QAC9B,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAyB,CAAC;YACrH,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,OAAO;gBAChH,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,cAAc,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;gBAC3F,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,cAAc;gBAChE,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;gBACrH,SAAS;YACb,CAAC;YACD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,kHAAkH,CAAC;iBAChI,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClI,SAAS;QACb,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC;iBACrH,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC/G,SAAS;QACb,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,IAAI,MAAM,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,oGAAoG,CAAC;iBAClH,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC5G,SAAS;QACb,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,MAAM,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC;qBACrH,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;gBACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACjG,SAAS;YACb,CAAC;YACD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC;iBACrH,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,uGAAuG,CAAC;iBACrH,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtI,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAW,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3G,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAClB,CAAC;AACY,QAAA,8BAA8B,GAA+B,MAAM,CAAC,MAAM,CAAC;IACpF,SAAS,EAAE,wBAAwB;IACnC,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,gBAAgB;CAC5B,CAAC,CAAC","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { execFile } from \"node:child_process\";\nimport { mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport { DatabaseSync } from \"node:sqlite\";\nimport type { DockerCapacityObservation as ProviderCapacityObservation, DockerCacheDomainDescriptor as CacheDomainDescriptor, } from \"../docker/cache-administration.ts\";\nconst execFileAsync = promisify(execFile);\nconst MINIMUM_AGE_MS = 24 * 60 * 60 * 1000;\nconst MAX_TASK_BUILD_AGE_MS = 30 * 24 * 60 * 60 * 1000;\nconst PLAN_TTL_MS = 15 * 60 * 1000;\ninterface EntryRow {\n    readonly build_key: string;\n    readonly tag: string;\n    readonly image_id: string;\n    readonly created_at: string;\n    readonly last_successful_use_at: string | null;\n    readonly protected_until: string;\n    readonly manifest_digest: string;\n    readonly generation: number;\n    readonly operation_id: string;\n    readonly state: \"indexed\" | \"deleting\" | \"tombstoned\" | \"unverified\";\n}\nexport interface TaskBuildInventoryEntry {\n    readonly buildKey: string;\n    readonly tag: string;\n    readonly imageId: string;\n    readonly createdAt: string;\n    readonly lastSuccessfulUseAt: string | null;\n    readonly protectedUntil: string;\n    readonly state: \"active-leased\" | \"cold-reusable\" | \"unverified\";\n}\nexport interface TaskBuildDomainInventory {\n    readonly domainId: string;\n    readonly providerFamily: \"docker\";\n    readonly backendKind: \"docker-images\";\n    readonly state: \"verified-managed\";\n    readonly entries: readonly TaskBuildInventoryEntry[];\n}\nexport interface TaskBuildCacheService {\n    lookup(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<boolean>;\n    publish(buildKey: string, tag: string, manifestDigest: string, operationId: string, dockerSocketPath?: string): Promise<void>;\n    acquireUse(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<{\n        release(): void;\n    }>;\n}\nexport interface TaskBuildCacheAdminService {\n    inventory(): Promise<TaskBuildDomainInventory>;\n    planGc(domainId: string): Promise<TaskBuildGcPlan>;\n    applyGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome>;\n}\nexport interface TaskBuildGcPlan {\n    readonly schemaVersion: 1;\n    readonly planId: string;\n    readonly domainId: string;\n    readonly ownerId: string;\n    readonly backendIdentity: string;\n    readonly authorityEpoch: string;\n    readonly policyVersion: 1;\n    readonly registrySafetyRevision: number;\n    readonly observedAt: string;\n    readonly expiresAt: string;\n    readonly planDigest: string;\n    readonly candidates: ReadonlyArray<{\n        readonly buildKey: string;\n        readonly tag: string;\n        readonly imageId: string;\n        readonly manifestDigest: string;\n        readonly generation: number;\n        readonly evidenceDigest: string;\n        readonly ruleId: \"max-age/task-build\";\n    }>;\n}\ninterface DomainHandle {\n    readonly domainId: string;\n    readonly ownerId: string;\n    readonly authorityEpoch: string;\n    readonly backendIdentity: string;\n    readonly db: DatabaseSync;\n}\nfunction domainIdFor(ownerId: string, daemonId: string, storageDriver: string, sentinelId: string): string {\n    return createHash(\"sha256\")\n        .update(`docker-images\\0${ownerId}\\0${daemonId}\\0${storageDriver}\\0${sentinelId}`)\n        .digest(\"hex\").slice(0, 24);\n}\nfunction inventoryState(actual: string | undefined, expected: string, leases: number): TaskBuildInventoryEntry[\"state\"] {\n    return actual !== expected ? \"unverified\" : leases > 0 ? \"active-leased\" : \"cold-reusable\";\n}\nfunction passesGcAgePolicy(row: EntryRow, now: number): boolean {\n    const lastUse = Date.parse(row.last_successful_use_at ?? row.created_at);\n    return Date.parse(row.protected_until) <= now && now - lastUse >= MAX_TASK_BUILD_AGE_MS;\n}\nfunction canonicalDigest(value: unknown): string {\n    return createHash(\"sha256\").update(JSON.stringify(value)).digest(\"hex\");\n}\nfunction digestPlan(plan: Omit<TaskBuildGcPlan, \"planDigest\">): string {\n    return canonicalDigest(plan);\n}\nfunction entryEvidence(row: EntryRow): Record<string, unknown> {\n    return {\n        buildKey: row.build_key,\n        imageId: row.image_id,\n        manifestDigest: row.manifest_digest,\n        generation: row.generation,\n        createdAt: row.created_at,\n        lastSuccessfulUseAt: row.last_successful_use_at,\n        protectedUntil: row.protected_until,\n    };\n}\nfunction stateRoot(): string {\n    const base = process.env.XDG_STATE_HOME ?? join(homedir(), \".local\", \"state\");\n    return join(base, \"niceeval\", \"cache\", \"v2\", \"domains\");\n}\nasync function docker(args: readonly string[], dockerSocketPath?: string): Promise<string> {\n    const connection = dockerSocketPath === undefined ? [] : [\"--host\", `unix://${dockerSocketPath}`];\n    const result = await execFileAsync(\"docker\", [...connection, ...args], { encoding: \"utf8\", maxBuffer: 4 * 1024 * 1024 });\n    return result.stdout.trim();\n}\nfunction decimalBytes(value: unknown): number | null {\n    if (typeof value !== \"string\")\n        return null;\n    const match = /^([0-9]+(?:\\.[0-9]+)?)\\s*([kmgtp]?b)$/iu.exec(value.trim());\n    if (match === null)\n        return null;\n    const power = [\"b\", \"kb\", \"mb\", \"gb\", \"tb\", \"pb\"].indexOf(match[2]!.toLowerCase());\n    return power < 0 ? null : Math.round(Number(match[1]) * 1000 ** power);\n}\nexport async function observeDockerBuildKitCapacity(): Promise<ProviderCapacityObservation> {\n    const output = await docker([\"system\", \"df\", \"--format\", \"json\"]);\n    const rows = output.split(/\\r?\\n/u).filter(Boolean).map((line) => JSON.parse(line) as Record<string, unknown>);\n    const build = rows.find((row) => row.Type === \"Build Cache\");\n    const reclaimable = typeof build?.Reclaimable === \"string\" ? build.Reclaimable.trim().split(/\\s+/u)[0] : undefined;\n    return Object.freeze({\n        scope: \"provider\",\n        providerFamily: \"docker\",\n        backendKind: \"buildkit\",\n        state: \"unverified\",\n        observedAt: new Date().toISOString(),\n        totalBytes: decimalBytes(build?.Size),\n        reclaimableEstimateBytes: decimalBytes(reclaimable),\n        reason: \"shared-builder-unattributed\",\n    });\n}\nasync function openDomain(dockerSocketPath?: string): Promise<DomainHandle> {\n    if (dockerSocketPath !== undefined)\n        throw new Error(\"managed Docker cache requires the default local Unix socket\");\n    const root = stateRoot();\n    mkdirSync(root, { recursive: true, mode: 0o700 });\n    const ownerPath = join(root, \"owner-id\");\n    let ownerId: string;\n    try {\n        ownerId = readFileSync(ownerPath, \"utf8\").trim();\n    }\n    catch {\n        ownerId = randomUUID();\n        const temporary = `${ownerPath}.${process.pid}.${randomUUID()}.tmp`;\n        writeFileSync(temporary, `${ownerId}\\n`, { encoding: \"utf8\", mode: 0o600, flag: \"wx\" });\n        try {\n            renameSync(temporary, ownerPath);\n        }\n        catch {\n            ownerId = readFileSync(ownerPath, \"utf8\").trim();\n        }\n    }\n    const sentinelName = `niceeval-cache-${createHash(\"sha256\").update(ownerId).digest(\"hex\").slice(0, 16)}`;\n    const sentinelLabel = \"io.niceeval.cache-domain\";\n    let sentinelId: string | undefined;\n    try {\n        sentinelId = await docker([\"volume\", \"inspect\", \"--format\", `{{index .Labels \\\"${sentinelLabel}\\\"}}`, sentinelName]);\n    }\n    catch {\n        sentinelId = randomUUID();\n        await docker([\"volume\", \"create\", \"--label\", `${sentinelLabel}=${sentinelId}`, sentinelName]);\n        sentinelId = await docker([\"volume\", \"inspect\", \"--format\", `{{index .Labels \\\"${sentinelLabel}\\\"}}`, sentinelName]);\n    }\n    if (sentinelId.length === 0 || sentinelId === \"<no value>\")\n        throw new Error(`Docker cache sentinel ${sentinelName} has no managed identity`);\n    const daemonId = await docker([\"info\", \"--format\", \"{{.ID}}\"], dockerSocketPath);\n    const storageDriver = await docker([\"info\", \"--format\", \"{{.Driver}}\"], dockerSocketPath);\n    const domainId = domainIdFor(ownerId, daemonId, storageDriver, sentinelId);\n    const backendIdentity = createHash(\"sha256\").update(`${daemonId}\\0${storageDriver}\\0${sentinelId}`).digest(\"hex\");\n    const directory = join(stateRoot(), domainId);\n    mkdirSync(directory, { recursive: true, mode: 0o700 });\n    const db = new DatabaseSync(join(directory, \"registry.sqlite\"));\n    db.exec(\"PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;\");\n    db.exec(`\n    CREATE TABLE IF NOT EXISTS entries (\n      build_key TEXT PRIMARY KEY,\n      tag TEXT NOT NULL,\n      image_id TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      last_successful_use_at TEXT,\n      protected_until TEXT NOT NULL,\n      manifest_digest TEXT NOT NULL,\n      generation INTEGER NOT NULL,\n      operation_id TEXT NOT NULL,\n      state TEXT NOT NULL CHECK(state IN ('indexed','deleting','tombstoned','unverified'))\n    );\n    CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);\n    CREATE TABLE IF NOT EXISTS leases (\n      lease_id TEXT PRIMARY KEY,\n      build_key TEXT NOT NULL REFERENCES entries(build_key),\n      holder_pid INTEGER NOT NULL,\n      holder_boot_id TEXT NOT NULL,\n      holder_process_start TEXT NOT NULL,\n      generation INTEGER NOT NULL,\n      created_at TEXT NOT NULL,\n      heartbeat_at TEXT NOT NULL\n    );\n    CREATE TABLE IF NOT EXISTS roots (\n      root_id TEXT PRIMARY KEY,\n      build_key TEXT NOT NULL REFERENCES entries(build_key),\n      generation INTEGER NOT NULL,\n      holder_boot_id TEXT NOT NULL,\n      holder_pid INTEGER NOT NULL,\n      holder_process_start TEXT NOT NULL,\n      state TEXT NOT NULL CHECK(state IN ('prepared','active')),\n      created_at TEXT NOT NULL\n    );\n    CREATE TABLE IF NOT EXISTS gc_plans (\n      plan_id TEXT PRIMARY KEY,\n      created_at TEXT NOT NULL,\n      expires_at TEXT NOT NULL,\n      payload TEXT NOT NULL,\n      digest TEXT NOT NULL,\n      outcome TEXT\n    );\n  `);\n    const epochRow = db.prepare(\"SELECT value FROM metadata WHERE key = 'authorityEpoch'\").get() as {\n        value: string;\n    } | undefined;\n    const authorityEpoch = epochRow?.value ?? randomUUID();\n    db.prepare(\"INSERT OR IGNORE INTO metadata(key, value) VALUES ('authorityEpoch', ?)\").run(authorityEpoch);\n    db.prepare(\"INSERT OR IGNORE INTO metadata(key, value) VALUES ('safetyRevision', '1')\").run();\n    const catalog = new DatabaseSync(join(root, \"catalog.sqlite\"));\n    catalog.exec(`\n    PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;\n    CREATE TABLE IF NOT EXISTS domains (\n      domain_id TEXT PRIMARY KEY,\n      provider_family TEXT NOT NULL,\n      admin_protocol_version INTEGER NOT NULL,\n      backend_kind TEXT NOT NULL,\n      first_verified_at TEXT NOT NULL,\n      last_verified_at TEXT NOT NULL,\n      last_state TEXT NOT NULL\n    );\n  `);\n    const verifiedAt = new Date().toISOString();\n    catalog.prepare(`\n    INSERT INTO domains(domain_id, provider_family, admin_protocol_version, backend_kind, first_verified_at, last_verified_at, last_state)\n    VALUES (?, 'docker', 1, 'docker-images', ?, ?, 'verified-managed')\n    ON CONFLICT(domain_id) DO UPDATE SET last_verified_at=excluded.last_verified_at, last_state='verified-managed'\n  `).run(domainId, verifiedAt, verifiedAt);\n    catalog.close();\n    return { domainId, ownerId, authorityEpoch, backendIdentity, db };\n}\nexport async function listDockerCacheDomains(): Promise<readonly CacheDomainDescriptor[]> {\n    const current = await openDomain();\n    current.db.close();\n    const catalog = new DatabaseSync(join(stateRoot(), \"catalog.sqlite\"), { readOnly: true });\n    const rows = catalog.prepare(\"SELECT domain_id, provider_family, admin_protocol_version, backend_kind FROM domains ORDER BY first_verified_at, domain_id\").all() as Array<{\n        domain_id: string;\n        provider_family: string;\n        admin_protocol_version: number;\n        backend_kind: string;\n    }>;\n    catalog.close();\n    return rows.map((row) => ({\n        providerFamily: \"docker\",\n        adminProtocolVersion: row.admin_protocol_version,\n        domainId: row.domain_id,\n        backendKind: row.backend_kind,\n        state: row.domain_id === current.domainId ? \"verified-managed\" : \"unavailable\",\n    }));\n}\nexport async function dockerTaskBuildAuthorityFingerprint(): Promise<string> {\n    const domain = await openDomain();\n    domain.db.close();\n    return domain.domainId;\n}\nasync function imageId(tag: string, dockerSocketPath?: string): Promise<string | undefined> {\n    try {\n        return await docker([\"image\", \"inspect\", \"--format\", \"{{.Id}}\", tag], dockerSocketPath);\n    }\n    catch {\n        return undefined;\n    }\n}\nasync function hasContainerReference(image: string, dockerSocketPath?: string): Promise<boolean> {\n    return (await docker([\"ps\", \"-a\", \"--filter\", `ancestor=${image}`, \"--quiet\"], dockerSocketPath)).length > 0;\n}\nfunction holderIdentity(pid = process.pid): {\n    bootId: string;\n    processStart: string;\n} {\n    const bootId = readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim();\n    const stat = readFileSync(`/proc/${pid}/stat`, \"utf8\").trim();\n    const processStart = stat.slice(stat.lastIndexOf(\")\") + 2).split(/\\s+/u)[19];\n    if (bootId.length === 0 || processStart === undefined)\n        throw new Error(\"cannot verify local process identity\");\n    return { bootId, processStart };\n}\nfunction processIdentityIsLive(pid: number, bootId: string, processStart: string): boolean {\n    try {\n        const actual = holderIdentity(pid);\n        return actual.bootId === bootId && actual.processStart === processStart;\n    }\n    catch {\n        return false;\n    }\n}\nclass LiveTaskBuildCacheSession implements TaskBuildCacheService {\n    async lookup(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<boolean> {\n        const domain = await openDomain(dockerSocketPath);\n        const row = domain.db.prepare(\"SELECT * FROM entries WHERE build_key = ? AND state = 'indexed'\").get(buildKey) as EntryRow | undefined;\n        if (row === undefined || row.tag !== tag || row.manifest_digest !== manifestDigest) {\n            domain.db.close();\n            return false;\n        }\n        const actual = await imageId(tag, dockerSocketPath);\n        if (actual === undefined || actual !== row.image_id) {\n            domain.db.prepare(\"UPDATE entries SET state = 'unverified' WHERE build_key = ?\").run(buildKey);\n            domain.db.close();\n            return false;\n        }\n        domain.db.close();\n        return true;\n    }\n    async publish(buildKey: string, tag: string, manifestDigest: string, operationId: string, dockerSocketPath?: string): Promise<void> {\n        const actual = await imageId(tag, dockerSocketPath);\n        if (actual === undefined)\n            throw new Error(`built image ${tag} is absent after build`);\n        const domain = await openDomain(dockerSocketPath);\n        const now = new Date();\n        domain.db.prepare(`\n      INSERT INTO entries(build_key, tag, image_id, created_at, last_successful_use_at, protected_until, manifest_digest, generation, operation_id, state)\n      VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?, 'indexed')\n      ON CONFLICT(build_key) DO UPDATE SET\n        tag=excluded.tag, image_id=excluded.image_id, created_at=excluded.created_at,\n        last_successful_use_at=excluded.last_successful_use_at,\n        protected_until=excluded.protected_until, manifest_digest=excluded.manifest_digest,\n        generation=CASE WHEN entries.operation_id = excluded.operation_id THEN entries.generation ELSE entries.generation + 1 END,\n        operation_id=excluded.operation_id, state='indexed'\n    `).run(buildKey, tag, actual, now.toISOString(), now.toISOString(), new Date(now.getTime() + MINIMUM_AGE_MS).toISOString(), manifestDigest, operationId);\n        domain.db.prepare(\"UPDATE metadata SET value = CAST(value AS INTEGER) + 1 WHERE key = 'safetyRevision'\").run();\n        domain.db.close();\n    }\n    async acquireUse(buildKey: string, tag: string, manifestDigest: string, dockerSocketPath?: string): Promise<{\n        release(): void;\n    }> {\n        const domain = await openDomain(dockerSocketPath);\n        const row = domain.db.prepare(\"SELECT * FROM entries WHERE build_key = ? AND state = 'indexed'\").get(buildKey) as EntryRow | undefined;\n        if (row === undefined || row.tag !== tag || row.manifest_digest !== manifestDigest || await imageId(tag, dockerSocketPath) !== row.image_id) {\n            domain.db.close();\n            throw new Error(`Docker task-build artifact ${buildKey.slice(0, 12)} is no longer available`);\n        }\n        const leaseId = randomUUID();\n        const rootId = randomUUID();\n        const now = new Date().toISOString();\n        const holder = holderIdentity();\n        domain.db.exec(\"BEGIN IMMEDIATE\");\n        try {\n            domain.db.prepare(\"INSERT INTO leases(lease_id, build_key, holder_pid, holder_boot_id, holder_process_start, generation, created_at, heartbeat_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)\")\n                .run(leaseId, buildKey, process.pid, holder.bootId, holder.processStart, row.generation, now, now);\n            domain.db.prepare(\"INSERT INTO roots(root_id, build_key, generation, holder_boot_id, holder_pid, holder_process_start, state, created_at) VALUES (?, ?, ?, ?, ?, ?, 'prepared', ?)\")\n                .run(rootId, buildKey, row.generation, holder.bootId, process.pid, holder.processStart, now);\n            domain.db.prepare(\"UPDATE roots SET state = 'active' WHERE root_id = ? AND state = 'prepared'\").run(rootId);\n            domain.db.prepare(\"UPDATE entries SET last_successful_use_at = ? WHERE build_key = ?\").run(now, buildKey);\n            domain.db.exec(\"COMMIT\");\n        }\n        catch (cause) {\n            domain.db.exec(\"ROLLBACK\");\n            domain.db.close();\n            throw cause;\n        }\n        let released = false;\n        const heartbeat = setInterval(() => {\n            if (released)\n                return;\n            try {\n                domain.db.prepare(\"UPDATE leases SET heartbeat_at = ? WHERE lease_id = ?\").run(new Date().toISOString(), leaseId);\n            }\n            catch {\n                // The holder identity and durable root remain authoritative; reconciliation will classify an unreadable registry as unverified.\n            }\n        }, 30000);\n        heartbeat.unref();\n        return { release() {\n                if (released)\n                    return;\n                released = true;\n                clearInterval(heartbeat);\n                domain.db.exec(\"BEGIN IMMEDIATE\");\n                try {\n                    domain.db.prepare(\"DELETE FROM roots WHERE root_id = ?\").run(rootId);\n                    domain.db.prepare(\"DELETE FROM leases WHERE lease_id = ?\").run(leaseId);\n                    domain.db.exec(\"COMMIT\");\n                }\n                catch (cause) {\n                    domain.db.exec(\"ROLLBACK\");\n                    throw cause;\n                }\n                domain.db.close();\n            } };\n    }\n}\nexport function makeTaskBuildCacheService(): TaskBuildCacheService {\n    return new LiveTaskBuildCacheSession();\n}\nfunction liveLeaseCount(db: DatabaseSync, buildKey: string): number {\n    const rows = db.prepare(\"SELECT lease_id, holder_pid, holder_boot_id, holder_process_start FROM leases WHERE build_key = ?\").all(buildKey) as Array<{\n        lease_id: string;\n        holder_pid: number;\n        holder_boot_id: string;\n        holder_process_start: string;\n    }>;\n    let live = 0;\n    for (const row of rows) {\n        if (processIdentityIsLive(row.holder_pid, row.holder_boot_id, row.holder_process_start)) {\n            live += 1;\n        }\n        else {\n            db.prepare(\"DELETE FROM leases WHERE lease_id = ?\").run(row.lease_id);\n        }\n    }\n    return live;\n}\nfunction liveRootCount(db: DatabaseSync, buildKey: string): number {\n    const rows = db.prepare(\"SELECT root_id, holder_pid, holder_boot_id, holder_process_start FROM roots WHERE build_key = ?\").all(buildKey) as Array<{\n        root_id: string;\n        holder_pid: number;\n        holder_boot_id: string;\n        holder_process_start: string;\n    }>;\n    let live = 0;\n    for (const row of rows) {\n        if (processIdentityIsLive(row.holder_pid, row.holder_boot_id, row.holder_process_start))\n            live += 1;\n        else\n            db.prepare(\"DELETE FROM roots WHERE root_id = ?\").run(row.root_id);\n    }\n    return live;\n}\nexport async function inventoryTaskBuildDomain(dockerSocketPath?: string): Promise<TaskBuildDomainInventory> {\n    const domain = await openDomain(dockerSocketPath);\n    const rows = domain.db.prepare(\"SELECT * FROM entries ORDER BY COALESCE(last_successful_use_at, created_at), created_at, build_key\").all() as unknown as EntryRow[];\n    const entries: TaskBuildInventoryEntry[] = [];\n    for (const row of rows) {\n        const actual = await imageId(row.tag, dockerSocketPath);\n        const leases = liveLeaseCount(domain.db, row.build_key) + liveRootCount(domain.db, row.build_key);\n        entries.push({\n            buildKey: row.build_key,\n            tag: row.tag,\n            imageId: row.image_id,\n            createdAt: row.created_at,\n            lastSuccessfulUseAt: row.last_successful_use_at,\n            protectedUntil: row.protected_until,\n            state: inventoryState(actual, row.image_id, leases),\n        });\n    }\n    domain.db.close();\n    return { domainId: domain.domainId, providerFamily: \"docker\", backendKind: \"docker-images\", state: \"verified-managed\", entries };\n}\nexport async function planTaskBuildGc(domainId: string): Promise<TaskBuildGcPlan> {\n    const domain = await openDomain();\n    if (domain.domainId !== domainId) {\n        domain.db.close();\n        throw new Error(`unknown Docker image cache domain ${domainId}`);\n    }\n    const now = new Date();\n    const candidates: TaskBuildGcPlan[\"candidates\"][number][] = [];\n    const rows = domain.db.prepare(\"SELECT * FROM entries WHERE state = 'indexed' ORDER BY COALESCE(last_successful_use_at, created_at), created_at, build_key\").all() as unknown as EntryRow[];\n    for (const row of rows) {\n        if (!passesGcAgePolicy(row, now.getTime()))\n            continue;\n        if (liveLeaseCount(domain.db, row.build_key) > 0)\n            continue;\n        if (liveRootCount(domain.db, row.build_key) > 0)\n            continue;\n        if (await imageId(row.tag) !== row.image_id)\n            continue;\n        if (await hasContainerReference(row.image_id))\n            continue;\n        const evidence = entryEvidence(row);\n        candidates.push({\n            buildKey: row.build_key,\n            tag: row.tag,\n            imageId: row.image_id,\n            manifestDigest: row.manifest_digest,\n            generation: row.generation,\n            evidenceDigest: canonicalDigest(evidence),\n            ruleId: \"max-age/task-build\",\n        });\n    }\n    const revision = Number((domain.db.prepare(\"SELECT value FROM metadata WHERE key = 'safetyRevision'\").get() as {\n        value: string;\n    }).value);\n    const unsigned: Omit<TaskBuildGcPlan, \"planDigest\"> = {\n        schemaVersion: 1,\n        planId: randomUUID(),\n        domainId,\n        ownerId: domain.ownerId,\n        backendIdentity: domain.backendIdentity,\n        authorityEpoch: domain.authorityEpoch,\n        policyVersion: 1,\n        registrySafetyRevision: revision,\n        observedAt: now.toISOString(),\n        expiresAt: new Date(now.getTime() + PLAN_TTL_MS).toISOString(),\n        candidates,\n    };\n    const plan: TaskBuildGcPlan = { ...unsigned, planDigest: digestPlan(unsigned) };\n    domain.db.prepare(\"INSERT INTO gc_plans(plan_id, created_at, expires_at, payload, digest) VALUES (?, ?, ?, ?, ?)\")\n        .run(plan.planId, plan.observedAt, plan.expiresAt, JSON.stringify(plan), plan.planDigest);\n    domain.db.close();\n    return plan;\n}\nexport interface TaskBuildGcOutcome {\n    readonly planId: string;\n    readonly domainId: string;\n    readonly outcomes: ReadonlyArray<{\n        readonly buildKey: string;\n        readonly status: \"deleted\" | \"already-absent\" | \"skipped\" | \"failed\";\n        readonly reason: string;\n    }>;\n}\nexport async function applyTaskBuildGc(domainId: string, planId: string): Promise<TaskBuildGcOutcome> {\n    const domain = await openDomain();\n    if (domain.domainId !== domainId) {\n        domain.db.close();\n        throw new Error(`unknown Docker image cache domain ${domainId}`);\n    }\n    const saved = domain.db.prepare(\"SELECT expires_at, payload, digest, outcome FROM gc_plans WHERE plan_id = ?\").get(planId) as {\n        expires_at: string;\n        payload: string;\n        digest: string;\n        outcome: string | null;\n    } | undefined;\n    if (saved === undefined) {\n        domain.db.close();\n        throw new Error(`unknown GC plan ${planId}`);\n    }\n    if (saved.outcome !== null) {\n        const outcome = JSON.parse(saved.outcome);\n        domain.db.close();\n        return outcome;\n    }\n    if (Date.parse(saved.expires_at) < Date.now()) {\n        domain.db.close();\n        throw new Error(`GC plan ${planId} expired`);\n    }\n    const plan = JSON.parse(saved.payload) as TaskBuildGcPlan;\n    const { planDigest: persistedPlanDigest, ...unsigned } = plan;\n    if (saved.digest !== persistedPlanDigest || digestPlan(unsigned) !== persistedPlanDigest) {\n        domain.db.close();\n        throw new Error(`GC plan ${planId} is corrupt`);\n    }\n    if (plan.domainId !== domain.domainId ||\n        plan.ownerId !== domain.ownerId ||\n        plan.backendIdentity !== domain.backendIdentity ||\n        plan.authorityEpoch !== domain.authorityEpoch ||\n        plan.policyVersion !== 1) {\n        domain.db.close();\n        throw new Error(`GC plan ${planId} authority changed`);\n    }\n    const outcomes: Array<{\n        buildKey: string;\n        status: \"deleted\" | \"already-absent\" | \"skipped\" | \"failed\";\n        reason: string;\n    }> = [];\n    for (const candidate of plan.candidates) {\n        domain.db.exec(\"BEGIN IMMEDIATE\");\n        let row: EntryRow | undefined;\n        try {\n            row = domain.db.prepare(\"SELECT * FROM entries WHERE build_key = ?\").get(candidate.buildKey) as EntryRow | undefined;\n            if (row === undefined || (row.state !== \"indexed\" && row.state !== \"deleting\") || row.image_id !== candidate.imageId ||\n                row.manifest_digest !== candidate.manifestDigest || row.generation !== candidate.generation ||\n                canonicalDigest(entryEvidence(row)) !== candidate.evidenceDigest ||\n                liveLeaseCount(domain.db, candidate.buildKey) > 0 || liveRootCount(domain.db, candidate.buildKey) > 0) {\n                domain.db.exec(\"ROLLBACK\");\n                outcomes.push({ buildKey: candidate.buildKey, status: \"skipped\", reason: \"entry-lease-root-or-generation-changed\" });\n                continue;\n            }\n            domain.db.prepare(\"UPDATE entries SET state = 'deleting' WHERE build_key = ? AND generation = ? AND state IN ('indexed','deleting')\")\n                .run(candidate.buildKey, candidate.generation);\n            domain.db.exec(\"COMMIT\");\n        }\n        catch (cause) {\n            domain.db.exec(\"ROLLBACK\");\n            outcomes.push({ buildKey: candidate.buildKey, status: \"failed\", reason: cause instanceof Error ? cause.message : String(cause) });\n            continue;\n        }\n        const actual = await imageId(row.tag);\n        if (actual === undefined) {\n            domain.db.prepare(\"UPDATE entries SET state = 'tombstoned' WHERE build_key = ? AND generation = ? AND state = 'deleting'\")\n                .run(candidate.buildKey, candidate.generation);\n            outcomes.push({ buildKey: candidate.buildKey, status: \"already-absent\", reason: \"provider-confirmed-absent\" });\n            continue;\n        }\n        if (actual !== candidate.imageId || await hasContainerReference(candidate.imageId)) {\n            domain.db.prepare(\"UPDATE entries SET state = 'indexed' WHERE build_key = ? AND generation = ? AND state = 'deleting'\")\n                .run(candidate.buildKey, candidate.generation);\n            outcomes.push({ buildKey: candidate.buildKey, status: \"skipped\", reason: \"resource-or-reference-changed\" });\n            continue;\n        }\n        try {\n            await docker([\"image\", \"rm\", candidate.imageId]);\n            if (await imageId(row.tag) !== undefined || await hasContainerReference(candidate.imageId)) {\n                domain.db.prepare(\"UPDATE entries SET state = 'unverified' WHERE build_key = ? AND generation = ? AND state = 'deleting'\")\n                    .run(candidate.buildKey, candidate.generation);\n                outcomes.push({ buildKey: candidate.buildKey, status: \"failed\", reason: \"image-still-present\" });\n                continue;\n            }\n            domain.db.prepare(\"UPDATE entries SET state = 'tombstoned' WHERE build_key = ? AND generation = ? AND state = 'deleting'\")\n                .run(candidate.buildKey, candidate.generation);\n            outcomes.push({ buildKey: candidate.buildKey, status: \"deleted\", reason: \"max-age/task-build\" });\n        }\n        catch (cause) {\n            domain.db.prepare(\"UPDATE entries SET state = 'unverified' WHERE build_key = ? AND generation = ? AND state = 'deleting'\")\n                .run(candidate.buildKey, candidate.generation);\n            outcomes.push({ buildKey: candidate.buildKey, status: \"failed\", reason: cause instanceof Error ? cause.message : String(cause) });\n        }\n    }\n    const result = { planId, domainId, outcomes } as const;\n    domain.db.prepare(\"UPDATE gc_plans SET outcome = ? WHERE plan_id = ?\").run(JSON.stringify(result), planId);\n    domain.db.close();\n    return result;\n}\nexport const liveTaskBuildCacheAdminService: TaskBuildCacheAdminService = Object.freeze({\n    inventory: inventoryTaskBuildDomain,\n    planGc: planTaskBuildGc,\n    applyGc: applyTaskBuildGc,\n});\n"]}