orizu 0.5.19 → 0.5.21

package/dist/hosted-loop-lifecycle.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Hosted-loop LIFECYCLE seam (ALI-1015 Phase 1, per ADR-005 Resolution).
+ *
+ * The orchestration-facing parts of the hosted loop, extracted VERBATIM from
+ * `hosted-loop.ts` so they can be re-exported through the shared
+ * `lib/hosted-runtime/` surface and driven by a server-side coordinator (the
+ * per-session Durable Object) as well as the CLI. This module deliberately
+ * carries NO harness/runtime machinery: its only import is the TYPE-ONLY
+ * `HarnessEvent` (erased at compile time), so a Worker bundle that pulls the
+ * lifecycle seam never drags in the OpenCode/Claude-SDK drivers or any Node
+ * child-process code.
+ *
+ * Contents (moved, not rewritten — behavior identical):
+ *   - `HostedLoopContext` — the run-scoped boot context the host orchestrator
+ *     writes for the in-sandbox loop;
+ *   - `buildOpenCodeSpawnEnv` — the pre-authenticated agent env (ALI-1044);
+ *   - the G5 egress canary: `runEgressCanary`, `egressCanaryAllowedHost`,
+ *     `defaultProbeEgress`, and their types/constants;
+ *   - `SetupHookOutcome` — the deferred customer-setup-hook contract.
+ *
+ * `hosted-loop.ts` re-exports everything here, so the CLI's import surface
+ * (`@/packages/cli/src/hosted-loop`) is unchanged.
+ */
+import type { HarnessEvent } from './hosted-harness.js';
+/**
+ * Default provider-qualified hosted model — the SINGLE source of truth
+ * (ALI-1086). Imported by both the operator-path session CLI
+ * (`hosted-session-cli.ts`) and the DO-path boot (`hosted-boot.ts`); never
+ * re-inline it.
+ *
+ * PIN CONSTRAINT: the hosted OpenCode runtime is HARD-PINNED to
+ * `opencode-ai@1.14.41` (`OPENCODE_PINNED_VERSION`, SSE-fragile — do not bump)
+ * whose BUNDLED model catalog predates this model (newest bundled anthropic
+ * opus: claude-opus-4-7). Verified empirically on ALI-1086: 1.14.41 DOES fetch
+ * `https://models.dev/api.json` at boot when reachable (cached to
+ * `~/.cache/opencode/models.json`, refreshed when stale, disabled only by
+ * `OPENCODE_DISABLE_MODELS_FETCH`), so with models.dev on the sandbox egress
+ * allowlist (#1392, `ORIZU_HOSTED_EGRESS_ALLOWLIST`) this id resolves in new
+ * sandboxes. If the catalog fetch is blocked/stale anyway, the loop's
+ * pre-prompt validation (`awaitOpenCodeModelResolvable`) fails the run fast,
+ * naming the resolvable alternatives. The durable fix for the stale bundled
+ * catalog is the ALI-929 harness swap.
+ */
+export declare const DEFAULT_HOSTED_MODEL = "anthropic/claude-opus-4-8";
+/**
+ * The run-scoped context the host orchestrator writes for the loop. Paths are
+ * ABSOLUTE (or sandbox-root-relative) so the loop resolves them regardless of
+ * cwd. NO secret lives here — the bearer is read from `bearerFile` (0600).
+ */
+export interface HostedLoopContext {
+    apiBaseUrl: string;
+    runId: string;
+    /** 0600 file holding the agent bearer (never inlined into this context). */
+    bearerFile: string;
+    /** File holding the single task prompt (v0: one prompt, no queue). */
+    taskFile: string;
+    /** Directory the agent operates in (the cloned session-branch workspace). */
+    workspaceDir: string;
+    /** Provider-qualified model, e.g. "anthropic/claude-opus-4-8". */
+    model: string;
+    reasoningEffort?: string;
+    /** Idempotency / correlation key for the prompt. */
+    messageId: string;
+    /** Git identity for commit attribution during the prompt. */
+    author: {
+        name: string;
+        email: string;
+    };
+    /**
+     * Which `AgentHarness` drives the loop (ALI-929 swappability seam). Default
+     * 'opencode'. 'claude-agent-sdk' selects the in-process Claude-Agent-SDK driver
+     * — no `opencode` install/spawn happens on that path.
+     */
+    harness?: 'opencode' | 'claude-agent-sdk';
+    /**
+     * Total sandbox lifetime budget in ms (derived from the session `--duration`).
+     * The loop derives the per-prompt max-duration cap from this (budget minus a
+     * harvest margin, floored at the harness default) so a long `--duration` run is
+     * NOT killed at the hard-coded 90-min prompt cap while its sandbox still lives
+     * (ALI-1061). Unset for undated runs → the harness default (5400s) floor holds.
+     */
+    sandboxBudgetMs?: number;
+    opencodePort?: number;
+    opencodePinnedVersion?: string;
+    /**
+     * Pre-baked runtime (ALI-1017): the image already ships the pinned `opencode`
+     * on PATH, so the loop SKIPS the `opencode-ai` install (npm is blocked under G5
+     * default-deny egress) and spawns `opencode` directly, recording an
+     * `opencode_prebaked` artifact instead of `opencode_install`. The host sets this
+     * together with the sandbox `image` so the two never disagree. When unset, the
+     * loop ALSO belt-checks the `/opt/orizu/prebaked.json` marker; either signal
+     * skips the install. Ignored on the claude-agent-sdk path (no server to install).
+     */
+    prebaked?: boolean;
+    /**
+     * Non-secret placeholder key OpenCode is given so it FORMS model requests; the
+     * sandbox firewall's request transform overrides the real auth header at the
+     * proxy (model-key brokering, G3). Never a real key.
+     */
+    anthropicDummyKey?: string;
+    /** OpenCode session id to resume on reconnect. */
+    resumeAgentSessionId?: string;
+    /**
+     * Startup egress-canary probe host (G5 / ALI-1006). When SET, the loop runs a
+     * POSITIVE-CONTROL canary before any agent work, probing BOTH this known
+     * NON-allowlisted (denied) host AND a known-allowed host (the Orizu API base,
+     * derived from `apiBaseUrl`). The run proceeds ONLY IF the allowed host is
+     * reachable AND the denied host is blocked (`egress_blocked` proof). Any other
+     * outcome FAILS the run closed (`egress_allowed`): the denied host reachable
+     * means the firewall did not take; the allowed host ALSO unreachable means the
+     * network is broken and we cannot distinguish policy-enforcement from a total
+     * outage — either way we must not proceed to real customer data. The host sets
+     * this only for providers that actually enforce egress (Vercel); it is UNSET
+     * for local-sim / no-policy runs, so the canary is skipped there. Default
+     * denied probe target: `example.com`.
+     */
+    egressCanaryHost?: string;
+    /**
+     * When true, run the customer `.orizu/setup.sh` hook HERE (in the loop), AFTER
+     * the egress canary has proven the firewall is live and BEFORE harness work.
+     * The host sets this for enforced-egress providers so bootstrap DEFERS the hook
+     * (which would otherwise get network access before the canary could detect a
+     * silent firewall failure). UNSET for local-sim / no-policy runs, where
+     * bootstrap runs the hook inline as before. See docs sandbox-egress-policy §4.
+     */
+    runSetupHook?: boolean;
+}
+/**
+ * Environment injected into the spawned OpenCode server so the AGENT's bash sees a
+ * PRE-AUTHENTICATED `orizu` CLI (ALI-1044). ORIZU_TOKEN_FILE points at the 0600
+ * rotated bearer file and ORIZU_BASE_URL at the Orizu API — the exact vars the
+ * CLI's auth resolution reads (resolveEnvBearerToken + resolveBaseUrl). The dummy
+ * ANTHROPIC key (model-key brokering, G3) is preserved. No real secret is carried
+ * here: the bearer stays on disk and is read fresh per request from the file.
+ */
+export declare function buildOpenCodeSpawnEnv(context: HostedLoopContext): Record<string, string> | undefined;
+/** Default egress-canary probe host (a known non-allowlisted destination). */
+export declare const DEFAULT_EGRESS_CANARY_HOST = "example.com";
+export interface EgressProbeResult {
+    /** True when the denied host was reachable (policy did NOT take → fail closed). */
+    reachable: boolean;
+    /** Short human/audit detail (HTTP status on reach, error class on block). */
+    detail: string;
+}
+/**
+ * Default probe: attempt a bounded HTTPS GET to `host`. A live default-deny
+ * firewall makes this THROW for a DENIED host (connection reset / timeout / DNS
+ * failure) → `reachable: false`. Any response at all — even an error status —
+ * proves the host was reachable → `reachable: true`. Used for BOTH the allowed
+ * (positive-control) and denied probes.
+ */
+export declare function defaultProbeEgress(host: string): Promise<EgressProbeResult>;
+/** The two hosts the positive-control canary probes. */
+export interface EgressCanaryTargets {
+    /** A known-ALLOWED host (the Orizu API base) that MUST be reachable — the
+     *  positive control that distinguishes "policy blocking" from "network dead". */
+    allowedHost: string;
+    /** A known-DENIED, non-allowlisted host that MUST be blocked (`example.com`). */
+    deniedHost: string;
+}
+export interface EgressCanaryDecision {
+    proceed: boolean;
+    /** Null on proceed; a human/audit reason for the fail-closed decision. */
+    reason: string | null;
+    allowed: EgressProbeResult;
+    denied: EgressProbeResult;
+}
+/**
+ * Run the startup egress canary as a POSITIVE CONTROL and emit the proof event
+ * through the (single-writer) sink. Probes BOTH a known-allowed host and the
+ * known-denied host, then decides:
+ *
+ *   - allowed REACHABLE and denied BLOCKED → the firewall is live AND the network
+ *     works → emit `egress_blocked` and PROCEED (the ONLY healthy outcome);
+ *   - denied REACHABLE → egress is NOT enforced → emit `egress_allowed`, FAIL
+ *     CLOSED;
+ *   - allowed ALSO UNREACHABLE (denied blocked but the positive control failed) →
+ *     we cannot tell policy-blocking from a total network outage → emit
+ *     `egress_allowed`, FAIL CLOSED.
+ *
+ * The `egress_blocked` kind therefore means EXACTLY "proceeded, positive control
+ * passed"; `egress_allowed` means "failed closed" (the payload `result` field
+ * distinguishes an unexpectedly-reachable denied host from an unreachable
+ * positive control). Old behavior — treating ANY denied-host throw (incl. a
+ * timeout under a total outage) as "blocked → proceed" — failed OPEN; this now
+ * fails closed on that ambiguity.
+ */
+export declare function runEgressCanary(targets: EgressCanaryTargets, sink: {
+    append: (event: HarnessEvent) => Promise<void>;
+}, probe: (host: string) => Promise<EgressProbeResult>, now?: () => number): Promise<EgressCanaryDecision>;
+/**
+ * Derive the known-ALLOWED positive-control host from the run's Orizu API base —
+ * always allowlisted (it is the agent's control-plane path) and ours, so it is
+ * the safest "must be reachable" signal. Falls back to a lenient host parse if
+ * the base is not a well-formed URL.
+ */
+export declare function egressCanaryAllowedHost(apiBaseUrl: string): string;
+/** Outcome of the deferred customer setup hook run inside the loop. */
+export interface SetupHookOutcome {
+    /** True when a `.orizu/setup.sh` existed and was executed. */
+    ran: boolean;
+    /** True when the hook was absent OR exited 0 (non-fatal either way). */
+    ok: boolean;
+    detail: string;
+}
+//# sourceMappingURL=hosted-loop-lifecycle.d.ts.map

package/dist/hosted-loop-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-loop-lifecycle.d.ts","sourceRoot":"","sources":["../src/hosted-loop-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAA;AAE/D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAA;IACzC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYpG;AAED,8EAA8E;AAC9E,eAAO,MAAM,0BAA0B,gBAAgB,CAAA;AAKvD,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAA;IAClB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAejF;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC;qFACiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE;IAAE,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EACxD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,EACnD,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAkE/B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMlE;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,GAAG,EAAE,OAAO,CAAA;IACZ,wEAAwE;IACxE,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf"}

package/dist/hosted-loop.d.ts

@@ -0,0 +1,170 @@
+/**
+ * In-sandbox hosted agent loop (ALI-928 / P3.5, per ADR-005).
+ *
+ * Runs INSIDE the sandbox (installed by the bootstrap CLI step, launched
+ * DETACHED by `orizu session start --hosted`). It composes the ALI-926 pieces:
+ *
+ *   1. resolve the loop boot context (a run-scoped JSON file written by the host
+ *      orchestrator) + read the agent bearer from its 0600 file (G3);
+ *   2. install `opencode` pinned to OPENCODE_PINNED_VERSION (non-fatal-RECORDED;
+ *      if it is unavailable the spawn/connect below fails and the run finishes
+ *      'failed' cleanly — the run never dangles);
+ *   3. build a RESUME-AWARE RunEventSink (continues the server's sequence after
+ *      the run-start + bootstrap events — so a reconnect loses nothing);
+ *   4. provision the `AgentHarness` SELECTED by `context.harness` (default
+ *      'opencode': install+spawn `opencode serve` then connect the OpenCode
+ *      driver; 'claude-agent-sdk': construct the in-process Claude-Agent-SDK
+ *      driver — no server to install or spawn), then drive the SINGLE task prompt
+ *      (v0: no queue) through `drainHarnessToSink`;
+ *   5. the terminal event decides the run's final status via the sink's PATCH.
+ *
+ * SWAPPABILITY (ALI-929 / P3.6): harness SELECTION is the ONLY thing that differs
+ * between the two drivers — `start()` → `runPrompt()` → `drainHarnessToSink()` →
+ * `shutdown()` is byte-identical for both, and the sink, event vocabulary, and
+ * terminal-PATCH flow are unchanged. That is the proof: a second harness drops in
+ * behind the seam with no change to any consumer beyond the selector.
+ *
+ * The redaction list carries the agent bearer (added automatically by the sink)
+ * plus any model key present in the process env (defense in depth for the G3
+ * per-exec fallback — with firewall brokering the real key never reaches here).
+ *
+ * TESTABILITY: `runHostedLoop` takes injected `fetchImpl`, `spawnOpenCode`,
+ * `installOpenCode`, and `createHarness`, so the whole loop runs in-process
+ * against a fake broker + fake OpenCode server with no real binary.
+ */
+import type { AgentHarness } from './hosted-harness.js';
+import { type HarvestExec } from './hosted-harvest.js';
+import { type ModelValidationOutcome, type SpawnOpenCodeOptions, type SpawnedOpenCode } from './hosted-harness-opencode.js';
+import { type HostedFetch, type TerminalStatus } from './hosted-run-event-sink.js';
+import { type EgressProbeResult, type HostedLoopContext, type SetupHookOutcome } from './hosted-loop-lifecycle.js';
+export { DEFAULT_EGRESS_CANARY_HOST, DEFAULT_HOSTED_MODEL, buildOpenCodeSpawnEnv, egressCanaryAllowedHost, runEgressCanary, } from './hosted-loop-lifecycle.js';
+export type { EgressCanaryDecision, EgressCanaryTargets, EgressProbeResult, HostedLoopContext, SetupHookOutcome, } from './hosted-loop-lifecycle.js';
+export declare const PROMPT_HARVEST_MARGIN_MS: number;
+/**
+ * Derive the per-prompt max-duration cap from the sandbox lifetime budget: the
+ * budget minus a harvest margin, FLOORED at the harness default so a short or
+ * undated run is never shortened below the historical 5400s cap (ALI-1061).
+ * Undated runs (`sandboxBudgetMs` unset / non-positive) get exactly the default.
+ */
+export declare function derivePromptMaxDurationMs(sandboxBudgetMs: number | undefined): number;
+export interface InstallResult {
+    ok: boolean;
+    detail: string;
+}
+export interface RunHostedLoopOptions {
+    context: HostedLoopContext;
+    /**
+     * Agent bearer, as a FIXED string (tests / in-process launcher) OR omitted in
+     * favor of `bearerProvider`. In production the loop reads the rotated 0600
+     * bearer file per request via a provider (see `bearerProvider`), so a
+     * host-side rotation is picked up without restarting the loop.
+     */
+    bearer?: string;
+    /** Per-request bearer resolver (default: read `context.bearerFile`, trimmed).
+     *  Passing a provider is what lets rotation reach the event sink. */
+    bearerProvider?: () => string;
+    /** The single task prompt (already read from the task file by the caller). */
+    taskPrompt: string;
+    fetchImpl?: HostedFetch;
+    /** Build the harness for a spawned OpenCode base URL (default: OpenCode driver).
+     *  `options.promptMaxDurationMs` is the duration-derived per-prompt cap (ALI-1061). */
+    createHarness?: (baseUrl: string, options?: {
+        promptMaxDurationMs?: number;
+    }) => AgentHarness;
+    /** Build the in-process Claude-Agent-SDK harness (default: real SDK loader).
+     *  Injectable so the swap test drives a fake `query()` with no real SDK. */
+    createClaudeHarness?: () => AgentHarness;
+    spawnOpenCode?: (opts: SpawnOpenCodeOptions) => SpawnedOpenCode | Promise<SpawnedOpenCode>;
+    installOpenCode?: () => Promise<InstallResult>;
+    /**
+     * Pre-prompt model validation against the RUNNING opencode's resolvable
+     * catalog (ALI-1086). Default: `awaitOpenCodeModelResolvable`, which polls
+     * `GET /config/providers` briefly so the boot-time models.dev refresh can
+     * land. An `unresolvable` outcome fails the run BEFORE the first prompt with
+     * an error naming the requested id and the resolvable alternatives; a
+     * `skipped` outcome (catalog endpoint unreachable) proceeds — opencode's own
+     * `session.error` remains the backstop. Injectable for tests.
+     */
+    validateModel?: (input: {
+        baseUrl: string;
+        model: string;
+    }) => Promise<ModelValidationOutcome>;
+    now?: () => number;
+    signal?: AbortSignal;
+    /** Extra verbatim secrets to redact (the bearer is added by the sink itself). */
+    redactSecretsList?: readonly string[];
+    /** Egress-canary probe (default: a bounded `fetch` to https://<host>/).
+     *  Injectable so tests exercise both the blocked and reachable branches with
+     *  no real network. Called once per host (allowed + denied) by the canary. */
+    probeEgress?: (host: string) => Promise<EgressProbeResult>;
+    /** Run the deferred customer setup hook (default: `bash .orizu/setup.sh` in the
+     *  workspace, non-fatal). Injectable so tests exercise the deferred-hook path
+     *  with no real filesystem or child process. */
+    runSetupHook?: (input: {
+        workspaceDir: string;
+    }) => Promise<SetupHookOutcome> | SetupHookOutcome;
+    /**
+     * Standing preamble wrapped around the user task (ALI-1036). Defaults to
+     * `HOSTED_TASK_PREAMBLE`; pass an override to customize it, or an empty string
+     * to send the task verbatim (tests). The user task is always kept verbatim
+     * beneath a delimiter (see `composeHostedTaskPrompt`).
+     */
+    taskPreamble?: string;
+    /**
+     * Injectable git runner for the end-of-run auto-harvest (ALI-1036). Default:
+     * real `git` via child_process in `context.workspaceDir`.
+     */
+    harvestExec?: HarvestExec;
+    /**
+     * Idle watchdog window (ALI-1037): abort the prompt + fail the run
+     * `agent_stalled` if NO progress event arrives for this many ms. Default: env
+     * `ORIZU_AGENT_IDLE_TIMEOUT_MS` or 25 minutes. <= 0 disables the watchdog.
+     */
+    idleTimeoutMs?: number;
+    /** Injectable sleep for the terminal-delivery retry backoff (ALI-1065
+     *  finding 2). Tests pass a no-op to avoid real delays. */
+    sleepImpl?: (ms: number) => Promise<void>;
+}
+export interface HostedLoopResult {
+    status: TerminalStatus;
+    agentSessionId: string | null;
+    installOk: boolean;
+    error: string | null;
+}
+/** Default idle-watchdog window (ALI-1037): abort a prompt that makes no progress
+ *  for this long. The timer resets on every harness EVENT, and a legitimate long
+ *  single tool call (a big `npm install`, a build, an optimization step) emits no
+ *  intermediate events — so this must comfortably exceed the longest expected
+ *  quiet tool call (review finding #2). Overridable per-run via `idleTimeoutMs` or
+ *  the `ORIZU_AGENT_IDLE_TIMEOUT_MS` env var. */
+export declare const DEFAULT_AGENT_IDLE_TIMEOUT_MS: number;
+/**
+ * Loop-level retry schedule for an undeliverable TERMINAL transition (ALI-1065
+ * finding 2). Each entry is a pause before one more full sink delivery cycle
+ * (which itself retries ~4 times over ~350ms), so a transport blip of a few
+ * seconds recovers with the ORIGINAL status instead of being re-recorded as
+ * 'failed'. Bounded: a persistently unreachable control plane fails the
+ * DELIVERY visibly (result.error) without recording a wrong outcome.
+ */
+export declare const TERMINAL_DELIVERY_RETRY_DELAYS_MS: readonly number[];
+/**
+ * Env var naming OTHER env vars whose values were injected as secrets — the
+ * server env-bundle pull (ALI-1055: `GET /api/coordinator/sessions/:id/
+ * env-bundle` returns `redactEnvVars`) writes it as a comma-separated list of
+ * names (e.g. `ANTHROPIC_API_KEY,BRAINTRUST_API_KEY`) so every pulled secret
+ * (model key + connector credentials) lands on the run-event redaction list.
+ */
+export declare const INJECTED_ENV_VARS_ENV = "ORIZU_INJECTED_ENV_VARS";
+export declare function runHostedLoop(opts: RunHostedLoopOptions): Promise<HostedLoopResult>;
+export interface HostedLoopCommandIo {
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    json?: boolean;
+}
+/**
+ * Read the loop context + bearer + task from disk and run the loop. Invoked
+ * in-sandbox as a hidden command; the run's terminal status is recorded
+ * server-side regardless of this process's exit code.
+ */
+export declare function hostedLoopCommand(args: readonly string[], io: HostedLoopCommandIo): Promise<number>;
+//# sourceMappingURL=hosted-loop.d.ts.map

package/dist/hosted-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-loop.d.ts","sourceRoot":"","sources":["../src/hosted-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,qBAAqB,CAAA;AAQtE,OAAO,EAAoB,KAAK,WAAW,EAAuB,MAAM,qBAAqB,CAAA;AAE7F,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAA;AAKnC,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,GAChB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,4BAA4B,CAAA;AAOnC,eAAO,MAAM,wBAAwB,QAAgB,CAAA;AAErD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKrF;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,iBAAiB,CAAA;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;yEACqE;IACrE,cAAc,CAAC,EAAE,MAAM,MAAM,CAAA;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB;2FACuF;IACvF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,YAAY,CAAA;IAC7F;gFAC4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,YAAY,CAAA;IACxC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1F,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9C;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC9F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;kFAE8E;IAC9E,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1D;;oDAEgD;IAChD,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAChG;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;+DAC2D;IAC3D,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAeD;;;;;iDAKiD;AACjD,eAAO,MAAM,6BAA6B,QAAiB,CAAA;AAa3D;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,EAAE,SAAS,MAAM,EAAmB,CAAA;AAKlF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,4BAA4B,CAAA;AA4E9D,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgZzF;AAID,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AASD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,mBAAmB,GACtB,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/hosted-run-event-sink.d.ts

@@ -0,0 +1,222 @@
+/**
+ * RunEventSink — the RunAPI event bridge (ALI-926 / P3.4, interface 2 of
+ * ADR-005's swappability contract; the full realization of audit §4b).
+ *
+ * This is the transport half that `bridge.py`'s WebSocket client is NOT: it maps
+ * normalized `HarnessEvent`s onto Orizu's append-only, client-sequenced
+ * `workbench_run_events` and terminal PATCH. It extends the seed
+ * `createBootstrapRunEventSink` (`hosted-bootstrap.ts`) into the complete bridge:
+ * kind-to-event-type mapping, token coalescing, monotonic client-sequenced
+ * allocation (gaps tolerated on an ambiguous append failure, but NEVER a content
+ * swap at a committed sequence — see the P2-4 burn rule in `postEvent`),
+ * critical-event delivery guarantees, terminal-via-PATCH, reconnect/resume, and
+ * the "Orizu records win" disagreement rule. A retried POST is an idempotent 200
+ * ONLY for a content-identical replay (same eventId, same sequence, same
+ * payload); a burned sequence after an ambiguous error leaves a server-visible
+ * gap, which is acceptable.
+ *
+ * ── Disagreement rule (Orizu records win) ────────────────────────────────────
+ * Orizu's RunAPI is the source of truth; the OpenCode-side session state is a
+ * cache/UX layer. If the harness reports state that CONTRADICTS a terminal Orizu
+ * run status — e.g. it keeps streaming parts after the run was finished — the
+ * sink REFUSES to append: once `finish()` succeeds the sink is SEALED, and any
+ * later `append()` throws `RunTerminalError` locally rather than POSTing. The
+ * sink never un-terminates a run and never invents a new one. A run-gone/terminal
+ * signal from the server (append 404/410, or a persistent terminal-status 409 on
+ * the finish PATCH) is likewise accepted as truth, sealing the sink. Note the
+ * narrow classifications: a 403 is NOT "terminal" — it is a `RunAuthError`
+ * (revoked bearer or lost access) that does not seal, and a 409 whose run is
+ * still running does NOT report success. The harness is a subordinate producer;
+ * the server record wins every disagreement.
+ *
+ * ── Artifact-ref decision (transcript/summary) ───────────────────────────────
+ * The audit points at `lib/primitive-artifact-writer.server.ts`, but that is
+ * server-only Supabase/object-store code the sandbox cannot import, and the
+ * CLI's existing artifact write paths (`orizu runners/prompts/... push`) are all
+ * PROJECT-scoped versioned-primitive uploads — there is NO run-scoped artifact
+ * write path today. Per ADR-003 (do not invent a new storage convention), a
+ * transcript is recorded as a BOUNDED-TAIL run event (`agent_transcript`,
+ * `TRANSCRIPT_TAIL_MAX_CHARS`) appended BEFORE the terminal PATCH (a post-terminal
+ * append would be refused by the seal). TODO(P3.6/ALI-928): when a run-scoped
+ * artifact-ref CLI path lands, swap the tail event for a real object ref.
+ */
+import type { HarnessEvent, HarnessEventKind } from './hosted-harness.js';
+export type HostedFetch = (url: string, init?: RequestInit) => Promise<Response>;
+export declare const EGRESS_ALLOWED_EVENT_TYPE = "egress_allowed";
+export declare const EGRESS_BLOCKED_EVENT_TYPE = "egress_blocked";
+/** The RunAPI event type a harness kind maps to, or null if it is not appendable
+ *  (terminal kinds route through the PATCH; deferred kinds have no mapping yet). */
+export declare function eventTypeForKind(kind: HarnessEventKind): string | null;
+export declare const AGENT_TOKEN_EVENT_TYPE = "agent_token";
+export declare const AGENT_TRANSCRIPT_EVENT_TYPE = "agent_transcript";
+/** Bounded tail size for the transcript stopgap (see artifact-ref decision). */
+export declare const TRANSCRIPT_TAIL_MAX_CHARS = 16384;
+export declare const CREDENTIAL_ROTATED_EVENT_TYPE = "credential_rotated";
+export declare const CREDENTIAL_MINT_FAILED_EVENT_TYPE = "credential_mint_failed";
+export type TerminalStatus = 'succeeded' | 'failed' | 'cancelled';
+export interface FinishOptions {
+    summary?: Record<string, unknown>;
+    evidence?: Record<string, unknown>;
+    /** Full agent transcript; stored as a bounded-tail `agent_transcript` event
+     *  BEFORE the terminal PATCH (see the artifact-ref decision docblock). */
+    transcript?: string;
+}
+export interface RunEventSink {
+    /** Map + coalesce + POST a harness event. Owns per-run monotonic sequence.
+     *  Terminal kinds are rejected (they must go through `finish`). */
+    append(event: HarnessEvent): Promise<void>;
+    /** Force-flush any coalesced token snapshots (also runs on every structural
+     *  event and on `finish`). Exposed so callers can flush on a timer if desired. */
+    flushTokens(): Promise<void>;
+    /** Terminal transition via PATCH; records the transcript tail first, then CAS. */
+    finish(status: TerminalStatus, opts?: FinishOptions): Promise<void>;
+    /** True once a terminal transition has landed and the sink is sealed. */
+    readonly sealed: boolean;
+    /** The next sequence the sink will attempt to allocate (test/resume aid). */
+    readonly nextSequence: number;
+    /** Events the sink has confirmed appended, in order (redacted payloads). */
+    readonly recorded: readonly AppendedRunEvent[];
+}
+export interface AppendedRunEvent {
+    eventId: string;
+    sequence: number;
+    eventType: string;
+    payload: Record<string, unknown>;
+}
+/** Raised when an append is attempted against a run the sink knows is terminal. */
+export declare class RunTerminalError extends Error {
+    constructor(message: string);
+}
+/** Raised when a critical event (or the terminal PATCH) is undeliverable after
+ *  the bounded retry budget — the caller MUST treat the run as compromised. */
+export declare class CriticalDeliveryError extends Error {
+    constructor(message: string);
+}
+/**
+ * Raised when `finish()` itself is undeliverable (ALI-1065 finding 2): a
+ * CriticalDeliveryError thrown WHILE DELIVERING A TERMINAL TRANSITION, carrying
+ * the intended status + finish options so the caller can retry the delivery
+ * with the ORIGINAL outcome. Before this, the error surfaced as a bare
+ * CriticalDeliveryError and the loop's generic catch re-finished the run
+ * 'failed' — a ~1s transport blip on the SUCCESS terminal recorded a succeeded
+ * run as failed. Subclasses CriticalDeliveryError so existing classification
+ * (drop-vs-surface) is unchanged.
+ */
+export declare class TerminalDeliveryError extends CriticalDeliveryError {
+    readonly intendedStatus: TerminalStatus;
+    readonly finishOptions: FinishOptions | undefined;
+    constructor(message: string, intendedStatus: TerminalStatus, finishOptions?: FinishOptions);
+}
+/**
+ * Raised on a 403 from the RunAPI. Named for what a 403 actually is — NOT "the
+ * run is terminal" (that is 404/410). A 403 means the caller may no longer write
+ * this run: the session bearer was revoked, OR the agent lost access to the run
+ * (e.g. its session was reassigned). The write definitely did not land, so the
+ * sink does NOT seal and does NOT burn the sequence; the caller decides whether
+ * to re-authenticate or abandon the run.
+ */
+export declare class RunAuthError extends Error {
+    constructor(message: string);
+}
+export interface CreateRunEventSinkOptions {
+    apiBaseUrl: string;
+    runId: string;
+    /**
+     * The Orizu bearer, EITHER a fixed string OR a provider resolved per request.
+     * A provider (e.g. one that reads the rotated 0600 bearer file) lets the sink
+     * pick up a host-side token rotation without being rebuilt: every request
+     * resolves the current value, and on a 401/403 the sink re-resolves ONCE and
+     * retries before classifying the failure (fresh token after rotation).
+     */
+    bearer: string | (() => string);
+    fetchImpl?: HostedFetch;
+    /**
+     * Verbatim secrets to strip from every payload before it leaves the sandbox.
+     *
+     * THIS IS THE REDACTION GUARANTEE. Exact-match on these values is the control
+     * we rely on — ANY secret that is present in the sandbox (the run bearer is
+     * added automatically; also pass every minted repo token, model-provider API
+     * key, and any credential a customer setup step injects) MUST appear in this
+     * list. Whatever is here is scrubbed wherever it appears, even mid-string and
+     * regardless of its shape. The token-shape patterns in `secret-redaction.ts`
+     * are only defense-in-depth for credentials no one declared; never treat a
+     * shape match as the primary safeguard.
+     */
+    redactSecretsList?: readonly string[];
+    now?: () => number;
+    /** First sequence to allocate (resume sets this to server cursor + 1). */
+    startSequence?: number;
+    /** eventId namespace; deterministic ids `<prefix>:<sequence>` make a replayed
+     *  event an idempotent 200 (never a 409 same-sequence-different-eventId). */
+    eventIdPrefix?: string;
+    /** Bounded retry budget for critical deliveries (append critical + finish). */
+    maxCriticalAttempts?: number;
+    /**
+     * Bounded retry budget for NON-critical appends (agent_tool_call, agent_step_*,
+     * token snapshots) before the event is DROPPED. Retries only on transient
+     * network/5xx failures; on exhaustion the event is dropped (never thrown), so a
+     * single bad POST in a multi-hour run never fails the whole run (ALI-1061).
+     * Default 3.
+     */
+    maxNonCriticalAttempts?: number;
+    /** Injectable backoff sleep (tests pass a no-op to avoid real delays). */
+    sleepImpl?: (ms: number) => Promise<void>;
+    /** Local diagnostic sink for disagreement-rule logs (never throws). */
+    onDiagnostic?: (message: string) => void;
+}
+export declare function createRunEventSink(options: CreateRunEventSinkOptions): RunEventSink;
+export interface ResumeRunEventSinkOptions extends Omit<CreateRunEventSinkOptions, 'startSequence'> {
+    /** Page size for the cursor tail while discovering the latest sequence. */
+    pageSize?: number;
+}
+/**
+ * Rebuild a sink after a restart WITHOUT losing run continuity (acceptance:
+ * "reconnect/resume without losing run continuity"). Walks the events GET
+ * cursor tail to the end to learn the server's latest sequence, then returns a
+ * fresh sink whose first allocation is `latest + 1`.
+ *
+ * ── QUIESCE PRECONDITION (single-writer handoff) ─────────────────────────────
+ * This is safe ONLY when the predecessor sink has FULLY STOPPED before resume
+ * runs — the RunAPI is single-writer-per-run (see the events route), and resume
+ * assumes it is the sole writer while it reads the tail and picks the next
+ * sequence. It does NOT coordinate with a live predecessor. If a still-in-flight
+ * commit from a not-yet-dead sink lands AFTER we read the cursor, that sink and
+ * this one can both target the same next sequence. We do not claim "no
+ * collision": deterministic eventIds (`<runId>:<sequence>`) make an identical
+ * replay an idempotent 200, but two DIFFERENT payloads racing one sequence is a
+ * real conflict — bounded, not eliminated, by the P2-4 burn rule (the loser
+ * burns its candidate and advances rather than swapping committed content).
+ * Callers MUST ensure the predecessor is quiesced; treat overlap as a bug.
+ *
+ * ── STUCK-RUNNING RECOVERY (out of scope here) ───────────────────────────────
+ * If a sink crashes BETWEEN its last append and finish(), the run is left with
+ * status='running' server-side and no terminal event — resume can continue
+ * appending, but nothing in THIS module will time out and finalize an abandoned
+ * run whose writer never came back. A server-side watchdog owns that recovery
+ * (G6 / ALI-1007); it is deliberately not implemented in the sandbox client.
+ */
+export declare function resumeRunEventSink(options: ResumeRunEventSinkOptions): Promise<RunEventSink>;
+export interface DrainOptions {
+    /** Transcript captured by the caller, stored on the terminal transition. */
+    transcript?: string;
+    summary?: Record<string, unknown>;
+    evidence?: Record<string, unknown>;
+    /**
+     * Hook invoked AFTER the stream yields its terminal event but BEFORE `finish()`
+     * seals the sink, on EVERY terminal path (success, failure, abnormal end). Used
+     * by the loop's end-of-run auto-harvest (ALI-1036) so `work_persisted` /
+     * `work_none` / `work_persist_failed` can still be appended while the sink is
+     * writable. Its own failure must never change the run's terminal status — the
+     * hook itself is responsible for swallowing errors.
+     */
+    beforeFinish?: () => Promise<void>;
+}
+/**
+ * Consume a harness `runPrompt` stream into a sink: structural events are
+ * appended (with token coalescing), and the single terminal event
+ * (`execution_complete` / `error`) is routed to `finish()` — NEVER appended.
+ * This is the event bridge's happy-path driver; the terminal event decides the
+ * run's final status.
+ */
+export declare function drainHarnessToSink(events: AsyncIterable<HarnessEvent>, sink: RunEventSink, opts?: DrainOptions): Promise<TerminalStatus>;
+//# sourceMappingURL=hosted-run-event-sink.d.ts.map

package/dist/hosted-run-event-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-run-event-sink.d.ts","sourceRoot":"","sources":["../src/hosted-run-event-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAIzE,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAUhF,eAAO,MAAM,yBAAyB,mBAAmB,CAAA;AACzD,eAAO,MAAM,yBAAyB,mBAAmB,CAAA;AA8BzD;oFACoF;AACpF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED,eAAO,MAAM,sBAAsB,gBAAgB,CAAA;AACnD,eAAO,MAAM,2BAA2B,qBAAqB,CAAA;AAC7D,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAY/C,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AACjE,eAAO,MAAM,iCAAiC,2BAA2B,CAAA;AAEzE,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEjE,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;8EAC0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B;uEACmE;IACnE,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;sFACkF;IAClF,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,kFAAkF;IAClF,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,mFAAmF;AACnF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;+EAC+E;AAC/E,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;GASG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAA;gBACrC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,aAAa;CAM3F;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAQD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;iFAC6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACzC;AAkBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CAwUnF;AAID,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC;IACjG,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,YAAY,CAAC,CAyBvB;AAID,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,EACnC,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAoFzB"}