@adea-ai/plugins 4.0.0 → 4.0.6

package/dist/verify-artifacts.js

@@ -0,0 +1,286 @@
+import { parseIntegrityManifest, publishedAssetOf, } from './integrity-manifest.js';
+import { CATALOG_INDEX_ARTIFACT, iconCoverage, } from './consumer-index.js';
+import { digest } from './digest.js';
+import { assertRepositoryAllowed, DEFAULT_POLICY } from './policy.js';
+import { CatalogSchema, SourcesLockSchema } from './schema.js';
+import { safeRelativePath } from './sources.js';
+export function verifyArtifacts(artifacts) {
+    const parsedCatalog = CatalogSchema.parse(JSON.parse(artifacts['catalog.v1.json']));
+    verifyCatalogReferences(parsedCatalog);
+    const lock = SourcesLockSchema.parse(JSON.parse(artifacts['sources.lock.json']));
+    const summary = JSON.parse(artifacts['catalog-summary.v1.json']);
+    const compatibility = JSON.parse(artifacts['compatibility.v1.json']);
+    const categories = JSON.parse(artifacts['categories.v1.json']);
+    const integrity = parseIntegrityManifest(JSON.parse(artifacts['integrity.json']));
+    if (parsedCatalog.sources.length !== lock.sources.length)
+        throw new Error('INTEGRITY_SOURCE_COUNT_MISMATCH');
+    if (summary.schemaVersion !== 1 ||
+        summary.catalogId !== parsedCatalog.catalogId ||
+        summary.sourceCount !== parsedCatalog.sources.length ||
+        summary.pluginCount !== parsedCatalog.plugins.length ||
+        !Array.isArray(summary.search) ||
+        compatibility.schemaVersion !== 1 ||
+        compatibility.catalogId !== parsedCatalog.catalogId ||
+        !Array.isArray(compatibility.plugins) ||
+        compatibility.plugins.length !== parsedCatalog.plugins.length ||
+        categories.schemaVersion !== 1 ||
+        categories.catalogId !== parsedCatalog.catalogId ||
+        !Array.isArray(categories.categories) ||
+        (categories.products !== undefined &&
+            (typeof categories.products !== 'object' || categories.products === null)) ||
+        (categories.diagnostics !== undefined && !Array.isArray(categories.diagnostics)) ||
+        integrity.catalogId !== parsedCatalog.catalogId) {
+        throw new Error('INTEGRITY_ARTIFACT_METADATA_MISMATCH');
+    }
+    // The published file set is exactly what integrity.json enumerates, so the
+    // shards can grow with the category configuration without a fixed list here.
+    for (const name of Object.keys(artifacts))
+        if (name !== 'integrity.json' && integrity.files[name] === undefined)
+            throw new Error(`INTEGRITY_FILE_SET_MISMATCH: ${name}`);
+    for (const [name, expected] of Object.entries(integrity.files)) {
+        const content = artifacts[name];
+        if (content === undefined)
+            throw new Error(`INTEGRITY_FILE_SET_MISMATCH: ${name}`);
+        if (digest(content) !== expected)
+            throw new Error(`INTEGRITY_DIGEST_MISMATCH: ${name}`);
+    }
+    const indexArtifact = artifacts[CATALOG_INDEX_ARTIFACT];
+    const verification = verifyConsumerIndex(artifacts['categories.v1.json'], parsedCatalog, indexArtifact);
+    if (verification.hasConsumerIndex && indexArtifact === undefined)
+        throw new Error(`SHARD_MISSING: ${CATALOG_INDEX_ARTIFACT}`);
+    for (const shard of verification.shards)
+        verifyShardArtifact(shard, artifacts[shard.name], verification, parsedCatalog.catalogId);
+    verifyIconAssets(integrity.assets ?? [], verification);
+}
+/**
+ * Re-checks one consumer shard against the navigation index: a shelf carries
+ * exactly the curated products in order, and a category list carries exactly
+ * the category's products in order. The expected catalog ID must come from a
+ * separately verified catalog, not from the shard being checked.
+ */
+export function verifyShardArtifact(shard, content, verification, catalogId) {
+    if (!CatalogSchema.shape.catalogId.safeParse(catalogId).success)
+        throw new Error('SHARD_CATALOG_ID_REQUIRED');
+    if (content === undefined)
+        throw new Error(`SHARD_MISSING: ${shard.name}`);
+    const parsed = JSON.parse(content);
+    if (parsed.schemaVersion !== 1 ||
+        parsed.catalogId !== catalogId ||
+        (shard.kind !== 'index' && parsed.category !== shard.category))
+        throw new Error(`SHARD_IDENTITY_MISMATCH: ${shard.name}`);
+    const products = shard.kind === 'index'
+        ? Object.values((parsed.products ?? {}))
+        : parsed.products;
+    if (!Array.isArray(products))
+        throw new Error(`SHARD_PRODUCTS_INVALID: ${shard.name}`);
+    const keys = products.map((product) => product.productKey);
+    if (new Set(keys).size !== keys.length)
+        throw new Error(`SHARD_DUPLICATE_PRODUCT: ${shard.name}`);
+    if (shard.kind === 'index') {
+        const expected = Object.keys(verification.products ?? {}).toSorted();
+        if (keys.toSorted().join('\n') !== expected.join('\n'))
+            throw new Error('SHARD_INDEX_MEMBERSHIP_MISMATCH');
+        return;
+    }
+    const category = verification.categories?.find((item) => item.category === shard.category);
+    if (!category)
+        throw new Error(`SHARD_CATEGORY_UNKNOWN: ${shard.name}`);
+    const expected = shard.kind === 'shelf' ? category.topProductKeys : category.productKeys;
+    if (keys.join('\n') !== expected.join('\n'))
+        throw new Error(`SHARD_ORDER_MISMATCH: ${shard.name}`);
+    for (const product of products) {
+        const index = verification.products?.[product.productKey];
+        if (!index || digest(index) !== digest(product))
+            throw new Error(`SHARD_PRODUCT_MISMATCH: ${shard.name}: ${product.productKey}`);
+    }
+}
+function verifyIconAssets(declared, verification) {
+    const referenced = new Map();
+    for (const product of Object.values(verification.products ?? {})) {
+        if (!product.icon)
+            continue;
+        const existing = referenced.get(product.icon.asset);
+        if (existing && existing.digest !== product.icon.digest)
+            throw new Error(`ICON_ASSET_DIGEST_CONFLICT: ${product.icon.asset}`);
+        referenced.set(product.icon.asset, publishedAssetOf(product.icon));
+    }
+    if (declared.length !== referenced.size)
+        throw new Error('INTEGRITY_ASSET_SET_MISMATCH');
+    for (const asset of declared) {
+        const expected = referenced.get(asset.name);
+        if (!expected)
+            throw new Error(`INTEGRITY_ASSET_UNDECLARED: ${asset.name}`);
+        if (expected.digest !== asset.digest ||
+            expected.bytes !== asset.bytes ||
+            expected.contentType !== asset.contentType ||
+            expected.kind !== asset.kind ||
+            expected.origin !== asset.origin)
+            throw new Error(`INTEGRITY_ASSET_MISMATCH: ${asset.name}`);
+    }
+}
+/**
+ * Re-checks the published consumer index against the catalog it indexes. The
+ * index is what Adea renders directly, so a contradiction between the two
+ * artifacts must never reach a release. Snapshots published before the index
+ * existed carry membership only; those are still membership-checked and
+ * reported as `hasConsumerIndex: false`.
+ */
+export function verifyConsumerIndex(content, catalog, indexContent) {
+    const index = JSON.parse(content);
+    const knownPlugins = new Map(catalog.plugins.map((plugin) => [plugin.pluginId, plugin]));
+    // Products live in the index shard; the navigation artifact only points at it.
+    const shard = indexContent ? JSON.parse(indexContent) : undefined;
+    const products = shard && typeof shard.products === 'object' && shard.products !== null
+        ? shard.products
+        : typeof index.products === 'object' && index.products !== null
+            ? index.products
+            : undefined;
+    const diagnostics = Array.isArray(index.diagnostics) ? index.diagnostics : [];
+    for (const category of index.categories ?? []) {
+        const members = catalog.plugins.filter((plugin) => plugin.categories.includes(category.category));
+        if (category.pluginCount !== undefined && category.pluginCount !== members.length)
+            throw new Error(`CONSUMER_INDEX_PLUGIN_COUNT_MISMATCH: ${category.category}`);
+        if (category.pluginIds.length !== members.length)
+            throw new Error(`CONSUMER_INDEX_PLUGIN_LIST_MISMATCH: ${category.category}`);
+        if (new Set(category.pluginIds).size !== category.pluginIds.length)
+            throw new Error(`CONSUMER_INDEX_DUPLICATE_PLUGIN: ${category.category}`);
+        for (const pluginId of category.pluginIds) {
+            const plugin = knownPlugins.get(pluginId);
+            if (!plugin || !plugin.categories.includes(category.category))
+                throw new Error(`CONSUMER_INDEX_FOREIGN_PLUGIN: ${category.category}: ${pluginId}`);
+        }
+        if (!products)
+            continue;
+        if (category.productKeys === undefined || category.topProductKeys === undefined)
+            throw new Error(`CONSUMER_INDEX_PRODUCTS_INCOMPLETE: ${category.category}`);
+        if (new Set(category.productKeys).size !== category.productKeys.length)
+            throw new Error(`CONSUMER_INDEX_DUPLICATE_PRODUCT: ${category.category}`);
+        for (const productKey of category.productKeys) {
+            const product = products[productKey];
+            if (!product)
+                throw new Error(`CONSUMER_INDEX_UNKNOWN_PRODUCT: ${productKey}`);
+            if (!product.categories.includes(category.category))
+                throw new Error(`CONSUMER_INDEX_PRODUCT_CATEGORY_MISMATCH: ${productKey}`);
+        }
+        if (category.productCount !== category.productKeys.length)
+            throw new Error(`CONSUMER_INDEX_PRODUCT_COUNT_MISMATCH: ${category.category}`);
+        const topCount = index.topCount;
+        if (topCount === undefined || !Number.isInteger(topCount) || topCount < 0)
+            throw new Error('CONSUMER_INDEX_TOP_COUNT_INVALID');
+        if (category.topProductKeys.length > topCount)
+            throw new Error(`CONSUMER_INDEX_TOP_OVERFLOW: ${category.category}`);
+        const shelved = new Set();
+        for (const product of Object.values(products)) {
+            // Indexes published before the install facts existed carry no `release`,
+            // and are still valid; a record that does carry one must agree with the
+            // catalog it claims to describe.
+            if (product.release) {
+                const plugin = knownPlugins.get(product.pluginId);
+                const release = plugin?.availableReleases.find((candidate) => candidate.releaseId === plugin.currentReleaseId);
+                if (!plugin ||
+                    !release ||
+                    product.release.releaseId !== release.releaseId ||
+                    product.release.canonicalContentDigest !== release.canonicalContentDigest ||
+                    product.release.sourceRevision !== release.resolvedCommitSha ||
+                    product.provenance?.resolvedCommitSha !== release.resolvedCommitSha)
+                    throw new Error(`CONSUMER_INDEX_RELEASE_MISMATCH: ${product.productKey}`);
+            }
+            const icon = product.icon;
+            if (!icon?.assetUrl)
+                continue;
+            if (!icon.assetUrl.startsWith('https://') || !icon.assetUrl.endsWith(`/${icon.asset}`))
+                throw new Error(`CONSUMER_INDEX_ASSET_URL_INVALID: ${icon.asset}`);
+        }
+        for (const productKey of category.topProductKeys) {
+            if (!category.productKeys.includes(productKey))
+                throw new Error(`CONSUMER_INDEX_TOP_NOT_MEMBER: ${category.category}: ${productKey}`);
+            if (shelved.has(productKey))
+                throw new Error(`CONSUMER_INDEX_TOP_REPEATED: ${productKey}`);
+            shelved.add(productKey);
+        }
+    }
+    if (products) {
+        // A product headlines one category only, so no product is shelved twice.
+        const claimed = new Set();
+        for (const category of index.categories ?? [])
+            for (const productKey of category.topProductKeys ?? []) {
+                if (claimed.has(productKey))
+                    throw new Error(`CONSUMER_INDEX_TOP_CROSS_CATEGORY: ${productKey}`);
+                claimed.add(productKey);
+            }
+        for (const [productKey, product] of Object.entries(products)) {
+            if (productKey !== product.productKey)
+                throw new Error('CONSUMER_INDEX_PRODUCT_KEY_MISMATCH');
+            if (product.variantPluginIds[0] !== product.pluginId)
+                throw new Error(`CONSUMER_INDEX_CANONICAL_NOT_FIRST: ${productKey}`);
+            const variants = new Set(product.variantPluginIds.map((pluginId) => {
+                const plugin = knownPlugins.get(pluginId);
+                if (!plugin)
+                    throw new Error(`CONSUMER_INDEX_UNKNOWN_PLUGIN: ${pluginId}`);
+                if (plugin.productGroupingKey !== productKey)
+                    throw new Error(`CONSUMER_INDEX_VARIANT_PRODUCT_MISMATCH: ${pluginId}`);
+                return pluginId;
+            }));
+            if (variants.size !== product.variantPluginIds.length)
+                throw new Error(`CONSUMER_INDEX_DUPLICATE_VARIANT: ${productKey}`);
+        }
+        const counts = shard?.counts ?? index.counts;
+        if (counts?.plugins !== catalog.plugins.length)
+            throw new Error('CONSUMER_INDEX_TOTAL_MISMATCH');
+        if (counts?.products !== Object.keys(products).length)
+            throw new Error('CONSUMER_INDEX_PRODUCT_TOTAL_MISMATCH');
+        if (counts?.redundantPlugins !== catalog.plugins.length - counts.products)
+            throw new Error('CONSUMER_INDEX_REDUNDANCY_MISMATCH');
+        if (index.counts && shard?.counts && digest(index.counts) !== digest(shard.counts))
+            throw new Error('CONSUMER_INDEX_COUNTS_MISMATCH');
+        if (shard?.topCount !== undefined && index.topCount !== shard.topCount)
+            throw new Error('CONSUMER_INDEX_TOP_COUNT_MISMATCH');
+    }
+    if (products && index.iconCoverage) {
+        const expected = iconCoverage({ products });
+        if (index.iconCoverage.total !== expected.total ||
+            index.iconCoverage.content !== expected.content ||
+            index.iconCoverage.favicon !== expected.favicon ||
+            index.iconCoverage.monogramOnly !== expected.monogramOnly ||
+            index.iconCoverage.monogramProductKeys.join('\n') !== expected.monogramProductKeys.join('\n'))
+            throw new Error('CONSUMER_INDEX_ICON_COVERAGE_MISMATCH');
+    }
+    const shards = [
+        ...(products ? [{ name: CATALOG_INDEX_ARTIFACT, kind: 'index' }] : []),
+        ...(index.categories ?? []).flatMap((category) => products && category.shelfArtifact && category.listArtifact
+            ? [
+                { name: category.shelfArtifact, kind: 'shelf', category: category.category },
+                { name: category.listArtifact, kind: 'list', category: category.category },
+            ]
+            : []),
+    ];
+    return {
+        hasConsumerIndex: products !== undefined,
+        diagnostics,
+        ...(products ? { counts: index.counts } : {}),
+        ...(products && index.topCount !== undefined ? { topCount: index.topCount } : {}),
+        ...(products ? { products, categories: index.categories ?? [] } : {}),
+        shards: products ? shards : [],
+    };
+}
+export function verifyCatalogReferences(catalog, policy = DEFAULT_POLICY) {
+    for (const source of catalog.sources) {
+        assertRepositoryAllowed(source.repositoryUrl, policy);
+        validateCatalogPath(source.manifestPath, 'SOURCE_MANIFEST_PATH_INVALID');
+    }
+    for (const plugin of catalog.plugins) {
+        assertRepositoryAllowed(plugin.provenance.repositoryUrl, policy);
+        validateCatalogPath(plugin.provenance.pluginSubdirectory, 'PROVENANCE_PATH_INVALID');
+        for (const release of plugin.availableReleases) {
+            assertRepositoryAllowed(release.resolvedRepositoryUrl, policy);
+            validateCatalogPath(release.pluginSubdirectory, 'RELEASE_PATH_INVALID');
+            for (const path of release.fileIndex)
+                validateCatalogPath(path, 'RELEASE_FILE_PATH_INVALID');
+        }
+    }
+}
+function validateCatalogPath(path, code) {
+    if (path !== '.')
+        safeRelativePath(path, code);
+}
+//# sourceMappingURL=verify-artifacts.js.map

package/dist/verify-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-artifacts.js","sourceRoot":"","sources":["../src/verify-artifacts.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EACtB,gBAAgB,GAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,sBAAsB,EACtB,YAAY,GAKb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAgB,MAAM,aAAa,CAAA;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAmB/C,MAAM,UAAU,eAAe,CAAC,SAA6B;IAC3D,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAA;IACnF,uBAAuB,CAAC,aAAa,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAM9D,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAIlE,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAQ5D,CAAA;IACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAA;IACjF,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM;QACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,IACE,OAAO,CAAC,aAAa,KAAK,CAAC;QAC3B,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAC7C,OAAO,CAAC,WAAW,KAAK,aAAa,CAAC,OAAO,CAAC,MAAM;QACpD,OAAO,CAAC,WAAW,KAAK,aAAa,CAAC,OAAO,CAAC,MAAM;QACpD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,aAAa,CAAC,aAAa,KAAK,CAAC;QACjC,aAAa,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QACnD,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC;QACrC,aAAa,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC,MAAM;QAC7D,UAAU,CAAC,aAAa,KAAK,CAAC;QAC9B,UAAU,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS;QAChD,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QACrC,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS;YAChC,CAAC,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QAC5E,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAChF,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,SAAS,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACvC,IAAI,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;YAClE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;QAClF,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,aAAa,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,mBAAmB,CACtC,SAAS,CAAC,oBAAoB,CAAC,EAC/B,aAAa,EACb,aAAa,CACd,CAAA;IACD,IAAI,YAAY,CAAC,gBAAgB,IAAI,aAAa,KAAK,SAAS;QAC9D,MAAM,IAAI,KAAK,CAAC,kBAAkB,sBAAsB,EAAE,CAAC,CAAA;IAC7D,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM;QACrC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC1F,gBAAgB,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAoB,EACpB,OAA2B,EAC3B,YAAuC,EACvC,SAAiB;IAEjB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO;QAC7D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAMhC,CAAA;IACD,IACE,MAAM,CAAC,aAAa,KAAK,CAAC;QAC1B,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;QAE9D,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3D,MAAM,QAAQ,GACZ,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAoC,CAAC;QAC3E,CAAC,CAAE,MAAM,CAAC,QAAuC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1D,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACjG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QACpE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1F,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAA;IACxF,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACxD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACzD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAmC,EACnC,YAAuC;IAEvC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;IACpD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,SAAQ;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;YACrD,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACtE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACxF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3E,IACE,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAChC,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAC9B,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC1C,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAC5B,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAEhC,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,OAAiC,EACjC,YAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B,CAAA;IAC3D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IACxF,+EAA+E;IAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,MAAM,QAAQ,GACZ,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QACpE,CAAC,CAAC,KAAK,CAAC,QAAQ;QAChB,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAC7D,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,SAAS,CAAA;IACjB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7E,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC9C,CAAA;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM;YAC/E,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/E,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAC9C,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC9E,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,SAAS,CAAC,MAAM;YAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC1E,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;YAC7E,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7E,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;YACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC3E,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAA;YAC9E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;YACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrD,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QACtE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,yEAAyE;YACzE,wEAAwE;YACxE,iCAAiC;YACjC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACjD,MAAM,OAAO,GAAG,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,gBAAgB,CAC/D,CAAA;gBACD,IACE,CAAC,MAAM;oBACP,CAAC,OAAO;oBACR,OAAO,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;oBAC/C,OAAO,CAAC,OAAO,CAAC,sBAAsB,KAAK,OAAO,CAAC,sBAAsB;oBACzE,OAAO,CAAC,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,iBAAiB;oBAC5D,OAAO,CAAC,UAAU,EAAE,iBAAiB,KAAK,OAAO,CAAC,iBAAiB;oBAEnE,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;YAC7E,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;YACzB,IAAI,CAAC,IAAI,EAAE,QAAQ;gBAAE,SAAQ;YAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC,CAAA;YACvF,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAA;YAC1F,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE;YAC3C,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;gBACvD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;oBACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAA;gBACrE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACzB,CAAC;QACH,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,IAAI,UAAU,KAAK,OAAO,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YAC7F,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ;gBAClD,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAA;YACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACxC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACzC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAA;gBAC1E,IAAI,MAAM,CAAC,kBAAkB,KAAK,UAAU;oBAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAA;gBACzE,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAC,CACH,CAAA;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAAC,MAAM;gBACnD,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA;QAC5C,IAAI,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAChG,IAAI,MAAM,EAAE,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM;YACnD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,IAAI,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ;YACvE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACpE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3C,IACE,KAAK,CAAC,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAC3C,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;YAC/C,KAAK,CAAC,YAAY,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;YACzD,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAE7F,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,MAAM,GAAoB;QAC9B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC/C,QAAQ,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,YAAY;YACzD,CAAC,CAAC;gBACE,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,OAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBACrF,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,MAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;aACpF;YACH,CAAC,CAAC,EAAE,CACP;KACF,CAAA;IACD,OAAO;QACL,gBAAgB,EAAE,QAAQ,KAAK,SAAS;QACxC,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KAC/B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAgB,EAChB,MAAM,GAAkB,cAAc;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,uBAAuB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACrD,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,8BAA8B,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QAChE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,yBAAyB,CAAC,CAAA;QACpF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,uBAAuB,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;YAC9D,mBAAmB,CAAC,OAAO,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAA;YACvE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS;gBAAE,mBAAmB,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,IAAY;IACrD,IAAI,IAAI,KAAK,GAAG;QAAE,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAChD,CAAC"}

package/native/build-provenance.txt

@@ -1,6 +1,6 @@
-source_commit 509620fc5170f5736f99074500ac04546da2196a
+source_commit 562d176d4dd81b49043895b8715fe4a350c0892b
 12125c7ab1a1e2d7cbe538343e2a11ef4d7fb0fa0310c5251d8606bf20f26834  packages/plugins/native/staged-reader.c
-04b0085f0a471b87c11c67d2f9c39174f239aa1865cd83a3bec201efb0872ee8  packages/plugins/native/staged-reader-test-win32-arm64.node
-0e48eff409720188de9e53d0ead458f4240c415e64460be113fda9cbf4b9cefc  packages/plugins/native/staged-reader-test-win32-x64.node
-5dd361a5ff4fbe2ac4949a59083e1b7fae0c54f13f48b0a17d67c02b2e8962ff  packages/plugins/native/staged-reader-win32-arm64.node
-abf65f3e3e1ef1f899b627065b20fd9bf027e70493939505695bde976284cc1a  packages/plugins/native/staged-reader-win32-x64.node
+19fc1fbf9a4e1fa31a130a20f4108e1e64ea72d3d30ef29b259c4a0164221261  packages/plugins/native/staged-reader-test-win32-arm64.node
+030e0cf5e08996b18672430246d39ad29e9d01aa25d34869b7873b5056840e2b  packages/plugins/native/staged-reader-test-win32-x64.node
+dd2d78b06c6047a366ec339223754bd2f1d1706300967532436cf15990d81421  packages/plugins/native/staged-reader-win32-arm64.node
+cd01057f673bdf1694890fe0037ad522c3f5bcfe08d2b0ae5cc84268d3977789  packages/plugins/native/staged-reader-win32-x64.node

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adea-ai/plugins",
-  "version": "4.0.0",
+  "version": "4.0.6",
   "description": "Deterministic compiler for AI agent plugin marketplaces: schemas, source parsing, provenance verification, per-harness materialization, and provenance-checked static artifacts.",
   "keywords": [
     "agents",
@@ -78,14 +78,14 @@
     "./schema/*": "./schemas/*"
   },
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   },
   "scripts": {
     "build": "node --input-type=module -e \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
     "typecheck": "bun check -p tsconfig.json"
   },
   "dependencies": {
+    "parse5": "^8.0.0",
     "tar-stream": "^3.2.1",
     "yaml": "2.9.1",
     "zod": "^4.6.6"

package/src/agent-plugins-catalog.test.ts

@@ -331,8 +331,8 @@ describe('canonical Agent Plugins package compiler', () => {
     }
   })
   it('rejects duplicate escaped JSON keys without prototype mutation', () => {
-    assert.throws(() => parsePluginJson('{"x":1,"\\u0078":2}'))
-    assert.throws(() => parsePluginJson('{"a":{"x":1,"x":2}}'))
+    assert.throws(() => parsePluginJson('{"x":1,"\\u0078":2}'), /duplicate JSON object key/)
+    assert.throws(() => parsePluginJson('{"a":{"x":1,"x":2}}'), /duplicate JSON object key/)
     const value = parsePluginJson('{"__proto__":{"polluted":true}}') as Record<string, unknown>
     assert.equal(Object.prototype.hasOwnProperty.call(value, '__proto__'), true)
     assert.equal(Object.prototype.hasOwnProperty.call({}, 'polluted'), false)

package/src/agent-plugins-catalog.ts

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto'
 import { isIP } from 'node:net'
 import { posix } from 'node:path'
 import { validateHeaderName, validateHeaderValue } from 'node:http'
@@ -8,6 +7,7 @@ import {
   PLUGIN_SCHEMA_ID,
   MCP_SCHEMA_ID,
   NORMALIZER_VERSION,
+  PACKAGE_LIMITS,
   AgentManifestSchema,
   McpServerSchema,
   SkillFrontmatterSchema,
@@ -18,9 +18,11 @@ import {
   type PackageFile,
   type Diagnostic,
 } from './agent-plugins-schema.js'
-import { sourceDigest } from './source-digest.js'
+import { byteDigest, canonicalJson, ordinalCompare, sourceDigest } from './digest.js'
 
 export { NORMALIZER_VERSION, sourceDigest }
+// Public names of the shared canonical-JSON and digest helpers.
+export { byteDigest as sha256, canonicalJson as stableJson, ordinalCompare as compare }
 const decoder = new TextDecoder('utf-8', { fatal: true })
 const encoder = new TextEncoder()
 const manifestKeys = new Set([
@@ -49,27 +51,12 @@ const remoteTransportHeaders = new Set([
   'transfer-encoding',
   'upgrade',
 ])
-const own = (value: object, key: string) => Object.prototype.hasOwnProperty.call(value, key)
-export const compare = (a: string, b: string): number => (a < b ? -1 : a > b ? 1 : 0)
-export function stableJson(value: unknown): string {
-  if (value === null || typeof value !== 'object') return JSON.stringify(value)
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`
-  const record = value as Record<string, unknown>
-  return `{${Object.keys(record)
-    .toSorted(compare)
-    .map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`)
-    .join(',')}}`
-}
-export function sha256(value: string | Uint8Array): string {
-  return `sha256:${createHash('sha256').update(value).digest('hex')}`
-}
-
 export function packageDigest(files: readonly PackageFile[]): string {
-  return sha256(
-    stableJson({
+  return byteDigest(
+    canonicalJson({
       algorithm: 'adea-package-files/1',
       files: [...files]
-        .toSorted((a, b) => compare(a.targetPath, b.targetPath))
+        .toSorted((a, b) => ordinalCompare(a.targetPath, b.targetPath))
         .map((file) => ({
           path: file.targetPath,
           digest: file.digest,
@@ -217,7 +204,7 @@ function portableName(name: string): string {
     ) || 'plugin'
   return cleaned.length <= 64
     ? cleaned
-    : `${trimPortableEdges(cleaned.slice(0, 54))}-${sha256(name).slice(-8)}`
+    : `${trimPortableEdges(cleaned.slice(0, 54))}-${byteDigest(name).slice(-8)}`
 }
 function diagnostic(
   code: string,
@@ -233,7 +220,7 @@ function nativeManifest(raw: unknown, diagnostics: Diagnostic[]): AgentManifest
   const filtered = Object.fromEntries(Object.entries(raw).filter(([key]) => manifestKeys.has(key)))
   for (const key of Object.keys(raw)
     .filter((field) => !manifestKeys.has(field))
-    .toSorted(compare))
+    .toSorted(ordinalCompare))
     diagnostics.push(
       diagnostic(
         'UNKNOWN_MANIFEST_FIELD',
@@ -243,7 +230,7 @@ function nativeManifest(raw: unknown, diagnostics: Diagnostic[]): AgentManifest
         'warning'
       )
     )
-  if (own(filtered, 'extensions')) {
+  if (Object.hasOwn(filtered, 'extensions')) {
     if (!isRecord(filtered.extensions)) {
       delete filtered.extensions
       diagnostics.push(
@@ -360,7 +347,7 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
     (() => {
       try {
         const raw = parsePluginJson(decoder.decode(files.get('plugin.json')!))
-        return isRecord(raw) && own(raw, '$schema')
+        return isRecord(raw) && Object.hasOwn(raw, '$schema')
       } catch {
         return true
       }
@@ -396,7 +383,8 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
     const paths = new Set<string>()
     const spellings = new Map<string, string>()
     let total = 0
-    if (files.size > 4096) throw new Error('Package exceeds file-count policy.')
+    if (files.size > PACKAGE_LIMITS.maxFilesPerPlugin)
+      throw new Error('Package exceeds file-count policy.')
     for (const [path, bytes] of files) {
       assertPackagePath(path)
       const folded = path.normalize('NFC').toLowerCase()
@@ -409,7 +397,10 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
         spellings.set(key, component)
       }
       total += bytes.byteLength
-      if (bytes.byteLength > 5 * 1024 * 1024 || total > 50 * 1024 * 1024)
+      if (
+        bytes.byteLength > PACKAGE_LIMITS.maxFileBytes ||
+        total > PACKAGE_LIMITS.maxBytesPerPlugin
+      )
         throw new Error('Package exceeds byte-size policy.')
       for (let parent = posix.dirname(path); parent !== '.'; parent = posix.dirname(parent))
         if (files.has(parent)) throw new Error('File/directory path collision.')
@@ -469,7 +460,7 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
       diagnostic('INVALID_SKILLS_LOCATION', 'skills', 'skills', 'skills must be a directory.')
     )
   }
-  for (const [path, bytes] of [...files].toSorted(([a], [b]) => compare(a, b))) {
+  for (const [path, bytes] of [...files].toSorted(([a], [b]) => ordinalCompare(a, b))) {
     const match = /^skills\/([^/]+)\/SKILL\.md$/.exec(path)
     if (!match) continue
     try {
@@ -551,7 +542,7 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
     mcpEntries = {}
   }
   for (const [name, inputServer] of Object.entries(mcpEntries).toSorted(([a], [b]) =>
-    compare(a, b)
+    ordinalCompare(a, b)
   )) {
     try {
       if (['__proto__', 'constructor', 'prototype'].includes(name) || hasControlCharacters(name))
@@ -612,10 +603,10 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
       ...(extras.get('client-extension') ?? []),
       `plugin.json/extensions/${key}`,
     ])
-  for (const [kind, paths] of [...extras].toSorted(([a], [b]) => compare(a, b)))
+  for (const [kind, paths] of [...extras].toSorted(([a], [b]) => ordinalCompare(a, b)))
     nonPortable.push({
       kind,
-      paths: [...new Set(paths)].toSorted(compare),
+      paths: [...new Set(paths)].toSorted(ordinalCompare),
       reason:
         'Preserved as source content, not activated or presented as portable Agent Plugins behavior.',
     })
@@ -634,7 +625,7 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
       action: 'copy',
       sourcePath: path,
       targetPath: path,
-      digest: sha256(bytes),
+      digest: byteDigest(bytes),
       preserveMode: true,
     })
   }
@@ -643,14 +634,20 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
     ['plugin.json', manifest],
     ['mcp.json', { $schema: MCP_SCHEMA_ID, mcpServers }],
   ] as const) {
-    const content = stableJson(data) + '\n'
-    operations.push({ action: 'write', targetPath, content, digest: sha256(content), mode: '0644' })
+    const content = canonicalJson(data) + '\n'
+    operations.push({
+      action: 'write',
+      targetPath,
+      content,
+      digest: byteDigest(content),
+      mode: '0644',
+    })
   }
-  const sortedOperations = operations.toSorted((a, b) => compare(a.targetPath, b.targetPath))
+  const sortedOperations = operations.toSorted((a, b) => ordinalCompare(a.targetPath, b.targetPath))
   const values = [...servers.values()]
   const local = values.filter((server) => server.type === 'stdio')
   const sortedDiagnostics = diagnostics.toSorted((a, b) =>
-    compare(`${a.path}:${a.code}`, `${b.path}:${b.code}`)
+    ordinalCompare(`${a.path}:${a.code}`, `${b.path}:${b.code}`)
   )
   try {
     return verifyAgentPackage({
@@ -666,8 +663,8 @@ export function compileAgentPackage(input: CompilePackageInput): AgentPackage {
       mcpServers,
       requirements: {
         skills: skills.length > 0,
-        mcpTransports: [...new Set(values.map((server) => server.type))].toSorted(compare),
-        executables: [...new Set(local.map((server) => server.command))].toSorted(compare),
+        mcpTransports: [...new Set(values.map((server) => server.type))].toSorted(ordinalCompare),
+        executables: [...new Set(local.map((server) => server.command))].toSorted(ordinalCompare),
         environmentReview:
           local.length > 0 ||
           skills.some((skill) => !!skill.compatibility || !!skill.allowedTools) ||
@@ -703,7 +700,7 @@ export function verifyAgentPackage(input: unknown): AgentPackage {
     if (paths.has(key)) throw new Error('Duplicate package target.')
     paths.add(key)
     if (file.action === 'copy') assertPackagePath(file.sourcePath)
-    else if (sha256(file.content) !== file.digest)
+    else if (byteDigest(file.content) !== file.digest)
       throw new Error('Generated file digest mismatch.')
   }
   for (const path of paths)
@@ -714,11 +711,11 @@ export function verifyAgentPackage(input: unknown): AgentPackage {
     if (!file || file.action !== 'write') throw new Error('Missing canonical control file.')
     return parsePluginJson(file.content)
   }
-  if (stableJson(generated('plugin.json')) !== stableJson(pkg.manifest))
+  if (canonicalJson(generated('plugin.json')) !== canonicalJson(pkg.manifest))
     throw new Error('Manifest descriptor differs from package bytes.')
   if (
-    stableJson(generated('mcp.json')) !==
-    stableJson({ $schema: MCP_SCHEMA_ID, mcpServers: pkg.mcpServers })
+    canonicalJson(generated('mcp.json')) !==
+    canonicalJson({ $schema: MCP_SCHEMA_ID, mcpServers: pkg.mcpServers })
   )
     throw new Error('MCP descriptor differs from package bytes.')
   for (const server of Object.values(pkg.mcpServers)) validateServer(server)
@@ -739,23 +736,23 @@ export function verifyAgentPackage(input: unknown): AgentPackage {
     throw new Error('Skill inventory differs from package discovery.')
   const expectedTransports = [
     ...new Set(Object.values(pkg.mcpServers).map((server) => server.type)),
-  ].toSorted(compare)
+  ].toSorted(ordinalCompare)
   const expectedExecutables = [
     ...new Set(
       Object.values(pkg.mcpServers)
         .filter((server) => server.type === 'stdio')
         .map((server) => server.command)
     ),
-  ].toSorted(compare)
+  ].toSorted(ordinalCompare)
   if (
-    stableJson([...pkg.requirements.executables].toSorted(compare)) !==
-    stableJson(expectedExecutables)
+    canonicalJson([...pkg.requirements.executables].toSorted(ordinalCompare)) !==
+    canonicalJson(expectedExecutables)
   )
     throw new Error('Package executable requirements differ from components.')
   if (
     pkg.requirements.skills !== pkg.skills.length > 0 ||
-    stableJson([...pkg.requirements.mcpTransports].toSorted(compare)) !==
-      stableJson(expectedTransports)
+    canonicalJson([...pkg.requirements.mcpTransports].toSorted(ordinalCompare)) !==
+      canonicalJson(expectedTransports)
   )
     throw new Error('Package requirements differ from components.')
   if (
@@ -779,13 +776,13 @@ export function materializeAgentPackage(
     name: pkg.manifest!.name,
     sourceDigest: pkg.sourceDigest,
   })
-  if (stableJson(rebuilt) !== stableJson(pkg))
+  if (canonicalJson(rebuilt) !== canonicalJson(pkg))
     throw new Error('Recipe differs from deterministic source normalization.')
   const result = new Map<string, Uint8Array>()
   for (const file of pkg.files) {
     const bytes =
       file.action === 'write' ? encoder.encode(file.content) : source.get(file.sourcePath)
-    if (!bytes || sha256(bytes) !== file.digest)
+    if (!bytes || byteDigest(bytes) !== file.digest)
       throw new Error('Package file missing or digest mismatch.')
     result.set(file.targetPath, bytes.slice())
   }

package/src/agent-plugins-schema.ts

@@ -1,9 +1,19 @@
 import { z } from 'zod'
+import { DIGEST_RE } from './schema.js'
 
 // Locally pinned contracts. Never fetch a schema while inspecting a plugin.
 export const AGENT_PLUGINS_VERSION = '1.0.0' as const
 export const PLUGIN_SCHEMA_ID = 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json'
 export const MCP_SCHEMA_ID = 'https://agent-plugins.org/schemas/1.0.0/mcp.schema.json'
+/** Size limits for one package; the catalog policy defaults to the same values. */
+export const PACKAGE_LIMITS = {
+  maxFilesPerPlugin: 4096,
+  maxFileBytes: 5 * 1024 * 1024,
+  maxBytesPerPlugin: 50 * 1024 * 1024,
+} as const
+
+/** Where a release carries its compiled Agent Plugins package in `releaseMetadata`. */
+export const PACKAGE_METADATA_KEY = 'agentPlugins'
 export const NORMALIZER_VERSION = 'adea-agent-plugins/1' as const
 export const PluginNameSchema = z
   .string()
@@ -11,7 +21,7 @@ export const PluginNameSchema = z
   .max(64)
   .regex(/^(?!.*(?:--|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/)
 const Strings = z.record(z.string(), z.string())
-const Digest = z.string().regex(/^sha256:[a-f0-9]{64}$/)
+const Digest = z.string().regex(DIGEST_RE)
 const Path = z
   .string()
   .min(1)