@cotal-ai/manager 0.90.1 → 0.91.0

package/dist/operator-deregister.d.ts

@@ -0,0 +1,4 @@
+import { type EndpointDeregisterAction } from "@cotal-ai/workspace";
+/** Reuse the shipped guard and native key-pinned executor. Do not copy either into another CLI. */
+export declare const endpointDeregisterAction: EndpointDeregisterAction;
+//# sourceMappingURL=operator-deregister.d.ts.map

package/dist/operator-deregister.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-deregister.d.ts","sourceRoot":"","sources":["../src/operator-deregister.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAG7B,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,EAAE,wBAEtC,CAAC"}

package/dist/operator-deregister.js

@@ -0,0 +1,75 @@
+import { Kvm } from "@nats-io/kv";
+import { DEV_OWNER, dialerFor, epAuthBucket, mintCreds, mintLifecycleUid, newIdentity, recordsBucket, standaloneConnectOpts, } from "@cotal-ai/core";
+import { CommandFailure, authDir, canonicalRoot, findCotalRoot, getSoleSpaceAuth, getSpaceAuth, hasUserAuthState, isCommandFailure, workspaceSecretStore, } from "@cotal-ai/workspace";
+import { InstanceDeregisterRefused, deregisterEndpointInstance, makeInstanceProbe } from "./deregister-instance.js";
+/** Reuse the shipped guard and native key-pinned executor. Do not copy either into another CLI. */
+export const endpointDeregisterAction = {
+    kind: "endpoint-action", name: "deregister", run: deregister,
+};
+async function deregister(request) {
+    const { root, space, endpoint, instanceId } = request;
+    const target = { space, endpoint, instanceId };
+    let auth;
+    try {
+        if (hasUserAuthState(root, space, { readOnly: true }))
+            throw new CommandFailure("refused", "UNSUPPORTED", "a user-auth target cannot use a static signer as a substitute for its supported operator authority", { target });
+        const selected = await getSpaceAuth(workspaceSecretStore(root), space);
+        if (!selected || selected.account.pub !== request.account)
+            throw new CommandFailure("refused", "CONFLICT", "the selected static authority changed or is absent; no other account or root was substituted", { target });
+        auth = selected;
+        const cwd = findCotalRoot();
+        const current = canonicalRoot(cwd) === canonicalRoot(root) ? auth : await getSoleSpaceAuth(workspaceSecretStore(cwd), authDir(cwd));
+        if (current && (current.space !== space || current.account.pub !== auth.account.pub))
+            throw new CommandFailure("refused", "CONFLICT", "the current folder and selected space hold different account authorities; nothing was deregistered", { target });
+    }
+    catch (error) {
+        if (isCommandFailure(error))
+            throw error;
+        throw new CommandFailure("refused", "SCHEMA_INVALID", "the selected static authority could not be validated; no native record deletion was attempted", { target });
+    }
+    let probeNc, execNc;
+    let enteredGuard = false;
+    let result;
+    let failure;
+    const warnings = [];
+    try {
+        const identity = newIdentity(), uid = mintLifecycleUid();
+        const probeCreds = await mintCreds(auth, identity, "control-caller-privileged", { lifecycleUid: uid, endpointCapabilities: [{ endpoint, command: "describe", instanceId, instanceOnly: true, routes: [] }] });
+        const caller = { owner: DEV_OWNER, actor: identity.id, uid };
+        probeNc = await dialerFor(request.server)({ servers: request.server, ...standaloneConnectOpts({ creds: probeCreds, tls: request.tlsRequired }), maxReconnectAttempts: 0 });
+        const executorCreds = await mintCreds(auth, newIdentity(), "endpoint-serve-executor", { endpointServeExecutor: { endpoint, instanceId } });
+        execNc = await dialerFor(request.server)({ servers: request.server, ...standaloneConnectOpts({ creds: executorCreds, tls: request.tlsRequired }), maxReconnectAttempts: 0 });
+        const kv = await new Kvm(execNc).open(recordsBucket(space));
+        const authKv = await new Kvm(execNc).open(epAuthBucket(space));
+        enteredGuard = true;
+        const report = await deregisterEndpointInstance({ kv, authKv, endpoint, instanceId, probeInstance: makeInstanceProbe(probeNc, { space, endpoint, instanceId, caller }), log: () => { } });
+        result = { kind: "endpoint-deregistered", space, endpoint, instanceId, probe: "broker-affirmed-gone", removedSpecRevision: report.removedSpecRevision, removedStatusRevision: report.removedStatusRevision ?? null, processStopped: false, issuanceGateChanged: false };
+    }
+    catch (error) {
+        if (isCommandFailure(error))
+            failure = error;
+        else if (error instanceof InstanceDeregisterRefused) {
+            if (error.condition === "superseded")
+                failure = new CommandFailure("unknown", "OPERATION_UNKNOWN", "the registration moved during guarded deletion; its spec was not removed, but an older status may already have been removed", { target: { ...target, condition: error.condition }, remedy: "re-observe the same registration and gate; no delete was retried" });
+            else
+                failure = new CommandFailure("refused", error.condition === "not-registered" ? "TARGET_NOT_FOUND" : error.condition === "liveness-unestablishable" ? "TARGET_UNAVAILABLE" : "LIFECYCLE_BLOCKED", `the native deregistration guard refused: ${error.condition}; no record was removed`, { target: { ...target, condition: error.condition }, remedy: "a quiet or unreachable instance is not a broker-affirmed empty instance rail; inspect the exact target before trying again" });
+        }
+        else
+            failure = new CommandFailure(enteredGuard ? "unknown" : "refused", enteredGuard ? "OPERATION_UNKNOWN" : "TARGET_UNAVAILABLE", enteredGuard ? "the native guarded deletion did not return a confirmed result; no delete was retried" : "the selected native probe/executor connections could not be prepared; no record deletion was attempted", { target, remedy: "inspect this full instance and its registration, never replace it with a prefix or another account" });
+    }
+    finally {
+        for (const nc of [execNc, probeNc]) {
+            try {
+                if (nc)
+                    await nc.close();
+            }
+            catch {
+                warnings.push({ code: "DEREGISTER_CONNECTION_CLEANUP_UNCONFIRMED", target, message: "One operation connection's cleanup was not confirmed; the recorded native deletion outcome is unchanged." });
+            }
+        }
+    }
+    if (failure)
+        throw failure;
+    return { ...result, warnings };
+}
+//# sourceMappingURL=operator-deregister.js.map

package/dist/operator-deregister.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-deregister.js","sourceRoot":"","sources":["../src/operator-deregister.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAC5E,aAAa,EAAE,qBAAqB,GACrC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EACrF,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,GAEzD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEpH,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IAChE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU;CAC7D,CAAC;AAEF,KAAK,UAAU,UAAU,CAAC,OAAkC;IAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACtD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAC/C,IAAI,IAA2D,CAAC;IAChE,IAAI,CAAC;QACH,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,oGAAoG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5N,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,8FAA8F,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvN,IAAI,GAAG,QAAQ,CAAC;QAChB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACpI,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,oGAAoG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1P,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,+FAA+F,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrK,CAAC;IACD,IAAI,OAAmC,EAAE,MAAkC,CAAC;IAC5E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,MAA8D,CAAC;IACnE,IAAI,OAAgB,CAAC;IACrB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,EAAE,EAAE,GAAG,GAAG,gBAAgB,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,2BAA2B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9M,MAAM,MAAM,GAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QACvE,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3K,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,yBAAyB,EAAE,EAAE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3I,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7K,MAAM,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;QACzL,MAAM,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IAC1Q,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,KAAK,CAAC;aACxC,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YACpD,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY;gBAAE,OAAO,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,6HAA6H,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC,CAAC;;gBAChW,OAAO,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,0BAA0B,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,EAAE,4CAA4C,KAAK,CAAC,SAAS,yBAAyB,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,4HAA4H,EAAE,CAAC,CAAC;QAC3d,CAAC;;YAAM,OAAO,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,sFAAsF,CAAC,CAAC,CAAC,wGAAwG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,oGAAoG,EAAE,CAAC,CAAC;IACnd,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBAAC,IAAI,EAAE;oBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACjC,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,2CAA2C,EAAE,MAAM,EAAE,OAAO,EAAE,0GAA0G,EAAE,CAAC,CAAC;YAAC,CAAC;QAC9M,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;IAC3B,OAAO,EAAE,GAAG,MAAO,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC"}

package/dist/service-adapter.d.ts

@@ -0,0 +1,12 @@
+import { type LocalProcess, type ServiceAdapterAttempt, type ServiceAdapterContext, type ServicePreset } from "@cotal-ai/workspace";
+export declare const managerPreset: ServicePreset;
+/** Whether this root's maintenance journal, if any, admits this launch, as the broker adapter
+ *  decides for its own. An attempt launch is admitted only for the journal's own attempt, in a
+ *  state that starts or relaunches the manager, for the cut's manager instance whose newest start
+ *  row the attempt journaled and has not settled. A launch without an attempt is decided by
+ *  `maintenanceAdmitsStackWork`, which admits only a settled active controller restore of this
+ *  root's own stack, as the broker and a service restart decide. Every other journal, legacy
+ *  custody included, refuses. The journal is only read. */
+export declare function maintenanceAdmits(root: string, server: string, context: ServiceAdapterContext, attempt: ServiceAdapterAttempt | undefined): boolean;
+export declare const managerService: LocalProcess;
+//# sourceMappingURL=service-adapter.d.ts.map

package/dist/service-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-adapter.d.ts","sourceRoot":"","sources":["../src/service-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAMgB,KAAK,YAAY,EAAiC,KAAK,qBAAqB,EAAE,KAAK,qBAAqB,EAE7H,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAI7B,eAAO,MAAM,aAAa,EAAE,aAG3B,CAAC;AAKF;;;;;;2DAM2D;AAC3D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,GAAG,SAAS,GAAG,OAAO,CASnJ;AAsED,eAAO,MAAM,cAAc,EAAE,YAgD5B,CAAC"}

package/dist/service-adapter.js

@@ -0,0 +1,174 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { registry } from "@cotal-ai/core";
+import { CommandFailure, MANAGER_PIDFILE, MANAGER_SHUTDOWN_INTENT, armManagerShutdownIntent, assertRecordIdentity, canonicalLocalProcessPath, canonicalRoot, clearRefusedServiceStopRequest, colorEnabled, commandIsCotalSupervisor, controllerAttemptBinding, cutController, localProcessPath, maintenanceAdmitsStackWork, publishServiceStopRequest, readLocalRecordSource, readMaintenanceJournal, readPidfile, readProcessRecord, readServiceStopReceipts, reserveNativeServiceStop, resolveNativeServiceTarget, serviceAdapterAttempt, serviceMetadataDigest, stopReservationPath, } from "@cotal-ai/workspace";
+import { managerServiceLaunchSpec, managerServicePreservedExitScope, managerServiceStopScope } from "./service-child.js";
+import { managerServiceReadiness, observeManagerService } from "./service-observation.js";
+export const managerPreset = {
+    kind: "service-preset", name: "manager", adapter: "manager-service", timeoutMs: 60000,
+    summary: "native manager with selected-root custody; caller-attributed agent impact, or the child's local receipt on an open space",
+};
+/** Journal states in which a controller attempt starts or relaunches its manager. */
+const ATTEMPT_LAUNCH_STATES = ["resume-intent", "commit-intent", "resume-committed", "manager-committed"];
+/** Whether this root's maintenance journal, if any, admits this launch, as the broker adapter
+ *  decides for its own. An attempt launch is admitted only for the journal's own attempt, in a
+ *  state that starts or relaunches the manager, for the cut's manager instance whose newest start
+ *  row the attempt journaled and has not settled. A launch without an attempt is decided by
+ *  `maintenanceAdmitsStackWork`, which admits only a settled active controller restore of this
+ *  root's own stack, as the broker and a service restart decide. Every other journal, legacy
+ *  custody included, refuses. The journal is only read. */
+export function maintenanceAdmits(root, server, context, attempt) {
+    if (!attempt)
+        return maintenanceAdmitsStackWork(root, context.space, server, context.stack);
+    const journal = readMaintenanceJournal(root);
+    if (!journal)
+        return true;
+    const attemptId = "ordinaryResume" in journal ? journal.ordinaryResume.attemptId : "restore" in journal ? journal.restore.attemptId : undefined;
+    const manager = cutController(journal.cut)?.members.find((member) => member.role === "manager");
+    const row = [...controllerAttemptBinding(journal)?.started ?? []].reverse().find((entry) => entry.role === "manager");
+    return ATTEMPT_LAUNCH_STATES.includes(journal.state) && attempt.attemptId === attemptId && manager?.instanceId === context.instanceId &&
+        row?.instanceId === context.instanceId && row.outcome === undefined;
+}
+async function prepareStop(context) {
+    if (context.preserved && context.withAgents)
+        throw new CommandFailure("refused", "USAGE_INVALID", "a preserved-exit stop retains agents; --with-agents cannot be combined with it");
+    const observation = await observeManagerService(context);
+    if (!observation)
+        throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "the exact native manager has no complete attributed startup observation; no stop was submitted");
+    const registration = observation.registration;
+    // An attributed status names the binding the manager holds and must equal the request. An open
+    // space's local receipt keeps its older shape, so the request is digested and the native child
+    // recomputes the scope against its own binding at acceptance.
+    const held = observation.stopImpact.preservation ?? context.preserved;
+    const scopeSha256 = context.preserved ? managerServicePreservedExitScope(observation, context.preserved, held) : managerServiceStopScope(observation, context.withAgents);
+    return {
+        scopeSha256, observedAt: new Date().toISOString(), withAgents: context.withAgents,
+        native: { endpoint: registration.endpoint, instanceId: registration.instanceId, epoch: registration.epoch, owner: registration.principal.owner, actor: registration.principal.actor, lifecycleUid: registration.principal.uid },
+        subjects: observation.stopImpact.agents.map((row) => ({ name: row.name, id: row.id, lifecycleUid: row.lifecycleUid, action: context.withAgents ? row.withAgentsAction : row.defaultAction })),
+        ...(observation.evidence ? { evidence: observation.evidence } : {}),
+        ...(context.preserved ? { preserved: { attemptId: context.preserved.attemptId, inventorySha256: context.preserved.inventorySha256 } } : {}),
+    };
+}
+/** The reservation is retained after any unconfirmed submission. Only a known refusal or both a
+ *  native returned receipt and the exact process exit can release it. There is no force kill. */
+async function stop(context) {
+    const root = String(context.options.root), pidPath = canonicalLocalProcessPath(MANAGER_PIDFILE, { root, space: context.space });
+    const reservation = reserveNativeServiceStop(stopReservationPath(pidPath));
+    let submitted = false, releasable = true;
+    try {
+        const current = await prepareStop(context);
+        if (current.scopeSha256 !== context.plan.scopeSha256 || current.withAgents !== context.withAgents || current.evidence !== context.plan.evidence || serviceMetadataDigest(current.native) !== serviceMetadataDigest(context.plan.native) || serviceMetadataDigest(current.preserved ?? null) !== serviceMetadataDigest(context.plan.preserved ?? null))
+            throw new CommandFailure("refused", "CONFLICT", "the manager impact or native incarnation changed after confirmation; no signal was sent");
+        const legacyPid = readLocalRecordSource(pidPath, 128, true)?.toString("utf8").trim();
+        if (legacyPid !== String(context.process.pid) || assertRecordIdentity(context.process).kind !== "match")
+            throw new CommandFailure("refused", "CONFLICT", "the native manager PID custody changed; no signal was sent");
+        const intent = canonicalLocalProcessPath(MANAGER_SHUTDOWN_INTENT, { root, space: context.space });
+        if (readLocalRecordSource(intent, 8192, true) !== undefined)
+            throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "an earlier native shutdown intent is retained; it was not overwritten or adopted");
+        const request = { schemaVersion: 1, space: context.space, instanceId: context.instanceId, launchRequestId: context.launchRequestId, requestId: context.requestId, target: { ...context.process }, stopper: reservation.stopper, withAgents: context.withAgents, scopeSha256: current.scopeSha256, ...(context.preserved ? { preserved: { attemptId: context.preserved.attemptId, inventorySha256: context.preserved.inventorySha256 } } : {}) };
+        context.signal.throwIfAborted();
+        // Publication can succeed before a durability error reaches us. Retain custody from here.
+        releasable = false;
+        publishServiceStopRequest(context, request);
+        if (context.withAgents)
+            armManagerShutdownIntent({ root, space: context.space }, { target: context.process, stopper: { pid: reservation.stopper.pid, marker: stopReservationPath(pidPath) } });
+        context.signal.throwIfAborted();
+        if (assertRecordIdentity(context.process).kind !== "match")
+            throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "the manager process changed after its stop handoff; no successor was signalled");
+        submitted = true;
+        process.kill(context.process.pid, "SIGTERM");
+        const deadline = Date.now() + 30000;
+        while (Date.now() < deadline) {
+            context.signal.throwIfAborted();
+            const phases = readServiceStopReceipts(context, request);
+            if (phases.some((row) => row.phase === "refused")) {
+                clearRefusedServiceStopRequest(context, request);
+                releasable = true;
+                throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "the native manager refused the changed request or impact before stopping; inspect again before a new confirmation");
+            }
+            if (phases.some((row) => row.phase === "failed"))
+                throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "the native manager reported a failed stop; process and cleanup completion remain unconfirmed and the original request was retained");
+            const completed = phases.find((row) => row.phase === "completed");
+            const identity = assertRecordIdentity(context.process);
+            if (completed && (identity.kind === "gone" || identity.kind === "mismatch")) {
+                releasable = true;
+                return { requestId: request.requestId, scopeSha256: request.scopeSha256, process: { ...request.target }, nativeStop: request.preserved ? "preserved-exit-returned" : "returned", cleanup: "not-checked", observedAt: completed.observedAt };
+            }
+            if (!completed && (identity.kind === "gone" || identity.kind === "mismatch"))
+                throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "the original manager process exited without its native returned receipt; disappearance was not treated as a completed stop or cleanup");
+            await delay(100, undefined, { signal: context.signal });
+        }
+        throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "the original native manager stop did not confirm both return and process exit; its request/reservation were retained, without force kill or restart");
+    }
+    catch (error) {
+        if (error instanceof CommandFailure)
+            throw error;
+        throw new CommandFailure(submitted || !releasable ? "unknown" : "refused", submitted || !releasable ? "OPERATION_UNKNOWN" : "LIFECYCLE_BLOCKED", submitted || !releasable ? "the native manager stop submission or observation was not confirmed; its original request was retained and not retried" : "the native manager preflight did not establish its exact current scope; no stop was submitted");
+    }
+    finally {
+        if (releasable)
+            reservation.release();
+    }
+}
+export const managerService = {
+    kind: "local-process", name: "manager-service", label: "manager service", order: 10, controllerOnly: true,
+    pidFile: MANAGER_PIDFILE, isOwnCommand: commandIsCotalSupervisor,
+    service: {
+        abiVersion: 1, requiresCli: true, readiness: "endpoint", stop: "native",
+        capabilities: { multiInstance: false, foreground: true, logs: true }, paths: { root: "directory", launch: "private-file", roster: "file" },
+        optionsSchema: { type: "object", additionalProperties: false, required: ["root", "runtime"], properties: {
+                root: { type: "string", minLength: 1, maxLength: 4096, description: "registered mesh root holding this manager's native custody" },
+                runtime: { type: "string", minLength: 1, maxLength: 200, description: "explicit installed runtime; no runtime is installed or selected implicitly" },
+                server: { type: "string", minLength: 1, maxLength: 4096, description: "optional repeat of the registered broker URL; another broker refuses" },
+                "console-port": { type: "integer", minimum: 0, maximum: 65535, description: "explicit console port; zero allocates a port" },
+                "console-host": { type: "string", minLength: 1, maxLength: 253, description: "explicit console bind host; omitted keeps native loopback binding" },
+                "ws-port": { type: "integer", minimum: 1, maximum: 65535, description: "explicit prepared broker websocket listener port" },
+                "max-sessions": { type: "integer", minimum: 1, maximum: Number.MAX_SAFE_INTEGER, description: "explicit positive native live-session ceiling" },
+                launch: { type: "string", minLength: 1, maxLength: 4096, description: "existing private resolved native launch spec for the selected space" },
+                "launch-sha256": { type: "string", minLength: 64, maxLength: 64, description: "full SHA-256 of the exact resolved launch file; required with launch" },
+                roster: { type: "string", minLength: 1, maxLength: 4096, description: "existing roster file whose agents the manager starts at each launch; a resumed manager takes none" },
+            } },
+    },
+    buildServiceLaunch(context) {
+        if (!context.cliInvocation?.length)
+            throw new CommandFailure("refused", "UNSUPPORTED", "the manager service requires the verified cotal entry; no PATH binary was selected");
+        if (context.credentialRef)
+            throw new CommandFailure("refused", "UNSUPPORTED", "the native manager uses its selected root's supported service authority; a generic credential reference was not substituted");
+        const root = String(context.options.root), target = resolveNativeServiceTarget(root, context.space, context.options.server);
+        const path = localProcessPath(MANAGER_PIDFILE, { root: target.root, space: context.space });
+        const raw = readPidfile(path), state = readProcessRecord(path, commandIsCotalSupervisor);
+        if (raw === "" || !["absent", "dead"].includes(state.state))
+            throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "a native manager record is live, foreign or unresolved; no legacy manager was adopted, stopped or replaced");
+        if (typeof context.options["console-host"] === "string" && /[\u0000- \u007f]/u.test(context.options["console-host"]))
+            throw new CommandFailure("refused", "USAGE_INVALID", "the declared console host contains whitespace or controls; no native child was launched");
+        const extra = [];
+        for (const name of ["console-port", "console-host", "ws-port", "max-sessions"])
+            if (context.options[name] !== undefined)
+                extra.push(`--${name}`, String(context.options[name]));
+        // A controller resume passes only its attempt and, when present, the protected token handoff
+        // path and digest. Never the token, and never with a launch spec.
+        const attempt = context.attempt === undefined ? undefined : serviceAdapterAttempt(context.attempt, ["resumeCommit"]);
+        if (attempt && (context.options.launch !== undefined || context.options["launch-sha256"] !== undefined))
+            throw new CommandFailure("refused", "USAGE_INVALID", "a resumed manager takes no launch spec; no native child was launched");
+        if (attempt && context.options.roster !== undefined)
+            throw new CommandFailure("refused", "USAGE_INVALID", "a resumed manager boots no roster; retained agents resume through the attempt. No native child was launched");
+        if (!maintenanceAdmits(canonicalRoot(target.root), target.server, context, attempt))
+            throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "this root retains a maintenance or recovery attempt; the manager service did not substitute an ordinary lifecycle");
+        if (attempt)
+            extra.push("--resume-attempt", attempt.attemptId, ...(attempt.resumeCommit ? ["--resume-commit-file", attempt.resumeCommit.path, "--resume-commit-sha256", attempt.resumeCommit.sha256] : []));
+        if (context.options.launch !== undefined || context.options["launch-sha256"] !== undefined) {
+            if (typeof context.options.launch !== "string" || typeof context.options["launch-sha256"] !== "string")
+                throw new CommandFailure("refused", "USAGE_INVALID", "a manager launch requires both its private native spec and full SHA-256; neither was inferred");
+            managerServiceLaunchSpec(context.options.launch, context.options["launch-sha256"], context.space);
+            extra.push("--launch", context.options.launch, "--launch-sha256", context.options["launch-sha256"]);
+        }
+        if (context.options.roster !== undefined)
+            extra.push("--roster", String(context.options.roster));
+        const [executable, ...self] = context.cliInvocation;
+        return { executable: executable, cwd: target.root, args: [...self, ...(colorEnabled() ? [] : ["--no-color"]), "__service-manager", "--root", target.root, "--space", context.space, "--server", target.server, "--runtime", String(context.options.runtime), "--service-instance", context.instanceId, "--launch-request", context.launchRequestId, "--state-directory", context.stateDirectory, ...extra] };
+    },
+    checkServiceReadiness: managerServiceReadiness,
+    prepareServiceStop: prepareStop,
+    stopService: stop,
+};
+registry.register(managerService, managerPreset);
+//# sourceMappingURL=service-adapter.js.map

package/dist/service-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-adapter.js","sourceRoot":"","sources":["../src/service-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,wBAAwB,EAClF,oBAAoB,EAAE,yBAAyB,EAAE,aAAa,EAAE,8BAA8B,EAC9F,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,aAAa,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,yBAAyB,EACxJ,qBAAqB,EAAE,sBAAsB,EAAE,WAAW,EAAE,iBAAiB,EAAE,uBAAuB,EACtG,wBAAwB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,qBAAqB,EAClG,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACzH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK;IACrF,OAAO,EAAE,0HAA0H;CACpI,CAAC;AAEF,qFAAqF;AACrF,MAAM,qBAAqB,GAAsB,CAAC,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AAE7H;;;;;;2DAM2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc,EAAE,OAA8B,EAAE,OAA0C;IACxI,IAAI,CAAC,OAAO;QAAE,OAAO,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,SAAS,GAAG,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChJ,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAChG,MAAM,GAAG,GAAG,CAAC,GAAG,wBAAwB,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACtH,OAAO,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU;QACnI,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAkC;IAC3D,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,gFAAgF,CAAC,CAAC;IACpL,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,gGAAgG,CAAC,CAAC;IAC7K,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAC9C,+FAA+F;IAC/F,+FAA+F;IAC/F,8DAA8D;IAC9D,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1K,OAAO;QACL,WAAW,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QACjF,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE;QAC/N,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7L,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5I,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,KAAK,UAAU,IAAI,CAAC,OAAwF;IAC1G,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,yBAAyB,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAChI,MAAM,WAAW,GAAG,wBAAwB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAG,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC;QACle,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,IAAI,SAAS,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,4DAA4D,CAAC,CAAC;QACvN,MAAM,MAAM,GAAG,yBAAyB,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAClG,IAAI,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,kFAAkF,CAAC,CAAC;QAC1M,MAAM,OAAO,GAA6B,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1c,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChC,0FAA0F;QAC1F,UAAU,GAAG,KAAK,CAAC;QACnB,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,UAAU;YAAE,wBAAwB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/L,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChC,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,gFAAgF,CAAC,CAAC;QACvM,SAAS,GAAG,IAAI,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBAClD,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjD,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,mHAAmH,CAAC,CAAC;YAChL,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,oIAAoI,CAAC,CAAC;YACjP,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC5E,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9O,CAAC;YACD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,uIAAuI,CAAC,CAAC;YAChR,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,qJAAqJ,CAAC,CAAC;IAClN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc;YAAE,MAAM,KAAK,CAAC;QACjD,MAAM,IAAI,cAAc,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,wHAAwH,CAAC,CAAC,CAAC,+FAA+F,CAAC,CAAC;IAC1Y,CAAC;YAAS,CAAC;QAAC,IAAI,UAAU;YAAE,WAAW,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAiB;IAC1C,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI;IACzG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,wBAAwB;IAChE,OAAO,EAAE;QACP,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ;QACvE,YAAY,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;QAC1I,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE;gBACvG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,4DAA4D,EAAE;gBAClI,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4EAA4E,EAAE;gBACpJ,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,sEAAsE,EAAE;gBAC9I,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE;gBAC5H,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,mEAAmE,EAAE;gBAClJ,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,kDAAkD,EAAE;gBAC3H,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,+CAA+C,EAAE;gBAC/I,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,qEAAqE,EAAE;gBAC7I,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,sEAAsE,EAAE;gBACtJ,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,mGAAmG,EAAE;aAC5K,EAAE;KACJ;IACD,kBAAkB,CAAC,OAAO;QACxB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,oFAAoF,CAAC,CAAC;QAC7K,IAAI,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,6HAA6H,CAAC,CAAC;QAC7M,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,MAA4B,CAAC,CAAC;QAClJ,MAAM,IAAI,GAAG,gBAAgB,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACzF,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,4GAA4G,CAAC,CAAC;QACpO,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,yFAAyF,CAAC,CAAC;QACtQ,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,CAAU;YAAE,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzL,6FAA6F;QAC7F,kEAAkE;QAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QACrH,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,sEAAsE,CAAC,CAAC;QACtO,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,6GAA6G,CAAC,CAAC;QACzN,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,mHAAmH,CAAC,CAAC;QACnQ,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,wBAAwB,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5M,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3F,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,+FAA+F,CAAC,CAAC;YAC9P,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;QACpD,OAAO,EAAE,UAAU,EAAE,UAAW,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,UAAU,EAAE,kBAAkB,EAAE,OAAO,CAAC,eAAe,EAAE,mBAAmB,EAAE,OAAO,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAChZ,CAAC;IACD,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,WAAW;IAC/B,WAAW,EAAE,IAAI;CAClB,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC"}

package/dist/service-child.d.ts

@@ -0,0 +1,37 @@
+import type { MeshLaunchSpec, ParsedArgs } from "@cotal-ai/core";
+import { type NativeServiceStopRequest, type ServiceAdapterContext } from "@cotal-ai/workspace";
+import type { Manager, ManagerOptions, ManagerServiceObservation, StartAgentOpts } from "./manager.js";
+export interface ManagerServiceChild {
+    readonly root: string;
+    readonly context: Pick<ServiceAdapterContext, "space" | "instanceId" | "launchRequestId" | "stateDirectory">;
+    readonly launchSpec?: MeshLaunchSpec;
+    /** The roster's agents, parsed once here like the launch spec. */
+    readonly roster?: readonly StartAgentOpts[];
+}
+/** Read one private, content-pinned manifest once. The child keeps these parsed bytes rather than
+ *  reopening a path after asynchronous authority preparation. */
+export declare function managerServiceLaunchSpec(path: string, digest: string, space: string): MeshLaunchSpec;
+/** Hidden runner inputs contain public coordinates only, never credentials or console URLs. */
+export declare function managerServiceChild(args: ParsedArgs): ManagerServiceChild;
+/** Shared by the native child and its caller-attributed controller preflight. Dynamic
+ *  observation time is excluded; identity, policy, agents and pending work remain bound. */
+export declare function managerServiceStopScope(observation: ManagerServiceObservation, withAgents: boolean): string;
+/** The preserved-exit counterpart of {@link managerServiceStopScope}, shared by the native child and
+ *  the controller. It accepts only a fully preserved, whole-manager, quiescent embedding whose
+ *  preservation binding is the requested attempt and inventory. The ordinary scope is unchanged. */
+export declare function managerServicePreservedExitScope(observation: ManagerServiceObservation, preserved: {
+    attemptId: string;
+    inventorySha256: string;
+}, held: {
+    attemptId: string;
+    inventorySha256: string;
+} | undefined): string;
+/** All guards and acceptance publication are synchronous. The caller invokes mgr.stop in the
+ *  same event-loop turn, before another native lifecycle callback can change this scope. */
+export declare function acceptManagerServiceStop(manager: Manager, service: ManagerServiceChild): NativeServiceStopRequest;
+export declare function bindManagerServiceIdentity(service: ManagerServiceChild): NonNullable<ManagerOptions["onServiceIdentity"]>;
+/** Answer request-bound local observations addressed to this exact process. Arm it only after the
+ *  manager-serving startup is published. It answers nothing until the manager has its own serve
+ *  registration, and stops on dispose. Errors leave the request unanswered, never ready. */
+export declare function armManagerServiceObserver(manager: Manager, service: ManagerServiceChild): () => void;
+//# sourceMappingURL=service-child.d.ts.map

package/dist/service-child.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-child.d.ts","sourceRoot":"","sources":["../src/service-child.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAML,KAAK,wBAAwB,EAAE,KAAK,qBAAqB,EAC1D,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAIvG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,YAAY,GAAG,iBAAiB,GAAG,gBAAgB,CAAC,CAAC;IAC7G,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED;iEACiE;AACjE,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAUpG;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,mBAAmB,CAqCzE;AAED;4FAC4F;AAC5F,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,yBAAyB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAqB3G;AAED;;oGAEoG;AACpG,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,yBAAyB,EAAE,SAAS,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,CAuB5N;AAED;4FAC4F;AAC5F,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,CA0BjH;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,mBAAmB,GAAG,WAAW,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAEzH;AAED;;4FAE4F;AAC5F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,MAAM,IAAI,CASpG"}

package/dist/service-child.js

@@ -0,0 +1,195 @@
+import { createHash } from "node:crypto";
+import { lstatSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { CommandFailure, MANAGER_PIDFILE, answerServiceObservations, assertRecordIdentity, canonicalLocalProcessPath, consumeManagerShutdownIntent, protectedCredentialReference, protectedLocalDirectory, publishServiceIdentity, publishServiceStopReceipt, readLocalRecordSource, readServiceIdentity, readServiceStopReceipts, readServiceStopRequest, resolveNativeServiceTarget, serviceMetadataDigest, serviceOperationId, serviceStopRequestPath, stopReservationPath, } from "@cotal-ai/workspace";
+import { parseLaunchSpec } from "./launch.js";
+import { loadRoster } from "./roster.js";
+/** Read one private, content-pinned manifest once. The child keeps these parsed bytes rather than
+ *  reopening a path after asynchronous authority preparation. */
+export function managerServiceLaunchSpec(path, digest, space) {
+    if (!isAbsolute(path) || path.length > 4096 || /[\u0000-\u001f\u007f]/u.test(path) || !/^[0-9a-f]{64}$/.test(digest))
+        throw new CommandFailure("refused", "USAGE_INVALID", "an owned manager launch requires an absolute private spec and its full SHA-256");
+    protectedCredentialReference(path);
+    const bytes = readLocalRecordSource(path, 256 * 1024, true);
+    if (!bytes || createHash("sha256").update(bytes).digest("hex") !== digest)
+        throw new CommandFailure("refused", "CONFLICT", "the owned manager launch spec is absent or changed from its declared digest; no agent launch was selected");
+    let spec;
+    try {
+        spec = parseLaunchSpec(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)), "owned manager launch");
+    }
+    catch {
+        throw new CommandFailure("refused", "SCHEMA_INVALID", "the owned manager launch spec is not valid native launch data; document contents were not echoed");
+    }
+    if (spec.space !== space)
+        throw new CommandFailure("refused", "CONFLICT", "the owned manager launch spec names another space; no target was substituted");
+    return spec;
+}
+/** Hidden runner inputs contain public coordinates only, never credentials or console URLs. */
+export function managerServiceChild(args) {
+    const values = args.values;
+    for (const key of ["root", "space", "server", "runtime", "service-instance", "launch-request", "state-directory"]) {
+        if (typeof values[key] !== "string" || !values[key] || values[key].length > 4096 || /[\u0000-\u001f\u007f]/u.test(values[key]))
+            throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires its explicit public target, runtime and full launch coordinates");
+    }
+    if (args.positionals.length)
+        throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child takes no positional targets");
+    const root = String(values.root), stateDirectory = String(values["state-directory"]);
+    if (process.platform !== "linux" || !isAbsolute(root) || !isAbsolute(stateDirectory))
+        throw new CommandFailure("refused", "UNSUPPORTED", "the native manager child requires protected absolute paths and Linux process creation identity");
+    protectedLocalDirectory(root);
+    protectedLocalDirectory(join(root, ".cotal"));
+    protectedLocalDirectory(stateDirectory);
+    const directory = lstatSync(stateDirectory);
+    if (directory.uid !== process.getuid() || (directory.mode & 0o077) !== 0)
+        throw new CommandFailure("refused", "PERMISSION_DENIED", "the native manager launch state must be an owned private directory");
+    const target = resolveNativeServiceTarget(root, String(values.space), String(values.server));
+    const context = Object.freeze({ space: target.space, instanceId: serviceOperationId(values["service-instance"]), launchRequestId: serviceOperationId(values["launch-request"]), stateDirectory });
+    for (const [field, minimum, maximum] of [["console-port", 0, 65535], ["ws-port", 1, 65535], ["max-sessions", 1, Number.MAX_SAFE_INTEGER]]) {
+        const value = values[field];
+        if (value !== undefined && (typeof value !== "string" || !/^(0|[1-9][0-9]*)$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < minimum || Number(value) > maximum))
+            throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires valid explicit ports and a positive session ceiling");
+    }
+    if (values["console-host"] !== undefined && (typeof values["console-host"] !== "string" || !values["console-host"] || values["console-host"].length > 253 || /[\u0000- \u007f]/u.test(values["console-host"])))
+        throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires a bounded explicit console host without controls");
+    let launchSpec;
+    if (values.launch !== undefined || values["launch-sha256"] !== undefined) {
+        if (typeof values.launch !== "string" || typeof values["launch-sha256"] !== "string")
+            throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires both its private launch spec and full digest");
+        launchSpec = managerServiceLaunchSpec(values.launch, values["launch-sha256"], target.space);
+    }
+    if (values["resume-attempt"] !== undefined && (typeof values["resume-attempt"] !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(values["resume-attempt"])))
+        throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires a safe resume attempt token");
+    if ((values["resume-commit-file"] !== undefined || values["resume-commit-sha256"] !== undefined) && (values["resume-attempt"] === undefined || typeof values["resume-commit-file"] !== "string" || !isAbsolute(values["resume-commit-file"]) || values["resume-commit-file"].length > 4096 || /[\u0000-\u001f\u007f]/u.test(values["resume-commit-file"]) || typeof values["resume-commit-sha256"] !== "string" || !/^[0-9a-f]{64}$/.test(values["resume-commit-sha256"])))
+        throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires its resume attempt, an absolute resume commit file and its full digest together");
+    if ((values["resume-attempt"] !== undefined) && (values.launch !== undefined || values["launch-sha256"] !== undefined))
+        throw new CommandFailure("refused", "USAGE_INVALID", "a resumed native manager takes no launch spec; retained agents resume through the attempt-bound control operation");
+    let roster;
+    if (values.roster !== undefined) {
+        if (typeof values.roster !== "string" || !isAbsolute(values.roster) || values.roster.length > 4096 || /[\u0000-\u001f\u007f]/u.test(values.roster))
+            throw new CommandFailure("refused", "USAGE_INVALID", "the native manager child requires an absolute roster file path without controls");
+        if (values["resume-attempt"] !== undefined)
+            throw new CommandFailure("refused", "USAGE_INVALID", "a resumed native manager boots no roster; retained agents resume through the attempt-bound control operation");
+        try {
+            roster = loadRoster(values.roster);
+        }
+        catch (error) {
+            throw new CommandFailure("refused", "SCHEMA_INVALID", `the manager roster was not loaded: ${error.message}`);
+        }
+    }
+    serviceStopRequestPath(context);
+    return Object.freeze({ root: target.root, context, ...(launchSpec ? { launchSpec } : {}), ...(roster ? { roster } : {}) });
+}
+/** Shared by the native child and its caller-attributed controller preflight. Dynamic
+ *  observation time is excluded; identity, policy, agents and pending work remain bound. */
+export function managerServiceStopScope(observation, withAgents) {
+    const impact = observation.stopImpact;
+    const pending = { lifecycleInFlight: impact.lifecycleInFlight, reservedLaunches: impact.reservedLaunches, retirementsPending: impact.retirementsPending, deprovisioningInFlight: impact.deprovisioningInFlight, staticReconciliationInFlight: impact.staticReconciliationInFlight };
+    const blockers = [
+        ...(impact.agentScope !== "manager" ? ["owner-filtered-visibility"] : []),
+        ...(impact.maintenance !== "active" ? ["maintenance"] : []),
+        ...(impact.resumeRequired ? ["resume-required"] : []),
+        ...(impact.stopping ? ["stop-in-progress"] : []),
+        ...Object.entries(pending).filter(([, count]) => count !== 0).map(([name]) => name),
+    ];
+    if (blockers.length)
+        throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", impact.agentScope !== "manager" ? "the native manager returned owner-filtered impact; no whole-manager stop policy was accepted" : "the native manager did not meet its full-scope quiescence checks; no stop policy was accepted", {
+            target: { managerInstanceId: observation.registration.instanceId },
+            native: { detail: { phase: "manager-stop-preflight", blockers, agentScope: impact.agentScope, maintenance: impact.maintenance, resumeRequired: impact.resumeRequired, stopping: impact.stopping, pending } },
+            remedy: impact.agentScope !== "manager" ? "ask the stack operator to stop this shared manager, or use an authorized admin-scoped caller; no wider caller was substituted" : "inspect the reported blockers and this manager's native status before another stop; no stop was submitted",
+        });
+    const agents = impact.agents.map((row) => ({ ...row })).sort((a, b) => {
+        const first = JSON.stringify([a.name, a.id, a.lifecycleUid]), second = JSON.stringify([b.name, b.id, b.lifecycleUid]);
+        return first < second ? -1 : first > second ? 1 : 0;
+    });
+    const { observedAt: _observedAt, ...policy } = impact;
+    return serviceMetadataDigest({ registration: observation.registration, withAgents, impact: { ...policy, agents } });
+}
+/** The preserved-exit counterpart of {@link managerServiceStopScope}, shared by the native child and
+ *  the controller. It accepts only a fully preserved, whole-manager, quiescent embedding whose
+ *  preservation binding is the requested attempt and inventory. The ordinary scope is unchanged. */
+export function managerServicePreservedExitScope(observation, preserved, held) {
+    const impact = observation.stopImpact;
+    const pending = { lifecycleInFlight: impact.lifecycleInFlight, reservedLaunches: impact.reservedLaunches, retirementsPending: impact.retirementsPending, deprovisioningInFlight: impact.deprovisioningInFlight, staticReconciliationInFlight: impact.staticReconciliationInFlight };
+    const blockers = [
+        ...(impact.agentScope !== "manager" ? ["owner-filtered-visibility"] : []),
+        ...(impact.maintenance !== "preserved" ? ["not-preserved"] : []),
+        ...(impact.stopping ? ["stop-in-progress"] : []),
+        ...Object.entries(pending).filter(([, count]) => count !== 0).map(([name]) => name),
+        ...(!held || held.attemptId !== preserved.attemptId || held.inventorySha256 !== preserved.inventorySha256 ? ["preservation-mismatch"] : []),
+    ];
+    if (blockers.length)
+        throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "the native manager is not the fully preserved, quiescent embedding this preserved-exit stop names; no stop policy was accepted", {
+            target: { managerInstanceId: observation.registration.instanceId },
+            native: { detail: { phase: "manager-preserved-exit-preflight", blockers, agentScope: impact.agentScope, maintenance: impact.maintenance, stopping: impact.stopping, pending } },
+            remedy: "inspect this manager's native status and the maintenance journal before another preserved stop; no stop was submitted",
+        });
+    const agents = impact.agents.map((row) => ({ ...row })).sort((a, b) => {
+        const first = JSON.stringify([a.name, a.id, a.lifecycleUid]), second = JSON.stringify([b.name, b.id, b.lifecycleUid]);
+        return first < second ? -1 : first > second ? 1 : 0;
+    });
+    // The binding is named once, outside the impact, so both sides digest the same shape whether or
+    // not their observation carried it.
+    const { observedAt: _observedAt, preservation: _preservation, ...policy } = impact;
+    return serviceMetadataDigest({ registration: observation.registration, kind: "preserved-exit", attemptId: preserved.attemptId, inventorySha256: preserved.inventorySha256, impact: { ...policy, agents } });
+}
+/** All guards and acceptance publication are synchronous. The caller invokes mgr.stop in the
+ *  same event-loop turn, before another native lifecycle callback can change this scope. */
+export function acceptManagerServiceStop(manager, service) {
+    const request = readServiceStopRequest(service.context);
+    if (!request)
+        throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "this managed manager has no request-bound native stop handoff; no stop was started");
+    if (readServiceStopReceipts(service.context, request).length)
+        throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "this native manager stop request already has phase evidence; it was not replayed");
+    const refuse = () => {
+        publishServiceStopReceipt(service.context, request, "refused");
+        throw new CommandFailure("refused", "LIFECYCLE_BLOCKED", "the native manager stop target, reservation or reviewed scope changed; no stop was started");
+    };
+    if (request.target.pid !== process.pid || assertRecordIdentity(request.target).kind !== "match")
+        throw new CommandFailure("unknown", "OPERATION_UNKNOWN", "the native manager stop handoff does not name this process; no phase was attributed to it");
+    const binding = readServiceIdentity(service.context, request.target);
+    const observation = manager.localServiceObservation();
+    if (!binding || !observation || serviceMetadataDigest(binding.native) !== serviceMetadataDigest({ endpoint: observation.registration.endpoint, instanceId: observation.registration.instanceId, principal: observation.registration.principal }))
+        return refuse();
+    const pidPath = canonicalLocalProcessPath(MANAGER_PIDFILE, { root: service.root, space: service.context.space });
+    const pid = readLocalRecordSource(pidPath, 128, true)?.toString("utf8").trim();
+    const stopper = readLocalRecordSource(stopReservationPath(pidPath), 128, true)?.toString("utf8");
+    if (pid !== String(request.target.pid) || stopper !== String(request.stopper.pid) || assertRecordIdentity(request.stopper).kind !== "match")
+        return refuse();
+    let scope;
+    // A preserved request selects the preserved-exit scope. A preserved request that also asks to
+    // reap agents is refused, and so is any request the embedding's own state does not support.
+    if (request.preserved && request.withAgents)
+        return refuse();
+    try {
+        scope = request.preserved ? managerServicePreservedExitScope(observation, request.preserved, manager.localPreservation()) : managerServiceStopScope(observation, request.withAgents);
+    }
+    catch {
+        return refuse();
+    }
+    if (scope !== request.scopeSha256)
+        return refuse();
+    const decision = consumeManagerShutdownIntent({ root: service.root, space: service.context.space });
+    if (decision.warning || decision.withAgents !== request.withAgents)
+        return refuse();
+    publishServiceStopReceipt(service.context, request, "accepted");
+    return request;
+}
+export function bindManagerServiceIdentity(service) {
+    return (identity) => publishServiceIdentity(service.context, identity);
+}
+/** Answer request-bound local observations addressed to this exact process. Arm it only after the
+ *  manager-serving startup is published. It answers nothing until the manager has its own serve
+ *  registration, and stops on dispose. Errors leave the request unanswered, never ready. */
+export function armManagerServiceObserver(manager, service) {
+    const timer = setInterval(() => {
+        try {
+            if (!manager.localServiceObservation())
+                return;
+            answerServiceObservations(service.context, () => manager.localServiceObservation());
+        }
+        catch { /* unanswered: the controller times out with no evidence */ }
+    }, 200);
+    timer.unref();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=service-child.js.map

package/dist/service-child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-child.js","sourceRoot":"","sources":["../src/service-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EACL,cAAc,EAAE,eAAe,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,yBAAyB,EAC3G,4BAA4B,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,sBAAsB,EAC3G,yBAAyB,EAAE,qBAAqB,EAAE,mBAAmB,EACrE,uBAAuB,EAAE,sBAAsB,EAAE,0BAA0B,EAC3E,qBAAqB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,mBAAmB,GAEvF,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC;iEACiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa;IAClF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,gFAAgF,CAAC,CAAC;IAC7P,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC;IACxO,IAAI,IAAoB,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAAC,CAAC;IAC5H,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,kGAAkG,CAAC,CAAC;IAAC,CAAC;IACpK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,8EAA8E,CAAC,CAAC;IAC1J,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAClH,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,mGAAmG,CAAC,CAAC;IAC5R,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,sDAAsD,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,gGAAgG,CAAC,CAAC;IAC3O,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9B,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,uBAAuB,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,oEAAoE,CAAC,CAAC;IAC1M,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAClM,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAU,EAAE,CAAC;QACnJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,uFAAuF,CAAC,CAAC;IAC1U,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,oFAAoF,CAAC,CAAC;IAC3V,IAAI,UAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QACzE,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,gFAAgF,CAAC,CAAC;QAC7N,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,+DAA+D,CAAC,CAAC;IAC3R,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,sBAAsB,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,oBAAoB,CAAC,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,sBAAsB,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,mHAAmH,CAAC,CAAC;IACtnB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,mHAAmH,CAAC,CAAC;IAClS,IAAI,MAAoC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,iFAAiF,CAAC,CAAC;QAC5R,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,8GAA8G,CAAC,CAAC;QACjN,IAAI,CAAC;YAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAC3C,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,gBAAgB,EAAE,sCAAuC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IAC5I,CAAC;IACD,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,WAAsC,EAAE,UAAmB;IACjG,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC;IACpR,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;KACpF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,8FAA8F,CAAC,CAAC,CAAC,+FAA+F,EAAE;YAChT,MAAM,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAC,UAAU,EAAE;YAClE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC5M,MAAM,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,+HAA+H,CAAC,CAAC,CAAC,2GAA2G;SACxR,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACtH,OAAO,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;IACtD,OAAO,qBAAqB,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACtH,CAAC;AAED;;oGAEoG;AACpG,MAAM,UAAU,gCAAgC,CAAC,WAAsC,EAAE,SAAyD,EAAE,IAAgE;IAClN,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC;IACtC,MAAM,OAAO,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B,EAAE,CAAC;IACpR,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;QACnF,GAAG,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5I,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,gIAAgI,EAAE;YAC9M,MAAM,EAAE,EAAE,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAC,UAAU,EAAE;YAClE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;YAC/K,MAAM,EAAE,uHAAuH;SAChI,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACtH,OAAO,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,gGAAgG;IAChG,oCAAoC;IACpC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC;IACnF,OAAO,qBAAqB,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9M,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,wBAAwB,CAAC,OAAgB,EAAE,OAA4B;IACrF,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,oFAAoF,CAAC,CAAC;IAC7J,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,kFAAkF,CAAC,CAAC;IAC3M,MAAM,MAAM,GAAG,GAAU,EAAE;QACzB,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,4FAA4F,CAAC,CAAC;IACzJ,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,2FAA2F,CAAC,CAAC;IACvP,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAAE,OAAO,MAAM,EAAE,CAAC;IAClQ,MAAM,OAAO,GAAG,yBAAyB,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACjH,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,MAAM,OAAO,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,EAAE,CAAC;IAC7J,IAAI,KAAa,CAAC;IAClB,8FAA8F;IAC9F,4FAA4F;IAC5F,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU;QAAE,OAAO,MAAM,EAAE,CAAC;IAC7D,IAAI,CAAC;QAAC,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;IAAC,CAAC;IACxN,IAAI,KAAK,KAAK,OAAO,CAAC,WAAW;QAAE,OAAO,MAAM,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,4BAA4B,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACpG,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAAE,OAAO,MAAM,EAAE,CAAC;IACpF,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA4B;IACrE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;4FAE4F;AAC5F,MAAM,UAAU,yBAAyB,CAAC,OAAgB,EAAE,OAA4B;IACtF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE;gBAAE,OAAO;YAC/C,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IACzE,CAAC,EAAE,GAAG,CAAC,CAAC;IACR,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}