@dharma-ai-labs/agent-fabric 0.2.209 → 0.2.211

package/dist/relaySigningMaintenanceUpgrade.test.js

@@ -0,0 +1,230 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, realpath, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { upgradeRelayRuntime } from './relayRuntimeUpgrade.js';
+import { validateContract } from '@dharma-ai-labs/agent-fabric-contracts';
+import { commandExitCode } from './index.js';
+const modulePath = './relaySigningMaintenanceUpgrade.js';
+const hash = (value) => 'sha256:' + createHash('sha256').update(value).digest('hex');
+const contents = (version) => ({ shell: `#!/bin/sh\n# verified ${version}\n`, windows: `@echo off\r\nrem verified ${version}\r\n` });
+async function fixture() {
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'relay-signing-maintenance-')));
+    const home = join(root, 'home'), workspace = join(root, 'repo');
+    await mkdir(join(workspace, '.dharma', 'bin'), { recursive: true });
+    await mkdir(join(home, 'relay'), { recursive: true });
+    const input = { home, workspace, organizationId: 'org_fixture', deviceId: '11111111-1111-4111-8111-111111111111',
+        workspaceId: '22222222-2222-4222-8222-222222222222', version: '0.2.211', trustGeneration: 2 };
+    let version = '0.2.207';
+    const calls = [];
+    const old = contents(version);
+    for (const [name, value] of Object.entries({ dharma: old.shell, 'dharma.cmd': old.windows }))
+        await writeFile(join(workspace, '.dharma', 'bin', name), value);
+    const deps = { assertStopped: async () => { calls.push('stopped'); }, assertNamedDisabled: async () => { calls.push('named-disabled'); },
+        assertStartupPaused: async () => { calls.push('paused'); },
+        inspectStartup: async () => ({ version, workspace }), configureStartup: async (next) => { calls.push('configure:' + next); version = next; },
+        stageStartup: async (next) => { calls.push('stage:' + next); version = next; },
+        launcherContents: contents, verifyPriorLaunchers: async (v, c) => JSON.stringify(c) === JSON.stringify(contents(v)),
+        verifyRecoveryLaunchers: async (v, c) => JSON.stringify(c) === JSON.stringify(contents(v)),
+        start: async () => { calls.push('start'); }, stop: async () => { calls.push('stop'); },
+        verify: async (v) => { calls.push('verify:' + v); }, assertRecoveredTrust: async (generation) => { calls.push('trust:' + generation); } };
+    return { input, deps, calls, old, currentVersion: () => version };
+}
+test('expired-signing upgrade stages offline without inventing a successful poll or starting a receiver', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    const result = await upgradeRelayForSigningMaintenance({ ...f.input, dryRun: false }, f.deps);
+    assert.equal(result.state, 'staged');
+    assert.equal(result.upgradeComplete, false);
+    assert.equal(result.ready, false);
+    assert.equal(result.runtimeObservation, 'not_performed');
+    assert.equal(result.nativeContinuationAuthorized, false);
+    assert.equal(f.currentVersion(), f.input.version);
+    assert(!f.calls.includes('start'));
+    assert(!f.calls.some(v => v.startsWith('trust:') || v.startsWith('verify:')));
+    assert(f.calls.indexOf('stage:0.2.207') < f.calls.indexOf('stage:0.2.211'));
+    await assert.rejects(readFile(join(f.input.home, 'relay', 'runtime-upgrade.json')), /ENOENT/);
+});
+test('the default plan and repeated staging preserve public bytes and never start a receiver', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    const plan = await upgradeRelayForSigningMaintenance({ ...f.input, dryRun: true }, f.deps);
+    assert.equal(plan.state, 'planned');
+    assert.equal(f.currentVersion(), '0.2.207');
+    assert(!f.calls.some(v => v.startsWith('configure:') || v.startsWith('stage:')));
+    await assert.rejects(readFile(join(f.input.home, 'relay', 'signing-maintenance-upgrade.json')), /ENOENT/);
+    const first = await upgradeRelayForSigningMaintenance(f.input, f.deps);
+    const bytes = await readFile(join(f.input.home, 'relay', 'signing-maintenance-upgrade.json'), 'utf8');
+    f.calls.length = 0;
+    const second = await upgradeRelayForSigningMaintenance(f.input, f.deps);
+    assert.equal(second.upgradeId, first.upgradeId);
+    assert.equal(second.state, 'staged');
+    assert.equal(await readFile(join(f.input.home, 'relay', 'signing-maintenance-upgrade.json'), 'utf8'), bytes);
+    assert(!f.calls.some(v => v === 'start' || v.startsWith('configure:') || v.startsWith('stage:')));
+});
+test('a failed legacy rollback cannot be erased or retried by a new release', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    const legacy = await upgradeRelayRuntime({ ...f.input, version: '0.2.209' }, { ...f.deps, verify: async () => { throw Error('expired signer'); } });
+    assert.equal(legacy.state, 'rollback_failed');
+    assert.equal(f.currentVersion(), '0.2.207');
+    const path = join(f.input.home, 'relay', 'runtime-upgrade.json'), bytes = await readFile(path, 'utf8');
+    f.calls.length = 0;
+    await assert.rejects(upgradeRelayForSigningMaintenance(f.input, f.deps), /prior_failure_custody_required/);
+    await assert.rejects(upgradeRelayForSigningMaintenance({ ...f.input, previousUpgradeSha256: hash(bytes + 'tampered') }, f.deps), /prior_failure_custody_required/);
+    assert.equal(await readFile(path, 'utf8'), bytes);
+    assert(!f.calls.some(v => v.startsWith('configure:') || v.startsWith('stage:') || v === 'start'));
+    const staged = await upgradeRelayForSigningMaintenance({ ...f.input, previousUpgradeSha256: hash(bytes) }, f.deps);
+    assert.equal(staged.state, 'staged');
+    assert.equal(await readFile(path, 'utf8'), bytes);
+    assert.equal(await readFile(join(f.input.home, 'relay', staged.priorJournalArchive), 'utf8'), bytes);
+});
+test('changed or half-restored failed journals are refused before launcher or startup mutation', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    for (const change of ['launcher', 'context', 'state']) {
+        const f = await fixture();
+        await upgradeRelayRuntime({ ...f.input, version: '0.2.209' }, { ...f.deps, verify: async () => { throw Error('offline'); } });
+        const path = join(f.input.home, 'relay', 'runtime-upgrade.json');
+        let bytes = await readFile(path, 'utf8');
+        if (change === 'launcher')
+            await writeFile(join(f.input.workspace, '.dharma', 'bin', 'dharma'), contents('0.2.209').shell);
+        if (change === 'state') {
+            const value = JSON.parse(bytes);
+            value.state = 'installed';
+            bytes = JSON.stringify(value);
+            await writeFile(path, bytes, { mode: 0o600 });
+        }
+        f.calls.length = 0;
+        await assert.rejects(upgradeRelayForSigningMaintenance({ ...f.input, previousUpgradeSha256: hash(bytes) }, { ...f.deps, ...(change === 'context' ? { inspectStartup: async () => ({ version: '0.2.207', workspace: f.input.workspace, codexHome: '/different/profile' }) } : {}) }), /prior_failure_custody_required|launcher_conflict|context_conflict/);
+        assert.equal(await readFile(path, 'utf8'), bytes);
+        assert(!f.calls.some(v => v.startsWith('configure:') || v.startsWith('stage:') || v === 'start'));
+    }
+});
+test('finish requires recovered trust and a genuine current-version receiver verification', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    await upgradeRelayForSigningMaintenance(f.input, f.deps);
+    f.calls.length = 0;
+    await assert.rejects(upgradeRelayForSigningMaintenance({ ...f.input, finish: true }, { ...f.deps, assertRecoveredTrust: async () => { throw Error('trust still expired'); } }), /trust still expired/);
+    assert(!f.calls.includes('start'));
+    const result = await upgradeRelayForSigningMaintenance({ ...f.input, finish: true }, f.deps);
+    assert.equal(result.state, 'completed');
+    assert.equal(result.upgradeComplete, true);
+    assert.equal(result.ready, false);
+    assert(f.calls.indexOf('trust:2') < f.calls.indexOf('start'));
+    assert(f.calls.includes('verify:0.2.211'));
+    const ordinary = JSON.parse(await readFile(join(f.input.home, 'relay', 'runtime-upgrade.json'), 'utf8'));
+    assert.equal(ordinary.state, 'completed');
+    assert.equal(ordinary.version, f.input.version);
+});
+test('a failed finish preserves its attempt and cannot automatically resume or restart old expired services', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    await upgradeRelayForSigningMaintenance(f.input, f.deps);
+    f.calls.length = 0;
+    const failed = await upgradeRelayForSigningMaintenance({ ...f.input, finish: true }, { ...f.deps, verify: async () => { throw Error('no current poll'); } });
+    assert.equal(failed.state, 'finish_failed');
+    assert.equal(failed.upgradeComplete, false);
+    assert.equal(f.calls.filter(v => v === 'start').length, 1);
+    assert.equal(f.calls.filter(v => v === 'stop').length, 1);
+    await assert.rejects(upgradeRelayForSigningMaintenance({ ...f.input, finish: true }, f.deps), /reconciliation_required/);
+    assert.equal(f.calls.filter(v => v === 'start').length, 1);
+});
+test('staging rejects active or enabled named sessions and never removes old service locks', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    for (const boundary of ['assertStopped', 'assertNamedDisabled']) {
+        const f = await fixture();
+        await assert.rejects(upgradeRelayForSigningMaintenance(f.input, { ...f.deps, [boundary]: async () => { throw Error('not quiescent'); } }), /not quiescent/);
+        assert(!f.calls.some(v => v === 'start' || v.startsWith('configure:') || v.startsWith('stage:')));
+        assert.equal(await readFile(join(f.input.workspace, '.dharma', 'bin', 'dharma'), 'utf8'), f.old.shell);
+    }
+});
+test('staging failure restores verified public files without opening protected stores or starting the old relay', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    let failed = false;
+    const result = await upgradeRelayForSigningMaintenance(f.input, { ...f.deps, stageStartup: async (v) => {
+            if (!failed) {
+                failed = true;
+                throw Error('configuration write failed');
+            }
+            return f.deps.stageStartup(v);
+        } });
+    assert.equal(result.state, 'staging_reverted');
+    assert.equal(result.upgradeComplete, false);
+    assert.equal(f.currentVersion(), '0.2.207');
+    assert.equal(await readFile(join(f.input.workspace, '.dharma', 'bin', 'dharma'), 'utf8'), f.old.shell);
+    assert(!f.calls.includes('start'));
+    assert(!f.calls.some(v => v.startsWith('trust:')));
+});
+test('stage and finish receipts and the persistent journal match their bounded contracts', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    const schemaRoot = join(import.meta.dirname, 'schemas');
+    const staged = await upgradeRelayForSigningMaintenance(f.input, f.deps);
+    const journal = JSON.parse(await readFile(join(f.input.home, 'relay', 'signing-maintenance-upgrade.json'), 'utf8'));
+    assert.equal((await validateContract(schemaRoot, 'https://schemas.dharma-ai.io/local-signing-maintenance-upgrade/v1', staged)).ok, true);
+    assert.equal((await validateContract(schemaRoot, 'https://schemas.dharma-ai.io/local-signing-maintenance-upgrade-journal/v1', journal)).ok, true);
+    assert.equal((await validateContract(schemaRoot, 'https://schemas.dharma-ai.io/local-signing-maintenance-upgrade/v1', { ...staged, upgradeComplete: true })).ok, false);
+    assert.equal((await validateContract(schemaRoot, 'https://schemas.dharma-ai.io/local-signing-maintenance-upgrade-journal/v1', { ...journal, password: 'SYNTHETIC_FORBIDDEN' })).ok, false);
+    const completed = await upgradeRelayForSigningMaintenance({ ...f.input, finish: true }, f.deps);
+    assert.equal((await validateContract(schemaRoot, 'https://schemas.dharma-ai.io/local-signing-maintenance-upgrade/v1', completed)).ok, true);
+});
+test('journal, launcher and original-history changes prevent finish before trust access or service start', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    for (const change of ['journal', 'launcher', 'legacy']) {
+        const f = await fixture();
+        await upgradeRelayForSigningMaintenance(f.input, f.deps);
+        if (change === 'journal') {
+            const path = join(f.input.home, 'relay', 'signing-maintenance-upgrade.json');
+            const body = JSON.parse(await readFile(path, 'utf8'));
+            body.deviceId = '33333333-3333-4333-8333-333333333333';
+            await writeFile(path, JSON.stringify(body), { mode: 0o600 });
+        }
+        else if (change === 'launcher')
+            await writeFile(join(f.input.workspace, '.dharma', 'bin', 'dharma'), contents('0.2.209').shell);
+        else
+            await writeFile(join(f.input.home, 'relay', 'runtime-upgrade.json'), '{}', { mode: 0o600 });
+        f.calls.length = 0;
+        await assert.rejects(upgradeRelayForSigningMaintenance({ ...f.input, finish: true }, f.deps), /journal_unavailable|launcher_conflict|prior_journal_changed/);
+        assert(!f.calls.some(v => v === 'start' || v.startsWith('trust:')));
+    }
+});
+test('staging exit status cannot relabel an unfinished or failed finish as success', () => {
+    const base = { schema: 'dharma.local-signing-maintenance-upgrade/v1', ready: false, nativeContinuationAuthorized: false };
+    const stage = ['relay', 'upgrade', '--stage-signing-maintenance', '--apply'];
+    const finish = ['relay', 'upgrade', '--finish-signing-maintenance', '--apply'];
+    assert.equal(commandExitCode(stage, { ...base, state: 'staged', upgradeComplete: false }), 0);
+    assert.equal(commandExitCode(finish, { ...base, state: 'staged', upgradeComplete: false }), 2);
+    assert.equal(commandExitCode(finish, { ...base, state: 'completed', upgradeComplete: true }), 0);
+    for (const state of ['staging_failed', 'finish_failed', 'staging_reverted']) {
+        assert.equal(commandExitCode(stage, { ...base, state, upgradeComplete: false }), 2);
+        assert.equal(commandExitCode(finish, { ...base, state, upgradeComplete: false }), 2);
+    }
+    assert.equal(commandExitCode(stage, { ...base, state: 'staged', upgradeComplete: false, ready: true }), 2);
+});
+test('startup is paused and independently verified before either launcher can change', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    const result = await upgradeRelayForSigningMaintenance(f.input, { ...f.deps,
+        stageStartup: async (v) => {
+            assert.equal(await readFile(join(f.input.workspace, '.dharma', 'bin', 'dharma'), 'utf8'), v === '0.2.207' ? f.old.shell : contents(f.input.version).shell);
+            await f.deps.stageStartup(v);
+        },
+        assertStartupPaused: async () => { f.calls.push('paused'); assert(!f.calls.includes('start')); } });
+    assert.equal(result.state, 'staged');
+    const firstPause = f.calls.indexOf('paused'), writeTarget = f.calls.indexOf('stage:0.2.211');
+    assert(firstPause >= 0 && firstPause < writeTarget);
+});
+test('unconfirmed pause cannot mutate launchers or open protected trust', async () => {
+    const { upgradeRelayForSigningMaintenance } = await import(modulePath);
+    const f = await fixture();
+    const result = await upgradeRelayForSigningMaintenance(f.input, { ...f.deps, assertStartupPaused: async () => { throw Error('pause not acknowledged'); } });
+    assert.equal(result.state, 'staging_failed');
+    assert.equal(await readFile(join(f.input.workspace, '.dharma', 'bin', 'dharma'), 'utf8'), f.old.shell);
+    assert(!f.calls.includes('start'));
+    assert(!f.calls.some(v => v.startsWith('trust:')));
+});
+//# sourceMappingURL=relaySigningMaintenanceUpgrade.test.js.map

package/dist/relaySigningMaintenanceUpgrade.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relaySigningMaintenanceUpgrade.test.js","sourceRoot":"","sources":["../src/relaySigningMaintenanceUpgrade.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,KAAK,EAAC,OAAO,EAAC,QAAQ,EAAC,QAAQ,EAAC,SAAS,EAAC,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAC,MAAM,EAAC,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,mBAAmB,EAAC,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAC,gBAAgB,EAAC,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAC,eAAe,EAAC,MAAM,YAAY,CAAC;AAE3C,MAAM,UAAU,GAAC,qCAAqC,CAAC;AACvD,MAAM,IAAI,GAAC,CAAC,KAAY,EAAC,EAAE,CAAA,SAAS,GAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,MAAM,QAAQ,GAAC,CAAC,OAAc,EAAC,EAAE,CAAA,CAAC,EAAC,KAAK,EAAC,yBAAyB,OAAO,IAAI,EAAC,OAAO,EAAC,6BAA6B,OAAO,MAAM,EAAC,CAAC,CAAC;AACnI,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,SAAS,GAAC,IAAI,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;IACzD,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC;IAAA,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAC,OAAO,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAC,EAAC,IAAI,EAAC,SAAS,EAAC,cAAc,EAAC,aAAa,EAAC,QAAQ,EAAC,sCAAsC;QACtG,WAAW,EAAC,sCAAsC,EAAC,OAAO,EAAC,SAAS,EAAC,eAAe,EAAC,CAAC,EAAC,CAAC;IAC1F,IAAI,OAAO,GAAC,SAAS,CAAC;IAAA,MAAM,KAAK,GAAU,EAAE,CAAC;IAAA,MAAM,GAAG,GAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1E,KAAI,MAAK,CAAC,IAAI,EAAC,KAAK,CAAC,IAAG,MAAM,CAAC,OAAO,CAAC,EAAC,MAAM,EAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,GAAG,CAAC,OAAO,EAAC,CAAC;QAAC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,IAAI,CAAC,EAAC,KAAK,CAAC,CAAC;IAChJ,MAAM,IAAI,GAAC,EAAC,aAAa,EAAC,KAAK,IAAE,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,EAAC,mBAAmB,EAAC,KAAK,IAAE,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAA,CAAC;QACtH,mBAAmB,EAAC,KAAK,IAAE,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC;QACpD,cAAc,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,OAAO,EAAC,SAAS,EAAC,CAAC,EAAC,gBAAgB,EAAC,KAAK,EAAC,IAAW,EAAC,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAC,IAAI,CAAC,CAAC,CAAA,OAAO,GAAC,IAAI,CAAC,CAAA,CAAC;QAChI,YAAY,EAAC,KAAK,EAAC,IAAW,EAAC,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAC,IAAI,CAAC,CAAC,CAAA,OAAO,GAAC,IAAI,CAAC,CAAA,CAAC;QAC1E,gBAAgB,EAAC,QAAQ,EAAC,oBAAoB,EAAC,KAAK,EAAC,CAAQ,EAAC,CAAY,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5H,uBAAuB,EAAC,KAAK,EAAC,CAAQ,EAAC,CAAY,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrG,KAAK,EAAC,KAAK,IAAE,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA,CAAC,EAAC,IAAI,EAAC,KAAK,IAAE,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA,CAAC;QACzE,MAAM,EAAC,KAAK,EAAC,CAAQ,EAAC,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAC,CAAC,CAAC,CAAC,CAAA,CAAC,EAAC,oBAAoB,EAAC,KAAK,EAAC,UAAiB,EAAC,EAAE,GAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAC,UAAU,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC;IACxI,OAAM,EAAC,KAAK,EAAC,IAAI,EAAC,KAAK,EAAC,GAAG,EAAC,cAAc,EAAC,GAAE,EAAE,CAAA,OAAO,EAAC,CAAC;AAC1D,CAAC;AAED,IAAI,CAAC,mGAAmG,EAAC,KAAK,IAAE,EAAE;IAChH,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,KAAK,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAC,KAAK,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,KAAK,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAC,eAAe,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAC,KAAK,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,EAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9J,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,sBAAsB,CAAC,CAAC,EAAC,QAAQ,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wFAAwF,EAAC,KAAK,IAAE,EAAE;IACrG,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAC,MAAM,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAC,SAAS,CAAC,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,EAAC,SAAS,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,kCAAkC,CAAC,CAAC,EAAC,QAAQ,CAAC,CAAC;IACvG,MAAM,KAAK,GAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,KAAK,GAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,kCAAkC,CAAC,EAAC,MAAM,CAAC,CAAC;IAAA,CAAC,CAAC,KAAK,CAAC,MAAM,GAAC,CAAC,CAAC;IAClH,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,kCAAkC,CAAC,EAAC,MAAM,CAAC,EAAC,KAAK,CAAC,CAAC;IACzG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,OAAO,IAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAC,KAAK,IAAE,EAAE;IACpF,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAC,MAAM,mBAAmB,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,OAAO,EAAC,SAAS,EAAC,EAAE,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;IACrI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,iBAAiB,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,EAAC,SAAS,CAAC,CAAC;IACxF,MAAM,IAAI,GAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,sBAAsB,CAAC,EAAC,KAAK,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;IAAA,CAAC,CAAC,KAAK,CAAC,MAAM,GAAC,CAAC,CAAC;IAChH,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,EAAC,gCAAgC,CAAC,CAAC;IACzG,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,qBAAqB,EAAC,IAAI,CAAC,KAAK,GAAC,UAAU,CAAC,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,EAAC,gCAAgC,CAAC,CAAC;IAC3J,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,KAAK,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAE,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,qBAAqB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,KAAK,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,MAAM,CAAC,mBAAmB,CAAC,EAAC,MAAM,CAAC,EAAC,KAAK,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAC,KAAK,IAAE,EAAE;IACvG,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnE,KAAI,MAAM,MAAM,IAAG,CAAC,UAAU,EAAC,SAAS,EAAC,OAAO,CAAC,EAAC,CAAC;QACjD,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;QAAA,MAAM,mBAAmB,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,OAAO,EAAC,SAAS,EAAC,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;QACxI,MAAM,IAAI,GAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,sBAAsB,CAAC,CAAC;QAAA,IAAI,KAAK,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;QACnG,IAAG,MAAM,KAAG,UAAU;YAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,CAAC,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;QACnH,IAAG,MAAM,KAAG,OAAO,EAAC,CAAC;YAAA,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAA,KAAK,CAAC,KAAK,GAAC,WAAW,CAAC;YAAA,KAAK,GAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAA,MAAM,SAAS,CAAC,IAAI,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,CAAC;QACjJ,CAAC,CAAC,KAAK,CAAC,MAAM,GAAC,CAAC,CAAC;QACjB,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,qBAAqB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAC,EACnG,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,GAAG,CAAC,MAAM,KAAG,SAAS,CAAA,CAAC,CAAA,EAAC,cAAc,EAAC,KAAK,IAAE,EAAE,CAAA,CAAC,EAAC,OAAO,EAAC,SAAS,EAAC,SAAS,EAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,oBAAoB,EAAC,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,EACpJ,mEAAmE,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,KAAK,CAAC,CAAC;QAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAE,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAC,KAAK,IAAE,EAAE;IAClG,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAAA,CAAC,CAAC,KAAK,CAAC,MAAM,GAAC,CAAC,CAAC;IACzE,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,oBAAoB,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,EAAC,qBAAqB,CAAC,CAAC;IACxL,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,WAAW,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAC,IAAI,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,KAAK,CAAC,CAAC;IAClH,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,sBAAsB,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAC,WAAW,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uGAAuG,EAAC,KAAK,IAAE,EAAE;IACpH,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAAA,CAAC,CAAC,KAAK,CAAC,MAAM,GAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,MAAM,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;IAC7I,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,eAAe,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAC,KAAK,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,OAAO,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,MAAM,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,EAAC,yBAAyB,CAAC,CAAC;IACnH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,OAAO,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAC,KAAK,IAAE,EAAE;IACnG,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnE,KAAI,MAAM,QAAQ,IAAG,CAAC,eAAe,EAAC,qBAAqB,CAAS,EAAC,CAAC;QAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;QAC5F,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,CAAC,QAAQ,CAAC,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,EAAC,eAAe,CAAC,CAAC;QACjJ,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,OAAO,IAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,CAAC,EAAC,MAAM,CAAC,EAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAC,KAAK,IAAE,EAAE;IACxH,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAAA,IAAI,MAAM,GAAC,KAAK,CAAC;IAC5G,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,YAAY,EAAC,KAAK,EAAC,CAAQ,EAAC,EAAE;YACpG,IAAG,CAAC,MAAM,EAAC,CAAC;gBAAA,MAAM,GAAC,IAAI,CAAC;gBAAA,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC,EAAC,CAAC,CAAC;IACvG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,kBAAkB,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAC,KAAK,CAAC,CAAC;IACzF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,EAAC,SAAS,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,CAAC,EAAC,MAAM,CAAC,EAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7I,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAC,KAAK,IAAE,EAAE;IACjG,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,UAAU,GAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,kCAAkC,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAC,mEAAmE,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC;IACtI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAC,2EAA2E,EAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC;IAC/I,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAC,mEAAmE,EAAC,EAAC,GAAG,MAAM,EAAC,eAAe,EAAC,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,EAAC,KAAK,CAAC,CAAC;IACjK,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAC,2EAA2E,EAAC,EAAC,GAAG,OAAO,EAAC,QAAQ,EAAC,qBAAqB,EAAC,CAAC,CAAC,CAAC,EAAE,EAAC,KAAK,CAAC,CAAC;IACpL,MAAM,SAAS,GAAC,MAAM,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAC,mEAAmE,EAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAC,IAAI,CAAC,CAAC;AAC3I,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAC,KAAK,IAAE,EAAE;IACjH,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnE,KAAI,MAAM,MAAM,IAAG,CAAC,SAAS,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAC,CAAC;QAClD,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;QAAA,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChF,IAAG,MAAM,KAAG,SAAS,EAAC,CAAC;YACrB,MAAM,IAAI,GAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,kCAAkC,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC,CAAC;YAC5H,IAAI,CAAC,QAAQ,GAAC,sCAAsC,CAAC;YAAA,MAAM,SAAS,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAC/G,CAAC;aAAK,IAAG,MAAM,KAAG,UAAU;YAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,CAAC,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;;YACpH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,sBAAsB,CAAC,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAC1F,CAAC,CAAC,KAAK,CAAC,MAAM,GAAC,CAAC,CAAC;QAAA,MAAM,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAC,GAAG,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,CAAC,CAAC,IAAI,CAAC,EAAC,6DAA6D,CAAC,CAAC;QACxK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,KAAG,OAAO,IAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAC,GAAE,EAAE;IACtF,MAAM,IAAI,GAAC,EAAC,MAAM,EAAC,6CAA6C,EAAC,KAAK,EAAC,KAAK,EAAC,4BAA4B,EAAC,KAAK,EAAC,CAAC;IACjH,MAAM,KAAK,GAAC,CAAC,OAAO,EAAC,SAAS,EAAC,6BAA6B,EAAC,SAAS,CAAC,CAAC;IACxE,MAAM,MAAM,GAAC,CAAC,OAAO,EAAC,SAAS,EAAC,8BAA8B,EAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAC,EAAC,GAAG,IAAI,EAAC,KAAK,EAAC,QAAQ,EAAC,eAAe,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAC,EAAC,GAAG,IAAI,EAAC,KAAK,EAAC,QAAQ,EAAC,eAAe,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAC,EAAC,GAAG,IAAI,EAAC,KAAK,EAAC,WAAW,EAAC,eAAe,EAAC,IAAI,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IACzF,KAAI,MAAM,KAAK,IAAG,CAAC,gBAAgB,EAAC,eAAe,EAAC,kBAAkB,CAAC,EAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAC,EAAC,GAAG,IAAI,EAAC,KAAK,EAAC,eAAe,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAC,EAAC,GAAG,IAAI,EAAC,KAAK,EAAC,eAAe,EAAC,KAAK,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAC,EAAC,GAAG,IAAI,EAAC,KAAK,EAAC,QAAQ,EAAC,eAAe,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,EAAC,CAAC,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAC,KAAK,IAAE,EAAE;IAC7F,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI;QACrE,YAAY,EAAC,KAAK,EAAC,CAAQ,EAAC,EAAE;YAAC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,CAAC,EAAC,MAAM,CAAC,EACjH,CAAC,KAAG,SAAS,CAAA,CAAC,CAAA,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,CAAC,CAAA,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;YAAA,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QAC3F,mBAAmB,EAAC,KAAK,IAAE,EAAE,GAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,UAAU,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAC,WAAW,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF,MAAM,CAAC,UAAU,IAAE,CAAC,IAAE,UAAU,GAAC,WAAW,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAC,KAAK,IAAE,EAAE;IAChF,MAAM,EAAC,iCAAiC,EAAC,GAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,MAAM,OAAO,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC,KAAK,EAAC,EAAC,GAAG,CAAC,CAAC,IAAI,EAAC,mBAAmB,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC,CAAC;IAChJ,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAC,gBAAgB,CAAC,CAAC;IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAC,SAAS,EAAC,KAAK,EAAC,QAAQ,CAAC,EAAC,MAAM,CAAC,EAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9I,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAAA,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC"}

package/dist/schemas/codex-signing-recovery-native-progress.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/codex-signing-recovery-native-progress/v1",
+  "title": "Original native-turn signing recovery progress, not customer readiness",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "operationId", "threadId", "turnId", "ready", "progress"],
+  "properties": {
+    "schema": {"const": "dharma.codex-signing-recovery-native-progress/v1"},
+    "operationId": {"type": "string", "format": "uuid"},
+    "threadId": {"type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$"},
+    "turnId": {"type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$"},
+    "ready": {"const": false},
+    "progress": {"anyOf": [{"type": "null"}, {"$ref": "https://schemas.dharma-ai.io/device-signing-recovery-host-progress/v1"}]}
+  }
+}

package/dist/schemas/device-enrollment-recovery-journal.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-enrollment-recovery-journal/v1",
+  "title": "Protected local write-ahead transaction, never task-supplied authority",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "acceptedAt", "challenge", "candidate", "previousAnchor", "previousCurrentHash", "previousLegacyHash", "previousConnectionMode", "nextConfigDigest"],
+  "properties": {
+    "schema": {"const": "dharma.device-enrollment-recovery-journal/v1"},
+    "acceptedAt": {"type": "string", "format": "date-time", "maxLength": 40},
+    "challenge": {"$ref": "https://schemas.dharma-ai.io/device-signing-recovery-challenge/v1"},
+    "candidate": {"$ref": "https://schemas.dharma-ai.io/device-signing-recovery-candidate/v1"},
+    "previousAnchor": {"type": "string", "minLength": 2, "maxLength": 65536},
+    "previousCurrentHash": {"anyOf": [{"type": "null"}, {"$ref": "#/$defs/digest"}]},
+    "previousLegacyHash": {"anyOf": [{"type": "null"}, {"$ref": "#/$defs/digest"}]},
+    "previousConnectionMode": {"enum": [null, "manual", "resume"]},
+    "nextConfigDigest": {"$ref": "#/$defs/digest"}
+  },
+  "$defs": {"digest": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"}}
+}

package/dist/schemas/device-signing-maintenance-challenge.schema.json

@@ -0,0 +1,185 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-maintenance-challenge/v1",
+  "title": "Existing-device signing maintenance challenge; no native continuation authority",
+  "$comment": "Distinct device-maintenance origin. Device possession, both fresh browser consents, current member/device/source, independent configured-key provenance, publication CAS and protected installation remain separate and mandatory. Native session liveness or execution is not asserted.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "origin",
+    "issuer",
+    "audience",
+    "recoveryId",
+    "approvalId",
+    "organizationId",
+    "recipientMembershipId",
+    "deviceId",
+    "installationId",
+    "workspaceId",
+    "publicKeyEd25519",
+    "credentialEncryptionPublicKey",
+    "repositoryFingerprint",
+    "policyRevision",
+    "scopeDigest",
+    "contractDigest",
+    "sourceSelectionDigest",
+    "controllerBindingDigest",
+    "previousAnchorHash",
+    "protectedConfigDigest",
+    "previousGeneration",
+    "previousKeysetHash",
+    "previousRootFingerprint",
+    "candidateGeneration",
+    "candidateKeysetHash",
+    "candidateRootFingerprint",
+    "candidateKeyVersionFingerprint",
+    "purpose",
+    "method",
+    "path",
+    "nonce",
+    "issuedAt",
+    "expiresAt",
+    "authenticator"
+  ],
+  "properties": {
+    "schema": {
+      "const": "dharma.device-signing-maintenance-challenge/v1"
+    },
+    "origin": {
+      "type": "string",
+      "maxLength": 256,
+      "format": "uri",
+      "pattern": "^https://[^/@?#\\s]+$"
+    },
+    "issuer": {
+      "type": "string",
+      "maxLength": 256,
+      "format": "uri",
+      "pattern": "^https://[^/@?#\\s]+$"
+    },
+    "audience": {
+      "const": "dharma.agent-fabric.signing-maintenance/v1"
+    },
+    "recoveryId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "approvalId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "organizationId": {
+      "type": "string",
+      "maxLength": 256,
+      "pattern": "^org_[A-Za-z0-9]+$"
+    },
+    "recipientMembershipId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "deviceId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "installationId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "workspaceId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "publicKeyEd25519": {
+      "$ref": "#/$defs/bytes32"
+    },
+    "credentialEncryptionPublicKey": {
+      "$ref": "#/$defs/bytes32"
+    },
+    "repositoryFingerprint": {
+      "$ref": "#/$defs/digest"
+    },
+    "policyRevision": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+    },
+    "scopeDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "contractDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "sourceSelectionDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "controllerBindingDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "previousAnchorHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "protectedConfigDigest": {
+      "$ref": "#/$defs/digest"
+    },
+    "previousGeneration": {
+      "$ref": "#/$defs/generation"
+    },
+    "previousKeysetHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "previousRootFingerprint": {
+      "$ref": "#/$defs/digest"
+    },
+    "candidateGeneration": {
+      "$ref": "#/$defs/generation"
+    },
+    "candidateKeysetHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "candidateRootFingerprint": {
+      "$ref": "#/$defs/digest"
+    },
+    "candidateKeyVersionFingerprint": {
+      "$ref": "#/$defs/digest"
+    },
+    "purpose": {
+      "const": "expired_signing_trust_reapproval"
+    },
+    "method": {
+      "const": "POST"
+    },
+    "path": {
+      "const": "/api/v1/agent-fabric/signing-recovery"
+    },
+    "nonce": {
+      "$ref": "#/$defs/bytes32"
+    },
+    "issuedAt": {
+      "type": "string",
+      "format": "date-time",
+      "maxLength": 256
+    },
+    "expiresAt": {
+      "type": "string",
+      "format": "date-time",
+      "maxLength": 256
+    },
+    "authenticator": {
+      "$ref": "#/$defs/bytes32"
+    }
+  },
+  "$defs": {
+    "uuid": {
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+    },
+    "bytes32": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "generation": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    }
+  }
+}

package/dist/schemas/device-signing-maintenance-completion.schema.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-signing-maintenance-completion/v1",
+  "title": "Device trust maintenance completion; not native continuation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "organizationId",
+    "deviceId",
+    "installationId",
+    "workspaceId",
+    "recoveryId",
+    "approvalId",
+    "generation",
+    "keysetHash",
+    "rootFingerprint",
+    "publicationArtifactHash",
+    "observedAt",
+    "connectionMode",
+    "ready",
+    "disposition",
+    "authorityKind",
+    "nativeContinuationAuthorized"
+  ],
+  "properties": {
+    "schema": {
+      "const": "dharma.device-signing-maintenance-completion/v1"
+    },
+    "organizationId": {
+      "type": "string",
+      "pattern": "^org_[A-Za-z0-9]+$(?![\\s\\S])",
+      "maxLength": 200
+    },
+    "deviceId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "installationId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "workspaceId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "recoveryId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "approvalId": {
+      "$ref": "#/$defs/uuid"
+    },
+    "generation": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
+    "keysetHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "rootFingerprint": {
+      "$ref": "#/$defs/digest"
+    },
+    "publicationArtifactHash": {
+      "$ref": "#/$defs/digest"
+    },
+    "observedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "connectionMode": {
+      "enum": [
+        "manual",
+        "resume"
+      ]
+    },
+    "ready": {
+      "const": false
+    },
+    "disposition": {
+      "const": "signing_trust_installed_not_onboarding_ready"
+    },
+    "authorityKind": {
+      "const": "device_trust_maintenance"
+    },
+    "nativeContinuationAuthorized": {
+      "const": false
+    }
+  },
+  "$defs": {
+    "uuid": {
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$(?![\\s\\S])"
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$(?![\\s\\S])"
+    }
+  }
+}