@dsh-enhanced/lark-channel 0.1.48 → 0.1.49

package/lib/business-skill.js

@@ -0,0 +1,202 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { lstat, mkdir, readFile, readdir, rename, unlink, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, parse, relative, resolve, sep, win32 } from 'node:path';
+import { parse as parseYaml, stringify } from 'yaml';
+import { LARK_BUSINESS_CLEARED_ENV } from './business-environment.js';
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const ownerPattern = /^ou_[A-Za-z0-9_-]{1,124}$/u;
+const appIdPattern = /^cli_[0-9a-fA-F]{16}$/u;
+const markerPrefix = '<!-- managed-by:@dsh-enhanced/lark-channel/business-skill:v1 ';
+function hasControlCharacter(value) {
+    return Array.from(value).some(char => {
+        const code = char.codePointAt(0) ?? 0;
+        return code < 32 || code === 127;
+    });
+}
+function requireIdentifier(value, field) {
+    if (typeof value !== 'string' || !identifierPattern.test(value)) {
+        throw new Error(`lark business skill: invalid ${field}`);
+    }
+    return value;
+}
+function requireBinding(input) {
+    const profile = requireIdentifier(input.profile, 'profile');
+    const account = requireIdentifier(input.account, 'account');
+    if (typeof input.ownerUserId !== 'string' || !ownerPattern.test(input.ownerUserId)) {
+        throw new Error('lark business skill: invalid ownerUserId');
+    }
+    if (typeof input.appId !== 'string' || !appIdPattern.test(input.appId)) {
+        throw new Error('lark business skill: invalid appId');
+    }
+    return { profile, account, appId: input.appId, ownerUserId: input.ownerUserId };
+}
+function requireAbsolutePath(value, field, platform) {
+    if (typeof value !== 'string' || hasControlCharacter(value)
+        || !(isAbsolute(value) || (platform === 'win32' && win32.isAbsolute(value)))) {
+        throw new Error(`lark business skill: ${field} must be an absolute path without control characters`);
+    }
+    return platform === 'win32' && win32.isAbsolute(value) && !isAbsolute(value)
+        ? win32.normalize(value) : resolve(value);
+}
+function validate(input) {
+    const platform = input.platform ?? process.platform;
+    const binding = requireBinding(input);
+    const cliProfile = requireIdentifier(input.cliProfile, 'cliProfile');
+    return {
+        dshHome: requireAbsolutePath(input.dshHome, 'dshHome', platform),
+        ...binding,
+        cliCommand: requireAbsolutePath(input.cliCommand, 'cliCommand', platform),
+        cliProfile,
+        cliConfigDir: requireAbsolutePath(input.cliConfigDir, 'cliConfigDir', platform),
+        cliDataDir: requireAbsolutePath(input.cliDataDir, 'cliDataDir', platform),
+        platform,
+    };
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function powershellQuote(value) {
+    return `'${value.replaceAll("'", "''")}'`;
+}
+function skillName(input) {
+    const hash = createHash('sha256').update(input.profile).update('\0').update(input.account).digest('hex').slice(0, 16);
+    return `lark-business-${hash}`;
+}
+export function renderLarkBusinessSkill(input) {
+    const checked = validate(input);
+    const name = skillName(checked);
+    const marker = `${markerPrefix}${name} -->`;
+    const cli = checked.platform === 'win32'
+        ? `${LARK_BUSINESS_CLEARED_ENV.map(name => `Remove-Item Env:${name} -ErrorAction SilentlyContinue;`).join(' ')} $env:LARKSUITE_CLI_CONFIG_DIR=${powershellQuote(checked.cliConfigDir)}; $env:LARKSUITE_CLI_DATA_DIR=${powershellQuote(checked.cliDataDir)}; $env:LARKSUITE_CLI_NO_UPDATE_NOTIFIER='1'; $env:LARKSUITE_CLI_NO_SKILLS_NOTIFIER='1'; & ${powershellQuote(checked.cliCommand)} --profile ${powershellQuote(checked.cliProfile)}`
+        : `env ${LARK_BUSINESS_CLEARED_ENV.map(name => `-u ${name}`).join(' ')} LARKSUITE_CLI_CONFIG_DIR=${shellQuote(checked.cliConfigDir)} LARKSUITE_CLI_DATA_DIR=${shellQuote(checked.cliDataDir)} LARKSUITE_CLI_NO_UPDATE_NOTIFIER=1 LARKSUITE_CLI_NO_SKILLS_NOTIFIER=1 ${shellQuote(checked.cliCommand)} --profile ${shellQuote(checked.cliProfile)}`;
+    const frontmatter = stringify({
+        name,
+        description: `Use the configured Lark CLI for owner-authorized documents, sheets, Base, calendar, tasks, mail, meetings, contacts, and approvals. Only for DSH profile ${checked.profile}, Lark account ${checked.account}, app ${checked.appId}, and owner ${checked.ownerUserId}; read current embedded official skills and schemas before acting.`,
+        metadata: { appId: checked.appId, ownerUserId: checked.ownerUserId,
+            profile: checked.profile, account: checked.account },
+    }).trimEnd();
+    const content = `---\n${frontmatter}\n---\n${marker}\n# Lark business operations\n\nThis skill belongs to DSH profile **${checked.profile}**, Lark account **${checked.account}**, application **${checked.appId}**, and owner open ID **${checked.ownerUserId}**. Use it only when the current DSH profile, channel account, application, and owner all match this binding. If any value differs, stop using this skill and rerun channel setup. These values identify this installation; they are not credentials. Never print tokens, secrets, or configuration contents.\n\nUse the native skill and shell tools for this task (${checked.platform === 'win32' ? 'PowerShell on Windows' : 'a POSIX shell on this platform'}). Do not start another Agent loop. Every CLI invocation must use the exact command prefix below, including its explicit profile and private configuration directory. Linux uses the private data directory for CLI token files; on macOS and Windows the CLI may use a system keychain shared by the OS account. Do not use an unbound CLI command or the machine's default CLI profile/configuration.\n\n    ${cli} skills list\n    ${cli} skills read lark-shared\n\nBefore each business operation, discover the current embedded official instructions with \`skills list\`, then \`skills read <relevant-skill>\`. Read its referenced files on demand with \`skills list <skill>/references\` and \`skills read <skill> <reference-path>\`. The embedded instructions and command schemas are the source of truth; do not rely on a copied catalogue. For example, a document task can start with:\n\n    ${cli} skills read lark-doc\n\nUse the operation's \`--help\` and \`schema <service.resource.method>\` when the exact arguments or risk level are unclear. Keep the same isolated prefix for these calls and for every subsequent business command. Select \`--as user\` for the owner's personal resources; use \`--as bot\` only for application/bot resources. The bot identity may not see the owner's resources.\n\nThe owner's current request authorizes the operations necessary to complete that task; do not ask again for an already authorized action. If a CLI command exits with code 10, add \`--yes\` only when the specific operation is already authorized by that request, then retry that command once. Otherwise request the missing authorization. Authentication, scope, and network failures are not approval gates: diagnose them, never turn them into a successful retry.\n\nKeep all subsequent examples and real invocations bound to this exact prefix, including explicit \`--profile\`. Do not disclose credentials in replies or logs.\n`;
+    return { name, content };
+}
+async function existingKind(path) {
+    try {
+        const stat = await lstat(path);
+        if (stat.isSymbolicLink())
+            return 'symlink';
+        if (stat.isDirectory())
+            return 'directory';
+        if (stat.isFile())
+            return 'file';
+        return 'other';
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return 'missing';
+        throw error;
+    }
+}
+async function ensureRealDirectory(path) {
+    const absolute = resolve(path);
+    const root = parse(absolute).root;
+    let current = root;
+    for (const segment of relative(root, absolute).split(sep).filter(Boolean)) {
+        current = join(current, segment);
+        const kind = await existingKind(current);
+        if (kind === 'missing')
+            await mkdir(current, { mode: 0o700 });
+        else if (kind !== 'directory')
+            throw new Error(`lark business skill: directory path is ${kind}: ${current}`);
+    }
+}
+async function hasExistingRealDirectory(path) {
+    const absolute = resolve(path);
+    const root = parse(absolute).root;
+    let current = root;
+    for (const segment of relative(root, absolute).split(sep).filter(Boolean)) {
+        current = join(current, segment);
+        const kind = await existingKind(current);
+        if (kind === 'missing')
+            return false;
+        if (kind !== 'directory')
+            throw new Error(`lark business skill: directory path is ${kind}: ${current}`);
+    }
+    return true;
+}
+function metadataBinding(content, name) {
+    const marker = `${markerPrefix}${name} -->`;
+    const separator = `\n---\n${marker}\n`;
+    const end = content.startsWith('---\n') ? content.indexOf(separator, 4) : -1;
+    if (end < 0)
+        throw new Error('lark business skill: existing SKILL.md is not managed by this installer');
+    try {
+        const document = parseYaml(content.slice(4, end));
+        if (typeof document !== 'object' || document === null || Array.isArray(document))
+            return undefined;
+        const metadata = document.metadata;
+        return typeof metadata === 'object' && metadata !== null && !Array.isArray(metadata)
+            ? metadata : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Remove a stale managed skill after owner/app rotation or explicit opt-out. */
+export async function reconcileLarkBusinessSkill(input) {
+    const binding = requireBinding(input);
+    if (typeof input.enabled !== 'boolean')
+        throw new Error('lark business skill: invalid enabled flag');
+    const dshHome = requireAbsolutePath(input.dshHome, 'dshHome', process.platform);
+    const previousAccount = input.previousAccount === undefined
+        ? undefined : requireIdentifier(input.previousAccount, 'previousAccount');
+    const reconcileName = async (name, removeRegardlessOfBinding) => {
+        const skillDir = join(dshHome, 'skills', name);
+        if (!await hasExistingRealDirectory(skillDir))
+            return;
+        const path = join(skillDir, 'SKILL.md');
+        const kind = await existingKind(path);
+        if (kind === 'missing')
+            return;
+        if (kind !== 'file')
+            throw new Error(`lark business skill: existing SKILL.md is ${kind}; refusing to replace it`);
+        const metadata = metadataBinding(await readFile(path, 'utf8'), name);
+        if (removeRegardlessOfBinding || !input.enabled || metadata?.appId !== binding.appId || metadata?.ownerUserId !== binding.ownerUserId
+            || metadata?.profile !== binding.profile || metadata?.account !== binding.account) {
+            await unlink(path);
+        }
+    };
+    if (previousAccount !== undefined && previousAccount !== binding.account) {
+        await reconcileName(skillName({ profile: binding.profile, account: previousAccount }), true);
+    }
+    await reconcileName(skillName(binding), false);
+}
+export async function installLarkBusinessSkill(input) {
+    const { name, content } = renderLarkBusinessSkill(input);
+    const dshHome = requireAbsolutePath(input.dshHome, 'dshHome', input.platform ?? process.platform);
+    const skillDir = join(dshHome, 'skills', name);
+    const path = join(skillDir, 'SKILL.md');
+    await ensureRealDirectory(skillDir);
+    const kind = await existingKind(path);
+    if (kind !== 'missing' && kind !== 'file') {
+        throw new Error(`lark business skill: existing SKILL.md is ${kind}; refusing to replace it`);
+    }
+    if (kind === 'file') {
+        const previous = await readFile(path, 'utf8');
+        metadataBinding(previous, name);
+        if (previous === content)
+            return { path, name };
+    }
+    else if ((await readdir(skillDir)).length !== 0) {
+        throw new Error('lark business skill: existing skill directory is not managed by this installer');
+    }
+    const temporary = join(skillDir, `.SKILL.md.${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, content, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+        await rename(temporary, path);
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => undefined);
+        throw error;
+    }
+    return { path, name };
+}
+//# sourceMappingURL=business-skill.js.map

package/lib/business-skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"business-skill.js","sourceRoot":"","sources":["../src/business-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7F,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAClF,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AAyBrE,MAAM,iBAAiB,GAAG,oCAAoC,CAAA;AAC9D,MAAM,YAAY,GAAG,4BAA4B,CAAA;AACjD,MAAM,YAAY,GAAG,wBAAwB,CAAA;AAC7C,MAAM,YAAY,GAAG,+DAA+D,CAAA;AAEpF,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACrC,OAAO,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAoF;IAG1G,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IAC3D,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAA;AACjF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,KAAa,EAAE,QAAyB;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,KAAK,CAAC;WACtD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,sDAAsD,CAAC,CAAA;IACtG,CAAC;IACD,OAAO,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,KAA6B;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACnD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACpE,OAAO;QACL,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;QAChE,GAAG,OAAO;QACV,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;QACzE,UAAU;QACV,YAAY,EAAE,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC;QAC/E,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC;QACzE,QAAQ;KACT,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAA;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAA0D;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACrH,OAAO,iBAAiB,IAAI,EAAE,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,IAAI,MAAM,CAAA;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACtC,CAAC,CAAC,GAAG,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,IAAI,iCAAiC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,iCAAiC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,6FAA6F,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC5a,CAAC,CAAC,OAAO,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,2BAA2B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,0EAA0E,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAA;IACpV,MAAM,WAAW,GAAG,SAAS,CAAC;QAC5B,IAAI;QACJ,WAAW,EAAE,4JAA4J,OAAO,CAAC,OAAO,kBAAkB,OAAO,CAAC,OAAO,SAAS,OAAO,CAAC,KAAK,eAAe,OAAO,CAAC,WAAW,oEAAoE;QACrV,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;YAChE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;KACvD,CAAC,CAAC,OAAO,EAAE,CAAA;IACZ,MAAM,OAAO,GAAG,QAAQ,WAAW,UAAU,MAAM,uEAAuE,OAAO,CAAC,OAAO,sBAAsB,OAAO,CAAC,OAAO,qBAAqB,OAAO,CAAC,KAAK,2BAA2B,OAAO,CAAC,WAAW,wWAAwW,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gCAAgC,kZAAkZ,GAAG,qBAAqB,GAAG,wcAAwc,GAAG,qgCAAqgC,CAAA;IAC5jF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,SAAS,CAAA;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,WAAW,CAAA;QAC1C,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,MAAM,CAAA;QAChC,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACxE,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;IACjC,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;aACxD,IAAI,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;IAC9G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAA;IACjC,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1E,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACpC,IAAI,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,KAAK,OAAO,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,IAAI,MAAM,CAAA;IAC3C,MAAM,SAAS,GAAG,UAAU,MAAM,IAAI,CAAA;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5E,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;IACvG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAY,CAAA;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;QAClG,MAAM,QAAQ,GAAI,QAAoC,CAAC,QAAQ,CAAA;QAC/D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAClF,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAA;IAAC,CAAC;AAC9B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAsC;IACrF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACrC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IACpG,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/E,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,SAAS;QACzD,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;IAC3E,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAAE,yBAAkC,EAAiB,EAAE;QAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,wBAAwB,CAAC,QAAQ,CAAC;YAAE,OAAM;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACvC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAM;QAC9B,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,0BAA0B,CAAC,CAAA;QACjH,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QACpE,IAAI,yBAAyB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW;eAChI,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACpF,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;IACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QACzE,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9F,CAAC;IACD,MAAM,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAA6B;IAC1E,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACvC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,0BAA0B,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7C,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC/B,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjD,CAAC;SAAM,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,UAAU,EAAE,MAAM,CAAC,CAAA;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAClF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACvB,CAAC"}

package/lib/rsi-authority-config.d.ts

@@ -0,0 +1,29 @@
+import { type PluginControlTrustConfig, type SourceReleaseAuthorityConfig, type SystemdHostAuthorityConfig } from '@dsh-enhanced/plugin-control-plane';
+import { type RsiAuthorityResources } from './rsi-authority-resources.js';
+import type { Pin, RsiAuthorityRuntime } from './rsi-authority-runtime.js';
+import type { RsiSetupManifest } from './rsi-profile.js';
+import type { RsiReleaseBuildConfig } from './rsi-release-build.js';
+import type { RsiSourceWorkspace } from './rsi-source.js';
+export interface RsiAuthorityConfigInput {
+    manifest: RsiSetupManifest;
+    resources: RsiAuthorityResources;
+    runtime: RsiAuthorityRuntime;
+    source: RsiSourceWorkspace;
+    releaseBuild: RsiReleaseBuildConfig;
+    executor: PluginControlTrustConfig['executor'];
+    systemctl: Pin & {
+        interpreter: Pin | null;
+    };
+    unitProperties: SystemdHostAuthorityConfig['template']['unitProperties'];
+    policies: SourceReleaseAuthorityConfig['grant']['policies'];
+    now: number;
+}
+/** Compile immutable configuration bytes. The caller creates private directories,
+ * writes files atomically, opens the Control Plane ledger, and runs the real
+ * filesystem and executable validators before any service is enabled. */
+export declare function compileRsiAuthorityConfigs(input: RsiAuthorityConfigInput): {
+    files: Record<string, string>;
+    directories: string[];
+    trust: PluginControlTrustConfig;
+};
+//# sourceMappingURL=rsi-authority-config.d.ts.map

package/lib/rsi-authority-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-config.d.ts","sourceRoot":"","sources":["../src/rsi-authority-config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuE,KAAK,wBAAwB,EACjC,KAAK,4BAA4B,EAChF,KAAK,0BAA0B,EAAuC,MAAM,oCAAoC,CAAA;AAE3I,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAC5F,OAAO,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AA+BzD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,YAAY,EAAE,qBAAqB,CAAA;IACnC,QAAQ,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC9C,SAAS,EAAE,GAAG,GAAG;QAAE,WAAW,EAAE,GAAG,GAAG,IAAI,CAAA;KAAE,CAAA;IAC5C,cAAc,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC,gBAAgB,CAAC,CAAA;IACxE,QAAQ,EAAE,4BAA4B,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAA;IAC3D,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;yEAEyE;AACzE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,uBAAuB,GAAG;IAC1E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAA;CACtF,CAgLA"}

package/lib/rsi-authority-config.js

@@ -0,0 +1,233 @@
+import { createHash, createPublicKey } from 'node:crypto';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { defaultHostAttestationPolicy } from '@dsh-enhanced/plugin-control-plane';
+import { rsiAuthorityRoles } from './rsi-authority-resources.js';
+const phases = ['pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+const digest = (source) => createHash('sha256').update(source).digest('hex');
+const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+function fail(message) { throw new Error(`rsi authority config: ${message}`); }
+function path(value, label) {
+    if (typeof value !== 'string' || !isAbsolute(value) || value === '/' || resolve(value) !== value
+        || value.includes('\0') || /[\r\n]/u.test(value))
+        fail(`${label} must be a canonical absolute path`);
+    return value;
+}
+function within(root, value, label) {
+    path(root, 'config root');
+    path(value, label);
+    const child = relative(root, value);
+    if (!child || child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child))
+        fail(`${label} must be inside the authority config root`);
+    return value;
+}
+function finite(value, now, label) {
+    if (!Number.isSafeInteger(value) || value <= now)
+        fail(`${label} has expired`);
+    return value;
+}
+function positive(value, max, label) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > max)
+        fail(`${label} is outside its finite limit`);
+    return value;
+}
+function checkedPin(value, label) {
+    path(value.path, label);
+    if (!/^[a-f0-9]{64}$/u.test(value.sha256))
+        fail(`${label} digest is invalid`);
+    return value;
+}
+/** Compile immutable configuration bytes. The caller creates private directories,
+ * writes files atomically, opens the Control Plane ledger, and runs the real
+ * filesystem and executable validators before any service is enabled. */
+export function compileRsiAuthorityConfigs(input) {
+    const { manifest, resources, runtime, source, releaseBuild, executor, now } = input;
+    const cp = manifest.controlPlane, reviews = manifest.sourceReviews, env = manifest.serviceEnvironment?.target;
+    const jobs = cp.sourceJobs, approvals = cp.sourceApprovals, releases = cp.sourceReleases;
+    const adoption = cp.sourceAdoptions, observations = cp.taskObservations, qualification = cp.liveQualification;
+    if (manifest.schemaVersion !== 1 || resources.schemaVersion !== 1 || runtime.schemaVersion !== 1 || source.schemaVersion !== 1
+        || !Number.isSafeInteger(now) || now < 1 || !jobs || !approvals || !releases || !adoption || !observations || !qualification
+        || !cp.runtimeObserver || !cp.foregroundDeployments || !cp.sourceReleaseExecution || !env
+        || !adoption.liveQualification || !adoption.handoff || !adoption.hostDeploymentInputs)
+        fail('complete bounded-live deployment input is required');
+    const home = path(dirname(dirname(resources.root)), 'DSH_HOME');
+    if (resources.root !== join(home, 'rsi-authorities', manifest.targetProfile)
+        || resources.configRoot !== join(resources.root, 'config') || resources.stateRoot !== join(resources.root, 'state')
+        || runtime.root !== join(home, 'rsi-authority-runtimes', manifest.targetProfile)
+        || cp.runtimeObserver.profilePath !== join(home, 'profiles', manifest.targetProfile)
+        || adoption.profile !== manifest.targetProfile || observations.profilePath !== cp.runtimeObserver.profilePath
+        || qualification.profilePath !== cp.runtimeObserver.profilePath
+        || cp.catalogPath !== resources.catalog.path || jobs.repository !== source.repository
+        || source.baseline.targetBranch !== 'repairs' || !isDeepStrictEqual(jobs.baseline, source.baseline)
+        || reviews.repository !== source.baseline.remote || cp.sourceReleaseExecution.reviewDecisionRoot !== reviews.decisionRoot
+        || cp.sourceReleaseExecution.independentReview !== true || cp.sourceBuild?.versioning !== 'patch'
+        || reviews.owner.authorityId !== jobs.ownerRouteId || reviews.owner.principalId !== jobs.principalId
+        || reviews.owner.workspace !== jobs.workspace || reviews.owner.agentPreset !== jobs.preset
+        || !isDeepStrictEqual(reviews.plugins, input.policies.map(policy => policy.candidateId))
+        || adoption.liveQualification.authority !== resources.identities.qualification.authority
+        || adoption.liveQualification.keyId !== resources.identities.qualification.keyId
+        || manifest.serviceEnvironment?.coordinator?.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG !== env.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG)
+        fail('source, profile, owner, or policy binding differs');
+    for (const [name, client] of [['approval', approvals], ['release', releases], ['adoption', adoption.authority],
+        ['observation', observations.authority], ['qualification', qualification.authority]]) {
+        if (!isDeepStrictEqual(client.executable, runtime.executables[name])
+            || !isDeepStrictEqual(client.interpreter, runtime.node))
+            fail(`${name} client differs from prepared authority runtime`);
+    }
+    const ledgerPath = join(path(cp.statePath, 'Control Plane state'), 'control.sqlite');
+    const worktreeRoot = join(cp.statePath, 'source-worktrees');
+    const root = path(resources.configRoot, 'authority config root');
+    const trustPath = within(root, cp.trustPath, 'trust path');
+    const resolverPath = join(root, 'host-authority.json');
+    const hostWrapperPath = within(root, env.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG, 'Host wrapper path');
+    const approvalPath = within(root, approvals.configPath, 'approval config path');
+    const releasePath = within(root, releases.configPath, 'release config path');
+    const adoptionPath = within(root, adoption.authority.configPath, 'adoption config path');
+    const observationPath = within(root, observations.authority.configPath, 'observation config path');
+    const qualificationPath = within(root, qualification.authority.configPath, 'qualification config path');
+    const expiry = Math.min(finite(jobs.expiresAt, now, 'source jobs'), finite(reviews.expiresAt, now, 'source reviews'), finite(observations.policy.expiresAt, now, 'task observation policy'));
+    positive(jobs.maxSubmissions, 10_000, 'source submissions');
+    positive(reviews.maxReviews, 10_000, 'source reviews');
+    positive(observations.policy.maximumObservations, 1_000, 'task observations');
+    if (input.policies.length < 1 || input.policies.length > 32 || new Set(input.policies.map(policy => policy.candidateId)).size !== input.policies.length
+        || new Set(reviews.plugins).size !== reviews.plugins.length)
+        fail('source policies must be distinct and finite');
+    for (const policy of input.policies) {
+        if (policy.targetBranch !== source.baseline.targetBranch || policy.dshBaseline !== executor.version
+            || policy.packageName !== `@dsh-enhanced/${policy.candidateId}` || policy.packagePath !== `plugins/${policy.candidateId}`
+            || policy.registryId !== resources.registry.id || policy.registryLocator !== resources.registry.locator
+            || policy.catalogId !== resources.catalog.id || policy.catalogPath !== resources.catalog.path
+            || policy.minimumReproducibleBuilds < 2)
+            fail(`release policy differs from deployment: ${policy.candidateId}`);
+    }
+    const role = (name) => resources.identities[name];
+    const key = (name) => {
+        const identity = role(name);
+        if (identity.keyPath !== join(resources.root, 'identities', `${name}.pem`)
+            || identity.authority !== `${name}-${resources.installationId}` || identity.keyId !== `${identity.authority}-key`)
+            fail(`identity differs: ${name}`);
+        try {
+            if (createPublicKey(identity.publicKeyPem).asymmetricKeyType !== 'ed25519')
+                fail(`identity is not Ed25519: ${name}`);
+        }
+        catch {
+            fail(`identity is invalid: ${name}`);
+        }
+        return { authority: identity.authority, keyId: identity.keyId, publicKeyPem: identity.publicKeyPem };
+    };
+    if (new Set(rsiAuthorityRoles.map(name => role(name).publicKeyPem)).size !== rsiAuthorityRoles.length)
+        fail('authority keys must be independent');
+    const files = {};
+    const directories = new Set([root, join(root, 'public-keys'), resources.stateRoot, cp.statePath, worktreeRoot,
+        reviews.decisionRoot, join(resources.stateRoot, 'reviews'), join(resources.stateRoot, 'release'),
+        join(resources.stateRoot, 'host-attestor'), join(resources.stateRoot, 'registry-download')]);
+    const add = (filename, value) => {
+        if (Object.hasOwn(files, filename))
+            fail(`config paths collide: ${filename}`);
+        files[filename] = json(value);
+        directories.add(dirname(filename));
+    };
+    const publicPath = (name) => join(root, 'public-keys', `${name}.pem`);
+    for (const name of rsiAuthorityRoles) {
+        const filename = publicPath(name);
+        if (Object.hasOwn(files, filename))
+            fail(`public key paths collide: ${name}`);
+        files[filename] = role(name).publicKeyPem;
+    }
+    const identity = (name) => ({ authority: role(name).authority, keyId: role(name).keyId,
+        publicKeyPath: publicPath(name) });
+    const base = (name) => ({ schemaVersion: 1, authority: role(name).authority,
+        keyId: role(name).keyId, keyPath: role(name).keyPath, statePath: join(resources.stateRoot, `${name}.json`), controlDatabasePath: ledgerPath });
+    const common = { repository: source.repository, worktreeRoot, owner: reviews.owner, plugins: [...reviews.plugins],
+        maxChangedFiles: positive(reviews.maxChangedFiles, 256, 'changed files'),
+        maxChangedBytes: positive(reviews.maxInputBytes, 16 * 1024 * 1024, 'changed bytes'), receiptTtlMs: 60_000 };
+    const approvalConfig = { ...base('approval'), grant: { id: `approval-${resources.installationId}`,
+            expiresAt: expiry, maxApprovals: Math.min(jobs.maxSubmissions, reviews.maxReviews), ...common, versioning: 'patch' } };
+    const releaseConfig = { ...base('release'), grant: { id: `release-${resources.installationId}`,
+            expiresAt: expiry, maxReleases: Math.min(jobs.maxSubmissions, reviews.maxReviews), ...common, versioning: 'patch', policies: input.policies } };
+    const ledger = { id: resources.ledgerId, path: ledgerPath };
+    const profilePath = join(home, 'profiles', manifest.targetProfile);
+    const packages = reviews.plugins.map(name => `@dsh-enhanced/${name}`);
+    const adoptionPolicies = input.policies.map(({ candidateId, packageName, dshBaseline, capabilities, authorities, requires, registryId, registryLocator }) => ({ candidateId, packageName, dshBaseline, capabilities, authorities, requires, registryId, registryLocator }));
+    const adoptionConfig = { ...base('adoption'), grant: { id: `adoption-${resources.installationId}`,
+            expiresAt: expiry, maxAdoptions: Math.min(jobs.maxSubmissions, reviews.maxReviews), owner: reviews.owner,
+            installationId: resources.installationId, ledger, target: { dshHome: home, profile: manifest.targetProfile, profilePath },
+            executor: { id: executor.id, version: executor.version, path: executor.path, sha256: executor.sha256 },
+            catalogPath: resources.catalog.path, receiptTtlMs: 60_000, handoff: adoption.handoff,
+            liveQualification: adoption.liveQualification, hostDeploymentInputs: adoption.hostDeploymentInputs, policies: adoptionPolicies } };
+    const observationConfig = { ...base('observation'), grant: { policy: observations.policy,
+            owner: reviews.owner, installationId: resources.installationId, ledger, profilePath, packages, receiptTtlMs: 60_000 } };
+    const qualificationConfig = { ...base('qualification'), grant: { id: `qualification-${resources.installationId}`,
+            expiresAt: expiry, maxQualifications: Math.min(jobs.maxSubmissions, observations.policy.maximumObservations, 1_000),
+            owner: reviews.owner, installationId: resources.installationId, ledger, profilePath, packages,
+            terms: adoption.liveQualification, receiptTtlMs: 60_000 } };
+    add(approvalPath, approvalConfig);
+    add(releasePath, releaseConfig);
+    add(adoptionPath, adoptionConfig);
+    add(observationPath, observationConfig);
+    add(qualificationPath, qualificationConfig);
+    const releaseAdapters = {};
+    for (const phase of phases) {
+        const envName = `DSH_RELEASE_${phase.toUpperCase().replaceAll('-', '_')}_CONFIG`;
+        const configPath = within(root, env[envName], `${phase} adapter path`);
+        const executable = checkedPin(runtime.releaseAdapters[phase], `${phase} adapter`);
+        const stateRoot = join(resources.stateRoot, 'release', phase);
+        directories.add(stateRoot);
+        const adapter = { schemaVersion: 1, id: `release-${phase}-${resources.installationId}`, phase,
+            executablePath: executable.path, authority: role(phase).authority, keyId: role(phase).keyId,
+            privateKeyPath: role(phase).keyPath, authorizationAuthority: identity('release'), stateRoot,
+            git: { executable: checkedPin(reviews.git, 'review Git'), remote: source.baseline.remote,
+                targetBranch: source.baseline.targetBranch, authorName: 'DSH self iteration',
+                authorEmail: `agent-${resources.installationId}@dsh.invalid`, reviewStore: join(resources.stateRoot, 'reviews'),
+                reviewDecisionRoot: reviews.decisionRoot, reviewAuthority: identity('review') },
+            build: releaseBuild,
+            registry: { ...resources.registry, downloadRoot: join(resources.stateRoot, 'registry-download'), signer: identity('sign') },
+            catalog: { ...resources.catalog, helper: checkedPin(runtime.catalogValidator, 'catalog validator'),
+                interpreter: checkedPin(runtime.node, 'catalog Node') },
+            ...(phase === 'catalog-admission' ? { registryVerifier: identity('registry-verify') } : {}) };
+        add(configPath, adapter);
+        releaseAdapters[phase] = { id: adapter.id, version: 'dsh-local-release-adapter-1', ...executable,
+            interpreter: checkedPin(runtime.node, 'adapter Node'), authority: role(phase).authority, keyId: role(phase).keyId,
+            timeoutMs: 300_000, environmentAllowlist: [envName] };
+    }
+    const hostTemplate = {
+        authority: role('host').authority, keyId: role('host').keyId, privateKeyPath: role('host').keyPath,
+        stateRoot: join(resources.stateRoot, 'host-attestor'), executable: checkedPin(runtime.executables.hostAttestor, 'Host attestor'),
+        interpreter: checkedPin(runtime.node, 'Host Node'), processHelper: checkedPin(runtime.processHelper, 'process helper'),
+        systemctl: { ...checkedPin(input.systemctl, 'systemctl'), interpreter: input.systemctl.interpreter === null ? null
+                : checkedPin(input.systemctl.interpreter, 'systemctl interpreter') }, scope: 'user',
+        unit: `dsh-profile-${manifest.targetProfile}.service`, unitProperties: input.unitProperties,
+        timeoutMs: 20_000, stableWindowMs: 1_000, pollIntervalMs: 100,
+        readiness: { client: checkedPin(runtime.observerClient, 'observer client'), observer: cp.runtimeObserver },
+        recoveryReadiness: { client: checkedPin(runtime.observerClient, 'recovery observer client'), observer: cp.runtimeObserver },
+    };
+    const hostConfig = { schemaVersion: 1, statePath: join(resources.stateRoot, 'host-authority.json'),
+        controlDatabasePath: ledgerPath, trustPath, grant: { id: `host-${resources.installationId}`, notBefore: now,
+            expiresAt: expiry, maximumReloads: Math.min(jobs.maxSubmissions, 1_000), owner: reviews.owner,
+            profile: { name: manifest.targetProfile, path: profilePath }, packages,
+            coordinatorId: adoption.handoff.coordinatorId, hostDeploymentInputs: adoption.hostDeploymentInputs,
+            liveQualification: adoption.liveQualification }, template: hostTemplate };
+    const resolverSource = json(hostConfig);
+    add(resolverPath, hostConfig);
+    add(hostWrapperPath, { schemaVersion: 4, template: hostTemplate,
+        resolver: { executable: checkedPin(runtime.executables.hostAuthority, 'Host resolver'),
+            interpreter: checkedPin(runtime.node, 'resolver Node'), configPath: resolverPath,
+            configSha256: digest(resolverSource), timeoutMs: 10_000 } });
+    const trust = { schemaVersion: 4, installationId: resources.installationId, dshHome: home, ledger,
+        executor, hostPolicy: defaultHostAttestationPolicy,
+        hostAttestor: { id: `host-attestor-${resources.installationId}`, version: 'dsh-systemd-host-attestor-8',
+            ...checkedPin(runtime.executables.hostAttestor, 'Host attestor'), interpreter: checkedPin(runtime.node, 'Host Node'),
+            environmentAllowlist: ['DSH_SYSTEMD_HOST_ATTESTOR_CONFIG'], authority: role('host').authority, keyId: role('host').keyId,
+            timeoutMs: 60_000 }, catalog: resources.catalog,
+        releaseRegistry: { id: resources.registry.id, locator: resources.registry.locator, protocol: 'dsh', caPins: [], tokenEnvironment: null },
+        releaseReceiptTtlMs: 60_000, releaseAdapters,
+        approvalKeys: [key('approval'), key('adoption')], hostAttestationKeys: [key('host'), key('observation'), key('qualification')],
+        releaseKeys: phases.map(name => key(name)), releaseAuthorizationKeys: [key('release')] };
+    // Local file registries carry no CA or token fields on disk. The trust
+    // loader normalizes both to []/null after applying the schema-4 contract.
+    add(trustPath, { ...trust, releaseRegistry: { id: resources.registry.id, locator: resources.registry.locator, protocol: 'dsh' } });
+    if (new Set(Object.keys(files)).size !== rsiAuthorityRoles.length + 5 + phases.length + 2 + 1)
+        fail('generated config path collision');
+    return { files, directories: [...directories].sort(), trust };
+}
+//# sourceMappingURL=rsi-authority-config.js.map

package/lib/rsi-authority-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-config.js","sourceRoot":"","sources":["../src/rsi-authority-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAE4D,MAAM,oCAAoC,CAAA;AAE3I,OAAO,EAAE,iBAAiB,EAA8B,MAAM,8BAA8B,CAAA;AAM5F,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAkD,CAAA;AAC7J,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC5F,MAAM,IAAI,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;AAC9E,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC7F,SAAS,IAAI,CAAC,KAAa,EAAE,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;WAC3F,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAA;IACtG,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAA;IAC5I,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,MAAM,CAAC,KAAa,EAAE,GAAW,EAAE,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG;QAAE,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAA;IAC9E,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW,EAAE,KAAa;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;QAAE,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAA;IAC1G,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,UAAU,CAAC,KAAU,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAA;IAC7E,OAAO,KAAK,CAAA;AACd,CAAC;AAeD;;yEAEyE;AACzE,MAAM,UAAU,0BAA0B,CAAC,KAA8B;IAGvE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;IACnF,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,GAAG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IAC7G,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,EAAE,CAAC,eAAe,EAAE,QAAQ,GAAG,EAAE,CAAC,cAAc,CAAA;IACxF,MAAM,QAAQ,GAAG,EAAE,CAAC,eAAe,EAAE,YAAY,GAAG,EAAE,CAAC,gBAAgB,EAAE,aAAa,GAAG,EAAE,CAAC,iBAAiB,CAAA;IAC7G,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,SAAS,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;WACzH,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa;WACzH,CAAC,EAAE,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC,qBAAqB,IAAI,CAAC,EAAE,CAAC,sBAAsB,IAAI,CAAC,GAAG;WACtF,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACnJ,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC;WACvE,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;WAChH,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,wBAAwB,EAAE,QAAQ,CAAC,aAAa,CAAC;WAC7E,EAAE,CAAC,eAAe,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC;WACjF,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,aAAa,IAAI,YAAY,CAAC,WAAW,KAAK,EAAE,CAAC,eAAe,CAAC,WAAW;WAC1G,aAAa,CAAC,WAAW,KAAK,EAAE,CAAC,eAAe,CAAC,WAAW;WAC5D,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;WAClF,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;WAChG,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,kBAAkB,KAAK,OAAO,CAAC,YAAY;WACtH,EAAE,CAAC,sBAAsB,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,KAAK,OAAO;WAC9F,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;WACjG,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM;WACvF,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;WACrF,QAAQ,CAAC,iBAAiB,CAAC,SAAS,KAAK,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS;WACrF,QAAQ,CAAC,iBAAiB,CAAC,KAAK,KAAK,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK;WAC7E,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,gCAAgC,KAAK,GAAG,CAAC,gCAAgC;QAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;IACnL,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5G,CAAC,aAAa,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,CAAU,EAAE,CAAC;QAChG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;eAC/D,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,IAAI,iDAAiD,CAAC,CAAA;IAC3H,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpF,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;IACtD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,gCAAiC,EAAE,mBAAmB,CAAC,CAAA;IAChG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAA;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAA;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAA;IACxF,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAA;IAClG,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAA;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAClH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACxE,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC3D,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACtD,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;WAClJ,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IAClH,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO;eAC9F,MAAM,CAAC,WAAW,KAAK,iBAAiB,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,MAAM,CAAC,WAAW,EAAE;eACtH,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,QAAQ,CAAC,OAAO;eACpG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI;eAC1F,MAAM,CAAC,yBAAyB,GAAG,CAAC;YAAE,IAAI,CAAC,2CAA2C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAClH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,CAAC,IAAsC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC;eACrE,QAAQ,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,GAAG,QAAQ,CAAC,SAAS,MAAM;YAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;QACtJ,IAAI,CAAC;YAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,iBAAiB,KAAK,SAAS;gBAAE,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAC5H,MAAM,CAAC;YAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAC9C,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAA;IACtG,CAAC,CAAA;IACD,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACjJ,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,YAAY;QACnH,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;QAChG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;IAC9F,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,KAAc,EAAE,EAAE;QAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;QAC7E,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpC,CAAC,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACvG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QAC7E,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAA;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK;QACtH,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS;QACpH,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAA;IAChJ,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/G,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,eAAe,CAAC;QACxE,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,eAAe,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAA;IAC7G,MAAM,cAAc,GAAkC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,SAAS,CAAC,cAAc,EAAE;YAC9H,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAA;IACxH,MAAM,aAAa,GAAiC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,SAAS,CAAC,cAAc,EAAE;YAC1H,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACjJ,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE,CAC1J,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IAChH,MAAM,cAAc,GAAkC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,SAAS,CAAC,cAAc,EAAE;YAC9H,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YACxG,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE;YACzH,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACtG,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;YACpF,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAA;IACpI,MAAM,iBAAiB,GAAmC,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM;YACtH,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAA;IACzH,MAAM,mBAAmB,GAAqC,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,iBAAiB,SAAS,CAAC,cAAc,EAAE;YAChJ,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC;YACnH,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ;YAC7F,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAA;IAC7D,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACrG,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IAEpF,MAAM,eAAe,GAAG,EAA8D,CAAA;IACtF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAA;QAChF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAE,EAAE,GAAG,KAAK,eAAe,CAAC,CAAA;QACvE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7D,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,KAAK,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK;YAC3F,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK;YAC3F,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;YAC3F,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACtF,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,oBAAoB;gBAC5E,WAAW,EAAE,SAAS,SAAS,CAAC,cAAc,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;gBAC/G,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACjF,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YAC3H,OAAO,EAAE,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAChG,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;YACzD,GAAG,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC/F,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxB,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,UAAU;YAC9F,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK;YACjH,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;IACzD,CAAC;IAED,MAAM,YAAY,GAA2C;QAC3D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO;QAClG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC;QAChI,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC;QACtH,SAAS,EAAE,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;gBAChH,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM;QACrF,IAAI,EAAE,eAAe,QAAQ,CAAC,aAAa,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QAC3F,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG;QAC7D,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,eAAe,EAAE;QAC1G,iBAAiB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,eAAe,EAAE;KAC5H,CAAA;IACD,MAAM,UAAU,GAA+B,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC5H,mBAAmB,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,GAAG;YACzG,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YAC7F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ;YACtE,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YAClG,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;IACvC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC7B,GAAG,CAAC,eAAe,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY;QAC7D,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,eAAe,CAAC;YACpF,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,YAAY;YAChF,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAEhE,MAAM,KAAK,GAA6B,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM;QACzH,QAAQ,EAAE,UAAU,EAAE,4BAA4B;QAClD,YAAY,EAAE,EAAE,EAAE,EAAE,iBAAiB,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,6BAA6B;YACrG,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;YACpH,oBAAoB,EAAE,CAAC,kCAAkC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK;YACxH,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO;QACjD,eAAe,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACxI,mBAAmB,EAAE,MAAM,EAAE,eAAe;QAC5C,YAAY,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9H,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAA;IAC1F,uEAAuE;IACvE,0EAA0E;IAC1E,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IAClI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACtI,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAA;AAC/D,CAAC"}

package/lib/rsi-authority-resources.d.ts

@@ -0,0 +1,36 @@
+export declare const rsiAuthorityRoles: readonly ["approval", "release", "adoption", "observation", "qualification", "host", "pr", "review", "merge", "build", "sign", "publish", "registry-verify", "catalog-admission"];
+type Role = typeof rsiAuthorityRoles[number];
+export interface RsiAuthorityIdentity {
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    publicKeyPem: string;
+}
+export interface RsiAuthorityResources {
+    schemaVersion: 1;
+    root: string;
+    installationId: string;
+    ledgerId: string;
+    identities: Record<Role, RsiAuthorityIdentity>;
+    registry: {
+        id: string;
+        root: string;
+        locator: string;
+    };
+    catalog: {
+        id: string;
+        path: string;
+    };
+    stateRoot: string;
+    configRoot: string;
+}
+/** Caller holds the DSH_HOME lifecycle lock. This creates identities and local
+ * storage, not grants; owner-bound authorization is configured separately. */
+export declare function prepareRsiAuthorityResources(input: {
+    dshHome: string;
+    profile: string;
+    signal?: AbortSignal;
+    existingOnly?: boolean;
+}): Promise<RsiAuthorityResources>;
+export {};
+//# sourceMappingURL=rsi-authority-resources.d.ts.map

package/lib/rsi-authority-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-resources.d.ts","sourceRoot":"","sources":["../src/rsi-authority-resources.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,iBAAiB,mLACyE,CAAA;AACvG,KAAK,IAAI,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAA;AAC5C,MAAM,WAAW,oBAAoB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACjH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;IACxE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC9C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CACtC;AAyDD;8EAC8E;AAC9E,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAC/E,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiDjC"}