@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/effect-blocked-replay.d.ts

@@ -0,0 +1,81 @@
+import { Context } from '@deepseek-ai/cordis';
+import type { ToolExecutionInput } from '@deepseek-ai/dsh-tools';
+import { type RuntimeObservation, type RuntimeObserverConfig } from './runtime-observer-protocol.js';
+type Agent = NonNullable<ToolExecutionInput['agent']>;
+export type ReplayCase = {
+    id: string;
+    kind: 'tool';
+    name: string;
+    arguments: Record<string, unknown>;
+} | {
+    id: string;
+    kind: 'delivery';
+    text: string;
+};
+export interface EffectBlockedReplayInput {
+    /** A fresh, idle native Agent owned by the caller. This operation consumes it. */
+    handle: {
+        agent: Agent;
+        dispose(): Promise<void>;
+    };
+    operationId: string;
+    requestDigest: string;
+    cases: readonly ReplayCase[];
+    expiresAt: number;
+    signal: AbortSignal;
+}
+export interface ReplayAttempt {
+    caseId: string;
+    kind: 'tool' | 'delivery';
+    callId: string;
+    inputDigest: string;
+    blockedAt: 'native-tool-guard' | 'delivery-reply-admission';
+    observedAt: number;
+    resultDigest: string;
+}
+export interface EffectBlockedReplayResult {
+    schemaVersion: 1;
+    kind: 'dsh-effect-blocked-replay-observation';
+    operationId: string;
+    requestDigest: string;
+    caseDigest: string;
+    sessionId: string;
+    runtime: RuntimeObservation;
+    runtimeDigest: string;
+    attempts: ReplayAttempt[];
+    completedAt: number;
+    quiescent: true;
+}
+/** Runtime identity excludes freshness/challenge fields, never entry/provider epochs. */
+export declare function replayRuntimeDigest(sample: RuntimeObservation): string;
+export declare function validateReplayCases(input: unknown): {
+    cases: ReplayCase[];
+    caseDigest: string;
+};
+/**
+ * Host-only finite rehearsal. It issues no Host attestation and never changes an
+ * activation plan. Native monotonic guards block tool bodies; the current
+ * Delivery provider blocks actual reply admission before any Outbox write.
+ * This is not an OS sandbox or a guarantee about arbitrary plugin JS/hooks.
+ */
+export declare class EffectBlockedReplayRuntime {
+    private readonly ctx;
+    private readonly states;
+    private readonly operations;
+    private readonly flights;
+    private readonly cancellations;
+    private readonly sample;
+    private readonly config;
+    private readonly providers;
+    private closed;
+    constructor(ctx: Context, input: RuntimeObserverConfig);
+    private delivery;
+    private guard;
+    run(input: EffectBlockedReplayInput): Promise<EffectBlockedReplayResult>;
+    private execute;
+    /** Cached observations remain usable only in this exact sampler/provider generation. */
+    isCurrent(result: EffectBlockedReplayResult): boolean;
+    private assertProviders;
+}
+export {};
+//# sourceMappingURL=effect-blocked-replay.d.ts.map

package/lib/effect-blocked-replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-blocked-replay.d.ts","sourceRoot":"","sources":["../src/effect-blocked-replay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,OAAO,KAAK,EAAiB,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAE/E,OAAO,EAAsD,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAExJ,KAAK,KAAK,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAA;AACrD,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAClD,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,MAAM,EAAE;QAAE,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAA;IAClD,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,WAAW,CAAA;CACpB;AACD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,mBAAmB,GAAG,0BAA0B,CAAA;IAC3D,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;CACrB;AACD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,uCAAuC,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,kBAAkB,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,IAAI,CAAA;CAChB;AAoBD,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAGtE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAqB/F;AAED;;;;;GAKG;AACH,qBAAa,0BAA0B;IAUzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAThC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkE;IAC5F,OAAO,CAAC,MAAM,CAAQ;gBAEO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB;IAwBvE,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,KAAK;IAeb,GAAG,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;YAwB1D,OAAO;IAkFrB,wFAAwF;IACxF,SAAS,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO;IAQrD,OAAO,CAAC,eAAe;CAMxB"}

package/lib/effect-blocked-replay.js

@@ -0,0 +1,259 @@
+import { randomBytes } from 'node:crypto';
+import { Context } from '@deepseek-ai/cordis';
+import { scopeOf } from '@deepseek-ai/dsh-scope';
+import { createRuntimeSampler } from './runtime-observer.js';
+import { runtimeConfigDigest, validateRuntimeObserverConfig } from './runtime-observer-protocol.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/u;
+const DENIAL = 'plugin-control-plane: effect-blocked replay tool denial';
+function fail(message) { throw new Error(`effect-blocked replay: ${message}`); }
+/** Runtime identity excludes freshness/challenge fields, never entry/provider epochs. */
+export function replayRuntimeDigest(sample) {
+    return runtimeConfigDigest({ observerId: sample.observerId, observerConfigDigest: sample.observerConfigDigest,
+        processId: sample.processId, invocationId: sample.invocationId, profilePath: sample.profilePath, entries: sample.entries });
+}
+export function validateReplayCases(input) {
+    // Validate before taking ownership. JSON getters, cycles and oversized input
+    // are rejected by the bounded digest, then cloned to freeze the case set.
+    const caseDigest = runtimeConfigDigest(input);
+    const cases = structuredClone(input);
+    if (!Array.isArray(cases) || cases.length < 2 || cases.length > 32
+        || !cases.some(value => value?.kind === 'tool') || !cases.some(value => value?.kind === 'delivery'))
+        fail('two to 32 cases of both effect classes required');
+    const ids = new Set();
+    for (const item of cases) {
+        if (!item || typeof item.id !== 'string' || !ID.test(item.id) || ids.has(item.id))
+            fail('case identity is invalid or repeated');
+        ids.add(item.id);
+        if (item.kind === 'tool') {
+            if (typeof item.name !== 'string' || !/^[A-Za-z][A-Za-z0-9_-]{0,99}$/u.test(item.name)
+                || !item.arguments || typeof item.arguments !== 'object' || Array.isArray(item.arguments)
+                || Object.keys(item).sort().join(',') !== 'arguments,id,kind,name')
+                fail('tool case invalid');
+        }
+        else if (item.kind === 'delivery') {
+            if (typeof item.text !== 'string' || !item.text.length || Buffer.byteLength(item.text) > 4096
+                || Object.keys(item).sort().join(',') !== 'id,kind,text')
+                fail('delivery case invalid');
+        }
+        else
+            fail('unknown effect class');
+    }
+    return { cases, caseDigest };
+}
+/**
+ * Host-only finite rehearsal. It issues no Host attestation and never changes an
+ * activation plan. Native monotonic guards block tool bodies; the current
+ * Delivery provider blocks actual reply admission before any Outbox write.
+ * This is not an OS sandbox or a guarantee about arbitrary plugin JS/hooks.
+ */
+export class EffectBlockedReplayRuntime {
+    ctx;
+    states = new WeakMap();
+    operations = new Set();
+    flights = new Set();
+    cancellations = new Set();
+    sample;
+    config;
+    providers;
+    closed = false;
+    constructor(ctx, input) {
+        this.ctx = ctx;
+        validateRuntimeObserverConfig(input);
+        this.config = structuredClone(input);
+        if (scopeOf(ctx) !== undefined)
+            fail('runtime must belong to an unscoped Host Fiber, not an Agent');
+        if (typeof ctx.tools?.guard !== 'function' || !ctx.get('loader', false))
+            fail('native Tools and Loader required');
+        this.delivery();
+        this.providers = ['tools', 'loader', 'assistantDelivery', 'agents'].map(name => {
+            const implementation = ctx.reflect.store[ctx[Context.isolate][name]];
+            if (!implementation)
+                fail(`missing ${name} provider`);
+            return { name, implementation, store: implementation.fiber.store };
+        });
+        this.sample = createRuntimeSampler(ctx, this.config);
+        ctx.effect(() => {
+            const remove = ctx.tools.guard(execution => this.guard(execution));
+            return async () => {
+                this.closed = true;
+                for (const abort of this.cancellations)
+                    abort.abort();
+                // Keep the monotonic guard until all admitted native calls settle.
+                await Promise.allSettled(this.flights);
+                remove();
+            };
+        }, 'plugin-control-plane.effect-blocked-replay');
+    }
+    delivery() {
+        const value = this.ctx.get('assistantDelivery', false);
+        if (!value || typeof value.blockAgentRepliesForReplay !== 'function' || typeof value.reply !== 'function')
+            fail('current Delivery replay admission API required');
+        return value;
+    }
+    guard(execution) {
+        if (!execution.agent)
+            return;
+        const state = this.states.get(execution.agent);
+        if (!state)
+            return;
+        const expected = state.expected;
+        const inputDigest = runtimeConfigDigest(execution.arguments);
+        if (!expected || state.observed || expected.callId !== execution.callId || expected.name !== execution.name
+            || expected.inputDigest !== inputDigest || state.abort.signal.aborted || this.closed) {
+            state.violation = true;
+            state.abort.abort();
+        }
+        else
+            state.observed = { observedAt: Date.now(), inputDigest };
+        // Tombstones stay in the WeakMap after success, failure or cancellation.
+        return DENIAL;
+    }
+    run(input) {
+        if (this.closed || this.operations.size >= 1024 || typeof input.operationId !== 'string' || !ID.test(input.operationId)
+            || !/^[a-f0-9]{64}$/u.test(input.requestDigest) || this.operations.has(input.operationId))
+            fail('closed, duplicate or invalid operation');
+        if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= Date.now() || input.expiresAt > Date.now() + 60_000)
+            fail('deadline must be within 60 seconds');
+        const { cases, caseDigest } = validateReplayCases(input.cases);
+        const agent = input.handle.agent;
+        if (!agent || typeof input.handle.dispose !== 'function' || agent.status !== 'idle'
+            || scopeOf(agent.ctx) !== agent || this.states.has(agent))
+            fail('fresh idle native Agent handle required');
+        if (agent.inbox.hasPending || agent.session.snapshotEvents().some(event => ['turn/start', 'user/message', 'assistant/message', 'tool/result'].includes(event.type)))
+            fail('replay requires an unused Agent session');
+        this.assertProviders();
+        if (this.ctx.agents.get(agent.id) !== agent)
+            fail('Agent is not registered in this Host');
+        for (const name of ['tools', 'assistantDelivery']) {
+            if (agent.ctx.reflect.store[agent.ctx[Context.isolate][name]] !== this.ctx.reflect.store[this.ctx[Context.isolate][name]])
+                fail(`Agent ${name} realm differs from replay Host`);
+        }
+        input.signal.throwIfAborted();
+        const state = { abort: new AbortController(), violation: false };
+        this.states.set(agent, state);
+        this.operations.add(input.operationId);
+        this.cancellations.add(state.abort);
+        const flight = this.execute({ ...input, cases }, caseDigest, state);
+        this.flights.add(flight);
+        void flight.finally(() => { this.flights.delete(flight); this.cancellations.delete(state.abort); }).catch(() => { });
+        return flight;
+    }
+    async execute(input, caseDigest, state) {
+        const agent = input.handle.agent;
+        const cancel = () => state.abort.abort();
+        input.signal.addEventListener('abort', cancel, { once: true });
+        const timer = setTimeout(cancel, Math.max(1, input.expiresAt - Date.now()));
+        let block;
+        let result;
+        const assertCurrent = () => {
+            state.abort.signal.throwIfAborted();
+            if (this.closed || state.violation || Date.now() >= input.expiresAt || agent.status !== 'idle' || agent.inbox.hasPending)
+                fail('replay was interrupted or changed');
+            this.assertProviders();
+        };
+        try {
+            assertCurrent();
+            const runtime = this.sample(randomBytes(32).toString('hex'));
+            if (!runtime.entries.every(entry => entry.active))
+                fail('candidate or dependency is inactive');
+            const runtimeDigest = replayRuntimeDigest(runtime);
+            const stable = () => {
+                assertCurrent();
+                if (replayRuntimeDigest(this.sample(randomBytes(32).toString('hex'))) !== runtimeDigest)
+                    fail('candidate/provider generation changed');
+            };
+            const delivery = this.delivery();
+            block = delivery.blockAgentRepliesForReplay(agent, { operationId: input.operationId,
+                maximumAttempts: input.cases.filter(item => item.kind === 'delivery').length, expiresAt: input.expiresAt });
+            if (block.contract !== 'assistant-delivery/reply-replay-block/v1')
+                fail('reply blocker contract mismatch');
+            const attempts = [];
+            for (const item of input.cases) {
+                stable();
+                const callId = `${input.operationId}:${item.id}`;
+                if (item.kind === 'tool') {
+                    const inputDigest = runtimeConfigDigest(item.arguments);
+                    state.expected = { callId, name: item.name, inputDigest };
+                    delete state.observed;
+                    const outcome = await agent.ctx.tools.execute({ callId: callId, name: item.name,
+                        arguments: item.arguments, agent, signal: state.abort.signal });
+                    delete state.expected;
+                    stable();
+                    const observed = this.states.get(agent)?.observed;
+                    if (!observed || !outcome.isError || outcome.error.message !== DENIAL)
+                        throw new Error('effect-blocked replay: native monotonic denial was not observed');
+                    attempts.push({ caseId: item.id, kind: item.kind, callId, inputDigest, blockedAt: 'native-tool-guard',
+                        observedAt: observed.observedAt, resultDigest: runtimeConfigDigest(outcome) });
+                }
+                else {
+                    const before = block.snapshot();
+                    const reply = { idempotencyKey: callId, text: item.text, format: 'plain' };
+                    const inputDigest = runtimeConfigDigest({ ...reply, modelPicker: null, permissionPicker: null, replyToEventId: null });
+                    let denied = false;
+                    try {
+                        this.delivery().reply(agent, reply);
+                    }
+                    catch (error) {
+                        denied = error instanceof Error && 'code' in error && error.code === 'reply-replay-blocked'
+                            && 'operationId' in error && error.operationId === input.operationId;
+                    }
+                    const after = block.snapshot();
+                    const attempt = after.attempts.at(-1);
+                    stable();
+                    if (!denied || before.invalidated || after.invalidated || before.status !== 'active' || !['active', 'attempt-limit'].includes(after.status) || after.operationId !== input.operationId
+                        || after.attempts.length !== before.attempts.length + 1 || !attempt || !attempt.blocked
+                        || attempt.sequence !== after.attempts.length || attempt.operationId !== input.operationId || attempt.inputDigest !== inputDigest) {
+                        throw new Error('effect-blocked replay: actual Delivery reply denial was not observed');
+                    }
+                    attempts.push({ caseId: item.id, kind: item.kind, callId, inputDigest,
+                        blockedAt: 'delivery-reply-admission', observedAt: attempt.observedAt, resultDigest: runtimeConfigDigest(attempt) });
+                }
+            }
+            stable();
+            result = { schemaVersion: 1, kind: 'dsh-effect-blocked-replay-observation', operationId: input.operationId,
+                requestDigest: input.requestDigest, caseDigest, sessionId: String(agent.session.id), runtime, runtimeDigest,
+                attempts, completedAt: Date.now(), quiescent: true };
+        }
+        finally {
+            delete state.expected;
+            block?.close();
+            state.abort.abort();
+            clearTimeout(timer);
+            input.signal.removeEventListener('abort', cancel);
+            // The caller hands over the native ownership capability, not a bare
+            // cached Agent. No observation escapes before that Agent is reclaimed.
+            await input.handle.dispose();
+        }
+        if (!result || state.violation || block?.snapshot().invalidated)
+            fail('unsettled or extra replay calls');
+        if (this.closed || input.signal.aborted || Date.now() >= input.expiresAt)
+            fail('replay expired during Agent cleanup');
+        this.assertProviders();
+        if (this.ctx.agents.get(agent.id) !== undefined)
+            fail('native Agent was not reclaimed');
+        if (replayRuntimeDigest(this.sample(randomBytes(32).toString('hex'))) !== result.runtimeDigest)
+            fail('candidate changed during Agent cleanup');
+        result.completedAt = Date.now();
+        return structuredClone(result);
+    }
+    /** Cached observations remain usable only in this exact sampler/provider generation. */
+    isCurrent(result) {
+        if (this.closed)
+            return false;
+        try {
+            this.assertProviders();
+            return replayRuntimeDigest(this.sample(randomBytes(32).toString('hex'))) === result.runtimeDigest;
+        }
+        catch {
+            return false;
+        }
+    }
+    assertProviders() {
+        for (const provider of this.providers) {
+            const current = this.ctx.reflect.store[this.ctx[Context.isolate][provider.name]];
+            if (current !== provider.implementation || current?.fiber.store !== provider.store)
+                fail(`${provider.name} provider changed`);
+        }
+    }
+}
+//# sourceMappingURL=effect-blocked-replay.js.map

package/lib/effect-blocked-replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-blocked-replay.js","sourceRoot":"","sources":["../src/effect-blocked-replay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAuD,MAAM,gCAAgC,CAAA;AAoDxJ,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,MAAM,GAAG,yDAAyD,CAAA;AACxE,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAE9F,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,OAAO,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QAC3G,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;AAC/H,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;WAC7D,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC;QAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IAC9J,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;QAC/H,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;mBACjF,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;mBACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,wBAAwB;gBAAE,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACjG,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI;mBACxF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,cAAc;gBAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC3F,CAAC;;YAAM,IAAI,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IAUR;IATZ,MAAM,GAAG,IAAI,OAAO,EAAmB,CAAA;IACvC,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IACrC,aAAa,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC1C,MAAM,CAA2C;IACjD,MAAM,CAAuB;IAC7B,SAAS,CAAkE;IACpF,MAAM,GAAG,KAAK,CAAA;IAEtB,YAA6B,GAAY,EAAE,KAA4B;QAA1C,QAAG,GAAH,GAAG,CAAS;QACvC,6BAA6B,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACnG,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACjH,IAAI,CAAC,QAAQ,EAAE,CAAA;QACf,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC7E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAE,CAAC,CAAA;YACrE,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,CAAA;YACrD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAe,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACrE,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;YACd,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;YAClE,OAAO,KAAK,IAAI,EAAE;gBAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;gBAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;gBACrD,mEAAmE;gBACnE,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACtC,MAAM,EAAE,CAAA;YACV,CAAC,CAAA;QACH,CAAC,EAAE,4CAA4C,CAAC,CAAA;IAClD,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,mBAA4B,EAAE,KAAK,CAAwC,CAAA;QACtG,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,0BAA0B,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;QACjK,OAAO,KAAM,CAAA;IACf,CAAC;IAEO,KAAK,CAAC,SAAkC;QAC9C,IAAI,CAAC,SAAS,CAAC,KAAK;YAAE,OAAM;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;eACtG,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvF,KAAK,CAAC,SAAS,GAAG,IAAI,CAAA;YACtB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;;YAAM,KAAK,CAAC,QAAQ,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAA;QAC/D,yEAAyE;QACzE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,GAAG,CAAC,KAA+B;QACjC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;eAClH,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;QAC3I,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;YAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;QAChK,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAA;QAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;eAC9E,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAC5G,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAC3I,IAAI,CAAC,eAAe,EAAE,CAAA;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK;YAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;QACzF,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAE,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAE,CAAC;gBAAE,IAAI,CAAC,SAAS,IAAI,iCAAiC,CAAC,CAAA;QACnL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAa,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QAC1E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClH,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAA+B,EAAE,UAAkB,EAAE,KAAe;QACxF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAA;QAChC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACxC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC3E,IAAI,KAA6B,CAAA;QACjC,IAAI,MAA6C,CAAA;QACjD,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YACnC,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;YACnK,IAAI,CAAC,eAAe,EAAE,CAAA;QACxB,CAAC,CAAA;QACD,IAAI,CAAC;YACH,aAAa,EAAE,CAAA;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;YAC9F,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,aAAa,EAAE,CAAA;gBACf,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa;oBAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;YACxI,CAAC,CAAA;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;YAChC,KAAK,GAAG,QAAQ,CAAC,0BAA0B,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;gBACjF,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;YAC7G,IAAI,KAAK,CAAC,QAAQ,KAAK,0CAA0C;gBAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;YAC1G,MAAM,QAAQ,GAAoB,EAAE,CAAA;YACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,CAAA;gBACR,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,EAAE,CAAA;gBAChD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACvD,KAAK,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;oBAAC,OAAO,KAAK,CAAC,QAAQ,CAAA;oBAChF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAsC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;wBAC7G,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;oBACjE,OAAO,KAAK,CAAC,QAAQ,CAAA;oBACrB,MAAM,EAAE,CAAA;oBACR,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;oBACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;oBACzJ,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,mBAAmB;wBACnG,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBAClF,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;oBAC/B,MAAM,KAAK,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAA;oBACnF,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;oBACtH,IAAI,MAAM,GAAG,KAAK,CAAA;oBAClB,IAAI,CAAC;wBAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;oBAAC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACzD,MAAM,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB;+BACtF,aAAa,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAA;oBACxE,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAAC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;oBACrE,MAAM,EAAE,CAAA;oBACR,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;2BACjL,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;2BACpF,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;wBACpI,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;oBACzF,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;wBACnE,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBACxH,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAA;YACR,MAAM,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,uCAAuC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;gBACxG,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa;gBAC3G,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QACxD,CAAC;gBAAS,CAAC;YACT,OAAO,KAAK,CAAC,QAAQ,CAAA;YACrB,KAAK,EAAE,KAAK,EAAE,CAAA;YACd,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC,WAAW;YAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;QACxG,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACrH,IAAI,CAAC,eAAe,EAAE,CAAA;QACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;QACvF,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAO,CAAC,aAAa;YAAE,IAAI,CAAC,wCAAwC,CAAC,CAAA;QAC/I,MAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAChC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC;IAED,wFAAwF;IACxF,SAAS,CAAC,MAAiC;QACzC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,EAAE,CAAA;YACtB,OAAO,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa,CAAA;QACnG,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAA;QAAC,CAAC;IAC1B,CAAC;IAEO,eAAe;QACrB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC,CAAA;YACjF,IAAI,OAAO,KAAK,QAAQ,CAAC,cAAc,IAAI,OAAO,EAAE,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;gBAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,mBAAmB,CAAC,CAAA;QAC/H,CAAC;IACH,CAAC;CACF"}

package/lib/errors.d.ts

@@ -0,0 +1,6 @@
+export type ControlPlaneCliErrorCode = 'ACTIVATION_BINDING' | 'EXECUTOR_FAILED' | 'EXECUTOR_OUTPUT_LIMIT' | 'EXECUTOR_TIMEOUT' | 'FILESYSTEM_STATE' | 'HOST_ATTESTATION_REQUIRED' | 'HOST_ATTESTOR_NOT_CONFIGURED' | 'INVALID_ARGUMENT' | 'LOCK_CONFLICT' | 'SOURCE_BOUNDARY';
+export declare class ControlPlaneCliError extends Error {
+    readonly code: ControlPlaneCliErrorCode;
+    constructor(code: ControlPlaneCliErrorCode, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,GAClB,kBAAkB,GAClB,2BAA2B,GAC3B,8BAA8B,GAC9B,kBAAkB,GAClB,eAAe,GACf,iBAAiB,CAAA;AAErB,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,wBAAwB;gBAA9B,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM;CAIrE"}

package/lib/errors.js

@@ -0,0 +1,9 @@
+export class ControlPlaneCliError extends Error {
+    code;
+    constructor(code, message) {
+        super(`plugin-control-plane[${code}]: ${message}`);
+        this.code = code;
+        this.name = 'ControlPlaneCliError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB;IAArB,YAAqB,IAA8B,EAAE,OAAe;QAClE,KAAK,CAAC,wBAAwB,IAAI,MAAM,OAAO,EAAE,CAAC,CAAA;QAD/B,SAAI,GAAJ,IAAI,CAA0B;QAEjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF"}

package/lib/foreground-deployment-runtime.d.ts

@@ -0,0 +1,20 @@
+import type { ForegroundTaskObservationRegistration } from '@dsh-enhanced/assistant-delivery';
+import { type ControlPlaneStore } from './store.js';
+import type { PluginControlTrustConfig } from './trust.js';
+import type { RuntimeObservation } from './runtime-observer-protocol.js';
+export interface ForegroundDeploymentConfig {
+    attestorJournalPath: string;
+}
+export declare function validateForegroundDeploymentConfig(value: ForegroundDeploymentConfig): void;
+/** A changed trust file requires a fresh owning Fiber, never a stale key cache. */
+export declare function foregroundTrustSnapshot(path: string): string;
+export declare function createForegroundDeploymentObserver(input: {
+    config: ForegroundDeploymentConfig;
+    profilePath: string;
+    store: ControlPlaneStore;
+    trust: PluginControlTrustConfig;
+    sample(challenge: string): RuntimeObservation;
+    assertCurrent(): void;
+    owner: ForegroundTaskObservationRegistration['owner'];
+}): ForegroundTaskObservationRegistration;
+//# sourceMappingURL=foreground-deployment-runtime.d.ts.map

package/lib/foreground-deployment-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreground-deployment-runtime.d.ts","sourceRoot":"","sources":["../src/foreground-deployment-runtime.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAA;AAG7F,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAExE,MAAM,WAAW,0BAA0B;IAAG,mBAAmB,EAAE,MAAM,CAAA;CAAE;AAE3E,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAI1F;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5D;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,MAAM,EAAE,0BAA0B,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,iBAAiB,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;IAC/B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAAA;IAC7C,aAAa,IAAI,IAAI,CAAA;IACrB,KAAK,EAAE,qCAAqC,CAAC,OAAO,CAAC,CAAA;CACtD,GAAG,qCAAqC,CA0CxC"}

package/lib/foreground-deployment-runtime.js

@@ -0,0 +1,79 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { closeSync, constants, fstatSync, openSync, readFileSync, realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { captureRetainedDeploymentReadiness } from './deployment-readiness.js';
+import {} from './foreground-deployment.js';
+import { controlPlaneDigest } from './store.js';
+export function validateForegroundDeploymentConfig(value) {
+    if (!value || Object.keys(value).join(',') !== 'attestorJournalPath' || typeof value.attestorJournalPath !== 'string'
+        || value.attestorJournalPath.length > 4096 || !isAbsolute(value.attestorJournalPath)
+        || resolve(value.attestorJournalPath) !== value.attestorJournalPath)
+        throw new Error('invalid foregroundDeployments configuration');
+}
+/** A changed trust file requires a fresh owning Fiber, never a stale key cache. */
+export function foregroundTrustSnapshot(path) {
+    if (realpathSync(path) !== path)
+        throw new Error('foreground trust path is not canonical');
+    const descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = fstatSync(descriptor);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 65_536 || (stat.mode & 0o077) !== 0
+            || (process.getuid && stat.uid !== process.getuid()))
+            throw new Error('unsafe foreground trust file');
+        return createHash('sha256').update(readFileSync(descriptor)).digest('hex');
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+export function createForegroundDeploymentObserver(input) {
+    const capture = (task) => {
+        input.assertCurrent();
+        const runtime = input.sample(randomBytes(32).toString('hex'));
+        if (runtime.observedAt < task.dispatchedAt || runtime.observedAt > Date.now())
+            throw new Error('foreground sample is not current');
+        return runtime;
+    };
+    return Object.freeze({
+        protocol: 'plugin-control-plane/foreground-observer/v1',
+        generation: randomUUID(), owner: input.owner,
+        begin(task) {
+            return input.store.withForegroundDeployment(task, input.profilePath, (plan, operation) => {
+                const begin = capture(task);
+                if (!operation.receipt)
+                    throw new Error('foreground deployment lacks signed readiness');
+                const readiness = captureRetainedDeploymentReadiness({ plan, operation, receipt: operation.receipt, trust: input.trust,
+                    journalPath: input.config.attestorJournalPath, runtime: begin });
+                input.assertCurrent();
+                input.store.beginForegroundDeployment({ schemaVersion: 1, task: structuredClone(task), readiness, begin, state: 'pending' });
+                return task.inboxId;
+            });
+        },
+        completed(handle, task, execution) {
+            input.assertCurrent();
+            if (handle !== task.inboxId)
+                throw new Error('foreground deployment handle differs');
+            const prior = input.store.getForegroundDeployment(task.inboxId);
+            if (!prior || prior.state !== 'pending' || controlPlaneDigest(prior.task) !== controlPlaneDigest(task))
+                throw new Error('foreground deployment dispatch differs');
+            try {
+                input.store.withForegroundDeployment(task, input.profilePath, (plan, operation) => {
+                    const end = capture(task);
+                    if (!operation.receipt || !execution.quiescent || execution.status !== 'succeeded')
+                        throw new Error('foreground deployment completion unknown');
+                    const readiness = captureRetainedDeploymentReadiness({ plan, operation, receipt: operation.receipt, trust: input.trust,
+                        journalPath: input.config.attestorJournalPath, runtime: end });
+                    if (controlPlaneDigest(readiness) !== controlPlaneDigest(prior.readiness))
+                        throw new Error('foreground deployment changed during execution');
+                    input.assertCurrent();
+                    input.store.finishForegroundDeployment({ ...prior, state: 'observed', end, execution: structuredClone(execution) });
+                });
+            }
+            catch {
+                input.assertCurrent();
+                input.store.finishForegroundDeployment({ ...prior, state: 'unknown', execution: structuredClone(execution) });
+            }
+        },
+    });
+}
+//# sourceMappingURL=foreground-deployment-runtime.js.map

package/lib/foreground-deployment-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreground-deployment-runtime.js","sourceRoot":"","sources":["../src/foreground-deployment-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/F,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/C,OAAO,EAAE,kCAAkC,EAAE,MAAM,2BAA2B,CAAA;AAC9E,OAAO,EAAmC,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AAMvE,MAAM,UAAU,kCAAkC,CAAC,KAAiC;IAClF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,qBAAqB,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;WAChH,KAAK,CAAC,mBAAmB,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC;WACjF,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,KAAK,CAAC,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;AACvI,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC1F,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC5E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eACpF,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACvG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5E,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAQlD;IACC,MAAM,OAAO,GAAG,CAAC,IAAwC,EAAE,EAAE;QAC3D,KAAK,CAAC,aAAa,EAAE,CAAA;QACrB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC7D,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QAClI,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAwC;QAC1D,QAAQ,EAAE,6CAAsD;QAChE,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;QAC5C,KAAK,CAAC,IAAI;YACR,OAAO,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;gBACvF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC3B,IAAI,CAAC,SAAS,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;gBACvF,MAAM,SAAS,GAAG,kCAAkC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;oBACpH,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBAClE,KAAK,CAAC,aAAa,EAAE,CAAA;gBACrB,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC5H,OAAO,IAAI,CAAC,OAAO,CAAA;YACrB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS;YAC/B,KAAK,CAAC,aAAa,EAAE,CAAA;YACrB,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;YACpF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACjK,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;oBAChF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;oBACzB,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW;wBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;oBAC/I,MAAM,SAAS,GAAG,kCAAkC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;wBACpH,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;oBAChE,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;oBAC5I,KAAK,CAAC,aAAa,EAAE,CAAA;oBACrB,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBACrH,CAAC,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,CAAC,aAAa,EAAE,CAAA;gBACrB,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAC/G,CAAC;QACH,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/lib/foreground-deployment.d.ts

@@ -0,0 +1,17 @@
+import type { ForegroundTaskIdentity, ForegroundExecution } from '@dsh-enhanced/assistant-delivery';
+import type { DeploymentReadinessBinding } from './deployment-readiness.js';
+import { type RuntimeObservation } from './runtime-observer-protocol.js';
+/** A deployment cohort witness; it does not claim a tool call or task quality. */
+export interface ForegroundDeploymentRecord {
+    schemaVersion: 1;
+    task: ForegroundTaskIdentity;
+    readiness: DeploymentReadinessBinding;
+    begin: RuntimeObservation;
+    state: 'pending' | 'observed' | 'unknown';
+    end?: RuntimeObservation;
+    execution?: ForegroundExecution;
+}
+export declare function assertForegroundTask(value: ForegroundTaskIdentity): void;
+export declare function runtimeIdentityDigest(runtime: RuntimeObservation): string;
+export declare function assertForegroundDeployment(record: ForegroundDeploymentRecord): void;
+//# sourceMappingURL=foreground-deployment.d.ts.map

package/lib/foreground-deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreground-deployment.d.ts","sourceRoot":"","sources":["../src/foreground-deployment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAiD,KAAK,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAEvH,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,sBAAsB,CAAA;IAC5B,SAAS,EAAE,0BAA0B,CAAA;IACrC,KAAK,EAAE,kBAAkB,CAAA;IACzB,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;IACzC,GAAG,CAAC,EAAE,kBAAkB,CAAA;IACxB,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAChC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAUxE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAIzE;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAgBnF"}

package/lib/foreground-deployment.js

@@ -0,0 +1,43 @@
+import { assertRuntimeObservation, runtimeConfigDigest } from './runtime-observer-protocol.js';
+export function assertForegroundTask(value) {
+    runtimeConfigDigest(value);
+    if (value.protocol !== 'assistant-delivery/foreground-task/v1')
+        throw new Error('invalid foreground task protocol');
+    for (const text of [value.inboxId, value.sessionId, value.scope.workspace, value.scope.preset,
+        value.owner.principalRecordId, value.binding.id]) {
+        if (typeof text !== 'string' || !text.trim() || text.length > 4096)
+            throw new Error('invalid foreground task identity');
+    }
+    for (const version of [value.owner.principalVersion, value.binding.version, value.binding.generation, value.dispatchedAt]) {
+        if (!Number.isSafeInteger(version) || version < 1)
+            throw new Error('invalid foreground task generation');
+    }
+}
+export function runtimeIdentityDigest(runtime) {
+    assertRuntimeObservation(runtime);
+    const { challenge: _challenge, observedAt: _observedAt, ...identity } = runtime;
+    return runtimeConfigDigest(identity);
+}
+export function assertForegroundDeployment(record) {
+    if (record.schemaVersion !== 1 || !['pending', 'observed', 'unknown'].includes(record.state))
+        throw new Error('invalid foreground deployment');
+    assertForegroundTask(record.task);
+    assertRuntimeObservation(record.begin);
+    if (record.begin.observedAt < record.task.dispatchedAt || record.begin.profilePath !== record.readiness.profilePath
+        || runtimeIdentityDigest(record.begin) !== record.readiness.runtimeDigest)
+        throw new Error('foreground deployment binding differs');
+    if (record.end)
+        assertRuntimeObservation(record.end);
+    if (record.state === 'pending' && (record.execution || record.end))
+        throw new Error('pending foreground deployment has completion');
+    if (record.execution && (record.execution.executionRef !== record.task.inboxId
+        || record.execution.dispatchedAt !== record.task.dispatchedAt || record.execution.completedAt < record.task.dispatchedAt)) {
+        throw new Error('foreground completion targets a different execution');
+    }
+    if (record.state === 'observed' && (!record.execution || !record.end
+        || record.execution.status !== 'succeeded' || !record.execution.quiescent
+        || record.end.observedAt < record.execution.completedAt
+        || runtimeIdentityDigest(record.end) !== record.readiness.runtimeDigest))
+        throw new Error('foreground deployment has no stable completion');
+}
+//# sourceMappingURL=foreground-deployment.js.map

package/lib/foreground-deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreground-deployment.js","sourceRoot":"","sources":["../src/foreground-deployment.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAA2B,MAAM,gCAAgC,CAAA;AAavH,MAAM,UAAU,oBAAoB,CAAC,KAA6B;IAChE,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,uCAAuC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACnH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QAC3F,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACzH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAC1G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA2B;IAC/D,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC/E,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAkC;IAC3E,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC9I,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACjC,wBAAwB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,SAAS,CAAC,WAAW;WAC9G,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IACrI,IAAI,MAAM,CAAC,GAAG;QAAE,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACpD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACnI,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO;WACzE,MAAM,CAAC,SAAS,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5H,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;WAC/D,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS;WACtE,MAAM,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW;WACpD,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;AAC/I,CAAC"}

package/lib/host-attestor.d.ts

@@ -9,5 +9,5 @@ export declare class HostAttestorError extends Error {
 export declare function hostRequirements(policy: HostAttestationPolicy, phase: HostAttestationPhase, previousHostGeneration: number): HostAttestationRequirements;
 export declare function prepareManualHostAttestation(store: ControlPlaneStore, plan: PluginActivationPlan, trust: PluginControlTrustConfig): HostAttestationOperation;
 export declare function prepareConfiguredHostAttestation(store: ControlPlaneStore, plan: PluginActivationPlan, trust: PluginControlTrustConfig): HostAttestationOperation;
-export declare function invokeConfiguredHostAttestor(trust: PluginControlTrustConfig, request: HostAttestationRequest): Promise<HostAttestationReceipt>;
+export declare function invokeConfiguredHostAttestor(trust: PluginControlTrustConfig, request: HostAttestationRequest, signal?: AbortSignal): Promise<HostAttestationReceipt>;
 //# sourceMappingURL=host-attestor.d.ts.map

package/lib/host-attestor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-attestor.d.ts","sourceRoot":"","sources":["../src/host-attestor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAA0B,MAAM,YAAY,CAAA;AACtE,OAAO,EACuB,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC/E,OAAO,KAAK,EACV,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAEnB,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,kBAAkB,CAAA;AAExI,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,qBAAqB;gBAA3B,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAIlE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,oBAAoB,EACzF,sBAAsB,EAAE,MAAM,GAAG,2BAA2B,CAa7D;AAmBD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EAC/F,KAAK,EAAE,wBAAwB,GAAG,wBAAwB,CAE3D;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EACnG,KAAK,EAAE,wBAAwB,GAAG,wBAAwB,CAM3D;AAsCD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,wBAAwB,EAChF,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA8BlE"}
+{"version":3,"file":"host-attestor.d.ts","sourceRoot":"","sources":["../src/host-attestor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAA0B,MAAM,YAAY,CAAA;AACtE,OAAO,EACuB,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC/E,OAAO,KAAK,EACV,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAEnB,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,kBAAkB,CAAA;AAExI,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,IAAI,EAAE,qBAAqB;gBAA3B,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAIlE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,oBAAoB,EACzF,sBAAsB,EAAE,MAAM,GAAG,2BAA2B,CAc7D;AAuBD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EAC/F,KAAK,EAAE,wBAAwB,GAAG,wBAAwB,CAE3D;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,EACnG,KAAK,EAAE,wBAAwB,GAAG,wBAAwB,CAM3D;AA0BD,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,wBAAwB,EAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsCxF"}