@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/replay-endpoint-protocol.js

@@ -0,0 +1,183 @@
+import { randomBytes } from 'node:crypto';
+import { assertReplayGrant, validateReplaySignedAuthority } from './replay-grant.js';
+import { lstatSync, realpathSync } from 'node:fs';
+import { createConnection } from 'node:net';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { replayRuntimeDigest, validateReplayCases } from './effect-blocked-replay.js';
+import { assertRuntimeObservation, assertRuntimeObserverExact as exact, assertRuntimeObserverText as text, equalRuntimeObserverMac, privateRuntimeObserverDirectory, readPrivateRuntimeObserverKey, runtimeConfigDigest, runtimeObserverMac, validateRuntimeObserverConfig } from './runtime-observer-protocol.js';
+export const REPLAY_MAX_BYTES = 131_072;
+export const REPLAY_REQUEST_MAX_BYTES = 65_536;
+export const REPLAY_REQUEST_DOMAIN = 'dsh-effect-replay-request/v1';
+export const REPLAY_RESPONSE_DOMAIN = 'dsh-effect-replay-response/v1';
+const HEX = /^[a-f0-9]{64}$/u;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/u;
+export function replayEndpointFail() { throw new Error('replay endpoint: invalid authority, request or observation'); }
+export function validateReplayEndpointConfig(value) {
+    runtimeConfigDigest(value);
+    exact(value, ['runtime', 'journalPath', 'authority', 'agent', 'timeoutMs']);
+    validateRuntimeObserverConfig(value.runtime);
+    const runtime = value.runtime;
+    if (typeof value.journalPath !== 'string' || !isAbsolute(value.journalPath) || resolve(value.journalPath) !== value.journalPath
+        || value.journalPath === runtime.profilePath || value.journalPath.startsWith(runtime.profilePath + '/')
+        || value.journalPath === runtime.socketPath || value.journalPath === runtime.keyPath)
+        replayEndpointFail();
+    privateRuntimeObserverDirectory(dirname(value.journalPath));
+    if (isReplaySignedAuthority(value.authority)) {
+        validateReplaySignedAuthority(value.authority);
+        if (value.authority.scope.profile.path !== runtime.profilePath)
+            replayEndpointFail();
+    }
+    else {
+        exact(value.authority, ['operationId', 'requestDigest', 'notBefore', 'expiresAt', 'cases']);
+        text(value.authority.operationId, ID);
+        text(value.authority.requestDigest, HEX);
+        for (const key of ['notBefore', 'expiresAt'])
+            if (!Number.isSafeInteger(value.authority[key]) || value.authority[key] <= 0)
+                replayEndpointFail();
+        if (value.authority.expiresAt <= value.authority.notBefore
+            || value.authority.expiresAt - value.authority.notBefore > 86_400_000)
+            replayEndpointFail();
+        validateReplayCases(value.authority.cases);
+    }
+    exact(value.agent, ['cwd', 'preset', 'provider', 'model']);
+    if (typeof value.agent.cwd !== 'string' || !isAbsolute(value.agent.cwd) || realpathSync(value.agent.cwd) !== value.agent.cwd
+        || !lstatSync(value.agent.cwd).isDirectory())
+        replayEndpointFail();
+    for (const key of ['preset', 'provider', 'model']) {
+        text(value.agent[key], /^\S{1,160}$/u);
+        if (Array.from(value.agent[key]).some(char => char.charCodeAt(0) < 33))
+            replayEndpointFail();
+    }
+    if (!Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 100 || value.timeoutMs > 60_000)
+        replayEndpointFail();
+}
+export function isReplaySignedAuthority(value) {
+    return typeof value === 'object' && value !== null && 'mode' in value && value.mode === 'signed';
+}
+export function assertReplayEndpointRequest(value) {
+    runtimeConfigDigest(value);
+    const signed = typeof value === 'object' && value !== null && 'schemaVersion' in value && value.schemaVersion === 2;
+    exact(value, ['schemaVersion', 'action', 'operationId', 'requestDigest', 'challenge', ...(signed ? ['grant'] : [])]);
+    if ((!signed && value.schemaVersion !== 1) || !['execute', 'query'].includes(value.action))
+        replayEndpointFail();
+    if (signed)
+        assertReplayGrant(value.grant);
+    text(value.operationId, ID);
+    text(value.requestDigest, HEX);
+    text(value.challenge, HEX);
+}
+export function assertReplayEndpointResponse(value) {
+    exact(value, ['schemaVersion', 'challenge', 'operationId', 'requestDigest', 'status', 'result', 'observedAt']);
+    if (value.schemaVersion !== 1 || !['not-started', 'unknown', 'completed', 'stale'].includes(value.status)
+        || !Number.isSafeInteger(value.observedAt) || value.observedAt <= 0)
+        replayEndpointFail();
+    text(value.challenge, HEX);
+    text(value.operationId, ID);
+    text(value.requestDigest, HEX);
+    if (value.status !== 'completed') {
+        if (value.result !== null)
+            replayEndpointFail();
+        return;
+    }
+    const result = value.result;
+    exact(result, ['schemaVersion', 'kind', 'operationId', 'requestDigest', 'caseDigest', 'sessionId', 'runtime', 'runtimeDigest', 'attempts', 'completedAt', 'quiescent']);
+    runtimeConfigDigest(result);
+    if (result.schemaVersion !== 1 || result.kind !== 'dsh-effect-blocked-replay-observation' || result.quiescent !== true
+        || result.operationId !== value.operationId || result.requestDigest !== value.requestDigest
+        || typeof result.sessionId !== 'string' || result.sessionId.length > 256
+        || !Number.isSafeInteger(result.completedAt) || result.completedAt <= 0
+        || result.completedAt > value.observedAt)
+        replayEndpointFail();
+    text(result.caseDigest, HEX);
+    text(result.runtimeDigest, HEX);
+    assertRuntimeObservation(result.runtime);
+    if (replayRuntimeDigest(result.runtime) !== result.runtimeDigest || !result.runtime.entries.every(entry => entry.active)
+        || result.runtime.observedAt > result.completedAt)
+        replayEndpointFail();
+    if (!Array.isArray(result.attempts) || result.attempts.length < 2 || result.attempts.length > 32)
+        replayEndpointFail();
+    const ids = new Set(), kinds = new Set();
+    for (const attempt of result.attempts) {
+        exact(attempt, ['caseId', 'kind', 'callId', 'inputDigest', 'blockedAt', 'observedAt', 'resultDigest']);
+        text(attempt.caseId, ID);
+        text(attempt.inputDigest, HEX);
+        text(attempt.resultDigest, HEX);
+        if (!['tool', 'delivery'].includes(attempt.kind) || attempt.callId !== `${result.operationId}:${attempt.caseId}`
+            || attempt.blockedAt !== (attempt.kind === 'tool' ? 'native-tool-guard' : 'delivery-reply-admission')
+            || !Number.isSafeInteger(attempt.observedAt) || attempt.observedAt < result.runtime.observedAt
+            || attempt.observedAt > result.completedAt || ids.has(attempt.caseId))
+            replayEndpointFail();
+        ids.add(attempt.caseId);
+        kinds.add(attempt.kind);
+    }
+    if (kinds.size !== 2)
+        replayEndpointFail();
+}
+/** Explicit execute or read-only query; disconnect/timeout never causes an automatic retry. */
+export async function queryReplayEndpoint(input) {
+    if (process.platform !== 'linux' || !Number.isSafeInteger(input.timeoutMs) || input.timeoutMs < 100 || input.timeoutMs > 65_000)
+        replayEndpointFail();
+    privateRuntimeObserverDirectory(dirname(input.socketPath));
+    const before = lstatSync(input.socketPath);
+    if (!before.isSocket() || before.uid !== process.getuid() || (before.mode & 0o077) !== 0 || realpathSync(input.socketPath) !== input.socketPath)
+        replayEndpointFail();
+    const request = { ...(input.grant ? { schemaVersion: 2, grant: input.grant } : { schemaVersion: 1 }), action: input.action, operationId: input.operationId,
+        requestDigest: input.requestDigest, challenge: randomBytes(32).toString('hex') };
+    assertReplayEndpointRequest(request);
+    if (Buffer.byteLength(JSON.stringify(request)) + 100 > REPLAY_REQUEST_MAX_BYTES)
+        replayEndpointFail();
+    const key = readPrivateRuntimeObserverKey(input.keyPath);
+    const signal = AbortSignal.any([AbortSignal.timeout(input.timeoutMs), ...(input.signal ? [input.signal] : [])]);
+    try {
+        return await new Promise((resolveReply, reject) => {
+            const socket = createConnection({ path: input.socketPath, signal });
+            let bytes = Buffer.alloc(0), settled = false;
+            const finish = (error, response) => {
+                if (settled)
+                    return;
+                settled = true;
+                socket.destroy();
+                if (error)
+                    reject(error);
+                else
+                    resolveReply(response);
+            };
+            socket.once('error', error => finish(error));
+            socket.once('connect', () => socket.end(JSON.stringify({ request, mac: runtimeObserverMac(key, REPLAY_REQUEST_DOMAIN, request) }) + '\n'));
+            socket.on('data', chunk => {
+                if (bytes.length + chunk.length > REPLAY_MAX_BYTES) {
+                    finish(new Error('replay endpoint response too large'));
+                    return;
+                }
+                bytes = Buffer.concat([bytes, chunk]);
+            });
+            socket.once('end', () => {
+                try {
+                    if (bytes.at(-1) !== 10 || bytes.subarray(0, -1).includes(10))
+                        replayEndpointFail();
+                    const envelope = JSON.parse(bytes.toString('utf8'));
+                    exact(envelope, ['response', 'mac']);
+                    if (!equalRuntimeObserverMac(envelope.mac, runtimeObserverMac(key, REPLAY_RESPONSE_DOMAIN, envelope.response)))
+                        replayEndpointFail();
+                    const response = envelope.response;
+                    assertReplayEndpointResponse(response);
+                    if (response.challenge !== request.challenge || response.operationId !== input.operationId || response.requestDigest !== input.requestDigest)
+                        replayEndpointFail();
+                    const after = lstatSync(input.socketPath);
+                    if (after.ino !== before.ino || after.dev !== before.dev || !after.isSocket() || (after.mode & 0o077) !== 0 || after.uid !== before.uid)
+                        replayEndpointFail();
+                    finish(undefined, response);
+                }
+                catch {
+                    finish(new Error('replay endpoint response rejected'));
+                }
+            });
+            socket.once('close', () => { if (!settled)
+                finish(new Error('replay endpoint closed before response')); });
+        });
+    }
+    finally {
+        key.fill(0);
+    }
+}
+//# sourceMappingURL=replay-endpoint-protocol.js.map

package/lib/replay-endpoint-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-endpoint-protocol.js","sourceRoot":"","sources":["../src/replay-endpoint-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,EAAgD,MAAM,mBAAmB,CAAA;AAClI,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAmD,MAAM,4BAA4B,CAAA;AACtI,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,IAAI,KAAK,EAAE,yBAAyB,IAAI,IAAI,EACvG,uBAAuB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,mBAAmB,EAC5G,kBAAkB,EAAE,6BAA6B,EAA8B,MAAM,gCAAgC,CAAA;AA+BvH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAA;AACvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,+BAA+B,CAAA;AACrE,MAAM,GAAG,GAAG,iBAAiB,CAAA;AAC7B,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,UAAU,kBAAkB,KAAY,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA,CAAC,CAAC;AAE7H,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;IAC3E,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IAC7B,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,WAAW;WAC1H,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC;WACpG,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO;QAAE,kBAAkB,EAAE,CAAA;IAC5G,+BAA+B,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC3D,IAAI,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,6BAA6B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW;YAAE,kBAAkB,EAAE,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3F,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;QAC/E,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAK,KAAK,CAAC,SAAS,CAAC,GAAG,CAAY,IAAI,CAAC;gBAAE,kBAAkB,EAAE,CAAA;QAC5J,IAAK,KAAK,CAAC,SAAS,CAAC,SAAoB,IAAK,KAAK,CAAC,SAAS,CAAC,SAAoB;eAC5E,KAAK,CAAC,SAAS,CAAC,SAAoB,GAAI,KAAK,CAAC,SAAS,CAAC,SAAoB,GAAG,UAAU;YAAE,kBAAkB,EAAE,CAAA;QACrH,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG;WACvH,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QAAE,kBAAkB,EAAE,CAAA;IACpE,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAAE,kBAAkB,EAAE,CAAA;IACxG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAK,KAAK,CAAC,SAAoB,GAAG,GAAG,IAAK,KAAK,CAAC,SAAoB,GAAG,MAAM;QAAE,kBAAkB,EAAE,CAAA;AAC/I,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,IAAI,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,CAAA;IACnH,KAAK,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpH,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAgB,CAAC;QAAE,kBAAkB,EAAE,CAAA;IAC1H,IAAI,MAAM;QAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;AACzF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,KAAK,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC9G,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAgB,CAAC;WAC9G,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAK,KAAK,CAAC,UAAqB,IAAI,CAAC;QAAE,kBAAkB,EAAE,CAAA;IACvG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IACvF,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAAC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,kBAAkB,EAAE,CAAC;QAAC,OAAM;IAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,KAAK,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IACvK,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,uCAAuC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;WACjH,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;WACxF,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;WACrE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,IAAK,MAAM,CAAC,WAAsB,IAAI,CAAC;WAC/E,MAAM,CAAC,WAAsB,GAAI,KAAK,CAAC,UAAqB;QAAE,kBAAkB,EAAE,CAAA;IACxF,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAAC,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvG,IAAI,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;WACnH,MAAM,CAAC,OAAO,CAAC,UAAU,GAAI,MAAM,CAAC,WAAsB;QAAE,kBAAkB,EAAE,CAAA;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,kBAAkB,EAAE,CAAA;IACtH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,EAAE,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IACxD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAA;QACtG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;QACzF,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAc,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE;eACrH,OAAO,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,0BAA0B,CAAC;eAClG,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAK,OAAO,CAAC,UAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU;eACtG,OAAO,CAAC,UAAqB,GAAI,MAAM,CAAC,WAAsB,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,kBAAkB,EAAE,CAAA;QACrH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAc,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,kBAAkB,EAAE,CAAA;AAC5C,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KACkE;IAC1G,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM;QAAE,kBAAkB,EAAE,CAAA;IACrJ,+BAA+B,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,KAAK,CAAC,UAAU;QAAE,kBAAkB,EAAE,CAAA;IACtK,MAAM,OAAO,GAA0B,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAU,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACjM,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAClF,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,wBAAwB;QAAE,kBAAkB,EAAE,CAAA;IACrG,MAAM,GAAG,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/G,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;YACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;YACnE,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;YAC5C,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,QAAiC,EAAE,EAAE;gBAClE,IAAI,OAAO;oBAAE,OAAM;gBACnB,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChC,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBAAM,YAAY,CAAC,QAAS,CAAC,CAAA;YACxD,CAAC,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;YAC1I,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACxB,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBACvH,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;YACvC,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC;oBACH,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAAE,kBAAkB,EAAE,CAAA;oBACnF,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;oBAC5D,KAAK,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;oBACpC,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBAAE,kBAAkB,EAAE,CAAA;oBACpI,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAA;oBAClC,4BAA4B,CAAC,QAAQ,CAAC,CAAA;oBACtC,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;wBAAE,kBAAkB,EAAE,CAAA;oBAClK,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;oBACzC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;wBAAE,kBAAkB,EAAE,CAAA;oBAC7J,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAA;gBAAC,CAAC;YACpE,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3G,CAAC,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAAC,CAAC;AAC3B,CAAC"}

package/lib/replay-endpoint.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type ReplayEndpointConfig } from './replay-endpoint-protocol.js';
+export { queryReplayEndpoint, validateReplayEndpointConfig, type ReplayEndpointConfig, type ReplayFixedAuthority, type ReplayEndpointResponse } from './replay-endpoint-protocol.js';
+export * from './replay-grant.js';
+/** Opt-in mutation endpoint: a single immutable owner operation, never a model tool. */
+export declare function installReplayEndpoint(ctx: Context, input: ReplayEndpointConfig): void;
+//# sourceMappingURL=replay-endpoint.d.ts.map

package/lib/replay-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-endpoint.d.ts","sourceRoot":"","sources":["../src/replay-endpoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,EAEL,KAAK,oBAAoB,EAA2D,MAAM,+BAA+B,CAAA;AAI3H,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,KAAK,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACpL,cAAc,mBAAmB,CAAA;AAEjC,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,IAAI,CA0IrF"}

package/lib/replay-endpoint.js

@@ -0,0 +1,193 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, lstat, unlink } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { EffectBlockedReplayRuntime, validateReplayCases } from './effect-blocked-replay.js';
+import { verifyReplayGrant } from './replay-grant.js';
+import { ReplayJournal } from './replay-journal.js';
+import { assertReplayEndpointRequest, assertReplayEndpointResponse, REPLAY_MAX_BYTES, REPLAY_REQUEST_MAX_BYTES, REPLAY_REQUEST_DOMAIN, REPLAY_RESPONSE_DOMAIN, replayEndpointFail, isReplaySignedAuthority, validateReplayEndpointConfig } from './replay-endpoint-protocol.js';
+import { assertRuntimeObserverExact, equalRuntimeObserverMac, readPrivateRuntimeObserverKey, runtimeConfigDigest, runtimeObserverMac } from './runtime-observer-protocol.js';
+export { queryReplayEndpoint, validateReplayEndpointConfig } from './replay-endpoint-protocol.js';
+export * from './replay-grant.js';
+/** Opt-in mutation endpoint: a single immutable owner operation, never a model tool. */
+export function installReplayEndpoint(ctx, input) {
+    validateReplayEndpointConfig(input);
+    const config = structuredClone(input);
+    const bindingDigest = runtimeConfigDigest(config);
+    const { caseDigest } = validateReplayCases(config.authority.cases);
+    ctx.inject(['tools', 'loader', 'assistantDelivery', 'agents'], endpointCtx => {
+        endpointCtx.effect(async () => {
+            const key = readPrivateRuntimeObserverKey(config.runtime.keyPath);
+            let journal;
+            let runtime;
+            let runtimeFiber;
+            const lifetime = new AbortController();
+            const flights = new Set();
+            const sockets = new Set();
+            let closing = false;
+            let identity;
+            const respond = (request, authorization) => {
+                const row = journal.get(request.operationId, bindingDigest, authorization);
+                const result = row?.result ?? null;
+                const current = result !== null && runtime.isCurrent(result);
+                const response = { schemaVersion: 1, challenge: request.challenge,
+                    operationId: request.operationId, requestDigest: request.requestDigest,
+                    status: !row ? 'not-started' : !result ? 'unknown' : current ? 'completed' : 'stale',
+                    result: current ? result : null, observedAt: Date.now() };
+                assertReplayEndpointResponse(response);
+                return response;
+            };
+            const dispatch = async (request, signal) => {
+                if (closing)
+                    replayEndpointFail();
+                let authorization;
+                let authorityExpiresAt = config.authority.expiresAt;
+                if (isReplaySignedAuthority(config.authority)) {
+                    if (request.schemaVersion !== 2)
+                        replayEndpointFail();
+                    const verified = verifyReplayGrant(request.grant, config.authority, {
+                        endpointDigest: bindingDigest, caseDigest, profilePath: config.runtime.profilePath,
+                        operationId: request.operationId, requestDigest: request.requestDigest,
+                    }, Date.now());
+                    authorization = { scopeDigest: verified.scopeDigest, grantDigest: verified.grantDigest };
+                    authorityExpiresAt = verified.expiresAt;
+                    if (request.action === 'execute' && (request.grant.processId !== process.pid
+                        || request.grant.invocationId !== (/^[a-f0-9]{32}$/u.test(process.env.INVOCATION_ID ?? '') ? process.env.INVOCATION_ID : null)))
+                        replayEndpointFail();
+                }
+                else if (request.schemaVersion !== 1 || request.operationId !== config.authority.operationId
+                    || request.requestDigest !== config.authority.requestDigest || Date.now() < config.authority.notBefore
+                    || Date.now() >= config.authority.expiresAt)
+                    replayEndpointFail();
+                if (request.action === 'query')
+                    return respond(request, authorization);
+                signal.throwIfAborted();
+                if (!journal.reserve(request.operationId, bindingDigest, request.requestDigest, caseDigest, authorization))
+                    return respond(request, authorization);
+                // No failure after this durable admission may regain create/dispatch authority.
+                let handle;
+                const expiresAt = Math.min(authorityExpiresAt, Date.now() + config.timeoutMs);
+                // Durable admission may wait for SQLite locks/fsync past the authority window.
+                // Keep its reservation unknown without running any Agent startup hook.
+                if (Date.now() >= expiresAt)
+                    return respond(request, authorization);
+                const executionSignal = AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, expiresAt - Date.now()))]);
+                try {
+                    handle = await endpointCtx.agents.create({
+                        sessionId: `effect-replay-${randomUUID()}`,
+                        meta: { cwd: config.agent.cwd, agentPreset: config.agent.preset },
+                        agentOptions: { provider: config.agent.provider, model: config.agent.model }, signal: executionSignal,
+                    });
+                    executionSignal.throwIfAborted();
+                    const result = await runtime.run({ handle, operationId: request.operationId, requestDigest: request.requestDigest,
+                        cases: config.authority.cases, expiresAt, signal: executionSignal });
+                    if (result.caseDigest !== caseDigest || !runtime.isCurrent(result))
+                        replayEndpointFail();
+                    journal.complete(request.operationId, bindingDigest, result);
+                }
+                catch {
+                    // Interrupted, cancelled and failed runs remain unresolved, never a passing receipt.
+                }
+                finally {
+                    // Native handles memoize disposal. Also reclaim if validation rejected before handoff.
+                    if (handle)
+                        await handle.dispose();
+                }
+                return respond(request, authorization);
+            };
+            const server = createServer({ allowHalfOpen: true }, socket => {
+                if (closing || sockets.size >= 8) {
+                    socket.destroy();
+                    return;
+                }
+                sockets.add(socket);
+                const disconnected = new AbortController();
+                const deadline = setTimeout(() => socket.destroy(), config.timeoutMs + 1000);
+                socket.on('error', () => socket.destroy());
+                socket.once('close', () => { clearTimeout(deadline); disconnected.abort(); sockets.delete(socket); });
+                let bytes = Buffer.alloc(0), received = false;
+                socket.on('data', chunk => {
+                    if (received || bytes.length + chunk.length > REPLAY_REQUEST_MAX_BYTES) {
+                        socket.destroy();
+                        return;
+                    }
+                    bytes = Buffer.concat([bytes, chunk]);
+                    if (!bytes.includes(10))
+                        return;
+                    received = true;
+                    try {
+                        if (bytes.at(-1) !== 10 || bytes.subarray(0, -1).includes(10))
+                            replayEndpointFail();
+                        const envelope = JSON.parse(bytes.toString('utf8'));
+                        assertRuntimeObserverExact(envelope, ['request', 'mac']);
+                        assertReplayEndpointRequest(envelope.request);
+                        if (!equalRuntimeObserverMac(envelope.mac, runtimeObserverMac(key, REPLAY_REQUEST_DOMAIN, envelope.request)))
+                            replayEndpointFail();
+                        const flight = dispatch(envelope.request, AbortSignal.any([lifetime.signal, disconnected.signal])).then(response => {
+                            const payload = JSON.stringify({ response, mac: runtimeObserverMac(key, REPLAY_RESPONSE_DOMAIN, response) }) + '\n';
+                            if (Buffer.byteLength(payload) > REPLAY_MAX_BYTES)
+                                replayEndpointFail();
+                            if (!closing && !socket.destroyed)
+                                socket.end(payload);
+                        }).catch(() => socket.destroy());
+                        flights.add(flight);
+                        void flight.finally(() => flights.delete(flight)).catch(() => { });
+                    }
+                    catch {
+                        socket.destroy();
+                    }
+                });
+            });
+            server.maxConnections = 8;
+            let closeTask;
+            const close = () => closeTask ??= (async () => {
+                closing = true;
+                lifetime.abort();
+                for (const socket of sockets)
+                    socket.destroy();
+                const stopped = server.listening
+                    ? new Promise((resolveClose, reject) => server.close(error => error ? reject(error) : resolveClose()))
+                    : Promise.resolve();
+                try {
+                    await Promise.allSettled(flights);
+                    await runtimeFiber?.dispose();
+                    await stopped;
+                    if (identity) {
+                        try {
+                            const current = await lstat(config.runtime.socketPath);
+                            if (current.dev === identity.dev && current.ino === identity.ino && current.isSocket())
+                                await unlink(config.runtime.socketPath);
+                        }
+                        catch (error) {
+                            if (error.code !== 'ENOENT')
+                                throw error;
+                        }
+                    }
+                }
+                finally {
+                    journal?.close();
+                    key.fill(0);
+                }
+            })();
+            try {
+                journal = new ReplayJournal(config.journalPath);
+                runtimeFiber = endpointCtx.plugin({ name: 'effect-replay-endpoint-runtime', apply(owner) { runtime = new EffectBlockedReplayRuntime(owner, config.runtime); } });
+                await runtimeFiber;
+                if (!runtime)
+                    replayEndpointFail();
+                await new Promise((resolveListen, reject) => {
+                    server.once('error', reject);
+                    server.listen(config.runtime.socketPath, () => { server.off('error', reject); resolveListen(); });
+                });
+                identity = await lstat(config.runtime.socketPath);
+                await chmod(config.runtime.socketPath, 0o600);
+                server.on('error', () => { void close().catch(() => endpointCtx.logger.error('replay endpoint teardown failed')); });
+                return close;
+            }
+            catch (error) {
+                await close();
+                throw error;
+            }
+        }, 'plugin-control-plane.replay-endpoint');
+    });
+}
+//# sourceMappingURL=replay-endpoint.js.map

package/lib/replay-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-endpoint.js","sourceRoot":"","sources":["../src/replay-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAA;AAEpD,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAiC,MAAM,4BAA4B,CAAA;AAC3H,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,qBAAqB,EACnI,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,4BAA4B,EACb,MAAM,+BAA+B,CAAA;AAC3H,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,6BAA6B,EACzF,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAEjF,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAqF,MAAM,+BAA+B,CAAA;AACpL,cAAc,mBAAmB,CAAA;AAEjC,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,KAA2B;IAC7E,4BAA4B,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACrC,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAClE,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,EAAE;QAC3E,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,GAAG,GAAG,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACjE,IAAI,OAAkC,CAAA;YACtC,IAAI,OAA+C,CAAA;YACnD,IAAI,YAAuD,CAAA;YAC3D,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;YAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;YACjC,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,QAAuD,CAAA;YAC3D,MAAM,OAAO,GAAG,CAAC,OAA8B,EAAE,aAA4D,EAA0B,EAAE;gBACvI,MAAM,GAAG,GAAG,OAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;gBAC3E,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,IAAI,CAAA;gBAClC,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,IAAI,OAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBAC7D,MAAM,QAAQ,GAA2B,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;oBACvF,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;oBACtE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;oBACpF,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;gBAC3D,4BAA4B,CAAC,QAAQ,CAAC,CAAA;gBACtC,OAAO,QAAQ,CAAA;YACjB,CAAC,CAAA;YACD,MAAM,QAAQ,GAAG,KAAK,EAAE,OAA8B,EAAE,MAAmB,EAAmC,EAAE;gBAC9G,IAAI,OAAO;oBAAE,kBAAkB,EAAE,CAAA;gBACjC,IAAI,aAAuE,CAAA;gBAC3E,IAAI,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAA;gBACnD,IAAI,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9C,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC;wBAAE,kBAAkB,EAAE,CAAA;oBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;wBAClE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;wBAClF,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;qBACvE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;oBACd,aAAa,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;oBACxF,kBAAkB,GAAG,QAAQ,CAAC,SAAS,CAAA;oBACvC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG;2BACvE,OAAO,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBAAE,kBAAkB,EAAE,CAAA;gBAC1J,CAAC;qBAAM,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,SAAS,CAAC,WAAW;uBACzF,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,SAAS,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS;uBACnG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS;oBAAE,kBAAkB,EAAE,CAAA;gBACnE,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;oBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;gBACtE,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,IAAI,CAAC,OAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,aAAa,CAAC;oBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;gBACnJ,gFAAgF;gBAChF,IAAI,MAAsD,CAAA;gBAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;gBAC7E,+EAA+E;gBAC/E,uEAAuE;gBACvE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS;oBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;gBACnE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC3G,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;wBACvC,SAAS,EAAE,iBAAiB,UAAU,EAAE,EAA6D;wBACrG,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;wBACjE,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe;qBACtG,CAAC,CAAA;oBACF,eAAe,CAAC,cAAc,EAAE,CAAA;oBAChC,MAAM,MAAM,GAAG,MAAM,OAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa;wBAChH,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;oBACtE,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,OAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;wBAAE,kBAAkB,EAAE,CAAA;oBACzF,OAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,CAAA;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,qFAAqF;gBACvF,CAAC;wBAAS,CAAC;oBACT,uFAAuF;oBACvF,IAAI,MAAM;wBAAE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;gBACpC,CAAC;gBACD,OAAO,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YACxC,CAAC,CAAA;YACD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE;gBAC5D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;oBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBAC9D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACnB,MAAM,YAAY,GAAG,IAAI,eAAe,EAAE,CAAA;gBAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;gBAC5E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;gBACpG,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;gBAC7C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;oBACxB,IAAI,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;wBAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBAAC,OAAM;oBAAC,CAAC;oBACpG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;oBACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAAE,OAAM;oBAC/B,QAAQ,GAAG,IAAI,CAAA;oBACf,IAAI,CAAC;wBACH,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAAE,kBAAkB,EAAE,CAAA;wBACnF,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;wBAC5D,0BAA0B,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAA;wBACxD,2BAA2B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;wBAC7C,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;4BAAE,kBAAkB,EAAE,CAAA;wBAClI,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;4BACjH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;4BACnH,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,gBAAgB;gCAAE,kBAAkB,EAAE,CAAA;4BACvE,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS;gCAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;wBACxD,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;wBAChC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;wBACnB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBACnE,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM,CAAC,OAAO,EAAE,CAAA;oBAAC,CAAC;gBAC9B,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,cAAc,GAAG,CAAC,CAAA;YACzB,IAAI,SAAoC,CAAA;YACxC,MAAM,KAAK,GAAG,GAAkB,EAAE,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;gBAC3D,OAAO,GAAG,IAAI,CAAC;gBAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;gBAChC,KAAK,MAAM,MAAM,IAAI,OAAO;oBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;gBAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS;oBAC9B,CAAC,CAAC,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;oBAC5G,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;gBACrB,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;oBACjC,MAAM,YAAY,EAAE,OAAO,EAAE,CAAA;oBAC7B,MAAM,OAAO,CAAA;oBACb,IAAI,QAAQ,EAAE,CAAC;wBACb,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;4BACtD,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE;gCAAE,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;wBACjI,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gCAAE,MAAM,KAAK,CAAA;wBAAC,CAAC;oBACzF,CAAC;gBACH,CAAC;wBAAS,CAAC;oBAAC,OAAO,EAAE,KAAK,EAAE,CAAC;oBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAAC,CAAC;YAC7C,CAAC,CAAC,EAAE,CAAA;YACJ,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;gBAC/C,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,GAAG,IAAI,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC/J,MAAM,YAAY,CAAA;gBAClB,IAAI,CAAC,OAAO;oBAAE,kBAAkB,EAAE,CAAA;gBAClC,MAAM,IAAI,OAAO,CAAO,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;oBAChD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;oBAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;gBAClG,CAAC,CAAC,CAAA;gBACF,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBACjD,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;gBAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;gBACnH,OAAO,KAAK,CAAA;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,KAAK,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAA;YAAC,CAAC;QAChD,CAAC,EAAE,sCAAsC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/replay-grant.d.ts

@@ -0,0 +1,62 @@
+import { type ReplayCase } from './effect-blocked-replay.js';
+import type { HostAttestationRequest } from './types.js';
+export interface ReplaySignedAuthority {
+    mode: 'signed';
+    authority: string;
+    keyId: string;
+    publicKeyPem: string;
+    scope: {
+        installationId: string;
+        ledger: {
+            id: string;
+            path: string;
+        };
+        plan: {
+            id: string;
+            digest: string;
+        };
+        activation: {
+            id: string;
+            fence: number;
+        };
+        profile: {
+            name: string;
+            path: string;
+        };
+    };
+    notBefore: number;
+    expiresAt: number;
+    maximumGrantMs: number;
+    cases: ReplayCase[];
+}
+export interface ReplayGrant {
+    schemaVersion: 1;
+    kind: 'dsh-effect-replay-grant';
+    authority: string;
+    keyId: string;
+    request: HostAttestationRequest;
+    endpointDigest: string;
+    caseDigest: string;
+    processId: number;
+    invocationId: string | null;
+    notBefore: number;
+    expiresAt: number;
+    signature: string;
+}
+/** Validates only a public SPKI Ed25519 signer and a bounded authority window. */
+export declare function validateReplaySignedAuthority(value: unknown): asserts value is ReplaySignedAuthority;
+export declare function assertReplayGrant(value: unknown): asserts value is ReplayGrant;
+/** The payload contains a bounded canonical digest, so object access happens only after getter rejection. */
+export declare function replayGrantSigningPayload(grant: Omit<ReplayGrant, 'signature'>): string;
+export declare function verifyReplayGrant(grantInput: ReplayGrant, authorityInput: ReplaySignedAuthority, binding: {
+    endpointDigest: string;
+    caseDigest: string;
+    profilePath: string;
+    operationId: string;
+    requestDigest: string;
+}, now: number): {
+    scopeDigest: string;
+    grantDigest: string;
+    expiresAt: number;
+};
+//# sourceMappingURL=replay-grant.d.ts.map

package/lib/replay-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-grant.d.ts","sourceRoot":"","sources":["../src/replay-grant.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAEjF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AASxD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE;QACL,cAAc,EAAE,MAAM,CAAA;QACtB,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACpC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;QACpC,UAAU,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;QACzC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KACxC,CAAA;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,yBAAyB,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,sBAAsB,CAAA;IAC/B,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AA+DD,kFAAkF;AAClF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAcpG;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAY9E;AAED,6GAA6G;AAC7G,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,MAAM,CAEvF;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,qBAAqB,EAAE,OAAO,EAAE;IACzG,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA8B/E"}