@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/source-adoption-runner.js

@@ -0,0 +1,197 @@
+/** Host-owned continuation from a completed source release into normal activation. */
+import { validateAdoptionHandoffTerms } from './adoption-handoff.js';
+import { lstat, realpath } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { Ed25519ApprovalAuthority, parseApprovalReceipt } from './approval.js';
+import { discover, loadCatalogWithMetadata } from './catalog.js';
+import { activatePluginPlan, probePluginPlan } from './cli.js';
+import { requestSourceAuthorityReceipt, validateSourceApprovalClientConfig } from './source-approval-client.js';
+import { controlPlaneDigest } from './store.js';
+import { resolveTrustKey } from './trust.js';
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const AWAITING = new Set(['awaiting-reload', 'awaiting-readiness', 'awaiting-effect-blocked-replay', 'awaiting-shadow', 'awaiting-canary', 'awaiting-soak', 'awaiting-health']);
+export function validateSourceAdoptionConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('plugin-control-plane: invalid source adoption config');
+    const item = value;
+    if (Object.keys(item).sort().join('\0') !== ['authority', ...(Object.hasOwn(item, 'handoff') ? ['handoff'] : []), 'planTtlMs', 'profile', 'timeoutMs'].join('\0')
+        || typeof item.profile !== 'string' || item.profile.normalize('NFC').trim() !== item.profile || !PROFILE.test(item.profile)
+        || !Number.isSafeInteger(item.planTtlMs) || Number(item.planTtlMs) < 60_000 || Number(item.planTtlMs) > 86_400_000
+        || !Number.isSafeInteger(item.timeoutMs) || Number(item.timeoutMs) < 1_000 || Number(item.timeoutMs) > 3_600_000) {
+        throw new Error('plugin-control-plane: invalid source adoption config');
+    }
+    validateSourceApprovalClientConfig(item.authority);
+    if (Object.hasOwn(item, 'handoff'))
+        validateAdoptionHandoffTerms(item.handoff);
+}
+function same(left, right) { return controlPlaneDigest(left) === controlPlaneDigest(right); }
+async function canonicalTarget(trust, profile) {
+    const profiles = join(trust.dshHome, 'profiles');
+    if (await realpath(profiles) !== resolve(profiles))
+        throw new Error('plugin-control-plane: profiles directory is not canonical');
+    const profilePath = join(profiles, profile);
+    try {
+        const metadata = await lstat(profilePath);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink() || await realpath(profilePath) !== resolve(profilePath))
+            throw new Error('plugin-control-plane: target profile is not canonical');
+    }
+    catch (error) {
+        if (!(typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT'))
+            throw error;
+        if (await realpath(dirname(profilePath)) !== resolve(dirname(profilePath)) || basename(profilePath) !== profile)
+            throw new Error('plugin-control-plane: target profile parent is not canonical');
+    }
+    return Object.freeze({ dshHome: trust.dshHome, profile, profilePath });
+}
+function assertPlanBinding(plan, sourcePlanId, trust, target, catalog, candidate) {
+    if (plan.profile !== target.profile || plan.installationId !== trust.installationId || !same(plan.target, target)
+        || !same(plan.ledger, trust.ledger) || !same(plan.executor, { id: trust.executor.id, version: trust.executor.version, path: trust.executor.path, sha256: trust.executor.sha256 })
+        || plan.dossier.catalogDigest !== catalog.digest || plan.dossier.catalogProvenance !== 'owner-provided-integrity-pinned' || !same(plan.candidate, candidate)) {
+        throw new Error(`plugin-control-plane: source adoption ${sourcePlanId} binding no longer matches current owner trust`);
+    }
+}
+/** Immutable fields sufficient for the shared engine to restore an exposed plan. */
+function recoveryBinding(plan, trust, profile) {
+    return plan.profile === profile && plan.installationId === trust.installationId && plan.target.dshHome === trust.dshHome
+        && plan.target.profile === profile && plan.target.profilePath === join(trust.dshHome, 'profiles', profile)
+        && same(plan.ledger, trust.ledger)
+        && same(plan.executor, { id: trust.executor.id, version: trust.executor.version, path: trust.executor.path, sha256: trust.executor.sha256 });
+}
+function authority(trust, receipt) {
+    const key = resolveTrustKey(trust, 'approval', receipt.authority, receipt.keyId);
+    return new Ed25519ApprovalAuthority(key.publicKeyPem, key.authority, key.keyId);
+}
+function terminal(plan) { return plan.status === 'activated' || plan.status === 'rolled-back'; }
+async function recoverAwaiting(store, trust, plan, timeoutMs) {
+    const recoverySignal = AbortSignal.timeout(timeoutMs);
+    let rollback = plan;
+    if (plan.status !== 'rollback-pending') {
+        if ((!AWAITING.has(plan.status) && plan.status !== 'staging' && plan.status !== 'commit-pending') || plan.activation === undefined)
+            return;
+        // The Store rejects a live lease. Expired staging/commit work can instead
+        // be converted to the same durable rollback path as an awaiting failure.
+        rollback = store.requestActivationRollback({ planId: plan.id, expectedRevision: plan.revision, fence: plan.activation.fence, failureCode: 'source-adoption-interrupted' });
+    }
+    const restored = await activatePluginPlan({ store, trust, planId: rollback.id, expectedRevision: rollback.revision, signal: recoverySignal });
+    if (restored.status === 'rollback-pending' && restored.activation?.rollbackProfileRestored) {
+        await probePluginPlan({ store, trust, planId: restored.id, expectedRevision: restored.revision, expectedFence: restored.activation.fence, signal: recoverySignal });
+    }
+}
+/**
+ * Create or recover the exact source-linked plan, obtain one finite approval,
+ * then delegate all deployment and rollback mechanics to the shared engine.
+ */
+export async function adoptSourceRelease(options) {
+    // Locate a durable link before checking current job authority: a withdrawn
+    // job may still have exposed a profile that needs the engine's recovery.
+    let created = options.store.findSourceAdoption(options.sourcePlanId);
+    let trustBound = created !== undefined && recoveryBinding(created, options.trust, options.config.profile);
+    try {
+        validateSourceAdoptionConfig(options.config);
+        const deadline = AbortSignal.timeout(options.config.timeoutMs);
+        const signal = options.signal === undefined ? deadline : AbortSignal.any([options.signal, deadline]);
+        const source = options.store.getSourcePlan(options.sourcePlanId);
+        if (source.status !== 'release-complete' || source.mode !== 'modify')
+            throw new Error('plugin-control-plane: source adoption requires a release-complete owner modify plan');
+        const released = options.store.sourceReleaseCandidate(source.id);
+        const catalog = await loadCatalogWithMetadata(options.trust.catalog.path);
+        const admitted = catalog.catalog.entries.find(entry => entry.id === released.id);
+        // Owner-failure source plans retain the generic repair gap rather than
+        // pretending that it is a candidate capability. Their durable Store link
+        // already binds this exact released entry; ordinary gaps still require
+        // catalog capability applicability.
+        if (admitted === undefined || !same(admitted, released)
+            || (source.gapSnapshot.capability !== 'foreground-task-repair' && !discover(catalog.catalog, source.gapSnapshot.capability).some(entry => entry.id === released.id))) {
+            throw new Error('plugin-control-plane: source release is not the exact applicable current catalog entry');
+        }
+        const target = await canonicalTarget(options.trust, options.config.profile);
+        let plan = created;
+        // A job can expire while catalog and filesystem checks await. Never make
+        // its durable activation claim until the Host has revalidated it.
+        await options.assertCurrent();
+        signal.throwIfAborted();
+        if (plan === undefined) {
+            plan = options.withSourceFence(() => options.store.createPlan({ candidate: admitted, catalog: { digest: catalog.digest, provenance: catalog.provenance }, matchedCapabilities: admitted.capabilities,
+                profile: options.config.profile, target, installationId: options.trust.installationId, ledger: options.trust.ledger,
+                executor: { id: options.trust.executor.id, version: options.trust.executor.version, path: options.trust.executor.path, sha256: options.trust.executor.sha256 },
+                ttlMs: options.config.planTtlMs, gapId: source.gapId, sourcePlanId: source.id, ...(options.config.handoff ? { handoff: options.config.handoff } : {}), idempotencyKey: `source-adoption:${source.id}` }).result);
+        }
+        assertPlanBinding(plan, source.id, options.trust, target, catalog, admitted);
+        created = plan;
+        trustBound = true;
+        if (!same(plan.dossier.handoff ?? null, options.config.handoff ?? null))
+            throw new Error('plugin-control-plane: adoption handoff configuration changed');
+        let requestedApproval = false;
+        for (let step = 0; step < 32; step++) {
+            await options.assertCurrent();
+            signal.throwIfAborted();
+            const current = options.store.getPlan(plan.id);
+            assertPlanBinding(current, source.id, options.trust, target, catalog, admitted);
+            if (terminal(current))
+                return current;
+            const before = { status: current.status, revision: current.revision, fence: current.activation?.fence };
+            if (current.status === 'pending-approval') {
+                if (requestedApproval)
+                    return current;
+                requestedApproval = true;
+                const sourceReference = options.store.getOwnerTaskFailureReference(current.gapId);
+                if (sourceReference === undefined)
+                    throw new Error('plugin-control-plane: source adoption owner reference is absent');
+                const request = { protocol: 'dsh-source-adoption/v1', planId: current.id, planDigest: current.digest, sourceReferenceDigest: controlPlaneDigest(sourceReference) };
+                const receipt = await requestSourceAuthorityReceipt(options.config.authority, request, value => {
+                    const parsed = parseApprovalReceipt(value);
+                    if (parsed.decision !== 'approved' || parsed.planId !== request.planId || parsed.planDigest !== request.planDigest)
+                        throw new Error('plugin-control-plane: source adoption authority receipt is not exact');
+                    return parsed;
+                }, signal);
+                await options.assertCurrent();
+                signal.throwIfAborted();
+                plan = (await options.store.approve({ planId: current.id, expectedRevision: current.revision, receipt,
+                    resolveAuthority: value => authority(options.trust, value), idempotencyKey: `source-adoption-approval:${receipt.approvalId}`, withSourceFence: options.withSourceFence })).result;
+            }
+            else if (options.config.handoff) {
+                if (current.status === 'approved') {
+                    options.withSourceFence(() => options.store.prepareAdoptionHandoff({ planId: current.id, expectedRevision: current.revision }));
+                }
+                else if (current.status === 'commit-pending') {
+                    options.store.assertAdoptionHandoff(current.id);
+                    return await activatePluginPlan({ store: options.store, trust: options.trust, planId: current.id, expectedRevision: current.revision, signal });
+                }
+                // The external native continuation owns staging, probes and recovery.
+                return options.store.getPlan(current.id);
+            }
+            else if (current.status === 'rollback-pending' && current.activation?.rollbackProfileRestored) {
+                plan = await probePluginPlan({ store: options.store, trust: options.trust, planId: current.id, expectedRevision: current.revision, expectedFence: current.activation.fence, signal });
+            }
+            else if (current.status === 'approved' || current.status === 'staging' || current.status === 'commit-pending' || current.status === 'rollback-pending') {
+                plan = await activatePluginPlan({ store: options.store, trust: options.trust, planId: current.id, expectedRevision: current.revision, signal });
+            }
+            else if (AWAITING.has(current.status)) {
+                if (current.activation === undefined)
+                    throw new Error('plugin-control-plane: awaiting source adoption has no activation fence');
+                plan = await probePluginPlan({ store: options.store, trust: options.trust, planId: current.id, expectedRevision: current.revision, expectedFence: current.activation.fence, signal });
+            }
+            else
+                return current;
+            if (plan.status === before.status && plan.revision === before.revision && plan.activation?.fence === before.fence)
+                return plan;
+        }
+        return options.store.getPlan(plan.id);
+    }
+    catch (error) {
+        if (created !== undefined && trustBound) {
+            try {
+                if (created.dossier.handoff) {
+                    // Unloading the target must not cancel the durable handoff it just made.
+                    if (!options.signal?.aborted)
+                        options.store.revokeAdoptionHandoff(created.id);
+                }
+                else
+                    await recoverAwaiting(options.store, options.trust, options.store.getPlan(created.id), options.config.timeoutMs);
+            }
+            catch { /* preserve the triggering failure */ }
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=source-adoption-runner.js.map

package/lib/source-adoption-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-adoption-runner.js","sourceRoot":"","sources":["../src/source-adoption-runner.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,EAAE,4BAA4B,EAA6B,MAAM,uBAAuB,CAAA;AAC/F,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAE,6BAA6B,EAAE,kCAAkC,EAAmC,MAAM,6BAA6B,CAAA;AAChJ,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,eAAe,EAAiC,MAAM,YAAY,CAAA;AAG3E,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiC,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAU/M,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACxI,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;WAC5J,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;WACxH,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,UAAU;WAC/G,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACnH,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,KAAc,IAAa,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAEvH,KAAK,UAAU,eAAe,CAAC,KAA+B,EAAE,OAAe;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAChD,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAChI,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC5L,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAA;QAC7G,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IAClM,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA0B,EAAE,YAAoB,EAAE,KAA+B,EAAE,MAAsC,EAAE,OAA2B,EAAE,SAA4C;IAC7N,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;WAC5G,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;WAC9K,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,iCAAiC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAC/J,MAAM,IAAI,KAAK,CAAC,yCAAyC,YAAY,gDAAgD,CAAC,CAAA;IACxH,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,IAA0B,EAAE,KAA+B,EAAE,OAAe;IACnG,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WACnH,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC;WACvG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;WAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;AAChJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA+B,EAAE,OAAgD;IAClG,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAChF,OAAO,IAAI,wBAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,IAA0B,IAAa,OAAO,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAA,CAAC,CAAC;AAE9H,KAAK,UAAU,eAAe,CAAC,KAAwB,EAAE,KAA+B,EAAE,IAA0B,EAAE,SAAiB;IACrI,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACrD,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAM;QAC1I,0EAA0E;QAC1E,yEAAyE;QACzE,QAAQ,GAAG,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAA;IAC5K,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;IAC7I,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,EAAE,uBAAuB,EAAE,CAAC;QAC3F,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;IACrK,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAQxC;IACC,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACpE,IAAI,UAAU,GAAG,OAAO,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACzG,IAAI,CAAC;QACH,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACpG,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAkB,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAA;QAC5K,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChF,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,oCAAoC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;eAClD,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,KAAK,wBAAwB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACvK,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;QAC3G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3E,IAAI,IAAI,GAAG,OAAO,CAAA;QAClB,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;QAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,mBAAmB,EAAE,QAAQ,CAAC,YAAY;gBAClM,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBACnH,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAC9J,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,mBAAmB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;QACpN,CAAC;QACD,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;QAAC,UAAU,GAAG,IAAI,CAAA;QAC/G,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACxJ,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YACtD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC/H,IAAI,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAA;YACrC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAA;YACvG,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,iBAAiB;oBAAE,OAAO,OAAO,CAAA;gBACrC,iBAAiB,GAAG,IAAI,CAAA;gBACxB,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACjF,IAAI,eAAe,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;gBACrH,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,wBAAiC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAA;gBAC3K,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;oBAC7F,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;oBAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;wBAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;oBAC3M,OAAO,MAAM,CAAA;gBACf,CAAC,EAAE,MAAM,CAAC,CAAA;gBACV,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;gBAAC,MAAM,CAAC,cAAc,EAAE,CAAA;gBACtD,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO;oBACnG,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,cAAc,EAAE,4BAA4B,OAAO,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;YACrL,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAClC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBACjI,CAAC;qBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;oBAC/C,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBAC/C,OAAO,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBACjJ,CAAC;gBACD,sEAAsE;gBACtE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC1C,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,IAAI,OAAO,CAAC,UAAU,EAAE,uBAAuB,EAAE,CAAC;gBAChG,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACvL,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACzJ,IAAI,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YACjJ,CAAC;iBAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;gBAC/H,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACvL,CAAC;;gBAAM,OAAO,OAAO,CAAA;YACrB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,KAAK,MAAM,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;QAChI,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC5B,yEAAyE;oBACzE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO;wBAAE,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;gBAC/E,CAAC;;oBAAM,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACzH,CAAC;YAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/lib/source-approval-authority.d.ts

@@ -0,0 +1,50 @@
+import type { SourceJobOwnerReceipt } from './source-job-types.js';
+import type { ApprovalReceipt, PluginSourcePlan } from './types.js';
+export interface SourceApprovalRequest {
+    protocol: 'dsh-source-approval/v1';
+    planId: string;
+    planDigest: string;
+    sourceReferenceDigest: string;
+}
+export interface SourceApprovalAuthorityConfig {
+    schemaVersion: 1;
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    statePath: string;
+    controlDatabasePath: string;
+    grant: {
+        id: string;
+        expiresAt: number;
+        maxApprovals: number;
+        repository: string;
+        worktreeRoot: string;
+        owner: Pick<SourceJobOwnerReceipt, 'authorityId' | 'authorityHash' | 'principalId' | 'principalRecordId' | 'principalVersion' | 'workspace' | 'agentPreset'>;
+        plugins: readonly string[];
+        maxChangedFiles: number;
+        maxChangedBytes: number;
+        receiptTtlMs: number;
+        /** Independently authorize only the deterministic Host-owned version delta. */
+        versioning?: 'patch';
+    };
+}
+export declare function sourceAuthorityCanonicalSafePath(path: string, kind: 'file' | 'directory', createFile?: boolean): string;
+export declare function sourceAuthorityCanonicalRepository(path: string): string;
+export declare function sourceAuthorityReadSafeFile(path: string, maximum: number): Buffer;
+export declare function sourceAuthorityEnvironment(): NodeJS.ProcessEnv;
+export declare function validateSourceApprovalAuthorityConfig(value: unknown): asserts value is SourceApprovalAuthorityConfig;
+export declare function sourceAuthorityValidatePrepared(plan: PluginSourcePlan, now: number, status?: PluginSourcePlan['status']): void;
+export interface SourceAuthorityWorktreeGrant {
+    repository: string;
+    worktreeRoot: string;
+    plugins: readonly string[];
+    maxChangedFiles: number;
+    maxChangedBytes: number;
+    versioning?: 'patch';
+}
+export declare function sourceAuthorityValidateWorktree(plan: PluginSourcePlan, grant: SourceAuthorityWorktreeGrant): Promise<void>;
+/** Sign a finite, freshly rechecked source approval. It cannot approve a release or activation. */
+export declare function authorizePreparedSource(configInput: SourceApprovalAuthorityConfig, requestInput: SourceApprovalRequest): Promise<ApprovalReceipt>;
+/** CLI entrypoint: exactly --config <absolute-path>, one bounded JSON request on stdin, one receipt on stdout. */
+export declare function runSourceApprovalAuthority(argv?: string[]): Promise<void>;
+//# sourceMappingURL=source-approval-authority.d.ts.map

package/lib/source-approval-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-approval-authority.d.ts","sourceRoot":"","sources":["../src/source-approval-authority.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAWnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,wBAAwB,CAAA;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,CAAC,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAA;QACV,SAAS,EAAE,MAAM,CAAA;QACjB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,eAAe,GAAG,aAAa,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,WAAW,GAAG,aAAa,CAAC,CAAA;QAC5J,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,eAAe,EAAE,MAAM,CAAA;QACvB,eAAe,EAAE,MAAM,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,+EAA+E;QAC/E,UAAU,CAAC,EAAE,OAAO,CAAA;KACrB,CAAA;CACF;AAkCD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,UAAU,UAAQ,GAAG,MAAM,CAiBrH;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOvE;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAWjF;AAQD,wBAAgB,0BAA0B,IAAI,MAAM,CAAC,UAAU,CAK9D;AASD,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,6BAA6B,CAiBpH;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,gBAAgB,CAAC,QAAQ,CAAsB,GAAG,IAAI,CAclJ;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC7I;AAED,wBAAsB,+BAA+B,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChI;AA0BD,mGAAmG;AACnG,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,6BAA6B,EAAE,YAAY,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA0DvJ;AAYD,kHAAkH;AAClH,wBAAsB,0BAA0B,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5F"}