@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/source-release-authority.d.ts

@@ -0,0 +1,35 @@
+import { type SourceAuthorityWorktreeGrant } from './source-approval-authority.js';
+import type { SourceJobOwnerReceipt } from './source-job-types.js';
+import type { SourceReleaseAuthorization, SourceReleasePolicy } from './types.js';
+type PolicyConfig = Omit<SourceReleasePolicy, 'packageVersion' | 'registryReference'>;
+export interface SourceReleaseAuthorityRequest {
+    protocol: 'dsh-source-release-authorization/v1';
+    planId: string;
+    planDigest: string;
+    sourceReferenceDigest: string;
+}
+export interface SourceReleaseAuthorityConfig {
+    schemaVersion: 1;
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    statePath: string;
+    controlDatabasePath: string;
+    grant: SourceAuthorityWorktreeGrant & {
+        id: string;
+        expiresAt: number;
+        maxReleases: number;
+        owner: Pick<SourceJobOwnerReceipt, 'authorityId' | 'authorityHash' | 'principalId' | 'principalRecordId' | 'principalVersion' | 'workspace' | 'agentPreset'>;
+        receiptTtlMs: number;
+        versioning: 'patch';
+        policies: readonly PolicyConfig[];
+    };
+}
+export declare class SourceReleaseAuthorityError extends Error {
+    constructor(message?: string);
+}
+export declare function validateSourceReleaseAuthorityConfig(value: unknown): asserts value is SourceReleaseAuthorityConfig;
+export declare function authorizePreparedSourceRelease(configInput: SourceReleaseAuthorityConfig, requestInput: SourceReleaseAuthorityRequest): Promise<SourceReleaseAuthorization>;
+export declare function runSourceReleaseAuthority(argv?: string[]): Promise<void>;
+export {};
+//# sourceMappingURL=source-release-authority.d.ts.map

package/lib/source-release-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-release-authority.d.ts","sourceRoot":"","sources":["../src/source-release-authority.ts"],"names":[],"mappings":"AAMA,OAAO,EAEwD,KAAK,4BAA4B,EAC/F,MAAM,gCAAgC,CAAA;AAIvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAKjF,KAAK,YAAY,GAAG,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,GAAG,mBAAmB,CAAC,CAAA;AAErF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,qCAAqC,CAAA;IAC/C,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,CAAC,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE,4BAA4B,GAAG;QACpC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;QAClD,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,eAAe,GAAG,aAAa,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,WAAW,GAAG,aAAa,CAAC,CAAA;QAC5J,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;KAC7E,CAAA;CACF;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,SAAiD;CACrE;AAiCD,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,4BAA4B,CAclH;AA0CD,wBAAsB,8BAA8B,CAAC,WAAW,EAAE,4BAA4B,EAAE,YAAY,EAAE,6BAA6B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAyChL;AAED,wBAAsB,yBAAyB,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3F"}

package/lib/source-release-authority.js

@@ -0,0 +1,271 @@
+/** Owner-operated finite signer for a checked local source release authorization. It never executes a release phase. */
+import { createHash, createPrivateKey, sign } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { parseSourceReleaseAuthorization, sourceReleaseAuthorizationSigningPayload } from './release.js';
+import { sourceAuthorityCanonicalSafePath, sourceAuthorityReadSafeFile, sourceAuthorityValidatePrepared, sourceAuthorityValidateWorktree, sourceAuthorityEnvironment, } from './source-approval-authority.js';
+import { controlPlaneDigest, readOwnerPreparedSourcePlan } from './store.js';
+import { verifyManagedPatchVersion } from './source-versioning.js';
+import { PROTECTED_PLUGIN_DENYLIST } from './source-workspace.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const DIGEST = /^[a-f0-9]{64}$/u;
+const MAX_CONFIG_BYTES = 65_536;
+const MAX_REQUEST_BYTES = 8_192;
+const MAX_KEY_BYTES = 32_768;
+export class SourceReleaseAuthorityError extends Error {
+    constructor(message = 'source release authority refused the request') { super(message); this.name = 'SourceReleaseAuthorityError'; }
+}
+function fail() { throw new SourceReleaseAuthorityError(); }
+function object(value) { if (!value || typeof value !== 'object' || Array.isArray(value))
+    fail(); return value; }
+function keys(value, expected) { if (Object.keys(value).sort().join('\0') !== [...expected].sort().join('\0'))
+    fail(); }
+function text(value, pattern = ID, max = 4096) { if (typeof value !== 'string' || value.normalize('NFC').trim() !== value || !pattern.test(value) || Buffer.byteLength(value) > max || /[\p{Cc}]/u.test(value))
+    fail(); return value; }
+function integer(value, min, max = Number.MAX_SAFE_INTEGER) { if (!Number.isSafeInteger(value) || Number(value) < min || Number(value) > max)
+    fail(); return Number(value); }
+function path(value) { const result = text(value, /^[\s\S]+$/u); if (!result.startsWith('/') || resolve(result) !== result)
+    fail(); return result; }
+function sameOwner(left, right) {
+    return left.authorityId === right.authorityId && left.authorityHash === right.authorityHash && left.principalId === right.principalId
+        && left.principalRecordId === right.principalRecordId && left.principalVersion === right.principalVersion
+        && left.workspace === right.workspace && left.agentPreset === right.agentPreset;
+}
+function policy(value, plugins) {
+    const item = object(value);
+    const fields = ['targetBranch', 'candidateId', 'packageName', 'packagePath', 'dshBaseline', 'capabilities', 'authorities', 'requires', 'registryId', 'registryLocator', 'catalogId', 'catalogPath', 'minimumReproducibleBuilds'];
+    keys(item, fields);
+    const candidateId = text(item.candidateId, /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u, 64);
+    if (!plugins.includes(candidateId) || item.packageName !== `@dsh-enhanced/${candidateId}` || item.packagePath !== `plugins/${candidateId}`)
+        fail();
+    const locator = text(item.registryLocator, /^[\s\S]+$/u);
+    registryRoot(locator);
+    sourceAuthorityCanonicalSafePath(path(item.catalogPath), 'file');
+    // Parse a complete envelope through the production policy parser now. The
+    // two deliberately dynamic fields are replaced before the real signature.
+    const envelope = { schemaVersion: 1, kind: 'dsh-source-release-authorization', authorizationId: 'config-policy', authority: 'config', keyId: 'config',
+        planId: 'config-plan', planDigest: 'a'.repeat(64), baseCommit: 'b'.repeat(40), checkedTreeDigest: 'c'.repeat(64), checkedPatchDigest: 'd'.repeat(64),
+        scope: [`plugins/${candidateId}`], releasePolicy: { ...item, packageVersion: '0.0.1', registryReference: 'file:///configured-reference' },
+        authorizedAt: 1, expiresAt: 2, signature: Buffer.alloc(64).toString('base64') };
+    try {
+        const parsed = parseSourceReleaseAuthorization(envelope);
+        const { packageVersion: _version, registryReference: _reference, ...staticPolicy } = parsed.releasePolicy;
+        return Object.freeze(staticPolicy);
+    }
+    catch {
+        fail();
+    }
+}
+export function validateSourceReleaseAuthorityConfig(value) {
+    const item = object(value);
+    keys(item, ['schemaVersion', 'authority', 'keyId', 'keyPath', 'statePath', 'controlDatabasePath', 'grant']);
+    if (item.schemaVersion !== 1)
+        fail();
+    text(item.authority);
+    text(item.keyId);
+    const keyPath = path(item.keyPath);
+    const statePath = path(item.statePath);
+    const control = path(item.controlDatabasePath);
+    if (new Set([keyPath, statePath, control]).size !== 3)
+        fail();
+    const grant = object(item.grant);
+    keys(grant, ['id', 'expiresAt', 'maxReleases', 'repository', 'worktreeRoot', 'owner', 'plugins', 'maxChangedFiles', 'maxChangedBytes', 'receiptTtlMs', 'versioning', 'policies']);
+    text(grant.id);
+    integer(grant.expiresAt, 1);
+    integer(grant.maxReleases, 1, 10_000);
+    path(grant.repository);
+    path(grant.worktreeRoot);
+    integer(grant.maxChangedFiles, 1, 256);
+    integer(grant.maxChangedBytes, 1, 16 * 1024 * 1024);
+    integer(grant.receiptTtlMs, 1_000, 86_400_000);
+    if (grant.versioning !== 'patch' || !Array.isArray(grant.plugins) || grant.plugins.length === 0 || grant.plugins.length > 32)
+        fail();
+    const plugins = grant.plugins.map(value => text(value, /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u, 64));
+    if (new Set(plugins).size !== plugins.length || plugins.some(value => PROTECTED_PLUGIN_DENYLIST.has(value)))
+        fail();
+    const owner = object(grant.owner);
+    keys(owner, ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset']);
+    text(owner.authorityId);
+    text(owner.authorityHash, DIGEST, 64);
+    text(owner.principalId, /^[\s\S]+$/u, 512);
+    text(owner.principalRecordId, /^[\s\S]+$/u, 512);
+    integer(owner.principalVersion, 1);
+    path(owner.workspace);
+    text(owner.agentPreset);
+    if (!Array.isArray(grant.policies) || grant.policies.length !== plugins.length)
+        fail();
+    const policies = grant.policies.map(value => policy(value, plugins));
+    if (new Set(policies.map(value => value.candidateId)).size !== policies.length)
+        fail();
+}
+function request(value) {
+    const item = object(value);
+    keys(item, ['protocol', 'planId', 'planDigest', 'sourceReferenceDigest']);
+    if (item.protocol !== 'dsh-source-release-authorization/v1')
+        fail();
+    return Object.freeze({ protocol: 'dsh-source-release-authorization/v1', planId: text(item.planId), planDigest: text(item.planDigest, DIGEST, 64), sourceReferenceDigest: text(item.sourceReferenceDigest, DIGEST, 64) });
+}
+function registryRoot(locator) {
+    let raw;
+    try {
+        raw = fileURLToPath(locator);
+    }
+    catch {
+        fail();
+    }
+    const canonical = sourceAuthorityCanonicalSafePath(raw, 'directory');
+    if (pathToFileURL(canonical).href !== locator)
+        fail();
+    return canonical;
+}
+function releaseAuthorization(config, plan, policyInput, version, privateKey, now, expiresAt) {
+    const root = registryRoot(policyInput.registryLocator);
+    sourceAuthorityCanonicalSafePath(policyInput.catalogPath, 'file');
+    const packageName = `@dsh-enhanced/${plan.name}`;
+    const registryReference = pathToFileURL(join(root, 'packages', encodeURIComponent(packageName), version, 'package.tgz')).href;
+    const releasePolicy = { ...policyInput, candidateId: plan.name, packageName, packagePath: `plugins/${plan.name}`, packageVersion: version, registryReference };
+    const unsigned = { schemaVersion: 1, kind: 'dsh-source-release-authorization',
+        authorizationId: `source-release-${controlPlaneDigest({ grant: config.grant.id, plan: plan.id, version }).slice(0, 40)}`,
+        authority: config.authority, keyId: config.keyId, planId: plan.id, planDigest: plan.digest, baseCommit: plan.baseCommit,
+        checkedTreeDigest: plan.sourceCheck.treeDigest, checkedPatchDigest: plan.sourceCheck.patchDigest, scope: plan.scope,
+        releasePolicy, authorizedAt: now, expiresAt };
+    const authorization = { ...unsigned, signature: sign(null, Buffer.from(sourceReleaseAuthorizationSigningPayload(unsigned)), privateKey).toString('base64') };
+    try {
+        return parseSourceReleaseAuthorization(authorization);
+    }
+    catch {
+        fail();
+    }
+}
+function ledger(path) {
+    sourceAuthorityCanonicalSafePath(path, 'file', true);
+    const db = new DatabaseSync(path);
+    db.exec(`PRAGMA busy_timeout = 5000; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;
+    CREATE TABLE IF NOT EXISTS source_release_grants (grant_id TEXT PRIMARY KEY, config_digest TEXT NOT NULL, key_fingerprint TEXT NOT NULL) STRICT;
+    CREATE TABLE IF NOT EXISTS source_release_receipts (request_digest TEXT PRIMARY KEY, grant_id TEXT NOT NULL, config_digest TEXT NOT NULL, plan_id TEXT NOT NULL UNIQUE, plan_digest TEXT NOT NULL, receipt_json TEXT NOT NULL, receipt_digest TEXT NOT NULL) STRICT;`);
+    return db;
+}
+export async function authorizePreparedSourceRelease(configInput, requestInput) {
+    try {
+        validateSourceReleaseAuthorityConfig(configInput);
+        const config = configInput;
+        const requested = request(requestInput);
+        const now = Date.now();
+        if (now >= config.grant.expiresAt)
+            fail();
+        const keyBytes = sourceAuthorityReadSafeFile(config.keyPath, MAX_KEY_BYTES);
+        let privateKey;
+        try {
+            privateKey = createPrivateKey(keyBytes);
+        }
+        catch {
+            fail();
+        }
+        ;
+        if (privateKey.asymmetricKeyType !== 'ed25519')
+            fail();
+        const configDigest = controlPlaneDigest(config);
+        const keyFingerprint = createHash('sha256').update(keyBytes).digest('hex');
+        const control = new DatabaseSync(sourceAuthorityCanonicalSafePath(config.controlDatabasePath, 'file'), { readOnly: true });
+        let source;
+        let version;
+        try {
+            control.exec('PRAGMA query_only = ON;');
+            source = readOwnerPreparedSourcePlan(control, requested.planId);
+            if (source.plan.digest !== requested.planDigest || controlPlaneDigest(source.source) !== requested.sourceReferenceDigest || !sameOwner(source.source.owner, config.grant.owner))
+                fail();
+            if (source.plan.approval === undefined || source.plan.approval.decision !== 'approved')
+                fail();
+            sourceAuthorityValidatePrepared(source.plan, now, 'ready-for-human-review');
+            await sourceAuthorityValidateWorktree(source.plan, config.grant);
+            version = (await verifyManagedPatchVersion({ worktree: source.plan.worktree, baseCommit: source.plan.baseCommit, name: source.plan.name,
+                environment: sourceAuthorityEnvironment() })).version;
+            if (source.plan.preparedEvidence.pack.version !== version)
+                fail();
+            const final = readOwnerPreparedSourcePlan(control, requested.planId);
+            if (final.plan.status !== 'ready-for-human-review' || final.plan.digest !== source.plan.digest || controlPlaneDigest(final.source) !== controlPlaneDigest(source.source))
+                fail();
+        }
+        finally {
+            control.close();
+        }
+        const selected = config.grant.policies.find(value => value.candidateId === source.plan.name);
+        if (!selected)
+            fail();
+        const state = ledger(config.statePath);
+        try {
+            state.exec('BEGIN IMMEDIATE');
+            try {
+                const current = Date.now();
+                if (current >= config.grant.expiresAt)
+                    fail();
+                sourceAuthorityValidatePrepared(source.plan, current, 'ready-for-human-review');
+                const expiresAt = Math.min(current + config.grant.receiptTtlMs, config.grant.expiresAt, source.plan.expiresAt);
+                if (expiresAt <= current)
+                    fail();
+                const grant = state.prepare('SELECT config_digest, key_fingerprint FROM source_release_grants WHERE grant_id = ?').get(config.grant.id);
+                if (!grant)
+                    state.prepare('INSERT INTO source_release_grants (grant_id, config_digest, key_fingerprint) VALUES (?, ?, ?)').run(config.grant.id, configDigest, keyFingerprint);
+                else if (grant.config_digest !== configDigest || grant.key_fingerprint !== keyFingerprint)
+                    fail();
+                const digest = controlPlaneDigest(requested);
+                const prior = state.prepare('SELECT * FROM source_release_receipts WHERE request_digest = ?').get(digest);
+                if (prior) {
+                    if (prior.grant_id !== config.grant.id || prior.config_digest !== configDigest || prior.plan_id !== requested.planId || prior.plan_digest !== requested.planDigest || prior.receipt_digest !== controlPlaneDigest(prior.receipt_json))
+                        fail();
+                    const replay = parseSourceReleaseAuthorization(JSON.parse(prior.receipt_json));
+                    if (replay.expiresAt <= current || replay.authority !== config.authority || replay.keyId !== config.keyId)
+                        fail();
+                    state.exec('COMMIT');
+                    return replay;
+                }
+                if (state.prepare('SELECT 1 FROM source_release_receipts WHERE plan_id = ?').get(requested.planId) || state.prepare('SELECT COUNT(*) AS count FROM source_release_receipts WHERE grant_id = ?').get(config.grant.id).count >= config.grant.maxReleases)
+                    fail();
+                const authorization = releaseAuthorization(config, source.plan, selected, version, privateKey, current, expiresAt);
+                const json = JSON.stringify(authorization);
+                state.prepare('INSERT INTO source_release_receipts (request_digest, grant_id, config_digest, plan_id, plan_digest, receipt_json, receipt_digest) VALUES (?, ?, ?, ?, ?, ?, ?)')
+                    .run(digest, config.grant.id, configDigest, requested.planId, requested.planDigest, json, controlPlaneDigest(json));
+                state.exec('COMMIT');
+                return authorization;
+            }
+            catch (error) {
+                try {
+                    state.exec('ROLLBACK');
+                }
+                catch { }
+                throw error;
+            }
+        }
+        finally {
+            state.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof SourceReleaseAuthorityError)
+            throw error;
+        throw new SourceReleaseAuthorityError();
+    }
+}
+export async function runSourceReleaseAuthority(argv = process.argv.slice(2)) {
+    try {
+        if (argv.length !== 2 || argv[0] !== '--config')
+            fail();
+        const bytes = sourceAuthorityReadSafeFile(path(argv[1]), MAX_CONFIG_BYTES);
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            if ((size += value.length) > MAX_REQUEST_BYTES)
+                fail();
+            chunks.push(value);
+        }
+        const config = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        const input = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+        process.stdout.write(`${JSON.stringify(await authorizePreparedSourceRelease(config, input))}\n`);
+    }
+    catch {
+        throw new SourceReleaseAuthorityError();
+    }
+}
+//# sourceMappingURL=source-release-authority.js.map

package/lib/source-release-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-release-authority.js","sourceRoot":"","sources":["../src/source-release-authority.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACvD,OAAO,EAAE,+BAA+B,EAAE,wCAAwC,EAAE,MAAM,cAAc,CAAA;AACxG,OAAO,EACL,gCAAgC,EAAE,2BAA2B,EAAE,+BAA+B,EAC9F,+BAA+B,EAAE,0BAA0B,GAC5D,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAIjE,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAAC,MAAM,aAAa,GAAG,MAAM,CAAA;AAwB9F,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAO,GAAG,8CAA8C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA,CAAC,CAAC;CACpI;AACD,SAAS,IAAI,KAAY,MAAM,IAAI,2BAA2B,EAAE,CAAA,CAAC,CAAC;AAClE,SAAS,MAAM,CAAC,KAAc,IAA6B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC,OAAO,KAAgC,CAAA,CAAC,CAAC;AAC7K,SAAS,IAAI,CAAC,KAA8B,EAAE,QAA2B,IAAU,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;IAAE,IAAI,EAAE,CAAA,CAAC,CAAC;AACzK,SAAS,IAAI,CAAC,KAAc,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,GAAG,IAAI,IAAY,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC,OAAO,KAAK,CAAA,CAAC,CAAC;AACvP,SAAS,OAAO,CAAC,KAAc,EAAE,GAAW,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAY,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;IAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AACrM,SAAS,IAAI,CAAC,KAAc,IAAY,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM;IAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAA,CAAC,CAAC;AACpK,SAAS,SAAS,CAAC,IAA2B,EAAE,KAAqD;IACnG,OAAO,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WAChI,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;WACtG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAA;AACnF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,OAA0B;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,2BAA2B,CAAC,CAAA;IAC5P,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAA;IAClF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,WAAW,EAAE;QAAE,IAAI,EAAE,CAAA;IAClJ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC/E,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;IAChE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;QACnJ,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpJ,KAAK,EAAE,CAAC,WAAW,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,8BAA8B,EAAE;QACzI,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACjF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAA;QACxD,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,aAAa,CAAA;QACzG,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,EAAE,CAAA;IAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAA;IACvI,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,IAAI,EAAE,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC1H,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;IACnN,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACpI,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IAC3I,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,IAAI,EAAE,CAAA;IACpI,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;IACpN,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;IACpK,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAChP,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,IAAI,EAAE,CAAA;IACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,IAAI,EAAE,CAAA;AAC9J,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAA;IACrG,IAAI,IAAI,CAAC,QAAQ,KAAK,qCAAqC;QAAE,IAAI,EAAE,CAAA;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,qCAAqC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;AAC1N,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QAAC,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,EAAE,CAAA;IAAC,CAAC;IACrD,MAAM,SAAS,GAAG,gCAAgC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACpE,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,IAAI,EAAE,CAAA;IACrD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAoC,EAAE,IAA4D,EAAE,WAAyB,EACzJ,OAAe,EAAE,UAA+C,EAAE,GAAW,EAAE,SAAiB;IAChG,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;IACtD,gCAAgC,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACjE,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,iBAAiB,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,kBAAkB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7H,MAAM,aAAa,GAAG,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC9J,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,IAAI,EAAE,kCAA2C;QAC7F,eAAe,EAAE,kBAAkB,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACxH,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;QACvH,iBAAiB,EAAE,IAAI,CAAC,WAAY,CAAC,UAAU,EAAE,kBAAkB,EAAE,IAAI,CAAC,WAAY,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;QACrH,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IAC/C,MAAM,aAAa,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC5J,IAAI,CAAC;QAAC,OAAO,+BAA+B,CAAC,aAAa,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,IAAI,EAAE,CAAA;IAAC,CAAC;AAChF,CAAC;AAGD,SAAS,MAAM,CAAC,IAAY;IAC1B,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACpD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAA;IACjC,EAAE,CAAC,IAAI,CAAC;;yQAE+P,CAAC,CAAA;IACxQ,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,WAAyC,EAAE,YAA2C;IACzI,IAAI,CAAC;QACH,oCAAoC,CAAC,WAAW,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,WAAW,CAAC;QAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS;YAAE,IAAI,EAAE,CAAA;QACzL,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAAC,IAAI,UAA+C,CAAA;QAChI,IAAI,CAAC;YAAC,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAA,CAAC;QAAC,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS;YAAE,IAAI,EAAE,CAAA;QACxH,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3H,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,gCAAgC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1H,IAAI,MAAsD,CAAC;QAAC,IAAI,OAAe,CAAA;QAC/E,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAAC,MAAM,GAAG,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;YACxG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,UAAU,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,IAAI,EAAE,CAAA;YACvL,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,UAAU;gBAAE,IAAI,EAAE,CAAC;YAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;YAAC,MAAM,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YAC7O,OAAO,GAAG,CAAC,MAAM,yBAAyB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBACrI,WAAW,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;YACvD,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAiB,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,EAAE,CAAA;YAClE,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;YACpE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,wBAAwB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,EAAE,CAAA;QAClL,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ;YAAE,IAAI,EAAE,CAAA;QACnH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS;oBAAE,IAAI,EAAE,CAAC;gBAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAA;gBAC1J,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,IAAI,SAAS,IAAI,OAAO;oBAAE,IAAI,EAAE,CAAA;gBAChJ,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,qFAAqF,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAmE,CAAA;gBACzM,IAAI,CAAC,KAAK;oBAAE,KAAK,CAAC,OAAO,CAAC,+FAA+F,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAA;qBACxK,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,eAAe,KAAK,cAAc;oBAAE,IAAI,EAAE,CAAA;gBACjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAAC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,MAAM,CAA8B,CAAA;gBACpL,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,KAAK,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC;wBAAE,IAAI,EAAE,CAAA;oBAC7O,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAY,CAAC,CAAC;oBAAC,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;wBAAE,IAAI,EAAE,CAAA;oBAC5M,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAC,OAAO,MAAM,CAAA;gBACrC,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAK,KAAK,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAuB,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW;oBAAE,IAAI,EAAE,CAAA;gBACrR,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;gBAC9J,KAAK,CAAC,OAAO,CAAC,gKAAgK,CAAC;qBAC5K,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,OAAO,aAAa,CAAA;YACnK,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBAAC,MAAM,KAAK,CAAA;YAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK,YAAY,2BAA2B;YAAE,MAAM,KAAK,CAAC;QAAC,MAAM,IAAI,2BAA2B,EAAE,CAAA;IAAC,CAAC;AAC5H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,IAAI,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACnI,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAAC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,iBAAiB;gBAAE,IAAI,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC;QACrO,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAY,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAY,CAAA;QAC3M,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,8BAA8B,CAAC,MAAsC,EAAE,KAAsC,CAAC,CAAC,IAAI,CAAC,CAAA;IACnK,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,2BAA2B,EAAE,CAAA;IAAC,CAAC;AACrD,CAAC"}

package/lib/source-release-client.d.ts

@@ -0,0 +1,10 @@
+import { type SourceApprovalClientConfig, type SourceAuthorityRequest } from './source-approval-client.js';
+import type { SourceReleaseAuthorization } from './types.js';
+export type SourceReleaseClientConfig = SourceApprovalClientConfig;
+export declare function validateSourceReleaseClientConfig(value: unknown): asserts value is SourceReleaseClientConfig;
+export interface SourceReleaseAuthorizationRequest extends Omit<SourceAuthorityRequest, 'protocol'> {
+    protocol: 'dsh-source-release-authorization/v1';
+}
+/** Uses the existing owned subprocess transport; this helper cannot run release phases. */
+export declare function requestSourceReleaseAuthorization(config: SourceReleaseClientConfig, request: SourceReleaseAuthorizationRequest, signal?: AbortSignal): Promise<SourceReleaseAuthorization>;
+//# sourceMappingURL=source-release-client.d.ts.map

package/lib/source-release-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-release-client.d.ts","sourceRoot":"","sources":["../src/source-release-client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AACnG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AAClE,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,yBAAyB,CAE5G;AACD,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAAC;IACjG,QAAQ,EAAE,qCAAqC,CAAA;CAChD;AAED,2FAA2F;AAC3F,wBAAsB,iCAAiC,CAAC,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EACnI,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAY3D"}

package/lib/source-release-client.js

@@ -0,0 +1,24 @@
+import { parseSourceReleaseAuthorization } from './release.js';
+import { requestSourceAuthorityReceipt, SourceApprovalClientError, validateSourceApprovalClientConfig } from './source-approval-client.js';
+export function validateSourceReleaseClientConfig(value) {
+    validateSourceApprovalClientConfig(value);
+}
+/** Uses the existing owned subprocess transport; this helper cannot run release phases. */
+export async function requestSourceReleaseAuthorization(config, request, signal) {
+    if (request?.protocol !== 'dsh-source-release-authorization/v1')
+        throw new SourceApprovalClientError('FAILED', 'source release request protocol is invalid');
+    return requestSourceAuthorityReceipt(config, request, value => {
+        let authorization;
+        try {
+            authorization = parseSourceReleaseAuthorization(value);
+        }
+        catch {
+            throw new SourceApprovalClientError('FAILED', 'source release authority returned an invalid authorization');
+        }
+        if (authorization.planId !== request.planId || authorization.planDigest !== request.planDigest) {
+            throw new SourceApprovalClientError('FAILED', 'source release authorization targets another plan');
+        }
+        return authorization;
+    }, signal);
+}
+//# sourceMappingURL=source-release-client.js.map

package/lib/source-release-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-release-client.js","sourceRoot":"","sources":["../src/source-release-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,kCAAkC,EACrC,MAAM,6BAA6B,CAAA;AAInG,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,kCAAkC,CAAC,KAAK,CAAC,CAAA;AAC3C,CAAC;AAKD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,MAAiC,EAAE,OAA0C,EACnI,MAAoB;IACpB,IAAI,OAAO,EAAE,QAAQ,KAAK,qCAAqC;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,EAAE,4CAA4C,CAAC,CAAA;IAC5J,OAAO,6BAA6B,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;QAC5D,IAAI,aAAyC,CAAA;QAC7C,IAAI,CAAC;YAAC,aAAa,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YACpE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,EAAE,4DAA4D,CAAC,CAAA;QAC7G,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/F,MAAM,IAAI,yBAAyB,CAAC,QAAQ,EAAE,mDAAmD,CAAC,CAAA;QACpG,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,EAAE,MAAM,CAAC,CAAA;AACZ,CAAC"}

package/lib/source-release-runner.d.ts

@@ -0,0 +1,31 @@
+import { Ed25519SourceReleaseAuthority } from './release.js';
+import { type ControlPlaneStore } from './store.js';
+import { type PluginControlTrustConfig } from './trust.js';
+import type { PluginSourcePlan, SourceReleaseAuthorization, SourceReleaseReceipt, SourceReleaseRequest } from './types.js';
+export interface SourceReleaseExecutionConfig {
+    /** Independently produced decisions consumed by the configured local review adapter. */
+    reviewDecisionRoot: string;
+    timeoutMs: number;
+    /** Ask the independently configured Host Verifier to produce a missing decision. */
+    independentReview?: boolean;
+}
+export declare function validateSourceReleaseExecutionConfig(value: SourceReleaseExecutionConfig): void;
+export declare function sourceReleaseAuthorities(trust: PluginControlTrustConfig): {
+    authorize: (value: SourceReleaseAuthorization) => {
+        verify: (authorization: SourceReleaseAuthorization, plan: PluginSourcePlan) => Promise<import("./types.js").VerifiedSourceReleaseAuthorization>;
+    };
+    authority: (value: SourceReleaseReceipt) => Ed25519SourceReleaseAuthority;
+};
+export declare function advanceSourceRelease(options: {
+    store: ControlPlaneStore;
+    planId: string;
+    trust: PluginControlTrustConfig;
+    config: SourceReleaseExecutionConfig;
+    signal: AbortSignal;
+    assertCurrent: () => Promise<void>;
+    withSourceFence: <T>(callback: () => T) => T;
+    review?: (request: Extract<SourceReleaseRequest, {
+        phase: 'review';
+    }>, plan: PluginSourcePlan) => Promise<void>;
+}): Promise<PluginSourcePlan>;
+//# sourceMappingURL=source-release-runner.d.ts.map

package/lib/source-release-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-release-runner.d.ts","sourceRoot":"","sources":["../src/source-release-runner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAA0E,MAAM,cAAc,CAAA;AAEpI,OAAO,EAA6C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9F,OAAO,EAAmB,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE1H,MAAM,WAAW,4BAA4B;IAC3C,wFAAwF;IACxF,kBAAkB,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AACD,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,4BAA4B,GAAG,IAAI,CAU9F;AAoBD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB;uBAC5C,0BAA0B;gCAGjB,0BAA0B,QAAQ,gBAAgB;;uBAK3D,oBAAoB;EAQ/C;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,KAAK,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IAAC,MAAM,EAAE,4BAA4B,CAAA;IAC/G,MAAM,EAAE,WAAW,CAAC;IAAC,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,eAAe,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;IACrG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE;QAAE,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAChH,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqD5B"}

package/lib/source-release-runner.js

@@ -0,0 +1,125 @@
+/** Host continuation of the existing release phases. No scheduler or review authority. */
+import { lstatSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { loadCatalogWithMetadata, previewCatalogAdmission } from './catalog.js';
+import { Ed25519SourceReleaseAuthority, Ed25519SourceReleaseAuthorizationAuthority, invokeSourceReleaseAdapter } from './release.js';
+import { sourceAuthorityCanonicalSafePath, sourceAuthorityReadSafeFile } from './source-approval-authority.js';
+import { controlPlaneDigest, expectedSourceRelease } from './store.js';
+import { resolveTrustKey } from './trust.js';
+export function validateSourceReleaseExecutionConfig(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || Object.keys(value).some(key => !['reviewDecisionRoot', 'timeoutMs', 'independentReview'].includes(key))
+        || (value.independentReview !== undefined && typeof value.independentReview !== 'boolean')
+        || typeof value.reviewDecisionRoot !== 'string' || !isAbsolute(value.reviewDecisionRoot)
+        || resolve(value.reviewDecisionRoot) !== value.reviewDecisionRoot
+        || !Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 1000 || value.timeoutMs > 1_800_000) {
+        throw new Error('plugin-control-plane: invalid sourceReleaseExecution config');
+    }
+    sourceAuthorityCanonicalSafePath(value.reviewDecisionRoot, 'directory');
+}
+/** A missing decision is a normal wait, never an attempted or self-approved review. */
+function hasIndependentReview(request, root) {
+    if (request.phase !== 'review')
+        return true;
+    sourceAuthorityCanonicalSafePath(root, 'directory');
+    const path = join(root, `${request.input.prId}.json`);
+    try {
+        lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    const decision = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(sourceAuthorityReadSafeFile(path, 8192)));
+    const expected = { schemaVersion: 1, kind: 'dsh-local-review-decision', prId: request.input.prId,
+        baseCommit: request.input.baseCommit, headCommit: request.input.headCommit, prEvidenceDigest: request.input.prEvidenceDigest,
+        decision: 'approved', reviewerPrincipal: decision?.reviewerPrincipal };
+    if (typeof expected.reviewerPrincipal !== 'string' || expected.reviewerPrincipal.trim() === '' || expected.reviewerPrincipal.length > 500
+        || controlPlaneDigest(decision) !== controlPlaneDigest(expected))
+        throw new Error('independent review decision does not match the current release');
+    return true;
+}
+export function sourceReleaseAuthorities(trust) {
+    const authorize = (value) => {
+        const key = resolveTrustKey(trust, 'release-authorization', value.authority, value.keyId);
+        const verifier = new Ed25519SourceReleaseAuthorizationAuthority(key.publicKeyPem, key.authority, key.keyId);
+        return { verify: (authorization, plan) => {
+                const { signatureDigest: _digest, ...signed } = authorization;
+                return verifier.verify(signed, plan);
+            } };
+    };
+    const authority = (value) => {
+        const key = resolveTrustKey(trust, 'release', value.authority, value.keyId);
+        return new Ed25519SourceReleaseAuthority(key.publicKeyPem, key.authority, key.keyId, Date.now, (id, keyId) => {
+            const verifier = trust.releaseAdapters?.['registry-verify'];
+            return verifier?.authority === id && verifier.keyId === keyId ? resolveTrustKey(trust, 'release', id, keyId).publicKeyPem : undefined;
+        });
+    };
+    return { authorize, authority };
+}
+export async function advanceSourceRelease(options) {
+    const { store, trust, signal, withSourceFence } = options;
+    if (trust.schemaVersion !== 4 || !trust.releaseRegistry?.locator.startsWith('file:'))
+        throw new Error('source release execution requires local schema-v4 trust');
+    const { authorize, authority } = sourceReleaseAuthorities(trust);
+    // Exactly the existing eight phases, with state/receipt recovery from the Store.
+    for (let step = 0; step < 8; step++) {
+        await options.assertCurrent();
+        signal.throwIfAborted();
+        const plan = store.getSourcePlan(options.planId), expected = expectedSourceRelease(plan.status);
+        if (!expected)
+            return plan;
+        if (!plan.release || !plan.releaseAuthorization)
+            throw new Error('source release has no authorization');
+        const adapter = trust.releaseAdapters?.[expected.phase];
+        if (!adapter)
+            throw new Error(`source release adapter missing: ${expected.phase}`);
+        if (plan.releaseAuthorization.releasePolicy.registryId !== trust.releaseRegistry.id
+            || plan.releaseAuthorization.releasePolicy.registryLocator !== trust.releaseRegistry.locator
+            || plan.releaseAuthorization.releasePolicy.catalogId !== trust.catalog.id
+            || plan.releaseAuthorization.releasePolicy.catalogPath !== trust.catalog.path)
+            throw new Error('source release trust changed');
+        let operation = store.findSourceReleaseOperation(plan.id, expected.phase, plan.release.fence);
+        if (!operation) {
+            let catalog = { id: trust.catalog.id, path: trust.catalog.path };
+            if (expected.phase === 'catalog-admission') {
+                const loaded = await loadCatalogWithMetadata(trust.catalog.path);
+                const preview = previewCatalogAdmission(loaded.catalog, store.previewSourceReleaseCandidate(plan.id));
+                catalog = { ...catalog, expectedBeforeDigest: preview.beforeCatalogDigest, expectedAfterDigest: preview.afterCatalogDigest };
+            }
+            await options.assertCurrent();
+            operation = await store.prepareSourceReleaseOperation({ planId: plan.id, expectedRevision: plan.revision, expectedFence: plan.release.fence,
+                installationId: trust.installationId, ledger: trust.ledger, registry: { id: trust.releaseRegistry.id, locator: trust.releaseRegistry.locator }, catalog,
+                adapter: { id: adapter.id, version: adapter.version, path: adapter.path, sha256: adapter.sha256, interpreter: adapter.interpreter, authority: adapter.authority, keyId: adapter.keyId },
+                receiptTtlMs: trust.releaseReceiptTtlMs, resolveAuthorizationAuthority: authorize, withSourceFence });
+        }
+        else if (controlPlaneDigest(operation.request.adapter) !== controlPlaneDigest({ id: adapter.id, version: adapter.version,
+            path: adapter.path, sha256: adapter.sha256, interpreter: adapter.interpreter, authority: adapter.authority, keyId: adapter.keyId })) {
+            throw new Error('source release adapter changed since preparation');
+        }
+        // A completed signed receipt can be applied even if the decision file was
+        // subsequently removed. Store still rechecks its exact request and source.
+        if (!operation.receipt && !hasIndependentReview(operation.request, options.config.reviewDecisionRoot)) {
+            if (options.config.independentReview && options.review && operation.request.phase === 'review') {
+                await options.assertCurrent();
+                signal.throwIfAborted();
+                await options.review(operation.request, plan);
+                await options.assertCurrent();
+                signal.throwIfAborted();
+            }
+            if (!hasIndependentReview(operation.request, options.config.reviewDecisionRoot))
+                return plan;
+        }
+        await options.assertCurrent();
+        const receipt = await store.runSourceReleaseOperation({ operationId: operation.operationId, expectedRevision: plan.revision,
+            expectedFence: plan.release.fence, resolveAuthority: authority, resolveAuthorizationAuthority: authorize, withSourceFence,
+            execute: async (request) => { await options.assertCurrent(); signal.throwIfAborted(); return invokeSourceReleaseAdapter(trust, request, signal); } });
+        await options.assertCurrent();
+        await store.applySourceRelease({ planId: plan.id, expectedRevision: plan.revision, expectedFence: plan.release.fence, receipt,
+            resolveAuthority: authority, idempotencyKey: `source-release:${operation.operationId}`, withSourceFence });
+    }
+    await options.assertCurrent();
+    return store.getSourcePlan(options.planId);
+}
+//# sourceMappingURL=source-release-runner.js.map

package/lib/source-release-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-release-runner.js","sourceRoot":"","sources":["../src/source-release-runner.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAC/E,OAAO,EAAE,6BAA6B,EAAE,0CAA0C,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACpI,OAAO,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAC9G,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAA0B,MAAM,YAAY,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAiC,MAAM,YAAY,CAAA;AAU3E,MAAM,UAAU,oCAAoC,CAAC,KAAmC;IACtF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACvG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC;WACvF,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC;WACrF,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,KAAK,CAAC,kBAAkB;WAC9D,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,SAAS,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,gCAAgC,CAAC,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAA;AACzE,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,OAA6B,EAAE,IAAY;IACvE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC3C,gCAAgC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACrC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACpE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAA4B,CAAA;IACjJ,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;QAC9F,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB;QAC5H,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IACxE,IAAI,OAAO,QAAQ,CAAC,iBAAiB,KAAK,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,GAAG;WACpI,kBAAkB,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACrJ,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAA+B;IACtE,MAAM,SAAS,GAAG,CAAC,KAAiC,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,uBAAuB,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QACzF,MAAM,QAAQ,GAAG,IAAI,0CAA0C,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3G,OAAO,EAAE,MAAM,EAAE,CAAC,aAAyC,EAAE,IAAsB,EAAE,EAAE;gBACrF,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,aAA0E,CAAA;gBAC1H,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACtC,CAAC,EAAE,CAAA;IACL,CAAC,CAAA;IACD,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3E,OAAO,IAAI,6BAA6B,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;YAC3G,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,iBAAiB,CAAC,CAAA;YAC3D,OAAO,QAAQ,EAAE,SAAS,KAAK,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;QACvI,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAI1C;IACC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAA;IACzD,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAChK,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAChE,iFAAiF;IACjF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;QAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/F,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACvG,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;QAClF,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,UAAU,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE;eAC9E,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe,CAAC,OAAO;eACzF,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,EAAE;eACtE,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAChI,IAAI,SAAS,GAAG,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC7F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,OAAO,GAA8F,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YAC3J,IAAI,QAAQ,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAChE,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;gBACrG,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,oBAAoB,EAAE,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAA;YAC9H,CAAC;YACD,MAAM,OAAO,CAAC,aAAa,EAAE,CAAA;YAC7B,SAAS,GAAG,MAAM,KAAK,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzI,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,OAAO;gBACvJ,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;gBACvL,YAAY,EAAE,KAAK,CAAC,mBAAmB,EAAE,6BAA6B,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAA;QACzG,CAAC;aAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,kBAAkB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxH,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YACtI,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtG,IAAI,OAAO,CAAC,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/F,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;gBAAC,MAAM,CAAC,cAAc,EAAE,CAAA;gBACtD,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC7C,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;gBAAC,MAAM,CAAC,cAAc,EAAE,CAAA;YACxD,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC9F,CAAC;QACD,MAAM,OAAO,CAAC,aAAa,EAAE,CAAA;QAC7B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YACzH,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,6BAA6B,EAAE,SAAS,EAAE,eAAe;YACzH,OAAO,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAA;QACpJ,MAAM,OAAO,CAAC,aAAa,EAAE,CAAA;QAC7B,MAAM,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC3H,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,SAAS,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,CAAC,CAAA;IAC9G,CAAC;IACD,MAAM,OAAO,CAAC,aAAa,EAAE,CAAA;IAC7B,OAAO,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC"}

package/lib/source-versioning.d.ts

@@ -0,0 +1,24 @@
+import { type ScopedPluginFile } from './source-workspace.js';
+export interface ManagedPatchVersionInput {
+    worktree: string;
+    baseCommit: string;
+    name: string;
+    environment: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    assertCurrent?: () => void | Promise<void>;
+}
+export interface ManagedPatchVersionFiles {
+    baseVersion: string;
+    version: string;
+    files: readonly ScopedPluginFile[];
+}
+/** Derive, but never write, the Host-reserved patch-version file contents. */
+export declare function managedPatchVersionFiles(input: ManagedPatchVersionInput): Promise<ManagedPatchVersionFiles>;
+/** Re-read current files and prove that only the Host-reserved version fields changed. */
+export declare function verifyManagedPatchVersion(input: ManagedPatchVersionInput): Promise<{
+    baseVersion: string;
+    version: string;
+}>;
+/** Candidate source files may never replace Host-reserved version fields. */
+export declare function assertManagedVersionPaths(files: readonly ScopedPluginFile[]): void;
+//# sourceMappingURL=source-versioning.d.ts.map

package/lib/source-versioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-versioning.d.ts","sourceRoot":"","sources":["../src/source-versioning.ts"],"names":[],"mappings":"AAIA,OAAO,EAA+F,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAO1J,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACnC;AAoID,8EAA8E;AAC9E,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAOjH;AAED,0FAA0F;AAC1F,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBlI;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,CAWlF"}