@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/task-observation-authority.d.ts

@@ -0,0 +1,29 @@
+import type { TaskObservationOwner, TaskObservationPolicy, TaskObservationRequest } from './task-observation-types.js';
+import type { PostActivationObservationReceipt } from './types.js';
+export interface TaskObservationAuthorityConfig {
+    schemaVersion: 1;
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    statePath: string;
+    controlDatabasePath: string;
+    grant: {
+        policy: TaskObservationPolicy;
+        owner: TaskObservationOwner;
+        installationId: string;
+        ledger: {
+            id: string;
+            path: string;
+        };
+        profilePath: string;
+        packages: readonly string[];
+        receiptTtlMs: number;
+    };
+}
+export declare class TaskObservationAuthorityError extends Error {
+    constructor();
+}
+export declare function validateTaskObservationAuthorityConfig(value: unknown): asserts value is TaskObservationAuthorityConfig;
+export declare function authorizeTaskObservation(configInput: TaskObservationAuthorityConfig, requestInput: TaskObservationRequest): Promise<PostActivationObservationReceipt>;
+export declare function runTaskObservationAuthority(argv?: string[]): Promise<void>;
+//# sourceMappingURL=task-observation-authority.d.ts.map

package/lib/task-observation-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-authority.d.ts","sourceRoot":"","sources":["../src/task-observation-authority.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAwB,oBAAoB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC5I,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAA;AAUlE,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,CAAC,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,EAAE;QACL,MAAM,EAAE,qBAAqB,CAAA;QAC7B,KAAK,EAAE,oBAAoB,CAAA;QAC3B,cAAc,EAAE,MAAM,CAAA;QACtB,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACpC,WAAW,EAAE,MAAM,CAAA;QACnB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;QAC3B,YAAY,EAAE,MAAM,CAAA;KACrB,CAAA;CACF;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAiED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,8BAA8B,CA2BtH;AAsJD,wBAAsB,wBAAwB,CAAC,WAAW,EAAE,8BAA8B,EAAE,YAAY,EAAE,sBAAsB,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAyE3K;AAED,wBAAsB,2BAA2B,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7F"}

package/lib/task-observation-authority.js

@@ -0,0 +1,370 @@
+import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
+import { resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { postActivationEvidenceDigest, parsePostActivationObservation, postActivationObservationSigningPayload, } from './post-activation.js';
+import { sourceAuthorityCanonicalSafePath, sourceAuthorityReadSafeFile, } from './source-approval-authority.js';
+import { controlPlaneDigest } from './store.js';
+import { readTaskObservationContext, taskObservationDigest } from './task-observation-store.js';
+import { PROTECTED_PLUGIN_DENYLIST } from './source-workspace.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const DIGEST = /^[a-f0-9]{64}$/u;
+const PACKAGE = /^@dsh-enhanced\/[a-z][a-z0-9-]*$/u;
+const MAX_CONFIG = 65_536;
+const MAX_REQUEST = 8_192;
+const MAX_KEY = 32_768;
+const MAX_LOOKBACK = 30 * 24 * 60 * 60 * 1_000;
+export class TaskObservationAuthorityError extends Error {
+    constructor() {
+        super('task observation authority refused the request');
+        this.name = 'TaskObservationAuthorityError';
+    }
+}
+function fail() {
+    throw new TaskObservationAuthorityError();
+}
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail();
+    return value;
+}
+function exact(value, fields) {
+    if (Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0'))
+        fail();
+}
+function string(value, pattern = ID, max = 4_096) {
+    if (typeof value !== 'string' || value.normalize('NFC').trim() !== value || !pattern.test(value)
+        || Buffer.byteLength(value) > max || /[\p{Cc}]/u.test(value))
+        fail();
+    return value;
+}
+function integer(value, min, max = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || Number(value) < min || Number(value) > max)
+        fail();
+    return Number(value);
+}
+function configuredPath(value) {
+    const path = string(value, /^[\s\S]+$/u);
+    if (!path.startsWith('/') || path === '/' || resolve(path) !== path)
+        fail();
+    return path;
+}
+function equal(left, right) {
+    return controlPlaneDigest(left) === controlPlaneDigest(right);
+}
+function parseOwner(value) {
+    const item = object(value);
+    exact(item, ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset']);
+    return Object.freeze({
+        authorityId: string(item.authorityId),
+        authorityHash: string(item.authorityHash, DIGEST, 64),
+        principalId: string(item.principalId, /^[\s\S]+$/u, 512),
+        principalRecordId: string(item.principalRecordId, /^[\s\S]+$/u, 512),
+        principalVersion: integer(item.principalVersion, 1),
+        workspace: configuredPath(item.workspace),
+        agentPreset: string(item.agentPreset),
+    });
+}
+function parsePolicy(value) {
+    const item = object(value);
+    exact(item, ['id', 'expiresAt', 'maximumObservations', 'minimumChecks', 'maximumChecks', 'lookbackMs']);
+    const result = {
+        id: string(item.id),
+        expiresAt: integer(item.expiresAt, 1),
+        maximumObservations: integer(item.maximumObservations, 1, 1_000),
+        minimumChecks: integer(item.minimumChecks, 1, 32),
+        maximumChecks: integer(item.maximumChecks, 1, 32),
+        lookbackMs: integer(item.lookbackMs, 1_000, MAX_LOOKBACK),
+    };
+    if (result.minimumChecks > result.maximumChecks)
+        fail();
+    return Object.freeze(result);
+}
+export function validateTaskObservationAuthorityConfig(value) {
+    const item = object(value);
+    exact(item, ['schemaVersion', 'authority', 'keyId', 'keyPath', 'statePath', 'controlDatabasePath', 'grant']);
+    if (item.schemaVersion !== 1)
+        fail();
+    string(item.authority);
+    string(item.keyId);
+    const keyPath = sourceAuthorityCanonicalSafePath(configuredPath(item.keyPath), 'file');
+    const statePath = configuredPath(item.statePath);
+    const controlPath = sourceAuthorityCanonicalSafePath(configuredPath(item.controlDatabasePath), 'file');
+    if (new Set([keyPath, statePath, controlPath]).size !== 3)
+        fail();
+    const grant = object(item.grant);
+    exact(grant, ['policy', 'owner', 'installationId', 'ledger', 'profilePath', 'packages', 'receiptTtlMs']);
+    parsePolicy(grant.policy);
+    parseOwner(grant.owner);
+    string(grant.installationId);
+    const ledger = object(grant.ledger);
+    exact(ledger, ['id', 'path']);
+    string(ledger.id);
+    if (configuredPath(ledger.path) !== controlPath)
+        fail();
+    configuredPath(grant.profilePath);
+    integer(grant.receiptTtlMs, 1_000, 300_000);
+    const rawPackages = grant.packages;
+    if (!Array.isArray(rawPackages))
+        fail();
+    if (rawPackages.length < 1 || rawPackages.length > 64)
+        fail();
+    const packages = rawPackages.map((value) => string(value, PACKAGE, 128));
+    if (new Set(packages).size !== packages.length)
+        fail();
+}
+function parseRequest(value) {
+    const item = object(value);
+    exact(item, ['protocol', 'observationId', 'observationDigest']);
+    if (item.protocol !== 'dsh-task-observation/v1')
+        fail();
+    return Object.freeze({
+        protocol: 'dsh-task-observation/v1',
+        observationId: string(item.observationId),
+        observationDigest: string(item.observationDigest, DIGEST, 64),
+    });
+}
+function openState(path) {
+    sourceAuthorityCanonicalSafePath(path, 'file', true);
+    const database = new DatabaseSync(path);
+    try {
+        database.exec(`
+    PRAGMA busy_timeout = 5000;
+    PRAGMA journal_mode = WAL;
+    PRAGMA synchronous = FULL;
+    CREATE TABLE IF NOT EXISTS task_observation_grants (
+      grant_id TEXT PRIMARY KEY,
+      config_digest TEXT NOT NULL,
+      key_fingerprint TEXT NOT NULL
+    ) STRICT;
+    CREATE TABLE IF NOT EXISTS task_observation_receipts (
+      request_digest TEXT PRIMARY KEY,
+      grant_id TEXT NOT NULL,
+      config_digest TEXT NOT NULL,
+      observation_id TEXT NOT NULL UNIQUE,
+      observation_digest TEXT NOT NULL,
+      receipt_json TEXT NOT NULL,
+      receipt_digest TEXT NOT NULL
+    ) STRICT;
+    `);
+        return database;
+    }
+    catch (error) {
+        database.close();
+        throw error;
+    }
+}
+function storedReceipt(receiptJson, digest, key) {
+    if (controlPlaneDigest(receiptJson) !== digest)
+        fail();
+    try {
+        const receipt = parsePostActivationObservation(JSON.parse(receiptJson));
+        const { signature: _signature, ...unsigned } = receipt;
+        if (!verify(null, Buffer.from(postActivationObservationSigningPayload(unsigned)), createPublicKey(key), Buffer.from(receipt.signature, 'base64')))
+            fail();
+        return receipt;
+    }
+    catch {
+        return fail();
+    }
+}
+function validateContext(config, request, now) {
+    const control = new DatabaseSync(sourceAuthorityCanonicalSafePath(config.controlDatabasePath, 'file'), { readOnly: true });
+    try {
+        control.exec('PRAGMA query_only = ON');
+        const { record, plan, source, deployments } = readTaskObservationContext(control, request.observationId);
+        const batch = record.batch;
+        if (!['pending', 'signed'].includes(record.state)
+            || batch.id !== request.observationId
+            || batch.digest !== request.observationDigest
+            || taskObservationDigest(batch) !== batch.digest
+            || batch.expiresAt <= now
+            || batch.policy.expiresAt <= now
+            || !equal(batch.policy, config.grant.policy)
+            || !equal(batch.owner, config.grant.owner)
+            || batch.installationId !== config.grant.installationId
+            || !equal(plan.ledger, config.grant.ledger)
+            || batch.profilePath !== config.grant.profilePath
+            || plan.id !== batch.planId
+            || plan.digest !== batch.planDigest
+            || plan.status !== 'activated'
+            || !plan.activation
+            || PROTECTED_PLUGIN_DENYLIST.has(plan.candidate.id)
+            || !config.grant.packages.includes(plan.candidate.package)
+            || source.owner.authorityId !== batch.owner.authorityId
+            || source.owner.authorityHash !== batch.owner.authorityHash
+            || source.owner.principalId !== batch.owner.principalId
+            || source.owner.principalRecordId !== batch.owner.principalRecordId
+            || source.owner.principalVersion !== batch.owner.principalVersion
+            || source.owner.workspace !== batch.owner.workspace
+            || source.owner.agentPreset !== batch.owner.agentPreset)
+            fail();
+        if (batch.votes.length < batch.policy.minimumChecks
+            || batch.votes.length > batch.policy.maximumChecks
+            || deployments.length !== batch.votes.length
+            || new Set(batch.votes.map(vote => vote.inboxId)).size !== batch.votes.length)
+            fail();
+        for (const vote of batch.votes) {
+            if (vote.completedAt > now || now - vote.completedAt > batch.policy.lookbackMs
+                || (vote.status !== 'achieved' && vote.status !== 'not-achieved'))
+                fail();
+            const deployment = deployments.find(item => item.task.inboxId === vote.inboxId);
+            if (!deployment
+                || deployment.readiness.planId !== plan.id
+                || deployment.task.owner.principalRecordId !== batch.owner.principalRecordId
+                || deployment.task.owner.principalVersion !== batch.owner.principalVersion
+                || deployment.task.scope.workspace !== batch.owner.workspace
+                || deployment.task.scope.preset !== batch.owner.agentPreset
+                || controlPlaneDigest(deployment) !== vote.deploymentDigest
+                || !deployment.execution
+                || deployment.execution.completedAt !== vote.completedAt)
+                fail();
+        }
+        return { batch, plan };
+    }
+    finally {
+        control.close();
+    }
+}
+function makeReceipt(config, batch, plan, key, now) {
+    const failures = batch.votes.filter(vote => vote.status === 'not-achieved').length;
+    const evidence = {
+        kind: 'post-activation-health',
+        checks: batch.votes.length,
+        failures,
+        probeDigest: batch.digest,
+    };
+    const unsigned = {
+        schemaVersion: 1,
+        observationId: batch.id,
+        authority: config.authority,
+        keyId: config.keyId,
+        installationId: batch.installationId,
+        planId: plan.id,
+        planDigest: plan.digest,
+        activationId: plan.activation.id,
+        fence: plan.activation.fence,
+        package: plan.candidate.package,
+        version: plan.candidate.version,
+        integrity: plan.candidate.integrity,
+        disposition: failures ? 'regressed' : 'healthy',
+        evidence,
+        evidenceDigest: postActivationEvidenceDigest(evidence),
+        hostGeneration: batch.hostGeneration,
+        observedAt: now,
+        expiresAt: Math.min(now + config.grant.receiptTtlMs, batch.expiresAt, batch.policy.expiresAt, config.grant.policy.expiresAt),
+    };
+    if (unsigned.expiresAt <= now)
+        fail();
+    try {
+        return parsePostActivationObservation({
+            ...unsigned,
+            signature: sign(null, Buffer.from(postActivationObservationSigningPayload(unsigned)), key).toString('base64'),
+        });
+    }
+    catch {
+        return fail();
+    }
+}
+export async function authorizeTaskObservation(configInput, requestInput) {
+    try {
+        validateTaskObservationAuthorityConfig(configInput);
+        const config = configInput;
+        const request = parseRequest(requestInput);
+        const keyBytes = sourceAuthorityReadSafeFile(config.keyPath, MAX_KEY);
+        let key;
+        try {
+            key = createPrivateKey(keyBytes);
+        }
+        catch {
+            return fail();
+        }
+        if (key.asymmetricKeyType !== 'ed25519')
+            fail();
+        const configDigest = controlPlaneDigest(config);
+        const keyFingerprint = createHash('sha256').update(keyBytes).digest('hex');
+        const requestDigest = controlPlaneDigest(request);
+        const state = openState(config.statePath);
+        try {
+            state.exec('BEGIN IMMEDIATE');
+            const frozen = state.prepare('SELECT config_digest, key_fingerprint FROM task_observation_grants WHERE grant_id = ?')
+                .get(config.grant.policy.id);
+            if (frozen && (frozen.config_digest !== configDigest || frozen.key_fingerprint !== keyFingerprint))
+                fail();
+            const prior = state.prepare(`
+        SELECT receipt_json, receipt_digest, grant_id, config_digest, observation_id, observation_digest
+        FROM task_observation_receipts WHERE request_digest = ?
+      `).get(requestDigest);
+            if (prior) {
+                if (prior.grant_id !== config.grant.policy.id
+                    || prior.config_digest !== configDigest
+                    || prior.observation_id !== request.observationId
+                    || prior.observation_digest !== request.observationDigest)
+                    fail();
+                const receipt = storedReceipt(prior.receipt_json, prior.receipt_digest, key);
+                if (receipt.observationId !== request.observationId
+                    || receipt.evidence.probeDigest !== request.observationDigest
+                    || receipt.authority !== config.authority
+                    || receipt.keyId !== config.keyId)
+                    fail();
+                state.exec('COMMIT');
+                return receipt;
+            }
+            const now = Date.now();
+            if (now >= config.grant.policy.expiresAt)
+                fail();
+            const first = validateContext(config, request, now);
+            const final = validateContext(config, request, now);
+            if (!equal(first.batch, final.batch) || !equal(first.plan, final.plan))
+                fail();
+            if (state.prepare('SELECT COUNT(*) AS count FROM task_observation_receipts WHERE grant_id = ?')
+                .get(config.grant.policy.id).count >= config.grant.policy.maximumObservations)
+                fail();
+            if (!frozen)
+                state.prepare('INSERT INTO task_observation_grants VALUES (?, ?, ?)')
+                    .run(config.grant.policy.id, configDigest, keyFingerprint);
+            const receipt = makeReceipt(config, final.batch, final.plan, key, now);
+            const receiptJson = JSON.stringify(receipt);
+            state.prepare('INSERT INTO task_observation_receipts VALUES (?, ?, ?, ?, ?, ?, ?)').run(requestDigest, config.grant.policy.id, configDigest, request.observationId, request.observationDigest, receiptJson, controlPlaneDigest(receiptJson));
+            state.exec('COMMIT');
+            return receipt;
+        }
+        catch (error) {
+            try {
+                state.exec('ROLLBACK');
+            }
+            catch { }
+            throw error;
+        }
+        finally {
+            state.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof TaskObservationAuthorityError)
+            throw error;
+        throw new TaskObservationAuthorityError();
+    }
+}
+export async function runTaskObservationAuthority(argv = process.argv.slice(2)) {
+    try {
+        if (argv.length !== 2 || argv[0] !== '--config')
+            fail();
+        const configBytes = sourceAuthorityReadSafeFile(configuredPath(argv[1]), MAX_CONFIG);
+        const config = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(configBytes));
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            size += bytes.length;
+            if (size > MAX_REQUEST)
+                fail();
+            chunks.push(bytes);
+        }
+        const input = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+        process.stdout.write(`${JSON.stringify(await authorizeTaskObservation(config, input))}\n`);
+    }
+    catch {
+        throw new TaskObservationAuthorityError();
+    }
+}
+//# sourceMappingURL=task-observation-authority.js.map

package/lib/task-observation-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-authority.js","sourceRoot":"","sources":["../src/task-observation-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,uCAAuC,GACxC,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAIjE,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,OAAO,GAAG,mCAAmC,CAAA;AACnD,MAAM,UAAU,GAAG,MAAM,CAAA;AACzB,MAAM,WAAW,GAAG,KAAK,CAAA;AACzB,MAAM,OAAO,GAAG,MAAM,CAAA;AACtB,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;AAoB9C,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACtD;QACE,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACvD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAA;IAC7C,CAAC;CACF;AAED,SAAS,IAAI;IACX,MAAM,IAAI,6BAA6B,EAAE,CAAA;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACvE,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,KAAK,CAAC,KAA8B,EAAE,MAAyB;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;AACpF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,GAAG,KAAK;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;WAC3F,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACtE,OAAO,KAAe,CAAA;AACxB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,GAAW,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;QAAE,IAAI,EAAE,CAAA;IACtF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,EAAE,CAAA;IAC3E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,KAAK,CAAC,IAAa,EAAE,KAAc;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;IACjI,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;QACrD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC;QACxD,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,GAAG,CAAC;QACpE,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACnD,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QACzC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;KACtC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAA;IACvG,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,EAAE,KAAK,CAAC;QAChE,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,CAAC;KAC1D,CAAA;IACD,IAAI,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa;QAAE,IAAI,EAAE,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5G,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClB,MAAM,OAAO,GAAG,gCAAgC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IACtF,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,gCAAgC,CAAC,cAAc,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAA;IACtG,IAAI,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChC,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAA;IACxG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACzB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvB,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACjB,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,WAAW;QAAE,IAAI,EAAE,CAAA;IACvD,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACjC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,IAAI,EAAE,CAAA;IACvC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,IAAI,EAAE,CAAA;IAC7D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACjF,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,IAAI,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAC/D,IAAI,IAAI,CAAC,QAAQ,KAAK,yBAAyB;QAAE,IAAI,EAAE,CAAA;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,yBAAyB;QACnC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;QACzC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC;KAC9D,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;KAkBb,CAAC,CAAA;QACF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,KAAK,EAAE,CAAA;QAChB,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB,EAAE,MAAc,EAAE,GAAwC;IAClG,IAAI,kBAAkB,CAAC,WAAW,CAAC,KAAK,MAAM;QAAE,IAAI,EAAE,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QACvE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAAE,IAAI,EAAE,CAAA;QACzJ,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,EAAE,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAsC,EAAE,OAA+B,EAAE,GAAW;IAC3G,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,gCAAgC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1H,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACtC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;QACxG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;eAC5C,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,aAAa;eAClC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,iBAAiB;eAC1C,qBAAqB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM;eAC7C,KAAK,CAAC,SAAS,IAAI,GAAG;eACtB,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG;eAC7B,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;eACzC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;eACvC,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,KAAK,CAAC,cAAc;eACpD,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;eACxC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,WAAW;eAC9C,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM;eACxB,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU;eAChC,IAAI,CAAC,MAAM,KAAK,WAAW;eAC3B,CAAC,IAAI,CAAC,UAAU;eAChB,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;eAChD,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;eACvD,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;eACpD,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,aAAa;eACxD,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;eACpD,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,KAAK,CAAC,iBAAiB;eAChE,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,KAAK,CAAC,gBAAgB;eAC9D,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS;eAChD,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;YAAE,IAAI,EAAE,CAAA;QAEjE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa;eAC9C,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa;eAC/C,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;eACzC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;YAAE,IAAI,EAAE,CAAA;QAEvF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,WAAW,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU;mBACzE,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC;gBAAE,IAAI,EAAE,CAAA;YAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/E,IAAI,CAAC,UAAU;mBACV,UAAU,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;mBACvC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,KAAK,CAAC,iBAAiB;mBACzE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,KAAK,CAAC,gBAAgB;mBACvE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS;mBACzD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;mBACxD,kBAAkB,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,gBAAgB;mBACxD,CAAC,UAAU,CAAC,SAAS;mBACrB,UAAU,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;gBAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAsC,EAAE,KAA2B,EAAE,IAAgD,EAAE,GAAwC,EAAE,GAAW;IAC/L,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM,CAAA;IAClF,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,wBAAiC;QACvC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QAC1B,QAAQ;QACR,WAAW,EAAE,KAAK,CAAC,MAAM;KAC1B,CAAA;IACD,MAAM,QAAQ,GAAwD;QACpE,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,KAAK,CAAC,EAAE;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,YAAY,EAAE,IAAI,CAAC,UAAW,CAAC,EAAE;QACjC,KAAK,EAAE,IAAI,CAAC,UAAW,CAAC,KAAK;QAC7B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;QAC/B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;QACnC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC/C,QAAQ;QACR,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QACtD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;KAC7H,CAAA;IACD,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG;QAAE,IAAI,EAAE,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,8BAA8B,CAAC;YACpC,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC9G,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,EAAE,CAAA;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,WAA2C,EAAE,YAAoC;IAC9H,IAAI,CAAC;QACH,sCAAsC,CAAC,WAAW,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,WAAW,CAAA;QAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;QAC1C,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrE,IAAI,GAAwC,CAAA;QAC5C,IAAI,CAAC;YACH,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;YAAE,IAAI,EAAE,CAAA;QAE/C,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1E,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,uFAAuF,CAAC;iBAClH,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAmE,CAAA;YAChG,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,YAAY,IAAI,MAAM,CAAC,eAAe,KAAK,cAAc,CAAC;gBAAE,IAAI,EAAE,CAAA;YAE1G,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;;;OAG3B,CAAC,CAAC,GAAG,CAAC,aAAa,CAGP,CAAA;YACb,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;uBACxC,KAAK,CAAC,aAAa,KAAK,YAAY;uBACpC,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa;uBAC9C,KAAK,CAAC,kBAAkB,KAAK,OAAO,CAAC,iBAAiB;oBAAE,IAAI,EAAE,CAAA;gBACnE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;gBAC5E,IAAI,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;uBAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,iBAAiB;uBAC1D,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;uBACtC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;oBAAE,IAAI,EAAE,CAAA;gBAC3C,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACpB,OAAO,OAAO,CAAA;YAChB,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;gBAAE,IAAI,EAAE,CAAA;YAChD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACnD,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACnD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,EAAE,CAAA;YAC9E,IAAK,KAAK,CAAC,OAAO,CAAC,4EAA4E,CAAC;iBAC7F,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAuB,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB;gBAAE,IAAI,EAAE,CAAA;YAE7G,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,OAAO,CAAC,sDAAsD,CAAC;qBAC/E,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAA;YAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;YACtE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YAC3C,KAAK,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CACrF,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,EAC1E,OAAO,CAAC,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,CAAC,WAAW,CAAC,CACxE,CAAA;YACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACpB,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACvC,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,6BAA6B;YAAE,MAAM,KAAK,CAAA;QAC/D,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,IAAI,EAAE,CAAA;QACvD,MAAM,WAAW,GAAG,2BAA2B,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACxF,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjE,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;YACpB,IAAI,IAAI,GAAG,WAAW;gBAAE,IAAI,EAAE,CAAA;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;AACH,CAAC"}

package/lib/task-observation-client.d.ts

@@ -0,0 +1,4 @@
+import { type SourceApprovalClientConfig } from './source-approval-client.js';
+import type { TaskObservationRequest } from './task-observation-types.js';
+export declare function requestTaskObservation(config: SourceApprovalClientConfig, request: TaskObservationRequest, signal?: AbortSignal): Promise<import("./types.js").PostActivationObservationReceipt>;
+//# sourceMappingURL=task-observation-client.d.ts.map

package/lib/task-observation-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-client.d.ts","sourceRoot":"","sources":["../src/task-observation-client.ts"],"names":[],"mappings":"AACA,OAAO,EAA4D,KAAK,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACvI,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAEzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,kEAW/H"}

package/lib/task-observation-client.js

@@ -0,0 +1,20 @@
+import { parsePostActivationObservation } from './post-activation.js';
+import { requestPinnedAuthorityReceipt, SourceApprovalClientError } from './source-approval-client.js';
+export function requestTaskObservation(config, request, signal) {
+    if (request.protocol !== 'dsh-task-observation/v1' || !/^task-observation-[a-f0-9]{64}$/u.test(request.observationId)
+        || !/^[a-f0-9]{64}$/u.test(request.observationDigest)
+        || Object.keys(request).sort().join(',') !== 'observationDigest,observationId,protocol')
+        throw new Error('invalid task observation request');
+    return requestPinnedAuthorityReceipt(config, request, value => {
+        try {
+            const receipt = parsePostActivationObservation(value);
+            if (receipt.observationId !== request.observationId || receipt.evidence.probeDigest !== request.observationDigest)
+                throw new Error('task observation receipt differs');
+            return receipt;
+        }
+        catch {
+            throw new SourceApprovalClientError('FAILED', 'task observation authority returned an invalid receipt');
+        }
+    }, signal);
+}
+//# sourceMappingURL=task-observation-client.js.map

package/lib/task-observation-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-client.js","sourceRoot":"","sources":["../src/task-observation-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAmC,MAAM,6BAA6B,CAAA;AAGvI,MAAM,UAAU,sBAAsB,CAAC,MAAkC,EAAE,OAA+B,EAAE,MAAoB;IAC9H,IAAI,OAAO,CAAC,QAAQ,KAAK,yBAAyB,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;WAChH,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;WAClD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0CAA0C;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAC9I,OAAO,6BAA6B,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;QAC5D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAA;YACrD,IAAI,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,iBAAiB;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;YACtK,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,yBAAyB,CAAC,QAAQ,EAAE,wDAAwD,CAAC,CAAA;QAAC,CAAC;IACrH,CAAC,EAAE,MAAM,CAAC,CAAA;AACZ,CAAC"}

package/lib/task-observation-runtime.d.ts

@@ -0,0 +1,59 @@
+import type { AssistantAutomationsService } from '@dsh-enhanced/assistant-automations';
+import type { AssistantDeliveryService } from '@dsh-enhanced/assistant-delivery';
+import type { AssistantEvaluationService } from '@dsh-enhanced/assistant-evaluation';
+import { type ControlPlaneStore } from './store.js';
+import { type PluginControlTrustConfig } from './trust.js';
+import type { TaskObservationBatch, TaskObservationConfig, TaskObservationOwner } from './task-observation-types.js';
+import type { PostActivationObservationReceipt } from './types.js';
+type Evaluation = Pick<AssistantEvaluationService, 'canonicalHostScope' | 'getTrustedForegroundLearningProjection' | 'withTrustedCanonicalTaskWriterFence' | 'onTrustedTaskChange'>;
+type Delivery = Pick<AssistantDeliveryService, 'validateOwnerRoute' | 'inspectOwnerForegroundLearningTask'>;
+type Automations = Pick<AssistantAutomationsService, 'registerHostExecutor' | 'reconcileSystem' | 'inspectSystemOwnedActivation'>;
+export declare function taskObservationOwner(owner: TaskObservationOwner): TaskObservationOwner;
+export declare function validateTaskObservationConfig(config: TaskObservationConfig): void;
+/** Trusted real-task cohorts; no model calls and no private scheduler. */
+export declare class TaskObservationRuntime {
+    private readonly options;
+    private readonly lane;
+    private readonly configDigest;
+    private readonly trustDigest;
+    private readonly scanId;
+    private readonly generation;
+    private readonly activationNonce;
+    private readonly abort;
+    private readonly flights;
+    private unregister?;
+    private unsubscribe?;
+    private closing?;
+    private active;
+    private scanning;
+    private lastError;
+    constructor(options: {
+        config: TaskObservationConfig;
+        store: ControlPlaneStore;
+        trust: PluginControlTrustConfig;
+        evaluation: Evaluation;
+        delivery: Delivery;
+        automations: Automations;
+        assertCurrent(): void;
+        rollback(planId: string, signal: AbortSignal): Promise<unknown>;
+        request?: (batch: TaskObservationBatch, signal: AbortSignal) => Promise<PostActivationObservationReceipt>;
+    });
+    start(): void;
+    close(): Promise<void>;
+    health: () => {
+        connected: boolean;
+        lastError: string | null;
+    };
+    private current;
+    private owner;
+    private source;
+    private vote;
+    private read;
+    private fence;
+    /** Bounded synchronous nudge; the persisted native cron owns asynchronous work. */
+    scan: () => void;
+    private definition;
+    private execute;
+}
+export {};
+//# sourceMappingURL=task-observation-runtime.d.ts.map

package/lib/task-observation-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-runtime.d.ts","sourceRoot":"","sources":["../src/task-observation-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAuF,MAAM,qCAAqC,CAAA;AAC3K,OAAO,KAAK,EAAE,wBAAwB,EAA+B,MAAM,kCAAkC,CAAA;AAC7G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAKvE,OAAO,EAAmB,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAuB,MAAM,6BAA6B,CAAA;AACzI,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAA;AAMlE,KAAK,UAAU,GAAG,IAAI,CAAC,0BAA0B,EAAE,oBAAoB,GAAG,wCAAwC,GAAG,qCAAqC,GAAG,qBAAqB,CAAC,CAAA;AACnL,KAAK,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,oBAAoB,GAAG,oCAAoC,CAAC,CAAA;AAC3G,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,iBAAiB,GAAG,8BAA8B,CAAC,CAAA;AAEjI,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAGtF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAkBjF;AAED,0EAA0E;AAC1E,qBAAa,sBAAsB;IAerB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAdpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAY;IAChC,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,SAAS,CAAsB;gBACV,OAAO,EAAE;QACpC,MAAM,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAC;QAAC,KAAK,EAAE,wBAAwB,CAAA;QACxF,UAAU,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;QACpE,aAAa,IAAI,IAAI,CAAA;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,gCAAgC,CAAC,CAAA;KAC1G;IASD,KAAK,IAAI,IAAI;IAmBb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBtB,MAAM;;;MAAgE;IAEtE,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,MAAM;IAWd,OAAO,CAAC,IAAI;IAgBZ,OAAO,CAAC,IAAI;IAUZ,OAAO,CAAC,KAAK;IAab,mFAAmF;IACnF,IAAI,QAAO,IAAI,CAwCd;IAED,OAAO,CAAC,UAAU;YAUJ,OAAO;CAyDtB"}