@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/task-observation-runtime.js

@@ -0,0 +1,331 @@
+import { randomUUID } from 'node:crypto';
+import { isAbsolute, resolve } from 'node:path';
+import { controlPlaneDigest } from './store.js';
+import { taskObservationDigest, taskObservationId } from './task-observation-store.js';
+import { validateSourceApprovalClientConfig } from './source-approval-client.js';
+import { requestTaskObservation } from './task-observation-client.js';
+import { Ed25519PostActivationObservationAuthority } from './post-activation.js';
+import { resolveTrustKey } from './trust.js';
+const OWNER = 'plugin-control-plane-task-observations';
+const EXECUTOR = 'plugin-control-plane-task-observations-v1';
+const CATALOG = controlPlaneDigest({ executor: EXECUTOR, version: 1 });
+const same = (a, b) => controlPlaneDigest(a) === controlPlaneDigest(b);
+export function taskObservationOwner(owner) {
+    const { authorityId, authorityHash, principalId, principalRecordId, principalVersion, workspace, agentPreset } = owner;
+    return { authorityId, authorityHash, principalId, principalRecordId, principalVersion, workspace, agentPreset };
+}
+export function validateTaskObservationConfig(config) {
+    const exact = (value, keys) => !!value && typeof value === 'object' && !Array.isArray(value)
+        && Object.keys(value).sort().join(',') === keys;
+    const integer = (value, min, max) => Number.isSafeInteger(value) && value >= min && value <= max;
+    const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 4096
+        && value.normalize('NFC').trim() === value && !/[\p{Cc}]/u.test(value);
+    if (!exact(config, 'authority,budgetAmount,budgetId,policy,profilePath,scope,timeoutMs')
+        || !exact(config.policy, 'expiresAt,id,lookbackMs,maximumChecks,maximumObservations,minimumChecks')
+        || !exact(config.scope, 'ownerRouteId,preset,principalId,workspace')
+        || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u.test(config.policy.id)
+        || !integer(config.policy.expiresAt, 1, 8_640_000_000_000_000)
+        || !integer(config.policy.maximumObservations, 1, 1000)
+        || !integer(config.policy.minimumChecks, 1, 32) || !integer(config.policy.maximumChecks, config.policy.minimumChecks, 32)
+        || !integer(config.policy.lookbackMs, 1000, 30 * 86_400_000) || !integer(config.timeoutMs, 1000, 300_000)
+        || !text(config.budgetId) || config.budgetId.length > 128 || !integer(config.budgetAmount, 1, 10_000_000)
+        || !Object.values(config.scope).every(text) || !text(config.profilePath)
+        || ![config.profilePath, config.scope.workspace].every(path => isAbsolute(path) && resolve(path) === path))
+        throw new Error('invalid taskObservations configuration');
+    validateSourceApprovalClientConfig(config.authority);
+}
+/** Trusted real-task cohorts; no model calls and no private scheduler. */
+export class TaskObservationRuntime {
+    options;
+    lane;
+    configDigest;
+    trustDigest;
+    scanId;
+    generation = randomUUID();
+    activationNonce;
+    abort = new AbortController();
+    flights = new Set();
+    unregister;
+    unsubscribe;
+    closing;
+    active = false;
+    scanning = false;
+    lastError = null;
+    constructor(options) {
+        this.options = options;
+        validateTaskObservationConfig(options.config);
+        this.lane = controlPlaneDigest({ scope: options.config.scope, profilePath: options.config.profilePath });
+        this.configDigest = controlPlaneDigest(options.config);
+        this.trustDigest = controlPlaneDigest(options.trust);
+        this.scanId = `task-observation-scan-${this.lane}`;
+        this.activationNonce = controlPlaneDigest({ config: this.configDigest, generation: this.generation });
+    }
+    start() {
+        this.unregister = this.options.automations.registerHostExecutor({
+            descriptor: { executorId: EXECUTOR, contractVersion: 1, catalogDigest: CATALOG },
+            accepts: spec => spec.executorId === EXECUTOR && spec.executorContractVersion === 1 && spec.catalogDigest === CATALOG
+                && spec.runbookId === 'observe' && spec.runbookVersion === 1,
+            execute: input => {
+                const flight = this.execute(input);
+                this.flights.add(flight);
+                void flight.finally(() => this.flights.delete(flight)).catch(() => { });
+                return flight;
+            },
+        });
+        this.active = true;
+        this.unsubscribe = this.options.evaluation.onTrustedTaskChange(() => this.scan());
+        this.options.automations.reconcileSystem({ owner: OWNER, automationId: this.scanId,
+            idempotencyKey: `${this.scanId}:${this.generation}`, desiredStatus: 'active', definition: this.definition() });
+        this.scan();
+    }
+    close() {
+        return this.closing ??= (async () => {
+            this.active = false;
+            try {
+                const current = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.scanId });
+                if (current?.activationNonce === this.activationNonce)
+                    this.options.automations.reconcileSystem({ owner: OWNER,
+                        automationId: this.scanId, idempotencyKey: `${this.scanId}:${this.generation}:pause`, desiredStatus: 'paused', definition: this.definition() });
+            }
+            finally {
+                this.abort.abort();
+                try {
+                    this.unsubscribe?.();
+                }
+                finally {
+                    try {
+                        this.unregister?.();
+                    }
+                    finally {
+                        await Promise.allSettled(this.flights);
+                        this.options.store.close();
+                    }
+                }
+            }
+        })();
+    }
+    health = () => ({ connected: this.active, lastError: this.lastError });
+    current() {
+        this.abort.signal.throwIfAborted();
+        if (!this.active)
+            throw new Error('task observation runtime unavailable');
+        this.options.assertCurrent();
+    }
+    owner() {
+        this.current();
+        const scope = this.options.config.scope;
+        return taskObservationOwner(this.options.delivery.validateOwnerRoute({ authorityId: scope.ownerRouteId,
+            principalId: scope.principalId, workspace: scope.workspace, agentPreset: scope.preset }));
+    }
+    source(inboxId) {
+        const owner = this.owner();
+        const scope = this.options.evaluation.canonicalHostScope({ workspace: owner.workspace, preset: owner.agentPreset });
+        const canonical = this.options.evaluation.getTrustedForegroundLearningProjection({ scope, inboxId });
+        if (!canonical)
+            return undefined;
+        const source = this.options.delivery.inspectOwnerForegroundLearningTask({ authorityId: owner.authorityId,
+            principalId: owner.principalId, workspace: owner.workspace, agentPreset: owner.agentPreset, outcomeId: canonical.triggerOutcomeId });
+        if (!source || !same(taskObservationOwner(source.owner), owner) || !same(source.canonical.projection, canonical.projection)
+            || source.source.inboxId !== inboxId)
+            return undefined;
+        return source;
+    }
+    vote(deployment, source) {
+        const now = Date.now(), status = source?.canonical.objective?.status;
+        if (!source || !['owner-feedback', 'independent-verifier'].includes(source.judgement)
+            || (status !== 'achieved' && status !== 'not-achieved') || source.ownerRevision?.action === 'withdraw'
+            || source.canonical.projection.subjectKind !== 'foreground-turn' || source.canonical.projection.disposition !== 'upsert'
+            || source.canonical.projection.subjectRef !== deployment.task.inboxId || !source.source.quiescent || source.source.truncated
+            || source.source.sessionId !== deployment.task.sessionId || deployment.state !== 'observed' || !deployment.execution
+            || source.owner.principalRecordId !== deployment.task.owner.principalRecordId
+            || source.owner.principalVersion !== deployment.task.owner.principalVersion
+            || source.owner.workspace !== deployment.task.scope.workspace || source.owner.agentPreset !== deployment.task.scope.preset
+            || deployment.execution.completedAt > now || now - deployment.execution.completedAt > this.options.config.policy.lookbackMs
+            || (source.canonical.objective?.occurredAt ?? now + 1) > now)
+            return undefined;
+        return { inboxId: deployment.task.inboxId, outcomeId: source.canonical.triggerOutcomeId, projection: { ...source.canonical.projection },
+            sourceDigest: controlPlaneDigest({ protocol: source.protocol, source: source.source, judgement: source.judgement, ownerRevision: source.ownerRevision }),
+            deploymentDigest: controlPlaneDigest(deployment), status, completedAt: deployment.execution.completedAt };
+    }
+    read(batch) {
+        this.current();
+        if (batch.configDigest !== this.configDigest || batch.trustDigest !== this.trustDigest || batch.expiresAt <= Date.now()
+            || !same(batch.owner, this.owner()))
+            throw new Error('task observation authority changed or expired');
+        return batch.votes.map(expected => {
+            const deployment = this.options.store.getForegroundDeployment(expected.inboxId), source = this.source(expected.inboxId);
+            if (!deployment || !source || !same(this.vote(deployment, source), expected))
+                throw new Error('task observation source changed');
+            return source;
+        });
+    }
+    fence(batch, callback) {
+        const sources = this.read(batch);
+        if (this.options.store.getTaskObservation(batch.id))
+            this.options.store.assertCurrentTaskObservation(batch.id);
+        const scope = this.options.evaluation.canonicalHostScope({ workspace: batch.owner.workspace, preset: batch.owner.agentPreset });
+        const result = this.options.evaluation.withTrustedCanonicalTaskWriterFence({ scope,
+            scopeWatermark: Math.max(...sources.map(source => source.canonical.scopeWatermark)), evidence: batch.votes.map(vote => vote.projection) }, () => {
+            this.read(batch);
+            return callback();
+        });
+        if (!result.matched)
+            throw new Error('task observation canonical writer fence changed');
+        return result.value;
+    }
+    /** Bounded synchronous nudge; the persisted native cron owns asynchronous work. */
+    scan = () => {
+        if (!this.active || this.scanning)
+            return;
+        this.scanning = true;
+        try {
+            this.current();
+            this.lastError = null;
+            const store = this.options.store, now = Date.now(), config = this.options.config;
+            const prior = store.listTaskObservations(this.lane, 1000);
+            for (const record of prior.filter(record => record.state === 'pending' || record.state === 'signed')) {
+                try {
+                    this.fence(record.batch, () => { });
+                    return;
+                }
+                catch {
+                    store.staleTaskObservation(record.batch.id);
+                }
+            }
+            if (now >= config.policy.expiresAt)
+                return;
+            const owner = this.owner();
+            const groups = new Map();
+            for (const deployment of store.listObservedForegroundDeployments(config.profilePath, 1000)) {
+                const vote = this.vote(deployment, this.source(deployment.task.inboxId));
+                if (!vote || store.hasAppliedTaskObservationVote(this.lane, vote.inboxId, vote.projection.digest))
+                    continue;
+                let group = groups.get(deployment.readiness.planId);
+                if (!group)
+                    groups.set(deployment.readiness.planId, group = { deployment, votes: [] });
+                if (group.votes.length < config.policy.maximumChecks)
+                    group.votes.push(vote);
+            }
+            for (const { deployment, votes } of groups.values()) {
+                if (votes.length < config.policy.minimumChecks)
+                    continue;
+                votes.sort((a, b) => a.inboxId.localeCompare(b.inboxId));
+                const readiness = deployment.readiness;
+                const core = { lane: this.lane, configDigest: this.configDigest, trustDigest: this.trustDigest,
+                    planId: readiness.planId, planDigest: readiness.planDigest, installationId: readiness.installationId,
+                    profilePath: config.profilePath, owner, policy: config.policy, hostGeneration: readiness.hostGeneration, votes };
+                const id = taskObservationId(core);
+                if (store.getTaskObservation(id))
+                    continue;
+                const unsigned = { schemaVersion: 1, kind: 'dsh-task-observation', id, ...core, createdAt: now,
+                    expiresAt: Math.min(config.policy.expiresAt, ...votes.map(vote => vote.completedAt + config.policy.lookbackMs)) };
+                const batch = { ...unsigned, digest: taskObservationDigest(unsigned) };
+                try {
+                    this.fence(batch, () => store.putTaskObservation(batch));
+                    break;
+                }
+                catch { /* Historical deployments and racing current feedback are ineligible. */ }
+            }
+            this.lastError = null;
+        }
+        catch (error) {
+            this.lastError = error instanceof Error ? error.message.slice(0, 200) : 'task observation scan failed';
+        }
+        finally {
+            this.scanning = false;
+        }
+    };
+    definition() {
+        const { scope, timeoutMs, budgetId, budgetAmount } = this.options.config;
+        return { name: 'Observe deployed plugin task feedback', schedule: { kind: 'cron', expression: '* * * * *', timezone: 'UTC' },
+            workspace: scope.workspace, agentPreset: scope.preset, timeoutMs, misfire: { kind: 'latest' }, overlap: 'skip',
+            retrySafety: 'never', maxRetries: 0, principal: scope.principalId, budgetId, budgetAmount,
+            execution: { kind: 'host', executorId: EXECUTOR, executorContractVersion: 1, runbookId: 'observe', runbookVersion: 1,
+                catalogDigest: CATALOG, targetScope: { workspace: scope.workspace, preset: scope.preset },
+                scopeDigest: controlPlaneDigest([scope.workspace, scope.preset]), ownerRouteId: scope.ownerRouteId, activationNonce: this.activationNonce } };
+    }
+    async execute(input) {
+        let began = false;
+        try {
+            const owner = this.owner();
+            const registration = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.scanId });
+            if (input.executionMode !== 'production' || input.automationId !== this.scanId || input.activationNonce !== this.activationNonce
+                || input.definitionHash !== registration?.definitionHash || input.catalogDigest !== CATALOG
+                || registration.activationNonce !== this.activationNonce || input.ownerRouteId !== owner.authorityId
+                || input.principal !== owner.principalId || input.targetScope.workspace !== owner.workspace
+                || input.targetScope.preset !== owner.agentPreset)
+                throw new Error('task observation dispatch changed');
+            const signal = AbortSignal.any([this.abort.signal, input.signal, AbortSignal.timeout(this.options.config.timeoutMs)]);
+            signal.throwIfAborted();
+            began = true;
+            this.scan();
+            for (const record of this.options.store.listTaskObservations(this.lane, 1000)) {
+                signal.throwIfAborted();
+                this.current();
+                if (record.state === 'applied' && record.receipt?.disposition === 'regressed') {
+                    // A committed rollback obligation survives feedback changes and grant expiry.
+                    if (record.batch.profilePath !== this.options.config.profilePath || record.batch.trustDigest !== this.trustDigest)
+                        continue;
+                    if (this.options.store.getPlan(record.batch.planId).status !== 'rolled-back')
+                        await this.options.rollback(record.batch.planId, signal);
+                    continue;
+                }
+                if (record.state !== 'pending' && record.state !== 'signed')
+                    continue;
+                try {
+                    this.fence(record.batch, () => { });
+                }
+                catch {
+                    this.options.store.staleTaskObservation(record.batch.id);
+                    continue;
+                }
+                const receipt = record.receipt ?? await (this.options.request?.(record.batch, signal)
+                    ?? requestTaskObservation(this.options.config.authority, { protocol: 'dsh-task-observation/v1',
+                        observationId: record.batch.id, observationDigest: record.batch.digest }, signal));
+                signal.throwIfAborted();
+                this.current();
+                if (receipt.expiresAt <= Date.now()) {
+                    this.options.store.staleTaskObservation(record.batch.id);
+                    continue;
+                }
+                try {
+                    this.fence(record.batch, () => { });
+                }
+                catch {
+                    this.options.store.staleTaskObservation(record.batch.id);
+                    continue;
+                }
+                const key = resolveTrustKey(this.options.trust, 'host-attestation', receipt.authority, receipt.keyId);
+                const authority = new Ed25519PostActivationObservationAuthority(key.publicKeyPem, key.authority, key.keyId, { receiptTtlMs: 300_000 });
+                try {
+                    await authority.verify(receipt, this.options.store.getPlan(record.batch.planId), this.options.store.getActivationWatch(record.batch.planId).exact);
+                    signal.throwIfAborted();
+                    this.fence(record.batch, () => this.options.store.signTaskObservation(record.batch.id, receipt));
+                }
+                catch (error) {
+                    this.options.store.staleTaskObservation(record.batch.id);
+                    throw error;
+                }
+                await this.options.store.recordPostActivationObservation({ receipt, taskObservationId: record.batch.id,
+                    idempotencyKey: `post-activation-observation:${receipt.observationId}`,
+                    withSourceFence: callback => { signal.throwIfAborted(); return this.fence(record.batch, callback); },
+                    resolveAuthority: value => {
+                        this.current();
+                        const key = resolveTrustKey(this.options.trust, 'host-attestation', value.authority, value.keyId);
+                        return new Ed25519PostActivationObservationAuthority(key.publicKeyPem, key.authority, key.keyId, { receiptTtlMs: 300_000 });
+                    } });
+                if (receipt.disposition === 'regressed')
+                    await this.options.rollback(record.batch.planId, signal);
+            }
+            if (this.lastError)
+                throw new Error(this.lastError);
+            return { outcome: 'succeeded', failureClass: 'none', failurePhase: 'none', failureCode: 'none', sideEffectState: 'possible', retryability: 'unsafe' };
+        }
+        catch (error) {
+            this.lastError = error instanceof Error ? error.message.slice(0, 200) : 'task observation failed';
+            return { outcome: began ? 'unknown' : 'failed', failureClass: began ? 'unknown' : 'configuration', failurePhase: 'host-execution',
+                failureCode: 'task-observation-rejected', sideEffectState: began ? 'unknown' : 'none', retryability: began ? 'unsafe' : 'after-intervention' };
+        }
+    }
+}
+//# sourceMappingURL=task-observation-runtime.js.map

package/lib/task-observation-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-runtime.js","sourceRoot":"","sources":["../src/task-observation-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAI/C,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACtF,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,yCAAyC,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,eAAe,EAAiC,MAAM,YAAY,CAAA;AAK3E,MAAM,KAAK,GAAG,wCAAwC,CAAA;AACtD,MAAM,QAAQ,GAAG,2CAA2C,CAAA;AAC5D,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;AACtE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAKjG,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;IACtH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AACjH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAA6B;IACzE,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAChH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;IACjD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAA;IACjI,MAAM,IAAI,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;WACzG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,oEAAoE,CAAC;WACnF,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,yEAAyE,CAAC;WAChG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,2CAA2C,CAAC;WACjE,CAAC,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;WAC9D,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC;WAC3D,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,IAAI,CAAC;WACpD,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;WACtH,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC;WACtG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,UAAU,CAAC;WACtG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;WACrE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IACvK,kCAAkC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AACtD,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,sBAAsB;IAeJ;IAdZ,IAAI,CAAQ;IACZ,YAAY,CAAQ;IACpB,WAAW,CAAQ;IACnB,MAAM,CAAQ;IACd,UAAU,GAAG,UAAU,EAAE,CAAA;IACzB,eAAe,CAAQ;IACvB,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC9C,UAAU,CAAa;IACvB,WAAW,CAAa;IACxB,OAAO,CAAgB;IACvB,MAAM,GAAG,KAAK,CAAA;IACd,QAAQ,GAAG,KAAK,CAAA;IAChB,SAAS,GAAkB,IAAI,CAAA;IACvC,YAA6B,OAM5B;QAN4B,YAAO,GAAP,OAAO,CAMnC;QACC,6BAA6B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACxG,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,GAAG,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAA;QAClD,IAAI,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC9D,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE;YAChF,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO;mBAChH,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC;YAC9D,OAAO,EAAE,KAAK,CAAC,EAAE;gBACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACxB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACtE,OAAO,MAAM,CAAA;YACf,CAAC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM;YAChF,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAChH,IAAI,CAAC,IAAI,EAAE,CAAA;IACb,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;gBAClH,IAAI,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC,eAAe;oBAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK;wBAC5G,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YACnJ,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAClB,IAAI,CAAC;oBAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBACpC,IAAI,CAAC;wBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;oBAAC,CAAC;4BAAS,CAAC;wBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;wBACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAE9D,OAAO;QACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IACO,KAAK;QACX,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;QACvC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY;YACpG,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC;IACO,MAAM,CAAC,OAAe;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QACnH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sCAAsC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QACpG,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAA;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;YACtG,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAA;QACtI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;eACtH,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,SAAS,CAAA;QACxD,OAAO,MAAM,CAAA;IACf,CAAC;IACO,IAAI,CAAC,UAAsC,EAAE,MAA+C;QAClG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,CAAA;QACpE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;eAChF,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,cAAc,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM,KAAK,UAAU;eACnG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,KAAK,iBAAiB,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,KAAK,QAAQ;eACrH,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;eACzH,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS;eACjH,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB;eAC1E,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB;eACxE,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;eACvH,UAAU,CAAC,SAAS,CAAC,WAAW,GAAG,GAAG,IAAI,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU;eACxH,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG;YAAE,OAAO,SAAS,CAAA;QAChF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE;YACrI,YAAY,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;YACxJ,gBAAgB,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAA;IAC7G,CAAC;IACO,IAAI,CAAC,KAA2B;QACtC,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;eAClH,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QACvG,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACvH,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAChI,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC;IACO,KAAK,CAAI,KAA2B,EAAE,QAAiB;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QAC/H,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,KAAK;YAChF,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE;YAChJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChB,OAAO,QAAQ,EAAE,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACvF,OAAO,MAAM,CAAC,KAAK,CAAA;IACrB,CAAC;IAED,mFAAmF;IACnF,IAAI,GAAG,GAAS,EAAE;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;YAChF,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACzD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAAC,OAAM;gBAAC,CAAC;gBAClD,MAAM,CAAC;oBAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAAC,CAAC;YACvD,CAAC;YACD,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAM;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoF,CAAA;YAC1G,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,iCAAiC,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;gBACxE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,SAAQ;gBAC3G,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBACnD,IAAI,CAAC,KAAK;oBAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;gBACtF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa;oBAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9E,CAAC;YACD,KAAK,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpD,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa;oBAAE,SAAQ;gBACxD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;gBACxD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;gBACtC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC5F,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc;oBACpG,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,KAAK,EAAE,CAAA;gBAClH,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;gBAClC,IAAI,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAAE,SAAQ;gBAC1C,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,IAAI,EAAE,sBAA+B,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG;oBAC9G,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;gBACnH,MAAM,KAAK,GAAG,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAA;gBACtE,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAC,MAAK;gBAAC,CAAC;gBACvE,MAAM,CAAC,CAAC,wEAAwE,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAA;QAAC,CAAC;gBAClH,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;QAAC,CAAC;IACnC,CAAC,CAAA;IAEO,UAAU;QAChB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QACxE,OAAO,EAAE,IAAI,EAAE,uCAAuC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC1H,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM;YAC9G,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY;YACzF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;gBAClH,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBACzF,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAA;IACnJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAkC;QACtD,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvH,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBAC3H,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,cAAc,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO;mBACxF,YAAY,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW;mBACjG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;mBACxF,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACzG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,CAAC,cAAc,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAA;YACrC,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9E,MAAM,CAAC,cAAc,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAA;gBACvC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;oBAC9E,8EAA8E;oBAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;wBAAE,SAAQ;oBAC3H,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,aAAa;wBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;oBACtI,SAAQ;gBACV,CAAC;gBACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;oBAAE,SAAQ;gBACrE,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBACvH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;uBAChF,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,yBAAyB;wBAC5F,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;gBACtF,MAAM,CAAC,cAAc,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAA;gBACvC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBAC3G,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAAC,SAAQ;gBAAC,CAAC;gBACvH,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACrG,MAAM,SAAS,GAAG,IAAI,yCAAyC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAA;gBACtI,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAA;oBAClJ,MAAM,CAAC,cAAc,EAAE,CAAA;oBACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;gBAClG,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;oBACxD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;oBACpG,cAAc,EAAE,+BAA+B,OAAO,CAAC,aAAa,EAAE;oBACtE,eAAe,EAAE,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC;oBACnG,gBAAgB,EAAE,KAAK,CAAC,EAAE;wBACxB,IAAI,CAAC,OAAO,EAAE,CAAA;wBACd,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;wBACjG,OAAO,IAAI,yCAAyC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAA;oBAC7H,CAAC,EAAE,CAAC,CAAA;gBACN,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACnG,CAAC;YACD,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;QACvJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAA;YACjG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,gBAAgB;gBAC/H,WAAW,EAAE,2BAA2B,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAA;QAClJ,CAAC;IACH,CAAC;CACF"}

package/lib/task-observation-store.d.ts

@@ -0,0 +1,17 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { type ForegroundDeploymentRecord } from './foreground-deployment.js';
+import { readOwnerSourceAdoptionPlan } from './store.js';
+import type { PluginActivationPlan } from './types.js';
+import type { TaskObservationBatch, TaskObservationRecord } from './task-observation-types.js';
+export declare function taskObservationId(batch: Omit<TaskObservationBatch, 'schemaVersion' | 'kind' | 'id' | 'digest' | 'createdAt' | 'expiresAt'>): string;
+export declare function taskObservationDigest(batch: Omit<TaskObservationBatch, 'digest'>): string;
+export declare function assertTaskObservationBatch(value: unknown): asserts value is TaskObservationBatch;
+export declare function getTaskObservationRecord(db: DatabaseSync, id: string): TaskObservationRecord | undefined;
+/** Read-only durable cohort validation; canonical quality is fenced by the Host. */
+export declare function readTaskObservationContext(db: DatabaseSync, id: string): {
+    record: TaskObservationRecord;
+    plan: PluginActivationPlan;
+    source: ReturnType<typeof readOwnerSourceAdoptionPlan>['source'];
+    deployments: readonly ForegroundDeploymentRecord[];
+};
+//# sourceMappingURL=task-observation-store.d.ts.map

package/lib/task-observation-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-store.d.ts","sourceRoot":"","sources":["../src/task-observation-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAA8B,KAAK,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAExG,OAAO,EAA8C,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAEpG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAW9F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAInJ;AACD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,MAAM,CAGzF;AACD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAyBhG;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAaxG;AAED,oFAAoF;AACpF,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG;IACxE,MAAM,EAAE,qBAAqB,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;IACzD,MAAM,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,QAAQ,CAAC,CAAC;IAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAA;CACrH,CAwCA"}

package/lib/task-observation-store.js

@@ -0,0 +1,115 @@
+import { isAbsolute, resolve } from 'node:path';
+import { assertForegroundDeployment } from './foreground-deployment.js';
+import { controlPlaneSchemaVersion } from './sqlite.js';
+import { controlPlaneDigest, ControlPlaneStoreError, readOwnerSourceAdoptionPlan } from './store.js';
+import { parsePostActivationObservation } from './post-activation.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const DIGEST = /^[a-f0-9]{64}$/u;
+const fail = (message) => { throw new ControlPlaneStoreError('invalid-state', message); };
+const same = (a, b) => controlPlaneDigest(a) === controlPlaneDigest(b);
+const integer = (value, min, max = Number.MAX_SAFE_INTEGER) => Number.isSafeInteger(value) && value >= min && value <= max;
+const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 4096
+    && value.normalize('NFC').trim() === value && !/[\p{Cc}]/u.test(value);
+const path = (value) => text(value) && isAbsolute(value) && resolve(value) === value;
+export function taskObservationId(batch) {
+    return `task-observation-${controlPlaneDigest({ lane: batch.lane, configDigest: batch.configDigest, trustDigest: batch.trustDigest,
+        planId: batch.planId, planDigest: batch.planDigest, installationId: batch.installationId, profilePath: batch.profilePath,
+        owner: batch.owner, policy: batch.policy, hostGeneration: batch.hostGeneration, votes: batch.votes })}`;
+}
+export function taskObservationDigest(batch) {
+    const { digest: _digest, ...unsigned } = batch;
+    return controlPlaneDigest(unsigned);
+}
+export function assertTaskObservationBatch(value) {
+    const batch = value;
+    if (!batch || typeof batch !== 'object' || batch.schemaVersion !== 1 || batch.kind !== 'dsh-task-observation'
+        || !ID.test(batch.id) || !DIGEST.test(batch.digest) || !DIGEST.test(batch.lane) || !DIGEST.test(batch.configDigest)
+        || !DIGEST.test(batch.trustDigest) || !ID.test(batch.planId) || !DIGEST.test(batch.planDigest) || !Array.isArray(batch.votes)
+        || !path(batch.profilePath) || !text(batch.installationId) || !integer(batch.hostGeneration, 1)
+        || !integer(batch.createdAt, 1) || !integer(batch.expiresAt, batch.createdAt + 1)
+        || !batch.policy || !ID.test(batch.policy.id) || !integer(batch.policy.expiresAt, batch.expiresAt)
+        || !integer(batch.policy.maximumObservations, 1, 1000) || !integer(batch.policy.minimumChecks, 1, 32)
+        || !integer(batch.policy.maximumChecks, batch.policy.minimumChecks, 32) || !integer(batch.policy.lookbackMs, 1000, 30 * 86_400_000)
+        || batch.votes.length < batch.policy.minimumChecks || batch.votes.length > batch.policy.maximumChecks
+        || !batch.owner || ![batch.owner.authorityId, batch.owner.principalId, batch.owner.principalRecordId, batch.owner.agentPreset].every(text)
+        || !DIGEST.test(batch.owner.authorityHash) || !path(batch.owner.workspace) || !integer(batch.owner.principalVersion, 1)
+        || Buffer.byteLength(JSON.stringify(batch)) > 262_144)
+        fail('task observation batch is invalid');
+    const seen = new Set();
+    for (const vote of batch.votes) {
+        if (!vote || !text(vote.inboxId) || !text(vote.outcomeId) || !DIGEST.test(vote.sourceDigest) || !DIGEST.test(vote.deploymentDigest)
+            || !['achieved', 'not-achieved'].includes(vote.status) || !integer(vote.completedAt, 1, batch.createdAt)
+            || batch.expiresAt > vote.completedAt + batch.policy.lookbackMs || !vote.projection
+            || vote.projection.subjectKind !== 'foreground-turn' || vote.projection.subjectRef !== vote.inboxId
+            || vote.projection.disposition !== 'upsert' || !integer(vote.projection.version, 1) || !DIGEST.test(vote.projection.digest)
+            || seen.has(vote.inboxId))
+            fail('task observation vote is invalid');
+        seen.add(vote.inboxId);
+    }
+    if (batch.id !== taskObservationId(batch) || batch.digest !== taskObservationDigest(batch))
+        fail('task observation digest differs');
+}
+export function getTaskObservationRecord(db, id) {
+    const row = db.prepare('SELECT id,lane,plan_id,batch_json,batch_digest,state,receipt_json,receipt_digest FROM task_observation_batches WHERE id=?').get(id);
+    if (!row)
+        return undefined;
+    if (Buffer.byteLength(row.batch_json) > 262_144)
+        fail('stored task observation exceeds bound');
+    const batch = JSON.parse(row.batch_json);
+    assertTaskObservationBatch(batch);
+    if (controlPlaneDigest(batch) !== row.batch_digest || batch.id !== row.id || batch.lane !== row.lane || batch.planId !== row.plan_id
+        || !['pending', 'signed', 'applied', 'stale'].includes(row.state))
+        fail('stored task observation changed');
+    const receipt = row.receipt_json === null ? undefined : parsePostActivationObservation(JSON.parse(row.receipt_json));
+    if (receipt && (controlPlaneDigest(receipt) !== row.receipt_digest || receipt.observationId !== id || receipt.evidence.probeDigest !== batch.digest))
+        fail('stored task observation receipt changed');
+    if ((row.state === 'signed' || row.state === 'applied') && !receipt)
+        fail('stored task observation receipt missing');
+    return Object.freeze({ batch, state: row.state, ...(receipt === undefined ? {} : { receipt }) });
+}
+/** Read-only durable cohort validation; canonical quality is fenced by the Host. */
+export function readTaskObservationContext(db, id) {
+    if (Number(db.prepare('PRAGMA user_version').get()?.user_version) !== controlPlaneSchemaVersion)
+        fail('task observation database version is invalid');
+    const record = getTaskObservationRecord(db, id);
+    if (!record)
+        return fail('task observation absent');
+    const { batch } = record;
+    const adopted = readOwnerSourceAdoptionPlan(db, batch.planId), plan = adopted.plan;
+    if (batch.planDigest !== plan.digest || batch.installationId !== plan.installationId || batch.profilePath !== plan.target.profilePath)
+        fail('task observation plan changed');
+    for (const key of ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset']) {
+        if (batch.owner[key] !== adopted.source.owner[key])
+            fail('task observation source owner changed');
+    }
+    const unsettled = db.prepare(`SELECT 1 FROM activation_plans WHERE target_path=? AND status IN (
+    'staging','awaiting-reload','awaiting-readiness','awaiting-effect-blocked-replay','awaiting-shadow',
+    'awaiting-canary','awaiting-soak','awaiting-health','commit-pending','rollback-pending') LIMIT 1`).get(plan.target.profilePath);
+    const latest = db.prepare(`SELECT checkpoint.plan_id,checkpoint.exposure_order,checkpoint.successful_order
+    FROM activation_deployment_checkpoints checkpoint JOIN activation_plans candidate ON candidate.id=checkpoint.plan_id
+    WHERE candidate.target_path=? ORDER BY checkpoint.exposure_order DESC LIMIT 1`).get(plan.target.profilePath);
+    const watch = db.prepare('SELECT state,activation_id,fence,started_at,last_host_generation FROM activation_watch WHERE plan_id=?').get(plan.id);
+    if (unsettled || latest?.plan_id !== plan.id || latest.exposure_order !== latest.successful_order || plan.status !== 'activated'
+        || !plan.activation || !watch || watch.state !== 'watching' || watch.activation_id !== plan.activation.id
+        || watch.fence !== plan.activation.fence || watch.last_host_generation !== batch.hostGeneration)
+        return fail('task observation deployment is no longer current');
+    const deployments = batch.votes.map(vote => {
+        const row = db.prepare('SELECT record_json,record_digest,plan_id FROM foreground_deployments WHERE inbox_id=?').get(vote.inboxId);
+        if (!row || row.plan_id !== plan.id || Buffer.byteLength(row.record_json) > 262_144)
+            return fail('task observation deployment absent');
+        const item = JSON.parse(row.record_json);
+        assertForegroundDeployment(item);
+        if (controlPlaneDigest(item) !== row.record_digest || row.record_digest !== vote.deploymentDigest
+            || item.state !== 'observed' || !item.execution || item.execution.completedAt !== vote.completedAt || item.task.inboxId !== vote.inboxId
+            || item.task.owner.principalRecordId !== batch.owner.principalRecordId || item.task.owner.principalVersion !== batch.owner.principalVersion
+            || item.task.scope.workspace !== batch.owner.workspace || item.task.scope.preset !== batch.owner.agentPreset
+            || item.task.dispatchedAt < watch.started_at || item.readiness.planId !== plan.id || item.readiness.planDigest !== plan.digest
+            || item.readiness.hostGeneration !== batch.hostGeneration || item.readiness.installationId !== batch.installationId
+            || item.readiness.profilePath !== batch.profilePath || item.readiness.activationId !== plan.activation.id
+            || item.readiness.fence !== plan.activation.fence || !same(item.readiness.exact, { package: plan.candidate.package, version: plan.candidate.version, integrity: plan.candidate.integrity }))
+            fail('task observation deployment witness changed');
+        return item;
+    });
+    return { record, plan, source: adopted.source, deployments };
+}
+//# sourceMappingURL=task-observation-store.js.map

package/lib/task-observation-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-store.js","sourceRoot":"","sources":["../src/task-observation-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,0BAA0B,EAAmC,MAAM,4BAA4B,CAAA;AACxG,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAIrE,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE,GAAG,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA,CAAC,CAAC,CAAA;AACvG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAA;AACjG,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAA;AACnJ,MAAM,IAAI,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;OACzG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACxE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAA;AAErG,MAAM,UAAU,iBAAiB,CAAC,KAAyG;IACzI,OAAO,oBAAoB,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QAChI,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACxH,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAA;AAC3G,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAA2C;IAC/E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,KAA6B,CAAA;IACtE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AACrC,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,KAAK,GAAG,KAA6B,CAAA;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB;WACxG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;WAChH,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;WAC1H,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;WAC5F,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;WAC9E,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;WAC/F,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;WAClG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC;WAChI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa;WAClG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;WACvI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;WACpH,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAClG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;eAC9H,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;eACrG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;eAChF,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,iBAAiB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO;eAChG,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;eACxH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,KAAK,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;AACrI,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EAAgB,EAAE,EAAU;IACnE,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,2HAA2H,CAAC,CAAC,GAAG,CAAC,EAAE,CACsB,CAAA;IAChL,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,OAAO;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAyB,CAAA;IAChE,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO;WAC/H,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC5G,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IACpH,IAAI,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACrM,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;IACpH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAuC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;AACpI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B,CAAC,EAAgB,EAAE,EAAU;IAIrE,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,KAAK,yBAAyB;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;IACrJ,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;IACxB,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAClF,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC5K,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,CAAU,EAAE,CAAC;QAChJ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC;;qGAEsE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACjI,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;kFAEsD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CACnB,CAAA;IAC1F,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,wGAAwG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACvB,CAAA;IACvH,IAAI,SAAS,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;WAC3H,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE;WACtG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC,kDAAkD,CAAC,CAAA;IAClK,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,uFAAuF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CACnD,CAAA;QAC7E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,OAAO;YAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACtI,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA+B,CAAA;QACtE,0BAA0B,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,gBAAgB;eAC5F,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;eACrI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,KAAK,CAAC,gBAAgB;eACxI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW;eACzG,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;eAC3H,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;eAChH,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAW,CAAC,EAAE;eACvG,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,UAAW,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAC9E,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;QACnK,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAA;AAC9D,CAAC"}

package/lib/task-observation-types.d.ts

@@ -0,0 +1,67 @@
+import type { EvaluationCanonicalLearningEvidenceTuple } from '@dsh-enhanced/assistant-evaluation';
+import type { SourceJobOwnerReceipt } from './source-job-types.js';
+import type { SourceApprovalClientConfig } from './source-approval-client.js';
+import type { PostActivationObservationReceipt } from './types.js';
+export type TaskObservationOwner = Pick<SourceJobOwnerReceipt, 'authorityId' | 'authorityHash' | 'principalId' | 'principalRecordId' | 'principalVersion' | 'workspace' | 'agentPreset'>;
+export interface TaskObservationPolicy {
+    id: string;
+    expiresAt: number;
+    maximumObservations: number;
+    minimumChecks: number;
+    maximumChecks: number;
+    lookbackMs: number;
+}
+export interface TaskObservationConfig {
+    policy: TaskObservationPolicy;
+    scope: {
+        ownerRouteId: string;
+        principalId: string;
+        workspace: string;
+        preset: string;
+    };
+    profilePath: string;
+    timeoutMs: number;
+    budgetId: string;
+    budgetAmount: number;
+    authority: SourceApprovalClientConfig;
+}
+/** Facts reread from trusted Delivery/Evaluation, never an Agent's rating. */
+export interface TaskObservationVote {
+    inboxId: string;
+    outcomeId: string;
+    projection: EvaluationCanonicalLearningEvidenceTuple;
+    sourceDigest: string;
+    deploymentDigest: string;
+    status: 'achieved' | 'not-achieved';
+    completedAt: number;
+}
+export interface TaskObservationBatch {
+    schemaVersion: 1;
+    kind: 'dsh-task-observation';
+    id: string;
+    digest: string;
+    lane: string;
+    configDigest: string;
+    trustDigest: string;
+    planId: string;
+    planDigest: string;
+    installationId: string;
+    profilePath: string;
+    owner: TaskObservationOwner;
+    policy: TaskObservationPolicy;
+    hostGeneration: number;
+    votes: readonly TaskObservationVote[];
+    createdAt: number;
+    expiresAt: number;
+}
+export interface TaskObservationRecord {
+    batch: TaskObservationBatch;
+    state: 'pending' | 'signed' | 'applied' | 'stale';
+    receipt?: PostActivationObservationReceipt;
+}
+export interface TaskObservationRequest {
+    protocol: 'dsh-task-observation/v1';
+    observationId: string;
+    observationDigest: string;
+}
+//# sourceMappingURL=task-observation-types.d.ts.map

package/lib/task-observation-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-types.d.ts","sourceRoot":"","sources":["../src/task-observation-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,oCAAoC,CAAA;AAClG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAA;AAElE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,eAAe,GAAG,aAAa,GAC1G,mBAAmB,GAAG,kBAAkB,GAAG,WAAW,GAAG,aAAa,CAAC,CAAA;AAE3E,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,qBAAqB,CAAA;IAC7B,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACvF,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,0BAA0B,CAAA;CACtC;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,wCAAwC,CAAA;IACpD,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,UAAU,GAAG,cAAc,CAAA;IACnC,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,sBAAsB,CAAA;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,MAAM,EAAE,qBAAqB,CAAA;IAC7B,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,oBAAoB,CAAA;IAC3B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;IACjD,OAAO,CAAC,EAAE,gCAAgC,CAAA;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,yBAAyB,CAAA;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;CAC1B"}

package/lib/task-observation-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=task-observation-types.js.map

package/lib/task-observation-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-types.js","sourceRoot":"","sources":["../src/task-observation-types.ts"],"names":[],"mappings":""}

package/lib/trust.d.ts

@@ -42,6 +42,9 @@ export interface PluginControlTrustConfig {
     releaseRegistry?: {
         id: string;
         locator: string;
+        protocol?: 'dsh' | 'npm';
+        caPins: readonly string[];
+        tokenEnvironment: string | null;
     };
     releaseReceiptTtlMs: number;
     releaseAdapters?: Partial<Record<SourceReleasePhase, SourceReleaseAdapterIdentity & {