@dsh-enhanced/plugin-control-plane 0.1.47 → 0.1.49

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (167) hide show
  1. package/README.md +183 -15
  2. package/bin/dsh-live-qualification-authority.js +15 -0
  3. package/bin/dsh-local-release-adapter.js +328 -8
  4. package/bin/dsh-systemd-host-attestor.js +359 -9
  5. package/bin/dsh-systemd-host-authority.js +12 -0
  6. package/lib/adoption-coordinator.d.ts +3 -1
  7. package/lib/adoption-coordinator.d.ts.map +1 -1
  8. package/lib/adoption-coordinator.js +24 -9
  9. package/lib/adoption-coordinator.js.map +1 -1
  10. package/lib/cli.d.ts.map +1 -1
  11. package/lib/cli.js +33 -14
  12. package/lib/cli.js.map +1 -1
  13. package/lib/creation-capability-feedback.d.ts +23 -0
  14. package/lib/creation-capability-feedback.d.ts.map +1 -0
  15. package/lib/creation-capability-feedback.js +132 -0
  16. package/lib/creation-capability-feedback.js.map +1 -0
  17. package/lib/creation-capability-journal.d.ts +66 -0
  18. package/lib/creation-capability-journal.d.ts.map +1 -0
  19. package/lib/creation-capability-journal.js +751 -0
  20. package/lib/creation-capability-journal.js.map +1 -0
  21. package/lib/creation-capability-runtime.d.ts +63 -0
  22. package/lib/creation-capability-runtime.d.ts.map +1 -0
  23. package/lib/creation-capability-runtime.js +564 -0
  24. package/lib/creation-capability-runtime.js.map +1 -0
  25. package/lib/creation-capability-source.d.ts +37 -0
  26. package/lib/creation-capability-source.d.ts.map +1 -0
  27. package/lib/creation-capability-source.js +328 -0
  28. package/lib/creation-capability-source.js.map +1 -0
  29. package/lib/creation-capability-types.d.ts +252 -0
  30. package/lib/creation-capability-types.d.ts.map +1 -0
  31. package/lib/creation-capability-types.js +2 -0
  32. package/lib/creation-capability-types.js.map +1 -0
  33. package/lib/deployment-readiness.d.ts +16 -0
  34. package/lib/deployment-readiness.d.ts.map +1 -1
  35. package/lib/deployment-readiness.js +48 -1
  36. package/lib/deployment-readiness.js.map +1 -1
  37. package/lib/effect-blocked-replay.js +2 -2
  38. package/lib/effect-blocked-replay.js.map +1 -1
  39. package/lib/foreground-deployment-runtime.d.ts +3 -0
  40. package/lib/foreground-deployment-runtime.d.ts.map +1 -1
  41. package/lib/foreground-deployment-runtime.js +55 -13
  42. package/lib/foreground-deployment-runtime.js.map +1 -1
  43. package/lib/foreground-deployment.d.ts.map +1 -1
  44. package/lib/foreground-deployment.js +5 -0
  45. package/lib/foreground-deployment.js.map +1 -1
  46. package/lib/host-attestor.d.ts +2 -0
  47. package/lib/host-attestor.d.ts.map +1 -1
  48. package/lib/host-attestor.js +8 -1
  49. package/lib/host-attestor.js.map +1 -1
  50. package/lib/host-inputs.d.ts +13 -0
  51. package/lib/host-inputs.d.ts.map +1 -0
  52. package/lib/host-inputs.js +162 -0
  53. package/lib/host-inputs.js.map +1 -0
  54. package/lib/host-maintenance.d.ts +61 -0
  55. package/lib/host-maintenance.d.ts.map +1 -0
  56. package/lib/host-maintenance.js +158 -0
  57. package/lib/host-maintenance.js.map +1 -0
  58. package/lib/host-readiness.d.ts +5 -0
  59. package/lib/host-readiness.d.ts.map +1 -0
  60. package/lib/host-readiness.js +22 -0
  61. package/lib/host-readiness.js.map +1 -0
  62. package/lib/index.d.ts +16 -0
  63. package/lib/index.d.ts.map +1 -1
  64. package/lib/index.js +7 -0
  65. package/lib/index.js.map +1 -1
  66. package/lib/live-qualification-authority.d.ts +32 -0
  67. package/lib/live-qualification-authority.d.ts.map +1 -0
  68. package/lib/live-qualification-authority.js +280 -0
  69. package/lib/live-qualification-authority.js.map +1 -0
  70. package/lib/live-qualification-client.d.ts +4 -0
  71. package/lib/live-qualification-client.d.ts.map +1 -0
  72. package/lib/live-qualification-client.js +22 -0
  73. package/lib/live-qualification-client.js.map +1 -0
  74. package/lib/live-qualification-runtime.d.ts +78 -0
  75. package/lib/live-qualification-runtime.d.ts.map +1 -0
  76. package/lib/live-qualification-runtime.js +367 -0
  77. package/lib/live-qualification-runtime.js.map +1 -0
  78. package/lib/live-qualification.d.ts +73 -0
  79. package/lib/live-qualification.d.ts.map +1 -0
  80. package/lib/live-qualification.js +164 -0
  81. package/lib/live-qualification.js.map +1 -0
  82. package/lib/owner-task-gaps.d.ts +2 -0
  83. package/lib/owner-task-gaps.d.ts.map +1 -1
  84. package/lib/owner-task-gaps.js +9 -1
  85. package/lib/owner-task-gaps.js.map +1 -1
  86. package/lib/runtime-epoch.d.ts +69 -0
  87. package/lib/runtime-epoch.d.ts.map +1 -0
  88. package/lib/runtime-epoch.js +139 -0
  89. package/lib/runtime-epoch.js.map +1 -0
  90. package/lib/runtime-observer.d.ts.map +1 -1
  91. package/lib/runtime-observer.js +42 -6
  92. package/lib/runtime-observer.js.map +1 -1
  93. package/lib/service.d.ts +247 -4
  94. package/lib/service.d.ts.map +1 -1
  95. package/lib/service.js +1332 -27
  96. package/lib/service.js.map +1 -1
  97. package/lib/source-adoption-authority.d.ts +3 -0
  98. package/lib/source-adoption-authority.d.ts.map +1 -1
  99. package/lib/source-adoption-authority.js +13 -3
  100. package/lib/source-adoption-authority.js.map +1 -1
  101. package/lib/source-adoption-runner.d.ts +3 -0
  102. package/lib/source-adoption-runner.d.ts.map +1 -1
  103. package/lib/source-adoption-runner.js +16 -4
  104. package/lib/source-adoption-runner.js.map +1 -1
  105. package/lib/source-baseline.d.ts +37 -0
  106. package/lib/source-baseline.d.ts.map +1 -0
  107. package/lib/source-baseline.js +250 -0
  108. package/lib/source-baseline.js.map +1 -0
  109. package/lib/source-build.d.ts +17 -1
  110. package/lib/source-build.d.ts.map +1 -1
  111. package/lib/source-build.js +501 -7
  112. package/lib/source-build.js.map +1 -1
  113. package/lib/source-context.d.ts +18 -0
  114. package/lib/source-context.d.ts.map +1 -1
  115. package/lib/source-context.js +85 -11
  116. package/lib/source-context.js.map +1 -1
  117. package/lib/source-creation.d.ts +106 -0
  118. package/lib/source-creation.d.ts.map +1 -0
  119. package/lib/source-creation.js +664 -0
  120. package/lib/source-creation.js.map +1 -0
  121. package/lib/source-job-types.d.ts +19 -0
  122. package/lib/source-job-types.d.ts.map +1 -1
  123. package/lib/source-jobs.d.ts +30 -3
  124. package/lib/source-jobs.d.ts.map +1 -1
  125. package/lib/source-jobs.js +382 -40
  126. package/lib/source-jobs.js.map +1 -1
  127. package/lib/source-maintenance.d.ts +66 -0
  128. package/lib/source-maintenance.d.ts.map +1 -0
  129. package/lib/source-maintenance.js +177 -0
  130. package/lib/source-maintenance.js.map +1 -0
  131. package/lib/source-revision.d.ts +57 -0
  132. package/lib/source-revision.d.ts.map +1 -0
  133. package/lib/source-revision.js +175 -0
  134. package/lib/source-revision.js.map +1 -0
  135. package/lib/source-workspace.d.ts +19 -14
  136. package/lib/source-workspace.d.ts.map +1 -1
  137. package/lib/source-workspace.js +90 -17
  138. package/lib/source-workspace.js.map +1 -1
  139. package/lib/sqlite.d.ts +13 -3
  140. package/lib/sqlite.d.ts.map +1 -1
  141. package/lib/sqlite.js +362 -1
  142. package/lib/sqlite.js.map +1 -1
  143. package/lib/store.d.ts +258 -3
  144. package/lib/store.d.ts.map +1 -1
  145. package/lib/store.js +2211 -95
  146. package/lib/store.js.map +1 -1
  147. package/lib/systemd-host-authority.d.ts +68 -0
  148. package/lib/systemd-host-authority.d.ts.map +1 -0
  149. package/lib/systemd-host-authority.js +424 -0
  150. package/lib/systemd-host-authority.js.map +1 -0
  151. package/lib/task-observation-evidence.d.ts +32 -0
  152. package/lib/task-observation-evidence.d.ts.map +1 -0
  153. package/lib/task-observation-evidence.js +62 -0
  154. package/lib/task-observation-evidence.js.map +1 -0
  155. package/lib/task-observation-runtime.d.ts +2 -3
  156. package/lib/task-observation-runtime.d.ts.map +1 -1
  157. package/lib/task-observation-runtime.js +7 -39
  158. package/lib/task-observation-runtime.js.map +1 -1
  159. package/lib/task-observation-store.js +1 -1
  160. package/lib/trust.d.ts.map +1 -1
  161. package/lib/trust.js +0 -0
  162. package/lib/trust.js.map +1 -1
  163. package/lib/types.d.ts +43 -6
  164. package/lib/types.d.ts.map +1 -1
  165. package/lib/version.d.ts +1 -1
  166. package/lib/version.js +1 -1
  167. package/package.json +21 -14
@@ -0,0 +1,367 @@
1
+ import { randomUUID } from 'node:crypto';
2
+ import { isAbsolute, resolve } from 'node:path';
3
+ import { controlPlaneDigest } from './store.js';
4
+ import { validateSourceApprovalClientConfig } from './source-approval-client.js';
5
+ import { requestLiveQualification } from './live-qualification-client.js';
6
+ import { assertLiveQualificationBatch, liveQualificationDigest, liveQualificationId } from './live-qualification.js';
7
+ import { trustedForegroundSource, trustedForegroundVote, withTrustedForegroundVoteFence, taskObservationOwner } from './task-observation-evidence.js';
8
+ import { resolveTrustKey } from './trust.js';
9
+ const OWNER = 'plugin-control-plane-live-qualification';
10
+ const EXECUTOR = 'plugin-control-plane-live-qualification-v1';
11
+ const CATALOG = controlPlaneDigest({ executor: EXECUTOR, version: 1 });
12
+ const same = (a, b) => controlPlaneDigest(a) === controlPlaneDigest(b);
13
+ export function validateLiveQualificationConfig(config) {
14
+ const exact = (value, keys) => !!value && typeof value === 'object' && !Array.isArray(value)
15
+ && Object.keys(value).sort().join(',') === keys;
16
+ const integer = (value, min, max) => Number.isSafeInteger(value) && value >= min && value <= max;
17
+ const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 4096
18
+ && value.normalize('NFC').trim() === value && !/[\p{Cc}]/u.test(value);
19
+ if (!exact(config, 'authority,budgetAmount,budgetId,profilePath,scope,timeoutMs')
20
+ || !exact(config.scope, 'ownerRouteId,preset,principalId,workspace')
21
+ || !integer(config.timeoutMs, 1000, 300_000) || !integer(config.budgetAmount, 1, 10_000_000)
22
+ || !text(config.budgetId) || config.budgetId.length > 128 || !Object.values(config.scope).every(text)
23
+ || !text(config.profilePath) || ![config.profilePath, config.scope.workspace].every(path => isAbsolute(path) && resolve(path) === path)) {
24
+ throw new Error('invalid liveQualification configuration');
25
+ }
26
+ validateSourceApprovalClientConfig(config.authority);
27
+ }
28
+ /** A finite native-automation witness for real foreground tasks, without a second Agent loop. */
29
+ export class LiveQualificationRuntime {
30
+ options;
31
+ lane;
32
+ configDigest;
33
+ trustDigest;
34
+ scanId;
35
+ generation = randomUUID();
36
+ activationNonce;
37
+ abort = new AbortController();
38
+ flights = new Set();
39
+ unregister;
40
+ unsubscribe;
41
+ closing;
42
+ active = false;
43
+ runtimeWasAvailable = false;
44
+ scanning = false;
45
+ lastError = null;
46
+ constructor(options) {
47
+ this.options = options;
48
+ validateLiveQualificationConfig(options.config);
49
+ this.lane = controlPlaneDigest({ scope: options.config.scope, profilePath: options.config.profilePath });
50
+ this.configDigest = controlPlaneDigest(options.config);
51
+ this.trustDigest = controlPlaneDigest(options.trust);
52
+ this.scanId = `live-qualification-scan-${this.lane}`;
53
+ this.activationNonce = controlPlaneDigest({ config: this.configDigest, generation: this.generation });
54
+ }
55
+ start() {
56
+ this.unregister = this.options.automations.registerHostExecutor({
57
+ descriptor: { executorId: EXECUTOR, contractVersion: 1, catalogDigest: CATALOG },
58
+ accepts: spec => spec.executorId === EXECUTOR && spec.executorContractVersion === 1 && spec.catalogDigest === CATALOG
59
+ && spec.runbookId === 'qualify' && spec.runbookVersion === 1,
60
+ execute: input => {
61
+ const flight = this.execute(input);
62
+ this.flights.add(flight);
63
+ void flight.finally(() => this.flights.delete(flight)).catch(() => { });
64
+ return flight;
65
+ },
66
+ });
67
+ this.active = true;
68
+ this.unsubscribe = this.options.evaluation.onTrustedTaskChange(() => this.scan());
69
+ this.options.automations.reconcileSystem({ owner: OWNER, automationId: this.scanId,
70
+ idempotencyKey: `${this.scanId}:${this.generation}`, desiredStatus: 'active', definition: this.definition() });
71
+ this.scan();
72
+ }
73
+ close() {
74
+ return this.closing ??= (async () => {
75
+ this.active = false;
76
+ try {
77
+ const current = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.scanId });
78
+ if (current?.activationNonce === this.activationNonce)
79
+ this.options.automations.reconcileSystem({ owner: OWNER,
80
+ automationId: this.scanId, idempotencyKey: `${this.scanId}:${this.generation}:pause`, desiredStatus: 'paused', definition: this.definition() });
81
+ }
82
+ finally {
83
+ this.abort.abort();
84
+ try {
85
+ this.unsubscribe?.();
86
+ }
87
+ finally {
88
+ try {
89
+ this.unregister?.();
90
+ }
91
+ finally {
92
+ await Promise.allSettled(this.flights);
93
+ this.options.store.close();
94
+ }
95
+ }
96
+ }
97
+ })();
98
+ }
99
+ health = () => ({ connected: this.active, lastError: this.lastError });
100
+ current() {
101
+ this.abort.signal.throwIfAborted();
102
+ if (!this.active)
103
+ throw new Error('live qualification runtime unavailable');
104
+ this.options.assertCurrent();
105
+ }
106
+ owner() {
107
+ this.current();
108
+ const scope = this.options.config.scope;
109
+ return taskObservationOwner(this.options.delivery.validateOwnerRoute({ authorityId: scope.ownerRouteId,
110
+ principalId: scope.principalId, workspace: scope.workspace, agentPreset: scope.preset }));
111
+ }
112
+ source(inboxId) {
113
+ return trustedForegroundSource({ owner: this.owner(), inboxId,
114
+ evaluation: this.options.evaluation, delivery: this.options.delivery });
115
+ }
116
+ vote(deployment, source, startedAt, deadlineAt, historical) {
117
+ if (deployment.execution?.modelSelectionState !== 'frozen' || !deployment.execution.modelSelection
118
+ || deployment.execution.completedAt < startedAt || deployment.execution.completedAt >= deadlineAt
119
+ || deployment.task.dispatchedAt < startedAt || deployment.task.dispatchedAt >= deadlineAt)
120
+ return undefined;
121
+ return trustedForegroundVote({ deployment, source, now: Date.now(),
122
+ lookbackMs: historical ? Number.MAX_SAFE_INTEGER : deadlineAt - startedAt });
123
+ }
124
+ sameDeployment(batch, deployment) {
125
+ const readiness = deployment.readiness;
126
+ return readiness.planId === batch.planId && readiness.planDigest === batch.planDigest
127
+ && readiness.installationId === batch.installationId && readiness.profilePath === batch.profilePath
128
+ && readiness.activationId === batch.activationId && readiness.fence === batch.fence
129
+ && readiness.hostGeneration === batch.hostGeneration && readiness.receiptDigest === batch.readinessDigest;
130
+ }
131
+ cohort(plan, window, owner, historical) {
132
+ const deployments = this.options.store.listLiveQualificationDeployments(plan.id, 1001);
133
+ const votes = [];
134
+ let blocked = false;
135
+ for (const deployment of deployments) {
136
+ if (deployment.task.dispatchedAt < window.startedAt || deployment.task.dispatchedAt >= window.deadlineAt)
137
+ continue;
138
+ const readiness = deployment.readiness;
139
+ if (readiness.planId !== plan.id || readiness.planDigest !== plan.digest || readiness.installationId !== plan.installationId
140
+ || readiness.profilePath !== plan.target.profilePath || readiness.activationId !== plan.activation?.id
141
+ || readiness.fence !== plan.activation?.fence || readiness.hostGeneration !== window.hostGeneration
142
+ || readiness.receiptDigest !== window.readinessDigest
143
+ || deployment.task.owner.principalRecordId !== owner.principalRecordId
144
+ || deployment.task.owner.principalVersion !== owner.principalVersion
145
+ || deployment.task.scope.workspace !== owner.workspace || deployment.task.scope.preset !== owner.agentPreset
146
+ || deployment.state !== 'observed' || deployment.execution?.modelSelectionState !== 'frozen'
147
+ || !deployment.execution.modelSelection) {
148
+ blocked = true;
149
+ continue;
150
+ }
151
+ const vote = this.vote(deployment, this.source(deployment.task.inboxId), window.startedAt, window.deadlineAt, historical);
152
+ if (vote)
153
+ votes.push(vote);
154
+ }
155
+ return { votes, blocked, overflow: deployments.length === 1001 };
156
+ }
157
+ read(batch, historical = false) {
158
+ this.current();
159
+ assertLiveQualificationBatch(batch);
160
+ const plan = this.options.store.getPlan(batch.planId);
161
+ const window = this.options.store.getLiveQualificationWindow(batch.planId);
162
+ if (batch.lane !== this.lane || batch.configDigest !== this.configDigest || batch.trustDigest !== this.trustDigest
163
+ || batch.profilePath !== this.options.config.profilePath || !same(batch.owner, this.owner())
164
+ || !same(batch.terms, plan.dossier.liveQualification) || batch.planDigest !== plan.digest
165
+ || batch.installationId !== plan.installationId || batch.activationId !== plan.activation?.id
166
+ || batch.fence !== plan.activation?.fence || batch.startedAt !== window.startedAt
167
+ || batch.deadlineAt !== window.deadlineAt || batch.readinessDigest !== window.readinessDigest
168
+ || batch.hostGeneration !== window.hostGeneration || (!historical && (Date.now() >= batch.deadlineAt || Date.now() >= batch.expiresAt))) {
169
+ throw new Error('live qualification authority, exposure, or deadline changed');
170
+ }
171
+ const sources = batch.votes.map(expected => {
172
+ const deployment = this.options.store.getForegroundDeployment(expected.inboxId), source = this.source(expected.inboxId);
173
+ if (!deployment || !source || !this.sameDeployment(batch, deployment)
174
+ || !same(this.vote(deployment, source, batch.startedAt, batch.deadlineAt, historical), expected)) {
175
+ throw new Error('live qualification source changed');
176
+ }
177
+ return source;
178
+ });
179
+ // Re-evaluate every started task in the bounded window, not just signed
180
+ // votes. Pending/unknown work and later negative feedback veto qualification.
181
+ if (batch.votes.every(vote => vote.status === 'achieved')) {
182
+ const cohort = this.cohort(plan, window, batch.owner, historical);
183
+ if (cohort.overflow || cohort.blocked || cohort.votes.some(vote => vote.status === 'not-achieved')) {
184
+ throw new Error('live qualification cohort is blocked or has a negative task');
185
+ }
186
+ }
187
+ const original = this.options.qualificationSource(batch.planId);
188
+ if (original.canonical.objective?.status !== 'not-achieved'
189
+ || original.ownerRevision?.action === 'withdraw'
190
+ || !same(taskObservationOwner(original.owner), batch.owner)) {
191
+ throw new Error('live qualification original owner failure changed');
192
+ }
193
+ this.options.assertRuntime(batch.planId);
194
+ return sources;
195
+ }
196
+ fence(batch, callback, historical = false) {
197
+ this.read(batch, historical);
198
+ if (this.options.store.getLiveQualification(batch.id))
199
+ this.options.store.assertCurrentLiveQualification(batch.id);
200
+ return withTrustedForegroundVoteFence({ evaluation: this.options.evaluation, owner: batch.owner, votes: batch.votes,
201
+ read: () => this.read(batch, historical), additionalSource: () => this.options.qualificationSource(batch.planId), callback });
202
+ }
203
+ /** Synchronous source audit and batch creation; only native cron may request authority. */
204
+ scan = () => {
205
+ if (!this.active || this.scanning)
206
+ return;
207
+ this.scanning = true;
208
+ try {
209
+ this.current();
210
+ this.lastError = null;
211
+ if (!this.options.runtimeAvailable() && !this.runtimeWasAvailable)
212
+ return;
213
+ if (this.options.runtimeAvailable())
214
+ this.runtimeWasAvailable = true;
215
+ const store = this.options.store, now = Date.now(), config = this.options.config;
216
+ for (const plan of store.listLiveQualificationPlans(config.profilePath, 100)) {
217
+ if (!plan.dossier.liveQualification || plan.target.profilePath !== config.profilePath)
218
+ continue;
219
+ const records = store.listLiveQualifications(plan.id, 100);
220
+ // A frozen batch is never replaced with newly selected votes after a correction.
221
+ if (records.length) {
222
+ for (const record of records) {
223
+ if (record.state === 'stale')
224
+ continue;
225
+ const historical = plan.status === 'activated';
226
+ try {
227
+ this.fence(record.batch, () => { }, historical);
228
+ }
229
+ catch {
230
+ if (record.state === 'applied' && record.receipt?.disposition === 'qualified') {
231
+ store.invalidateLiveQualification({ planId: plan.id, batchId: record.batch.id,
232
+ reason: 'live-qualification-unconfirmable' });
233
+ }
234
+ else if (record.state === 'pending' || record.state === 'signed') {
235
+ store.staleLiveQualification(record.batch.id);
236
+ if (plan.status === 'awaiting-live-tasks')
237
+ store.requestActivationRollback({ planId: plan.id,
238
+ expectedRevision: plan.revision, fence: record.batch.fence, failureCode: 'live-qualification-unconfirmable' });
239
+ }
240
+ }
241
+ }
242
+ continue;
243
+ }
244
+ if (plan.status !== 'awaiting-live-tasks' || now >= plan.expiresAt)
245
+ continue;
246
+ const window = store.getLiveQualificationWindow(plan.id);
247
+ if (now >= window.deadlineAt || window.startedAt > now)
248
+ continue;
249
+ const owner = this.owner();
250
+ const cohort = this.cohort(plan, window, owner, false);
251
+ const failures = cohort.votes.filter(vote => vote.status === 'not-achieved');
252
+ if (cohort.overflow && failures.length === 0)
253
+ continue;
254
+ if (failures.length === 0 && cohort.blocked)
255
+ continue;
256
+ const votes = (failures.length > 0 ? failures : cohort.votes.filter(vote => vote.status === 'achieved'))
257
+ .slice(0, 32).sort((a, b) => a.inboxId.localeCompare(b.inboxId));
258
+ if (votes.length === 0 || (failures.length === 0 && votes.length < plan.dossier.liveQualification.minimumTasks))
259
+ continue;
260
+ const core = { lane: this.lane, configDigest: this.configDigest, trustDigest: this.trustDigest,
261
+ planId: plan.id, planDigest: plan.digest, installationId: plan.installationId, profilePath: config.profilePath,
262
+ owner, terms: plan.dossier.liveQualification, activationId: plan.activation.id, fence: plan.activation.fence,
263
+ startedAt: window.startedAt, deadlineAt: window.deadlineAt, readinessDigest: window.readinessDigest,
264
+ hostGeneration: window.hostGeneration, votes };
265
+ const id = liveQualificationId(core);
266
+ const unsigned = { schemaVersion: 1, kind: 'dsh-live-qualification', id, ...core,
267
+ createdAt: now, expiresAt: window.deadlineAt + 300_000 };
268
+ const batch = { ...unsigned, digest: liveQualificationDigest(unsigned) };
269
+ try {
270
+ this.fence(batch, () => store.putLiveQualification(batch));
271
+ }
272
+ catch { /* A racing feedback revision or Host sample cannot create a batch. */ }
273
+ }
274
+ }
275
+ catch (error) {
276
+ this.lastError = error instanceof Error ? error.message.slice(0, 200) : 'live qualification scan failed';
277
+ }
278
+ finally {
279
+ this.scanning = false;
280
+ }
281
+ };
282
+ /** Synchronous final-commit guard; the Store calls this inside its CAS. */
283
+ withQualificationFence(planId, callback) {
284
+ this.current();
285
+ const records = this.options.store.listLiveQualifications(planId, 100).filter(record => record.state === 'applied' && record.receipt?.disposition === 'qualified');
286
+ if (records.length !== 1)
287
+ throw new Error('live qualification has no unique qualified receipt');
288
+ const batch = records[0].batch;
289
+ if (batch.planId !== planId)
290
+ throw new Error('live qualification plan changed');
291
+ return this.fence(batch, callback);
292
+ }
293
+ definition() {
294
+ const { scope, timeoutMs, budgetId, budgetAmount } = this.options.config;
295
+ return { name: 'Qualify live deployed plugin tasks', schedule: { kind: 'cron', expression: '* * * * *', timezone: 'UTC' },
296
+ workspace: scope.workspace, agentPreset: scope.preset, timeoutMs, misfire: { kind: 'latest' }, overlap: 'skip',
297
+ retrySafety: 'never', maxRetries: 0, principal: scope.principalId, budgetId, budgetAmount,
298
+ execution: { kind: 'host', executorId: EXECUTOR, executorContractVersion: 1, runbookId: 'qualify', runbookVersion: 1,
299
+ catalogDigest: CATALOG, targetScope: { workspace: scope.workspace, preset: scope.preset },
300
+ scopeDigest: controlPlaneDigest([scope.workspace, scope.preset]), ownerRouteId: scope.ownerRouteId,
301
+ activationNonce: this.activationNonce } };
302
+ }
303
+ async execute(input) {
304
+ let began = false;
305
+ try {
306
+ const scope = this.options.config.scope;
307
+ const registration = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.scanId });
308
+ if (input.executionMode !== 'production' || input.automationId !== this.scanId || input.activationNonce !== this.activationNonce
309
+ || input.definitionHash !== registration?.definitionHash || input.catalogDigest !== CATALOG
310
+ || registration.activationNonce !== this.activationNonce || input.ownerRouteId !== scope.ownerRouteId
311
+ || input.principal !== scope.principalId || input.targetScope.workspace !== scope.workspace
312
+ || input.targetScope.preset !== scope.preset)
313
+ throw new Error('live qualification dispatch changed');
314
+ const signal = AbortSignal.any([this.abort.signal, input.signal, AbortSignal.timeout(this.options.config.timeoutMs)]);
315
+ signal.throwIfAborted();
316
+ began = true;
317
+ // Registration is a sufficient native lifecycle barrier. A missing
318
+ // observer at the first actual cron tick is no longer a startup race.
319
+ if (!this.options.runtimeAvailable())
320
+ this.runtimeWasAvailable = true;
321
+ this.scan();
322
+ const owner = this.owner();
323
+ if (owner.authorityId !== scope.ownerRouteId || owner.principalId !== scope.principalId
324
+ || owner.workspace !== scope.workspace || owner.agentPreset !== scope.preset)
325
+ throw new Error('live qualification owner route changed');
326
+ if (!this.options.runtimeAvailable())
327
+ throw new Error('live qualification Host observer unavailable');
328
+ for (const plan of this.options.store.listLiveQualificationPlans(this.options.config.profilePath, 100)) {
329
+ signal.throwIfAborted();
330
+ this.current();
331
+ if (plan.status !== 'awaiting-live-tasks')
332
+ continue;
333
+ const records = this.options.store.listLiveQualifications(plan.id, 100);
334
+ for (const record of records) {
335
+ if (record.state !== 'pending' && record.state !== 'signed')
336
+ continue;
337
+ try {
338
+ this.fence(record.batch, () => { });
339
+ }
340
+ catch {
341
+ this.options.store.staleLiveQualification(record.batch.id);
342
+ this.options.store.requestActivationRollback({ planId: plan.id, expectedRevision: plan.revision,
343
+ fence: record.batch.fence, failureCode: 'live-qualification-unconfirmable' });
344
+ continue;
345
+ }
346
+ const receipt = record.receipt ?? await (this.options.request?.(record.batch, signal)
347
+ ?? requestLiveQualification(this.options.config.authority, { protocol: 'dsh-live-qualification/v1',
348
+ batchId: record.batch.id, batchDigest: record.batch.digest }, signal));
349
+ signal.throwIfAborted();
350
+ this.current();
351
+ const key = resolveTrustKey(this.options.trust, 'host-attestation', receipt.authority, receipt.keyId);
352
+ await this.options.store.applyLiveQualification({ receipt, publicKeyPem: key.publicKeyPem,
353
+ withSourceFence: callback => { signal.throwIfAborted(); return this.fence(record.batch, callback); } });
354
+ }
355
+ }
356
+ if (this.lastError)
357
+ throw new Error(this.lastError);
358
+ return { outcome: 'succeeded', failureClass: 'none', failurePhase: 'none', failureCode: 'none', sideEffectState: 'possible', retryability: 'unsafe' };
359
+ }
360
+ catch (error) {
361
+ this.lastError = error instanceof Error ? error.message.slice(0, 200) : 'live qualification failed';
362
+ return { outcome: began ? 'unknown' : 'failed', failureClass: began ? 'unknown' : 'configuration', failurePhase: 'host-execution',
363
+ failureCode: 'live-qualification-rejected', sideEffectState: began ? 'unknown' : 'none', retryability: began ? 'unsafe' : 'after-intervention' };
364
+ }
365
+ }
366
+ }
367
+ //# sourceMappingURL=live-qualification-runtime.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"live-qualification-runtime.js","sourceRoot":"","sources":["../src/live-qualification-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAI/C,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,kCAAkC,EAAmC,MAAM,6BAA6B,CAAA;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,mBAAmB,EACrB,MAAM,yBAAyB,CAAA;AAC7F,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACrJ,OAAO,EAAE,eAAe,EAAiC,MAAM,YAAY,CAAA;AAK3E,MAAM,KAAK,GAAG,yCAAyC,CAAA;AACvD,MAAM,QAAQ,GAAG,4CAA4C,CAAA;AAC7D,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;AACtE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAcjG,MAAM,UAAU,+BAA+B,CAAC,MAA+B;IAC7E,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAChH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;IACjD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAA;IACjI,MAAM,IAAI,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;WACzG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,6DAA6D,CAAC;WAC5E,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,2CAA2C,CAAC;WACjE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,UAAU,CAAC;WACzF,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;WAClG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1I,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,kCAAkC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AACtD,CAAC;AAED,iGAAiG;AACjG,MAAM,OAAO,wBAAwB;IAiBN;IAhBZ,IAAI,CAAQ;IACZ,YAAY,CAAQ;IACpB,WAAW,CAAQ;IACnB,MAAM,CAAQ;IACd,UAAU,GAAG,UAAU,EAAE,CAAA;IACzB,eAAe,CAAQ;IACvB,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC9C,UAAU,CAAa;IACvB,WAAW,CAAa;IACxB,OAAO,CAAgB;IACvB,MAAM,GAAG,KAAK,CAAA;IACd,mBAAmB,GAAG,KAAK,CAAA;IAC3B,QAAQ,GAAG,KAAK,CAAA;IAChB,SAAS,GAAkB,IAAI,CAAA;IAEvC,YAA6B,OAQ5B;QAR4B,YAAO,GAAP,OAAO,CAQnC;QACC,+BAA+B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACxG,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,GAAG,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC9D,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE;YAChF,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO;mBAChH,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC;YAC9D,OAAO,EAAE,KAAK,CAAC,EAAE;gBACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACxB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACtE,OAAO,MAAM,CAAA;YACf,CAAC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM;YAChF,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAChH,IAAI,CAAC,IAAI,EAAE,CAAA;IACb,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;gBAClH,IAAI,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC,eAAe;oBAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK;wBAC5G,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YACnJ,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAClB,IAAI,CAAC;oBAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBACpC,IAAI,CAAC;wBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;oBAAC,CAAC;4BAAS,CAAC;wBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;wBACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAE9D,OAAO;QACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3E,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IACO,KAAK;QACX,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;QACvC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY;YACpG,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC;IACO,MAAM,CAAC,OAAe;QAC5B,OAAO,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO;YAC3D,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC3E,CAAC;IACO,IAAI,CAAC,UAAsC,EAAE,MAA+C,EAClG,SAAiB,EAAE,UAAkB,EAAE,UAAmB;QAC1D,IAAI,UAAU,CAAC,SAAS,EAAE,mBAAmB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc;eAC7F,UAAU,CAAC,SAAS,CAAC,WAAW,GAAG,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,WAAW,IAAI,UAAU;eAC9F,UAAU,CAAC,IAAI,CAAC,YAAY,GAAG,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU;YAAE,OAAO,SAAS,CAAA;QAC7G,OAAO,qBAAqB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YAChE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC,CAAA;IAChF,CAAC;IACO,cAAc,CAAC,KAA6B,EAAE,UAAsC;QAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;QACtC,OAAO,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eAChF,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;eAChG,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAChF,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,eAAe,CAAA;IAC7G,CAAC;IACO,MAAM,CAAC,IAA0B,EAAE,MAAmE,EAC5G,KAA2B,EAAE,UAAmB;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACtF,MAAM,KAAK,GAA0B,EAAE,CAAA;QACvC,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU;gBAAE,SAAQ;YAClH,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;mBACvH,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE;mBACnG,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;mBAChG,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,eAAe;mBAClD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;mBACnE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;mBACjE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW;mBACzG,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,UAAU,CAAC,SAAS,EAAE,mBAAmB,KAAK,QAAQ;mBACzF,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,SAAQ;YAAC,CAAC;YACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YACzH,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAA;IAClE,CAAC;IACO,IAAI,CAAC,KAA6B,EAAE,UAAU,GAAG,KAAK;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,4BAA4B,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;eAC7G,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;eACzF,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;eACtF,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE;eAC1F,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;eAC9E,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;eAC1F,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC1I,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACvH,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;mBAChE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;QACF,wEAAwE;QACxE,8EAA8E;QAC9E,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACjE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAChF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,cAAc;eACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,KAAK,UAAU;eAC7C,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,OAAO,OAAO,CAAA;IAChB,CAAC;IACO,KAAK,CAAI,KAA6B,EAAE,QAAiB,EAAE,UAAU,GAAG,KAAK;QACnF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAClH,OAAO,8BAA8B,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;YACjH,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACjI,CAAC;IAED,2FAA2F;IAC3F,IAAI,GAAG,GAAS,EAAE;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;gBAAE,OAAM;YACzE,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAAE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAA;YACpE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;YAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;oBAAE,SAAQ;gBAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC1D,iFAAiF;gBACjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;4BAAE,SAAQ;wBACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,WAAW,CAAA;wBAC9C,IAAI,CAAC;4BAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,UAAU,CAAC,CAAA;wBAAC,CAAC;wBACtD,MAAM,CAAC;4BACL,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;gCAC9E,KAAK,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;oCAC3E,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;4BACjD,CAAC;iCAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCACnE,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gCAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB;oCAAE,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;wCAC1F,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;4BAClH,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,SAAQ;gBACV,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS;oBAAE,SAAQ;gBAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACxD,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;oBAAE,SAAQ;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,CAAA;gBAC5E,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAQ;gBACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO;oBAAE,SAAQ;gBACrD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;qBACrG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;gBAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC;oBAAE,SAAQ;gBACzH,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC5F,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC9G,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,UAAW,CAAC,KAAK;oBAC9G,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;oBACnG,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,CAAA;gBAChD,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBACpC,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,IAAI,EAAE,wBAAiC,EAAE,EAAE,EAAE,GAAG,IAAI;oBAChG,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE,CAAA;gBAC1D,MAAM,KAAK,GAA2B,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAA;gBAChG,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAA;gBAAC,CAAC;gBAClE,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAA;QAAC,CAAC;gBACpH,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;QAAC,CAAC;IACnC,CAAC,CAAA;IAED,2EAA2E;IAC3E,sBAAsB,CAAI,MAAc,EAAE,QAAiB;QACzD,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACrF,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,CAAC,CAAA;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAA;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACpC,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QACxE,OAAO,EAAE,IAAI,EAAE,oCAAoC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;YACvH,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM;YAC9G,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY;YACzF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;gBAClH,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBACzF,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAClG,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAA;IAC/C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAkC;QACtD,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;YACvC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvH,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBAC3H,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,cAAc,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO;mBACxF,YAAY,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBAClG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;mBACxF,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YACtG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,CAAC,cAAc,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAA;YACrC,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAAE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAA;YACrE,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YAC1B,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;mBAClF,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACzI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YACrG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvG,MAAM,CAAC,cAAc,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAA;gBACvC,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB;oBAAE,SAAQ;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;wBAAE,SAAQ;oBACrE,IAAI,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAAC,CAAC;oBAC1C,MAAM,CAAC;wBACL,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;wBAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;4BAC7F,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;wBAC/E,SAAQ;oBACV,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;2BAChF,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,2BAA2B;4BAChG,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;oBAC1E,MAAM,CAAC,cAAc,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO,EAAE,CAAA;oBACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;oBACrG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY;wBACvF,eAAe,EAAE,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC1G,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;QACvJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAA;YACnG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,gBAAgB;gBAC/H,WAAW,EAAE,6BAA6B,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACpJ,CAAC;IACH,CAAC;CACF"}
@@ -0,0 +1,73 @@
1
+ import type { TaskObservationOwner, TaskObservationVote } from './task-observation-types.js';
2
+ export interface LiveQualificationTerms {
3
+ protocol: 'dsh-bounded-live/v1';
4
+ maximumWindowMs: number;
5
+ minimumTasks: number;
6
+ authority: string;
7
+ keyId: string;
8
+ }
9
+ /** A finite, profile-wide pre-adoption observation; no exposure cap is implied. */
10
+ export interface LiveQualificationBatch {
11
+ schemaVersion: 1;
12
+ kind: 'dsh-live-qualification';
13
+ id: string;
14
+ digest: string;
15
+ lane: string;
16
+ configDigest: string;
17
+ trustDigest: string;
18
+ planId: string;
19
+ planDigest: string;
20
+ installationId: string;
21
+ profilePath: string;
22
+ owner: TaskObservationOwner;
23
+ terms: LiveQualificationTerms;
24
+ activationId: string;
25
+ fence: number;
26
+ startedAt: number;
27
+ deadlineAt: number;
28
+ readinessDigest: string;
29
+ hostGeneration: number;
30
+ votes: readonly TaskObservationVote[];
31
+ createdAt: number;
32
+ expiresAt: number;
33
+ }
34
+ export interface LiveQualificationReceipt {
35
+ schemaVersion: 1;
36
+ kind: 'dsh-live-qualification-receipt';
37
+ receiptId: string;
38
+ authority: string;
39
+ keyId: string;
40
+ batchId: string;
41
+ batchDigest: string;
42
+ planId: string;
43
+ planDigest: string;
44
+ activationId: string;
45
+ fence: number;
46
+ hostGeneration: number;
47
+ disposition: 'qualified' | 'failed';
48
+ observedAt: number;
49
+ expiresAt: number;
50
+ signature: string;
51
+ }
52
+ export interface LiveQualificationRequest {
53
+ protocol: 'dsh-live-qualification/v1';
54
+ batchId: string;
55
+ batchDigest: string;
56
+ }
57
+ export interface LiveQualificationRecord {
58
+ batch: LiveQualificationBatch;
59
+ state: 'pending' | 'signed' | 'applied' | 'stale';
60
+ receipt?: LiveQualificationReceipt;
61
+ }
62
+ export declare function validateLiveQualificationTerms(value: unknown): asserts value is LiveQualificationTerms;
63
+ /** Content identity excludes the creation clock, as with task observation. */
64
+ export declare function liveQualificationId(batch: Omit<LiveQualificationBatch, 'schemaVersion' | 'kind' | 'id' | 'digest' | 'createdAt' | 'expiresAt'>): string;
65
+ export declare function liveQualificationDigest(batch: Omit<LiveQualificationBatch, 'digest'>): string;
66
+ export declare function assertLiveQualificationBatch(value: unknown): asserts value is LiveQualificationBatch;
67
+ export declare function parseLiveQualificationReceipt(value: unknown): LiveQualificationReceipt;
68
+ /** Domain-separated canonical signing payload; never valid as a Host phase receipt. */
69
+ export declare function liveQualificationSigningPayload(receipt: Omit<LiveQualificationReceipt, 'signature'>): string;
70
+ export declare function verifyLiveQualificationReceipt(receiptInput: unknown, batchInput: unknown, publicKeyPem: string | Buffer, now?: number): LiveQualificationReceipt;
71
+ /** Shared exact identity constructor for the independent authority. */
72
+ export declare function liveQualificationReceiptId(receipt: Omit<LiveQualificationReceipt, 'receiptId' | 'signature'>): string;
73
+ //# sourceMappingURL=live-qualification.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"live-qualification.d.ts","sourceRoot":"","sources":["../src/live-qualification.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAY5F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,wBAAwB,CAAA;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,KAAK,EAAE,sBAAsB,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,gCAAgC,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,WAAW,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,2BAA2B,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAA;IAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;IACjD,OAAO,CAAC,EAAE,wBAAwB,CAAA;CACnC;AA0BD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAMtG;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAOvJ;AACD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,CAG7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAgCpG;AAMD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAkBtF;AAED,uFAAuF;AACvF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GAAG,MAAM,CAI5G;AASD,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAa,GAAG,wBAAwB,CAoBpK;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAErH"}