@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.49
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +183 -15
- package/bin/dsh-live-qualification-authority.js +15 -0
- package/bin/dsh-local-release-adapter.js +328 -8
- package/bin/dsh-systemd-host-attestor.js +359 -9
- package/bin/dsh-systemd-host-authority.js +12 -0
- package/lib/adoption-coordinator.d.ts +3 -1
- package/lib/adoption-coordinator.d.ts.map +1 -1
- package/lib/adoption-coordinator.js +24 -9
- package/lib/adoption-coordinator.js.map +1 -1
- package/lib/cli.d.ts.map +1 -1
- package/lib/cli.js +33 -14
- package/lib/cli.js.map +1 -1
- package/lib/creation-capability-feedback.d.ts +23 -0
- package/lib/creation-capability-feedback.d.ts.map +1 -0
- package/lib/creation-capability-feedback.js +132 -0
- package/lib/creation-capability-feedback.js.map +1 -0
- package/lib/creation-capability-journal.d.ts +66 -0
- package/lib/creation-capability-journal.d.ts.map +1 -0
- package/lib/creation-capability-journal.js +751 -0
- package/lib/creation-capability-journal.js.map +1 -0
- package/lib/creation-capability-runtime.d.ts +63 -0
- package/lib/creation-capability-runtime.d.ts.map +1 -0
- package/lib/creation-capability-runtime.js +564 -0
- package/lib/creation-capability-runtime.js.map +1 -0
- package/lib/creation-capability-source.d.ts +37 -0
- package/lib/creation-capability-source.d.ts.map +1 -0
- package/lib/creation-capability-source.js +328 -0
- package/lib/creation-capability-source.js.map +1 -0
- package/lib/creation-capability-types.d.ts +252 -0
- package/lib/creation-capability-types.d.ts.map +1 -0
- package/lib/creation-capability-types.js +2 -0
- package/lib/creation-capability-types.js.map +1 -0
- package/lib/deployment-readiness.d.ts +16 -0
- package/lib/deployment-readiness.d.ts.map +1 -1
- package/lib/deployment-readiness.js +48 -1
- package/lib/deployment-readiness.js.map +1 -1
- package/lib/effect-blocked-replay.js +2 -2
- package/lib/effect-blocked-replay.js.map +1 -1
- package/lib/foreground-deployment-runtime.d.ts +3 -0
- package/lib/foreground-deployment-runtime.d.ts.map +1 -1
- package/lib/foreground-deployment-runtime.js +55 -13
- package/lib/foreground-deployment-runtime.js.map +1 -1
- package/lib/foreground-deployment.d.ts.map +1 -1
- package/lib/foreground-deployment.js +5 -0
- package/lib/foreground-deployment.js.map +1 -1
- package/lib/host-attestor.d.ts +2 -0
- package/lib/host-attestor.d.ts.map +1 -1
- package/lib/host-attestor.js +8 -1
- package/lib/host-attestor.js.map +1 -1
- package/lib/host-inputs.d.ts +13 -0
- package/lib/host-inputs.d.ts.map +1 -0
- package/lib/host-inputs.js +162 -0
- package/lib/host-inputs.js.map +1 -0
- package/lib/host-maintenance.d.ts +61 -0
- package/lib/host-maintenance.d.ts.map +1 -0
- package/lib/host-maintenance.js +158 -0
- package/lib/host-maintenance.js.map +1 -0
- package/lib/host-readiness.d.ts +5 -0
- package/lib/host-readiness.d.ts.map +1 -0
- package/lib/host-readiness.js +22 -0
- package/lib/host-readiness.js.map +1 -0
- package/lib/index.d.ts +16 -0
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +7 -0
- package/lib/index.js.map +1 -1
- package/lib/live-qualification-authority.d.ts +32 -0
- package/lib/live-qualification-authority.d.ts.map +1 -0
- package/lib/live-qualification-authority.js +280 -0
- package/lib/live-qualification-authority.js.map +1 -0
- package/lib/live-qualification-client.d.ts +4 -0
- package/lib/live-qualification-client.d.ts.map +1 -0
- package/lib/live-qualification-client.js +22 -0
- package/lib/live-qualification-client.js.map +1 -0
- package/lib/live-qualification-runtime.d.ts +78 -0
- package/lib/live-qualification-runtime.d.ts.map +1 -0
- package/lib/live-qualification-runtime.js +367 -0
- package/lib/live-qualification-runtime.js.map +1 -0
- package/lib/live-qualification.d.ts +73 -0
- package/lib/live-qualification.d.ts.map +1 -0
- package/lib/live-qualification.js +164 -0
- package/lib/live-qualification.js.map +1 -0
- package/lib/owner-task-gaps.d.ts +2 -0
- package/lib/owner-task-gaps.d.ts.map +1 -1
- package/lib/owner-task-gaps.js +9 -1
- package/lib/owner-task-gaps.js.map +1 -1
- package/lib/runtime-epoch.d.ts +69 -0
- package/lib/runtime-epoch.d.ts.map +1 -0
- package/lib/runtime-epoch.js +139 -0
- package/lib/runtime-epoch.js.map +1 -0
- package/lib/runtime-observer.d.ts.map +1 -1
- package/lib/runtime-observer.js +42 -6
- package/lib/runtime-observer.js.map +1 -1
- package/lib/service.d.ts +247 -4
- package/lib/service.d.ts.map +1 -1
- package/lib/service.js +1332 -27
- package/lib/service.js.map +1 -1
- package/lib/source-adoption-authority.d.ts +3 -0
- package/lib/source-adoption-authority.d.ts.map +1 -1
- package/lib/source-adoption-authority.js +13 -3
- package/lib/source-adoption-authority.js.map +1 -1
- package/lib/source-adoption-runner.d.ts +3 -0
- package/lib/source-adoption-runner.d.ts.map +1 -1
- package/lib/source-adoption-runner.js +16 -4
- package/lib/source-adoption-runner.js.map +1 -1
- package/lib/source-baseline.d.ts +37 -0
- package/lib/source-baseline.d.ts.map +1 -0
- package/lib/source-baseline.js +250 -0
- package/lib/source-baseline.js.map +1 -0
- package/lib/source-build.d.ts +17 -1
- package/lib/source-build.d.ts.map +1 -1
- package/lib/source-build.js +501 -7
- package/lib/source-build.js.map +1 -1
- package/lib/source-context.d.ts +18 -0
- package/lib/source-context.d.ts.map +1 -1
- package/lib/source-context.js +85 -11
- package/lib/source-context.js.map +1 -1
- package/lib/source-creation.d.ts +106 -0
- package/lib/source-creation.d.ts.map +1 -0
- package/lib/source-creation.js +664 -0
- package/lib/source-creation.js.map +1 -0
- package/lib/source-job-types.d.ts +19 -0
- package/lib/source-job-types.d.ts.map +1 -1
- package/lib/source-jobs.d.ts +30 -3
- package/lib/source-jobs.d.ts.map +1 -1
- package/lib/source-jobs.js +382 -40
- package/lib/source-jobs.js.map +1 -1
- package/lib/source-maintenance.d.ts +66 -0
- package/lib/source-maintenance.d.ts.map +1 -0
- package/lib/source-maintenance.js +177 -0
- package/lib/source-maintenance.js.map +1 -0
- package/lib/source-revision.d.ts +57 -0
- package/lib/source-revision.d.ts.map +1 -0
- package/lib/source-revision.js +175 -0
- package/lib/source-revision.js.map +1 -0
- package/lib/source-workspace.d.ts +19 -14
- package/lib/source-workspace.d.ts.map +1 -1
- package/lib/source-workspace.js +90 -17
- package/lib/source-workspace.js.map +1 -1
- package/lib/sqlite.d.ts +13 -3
- package/lib/sqlite.d.ts.map +1 -1
- package/lib/sqlite.js +362 -1
- package/lib/sqlite.js.map +1 -1
- package/lib/store.d.ts +258 -3
- package/lib/store.d.ts.map +1 -1
- package/lib/store.js +2211 -95
- package/lib/store.js.map +1 -1
- package/lib/systemd-host-authority.d.ts +68 -0
- package/lib/systemd-host-authority.d.ts.map +1 -0
- package/lib/systemd-host-authority.js +424 -0
- package/lib/systemd-host-authority.js.map +1 -0
- package/lib/task-observation-evidence.d.ts +32 -0
- package/lib/task-observation-evidence.d.ts.map +1 -0
- package/lib/task-observation-evidence.js +62 -0
- package/lib/task-observation-evidence.js.map +1 -0
- package/lib/task-observation-runtime.d.ts +2 -3
- package/lib/task-observation-runtime.d.ts.map +1 -1
- package/lib/task-observation-runtime.js +7 -39
- package/lib/task-observation-runtime.js.map +1 -1
- package/lib/task-observation-store.js +1 -1
- package/lib/trust.d.ts.map +1 -1
- package/lib/trust.js +0 -0
- package/lib/trust.js.map +1 -1
- package/lib/types.d.ts +43 -6
- package/lib/types.d.ts.map +1 -1
- package/lib/version.d.ts +1 -1
- package/lib/version.js +1 -1
- package/package.json +21 -14
|
@@ -0,0 +1,367 @@
|
|
|
1
|
+
import { randomUUID } from 'node:crypto';
|
|
2
|
+
import { isAbsolute, resolve } from 'node:path';
|
|
3
|
+
import { controlPlaneDigest } from './store.js';
|
|
4
|
+
import { validateSourceApprovalClientConfig } from './source-approval-client.js';
|
|
5
|
+
import { requestLiveQualification } from './live-qualification-client.js';
|
|
6
|
+
import { assertLiveQualificationBatch, liveQualificationDigest, liveQualificationId } from './live-qualification.js';
|
|
7
|
+
import { trustedForegroundSource, trustedForegroundVote, withTrustedForegroundVoteFence, taskObservationOwner } from './task-observation-evidence.js';
|
|
8
|
+
import { resolveTrustKey } from './trust.js';
|
|
9
|
+
const OWNER = 'plugin-control-plane-live-qualification';
|
|
10
|
+
const EXECUTOR = 'plugin-control-plane-live-qualification-v1';
|
|
11
|
+
const CATALOG = controlPlaneDigest({ executor: EXECUTOR, version: 1 });
|
|
12
|
+
const same = (a, b) => controlPlaneDigest(a) === controlPlaneDigest(b);
|
|
13
|
+
export function validateLiveQualificationConfig(config) {
|
|
14
|
+
const exact = (value, keys) => !!value && typeof value === 'object' && !Array.isArray(value)
|
|
15
|
+
&& Object.keys(value).sort().join(',') === keys;
|
|
16
|
+
const integer = (value, min, max) => Number.isSafeInteger(value) && value >= min && value <= max;
|
|
17
|
+
const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 4096
|
|
18
|
+
&& value.normalize('NFC').trim() === value && !/[\p{Cc}]/u.test(value);
|
|
19
|
+
if (!exact(config, 'authority,budgetAmount,budgetId,profilePath,scope,timeoutMs')
|
|
20
|
+
|| !exact(config.scope, 'ownerRouteId,preset,principalId,workspace')
|
|
21
|
+
|| !integer(config.timeoutMs, 1000, 300_000) || !integer(config.budgetAmount, 1, 10_000_000)
|
|
22
|
+
|| !text(config.budgetId) || config.budgetId.length > 128 || !Object.values(config.scope).every(text)
|
|
23
|
+
|| !text(config.profilePath) || ![config.profilePath, config.scope.workspace].every(path => isAbsolute(path) && resolve(path) === path)) {
|
|
24
|
+
throw new Error('invalid liveQualification configuration');
|
|
25
|
+
}
|
|
26
|
+
validateSourceApprovalClientConfig(config.authority);
|
|
27
|
+
}
|
|
28
|
+
/** A finite native-automation witness for real foreground tasks, without a second Agent loop. */
|
|
29
|
+
export class LiveQualificationRuntime {
|
|
30
|
+
options;
|
|
31
|
+
lane;
|
|
32
|
+
configDigest;
|
|
33
|
+
trustDigest;
|
|
34
|
+
scanId;
|
|
35
|
+
generation = randomUUID();
|
|
36
|
+
activationNonce;
|
|
37
|
+
abort = new AbortController();
|
|
38
|
+
flights = new Set();
|
|
39
|
+
unregister;
|
|
40
|
+
unsubscribe;
|
|
41
|
+
closing;
|
|
42
|
+
active = false;
|
|
43
|
+
runtimeWasAvailable = false;
|
|
44
|
+
scanning = false;
|
|
45
|
+
lastError = null;
|
|
46
|
+
constructor(options) {
|
|
47
|
+
this.options = options;
|
|
48
|
+
validateLiveQualificationConfig(options.config);
|
|
49
|
+
this.lane = controlPlaneDigest({ scope: options.config.scope, profilePath: options.config.profilePath });
|
|
50
|
+
this.configDigest = controlPlaneDigest(options.config);
|
|
51
|
+
this.trustDigest = controlPlaneDigest(options.trust);
|
|
52
|
+
this.scanId = `live-qualification-scan-${this.lane}`;
|
|
53
|
+
this.activationNonce = controlPlaneDigest({ config: this.configDigest, generation: this.generation });
|
|
54
|
+
}
|
|
55
|
+
start() {
|
|
56
|
+
this.unregister = this.options.automations.registerHostExecutor({
|
|
57
|
+
descriptor: { executorId: EXECUTOR, contractVersion: 1, catalogDigest: CATALOG },
|
|
58
|
+
accepts: spec => spec.executorId === EXECUTOR && spec.executorContractVersion === 1 && spec.catalogDigest === CATALOG
|
|
59
|
+
&& spec.runbookId === 'qualify' && spec.runbookVersion === 1,
|
|
60
|
+
execute: input => {
|
|
61
|
+
const flight = this.execute(input);
|
|
62
|
+
this.flights.add(flight);
|
|
63
|
+
void flight.finally(() => this.flights.delete(flight)).catch(() => { });
|
|
64
|
+
return flight;
|
|
65
|
+
},
|
|
66
|
+
});
|
|
67
|
+
this.active = true;
|
|
68
|
+
this.unsubscribe = this.options.evaluation.onTrustedTaskChange(() => this.scan());
|
|
69
|
+
this.options.automations.reconcileSystem({ owner: OWNER, automationId: this.scanId,
|
|
70
|
+
idempotencyKey: `${this.scanId}:${this.generation}`, desiredStatus: 'active', definition: this.definition() });
|
|
71
|
+
this.scan();
|
|
72
|
+
}
|
|
73
|
+
close() {
|
|
74
|
+
return this.closing ??= (async () => {
|
|
75
|
+
this.active = false;
|
|
76
|
+
try {
|
|
77
|
+
const current = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.scanId });
|
|
78
|
+
if (current?.activationNonce === this.activationNonce)
|
|
79
|
+
this.options.automations.reconcileSystem({ owner: OWNER,
|
|
80
|
+
automationId: this.scanId, idempotencyKey: `${this.scanId}:${this.generation}:pause`, desiredStatus: 'paused', definition: this.definition() });
|
|
81
|
+
}
|
|
82
|
+
finally {
|
|
83
|
+
this.abort.abort();
|
|
84
|
+
try {
|
|
85
|
+
this.unsubscribe?.();
|
|
86
|
+
}
|
|
87
|
+
finally {
|
|
88
|
+
try {
|
|
89
|
+
this.unregister?.();
|
|
90
|
+
}
|
|
91
|
+
finally {
|
|
92
|
+
await Promise.allSettled(this.flights);
|
|
93
|
+
this.options.store.close();
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
}
|
|
97
|
+
})();
|
|
98
|
+
}
|
|
99
|
+
health = () => ({ connected: this.active, lastError: this.lastError });
|
|
100
|
+
current() {
|
|
101
|
+
this.abort.signal.throwIfAborted();
|
|
102
|
+
if (!this.active)
|
|
103
|
+
throw new Error('live qualification runtime unavailable');
|
|
104
|
+
this.options.assertCurrent();
|
|
105
|
+
}
|
|
106
|
+
owner() {
|
|
107
|
+
this.current();
|
|
108
|
+
const scope = this.options.config.scope;
|
|
109
|
+
return taskObservationOwner(this.options.delivery.validateOwnerRoute({ authorityId: scope.ownerRouteId,
|
|
110
|
+
principalId: scope.principalId, workspace: scope.workspace, agentPreset: scope.preset }));
|
|
111
|
+
}
|
|
112
|
+
source(inboxId) {
|
|
113
|
+
return trustedForegroundSource({ owner: this.owner(), inboxId,
|
|
114
|
+
evaluation: this.options.evaluation, delivery: this.options.delivery });
|
|
115
|
+
}
|
|
116
|
+
vote(deployment, source, startedAt, deadlineAt, historical) {
|
|
117
|
+
if (deployment.execution?.modelSelectionState !== 'frozen' || !deployment.execution.modelSelection
|
|
118
|
+
|| deployment.execution.completedAt < startedAt || deployment.execution.completedAt >= deadlineAt
|
|
119
|
+
|| deployment.task.dispatchedAt < startedAt || deployment.task.dispatchedAt >= deadlineAt)
|
|
120
|
+
return undefined;
|
|
121
|
+
return trustedForegroundVote({ deployment, source, now: Date.now(),
|
|
122
|
+
lookbackMs: historical ? Number.MAX_SAFE_INTEGER : deadlineAt - startedAt });
|
|
123
|
+
}
|
|
124
|
+
sameDeployment(batch, deployment) {
|
|
125
|
+
const readiness = deployment.readiness;
|
|
126
|
+
return readiness.planId === batch.planId && readiness.planDigest === batch.planDigest
|
|
127
|
+
&& readiness.installationId === batch.installationId && readiness.profilePath === batch.profilePath
|
|
128
|
+
&& readiness.activationId === batch.activationId && readiness.fence === batch.fence
|
|
129
|
+
&& readiness.hostGeneration === batch.hostGeneration && readiness.receiptDigest === batch.readinessDigest;
|
|
130
|
+
}
|
|
131
|
+
cohort(plan, window, owner, historical) {
|
|
132
|
+
const deployments = this.options.store.listLiveQualificationDeployments(plan.id, 1001);
|
|
133
|
+
const votes = [];
|
|
134
|
+
let blocked = false;
|
|
135
|
+
for (const deployment of deployments) {
|
|
136
|
+
if (deployment.task.dispatchedAt < window.startedAt || deployment.task.dispatchedAt >= window.deadlineAt)
|
|
137
|
+
continue;
|
|
138
|
+
const readiness = deployment.readiness;
|
|
139
|
+
if (readiness.planId !== plan.id || readiness.planDigest !== plan.digest || readiness.installationId !== plan.installationId
|
|
140
|
+
|| readiness.profilePath !== plan.target.profilePath || readiness.activationId !== plan.activation?.id
|
|
141
|
+
|| readiness.fence !== plan.activation?.fence || readiness.hostGeneration !== window.hostGeneration
|
|
142
|
+
|| readiness.receiptDigest !== window.readinessDigest
|
|
143
|
+
|| deployment.task.owner.principalRecordId !== owner.principalRecordId
|
|
144
|
+
|| deployment.task.owner.principalVersion !== owner.principalVersion
|
|
145
|
+
|| deployment.task.scope.workspace !== owner.workspace || deployment.task.scope.preset !== owner.agentPreset
|
|
146
|
+
|| deployment.state !== 'observed' || deployment.execution?.modelSelectionState !== 'frozen'
|
|
147
|
+
|| !deployment.execution.modelSelection) {
|
|
148
|
+
blocked = true;
|
|
149
|
+
continue;
|
|
150
|
+
}
|
|
151
|
+
const vote = this.vote(deployment, this.source(deployment.task.inboxId), window.startedAt, window.deadlineAt, historical);
|
|
152
|
+
if (vote)
|
|
153
|
+
votes.push(vote);
|
|
154
|
+
}
|
|
155
|
+
return { votes, blocked, overflow: deployments.length === 1001 };
|
|
156
|
+
}
|
|
157
|
+
read(batch, historical = false) {
|
|
158
|
+
this.current();
|
|
159
|
+
assertLiveQualificationBatch(batch);
|
|
160
|
+
const plan = this.options.store.getPlan(batch.planId);
|
|
161
|
+
const window = this.options.store.getLiveQualificationWindow(batch.planId);
|
|
162
|
+
if (batch.lane !== this.lane || batch.configDigest !== this.configDigest || batch.trustDigest !== this.trustDigest
|
|
163
|
+
|| batch.profilePath !== this.options.config.profilePath || !same(batch.owner, this.owner())
|
|
164
|
+
|| !same(batch.terms, plan.dossier.liveQualification) || batch.planDigest !== plan.digest
|
|
165
|
+
|| batch.installationId !== plan.installationId || batch.activationId !== plan.activation?.id
|
|
166
|
+
|| batch.fence !== plan.activation?.fence || batch.startedAt !== window.startedAt
|
|
167
|
+
|| batch.deadlineAt !== window.deadlineAt || batch.readinessDigest !== window.readinessDigest
|
|
168
|
+
|| batch.hostGeneration !== window.hostGeneration || (!historical && (Date.now() >= batch.deadlineAt || Date.now() >= batch.expiresAt))) {
|
|
169
|
+
throw new Error('live qualification authority, exposure, or deadline changed');
|
|
170
|
+
}
|
|
171
|
+
const sources = batch.votes.map(expected => {
|
|
172
|
+
const deployment = this.options.store.getForegroundDeployment(expected.inboxId), source = this.source(expected.inboxId);
|
|
173
|
+
if (!deployment || !source || !this.sameDeployment(batch, deployment)
|
|
174
|
+
|| !same(this.vote(deployment, source, batch.startedAt, batch.deadlineAt, historical), expected)) {
|
|
175
|
+
throw new Error('live qualification source changed');
|
|
176
|
+
}
|
|
177
|
+
return source;
|
|
178
|
+
});
|
|
179
|
+
// Re-evaluate every started task in the bounded window, not just signed
|
|
180
|
+
// votes. Pending/unknown work and later negative feedback veto qualification.
|
|
181
|
+
if (batch.votes.every(vote => vote.status === 'achieved')) {
|
|
182
|
+
const cohort = this.cohort(plan, window, batch.owner, historical);
|
|
183
|
+
if (cohort.overflow || cohort.blocked || cohort.votes.some(vote => vote.status === 'not-achieved')) {
|
|
184
|
+
throw new Error('live qualification cohort is blocked or has a negative task');
|
|
185
|
+
}
|
|
186
|
+
}
|
|
187
|
+
const original = this.options.qualificationSource(batch.planId);
|
|
188
|
+
if (original.canonical.objective?.status !== 'not-achieved'
|
|
189
|
+
|| original.ownerRevision?.action === 'withdraw'
|
|
190
|
+
|| !same(taskObservationOwner(original.owner), batch.owner)) {
|
|
191
|
+
throw new Error('live qualification original owner failure changed');
|
|
192
|
+
}
|
|
193
|
+
this.options.assertRuntime(batch.planId);
|
|
194
|
+
return sources;
|
|
195
|
+
}
|
|
196
|
+
fence(batch, callback, historical = false) {
|
|
197
|
+
this.read(batch, historical);
|
|
198
|
+
if (this.options.store.getLiveQualification(batch.id))
|
|
199
|
+
this.options.store.assertCurrentLiveQualification(batch.id);
|
|
200
|
+
return withTrustedForegroundVoteFence({ evaluation: this.options.evaluation, owner: batch.owner, votes: batch.votes,
|
|
201
|
+
read: () => this.read(batch, historical), additionalSource: () => this.options.qualificationSource(batch.planId), callback });
|
|
202
|
+
}
|
|
203
|
+
/** Synchronous source audit and batch creation; only native cron may request authority. */
|
|
204
|
+
scan = () => {
|
|
205
|
+
if (!this.active || this.scanning)
|
|
206
|
+
return;
|
|
207
|
+
this.scanning = true;
|
|
208
|
+
try {
|
|
209
|
+
this.current();
|
|
210
|
+
this.lastError = null;
|
|
211
|
+
if (!this.options.runtimeAvailable() && !this.runtimeWasAvailable)
|
|
212
|
+
return;
|
|
213
|
+
if (this.options.runtimeAvailable())
|
|
214
|
+
this.runtimeWasAvailable = true;
|
|
215
|
+
const store = this.options.store, now = Date.now(), config = this.options.config;
|
|
216
|
+
for (const plan of store.listLiveQualificationPlans(config.profilePath, 100)) {
|
|
217
|
+
if (!plan.dossier.liveQualification || plan.target.profilePath !== config.profilePath)
|
|
218
|
+
continue;
|
|
219
|
+
const records = store.listLiveQualifications(plan.id, 100);
|
|
220
|
+
// A frozen batch is never replaced with newly selected votes after a correction.
|
|
221
|
+
if (records.length) {
|
|
222
|
+
for (const record of records) {
|
|
223
|
+
if (record.state === 'stale')
|
|
224
|
+
continue;
|
|
225
|
+
const historical = plan.status === 'activated';
|
|
226
|
+
try {
|
|
227
|
+
this.fence(record.batch, () => { }, historical);
|
|
228
|
+
}
|
|
229
|
+
catch {
|
|
230
|
+
if (record.state === 'applied' && record.receipt?.disposition === 'qualified') {
|
|
231
|
+
store.invalidateLiveQualification({ planId: plan.id, batchId: record.batch.id,
|
|
232
|
+
reason: 'live-qualification-unconfirmable' });
|
|
233
|
+
}
|
|
234
|
+
else if (record.state === 'pending' || record.state === 'signed') {
|
|
235
|
+
store.staleLiveQualification(record.batch.id);
|
|
236
|
+
if (plan.status === 'awaiting-live-tasks')
|
|
237
|
+
store.requestActivationRollback({ planId: plan.id,
|
|
238
|
+
expectedRevision: plan.revision, fence: record.batch.fence, failureCode: 'live-qualification-unconfirmable' });
|
|
239
|
+
}
|
|
240
|
+
}
|
|
241
|
+
}
|
|
242
|
+
continue;
|
|
243
|
+
}
|
|
244
|
+
if (plan.status !== 'awaiting-live-tasks' || now >= plan.expiresAt)
|
|
245
|
+
continue;
|
|
246
|
+
const window = store.getLiveQualificationWindow(plan.id);
|
|
247
|
+
if (now >= window.deadlineAt || window.startedAt > now)
|
|
248
|
+
continue;
|
|
249
|
+
const owner = this.owner();
|
|
250
|
+
const cohort = this.cohort(plan, window, owner, false);
|
|
251
|
+
const failures = cohort.votes.filter(vote => vote.status === 'not-achieved');
|
|
252
|
+
if (cohort.overflow && failures.length === 0)
|
|
253
|
+
continue;
|
|
254
|
+
if (failures.length === 0 && cohort.blocked)
|
|
255
|
+
continue;
|
|
256
|
+
const votes = (failures.length > 0 ? failures : cohort.votes.filter(vote => vote.status === 'achieved'))
|
|
257
|
+
.slice(0, 32).sort((a, b) => a.inboxId.localeCompare(b.inboxId));
|
|
258
|
+
if (votes.length === 0 || (failures.length === 0 && votes.length < plan.dossier.liveQualification.minimumTasks))
|
|
259
|
+
continue;
|
|
260
|
+
const core = { lane: this.lane, configDigest: this.configDigest, trustDigest: this.trustDigest,
|
|
261
|
+
planId: plan.id, planDigest: plan.digest, installationId: plan.installationId, profilePath: config.profilePath,
|
|
262
|
+
owner, terms: plan.dossier.liveQualification, activationId: plan.activation.id, fence: plan.activation.fence,
|
|
263
|
+
startedAt: window.startedAt, deadlineAt: window.deadlineAt, readinessDigest: window.readinessDigest,
|
|
264
|
+
hostGeneration: window.hostGeneration, votes };
|
|
265
|
+
const id = liveQualificationId(core);
|
|
266
|
+
const unsigned = { schemaVersion: 1, kind: 'dsh-live-qualification', id, ...core,
|
|
267
|
+
createdAt: now, expiresAt: window.deadlineAt + 300_000 };
|
|
268
|
+
const batch = { ...unsigned, digest: liveQualificationDigest(unsigned) };
|
|
269
|
+
try {
|
|
270
|
+
this.fence(batch, () => store.putLiveQualification(batch));
|
|
271
|
+
}
|
|
272
|
+
catch { /* A racing feedback revision or Host sample cannot create a batch. */ }
|
|
273
|
+
}
|
|
274
|
+
}
|
|
275
|
+
catch (error) {
|
|
276
|
+
this.lastError = error instanceof Error ? error.message.slice(0, 200) : 'live qualification scan failed';
|
|
277
|
+
}
|
|
278
|
+
finally {
|
|
279
|
+
this.scanning = false;
|
|
280
|
+
}
|
|
281
|
+
};
|
|
282
|
+
/** Synchronous final-commit guard; the Store calls this inside its CAS. */
|
|
283
|
+
withQualificationFence(planId, callback) {
|
|
284
|
+
this.current();
|
|
285
|
+
const records = this.options.store.listLiveQualifications(planId, 100).filter(record => record.state === 'applied' && record.receipt?.disposition === 'qualified');
|
|
286
|
+
if (records.length !== 1)
|
|
287
|
+
throw new Error('live qualification has no unique qualified receipt');
|
|
288
|
+
const batch = records[0].batch;
|
|
289
|
+
if (batch.planId !== planId)
|
|
290
|
+
throw new Error('live qualification plan changed');
|
|
291
|
+
return this.fence(batch, callback);
|
|
292
|
+
}
|
|
293
|
+
definition() {
|
|
294
|
+
const { scope, timeoutMs, budgetId, budgetAmount } = this.options.config;
|
|
295
|
+
return { name: 'Qualify live deployed plugin tasks', schedule: { kind: 'cron', expression: '* * * * *', timezone: 'UTC' },
|
|
296
|
+
workspace: scope.workspace, agentPreset: scope.preset, timeoutMs, misfire: { kind: 'latest' }, overlap: 'skip',
|
|
297
|
+
retrySafety: 'never', maxRetries: 0, principal: scope.principalId, budgetId, budgetAmount,
|
|
298
|
+
execution: { kind: 'host', executorId: EXECUTOR, executorContractVersion: 1, runbookId: 'qualify', runbookVersion: 1,
|
|
299
|
+
catalogDigest: CATALOG, targetScope: { workspace: scope.workspace, preset: scope.preset },
|
|
300
|
+
scopeDigest: controlPlaneDigest([scope.workspace, scope.preset]), ownerRouteId: scope.ownerRouteId,
|
|
301
|
+
activationNonce: this.activationNonce } };
|
|
302
|
+
}
|
|
303
|
+
async execute(input) {
|
|
304
|
+
let began = false;
|
|
305
|
+
try {
|
|
306
|
+
const scope = this.options.config.scope;
|
|
307
|
+
const registration = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.scanId });
|
|
308
|
+
if (input.executionMode !== 'production' || input.automationId !== this.scanId || input.activationNonce !== this.activationNonce
|
|
309
|
+
|| input.definitionHash !== registration?.definitionHash || input.catalogDigest !== CATALOG
|
|
310
|
+
|| registration.activationNonce !== this.activationNonce || input.ownerRouteId !== scope.ownerRouteId
|
|
311
|
+
|| input.principal !== scope.principalId || input.targetScope.workspace !== scope.workspace
|
|
312
|
+
|| input.targetScope.preset !== scope.preset)
|
|
313
|
+
throw new Error('live qualification dispatch changed');
|
|
314
|
+
const signal = AbortSignal.any([this.abort.signal, input.signal, AbortSignal.timeout(this.options.config.timeoutMs)]);
|
|
315
|
+
signal.throwIfAborted();
|
|
316
|
+
began = true;
|
|
317
|
+
// Registration is a sufficient native lifecycle barrier. A missing
|
|
318
|
+
// observer at the first actual cron tick is no longer a startup race.
|
|
319
|
+
if (!this.options.runtimeAvailable())
|
|
320
|
+
this.runtimeWasAvailable = true;
|
|
321
|
+
this.scan();
|
|
322
|
+
const owner = this.owner();
|
|
323
|
+
if (owner.authorityId !== scope.ownerRouteId || owner.principalId !== scope.principalId
|
|
324
|
+
|| owner.workspace !== scope.workspace || owner.agentPreset !== scope.preset)
|
|
325
|
+
throw new Error('live qualification owner route changed');
|
|
326
|
+
if (!this.options.runtimeAvailable())
|
|
327
|
+
throw new Error('live qualification Host observer unavailable');
|
|
328
|
+
for (const plan of this.options.store.listLiveQualificationPlans(this.options.config.profilePath, 100)) {
|
|
329
|
+
signal.throwIfAborted();
|
|
330
|
+
this.current();
|
|
331
|
+
if (plan.status !== 'awaiting-live-tasks')
|
|
332
|
+
continue;
|
|
333
|
+
const records = this.options.store.listLiveQualifications(plan.id, 100);
|
|
334
|
+
for (const record of records) {
|
|
335
|
+
if (record.state !== 'pending' && record.state !== 'signed')
|
|
336
|
+
continue;
|
|
337
|
+
try {
|
|
338
|
+
this.fence(record.batch, () => { });
|
|
339
|
+
}
|
|
340
|
+
catch {
|
|
341
|
+
this.options.store.staleLiveQualification(record.batch.id);
|
|
342
|
+
this.options.store.requestActivationRollback({ planId: plan.id, expectedRevision: plan.revision,
|
|
343
|
+
fence: record.batch.fence, failureCode: 'live-qualification-unconfirmable' });
|
|
344
|
+
continue;
|
|
345
|
+
}
|
|
346
|
+
const receipt = record.receipt ?? await (this.options.request?.(record.batch, signal)
|
|
347
|
+
?? requestLiveQualification(this.options.config.authority, { protocol: 'dsh-live-qualification/v1',
|
|
348
|
+
batchId: record.batch.id, batchDigest: record.batch.digest }, signal));
|
|
349
|
+
signal.throwIfAborted();
|
|
350
|
+
this.current();
|
|
351
|
+
const key = resolveTrustKey(this.options.trust, 'host-attestation', receipt.authority, receipt.keyId);
|
|
352
|
+
await this.options.store.applyLiveQualification({ receipt, publicKeyPem: key.publicKeyPem,
|
|
353
|
+
withSourceFence: callback => { signal.throwIfAborted(); return this.fence(record.batch, callback); } });
|
|
354
|
+
}
|
|
355
|
+
}
|
|
356
|
+
if (this.lastError)
|
|
357
|
+
throw new Error(this.lastError);
|
|
358
|
+
return { outcome: 'succeeded', failureClass: 'none', failurePhase: 'none', failureCode: 'none', sideEffectState: 'possible', retryability: 'unsafe' };
|
|
359
|
+
}
|
|
360
|
+
catch (error) {
|
|
361
|
+
this.lastError = error instanceof Error ? error.message.slice(0, 200) : 'live qualification failed';
|
|
362
|
+
return { outcome: began ? 'unknown' : 'failed', failureClass: began ? 'unknown' : 'configuration', failurePhase: 'host-execution',
|
|
363
|
+
failureCode: 'live-qualification-rejected', sideEffectState: began ? 'unknown' : 'none', retryability: began ? 'unsafe' : 'after-intervention' };
|
|
364
|
+
}
|
|
365
|
+
}
|
|
366
|
+
}
|
|
367
|
+
//# sourceMappingURL=live-qualification-runtime.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"live-qualification-runtime.js","sourceRoot":"","sources":["../src/live-qualification-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAI/C,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,kCAAkC,EAAmC,MAAM,6BAA6B,CAAA;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,mBAAmB,EACrB,MAAM,yBAAyB,CAAA;AAC7F,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACrJ,OAAO,EAAE,eAAe,EAAiC,MAAM,YAAY,CAAA;AAK3E,MAAM,KAAK,GAAG,yCAAyC,CAAA;AACvD,MAAM,QAAQ,GAAG,4CAA4C,CAAA;AAC7D,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;AACtE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAcjG,MAAM,UAAU,+BAA+B,CAAC,MAA+B;IAC7E,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAChH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;IACjD,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAA;IACjI,MAAM,IAAI,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;WACzG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,6DAA6D,CAAC;WAC5E,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,2CAA2C,CAAC;WACjE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,UAAU,CAAC;WACzF,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;WAClG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1I,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,kCAAkC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AACtD,CAAC;AAED,iGAAiG;AACjG,MAAM,OAAO,wBAAwB;IAiBN;IAhBZ,IAAI,CAAQ;IACZ,YAAY,CAAQ;IACpB,WAAW,CAAQ;IACnB,MAAM,CAAQ;IACd,UAAU,GAAG,UAAU,EAAE,CAAA;IACzB,eAAe,CAAQ;IACvB,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC9C,UAAU,CAAa;IACvB,WAAW,CAAa;IACxB,OAAO,CAAgB;IACvB,MAAM,GAAG,KAAK,CAAA;IACd,mBAAmB,GAAG,KAAK,CAAA;IAC3B,QAAQ,GAAG,KAAK,CAAA;IAChB,SAAS,GAAkB,IAAI,CAAA;IAEvC,YAA6B,OAQ5B;QAR4B,YAAO,GAAP,OAAO,CAQnC;QACC,+BAA+B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACxG,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACpD,IAAI,CAAC,MAAM,GAAG,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC9D,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE;YAChF,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO;mBAChH,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC;YAC9D,OAAO,EAAE,KAAK,CAAC,EAAE;gBACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACxB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBACtE,OAAO,MAAM,CAAA;YACf,CAAC;SACF,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM;YAChF,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAChH,IAAI,CAAC,IAAI,EAAE,CAAA;IACb,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;gBAClH,IAAI,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC,eAAe;oBAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK;wBAC5G,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YACnJ,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAClB,IAAI,CAAC;oBAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBACpC,IAAI,CAAC;wBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;oBAAC,CAAC;4BAAS,CAAC;wBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;wBACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAE9D,OAAO;QACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC3E,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IACO,KAAK;QACX,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;QACvC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY;YACpG,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC7F,CAAC;IACO,MAAM,CAAC,OAAe;QAC5B,OAAO,uBAAuB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO;YAC3D,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC3E,CAAC;IACO,IAAI,CAAC,UAAsC,EAAE,MAA+C,EAClG,SAAiB,EAAE,UAAkB,EAAE,UAAmB;QAC1D,IAAI,UAAU,CAAC,SAAS,EAAE,mBAAmB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc;eAC7F,UAAU,CAAC,SAAS,CAAC,WAAW,GAAG,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,WAAW,IAAI,UAAU;eAC9F,UAAU,CAAC,IAAI,CAAC,YAAY,GAAG,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU;YAAE,OAAO,SAAS,CAAA;QAC7G,OAAO,qBAAqB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YAChE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC,CAAA;IAChF,CAAC;IACO,cAAc,CAAC,KAA6B,EAAE,UAAsC;QAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;QACtC,OAAO,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eAChF,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;eAChG,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAChF,SAAS,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,eAAe,CAAA;IAC7G,CAAC;IACO,MAAM,CAAC,IAA0B,EAAE,MAAmE,EAC5G,KAA2B,EAAE,UAAmB;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACtF,MAAM,KAAK,GAA0B,EAAE,CAAA;QACvC,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU;gBAAE,SAAQ;YAClH,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;mBACvH,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE;mBACnG,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;mBAChG,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,eAAe;mBAClD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;mBACnE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;mBACjE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW;mBACzG,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,UAAU,CAAC,SAAS,EAAE,mBAAmB,KAAK,QAAQ;mBACzF,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,SAAQ;YAAC,CAAC;YACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;YACzH,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAA;IAClE,CAAC;IACO,IAAI,CAAC,KAA6B,EAAE,UAAU,GAAG,KAAK;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,4BAA4B,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;eAC7G,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;eACzF,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;eACtF,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE;eAC1F,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;eAC9E,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe;eAC1F,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC1I,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACvH,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;mBAChE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACtD,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;QACF,wEAAwE;QACxE,8EAA8E;QAC9E,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YACjE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;YAChF,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,cAAc;eACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,KAAK,UAAU;eAC7C,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,OAAO,OAAO,CAAA;IAChB,CAAC;IACO,KAAK,CAAI,KAA6B,EAAE,QAAiB,EAAE,UAAU,GAAG,KAAK;QACnF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAClH,OAAO,8BAA8B,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;YACjH,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACjI,CAAC;IAED,2FAA2F;IAC3F,IAAI,GAAG,GAAS,EAAE;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB;gBAAE,OAAM;YACzE,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAAE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAA;YACpE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;YAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;oBAAE,SAAQ;gBAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC1D,iFAAiF;gBACjF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;wBAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;4BAAE,SAAQ;wBACtC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,KAAK,WAAW,CAAA;wBAC9C,IAAI,CAAC;4BAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,UAAU,CAAC,CAAA;wBAAC,CAAC;wBACtD,MAAM,CAAC;4BACL,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;gCAC9E,KAAK,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;oCAC3E,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;4BACjD,CAAC;iCAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gCACnE,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gCAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB;oCAAE,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;wCAC1F,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;4BAClH,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,SAAQ;gBACV,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS;oBAAE,SAAQ;gBAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACxD,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;oBAAE,SAAQ;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;gBAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,CAAC,CAAA;gBAC5E,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAQ;gBACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO;oBAAE,SAAQ;gBACrD,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;qBACrG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;gBAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC;oBAAE,SAAQ;gBACzH,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC5F,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC9G,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,UAAW,CAAC,KAAK;oBAC9G,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;oBACnG,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,CAAA;gBAChD,MAAM,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;gBACpC,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,IAAI,EAAE,wBAAiC,EAAE,EAAE,EAAE,GAAG,IAAI;oBAChG,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,EAAE,CAAA;gBAC1D,MAAM,KAAK,GAA2B,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAA;gBAChG,IAAI,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAA;gBAAC,CAAC;gBAClE,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAA;QAAC,CAAC;gBACpH,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAA;QAAC,CAAC;IACnC,CAAC,CAAA;IAED,2EAA2E;IAC3E,sBAAsB,CAAI,MAAc,EAAE,QAAiB;QACzD,IAAI,CAAC,OAAO,EAAE,CAAA;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACrF,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,CAAC,CAAA;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAA;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACpC,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QACxE,OAAO,EAAE,IAAI,EAAE,oCAAoC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;YACvH,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM;YAC9G,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY;YACzF,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;gBAClH,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBACzF,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAClG,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAA;IAC/C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAkC;QACtD,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;YACvC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACvH,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBAC3H,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,cAAc,IAAI,KAAK,CAAC,aAAa,KAAK,OAAO;mBACxF,YAAY,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBAClG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;mBACxF,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YACtG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrH,MAAM,CAAC,cAAc,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAA;YACrC,mEAAmE;YACnE,sEAAsE;YACtE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAAE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAA;YACrE,IAAI,CAAC,IAAI,EAAE,CAAA;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YAC1B,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;mBAClF,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;YACzI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;YACrG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvG,MAAM,CAAC,cAAc,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAA;gBACvC,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB;oBAAE,SAAQ;gBACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACvE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;wBAAE,SAAQ;oBACrE,IAAI,CAAC;wBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAAC,CAAC;oBAC1C,MAAM,CAAC;wBACL,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;wBAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;4BAC7F,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;wBAC/E,SAAQ;oBACV,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC;2BAChF,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,2BAA2B;4BAChG,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;oBAC1E,MAAM,CAAC,cAAc,EAAE,CAAC;oBAAC,IAAI,CAAC,OAAO,EAAE,CAAA;oBACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;oBACrG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY;wBACvF,eAAe,EAAE,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC1G,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;QACvJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAA;YACnG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,YAAY,EAAE,gBAAgB;gBAC/H,WAAW,EAAE,6BAA6B,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAA;QACpJ,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,73 @@
|
|
|
1
|
+
import type { TaskObservationOwner, TaskObservationVote } from './task-observation-types.js';
|
|
2
|
+
export interface LiveQualificationTerms {
|
|
3
|
+
protocol: 'dsh-bounded-live/v1';
|
|
4
|
+
maximumWindowMs: number;
|
|
5
|
+
minimumTasks: number;
|
|
6
|
+
authority: string;
|
|
7
|
+
keyId: string;
|
|
8
|
+
}
|
|
9
|
+
/** A finite, profile-wide pre-adoption observation; no exposure cap is implied. */
|
|
10
|
+
export interface LiveQualificationBatch {
|
|
11
|
+
schemaVersion: 1;
|
|
12
|
+
kind: 'dsh-live-qualification';
|
|
13
|
+
id: string;
|
|
14
|
+
digest: string;
|
|
15
|
+
lane: string;
|
|
16
|
+
configDigest: string;
|
|
17
|
+
trustDigest: string;
|
|
18
|
+
planId: string;
|
|
19
|
+
planDigest: string;
|
|
20
|
+
installationId: string;
|
|
21
|
+
profilePath: string;
|
|
22
|
+
owner: TaskObservationOwner;
|
|
23
|
+
terms: LiveQualificationTerms;
|
|
24
|
+
activationId: string;
|
|
25
|
+
fence: number;
|
|
26
|
+
startedAt: number;
|
|
27
|
+
deadlineAt: number;
|
|
28
|
+
readinessDigest: string;
|
|
29
|
+
hostGeneration: number;
|
|
30
|
+
votes: readonly TaskObservationVote[];
|
|
31
|
+
createdAt: number;
|
|
32
|
+
expiresAt: number;
|
|
33
|
+
}
|
|
34
|
+
export interface LiveQualificationReceipt {
|
|
35
|
+
schemaVersion: 1;
|
|
36
|
+
kind: 'dsh-live-qualification-receipt';
|
|
37
|
+
receiptId: string;
|
|
38
|
+
authority: string;
|
|
39
|
+
keyId: string;
|
|
40
|
+
batchId: string;
|
|
41
|
+
batchDigest: string;
|
|
42
|
+
planId: string;
|
|
43
|
+
planDigest: string;
|
|
44
|
+
activationId: string;
|
|
45
|
+
fence: number;
|
|
46
|
+
hostGeneration: number;
|
|
47
|
+
disposition: 'qualified' | 'failed';
|
|
48
|
+
observedAt: number;
|
|
49
|
+
expiresAt: number;
|
|
50
|
+
signature: string;
|
|
51
|
+
}
|
|
52
|
+
export interface LiveQualificationRequest {
|
|
53
|
+
protocol: 'dsh-live-qualification/v1';
|
|
54
|
+
batchId: string;
|
|
55
|
+
batchDigest: string;
|
|
56
|
+
}
|
|
57
|
+
export interface LiveQualificationRecord {
|
|
58
|
+
batch: LiveQualificationBatch;
|
|
59
|
+
state: 'pending' | 'signed' | 'applied' | 'stale';
|
|
60
|
+
receipt?: LiveQualificationReceipt;
|
|
61
|
+
}
|
|
62
|
+
export declare function validateLiveQualificationTerms(value: unknown): asserts value is LiveQualificationTerms;
|
|
63
|
+
/** Content identity excludes the creation clock, as with task observation. */
|
|
64
|
+
export declare function liveQualificationId(batch: Omit<LiveQualificationBatch, 'schemaVersion' | 'kind' | 'id' | 'digest' | 'createdAt' | 'expiresAt'>): string;
|
|
65
|
+
export declare function liveQualificationDigest(batch: Omit<LiveQualificationBatch, 'digest'>): string;
|
|
66
|
+
export declare function assertLiveQualificationBatch(value: unknown): asserts value is LiveQualificationBatch;
|
|
67
|
+
export declare function parseLiveQualificationReceipt(value: unknown): LiveQualificationReceipt;
|
|
68
|
+
/** Domain-separated canonical signing payload; never valid as a Host phase receipt. */
|
|
69
|
+
export declare function liveQualificationSigningPayload(receipt: Omit<LiveQualificationReceipt, 'signature'>): string;
|
|
70
|
+
export declare function verifyLiveQualificationReceipt(receiptInput: unknown, batchInput: unknown, publicKeyPem: string | Buffer, now?: number): LiveQualificationReceipt;
|
|
71
|
+
/** Shared exact identity constructor for the independent authority. */
|
|
72
|
+
export declare function liveQualificationReceiptId(receipt: Omit<LiveQualificationReceipt, 'receiptId' | 'signature'>): string;
|
|
73
|
+
//# sourceMappingURL=live-qualification.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"live-qualification.d.ts","sourceRoot":"","sources":["../src/live-qualification.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAY5F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,mFAAmF;AACnF,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,wBAAwB,CAAA;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,oBAAoB,CAAA;IAC3B,KAAK,EAAE,sBAAsB,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,gCAAgC,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,WAAW,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,2BAA2B,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAA;IAC7B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;IACjD,OAAO,CAAC,EAAE,wBAAwB,CAAA;CACnC;AA0BD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAMtG;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAOvJ;AACD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,CAG7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAgCpG;AAMD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAkBtF;AAED,uFAAuF;AACvF,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GAAG,MAAM,CAI5G;AASD,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAa,GAAG,wBAAwB,CAoBpK;AAED,uEAAuE;AACvE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,GAAG,WAAW,CAAC,GAAG,MAAM,CAErH"}
|