@dynamicalsystems/idl 0.10.0 → 0.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (32) hide show
  1. package/dist/index.cjs +295 -30
  2. package/dist/index.d.cts +249 -5
  3. package/dist/index.d.cts.map +1 -1
  4. package/dist/index.d.mts +249 -5
  5. package/dist/index.d.mts.map +1 -1
  6. package/dist/index.mjs +276 -31
  7. package/dist/index.mjs.map +1 -1
  8. package/package.json +1 -2
  9. package/schema/dsg-core-google-identity-v1.json +39 -0
  10. package/schema/dsg-core-refusal-v3.json +103 -0
  11. package/schema/dsg-organization-source-v2.json +623 -0
  12. package/src/core/google-identity.v1.ts +42 -0
  13. package/src/core/identity-binding.v1.ts +2 -2
  14. package/src/core/refusal.v1.ts +2 -2
  15. package/src/core/refusal.v2.ts +2 -2
  16. package/src/core/refusal.v3.ts +50 -0
  17. package/src/index.ts +50 -6
  18. package/src/infra/adoption-fact.v1.ts +2 -2
  19. package/src/infra/resource-descriptor.v1.ts +2 -2
  20. package/src/infra/signed-law.v1.ts +1 -1
  21. package/src/kernel/bootstrap.v1.ts +1 -1
  22. package/src/kernel/dispatch-consume.v1.ts +1 -1
  23. package/src/kernel/ordinary-authority.v1.ts +2 -2
  24. package/src/kernel/standing-order-activation.v1.ts +2 -2
  25. package/src/organization/source.v2.ts +219 -0
  26. package/src/primitives.ts +2 -2
  27. package/src/registry/revocations.v1.ts +1 -1
  28. package/src/run/decision.v1.ts +2 -2
  29. package/src/run/event.v1.ts +2 -2
  30. package/src/run/operation.v1.ts +1 -1
  31. package/src/run/request.v1.ts +2 -2
  32. package/src/run/run-summary.v1.ts +2 -2
package/dist/index.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.mjs","names":["digest","closed"],"sources":["../src/primitives.ts","../src/kernel/dispatch-consume.v1.ts","../src/run/operation.v1.ts","../src/infra/resource-descriptor.v1.ts","../src/infra/signed-law.v1.ts","../src/infra/adoption-fact.v1.ts","../src/registry/revocations.v1.ts","../src/kernel/bootstrap.v1.ts","../src/kernel/standing-order-activation.v1.ts","../src/kernel/ordinary-authority.v1.ts","../src/run/contract-versions.ts","../src/run/event.v1.ts","../src/run/request.v1.ts","../src/run/decision.v1.ts","../src/run/run-summary.v1.ts","../src/core/refusal.v1.ts","../src/core/refusal.v2.ts","../src/core/identity-binding.v1.ts","../src/index.ts"],"sourcesContent":["// The shared primitives every profile builds from. No profile defines its\n// own: a digest is Hex64 everywhere, a timestamp is UtcSecond everywhere,\n// an open object exists nowhere.\nimport { type TObject, type TProperties, type TSchema, Type } from \"@sinclair/typebox\";\nimport { ORN_PATTERN, SHA256_PATTERN } from \"@dynamicalsystems/orn-schemas\";\n\n/** Closed object: an extra field is a different protocol. */\nexport const closed = <T extends TProperties>(properties: T): TObject<T> =>\n Type.Object(properties, { additionalProperties: false });\n\n/** Lowercase sha256 hex. Every digest on the wire. */\nexport const Hex64 = Type.String({ pattern: \"^[0-9a-f]{64}$\" });\n\n/** Exact UTC second, Z suffix, no fractional part. */\nexport const UtcSecond = Type.String({\n pattern: \"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$\",\n});\n\nexport const NonEmptyString = Type.String({ minLength: 1 });\n\nexport const SafeInt = Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });\n\n/** An ORN, validated by the grammar dsg-orn owns. Built from the exported\n * pattern, not the exported schema object: the upstream schemas carry\n * JSON Schema $id metadata, and embedding the same $id in several route\n * schemas makes validators refuse the duplicate. The pattern is the wire\n * truth; the metadata is not. */\nexport const Orn = Type.String({ pattern: ORN_PATTERN });\n\n/** The pair of an ORN and the sha256 pinning a version (dsg-orn Reference). */\nexport const Reference = closed({\n orn: Orn,\n sha256: Type.String({ pattern: SHA256_PATTERN }),\n});\n\n/** A person named on a run. Missing on the wire is null; readers print\n * \"Not recorded\". Never inferred. */\nexport const PersonReference = closed({\n principal: Orn,\n displayName: NonEmptyString,\n source: NonEmptyString,\n});\n\n/** One wire profile: the literal, and every top-level shape that crosses\n * the seam it names. Shape names are stable identifiers (\"request\",\n * \"lease\", \"refusal\"); vectors address a shape as \"<literal>#<shape>\". */\nexport type ProfileEntry = {\n readonly literal: `dsg.${string}.${string}/${number}`;\n readonly shapes: Readonly<Record<string, TSchema>>;\n /** Set ONLY when the wire cannot carry the literal as a field of any\n * shape (a frozen /1); names exactly where the literal lives instead. */\n readonly literalNote?: string;\n /** Names the shape non-TS consumers validate a whole document against;\n * the emitted JSON Schema gains a root $ref to it. Only meaningful for\n * profiles with a single document root. */\n readonly rootShape?: string;\n};\n","// dsg.kernel.dispatch-consume/1\n// Owner: dsg-kernel (the consume route produces the lease and the refusal;\n// the plane produces the request).\n//\n// K05/I3: the dispatch-authorization consume contract between the kernel\n// and the plane. Immediately before its first non-cleanup cloud mutation -\n// identity, bucket and IAM preparation included, not only job submission -\n// the plane consumes a short-lived, single-operation dispatch authorization\n// bound to operation, generation, envelope digest, law digest and\n// reservation. The committed consume event is the authorization ordering\n// point; it is not atomic with any provider API. A replay returns the\n// original lease and never renews it; a renewal is a new recorded\n// authorization decision for the same operation and reservation.\n//\n// Lifted verbatim from dsg-kernel packages/core/src/dispatch.ts at commit\n// c2d39d95 (wire shapes only; the record-held event payloads stay in the\n// kernel). This file is frozen: changes ship as dispatch-consume.v2.ts.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n Orn,\n Reference,\n UtcSecond,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const DISPATCH_CONSUME_PROFILE = \"dsg.kernel.dispatch-consume/1\" as const;\n\n/** The bounded clock skew a lease check must tolerate, in seconds. */\nexport const DISPATCH_MAX_SKEW_SECONDS = 300;\n\nconst DispatchConsumeRequestSchemaValue = closed({\n profile: Type.Literal(DISPATCH_CONSUME_PROFILE),\n /** The kernel operation identity from the accepted OperationRequest. */\n operationId: NonEmptyString,\n /** The workspace generation the plane admitted the operation at. */\n generation: Type.Integer({ minimum: 0 }),\n /** The Case the operation belongs to - the stream the consume event\n * lands on and the stream the reservation was recorded on. */\n caseOrn: Orn,\n /** SHA256(JCS(complete OperationRequest)) - the M010 envelope digest. */\n envelopeSha256: Hex64,\n /** The exact retained signed-law bytes the Case pins. */\n lawSha256: Hex64,\n /** The K04 reservation the authorization is bound to: sha256 is the\n * reservation event's record id. */\n reservation: Reference,\n requestedAt: UtcSecond,\n /** False: first consumption or idempotent replay of it. True: an explicit\n * renewal - a new recorded authorization decision for the same operation\n * and reservation after lease expiry with the work known unsubmitted. A\n * replay never renews; only this flag does, and it re-runs every\n * revocation check at the current record state. */\n renewal: Type.Boolean(),\n});\nexport const DispatchConsumeRequestSchema: typeof DispatchConsumeRequestSchemaValue =\n DispatchConsumeRequestSchemaValue;\nexport type DispatchConsumeRequest = Static<typeof DispatchConsumeRequestSchema>;\n\nconst DispatchLeaseSchemaValue = closed({\n profile: Type.Literal(DISPATCH_CONSUME_PROFILE),\n /** The consume event's record id: the committed ordering point. */\n leaseId: Hex64,\n operationId: NonEmptyString,\n generation: Type.Integer({ minimum: 0 }),\n caseOrn: Orn,\n envelopeSha256: Hex64,\n lawSha256: Hex64,\n reservation: Reference,\n consumedAt: UtcSecond,\n /** Fixed maximum duration from consumedAt; the plane checks validity\n * before each new non-cleanup call, Batch submission included. */\n expiresAt: UtcSecond,\n /** The bounded clock skew a lease check must tolerate, in seconds. */\n maxSkewSeconds: Type.Integer({ minimum: 0, maximum: DISPATCH_MAX_SKEW_SECONDS }),\n renewal: Type.Literal(\"new-authorization-required\"),\n /** False when this response replays an earlier committed consumption:\n * the lease bytes, expiry included, are the original's. */\n fresh: Type.Boolean(),\n});\nexport const DispatchLeaseSchema: typeof DispatchLeaseSchemaValue = DispatchLeaseSchemaValue;\nexport type DispatchLease = Static<typeof DispatchLeaseSchema>;\n\nconst DispatchRefusalCodeSchemaValue = Type.Union([\n Type.Literal(\"unknown_operation\"),\n Type.Literal(\"no_reservation\"),\n Type.Literal(\"binding_mismatch\"),\n Type.Literal(\"revoked\"),\n Type.Literal(\"authority_refused\"),\n Type.Literal(\"renewal_requires_existing_consumption\"),\n Type.Literal(\"unavailable\"),\n]);\nexport const DispatchRefusalCodeSchema: typeof DispatchRefusalCodeSchemaValue =\n DispatchRefusalCodeSchemaValue;\nexport type DispatchRefusalCode = Static<typeof DispatchRefusalCodeSchema>;\n\nconst DispatchRefusalSchemaValue = closed({\n profile: Type.Literal(DISPATCH_CONSUME_PROFILE),\n code: DispatchRefusalCodeSchema,\n issues: Type.Array(NonEmptyString, { minItems: 1 }),\n});\nexport const DispatchRefusalSchema: typeof DispatchRefusalSchemaValue = DispatchRefusalSchemaValue;\nexport type DispatchRefusal = Static<typeof DispatchRefusalSchema>;\n\nexport const dispatchConsumeV1: ProfileEntry = {\n literal: DISPATCH_CONSUME_PROFILE,\n shapes: {\n request: DispatchConsumeRequestSchema,\n lease: DispatchLeaseSchema,\n refusal: DispatchRefusalSchema,\n },\n};\n","// dsg.run.operation/1\n// Owner: dsg-run (the protocol listener accepts the request and answers\n// the receipt; the kernel validates, records and reads back).\n//\n// Closed, versioned compute-operation vocabulary shared by the kernel and\n// the dsg.run plane. The document is deliberately references-only: payload\n// bytes remain retained artifacts, while this request carries the immutable\n// identity, generation fence, law, reservation and plan digest.\n//\n// The envelope digest bound at dispatch (M010) is sha256 over the RFC 8785\n// canonical form of the complete OperationRequest; the digest vectors in\n// the conformance package pin that meaning.\n//\n// Lifted verbatim from dsg-kernel packages/core/src/operation.ts at commit\n// 0f8d64d7 (equal, field for field, to dsg-run service/src/protocol/\n// schemas.ts 134-246 - the R01 cross-validation held). Known /2 candidate,\n// kept loose here because a released /1 is frozen: acceptedAt is\n// minLength 1, not an exact UTC second, and the plane emits fractional\n// seconds today.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n Reference,\n SafeInt,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const OPERATION_PROFILE = \"dsg.run.operation/1\" as const;\n\nconst ExecutionResourcesSchemaValue = closed({\n maxGpuSeconds: SafeInt,\n maxRunSeconds: SafeInt,\n maxParallelism: SafeInt,\n});\nexport const ExecutionResourcesSchema: typeof ExecutionResourcesSchemaValue =\n ExecutionResourcesSchemaValue;\nexport type ExecutionResources = Static<typeof ExecutionResourcesSchema>;\n\nconst ExecutionLawSchemaValue = closed({\n bundle: Reference,\n registryRelease: Reference,\n});\nexport const ExecutionLawSchema: typeof ExecutionLawSchemaValue = ExecutionLawSchemaValue;\nexport type ExecutionLaw = Static<typeof ExecutionLawSchema>;\n\nconst ExecutionDocumentSchemaValue = closed({\n schemaVersion: Type.Literal(1),\n classContract: Reference,\n law: ExecutionLawSchema,\n workload: Reference,\n inputs: Type.Array(Reference),\n resources: ExecutionResourcesSchema,\n costBound: Reference,\n placement: Reference,\n results: Reference,\n secrets: Type.Array(Reference),\n});\nexport const ExecutionDocumentSchema: typeof ExecutionDocumentSchemaValue =\n ExecutionDocumentSchemaValue;\nexport type ExecutionDocument = Static<typeof ExecutionDocumentSchema>;\n\nconst OperationBeforeSchemaValue = closed({\n operationId: Type.Union([NonEmptyString, Type.Null()]),\n planDigest: Type.Union([Hex64, Type.Null()]),\n});\nexport const OperationBeforeSchema: typeof OperationBeforeSchemaValue = OperationBeforeSchemaValue;\nexport type OperationBefore = Static<typeof OperationBeforeSchema>;\n\nconst OperationRequestSchemaValue = closed({\n profile: Type.Literal(OPERATION_PROFILE),\n operationId: NonEmptyString,\n case: Reference,\n workspace: NonEmptyString,\n expectedGeneration: SafeInt,\n before: OperationBeforeSchema,\n planDigest: Hex64,\n document: ExecutionDocumentSchema,\n authority: Reference,\n reservation: Reference,\n});\nexport const OperationRequestSchema: typeof OperationRequestSchemaValue =\n OperationRequestSchemaValue;\nexport type OperationRequest = Static<typeof OperationRequestSchema>;\n\nconst AcceptedSchemaValue = closed({\n profile: Type.Literal(OPERATION_PROFILE),\n operationId: NonEmptyString,\n actionId: NonEmptyString,\n generation: SafeInt,\n planDigest: Hex64,\n acceptedAt: NonEmptyString,\n});\nexport const AcceptedSchema: typeof AcceptedSchemaValue = AcceptedSchemaValue;\nexport type Accepted = Static<typeof AcceptedSchema>;\n\nconst OperationExecutionSchemaValue = Type.Union([\n Type.Literal(\"queued\"),\n Type.Literal(\"running\"),\n Type.Literal(\"succeeded\"),\n Type.Literal(\"failed\"),\n Type.Literal(\"canceled\"),\n Type.Literal(\"unknown\"),\n]);\nexport const OperationExecutionSchema: typeof OperationExecutionSchemaValue =\n OperationExecutionSchemaValue;\nexport type OperationExecution = Static<typeof OperationExecutionSchema>;\n\nconst OperationCleanupSchemaValue = Type.Union([\n Type.Literal(\"pending\"),\n Type.Literal(\"present\"),\n Type.Literal(\"absent\"),\n Type.Literal(\"unknown\"),\n]);\nexport const OperationCleanupSchema: typeof OperationCleanupSchemaValue =\n OperationCleanupSchemaValue;\nexport type OperationCleanup = Static<typeof OperationCleanupSchema>;\n\nconst OperationEvidenceSchemaValue = Type.Union([Type.Literal(\"pending\"), Type.Literal(\"ready\")]);\nexport const OperationEvidenceSchema: typeof OperationEvidenceSchemaValue =\n OperationEvidenceSchemaValue;\nexport type OperationEvidence = Static<typeof OperationEvidenceSchema>;\n\nconst OperationCostSchemaValue = Type.Union([\n Type.Literal(\"reserved\"),\n Type.Literal(\"provisional\"),\n Type.Literal(\"reconciled\"),\n]);\nexport const OperationCostSchema: typeof OperationCostSchemaValue = OperationCostSchemaValue;\nexport type OperationCost = Static<typeof OperationCostSchema>;\n\nconst ReadbackSchemaValue = closed({\n operationId: NonEmptyString,\n generation: SafeInt,\n planDigest: Hex64,\n execution: OperationExecutionSchema,\n cleanup: OperationCleanupSchema,\n evidence: OperationEvidenceSchema,\n evidenceRef: Type.Union([Reference, Type.Null()]),\n cost: OperationCostSchema,\n});\nexport const ReadbackSchema: typeof ReadbackSchemaValue = ReadbackSchemaValue;\nexport type Readback = Static<typeof ReadbackSchema>;\n\n// I-001 names the status as the same closed readback shape. Keeping this\n// alias prevents callers from inventing a second status wire contract.\nexport const OperationStatusSchema = ReadbackSchema;\nexport type OperationStatus = Readback;\n\nexport const operationV1: ProfileEntry = {\n literal: OPERATION_PROFILE,\n shapes: {\n request: OperationRequestSchema,\n accepted: AcceptedSchema,\n readback: ReadbackSchema,\n },\n};\n","// dsg.infra.resource-descriptor/1\n// Owner: dsg-infra (policy/resource-descriptor.schema.json is the source;\n// law_contract.py validates this exact shape and evaluate_descriptor\n// returns its canonical digest). A concrete provider-neutral resource: the\n// thing rendered from a workload and gated against the signed law's\n// capability limits before any provider API sees it. Distinct from\n// signed-law's capabilityProfile, which states allowed LIMITS; this\n// document states one concrete resource checked against them.\n//\n// The wire carries kind \"dsg.infra.resource-descriptor\" plus\n// schemaVersion 1; the /1 literal itself is the version marker signed-law\n// fields pin (scope.resourceDescriptorVersion, capabilities\n// .descriptorVersion), so the constant lives here and signed-law imports\n// it. Lifted verbatim from dsg-infra policy/resource-descriptor.schema.json\n// at fccf709.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const RESOURCE_DESCRIPTOR_PROFILE = \"dsg.infra.resource-descriptor/1\" as const;\n/** The document kind: the profile literal without its version suffix; the\n * version rides in schemaVersion. Frozen /1 wire choice. */\nexport const RESOURCE_DESCRIPTOR_KIND = \"dsg.infra.resource-descriptor\" as const;\n\nconst prefixedDigest = Type.String({ pattern: \"^sha256:[0-9a-f]{64}$\" });\n\nconst ResourceDescriptorSchemaValue = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(RESOURCE_DESCRIPTOR_KIND),\n workloadClass: NonEmptyString,\n lifecycle: Type.Union([Type.Literal(\"ephemeral\"), Type.Literal(\"durable\")]),\n machineType: Type.String({ pattern: \"^[a-z][a-z0-9]*-[a-z0-9]+-[0-9]+$\" }),\n accelerator: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),\n acceleratorCount: Type.Integer({ minimum: 0 }),\n vcpuCount: Type.Integer({ minimum: 1 }),\n memoryGiB: Type.Integer({ minimum: 1 }),\n maxRunSeconds: Type.Integer({ minimum: 1 }),\n maxParallelism: Type.Integer({ minimum: 1 }),\n region: NonEmptyString,\n imageDigest: prefixedDigest,\n moduleDigest: prefixedDigest,\n externalIp: Type.Literal(false),\n network: Type.Literal(\"private\"),\n reservation: closed({\n gpuSeconds: Type.Integer({ minimum: 0 }),\n usdMicroUnits: Type.Integer({ minimum: 0 }),\n }),\n});\nexport const ResourceDescriptorSchema: typeof ResourceDescriptorSchemaValue =\n ResourceDescriptorSchemaValue;\nexport type ResourceDescriptor = Static<typeof ResourceDescriptorSchema>;\n\nexport const resourceDescriptorV1: ProfileEntry = {\n literal: RESOURCE_DESCRIPTOR_PROFILE,\n literalNote:\n \"carried as kind (unversioned) plus schemaVersion on the document; the /1 literal is the version marker signed-law pins\",\n rootShape: \"descriptor\",\n shapes: { descriptor: ResourceDescriptorSchema },\n};\n","// dsg.infra.signed-law/1\n// Owner: dsg-infra (the S02 law producer; both prior copies were generated\n// from dsg-infra policy/law-bundle.schema.json, source SHA-256\n// bc3692395cf994567115c76d8fce66a7e9ebe7b2c50c70e1c83b8b10693a838c).\n//\n// The literal is the signing DOMAIN: it appears as the `domain` member of\n// the canonical signature input (JCS of {domain, payload, payloadSha256,\n// testOnly}), not as a field of the bundle itself; the bundle carries\n// `kind` plus `schemaVersion` instead. Lifted verbatim from dsg-kernel\n// packages/signing/src/law-schema.ts at ffafe305, byte-identical to the\n// module registry copy at 1f8c994.\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport type { ProfileEntry } from \"../primitives.js\";\nimport { RESOURCE_DESCRIPTOR_PROFILE } from \"./resource-descriptor.v1.js\";\n\nexport const SIGNED_LAW_PROFILE = \"dsg.infra.signed-law/1\" as const;\n/** The signature-input domain member is exactly the profile literal. */\nexport const SIGNED_LAW_DOMAIN = SIGNED_LAW_PROFILE;\n\n/** The scope vocabulary version today's laws cite in\n * standingOrder.scopeReference. The FIELD stays an open nonempty string on\n * purpose (a law may cite a future scope); this constant is the value in\n * force, exported so no consumer hand-types it. */\nexport const SCOPE_REFERENCE = \"dsg.infra.scope/1\" as const;\n\n/** The price-profile version today's laws cite in priceProfile.reference.\n * Same rule: the field stays open; this is the value in force. */\nexport const PRICE_PROFILE_REFERENCE = \"dsg.infra.price-profile/1\" as const;\n\nconst nullableString = Type.Union([Type.String({ minLength: 1 }), Type.Null()]);\nconst authority = Type.Object(\n {\n issuerType: Type.Literal(\"human\"),\n issuerReference: nullableString,\n designationReference: nullableString,\n signatureReference: nullableString,\n humanSignatureRequired: Type.Literal(true),\n releaseAutomationMayIssue: Type.Literal(false),\n },\n { additionalProperties: false },\n);\nconst utcSecond = Type.String({\n pattern: \"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$\",\n});\nconst standingOrder = Type.Object(\n {\n reference: nullableString,\n designationReference: nullableString,\n scopeReference: Type.String({ minLength: 1 }),\n issuedAt: Type.Union([utcSecond, Type.Null()]),\n expiresAt: Type.Union([utcSecond, Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst scope = Type.Object(\n {\n actions: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n workloadClasses: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n providers: Type.Array(Type.Literal(\"provider-neutral\"), { minItems: 1, uniqueItems: true }),\n regions: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n resourceDescriptorVersion: Type.Literal(RESOURCE_DESCRIPTOR_PROFILE),\n },\n { additionalProperties: false },\n);\nconst validity = Type.Object(\n {\n clock: Type.Literal(\"UTC\"),\n notBefore: Type.Union([utcSecond, Type.Null()]),\n notAfter: Type.Union([utcSecond, Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst revocation = Type.Object(\n {\n snapshotReference: nullableString,\n failClosed: Type.Literal(true),\n checks: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n },\n { additionalProperties: false },\n);\nconst ceiling = Type.Object(\n {\n unit: Type.String({ minLength: 1 }),\n period: Type.String({ minLength: 1 }),\n scope: Type.Union([Type.Literal(\"person\"), Type.Literal(\"organization\")]),\n value: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst capabilityProfile = Type.Object(\n {\n lifecycle: Type.Union([Type.Literal(\"ephemeral\"), Type.Literal(\"durable\")]),\n machinePrefixes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n accelerators: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n maxRunSeconds: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),\n maxParallelism: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),\n maxGpuInstances: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),\n maxVcpus: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),\n network: Type.Literal(\"private\"),\n externalIpAllowed: Type.Literal(false),\n },\n { additionalProperties: false },\n);\nconst capabilities = Type.Object(\n {\n providerNeutral: Type.Literal(true),\n descriptorVersion: Type.Literal(RESOURCE_DESCRIPTOR_PROFILE),\n profiles: Type.Record(Type.String(), capabilityProfile, { minProperties: 1 }),\n },\n { additionalProperties: false },\n);\nconst priceProfile = Type.Object(\n {\n reference: Type.String({ minLength: 1 }),\n status: Type.Union([Type.Literal(\"unassigned\"), Type.Literal(\"retained\")]),\n currency: Type.Literal(\"USD\"),\n unit: Type.Literal(\"micro_usd\"),\n basis: Type.Literal(\"retained-conservative-on-demand\"),\n rates: Type.Object(\n {\n vcpuSecond: Type.Optional(Type.Integer({ minimum: 0 })),\n memoryGiBSecond: Type.Optional(Type.Integer({ minimum: 0 })),\n gpuSecond: Type.Optional(Type.Integer({ minimum: 0 })),\n startup: Type.Optional(Type.Integer({ minimum: 0 })),\n },\n { additionalProperties: false },\n ),\n safetyFactorBps: Type.Union([Type.Integer({ minimum: 10000 }), Type.Null()]),\n validFrom: Type.Union([utcSecond, Type.Null()]),\n validUntil: Type.Union([utcSecond, Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst bootstrap = Type.Object(\n {\n mode: Type.Literal(\"finite-human-root\"),\n rootReferences: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n allowedActions: Type.Array(\n Type.Union([\n Type.Literal(\"enroll_human_root\"),\n Type.Literal(\"initialize_kernel_record\"),\n Type.Literal(\"restore_kernel_record\"),\n Type.Literal(\"cutover_single_writer\"),\n ]),\n { minItems: 1, uniqueItems: true },\n ),\n maxUses: Type.Integer({ minimum: 1, maximum: 1 }),\n expiresAt: Type.Union([utcSecond, Type.Null()]),\n projectCreationAllowed: Type.Literal(false),\n requiresHumanSignature: Type.Literal(true),\n automationCanSatisfy: Type.Literal(false),\n },\n { additionalProperties: false },\n);\nconst digest = Type.String({ pattern: \"^sha256:[0-9a-f]{64}$\" });\nconst policyBundle = Type.Object(\n {\n digest: digest,\n manifest: Type.Record(\n Type.String({ pattern: \"^policy/[A-Za-z0-9._-]+\\\\.rego$\" }),\n Type.String({ pattern: \"^[0-9a-f]{64}$\" }),\n { additionalProperties: false, minProperties: 1 },\n ),\n },\n { additionalProperties: false },\n);\nconst lawInputProfile = Type.Object(\n {\n requiresRunCeiling: Type.Boolean(),\n requiresExpirationLabel: Type.Boolean(),\n maxRunSeconds: Type.Integer({ minimum: 1 }),\n allowExternalIp: Type.Literal(false),\n machinePrefixes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n accelerators: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n maxGpuInstances: Type.Integer({ minimum: 0 }),\n maxTotalVcpus: Type.Integer({ minimum: 1 }),\n maxParallelism: Type.Integer({ minimum: 1 }),\n network: Type.Literal(\"private\"),\n },\n { additionalProperties: false },\n);\nconst lawInputs = Type.Object(\n {\n cloudflare: Type.Object(\n {\n approvedZoneId: Type.String({ minLength: 1 }),\n approvedAccountId: Type.String({ minLength: 1 }),\n },\n { additionalProperties: false },\n ),\n planLimits: Type.Object(\n {\n maxGpuInstances: Type.Integer({ minimum: 0 }),\n maxTotalVcpus: Type.Integer({ minimum: 1 }),\n approvedLocations: Type.Array(Type.String({ minLength: 1 }), {\n minItems: 1,\n uniqueItems: true,\n }),\n },\n { additionalProperties: false },\n ),\n profiles: Type.Object(\n { compute: lawInputProfile, plane: lawInputProfile },\n { additionalProperties: false },\n ),\n },\n { additionalProperties: false },\n);\nconst evaluationInputs = Type.Object(\n { policyBundle: policyBundle, lawInputs: lawInputs },\n { additionalProperties: false },\n);\nconst lawDocument = Type.Object(\n {\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"dsg.infra.law\"),\n lawId: Type.String({ minLength: 1 }),\n status: Type.Union([Type.Literal(\"unissued\"), Type.Literal(\"issued\")]),\n authority: authority,\n standingOrder: standingOrder,\n scope: scope,\n validity: validity,\n revocation: revocation,\n ceilings: Type.Object(\n {\n gpuSecondsPerPersonUtcWeek: ceiling,\n usdMicroUnitsPerPersonUtcMonth: ceiling,\n usdMicroUnitsPerOrganizationUtcMonth: ceiling,\n },\n { additionalProperties: false },\n ),\n capabilities: capabilities,\n priceProfile: priceProfile,\n bootstrap: bootstrap,\n evaluationInputs: evaluationInputs,\n },\n { additionalProperties: false },\n);\nconst signature = Type.Object(\n {\n algorithm: Type.Literal(\"Ed25519\"),\n keyClass: Type.Union([\n Type.Literal(\"synthetic-test-only\"),\n Type.Literal(\"human-authority\"),\n Type.Literal(\"release-automation\"),\n ]),\n publicKeyHex: Type.String({ pattern: \"^[0-9a-f]{64}$\" }),\n signatureHex: Type.String({ pattern: \"^[0-9a-f]{128}$\" }),\n },\n { additionalProperties: false },\n);\nconst signedLawBundle = Type.Object(\n {\n schemaVersion: Type.Literal(1),\n kind: Type.Union([\n Type.Literal(\"dsg.infra.signed-law\"),\n Type.Literal(\"dsg.infra.signed-law-fixture\"),\n ]),\n testOnly: Type.Boolean(),\n deployedAuthority: Type.Boolean(),\n payload: lawDocument,\n canonicalPayload: Type.String({ minLength: 1 }),\n payloadSha256: Type.String({ pattern: \"^[0-9a-f]{64}$\" }),\n canonicalSignatureInput: Type.String({ minLength: 1 }),\n signature: signature,\n },\n { additionalProperties: false },\n);\nexport const SignedLawBundleSchema = signedLawBundle;\nexport type SignedLawBundle = Static<typeof SignedLawBundleSchema>;\n\nexport const signedLawV1: ProfileEntry = {\n literal: SIGNED_LAW_PROFILE,\n literalNote:\n \"carried as the domain member of the canonical signature input, not as a bundle field\",\n shapes: { bundle: SignedLawBundleSchema },\n};\n","// dsg.infra.adoption-fact/1\n// Owner: dsg-infra (governance/adoption.py is the producer: it verifies an\n// exported kernel bootstrap record snapshot offline - canonical digest,\n// event hash chain, stream heads, artifact bytes - and emits the accepted\n// root-authorizing operation as this fact). The tofu baseline root\n// consumes it and re-validates independently: its deployment-specific\n// conditions (which root string, testOnly false for the real baseline)\n// are that root's own law, deliberately NOT part of this shape - a\n// synthetic testOnly fact is a valid FACT, just never a valid deployed\n// authorization.\n//\n// Lifted from dsg-infra governance/adoption.py at e9d9501 and\n// infrastructure/environments/dsg-run/adoption.tf (S01, commit fccf709).\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, type ProfileEntry } from \"../primitives.js\";\n\nexport const ADOPTION_FACT_PROFILE = \"dsg.infra.adoption-fact/1\" as const;\n\nconst AdoptionFactSchemaValue = closed({\n profile: Type.Literal(ADOPTION_FACT_PROFILE),\n /** The root the record names as active baseline owner. */\n root: NonEmptyString,\n lineage: NonEmptyString,\n /** The accepted root-authorizing operation. */\n operation: NonEmptyString,\n /** Count of accepted root operations; ownership needs at least one. */\n generation: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n /** Canonical digest of the verified record snapshot. */\n snapshotSha256: Hex64,\n /** initialize establishes the first owner; cutover transfers it. restore\n * and enrollment move custody and human roots, never root ownership. */\n action: Type.Union([\n Type.Literal(\"initialize_kernel_record\"),\n Type.Literal(\"cutover_single_writer\"),\n ]),\n signer: Orn,\n humanRoot: NonEmptyString,\n testOnly: Type.Boolean(),\n});\nexport const AdoptionFactSchema: typeof AdoptionFactSchemaValue = AdoptionFactSchemaValue;\nexport type AdoptionFact = Static<typeof AdoptionFactSchema>;\n\nexport const adoptionFactV1: ProfileEntry = {\n literal: ADOPTION_FACT_PROFILE,\n rootShape: \"fact\",\n shapes: { fact: AdoptionFactSchema },\n};\n","// dsg.registry.revocations/1\n// Owner: dsg-infra-module-registry (the S03 trust producer). Signed,\n// monotonically versioned revocation snapshots with retained trust\n// history; timestamps are epoch seconds by frozen choice of /1 (recorded\n// in FROZEN_EXEMPTIONS; exact-second strings would be a /2).\n// Lifted verbatim from dsg-infra-module-registry src/revocation.ts at\n// 1f8c994.\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport type { ProfileEntry } from \"../primitives.js\";\n\nexport const REVOCATIONS_PROFILE = \"dsg.registry.revocations/1\" as const;\n\nconst closed = { additionalProperties: false };\nconst text = Type.String({ minLength: 1 });\nconst digest = Type.String({ pattern: \"^[0-9a-f]{64}$\" });\nconst time = Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });\n\nconst RevocationSchemaValue = Type.Object(\n {\n domain: Type.Literal(REVOCATIONS_PROFILE),\n version: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n issuedAt: time,\n expiresAt: time,\n previousSha256: Type.Union([digest, Type.Null()]),\n testOnly: Type.Literal(true),\n signerKey: digest,\n revoked: Type.Array(\n Type.Object(\n {\n kind: Type.Union([\n Type.Literal(\"principal\"),\n Type.Literal(\"standing-order\"),\n Type.Literal(\"law\"),\n Type.Literal(\"class\"),\n Type.Literal(\"key\"),\n ]),\n id: text,\n effectiveAt: time,\n reason: text,\n },\n closed,\n ),\n ),\n trustHistory: Type.Array(\n Type.Object(\n {\n principal: text,\n publicKey: digest,\n role: Type.Union([\n Type.Literal(\"human\"),\n Type.Literal(\"release\"),\n Type.Literal(\"collector\"),\n ]),\n action: Type.Union([\n Type.Literal(\"enroll\"),\n Type.Literal(\"rotate\"),\n Type.Literal(\"compromise\"),\n ]),\n effectiveAt: time,\n authoritySha256: digest,\n replacesKey: Type.Union([digest, Type.Null()]),\n },\n closed,\n ),\n ),\n },\n closed,\n);\nexport const RevocationSchema: typeof RevocationSchemaValue = RevocationSchemaValue;\nexport type RevocationSnapshot = Static<typeof RevocationSchema>;\n\nconst RevocationPointerSchemaValue = Type.Object(\n {\n version: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n sha256: digest,\n url: Type.String({ pattern: \"^/revocations/v/[1-9][0-9]*/snapshot\\\\.json$\" }),\n },\n closed,\n);\nexport const RevocationPointerSchema: typeof RevocationPointerSchemaValue =\n RevocationPointerSchemaValue;\nexport type RevocationPointer = Static<typeof RevocationPointerSchema>;\n\nexport const revocationsV1: ProfileEntry = {\n literal: REVOCATIONS_PROFILE,\n shapes: { snapshot: RevocationSchema, pointer: RevocationPointerSchema },\n};\n","// dsg.kernel.bootstrap/1\n// Owner: dsg-kernel (K14). The finite bootstrap intent: a signed,\n// single-use, expiring authorization for exactly one of four record\n// actions, binding plan and resource-spec digests. enroll_human_root\n// (M030) is the additive action that anchors ordinary-authority\n// enrollment; initialization is never reinterpreted as enrollment. The\n// record-held bootstrap event payloads stay in the kernel.\n//\n// Lifted verbatim from dsg-kernel packages/core/src/contracts.ts at\n// 00b33ac1. createdAt/expiresAt are frozen /1 nonempty strings, recorded\n// in FROZEN_EXEMPTIONS; exact-second patterns would be a /2 against\n// already-recorded signed intents.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, type ProfileEntry } from \"../primitives.js\";\n\nexport const BOOTSTRAP_PROFILE = \"dsg.kernel.bootstrap/1\" as const;\n\nconst BootstrapActionSchemaValue = Type.Union([\n Type.Literal(\"initialize_kernel_record\"),\n Type.Literal(\"restore_kernel_record\"),\n Type.Literal(\"cutover_single_writer\"),\n Type.Literal(\"enroll_human_root\"),\n]);\nexport const BootstrapActionSchema: typeof BootstrapActionSchemaValue = BootstrapActionSchemaValue;\nexport type BootstrapAction = Static<typeof BootstrapActionSchema>;\n\nconst BootstrapIntentSchemaValue = closed({\n version: Type.Literal(BOOTSTRAP_PROFILE),\n operation: NonEmptyString,\n action: BootstrapActionSchema,\n lineage: NonEmptyString,\n humanRoot: NonEmptyString,\n signer: Orn,\n scope: NonEmptyString,\n resources: Type.Array(\n closed({\n identity: NonEmptyString,\n specSha256: Hex64,\n }),\n { minItems: 1, uniqueItems: true },\n ),\n planSha256: Hex64,\n preconditionsSha256: Hex64,\n createdAt: NonEmptyString,\n expiresAt: NonEmptyString,\n maxUses: Type.Literal(1),\n cost: closed({\n currency: Type.Literal(\"USD\"),\n maxMicroUsd: Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n assumptionsSha256: Hex64,\n }),\n testOnly: Type.Boolean(),\n});\nexport const BootstrapIntentSchema: typeof BootstrapIntentSchemaValue = BootstrapIntentSchemaValue;\nexport type BootstrapIntent = Static<typeof BootstrapIntentSchema>;\n\nconst SignedBootstrapIntentSchemaValue = closed({\n body: BootstrapIntentSchema,\n signature: Type.String({ pattern: \"^[0-9a-f]{128}$\" }),\n});\nexport const SignedBootstrapIntentSchema: typeof SignedBootstrapIntentSchemaValue =\n SignedBootstrapIntentSchemaValue;\nexport type SignedBootstrapIntent = Static<typeof SignedBootstrapIntentSchema>;\n\nexport const bootstrapV1: ProfileEntry = {\n literal: BOOTSTRAP_PROFILE,\n shapes: { intent: BootstrapIntentSchema, signed: SignedBootstrapIntentSchema },\n};\n","// dsg.kernel.standing-order-activation/1\n// Owner: dsg-kernel. The record event selects the one standing-order\n// activation that API and worker may resolve. The revocation reference is\n// the activation-time observation only; consumers must independently resolve\n// the current revocation head before every authority use.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Orn, Reference, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const STANDING_ORDER_ACTIVATION_PROFILE = \"dsg.kernel.standing-order-activation/1\" as const;\nexport const STANDING_ORDER_ACTIVATION_EVENT_KIND = \"standing_order_activated\" as const;\n\nconst StandingOrderModeSchemaValue = Type.Union([\n Type.Literal(\"synthetic-test-only\"),\n Type.Literal(\"human-authority\"),\n]);\nexport const StandingOrderModeSchema: typeof StandingOrderModeSchemaValue =\n StandingOrderModeSchemaValue;\nexport type StandingOrderMode = Static<typeof StandingOrderModeSchema>;\n\n/** The immutable descriptor retained with the activation event. */\nconst StandingOrderActivationSchemaValue = closed({\n profile: Type.Literal(STANDING_ORDER_ACTIVATION_PROFILE),\n /** Stable identity carried in the descriptor. The event's `activation`\n * reference points to this descriptor, avoiding a digest cycle. */\n activationId: Orn,\n /** Compare-and-set precondition. Null is valid only for the first head. */\n expectedPreviousActivation: Type.Union([Reference, Type.Null()]),\n law: Reference,\n enrollment: Reference,\n intent: Reference,\n roots: Reference,\n /** Activation-time observation. It never substitutes for a current read. */\n revocation: Reference,\n actor: Orn,\n mode: StandingOrderModeSchema,\n activatedAt: UtcSecond,\n});\nexport const StandingOrderActivationSchema: typeof StandingOrderActivationSchemaValue =\n StandingOrderActivationSchemaValue;\nexport type StandingOrderActivation = Static<typeof StandingOrderActivationSchema>;\n\n/** Append-only record event carrying the descriptor selected by the stream head. */\nconst StandingOrderActivationEventSchemaValue = closed({\n profile: Type.Literal(STANDING_ORDER_ACTIVATION_PROFILE),\n kind: Type.Literal(STANDING_ORDER_ACTIVATION_EVENT_KIND),\n stream: Orn,\n /** Reference to the canonical descriptor artifact. */\n activation: Reference,\n});\nexport const StandingOrderActivationEventSchema: typeof StandingOrderActivationEventSchemaValue =\n StandingOrderActivationEventSchemaValue;\nexport type StandingOrderActivationEvent = Static<typeof StandingOrderActivationEventSchema>;\n\n/** Detached signature over the canonical activation descriptor bytes. */\nconst SignedStandingOrderActivationSchemaValue = closed({\n body: StandingOrderActivationSchema,\n signer: Orn,\n signature: Type.String({ pattern: \"^[0-9a-f]{128}$\" }),\n});\nexport const SignedStandingOrderActivationSchema: typeof SignedStandingOrderActivationSchemaValue =\n SignedStandingOrderActivationSchemaValue;\nexport type SignedStandingOrderActivation = Static<typeof SignedStandingOrderActivationSchema>;\n\nexport const standingOrderActivationV1: ProfileEntry = {\n literal: STANDING_ORDER_ACTIVATION_PROFILE,\n rootShape: \"event\",\n shapes: {\n activation: StandingOrderActivationSchema,\n signed: SignedStandingOrderActivationSchema,\n event: StandingOrderActivationEventSchema,\n },\n};\n","// dsg.kernel.ordinary-authority/1\n// Owner: dsg-kernel (K02, M029/M030). The canonical ordinary-rights\n// artifact: who may issue law, exactly what they may permit, for how long,\n// and under which three ceilings. Closed and versioned; every set is an\n// explicit allow-list, never an omitted-means-unlimited default. A\n// verified finite enroll_human_root intent binds this document's digest as\n// both plan and resource spec. The revocation view a standing-order check\n// runs against stays in the kernel: independently supplied input, not a\n// wire document.\n//\n// Lifted verbatim from dsg-kernel packages/signing/src/enrollment.ts at\n// 00b33ac1.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const ORDINARY_AUTHORITY_PROFILE = \"dsg.kernel.ordinary-authority/1\" as const;\n\nconst names = Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true });\nconst ceilingValue = Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });\n\nconst OrdinaryAuthoritySchemaValue = closed({\n version: Type.Literal(ORDINARY_AUTHORITY_PROFILE),\n reference: NonEmptyString,\n actor: Orn,\n publicKeyHex: Hex64,\n keyClass: Type.Union([Type.Literal(\"synthetic-test-only\"), Type.Literal(\"human-authority\")]),\n designation: closed({\n role: Type.Literal(\"law-issuer\"),\n designationReference: NonEmptyString,\n }),\n scope: closed({\n scopeReference: NonEmptyString,\n actions: names,\n workloadClasses: names,\n regions: names,\n }),\n validity: closed({ notBefore: UtcSecond, notAfter: UtcSecond }),\n ceilings: closed({\n gpuSecondsPerPersonUtcWeek: ceilingValue,\n usdMicroUnitsPerPersonUtcMonth: ceilingValue,\n usdMicroUnitsPerOrganizationUtcMonth: ceilingValue,\n }),\n revoked: Type.Boolean(),\n});\nexport const OrdinaryAuthoritySchema: typeof OrdinaryAuthoritySchemaValue =\n OrdinaryAuthoritySchemaValue;\nexport type OrdinaryAuthority = Static<typeof OrdinaryAuthoritySchema>;\n\nexport const ordinaryAuthorityV1: ProfileEntry = {\n literal: ORDINARY_AUTHORITY_PROFILE,\n rootShape: \"authority\",\n shapes: { authority: OrdinaryAuthoritySchema },\n};\n","// In-process contract versions of the dsg-run plane. Under ruling I7 these\n// are NOT profiles: an executor or provider adapter is a TypeScript plugin\n// interface inside one process, with no serialized shape or digest of its\n// own - its documents (operation requests, descriptors) already have\n// profiles. The literals live here so no consumer repo defines a\n// dsg.*.*/N string and the CI grep stays absolute. When R06 gives\n// executors a real serialized job document, THAT becomes a profile module\n// beside this file.\nexport const EXECUTOR_PROTOCOL_VERSION = \"dsg.run.executor/1\" as const;\nexport type ExecutorProtocolVersion = typeof EXECUTOR_PROTOCOL_VERSION;\n\nexport const PROVIDER_PROTOCOL_VERSION = \"dsg.run.provider/1\" as const;\nexport type ProviderProtocolVersion = typeof PROVIDER_PROTOCOL_VERSION;\n","// dsg.run.event/1\n// Owner: dsg-run (the plane ingests, stores, streams, and seals) with the\n// emitting library as the other side of the seam.\n//\n// One event a running workload emitted about itself. The workload writes\n// these as single JSON lines on standard output, prefixed `DSGEV `, and\n// knows nothing about how they travel: the executor that ran the job is\n// the only thing that knows where its output went.\n//\n// Two things are closed and two are open by design. The ENVELOPE is\n// closed: an unknown envelope field is a different protocol. The PAYLOAD\n// is open here and closed by the catalog the emitter declared and the\n// request pinned by digest - the plane validates the payload against that\n// catalog, so this profile does not need to know a modeler's vocabulary\n// to refuse an invalid instance of it.\n//\n// Ordering is the sequence number, never arrival and never the clock: a\n// transport may duplicate or reorder, and the stored stream is the same\n// either way. A gap is recorded as a fact, not smoothed over.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n SafeInt,\n UtcSecond,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const EVENT_PROFILE = \"dsg.run.event/1\" as const;\n\n/** The wire prefix that lets a collector pick these lines out of ordinary\n * job logs. One space, then the JSON object, then a newline. */\nexport const EVENT_LINE_PREFIX = \"DSGEV \" as const;\n\n/** The lifecycle spine every catalog carries without declaring it: the\n * kinds the console draws for any workload, whatever it models. A\n * workload emitting only started and finished is fully described. */\nexport const LIFECYCLE_KINDS = [\n \"started\",\n \"phase.entered\",\n \"phase.exited\",\n \"progress\",\n \"checkpoint\",\n \"artifact\",\n \"warning\",\n \"failure\",\n \"finished\",\n] as const;\n\nconst EventSchemaValue = closed({\n profile: Type.Literal(EVENT_PROFILE),\n /** The operation this event belongs to; injected into the job's\n * environment by the plane, never chosen by the workload. */\n operation: NonEmptyString,\n /** Monotonic within one operation, from 1. Ordering lives here. */\n sequence: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n at: UtcSecond,\n /** A lifecycle kind or one the pinned catalog declares. */\n kind: NonEmptyString,\n /** Digest of the catalog the payload validates against. */\n catalogSha256: Hex64,\n /** Validated against the catalog by digest, not by this schema: a\n * modeler's vocabulary is theirs, and the plane refuses a payload the\n * catalog does not admit. Artifacts are references, never contents. */\n payload: Type.Record(Type.String(), Type.Unknown()),\n});\nexport const EventSchema: typeof EventSchemaValue = EventSchemaValue;\nexport type Event = Static<typeof EventSchema>;\n\n/** What the plane seals into the outcome: the ordered stream's own digest,\n * the catalog it validated against, and the count - enough for an\n * offline reader holding the exported stream to recompute the verdict\n * without the plane. `truncatedAtSequence` is the event ceiling's mark:\n * a runaway logger is bounded, and the bound is visible rather than a\n * silently short stream. */\nconst EventStreamSealSchemaValue = closed({\n profile: Type.Literal(EVENT_PROFILE),\n operation: NonEmptyString,\n catalogSha256: Hex64,\n /** sha256 over the newline-joined canonical event lines, in sequence. */\n streamSha256: Hex64,\n eventCount: SafeInt,\n /** Sequence numbers missing from an otherwise ordered stream. */\n gaps: Type.Array(Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n truncatedAtSequence: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),\n});\nexport const EventStreamSealSchema: typeof EventStreamSealSchemaValue = EventStreamSealSchemaValue;\nexport type EventStreamSeal = Static<typeof EventStreamSealSchema>;\n\nexport const eventV1: ProfileEntry = {\n literal: EVENT_PROFILE,\n rootShape: \"event\",\n shapes: { event: EventSchema, streamSeal: EventStreamSealSchema },\n};\n","// dsg.run.request/1\n// Owner: dsg-run (POST /requests). The CLI builds this document from an\n// experiment; the plane fills the requester from the door's assertion and\n// never from a field on this shape.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n Reference,\n SafeInt,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const REQUEST_PROFILE = \"dsg.run.request/1\" as const;\n\nconst ExperimentRefSchemaValue = closed({\n digest: Hex64,\n title: NonEmptyString,\n workloadClass: NonEmptyString,\n});\nexport const ExperimentRefSchema: typeof ExperimentRefSchemaValue = ExperimentRefSchemaValue;\nexport type ExperimentRef = Static<typeof ExperimentRefSchema>;\n\nconst RequestCeilingsSchemaValue = closed({\n maxRunSeconds: SafeInt,\n maxGpuSeconds: SafeInt,\n maxParallelism: SafeInt,\n costBoundMicroUsd: SafeInt,\n});\nexport const RequestCeilingsSchema: typeof RequestCeilingsSchemaValue = RequestCeilingsSchemaValue;\nexport type RequestCeilings = Static<typeof RequestCeilingsSchema>;\n\nconst RunRequestSchemaValue = closed({\n profile: Type.Literal(REQUEST_PROFILE),\n experiment: ExperimentRefSchema,\n workload: Reference,\n inputs: Type.Array(Reference, { minItems: 1 }),\n ceilings: RequestCeilingsSchema,\n purpose: NonEmptyString,\n window: NonEmptyString,\n});\nexport const RunRequestSchema: typeof RunRequestSchemaValue = RunRequestSchemaValue;\nexport type RunRequest = Static<typeof RunRequestSchema>;\n\nexport const requestV1: ProfileEntry = {\n literal: REQUEST_PROFILE,\n rootShape: \"request\",\n shapes: { request: RunRequestSchema },\n};\n","// dsg.run.decision/1\n// Owner: dsg-kernel (the decisions route verifies the signature against\n// the decider's recorded public key). A decision is a signature, not a\n// session. The requester may not decide their own run.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const DECISION_PROFILE = \"dsg.run.decision/1\" as const;\n\nconst RunDecisionSchemaValue = closed({\n profile: Type.Literal(DECISION_PROFILE),\n runId: NonEmptyString,\n requestDigest: Hex64,\n decision: Type.Union([Type.Literal(\"approved\"), Type.Literal(\"refused\")]),\n cause: Type.Union([NonEmptyString, Type.Null()]),\n decidedAt: UtcSecond,\n decider: Orn,\n signature: NonEmptyString,\n});\nexport const RunDecisionSchema: typeof RunDecisionSchemaValue = RunDecisionSchemaValue;\nexport type RunDecision = Static<typeof RunDecisionSchema>;\n\nexport const decisionV1: ProfileEntry = {\n literal: DECISION_PROFILE,\n rootShape: \"decision\",\n shapes: { decision: RunDecisionSchema },\n};\n","// dsg.run.run-summary/1\n// Owner: dsg-run (the plane writes it; the console and kernel status read\n// it). A gate with no decision is waiting, never approved or refused.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n PersonReference,\n UtcSecond,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const RUN_SUMMARY_PROFILE = \"dsg.run.run-summary/1\" as const;\n\nconst RunSummaryDecisionSchemaValue = closed({\n outcome: Type.Union([Type.Literal(\"approved\"), Type.Literal(\"refused\")]),\n decider: PersonReference,\n decidedAt: UtcSecond,\n cause: Type.Union([NonEmptyString, Type.Null()]),\n byStandingOrder: Type.Boolean(),\n});\nexport const RunSummaryDecisionSchema: typeof RunSummaryDecisionSchemaValue =\n RunSummaryDecisionSchemaValue;\nexport type RunSummaryDecision = Static<typeof RunSummaryDecisionSchema>;\n\nconst RunSummarySchemaValue = closed({\n profile: Type.Literal(RUN_SUMMARY_PROFILE),\n runId: NonEmptyString,\n experimentDigest: Hex64,\n requester: Type.Union([PersonReference, Type.Null()]),\n decision: Type.Union([RunSummaryDecisionSchema, Type.Null()]),\n waitingOn: Type.Union([NonEmptyString, Type.Null()]),\n});\nexport const RunSummarySchema: typeof RunSummarySchemaValue = RunSummarySchemaValue;\nexport type RunSummary = Static<typeof RunSummarySchema>;\n\nexport const runSummaryV1: ProfileEntry = {\n literal: RUN_SUMMARY_PROFILE,\n rootShape: \"summary\",\n shapes: { summary: RunSummarySchema },\n};\n","// dsg.core.refusal/1\n// Owner: shared. Kernel, plane, and console read this one envelope.\n// Identity ladder codes are identity-verifier-spec.md section 3.5.\n// Login and request codes are person-loop-spec.md sections 4.1 and 4.2.\n// The sentence is what a person hears; identifiers do not belong here.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const REFUSAL_PROFILE = \"dsg.core.refusal/1\" as const;\n\nconst RefusalCodeSchemaValue = Type.Union([\n Type.Literal(\"assertion_invalid\"),\n Type.Literal(\"audience_mismatch\"),\n Type.Literal(\"expired\"),\n Type.Literal(\"issuer_unknown\"),\n Type.Literal(\"transport_unverified\"),\n Type.Literal(\"relay_untrusted\"),\n Type.Literal(\"identity_unbound\"),\n Type.Literal(\"binding_expired\"),\n Type.Literal(\"principal_suspended\"),\n Type.Literal(\"not_dsg_account\"),\n Type.Literal(\"session_expired\"),\n Type.Literal(\"unknown_workload_class\"),\n Type.Literal(\"image_not_pinned\"),\n Type.Literal(\"not_a_requester\"),\n Type.Literal(\"document_invalid\"),\n Type.Literal(\"self_decision\"),\n Type.Literal(\"no_ceiling\"),\n]);\nexport const RefusalCodeSchema: typeof RefusalCodeSchemaValue = RefusalCodeSchemaValue;\nexport type RefusalCode = Static<typeof RefusalCodeSchema>;\n\nconst RefusalSchemaValue = closed({\n profile: Type.Literal(REFUSAL_PROFILE),\n code: RefusalCodeSchema,\n sentence: NonEmptyString,\n});\nexport const RefusalSchema: typeof RefusalSchemaValue = RefusalSchemaValue;\nexport type Refusal = Static<typeof RefusalSchema>;\n\nexport const refusalV1: ProfileEntry = {\n literal: REFUSAL_PROFILE,\n rootShape: \"refusal\",\n shapes: { refusal: RefusalSchema },\n};\n","// dsg.core.refusal/2\n// Owner: shared. Adds the two codes the shared authentication contract\n// requires: a validator that cannot answer fails closed and says so, and a\n// human confirmation outside its window is its own refusal, not a generic\n// expiry. /1 is frozen; this ships beside it.\n//\n// `stage` and `correlationId` are optional additions (2026-09-11): the\n// system has not shipped, so this profile amends in place rather than\n// spawning a /3 for two backward-compatible optional fields. An existing\n// non-proxy refusal carries neither. A proxy hop (dsg-run-console) always\n// sends both: `stage: \"proxy\"` names which hop answered, `correlationId`\n// is the proxy's own request id, replacing the `X-DSG-Refusal-Stage` /\n// `X-Request-ID` header detour with in-body fields the same schema covers.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const REFUSAL_V2_PROFILE = \"dsg.core.refusal/2\" as const;\n\nconst RefusalCodeV2SchemaValue = Type.Union([\n Type.Literal(\"assertion_invalid\"),\n Type.Literal(\"audience_mismatch\"),\n Type.Literal(\"expired\"),\n Type.Literal(\"issuer_unknown\"),\n Type.Literal(\"transport_unverified\"),\n Type.Literal(\"relay_untrusted\"),\n Type.Literal(\"identity_unbound\"),\n Type.Literal(\"binding_expired\"),\n Type.Literal(\"principal_suspended\"),\n Type.Literal(\"not_dsg_account\"),\n Type.Literal(\"session_expired\"),\n Type.Literal(\"unknown_workload_class\"),\n Type.Literal(\"image_not_pinned\"),\n Type.Literal(\"not_a_requester\"),\n Type.Literal(\"document_invalid\"),\n Type.Literal(\"self_decision\"),\n Type.Literal(\"no_ceiling\"),\n Type.Literal(\"validation_unavailable\"),\n Type.Literal(\"confirmation_expired\"),\n]);\nexport const RefusalCodeV2Schema: typeof RefusalCodeV2SchemaValue = RefusalCodeV2SchemaValue;\nexport type RefusalCodeV2 = Static<typeof RefusalCodeV2Schema>;\n\nconst RefusalStageV2SchemaValue = Type.Union([\n Type.Literal(\"proxy\"),\n Type.Literal(\"provider\"),\n Type.Literal(\"identity_read\"),\n Type.Literal(\"plane\"),\n]);\nexport const RefusalStageV2Schema: typeof RefusalStageV2SchemaValue = RefusalStageV2SchemaValue;\nexport type RefusalStageV2 = Static<typeof RefusalStageV2Schema>;\n\nconst RefusalV2SchemaValue = closed({\n profile: Type.Literal(REFUSAL_V2_PROFILE),\n code: RefusalCodeV2Schema,\n sentence: NonEmptyString,\n stage: Type.Optional(RefusalStageV2Schema),\n correlationId: Type.Optional(NonEmptyString),\n});\nexport const RefusalV2Schema: typeof RefusalV2SchemaValue = RefusalV2SchemaValue;\nexport type RefusalV2 = Static<typeof RefusalV2Schema>;\n\nexport const refusalV2: ProfileEntry = {\n literal: REFUSAL_V2_PROFILE,\n rootShape: \"refusal\",\n shapes: { refusal: RefusalV2Schema },\n};\n","// dsg.core.identity-binding/1\n// Owner: dsg-kernel. A binding is a signed act through the door.\n// The CLI signs; the plane forwards; the kernel verifies and appends.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, Orn, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const IDENTITY_BINDING_PROFILE = \"dsg.core.identity-binding/1\" as const;\nexport const GOOGLE_SIGN_IN_ISSUER = \"https://accounts.google.com\" as const;\n\nconst IdentityBindingSchemaValue = closed({\n profile: Type.Literal(IDENTITY_BINDING_PROFILE),\n principal: Orn,\n issuer: Type.Literal(GOOGLE_SIGN_IN_ISSUER),\n subject: NonEmptyString,\n decider: Orn,\n boundAt: UtcSecond,\n signature: NonEmptyString,\n});\nexport const IdentityBindingSchema: typeof IdentityBindingSchemaValue = IdentityBindingSchemaValue;\nexport type IdentityBinding = Static<typeof IdentityBindingSchema>;\n\nexport const identityBindingV1: ProfileEntry = {\n literal: IDENTITY_BINDING_PROFILE,\n rootShape: \"binding\",\n shapes: { binding: IdentityBindingSchema },\n};\n","export {\n closed,\n Hex64,\n NonEmptyString,\n Orn,\n PersonReference,\n Reference,\n SafeInt,\n UtcSecond,\n} from \"./primitives.js\";\nexport type { ProfileEntry } from \"./primitives.js\";\nexport {\n DISPATCH_CONSUME_PROFILE,\n DISPATCH_MAX_SKEW_SECONDS,\n DispatchConsumeRequestSchema,\n DispatchLeaseSchema,\n DispatchRefusalCodeSchema,\n DispatchRefusalSchema,\n} from \"./kernel/dispatch-consume.v1.js\";\nexport type {\n DispatchConsumeRequest,\n DispatchLease,\n DispatchRefusal,\n DispatchRefusalCode,\n} from \"./kernel/dispatch-consume.v1.js\";\nexport {\n AcceptedSchema,\n ExecutionDocumentSchema,\n ExecutionLawSchema,\n ExecutionResourcesSchema,\n OPERATION_PROFILE,\n OperationBeforeSchema,\n OperationCleanupSchema,\n OperationCostSchema,\n OperationEvidenceSchema,\n OperationExecutionSchema,\n OperationRequestSchema,\n OperationStatusSchema,\n ReadbackSchema,\n} from \"./run/operation.v1.js\";\nexport type {\n Accepted,\n ExecutionDocument,\n ExecutionLaw,\n ExecutionResources,\n OperationBefore,\n OperationCleanup,\n OperationCost,\n OperationEvidence,\n OperationExecution,\n OperationRequest,\n OperationStatus,\n Readback,\n} from \"./run/operation.v1.js\";\nexport {\n PRICE_PROFILE_REFERENCE,\n SCOPE_REFERENCE,\n SIGNED_LAW_DOMAIN,\n SIGNED_LAW_PROFILE,\n SignedLawBundleSchema,\n} from \"./infra/signed-law.v1.js\";\nexport {\n RESOURCE_DESCRIPTOR_KIND,\n RESOURCE_DESCRIPTOR_PROFILE,\n ResourceDescriptorSchema,\n} from \"./infra/resource-descriptor.v1.js\";\nexport type { ResourceDescriptor } from \"./infra/resource-descriptor.v1.js\";\nexport { ADOPTION_FACT_PROFILE, AdoptionFactSchema } from \"./infra/adoption-fact.v1.js\";\nexport type { AdoptionFact } from \"./infra/adoption-fact.v1.js\";\nexport type { SignedLawBundle } from \"./infra/signed-law.v1.js\";\nexport {\n REVOCATIONS_PROFILE,\n RevocationPointerSchema,\n RevocationSchema,\n} from \"./registry/revocations.v1.js\";\nexport type { RevocationPointer, RevocationSnapshot } from \"./registry/revocations.v1.js\";\nexport {\n BOOTSTRAP_PROFILE,\n BootstrapActionSchema,\n BootstrapIntentSchema,\n SignedBootstrapIntentSchema,\n} from \"./kernel/bootstrap.v1.js\";\nexport type {\n BootstrapAction,\n BootstrapIntent,\n SignedBootstrapIntent,\n} from \"./kernel/bootstrap.v1.js\";\nexport {\n STANDING_ORDER_ACTIVATION_EVENT_KIND,\n STANDING_ORDER_ACTIVATION_PROFILE,\n StandingOrderActivationEventSchema,\n StandingOrderActivationSchema,\n StandingOrderModeSchema,\n SignedStandingOrderActivationSchema,\n} from \"./kernel/standing-order-activation.v1.js\";\nexport type {\n StandingOrderActivation,\n StandingOrderActivationEvent,\n StandingOrderMode,\n SignedStandingOrderActivation,\n} from \"./kernel/standing-order-activation.v1.js\";\nexport {\n ORDINARY_AUTHORITY_PROFILE,\n OrdinaryAuthoritySchema,\n} from \"./kernel/ordinary-authority.v1.js\";\nexport type { OrdinaryAuthority } from \"./kernel/ordinary-authority.v1.js\";\nexport { EXECUTOR_PROTOCOL_VERSION, PROVIDER_PROTOCOL_VERSION } from \"./run/contract-versions.js\";\nexport type { ExecutorProtocolVersion, ProviderProtocolVersion } from \"./run/contract-versions.js\";\nexport {\n EVENT_PROFILE,\n EVENT_LINE_PREFIX,\n LIFECYCLE_KINDS,\n EventSchema,\n EventStreamSealSchema,\n} from \"./run/event.v1.js\";\nexport type { Event, EventStreamSeal } from \"./run/event.v1.js\";\nexport {\n REQUEST_PROFILE,\n ExperimentRefSchema,\n RequestCeilingsSchema,\n RunRequestSchema,\n} from \"./run/request.v1.js\";\nexport type { ExperimentRef, RequestCeilings, RunRequest } from \"./run/request.v1.js\";\nexport { DECISION_PROFILE, RunDecisionSchema } from \"./run/decision.v1.js\";\nexport type { RunDecision } from \"./run/decision.v1.js\";\nexport {\n RUN_SUMMARY_PROFILE,\n RunSummaryDecisionSchema,\n RunSummarySchema,\n} from \"./run/run-summary.v1.js\";\nexport type { RunSummary, RunSummaryDecision } from \"./run/run-summary.v1.js\";\nexport { REFUSAL_PROFILE, RefusalCodeSchema, RefusalSchema } from \"./core/refusal.v1.js\";\nexport type { Refusal, RefusalCode } from \"./core/refusal.v1.js\";\nexport {\n REFUSAL_V2_PROFILE,\n RefusalCodeV2Schema,\n RefusalStageV2Schema,\n RefusalV2Schema,\n} from \"./core/refusal.v2.js\";\nexport type { RefusalCodeV2, RefusalStageV2, RefusalV2 } from \"./core/refusal.v2.js\";\nexport {\n GOOGLE_SIGN_IN_ISSUER,\n IDENTITY_BINDING_PROFILE,\n IdentityBindingSchema,\n} from \"./core/identity-binding.v1.js\";\nexport type { IdentityBinding } from \"./core/identity-binding.v1.js\";\n\nimport type { ProfileEntry } from \"./primitives.js\";\nimport { dispatchConsumeV1 } from \"./kernel/dispatch-consume.v1.js\";\nimport { operationV1 } from \"./run/operation.v1.js\";\nimport { eventV1 } from \"./run/event.v1.js\";\nimport { requestV1 } from \"./run/request.v1.js\";\nimport { decisionV1 } from \"./run/decision.v1.js\";\nimport { runSummaryV1 } from \"./run/run-summary.v1.js\";\nimport { refusalV1 } from \"./core/refusal.v1.js\";\nimport { refusalV2 } from \"./core/refusal.v2.js\";\nimport { identityBindingV1 } from \"./core/identity-binding.v1.js\";\nimport { signedLawV1 } from \"./infra/signed-law.v1.js\";\nimport { resourceDescriptorV1 } from \"./infra/resource-descriptor.v1.js\";\nimport { adoptionFactV1 } from \"./infra/adoption-fact.v1.js\";\nimport { revocationsV1 } from \"./registry/revocations.v1.js\";\nimport { bootstrapV1 } from \"./kernel/bootstrap.v1.js\";\nimport { ordinaryAuthorityV1 } from \"./kernel/ordinary-authority.v1.js\";\nimport { standingOrderActivationV1 } from \"./kernel/standing-order-activation.v1.js\";\n\n/** Every profile this version of the package defines, keyed by literal.\n * Profile modules are added here as they are extracted; the rules test\n * and the schema emitter walk this registry, so a module that is not\n * registered does not exist. */\nexport const PROFILES: Readonly<Record<string, ProfileEntry>> = {\n [dispatchConsumeV1.literal]: dispatchConsumeV1,\n [operationV1.literal]: operationV1,\n [eventV1.literal]: eventV1,\n [requestV1.literal]: requestV1,\n [decisionV1.literal]: decisionV1,\n [runSummaryV1.literal]: runSummaryV1,\n [refusalV1.literal]: refusalV1,\n [refusalV2.literal]: refusalV2,\n [identityBindingV1.literal]: identityBindingV1,\n [signedLawV1.literal]: signedLawV1,\n [resourceDescriptorV1.literal]: resourceDescriptorV1,\n [adoptionFactV1.literal]: adoptionFactV1,\n [revocationsV1.literal]: revocationsV1,\n [bootstrapV1.literal]: bootstrapV1,\n [ordinaryAuthorityV1.literal]: ordinaryAuthorityV1,\n [standingOrderActivationV1.literal]: standingOrderActivationV1,\n};\n"],"mappings":";;;;AAOA,MAAa,UAAiC,eAC5C,KAAK,OAAO,YAAY,EAAE,sBAAsB,MAAM,CAAC;;AAGzD,MAAa,QAAQ,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;;AAG9D,MAAa,YAAY,KAAK,OAAO,EACnC,SAAS,2DACX,CAAC;AAED,MAAa,iBAAiB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAE1D,MAAa,UAAU,KAAK,QAAQ;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC;;;;;;AAOpF,MAAa,MAAM,KAAK,OAAO,EAAE,SAAS,YAAY,CAAC;;AAGvD,MAAa,YAAY,OAAO;CAC9B,KAAK;CACL,QAAQ,KAAK,OAAO,EAAE,SAAS,eAAe,CAAC;AACjD,CAAC;;;AAID,MAAa,kBAAkB,OAAO;CACpC,WAAW;CACX,aAAa;CACb,QAAQ;AACV,CAAC;;;ACbD,MAAa,2BAA2B;;AAGxC,MAAa,4BAA4B;AA0BzC,MAAa,+BAxB6B,OAAO;CAC/C,SAAS,KAAK,QAAQ,wBAAwB;;CAE9C,aAAa;;CAEb,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;;;CAGvC,SAAS;;CAET,gBAAgB;;CAEhB,WAAW;;;CAGX,aAAa;CACb,aAAa;;;;;;CAMb,SAAS,KAAK,QAAQ;AACxB,CAEE;AAwBF,MAAa,sBArBoB,OAAO;CACtC,SAAS,KAAK,QAAQ,wBAAwB;;CAE9C,SAAS;CACT,aAAa;CACb,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACvC,SAAS;CACT,gBAAgB;CAChB,WAAW;CACX,aAAa;CACb,YAAY;;;CAGZ,WAAW;;CAEX,gBAAgB,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAA;CAAmC,CAAC;CAC/E,SAAS,KAAK,QAAQ,4BAA4B;;;CAGlD,OAAO,KAAK,QAAQ;AACtB,CACoE;AAYpE,MAAa,4BAT0B,KAAK,MAAM;CAChD,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,uCAAuC;CACpD,KAAK,QAAQ,aAAa;AAC5B,CAEE;AAQF,MAAa,wBALsB,OAAO;CACxC,SAAS,KAAK,QAAQ,wBAAwB;CAC9C,MAAM;CACN,QAAQ,KAAK,MAAM,gBAAgB,EAAE,UAAU,EAAE,CAAC;AACpD,CACwE;AAGxE,MAAa,oBAAkC;CAC7C,SAAS;CACT,QAAQ;EACN,SAAS;EACT,OAAO;EACP,SAAS;CACX;AACF;;;ACpFA,MAAa,oBAAoB;AAOjC,MAAa,2BALyB,OAAO;CAC3C,eAAe;CACf,eAAe;CACf,gBAAgB;AAClB,CAEE;AAOF,MAAa,qBAJmB,OAAO;CACrC,QAAQ;CACR,iBAAiB;AACnB,CACkE;AAelE,MAAa,0BAZwB,OAAO;CAC1C,eAAe,KAAK,QAAQ,CAAC;CAC7B,eAAe;CACf,KAAK;CACL,UAAU;CACV,QAAQ,KAAK,MAAM,SAAS;CAC5B,WAAW;CACX,WAAW;CACX,WAAW;CACX,SAAS;CACT,SAAS,KAAK,MAAM,SAAS;AAC/B,CAEE;AAOF,MAAa,wBAJsB,OAAO;CACxC,aAAa,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;CACrD,YAAY,KAAK,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;AAC7C,CACwE;AAexE,MAAa,yBAZuB,OAAO;CACzC,SAAS,KAAK,QAAQ,iBAAiB;CACvC,aAAa;CACb,MAAM;CACN,WAAW;CACX,oBAAoB;CACpB,QAAQ;CACR,YAAY;CACZ,UAAU;CACV,WAAW;CACX,aAAa;AACf,CAEE;AAWF,MAAa,iBARe,OAAO;CACjC,SAAS,KAAK,QAAQ,iBAAiB;CACvC,aAAa;CACb,UAAU;CACV,YAAY;CACZ,YAAY;CACZ,YAAY;AACd,CAC0D;AAW1D,MAAa,2BARyB,KAAK,MAAM;CAC/C,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,WAAW;CACxB,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,SAAS;AACxB,CAEE;AASF,MAAa,yBANuB,KAAK,MAAM;CAC7C,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,SAAS;AACxB,CAEE;AAIF,MAAa,0BADwB,KAAK,MAAM,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,QAAQ,OAAO,CAAC,CAE7F;AAQF,MAAa,sBALoB,KAAK,MAAM;CAC1C,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,aAAa;CAC1B,KAAK,QAAQ,YAAY;AAC3B,CACoE;AAapE,MAAa,iBAVe,OAAO;CACjC,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,WAAW;CACX,SAAS;CACT,UAAU;CACV,aAAa,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAChD,MAAM;AACR,CAC0D;AAK1D,MAAa,wBAAwB;AAGrC,MAAa,cAA4B;CACvC,SAAS;CACT,QAAQ;EACN,SAAS;EACT,UAAU;EACV,UAAU;CACZ;AACF;;;AC3IA,MAAa,8BAA8B;;;AAG3C,MAAa,2BAA2B;AAExC,MAAM,iBAAiB,KAAK,OAAO,EAAE,SAAS,wBAAwB,CAAC;AAwBvE,MAAa,2BAtByB,OAAO;CAC3C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,wBAAwB;CAC3C,eAAe;CACf,WAAW,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CAC1E,aAAa,KAAK,OAAO,EAAE,SAAS,oCAAoC,CAAC;CACzE,aAAa,KAAK,MAAM,CAAC,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACpE,kBAAkB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC7C,WAAW,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtC,WAAW,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtC,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC1C,gBAAgB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC3C,QAAQ;CACR,aAAa;CACb,cAAc;CACd,YAAY,KAAK,QAAQ,KAAK;CAC9B,SAAS,KAAK,QAAQ,SAAS;CAC/B,aAAa,OAAO;EAClB,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EACvC,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC5C,CAAC;AACH,CAEE;AAGF,MAAa,uBAAqC;CAChD,SAAS;CACT,aACE;CACF,WAAW;CACX,QAAQ,EAAE,YAAY,yBAAyB;AACjD;;;AC1CA,MAAa,qBAAqB;;AAElC,MAAa,oBAAoB;;;;;AAMjC,MAAa,kBAAkB;;;AAI/B,MAAa,0BAA0B;AAEvC,MAAM,iBAAiB,KAAK,MAAM,CAAC,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AAC9E,MAAM,YAAY,KAAK,OACrB;CACE,YAAY,KAAK,QAAQ,OAAO;CAChC,iBAAiB;CACjB,sBAAsB;CACtB,oBAAoB;CACpB,wBAAwB,KAAK,QAAQ,IAAI;CACzC,2BAA2B,KAAK,QAAQ,KAAK;AAC/C,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OAAO,EAC5B,SAAS,2DACX,CAAC;AACD,MAAM,gBAAgB,KAAK,OACzB;CACE,WAAW;CACX,sBAAsB;CACtB,gBAAgB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC5C,UAAU,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC7C,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AAChD,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,QAAQ,KAAK,OACjB;CACE,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CACrF,iBAAiB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC7F,WAAW,KAAK,MAAM,KAAK,QAAQ,kBAAkB,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC1F,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CACxE,2BAA2B,KAAK,QAAQ,2BAA2B;AACrE,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,WAAW,KAAK,OACpB;CACE,OAAO,KAAK,QAAQ,KAAK;CACzB,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC9C,UAAU,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AAC/C,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,aAAa,KAAK,OACtB;CACE,mBAAmB;CACnB,YAAY,KAAK,QAAQ,IAAI;CAC7B,QAAQ,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;AACtF,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,UAAU,KAAK,OACnB;CACE,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAClC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACpC,OAAO,KAAK,MAAM,CAAC,KAAK,QAAQ,QAAQ,GAAG,KAAK,QAAQ,cAAc,CAAC,CAAC;CACxE,OAAO,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AAC/D,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,oBAAoB,KAAK,OAC7B;CACE,WAAW,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CAC1E,iBAAiB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC7F,cAAc,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CAC7E,eAAe,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACrE,gBAAgB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACtE,iBAAiB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACvE,UAAU,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CAChE,SAAS,KAAK,QAAQ,SAAS;CAC/B,mBAAmB,KAAK,QAAQ,KAAK;AACvC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,eAAe,KAAK,OACxB;CACE,iBAAiB,KAAK,QAAQ,IAAI;CAClC,mBAAmB,KAAK,QAAQ,2BAA2B;CAC3D,UAAU,KAAK,OAAO,KAAK,OAAO,GAAG,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAC9E,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,eAAe,KAAK,OACxB;CACE,WAAW,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACvC,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,YAAY,GAAG,KAAK,QAAQ,UAAU,CAAC,CAAC;CACzE,UAAU,KAAK,QAAQ,KAAK;CAC5B,MAAM,KAAK,QAAQ,WAAW;CAC9B,OAAO,KAAK,QAAQ,iCAAiC;CACrD,OAAO,KAAK,OACV;EACE,YAAY,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;EACtD,iBAAiB,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;EAC3D,WAAW,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;EACrD,SAAS,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;CACrD,GACA,EAAE,sBAAsB,MAAM,CAChC;CACA,iBAAiB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,IAAM,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CAC3E,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC9C,YAAY,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AACjD,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OACrB;CACE,MAAM,KAAK,QAAQ,mBAAmB;CACtC,gBAAgB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CAC/E,gBAAgB,KAAK,MACnB,KAAK,MAAM;EACT,KAAK,QAAQ,mBAAmB;EAChC,KAAK,QAAQ,0BAA0B;EACvC,KAAK,QAAQ,uBAAuB;EACpC,KAAK,QAAQ,uBAAuB;CACtC,CAAC,GACD;EAAE,UAAU;EAAG,aAAa;CAAK,CACnC;CACA,SAAS,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC;CAChD,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC9C,wBAAwB,KAAK,QAAQ,KAAK;CAC1C,wBAAwB,KAAK,QAAQ,IAAI;CACzC,sBAAsB,KAAK,QAAQ,KAAK;AAC1C,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAMA,WAAS,KAAK,OAAO,EAAE,SAAS,wBAAwB,CAAC;AAC/D,MAAM,eAAe,KAAK,OACxB;CACE,QAAQA;CACR,UAAU,KAAK,OACb,KAAK,OAAO,EAAE,SAAS,kCAAkC,CAAC,GAC1D,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC,GACzC;EAAE,sBAAsB;EAAO,eAAe;CAAE,CAClD;AACF,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,kBAAkB,KAAK,OAC3B;CACE,oBAAoB,KAAK,QAAQ;CACjC,yBAAyB,KAAK,QAAQ;CACtC,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC1C,iBAAiB,KAAK,QAAQ,KAAK;CACnC,iBAAiB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC7F,cAAc,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CAC7E,iBAAiB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC5C,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC1C,gBAAgB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC3C,SAAS,KAAK,QAAQ,SAAS;AACjC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OACrB;CACE,YAAY,KAAK,OACf;EACE,gBAAgB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAC5C,mBAAmB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACjD,GACA,EAAE,sBAAsB,MAAM,CAChC;CACA,YAAY,KAAK,OACf;EACE,iBAAiB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EAC5C,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EAC1C,mBAAmB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;GAC3D,UAAU;GACV,aAAa;EACf,CAAC;CACH,GACA,EAAE,sBAAsB,MAAM,CAChC;CACA,UAAU,KAAK,OACb;EAAE,SAAS;EAAiB,OAAO;CAAgB,GACnD,EAAE,sBAAsB,MAAM,CAChC;AACF,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,mBAAmB,KAAK,OAC5B;CAAgB;CAAyB;AAAU,GACnD,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,cAAc,KAAK,OACvB;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,eAAe;CAClC,OAAO,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACnC,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,QAAQ,CAAC,CAAC;CAC1D;CACI;CACR;CACG;CACE;CACZ,UAAU,KAAK,OACb;EACE,4BAA4B;EAC5B,gCAAgC;EAChC,sCAAsC;CACxC,GACA,EAAE,sBAAsB,MAAM,CAChC;CACc;CACA;CACH;CACO;AACpB,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OACrB;CACE,WAAW,KAAK,QAAQ,SAAS;CACjC,UAAU,KAAK,MAAM;EACnB,KAAK,QAAQ,qBAAqB;EAClC,KAAK,QAAQ,iBAAiB;EAC9B,KAAK,QAAQ,oBAAoB;CACnC,CAAC;CACD,cAAc,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;CACvD,cAAc,KAAK,OAAO,EAAE,SAAS,kBAAkB,CAAC;AAC1D,GACA,EAAE,sBAAsB,MAAM,CAChC;AAkBA,MAAa,wBAjBW,KAAK,OAC3B;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,MAAM,CACf,KAAK,QAAQ,sBAAsB,GACnC,KAAK,QAAQ,8BAA8B,CAC7C,CAAC;CACD,UAAU,KAAK,QAAQ;CACvB,mBAAmB,KAAK,QAAQ;CAChC,SAAS;CACT,kBAAkB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC9C,eAAe,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;CACxD,yBAAyB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC1C;AACb,GACA,EAAE,sBAAsB,MAAM,CAEK;AAGrC,MAAa,cAA4B;CACvC,SAAS;CACT,aACE;CACF,QAAQ,EAAE,QAAQ,sBAAsB;AAC1C;;;ACpQA,MAAa,wBAAwB;AAuBrC,MAAa,qBArBmB,OAAO;CACrC,SAAS,KAAK,QAAQ,qBAAqB;;CAE3C,MAAM;CACN,SAAS;;CAET,WAAW;;CAEX,YAAY,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;;CAEzE,gBAAgB;;;CAGhB,QAAQ,KAAK,MAAM,CACjB,KAAK,QAAQ,0BAA0B,GACvC,KAAK,QAAQ,uBAAuB,CACtC,CAAC;CACD,QAAQ;CACR,WAAW;CACX,UAAU,KAAK,QAAQ;AACzB,CACkE;AAGlE,MAAa,iBAA+B;CAC1C,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,MAAM,mBAAmB;AACrC;;;ACpCA,MAAa,sBAAsB;AAEnC,MAAMC,WAAS,EAAE,sBAAsB,MAAM;AAC7C,MAAM,OAAO,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AACzC,MAAM,SAAS,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;AACxD,MAAM,OAAO,KAAK,QAAQ;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC;AAqD1E,MAAa,mBAnDiB,KAAK,OACjC;CACE,QAAQ,KAAK,QAAQ,mBAAmB;CACxC,SAAS,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;CACtE,UAAU;CACV,WAAW;CACX,gBAAgB,KAAK,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;CAChD,UAAU,KAAK,QAAQ,IAAI;CAC3B,WAAW;CACX,SAAS,KAAK,MACZ,KAAK,OACH;EACE,MAAM,KAAK,MAAM;GACf,KAAK,QAAQ,WAAW;GACxB,KAAK,QAAQ,gBAAgB;GAC7B,KAAK,QAAQ,KAAK;GAClB,KAAK,QAAQ,OAAO;GACpB,KAAK,QAAQ,KAAK;EACpB,CAAC;EACD,IAAI;EACJ,aAAa;EACb,QAAQ;CACV,GACAA,QACF,CACF;CACA,cAAc,KAAK,MACjB,KAAK,OACH;EACE,WAAW;EACX,WAAW;EACX,MAAM,KAAK,MAAM;GACf,KAAK,QAAQ,OAAO;GACpB,KAAK,QAAQ,SAAS;GACtB,KAAK,QAAQ,WAAW;EAC1B,CAAC;EACD,QAAQ,KAAK,MAAM;GACjB,KAAK,QAAQ,QAAQ;GACrB,KAAK,QAAQ,QAAQ;GACrB,KAAK,QAAQ,YAAY;EAC3B,CAAC;EACD,aAAa;EACb,iBAAiB;EACjB,aAAa,KAAK,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;CAC/C,GACAA,QACF,CACF;AACF,GACAA,QAE4D;AAW9D,MAAa,0BARwB,KAAK,OACxC;CACE,SAAS,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;CACtE,QAAQ;CACR,KAAK,KAAK,OAAO,EAAE,SAAS,+CAA+C,CAAC;AAC9E,GACAA,QAGA;AAGF,MAAa,gBAA8B;CACzC,SAAS;CACT,QAAQ;EAAE,UAAU;EAAkB,SAAS;CAAwB;AACzE;;;ACvEA,MAAa,oBAAoB;AAQjC,MAAa,wBANsB,KAAK,MAAM;CAC5C,KAAK,QAAQ,0BAA0B;CACvC,KAAK,QAAQ,uBAAuB;CACpC,KAAK,QAAQ,uBAAuB;CACpC,KAAK,QAAQ,mBAAmB;AAClC,CACwE;AA8BxE,MAAa,wBA3BsB,OAAO;CACxC,SAAS,KAAK,QAAQ,iBAAiB;CACvC,WAAW;CACX,QAAQ;CACR,SAAS;CACT,WAAW;CACX,QAAQ;CACR,OAAO;CACP,WAAW,KAAK,MACd,OAAO;EACL,UAAU;EACV,YAAY;CACd,CAAC,GACD;EAAE,UAAU;EAAG,aAAa;CAAK,CACnC;CACA,YAAY;CACZ,qBAAqB;CACrB,WAAW;CACX,WAAW;CACX,SAAS,KAAK,QAAQ,CAAC;CACvB,MAAM,OAAO;EACX,UAAU,KAAK,QAAQ,KAAK;EAC5B,aAAa,KAAK,QAAQ;GAAE,SAAS;GAAG,SAAS,OAAO;EAAiB,CAAC;EAC1E,mBAAmB;CACrB,CAAC;CACD,UAAU,KAAK,QAAQ;AACzB,CACwE;AAOxE,MAAa,8BAJ4B,OAAO;CAC9C,MAAM;CACN,WAAW,KAAK,OAAO,EAAE,SAAS,kBAAkB,CAAC;AACvD,CAEE;AAGF,MAAa,cAA4B;CACvC,SAAS;CACT,QAAQ;EAAE,QAAQ;EAAuB,QAAQ;CAA4B;AAC/E;;;AC3DA,MAAa,oCAAoC;AACjD,MAAa,uCAAuC;AAMpD,MAAa,0BAJwB,KAAK,MAAM,CAC9C,KAAK,QAAQ,qBAAqB,GAClC,KAAK,QAAQ,iBAAiB,CAChC,CAEE;AAqBF,MAAa,gCAjB8B,OAAO;CAChD,SAAS,KAAK,QAAQ,iCAAiC;;;CAGvD,cAAc;;CAEd,4BAA4B,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC/D,KAAK;CACL,YAAY;CACZ,QAAQ;CACR,OAAO;;CAEP,YAAY;CACZ,OAAO;CACP,MAAM;CACN,aAAa;AACf,CAEE;AAWF,MAAa,qCAPmC,OAAO;CACrD,SAAS,KAAK,QAAQ,iCAAiC;CACvD,MAAM,KAAK,QAAQ,oCAAoC;CACvD,QAAQ;;CAER,YAAY;AACd,CAEE;AASF,MAAa,sCALoC,OAAO;CACtD,MAAM;CACN,QAAQ;CACR,WAAW,KAAK,OAAO,EAAE,SAAS,kBAAkB,CAAC;AACvD,CAEE;AAGF,MAAa,4BAA0C;CACrD,SAAS;CACT,WAAW;CACX,QAAQ;EACN,YAAY;EACZ,QAAQ;EACR,OAAO;CACT;AACF;;;ACxDA,MAAa,6BAA6B;AAE1C,MAAM,QAAQ,KAAK,MAAM,gBAAgB;CAAE,UAAU;CAAG,aAAa;AAAK,CAAC;AAC3E,MAAM,eAAe,KAAK,QAAQ;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC;AA0BlF,MAAa,0BAxBwB,OAAO;CAC1C,SAAS,KAAK,QAAQ,0BAA0B;CAChD,WAAW;CACX,OAAO;CACP,cAAc;CACd,UAAU,KAAK,MAAM,CAAC,KAAK,QAAQ,qBAAqB,GAAG,KAAK,QAAQ,iBAAiB,CAAC,CAAC;CAC3F,aAAa,OAAO;EAClB,MAAM,KAAK,QAAQ,YAAY;EAC/B,sBAAsB;CACxB,CAAC;CACD,OAAO,OAAO;EACZ,gBAAgB;EAChB,SAAS;EACT,iBAAiB;EACjB,SAAS;CACX,CAAC;CACD,UAAU,OAAO;EAAE,WAAW;EAAW,UAAU;CAAU,CAAC;CAC9D,UAAU,OAAO;EACf,4BAA4B;EAC5B,gCAAgC;EAChC,sCAAsC;CACxC,CAAC;CACD,SAAS,KAAK,QAAQ;AACxB,CAEE;AAGF,MAAa,sBAAoC;CAC/C,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,WAAW,wBAAwB;AAC/C;;;AC5CA,MAAa,4BAA4B;AAGzC,MAAa,4BAA4B;;;ACkBzC,MAAa,gBAAgB;;;AAI7B,MAAa,oBAAoB;;;;AAKjC,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAmBA,MAAa,cAjBY,OAAO;CAC9B,SAAS,KAAK,QAAQ,aAAa;;;CAGnC,WAAW;;CAEX,UAAU,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;CACvE,IAAI;;CAEJ,MAAM;;CAEN,eAAe;;;;CAIf,SAAS,KAAK,OAAO,KAAK,OAAO,GAAG,KAAK,QAAQ,CAAC;AACpD,CACoD;AAoBpD,MAAa,wBAXsB,OAAO;CACxC,SAAS,KAAK,QAAQ,aAAa;CACnC,WAAW;CACX,eAAe;;CAEf,cAAc;CACd,YAAY;;CAEZ,MAAM,KAAK,MAAM,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CAC/E,qBAAqB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AAC7E,CACwE;AAGxE,MAAa,UAAwB;CACnC,SAAS;CACT,WAAW;CACX,QAAQ;EAAE,OAAO;EAAa,YAAY;CAAsB;AAClE;;;AChFA,MAAa,kBAAkB;AAO/B,MAAa,sBALoB,OAAO;CACtC,QAAQ;CACR,OAAO;CACP,eAAe;AACjB,CACoE;AASpE,MAAa,wBANsB,OAAO;CACxC,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,mBAAmB;AACrB,CACwE;AAYxE,MAAa,mBATiB,OAAO;CACnC,SAAS,KAAK,QAAQ,eAAe;CACrC,YAAY;CACZ,UAAU;CACV,QAAQ,KAAK,MAAM,WAAW,EAAE,UAAU,EAAE,CAAC;CAC7C,UAAU;CACV,SAAS;CACT,QAAQ;AACV,CAC8D;AAG9D,MAAa,YAA0B;CACrC,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,SAAS,iBAAiB;AACtC;;;AC1CA,MAAa,mBAAmB;AAYhC,MAAa,oBAVkB,OAAO;CACpC,SAAS,KAAK,QAAQ,gBAAgB;CACtC,OAAO;CACP,eAAe;CACf,UAAU,KAAK,MAAM,CAAC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CACxE,OAAO,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;CAC/C,WAAW;CACX,SAAS;CACT,WAAW;AACb,CACgE;AAGhE,MAAa,aAA2B;CACtC,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,UAAU,kBAAkB;AACxC;;;ACbA,MAAa,sBAAsB;AASnC,MAAa,2BAPyB,OAAO;CAC3C,SAAS,KAAK,MAAM,CAAC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CACvE,SAAS;CACT,WAAW;CACX,OAAO,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;CAC/C,iBAAiB,KAAK,QAAQ;AAChC,CAEE;AAWF,MAAa,mBARiB,OAAO;CACnC,SAAS,KAAK,QAAQ,mBAAmB;CACzC,OAAO;CACP,kBAAkB;CAClB,WAAW,KAAK,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC;CACpD,UAAU,KAAK,MAAM,CAAC,0BAA0B,KAAK,KAAK,CAAC,CAAC;CAC5D,WAAW,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;AACrD,CAC8D;AAG9D,MAAa,eAA6B;CACxC,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,SAAS,iBAAiB;AACtC;;;ACjCA,MAAa,kBAAkB;AAqB/B,MAAa,oBAnBkB,KAAK,MAAM;CACxC,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,sBAAsB;CACnC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,qBAAqB;CAClC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,wBAAwB;CACrC,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,YAAY;AAC3B,CACgE;AAQhE,MAAa,gBALc,OAAO;CAChC,SAAS,KAAK,QAAQ,eAAe;CACrC,MAAM;CACN,UAAU;AACZ,CACwD;AAGxD,MAAa,YAA0B;CACrC,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,SAAS,cAAc;AACnC;;;AC5BA,MAAa,qBAAqB;AAuBlC,MAAa,sBArBoB,KAAK,MAAM;CAC1C,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,sBAAsB;CACnC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,qBAAqB;CAClC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,wBAAwB;CACrC,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,YAAY;CACzB,KAAK,QAAQ,wBAAwB;CACrC,KAAK,QAAQ,sBAAsB;AACrC,CACoE;AASpE,MAAa,uBANqB,KAAK,MAAM;CAC3C,KAAK,QAAQ,OAAO;CACpB,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,OAAO;AACtB,CACsE;AAUtE,MAAa,kBAPgB,OAAO;CAClC,SAAS,KAAK,QAAQ,kBAAkB;CACxC,MAAM;CACN,UAAU;CACV,OAAO,KAAK,SAAS,oBAAoB;CACzC,eAAe,KAAK,SAAS,cAAc;AAC7C,CAC4D;AAG5D,MAAa,YAA0B;CACrC,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,SAAS,gBAAgB;AACrC;;;AC3DA,MAAa,2BAA2B;AACxC,MAAa,wBAAwB;AAWrC,MAAa,wBATsB,OAAO;CACxC,SAAS,KAAK,QAAQ,wBAAwB;CAC9C,WAAW;CACX,QAAQ,KAAK,QAAQ,qBAAqB;CAC1C,SAAS;CACT,SAAS;CACT,SAAS;CACT,WAAW;AACb,CACwE;AAGxE,MAAa,oBAAkC;CAC7C,SAAS;CACT,WAAW;CACX,QAAQ,EAAE,SAAS,sBAAsB;AAC3C;;;;;;;ACgJA,MAAa,WAAmD;EAC7D,kBAAkB,UAAU;EAC5B,YAAY,UAAU;EACtB,QAAQ,UAAU;EAClB,UAAU,UAAU;EACpB,WAAW,UAAU;EACrB,aAAa,UAAU;EACvB,UAAU,UAAU;EACpB,UAAU,UAAU;EACpB,kBAAkB,UAAU;EAC5B,YAAY,UAAU;EACtB,qBAAqB,UAAU;EAC/B,eAAe,UAAU;EACzB,cAAc,UAAU;EACxB,YAAY,UAAU;EACtB,oBAAoB,UAAU;EAC9B,0BAA0B,UAAU;AACvC"}
1
+ {"version":3,"file":"index.mjs","names":["digest","closed","GOOGLE_SIGN_IN_ISSUER"],"sources":["../src/primitives.ts","../src/kernel/dispatch-consume.v1.ts","../src/run/operation.v1.ts","../src/infra/resource-descriptor.v1.ts","../src/infra/signed-law.v1.ts","../src/infra/adoption-fact.v1.ts","../src/registry/revocations.v1.ts","../src/kernel/bootstrap.v1.ts","../src/kernel/standing-order-activation.v1.ts","../src/kernel/ordinary-authority.v1.ts","../src/run/contract-versions.ts","../src/run/event.v1.ts","../src/run/request.v1.ts","../src/run/decision.v1.ts","../src/run/run-summary.v1.ts","../src/core/refusal.v1.ts","../src/core/refusal.v2.ts","../src/core/google-identity.v1.ts","../src/core/refusal.v3.ts","../src/core/identity-binding.v1.ts","../src/organization/source.v2.ts","../src/index.ts"],"sourcesContent":["// The shared primitives every profile builds from. No profile defines its\n// own: a digest is Hex64 everywhere, a timestamp is UtcSecond everywhere,\n// an open object exists nowhere.\nimport { type TObject, type TProperties, type TSchema, Type } from \"@sinclair/typebox\";\nimport { ORN_PATTERN, SHA256_PATTERN } from \"@dynamicalsystems/orn-schemas\";\n\n/** Closed object: an extra field is a different protocol. */\nexport const closed = <T extends TProperties>(properties: T): TObject<T> =>\n Type.Object(properties, { additionalProperties: false });\n\n/** Lowercase sha256 hex. Every digest on the wire. */\nexport const Hex64 = Type.String({ pattern: \"^[0-9a-f]{64}$\" });\n\n/** Exact UTC second, Z suffix, no fractional part. */\nexport const UtcSecond = Type.String({\n pattern: \"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$\",\n});\n\nexport const NonEmptyString = Type.String({ minLength: 1 });\n\nexport const SafeInt = Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });\n\n/** An ORN, validated by the grammar dsg-orn owns. Built from the exported\n * pattern, not the exported schema object: the upstream schemas carry\n * JSON Schema $id metadata, and embedding the same $id in several route\n * schemas makes validators refuse the duplicate. The pattern is the wire\n * truth; the metadata is not. */\nexport const Orn = Type.String({ pattern: ORN_PATTERN });\n\n/** The pair of an ORN and the sha256 pinning a version (dsg-orn Reference). */\nexport const Reference = closed({\n orn: Orn,\n sha256: Type.String({ pattern: SHA256_PATTERN }),\n});\n\n/** A person named on a run. Missing on the wire is null; readers print\n * \"Not recorded\". Never inferred. */\nexport const PersonReference = closed({\n principal: Orn,\n displayName: NonEmptyString,\n source: NonEmptyString,\n});\n\n/** One wire profile: the literal, and every top-level shape that crosses\n * the seam it names. Shape names are stable identifiers (\"request\",\n * \"lease\", \"refusal\"); vectors address a shape as \"<literal>#<shape>\". */\nexport type ProfileEntry = {\n readonly literal: `dsg.${string}.${string}/${number}`;\n readonly documents: Readonly<Record<string, TSchema>>;\n /** Set ONLY when the wire cannot carry the literal as a field of any\n * shape (a frozen /1); names exactly where the literal lives instead. */\n readonly literalNote?: string;\n /** Names the shape non-TS consumers validate a whole document against;\n * the emitted JSON Schema gains a root $ref to it. Only meaningful for\n * profiles with a single document root. */\n readonly rootDocument?: string;\n};\n","// dsg.kernel.dispatch-consume/1\n// Owner: dsg-kernel (the consume route produces the lease and the refusal;\n// the plane produces the request).\n//\n// K05/I3: the dispatch-authorization consume contract between the kernel\n// and the plane. Immediately before its first non-cleanup cloud mutation -\n// identity, bucket and IAM preparation included, not only job submission -\n// the plane consumes a short-lived, single-operation dispatch authorization\n// bound to operation, generation, envelope digest, law digest and\n// reservation. The committed consume event is the authorization ordering\n// point; it is not atomic with any provider API. A replay returns the\n// original lease and never renews it; a renewal is a new recorded\n// authorization decision for the same operation and reservation.\n//\n// Lifted verbatim from dsg-kernel packages/core/src/dispatch.ts at commit\n// c2d39d95 (wire shapes only; the record-held event payloads stay in the\n// kernel). This file is frozen: changes ship as dispatch-consume.v2.ts.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n Orn,\n Reference,\n UtcSecond,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const DISPATCH_CONSUME_PROFILE = \"dsg.kernel.dispatch-consume/1\" as const;\n\n/** The bounded clock skew a lease check must tolerate, in seconds. */\nexport const DISPATCH_MAX_SKEW_SECONDS = 300;\n\nconst DispatchConsumeRequestSchemaValue = closed({\n profile: Type.Literal(DISPATCH_CONSUME_PROFILE),\n /** The kernel operation identity from the accepted OperationRequest. */\n operationId: NonEmptyString,\n /** The workspace generation the plane admitted the operation at. */\n generation: Type.Integer({ minimum: 0 }),\n /** The Case the operation belongs to - the stream the consume event\n * lands on and the stream the reservation was recorded on. */\n caseOrn: Orn,\n /** SHA256(JCS(complete OperationRequest)) - the M010 envelope digest. */\n envelopeSha256: Hex64,\n /** The exact retained signed-law bytes the Case pins. */\n lawSha256: Hex64,\n /** The K04 reservation the authorization is bound to: sha256 is the\n * reservation event's record id. */\n reservation: Reference,\n requestedAt: UtcSecond,\n /** False: first consumption or idempotent replay of it. True: an explicit\n * renewal - a new recorded authorization decision for the same operation\n * and reservation after lease expiry with the work known unsubmitted. A\n * replay never renews; only this flag does, and it re-runs every\n * revocation check at the current record state. */\n renewal: Type.Boolean(),\n});\nexport const DispatchConsumeRequestSchema: typeof DispatchConsumeRequestSchemaValue =\n DispatchConsumeRequestSchemaValue;\nexport type DispatchConsumeRequest = Static<typeof DispatchConsumeRequestSchema>;\n\nconst DispatchLeaseSchemaValue = closed({\n profile: Type.Literal(DISPATCH_CONSUME_PROFILE),\n /** The consume event's record id: the committed ordering point. */\n leaseId: Hex64,\n operationId: NonEmptyString,\n generation: Type.Integer({ minimum: 0 }),\n caseOrn: Orn,\n envelopeSha256: Hex64,\n lawSha256: Hex64,\n reservation: Reference,\n consumedAt: UtcSecond,\n /** Fixed maximum duration from consumedAt; the plane checks validity\n * before each new non-cleanup call, Batch submission included. */\n expiresAt: UtcSecond,\n /** The bounded clock skew a lease check must tolerate, in seconds. */\n maxSkewSeconds: Type.Integer({ minimum: 0, maximum: DISPATCH_MAX_SKEW_SECONDS }),\n renewal: Type.Literal(\"new-authorization-required\"),\n /** False when this response replays an earlier committed consumption:\n * the lease bytes, expiry included, are the original's. */\n fresh: Type.Boolean(),\n});\nexport const DispatchLeaseSchema: typeof DispatchLeaseSchemaValue = DispatchLeaseSchemaValue;\nexport type DispatchLease = Static<typeof DispatchLeaseSchema>;\n\nconst DispatchRefusalCodeSchemaValue = Type.Union([\n Type.Literal(\"unknown_operation\"),\n Type.Literal(\"no_reservation\"),\n Type.Literal(\"binding_mismatch\"),\n Type.Literal(\"revoked\"),\n Type.Literal(\"authority_refused\"),\n Type.Literal(\"renewal_requires_existing_consumption\"),\n Type.Literal(\"unavailable\"),\n]);\nexport const DispatchRefusalCodeSchema: typeof DispatchRefusalCodeSchemaValue =\n DispatchRefusalCodeSchemaValue;\nexport type DispatchRefusalCode = Static<typeof DispatchRefusalCodeSchema>;\n\nconst DispatchRefusalSchemaValue = closed({\n profile: Type.Literal(DISPATCH_CONSUME_PROFILE),\n code: DispatchRefusalCodeSchema,\n issues: Type.Array(NonEmptyString, { minItems: 1 }),\n});\nexport const DispatchRefusalSchema: typeof DispatchRefusalSchemaValue = DispatchRefusalSchemaValue;\nexport type DispatchRefusal = Static<typeof DispatchRefusalSchema>;\n\nexport const dispatchConsumeV1: ProfileEntry = {\n literal: DISPATCH_CONSUME_PROFILE,\n documents: {\n request: DispatchConsumeRequestSchema,\n lease: DispatchLeaseSchema,\n refusal: DispatchRefusalSchema,\n },\n};\n","// dsg.run.operation/1\n// Owner: dsg-run (the protocol listener accepts the request and answers\n// the receipt; the kernel validates, records and reads back).\n//\n// Closed, versioned compute-operation vocabulary shared by the kernel and\n// the dsg.run plane. The document is deliberately references-only: payload\n// bytes remain retained artifacts, while this request carries the immutable\n// identity, generation fence, law, reservation and plan digest.\n//\n// The envelope digest bound at dispatch (M010) is sha256 over the RFC 8785\n// canonical form of the complete OperationRequest; the digest vectors in\n// the conformance package pin that meaning.\n//\n// Lifted verbatim from dsg-kernel packages/core/src/operation.ts at commit\n// 0f8d64d7 (equal, field for field, to dsg-run service/src/protocol/\n// schemas.ts 134-246 - the R01 cross-validation held). Known /2 candidate,\n// kept loose here because a released /1 is frozen: acceptedAt is\n// minLength 1, not an exact UTC second, and the plane emits fractional\n// seconds today.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n Reference,\n SafeInt,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const OPERATION_PROFILE = \"dsg.run.operation/1\" as const;\n\nconst ExecutionResourcesSchemaValue = closed({\n maxGpuSeconds: SafeInt,\n maxRunSeconds: SafeInt,\n maxParallelism: SafeInt,\n});\nexport const ExecutionResourcesSchema: typeof ExecutionResourcesSchemaValue =\n ExecutionResourcesSchemaValue;\nexport type ExecutionResources = Static<typeof ExecutionResourcesSchema>;\n\nconst ExecutionLawSchemaValue = closed({\n bundle: Reference,\n registryRelease: Reference,\n});\nexport const ExecutionLawSchema: typeof ExecutionLawSchemaValue = ExecutionLawSchemaValue;\nexport type ExecutionLaw = Static<typeof ExecutionLawSchema>;\n\nconst ExecutionDocumentSchemaValue = closed({\n schemaVersion: Type.Literal(1),\n classContract: Reference,\n law: ExecutionLawSchema,\n workload: Reference,\n inputs: Type.Array(Reference),\n resources: ExecutionResourcesSchema,\n costBound: Reference,\n placement: Reference,\n results: Reference,\n secrets: Type.Array(Reference),\n});\nexport const ExecutionDocumentSchema: typeof ExecutionDocumentSchemaValue =\n ExecutionDocumentSchemaValue;\nexport type ExecutionDocument = Static<typeof ExecutionDocumentSchema>;\n\nconst OperationBeforeSchemaValue = closed({\n operationId: Type.Union([NonEmptyString, Type.Null()]),\n planDigest: Type.Union([Hex64, Type.Null()]),\n});\nexport const OperationBeforeSchema: typeof OperationBeforeSchemaValue = OperationBeforeSchemaValue;\nexport type OperationBefore = Static<typeof OperationBeforeSchema>;\n\nconst OperationRequestSchemaValue = closed({\n profile: Type.Literal(OPERATION_PROFILE),\n operationId: NonEmptyString,\n case: Reference,\n workspace: NonEmptyString,\n expectedGeneration: SafeInt,\n before: OperationBeforeSchema,\n planDigest: Hex64,\n document: ExecutionDocumentSchema,\n authority: Reference,\n reservation: Reference,\n});\nexport const OperationRequestSchema: typeof OperationRequestSchemaValue =\n OperationRequestSchemaValue;\nexport type OperationRequest = Static<typeof OperationRequestSchema>;\n\nconst AcceptedSchemaValue = closed({\n profile: Type.Literal(OPERATION_PROFILE),\n operationId: NonEmptyString,\n actionId: NonEmptyString,\n generation: SafeInt,\n planDigest: Hex64,\n acceptedAt: NonEmptyString,\n});\nexport const AcceptedSchema: typeof AcceptedSchemaValue = AcceptedSchemaValue;\nexport type Accepted = Static<typeof AcceptedSchema>;\n\nconst OperationExecutionSchemaValue = Type.Union([\n Type.Literal(\"queued\"),\n Type.Literal(\"running\"),\n Type.Literal(\"succeeded\"),\n Type.Literal(\"failed\"),\n Type.Literal(\"canceled\"),\n Type.Literal(\"unknown\"),\n]);\nexport const OperationExecutionSchema: typeof OperationExecutionSchemaValue =\n OperationExecutionSchemaValue;\nexport type OperationExecution = Static<typeof OperationExecutionSchema>;\n\nconst OperationCleanupSchemaValue = Type.Union([\n Type.Literal(\"pending\"),\n Type.Literal(\"present\"),\n Type.Literal(\"absent\"),\n Type.Literal(\"unknown\"),\n]);\nexport const OperationCleanupSchema: typeof OperationCleanupSchemaValue =\n OperationCleanupSchemaValue;\nexport type OperationCleanup = Static<typeof OperationCleanupSchema>;\n\nconst OperationEvidenceSchemaValue = Type.Union([Type.Literal(\"pending\"), Type.Literal(\"ready\")]);\nexport const OperationEvidenceSchema: typeof OperationEvidenceSchemaValue =\n OperationEvidenceSchemaValue;\nexport type OperationEvidence = Static<typeof OperationEvidenceSchema>;\n\nconst OperationCostSchemaValue = Type.Union([\n Type.Literal(\"reserved\"),\n Type.Literal(\"provisional\"),\n Type.Literal(\"reconciled\"),\n]);\nexport const OperationCostSchema: typeof OperationCostSchemaValue = OperationCostSchemaValue;\nexport type OperationCost = Static<typeof OperationCostSchema>;\n\nconst ReadbackSchemaValue = closed({\n operationId: NonEmptyString,\n generation: SafeInt,\n planDigest: Hex64,\n execution: OperationExecutionSchema,\n cleanup: OperationCleanupSchema,\n evidence: OperationEvidenceSchema,\n evidenceRef: Type.Union([Reference, Type.Null()]),\n cost: OperationCostSchema,\n});\nexport const ReadbackSchema: typeof ReadbackSchemaValue = ReadbackSchemaValue;\nexport type Readback = Static<typeof ReadbackSchema>;\n\n// I-001 names the status as the same closed readback shape. Keeping this\n// alias prevents callers from inventing a second status wire contract.\nexport const OperationStatusSchema = ReadbackSchema;\nexport type OperationStatus = Readback;\n\nexport const operationV1: ProfileEntry = {\n literal: OPERATION_PROFILE,\n documents: {\n request: OperationRequestSchema,\n accepted: AcceptedSchema,\n readback: ReadbackSchema,\n },\n};\n","// dsg.infra.resource-descriptor/1\n// Owner: dsg-infra (policy/resource-descriptor.schema.json is the source;\n// law_contract.py validates this exact shape and evaluate_descriptor\n// returns its canonical digest). A concrete provider-neutral resource: the\n// thing rendered from a workload and gated against the signed law's\n// capability limits before any provider API sees it. Distinct from\n// signed-law's capabilityProfile, which states allowed LIMITS; this\n// document states one concrete resource checked against them.\n//\n// The wire carries kind \"dsg.infra.resource-descriptor\" plus\n// schemaVersion 1; the /1 literal itself is the version marker signed-law\n// fields pin (scope.resourceDescriptorVersion, capabilities\n// .descriptorVersion), so the constant lives here and signed-law imports\n// it. Lifted verbatim from dsg-infra policy/resource-descriptor.schema.json\n// at fccf709.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const RESOURCE_DESCRIPTOR_PROFILE = \"dsg.infra.resource-descriptor/1\" as const;\n/** The document kind: the profile literal without its version suffix; the\n * version rides in schemaVersion. Frozen /1 wire choice. */\nexport const RESOURCE_DESCRIPTOR_KIND = \"dsg.infra.resource-descriptor\" as const;\n\nconst prefixedDigest = Type.String({ pattern: \"^sha256:[0-9a-f]{64}$\" });\n\nconst ResourceDescriptorSchemaValue = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(RESOURCE_DESCRIPTOR_KIND),\n workloadClass: NonEmptyString,\n lifecycle: Type.Union([Type.Literal(\"ephemeral\"), Type.Literal(\"durable\")]),\n machineType: Type.String({ pattern: \"^[a-z][a-z0-9]*-[a-z0-9]+-[0-9]+$\" }),\n accelerator: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),\n acceleratorCount: Type.Integer({ minimum: 0 }),\n vcpuCount: Type.Integer({ minimum: 1 }),\n memoryGiB: Type.Integer({ minimum: 1 }),\n maxRunSeconds: Type.Integer({ minimum: 1 }),\n maxParallelism: Type.Integer({ minimum: 1 }),\n region: NonEmptyString,\n imageDigest: prefixedDigest,\n moduleDigest: prefixedDigest,\n externalIp: Type.Literal(false),\n network: Type.Literal(\"private\"),\n reservation: closed({\n gpuSeconds: Type.Integer({ minimum: 0 }),\n usdMicroUnits: Type.Integer({ minimum: 0 }),\n }),\n});\nexport const ResourceDescriptorSchema: typeof ResourceDescriptorSchemaValue =\n ResourceDescriptorSchemaValue;\nexport type ResourceDescriptor = Static<typeof ResourceDescriptorSchema>;\n\nexport const resourceDescriptorV1: ProfileEntry = {\n literal: RESOURCE_DESCRIPTOR_PROFILE,\n literalNote:\n \"carried as kind (unversioned) plus schemaVersion on the document; the /1 literal is the version marker signed-law pins\",\n rootDocument: \"descriptor\",\n documents: { descriptor: ResourceDescriptorSchema },\n};\n","// dsg.infra.signed-law/1\n// Owner: dsg-infra (the S02 law producer; both prior copies were generated\n// from dsg-infra policy/law-bundle.schema.json, source SHA-256\n// bc3692395cf994567115c76d8fce66a7e9ebe7b2c50c70e1c83b8b10693a838c).\n//\n// The literal is the signing DOMAIN: it appears as the `domain` member of\n// the canonical signature input (JCS of {domain, payload, payloadSha256,\n// testOnly}), not as a field of the bundle itself; the bundle carries\n// `kind` plus `schemaVersion` instead. Lifted verbatim from dsg-kernel\n// packages/signing/src/law-schema.ts at ffafe305, byte-identical to the\n// module registry copy at 1f8c994.\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport type { ProfileEntry } from \"../primitives.js\";\nimport { RESOURCE_DESCRIPTOR_PROFILE } from \"./resource-descriptor.v1.js\";\n\nexport const SIGNED_LAW_PROFILE = \"dsg.infra.signed-law/1\" as const;\n/** The signature-input domain member is exactly the profile literal. */\nexport const SIGNED_LAW_DOMAIN = SIGNED_LAW_PROFILE;\n\n/** The scope vocabulary version today's laws cite in\n * standingOrder.scopeReference. The FIELD stays an open nonempty string on\n * purpose (a law may cite a future scope); this constant is the value in\n * force, exported so no consumer hand-types it. */\nexport const SCOPE_REFERENCE = \"dsg.infra.scope/1\" as const;\n\n/** The price-profile version today's laws cite in priceProfile.reference.\n * Same rule: the field stays open; this is the value in force. */\nexport const PRICE_PROFILE_REFERENCE = \"dsg.infra.price-profile/1\" as const;\n\nconst nullableString = Type.Union([Type.String({ minLength: 1 }), Type.Null()]);\nconst authority = Type.Object(\n {\n issuerType: Type.Literal(\"human\"),\n issuerReference: nullableString,\n designationReference: nullableString,\n signatureReference: nullableString,\n humanSignatureRequired: Type.Literal(true),\n releaseAutomationMayIssue: Type.Literal(false),\n },\n { additionalProperties: false },\n);\nconst utcSecond = Type.String({\n pattern: \"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$\",\n});\nconst standingOrder = Type.Object(\n {\n reference: nullableString,\n designationReference: nullableString,\n scopeReference: Type.String({ minLength: 1 }),\n issuedAt: Type.Union([utcSecond, Type.Null()]),\n expiresAt: Type.Union([utcSecond, Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst scope = Type.Object(\n {\n actions: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n workloadClasses: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n providers: Type.Array(Type.Literal(\"provider-neutral\"), { minItems: 1, uniqueItems: true }),\n regions: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n resourceDescriptorVersion: Type.Literal(RESOURCE_DESCRIPTOR_PROFILE),\n },\n { additionalProperties: false },\n);\nconst validity = Type.Object(\n {\n clock: Type.Literal(\"UTC\"),\n notBefore: Type.Union([utcSecond, Type.Null()]),\n notAfter: Type.Union([utcSecond, Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst revocation = Type.Object(\n {\n snapshotReference: nullableString,\n failClosed: Type.Literal(true),\n checks: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n },\n { additionalProperties: false },\n);\nconst ceiling = Type.Object(\n {\n unit: Type.String({ minLength: 1 }),\n period: Type.String({ minLength: 1 }),\n scope: Type.Union([Type.Literal(\"person\"), Type.Literal(\"organization\")]),\n value: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst capabilityProfile = Type.Object(\n {\n lifecycle: Type.Union([Type.Literal(\"ephemeral\"), Type.Literal(\"durable\")]),\n machinePrefixes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n accelerators: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n maxRunSeconds: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),\n maxParallelism: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),\n maxGpuInstances: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),\n maxVcpus: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),\n network: Type.Literal(\"private\"),\n externalIpAllowed: Type.Literal(false),\n },\n { additionalProperties: false },\n);\nconst capabilities = Type.Object(\n {\n providerNeutral: Type.Literal(true),\n descriptorVersion: Type.Literal(RESOURCE_DESCRIPTOR_PROFILE),\n profiles: Type.Record(Type.String(), capabilityProfile, { minProperties: 1 }),\n },\n { additionalProperties: false },\n);\nconst priceProfile = Type.Object(\n {\n reference: Type.String({ minLength: 1 }),\n status: Type.Union([Type.Literal(\"unassigned\"), Type.Literal(\"retained\")]),\n currency: Type.Literal(\"USD\"),\n unit: Type.Literal(\"micro_usd\"),\n basis: Type.Literal(\"retained-conservative-on-demand\"),\n rates: Type.Object(\n {\n vcpuSecond: Type.Optional(Type.Integer({ minimum: 0 })),\n memoryGiBSecond: Type.Optional(Type.Integer({ minimum: 0 })),\n gpuSecond: Type.Optional(Type.Integer({ minimum: 0 })),\n startup: Type.Optional(Type.Integer({ minimum: 0 })),\n },\n { additionalProperties: false },\n ),\n safetyFactorBps: Type.Union([Type.Integer({ minimum: 10000 }), Type.Null()]),\n validFrom: Type.Union([utcSecond, Type.Null()]),\n validUntil: Type.Union([utcSecond, Type.Null()]),\n },\n { additionalProperties: false },\n);\nconst bootstrap = Type.Object(\n {\n mode: Type.Literal(\"finite-human-root\"),\n rootReferences: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n allowedActions: Type.Array(\n Type.Union([\n Type.Literal(\"enroll_human_root\"),\n Type.Literal(\"initialize_kernel_record\"),\n Type.Literal(\"restore_kernel_record\"),\n Type.Literal(\"cutover_single_writer\"),\n ]),\n { minItems: 1, uniqueItems: true },\n ),\n maxUses: Type.Integer({ minimum: 1, maximum: 1 }),\n expiresAt: Type.Union([utcSecond, Type.Null()]),\n projectCreationAllowed: Type.Literal(false),\n requiresHumanSignature: Type.Literal(true),\n automationCanSatisfy: Type.Literal(false),\n },\n { additionalProperties: false },\n);\nconst digest = Type.String({ pattern: \"^sha256:[0-9a-f]{64}$\" });\nconst policyBundle = Type.Object(\n {\n digest: digest,\n manifest: Type.Record(\n Type.String({ pattern: \"^policy/[A-Za-z0-9._-]+\\\\.rego$\" }),\n Type.String({ pattern: \"^[0-9a-f]{64}$\" }),\n { additionalProperties: false, minProperties: 1 },\n ),\n },\n { additionalProperties: false },\n);\nconst lawInputProfile = Type.Object(\n {\n requiresRunCeiling: Type.Boolean(),\n requiresExpirationLabel: Type.Boolean(),\n maxRunSeconds: Type.Integer({ minimum: 1 }),\n allowExternalIp: Type.Literal(false),\n machinePrefixes: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),\n accelerators: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }),\n maxGpuInstances: Type.Integer({ minimum: 0 }),\n maxTotalVcpus: Type.Integer({ minimum: 1 }),\n maxParallelism: Type.Integer({ minimum: 1 }),\n network: Type.Literal(\"private\"),\n },\n { additionalProperties: false },\n);\nconst lawInputs = Type.Object(\n {\n cloudflare: Type.Object(\n {\n approvedZoneId: Type.String({ minLength: 1 }),\n approvedAccountId: Type.String({ minLength: 1 }),\n },\n { additionalProperties: false },\n ),\n planLimits: Type.Object(\n {\n maxGpuInstances: Type.Integer({ minimum: 0 }),\n maxTotalVcpus: Type.Integer({ minimum: 1 }),\n approvedLocations: Type.Array(Type.String({ minLength: 1 }), {\n minItems: 1,\n uniqueItems: true,\n }),\n },\n { additionalProperties: false },\n ),\n profiles: Type.Object(\n { compute: lawInputProfile, plane: lawInputProfile },\n { additionalProperties: false },\n ),\n },\n { additionalProperties: false },\n);\nconst evaluationInputs = Type.Object(\n { policyBundle: policyBundle, lawInputs: lawInputs },\n { additionalProperties: false },\n);\nconst lawDocument = Type.Object(\n {\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"dsg.infra.law\"),\n lawId: Type.String({ minLength: 1 }),\n status: Type.Union([Type.Literal(\"unissued\"), Type.Literal(\"issued\")]),\n authority: authority,\n standingOrder: standingOrder,\n scope: scope,\n validity: validity,\n revocation: revocation,\n ceilings: Type.Object(\n {\n gpuSecondsPerPersonUtcWeek: ceiling,\n usdMicroUnitsPerPersonUtcMonth: ceiling,\n usdMicroUnitsPerOrganizationUtcMonth: ceiling,\n },\n { additionalProperties: false },\n ),\n capabilities: capabilities,\n priceProfile: priceProfile,\n bootstrap: bootstrap,\n evaluationInputs: evaluationInputs,\n },\n { additionalProperties: false },\n);\nconst signature = Type.Object(\n {\n algorithm: Type.Literal(\"Ed25519\"),\n keyClass: Type.Union([\n Type.Literal(\"synthetic-test-only\"),\n Type.Literal(\"human-authority\"),\n Type.Literal(\"release-automation\"),\n ]),\n publicKeyHex: Type.String({ pattern: \"^[0-9a-f]{64}$\" }),\n signatureHex: Type.String({ pattern: \"^[0-9a-f]{128}$\" }),\n },\n { additionalProperties: false },\n);\nconst signedLawBundle = Type.Object(\n {\n schemaVersion: Type.Literal(1),\n kind: Type.Union([\n Type.Literal(\"dsg.infra.signed-law\"),\n Type.Literal(\"dsg.infra.signed-law-fixture\"),\n ]),\n testOnly: Type.Boolean(),\n deployedAuthority: Type.Boolean(),\n payload: lawDocument,\n canonicalPayload: Type.String({ minLength: 1 }),\n payloadSha256: Type.String({ pattern: \"^[0-9a-f]{64}$\" }),\n canonicalSignatureInput: Type.String({ minLength: 1 }),\n signature: signature,\n },\n { additionalProperties: false },\n);\nexport const SignedLawBundleSchema = signedLawBundle;\nexport type SignedLawBundle = Static<typeof SignedLawBundleSchema>;\n\nexport const signedLawV1: ProfileEntry = {\n literal: SIGNED_LAW_PROFILE,\n literalNote:\n \"carried as the domain member of the canonical signature input, not as a bundle field\",\n documents: { bundle: SignedLawBundleSchema },\n};\n","// dsg.infra.adoption-fact/1\n// Owner: dsg-infra (governance/adoption.py is the producer: it verifies an\n// exported kernel bootstrap record snapshot offline - canonical digest,\n// event hash chain, stream heads, artifact bytes - and emits the accepted\n// root-authorizing operation as this fact). The tofu baseline root\n// consumes it and re-validates independently: its deployment-specific\n// conditions (which root string, testOnly false for the real baseline)\n// are that root's own law, deliberately NOT part of this shape - a\n// synthetic testOnly fact is a valid FACT, just never a valid deployed\n// authorization.\n//\n// Lifted from dsg-infra governance/adoption.py at e9d9501 and\n// infrastructure/environments/dsg-run/adoption.tf (S01, commit fccf709).\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, type ProfileEntry } from \"../primitives.js\";\n\nexport const ADOPTION_FACT_PROFILE = \"dsg.infra.adoption-fact/1\" as const;\n\nconst AdoptionFactSchemaValue = closed({\n profile: Type.Literal(ADOPTION_FACT_PROFILE),\n /** The root the record names as active baseline owner. */\n root: NonEmptyString,\n lineage: NonEmptyString,\n /** The accepted root-authorizing operation. */\n operation: NonEmptyString,\n /** Count of accepted root operations; ownership needs at least one. */\n generation: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n /** Canonical digest of the verified record snapshot. */\n snapshotSha256: Hex64,\n /** initialize establishes the first owner; cutover transfers it. restore\n * and enrollment move custody and human roots, never root ownership. */\n action: Type.Union([\n Type.Literal(\"initialize_kernel_record\"),\n Type.Literal(\"cutover_single_writer\"),\n ]),\n signer: Orn,\n humanRoot: NonEmptyString,\n testOnly: Type.Boolean(),\n});\nexport const AdoptionFactSchema: typeof AdoptionFactSchemaValue = AdoptionFactSchemaValue;\nexport type AdoptionFact = Static<typeof AdoptionFactSchema>;\n\nexport const adoptionFactV1: ProfileEntry = {\n literal: ADOPTION_FACT_PROFILE,\n rootDocument: \"fact\",\n documents: { fact: AdoptionFactSchema },\n};\n","// dsg.registry.revocations/1\n// Owner: dsg-infra-module-registry (the S03 trust producer). Signed,\n// monotonically versioned revocation snapshots with retained trust\n// history; timestamps are epoch seconds by frozen choice of /1 (recorded\n// in FROZEN_EXEMPTIONS; exact-second strings would be a /2).\n// Lifted verbatim from dsg-infra-module-registry src/revocation.ts at\n// 1f8c994.\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport type { ProfileEntry } from \"../primitives.js\";\n\nexport const REVOCATIONS_PROFILE = \"dsg.registry.revocations/1\" as const;\n\nconst closed = { additionalProperties: false };\nconst text = Type.String({ minLength: 1 });\nconst digest = Type.String({ pattern: \"^[0-9a-f]{64}$\" });\nconst time = Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });\n\nconst RevocationSchemaValue = Type.Object(\n {\n domain: Type.Literal(REVOCATIONS_PROFILE),\n version: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n issuedAt: time,\n expiresAt: time,\n previousSha256: Type.Union([digest, Type.Null()]),\n testOnly: Type.Literal(true),\n signerKey: digest,\n revoked: Type.Array(\n Type.Object(\n {\n kind: Type.Union([\n Type.Literal(\"principal\"),\n Type.Literal(\"standing-order\"),\n Type.Literal(\"law\"),\n Type.Literal(\"class\"),\n Type.Literal(\"key\"),\n ]),\n id: text,\n effectiveAt: time,\n reason: text,\n },\n closed,\n ),\n ),\n trustHistory: Type.Array(\n Type.Object(\n {\n principal: text,\n publicKey: digest,\n role: Type.Union([\n Type.Literal(\"human\"),\n Type.Literal(\"release\"),\n Type.Literal(\"collector\"),\n ]),\n action: Type.Union([\n Type.Literal(\"enroll\"),\n Type.Literal(\"rotate\"),\n Type.Literal(\"compromise\"),\n ]),\n effectiveAt: time,\n authoritySha256: digest,\n replacesKey: Type.Union([digest, Type.Null()]),\n },\n closed,\n ),\n ),\n },\n closed,\n);\nexport const RevocationSchema: typeof RevocationSchemaValue = RevocationSchemaValue;\nexport type RevocationSnapshot = Static<typeof RevocationSchema>;\n\nconst RevocationPointerSchemaValue = Type.Object(\n {\n version: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n sha256: digest,\n url: Type.String({ pattern: \"^/revocations/v/[1-9][0-9]*/snapshot\\\\.json$\" }),\n },\n closed,\n);\nexport const RevocationPointerSchema: typeof RevocationPointerSchemaValue =\n RevocationPointerSchemaValue;\nexport type RevocationPointer = Static<typeof RevocationPointerSchema>;\n\nexport const revocationsV1: ProfileEntry = {\n literal: REVOCATIONS_PROFILE,\n documents: { snapshot: RevocationSchema, pointer: RevocationPointerSchema },\n};\n","// dsg.kernel.bootstrap/1\n// Owner: dsg-kernel (K14). The finite bootstrap intent: a signed,\n// single-use, expiring authorization for exactly one of four record\n// actions, binding plan and resource-spec digests. enroll_human_root\n// (M030) is the additive action that anchors ordinary-authority\n// enrollment; initialization is never reinterpreted as enrollment. The\n// record-held bootstrap event payloads stay in the kernel.\n//\n// Lifted verbatim from dsg-kernel packages/core/src/contracts.ts at\n// 00b33ac1. createdAt/expiresAt are frozen /1 nonempty strings, recorded\n// in FROZEN_EXEMPTIONS; exact-second patterns would be a /2 against\n// already-recorded signed intents.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, type ProfileEntry } from \"../primitives.js\";\n\nexport const BOOTSTRAP_PROFILE = \"dsg.kernel.bootstrap/1\" as const;\n\nconst BootstrapActionSchemaValue = Type.Union([\n Type.Literal(\"initialize_kernel_record\"),\n Type.Literal(\"restore_kernel_record\"),\n Type.Literal(\"cutover_single_writer\"),\n Type.Literal(\"enroll_human_root\"),\n]);\nexport const BootstrapActionSchema: typeof BootstrapActionSchemaValue = BootstrapActionSchemaValue;\nexport type BootstrapAction = Static<typeof BootstrapActionSchema>;\n\nconst BootstrapIntentSchemaValue = closed({\n version: Type.Literal(BOOTSTRAP_PROFILE),\n operation: NonEmptyString,\n action: BootstrapActionSchema,\n lineage: NonEmptyString,\n humanRoot: NonEmptyString,\n signer: Orn,\n scope: NonEmptyString,\n resources: Type.Array(\n closed({\n identity: NonEmptyString,\n specSha256: Hex64,\n }),\n { minItems: 1, uniqueItems: true },\n ),\n planSha256: Hex64,\n preconditionsSha256: Hex64,\n createdAt: NonEmptyString,\n expiresAt: NonEmptyString,\n maxUses: Type.Literal(1),\n cost: closed({\n currency: Type.Literal(\"USD\"),\n maxMicroUsd: Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }),\n assumptionsSha256: Hex64,\n }),\n testOnly: Type.Boolean(),\n});\nexport const BootstrapIntentSchema: typeof BootstrapIntentSchemaValue = BootstrapIntentSchemaValue;\nexport type BootstrapIntent = Static<typeof BootstrapIntentSchema>;\n\nconst SignedBootstrapIntentSchemaValue = closed({\n body: BootstrapIntentSchema,\n signature: Type.String({ pattern: \"^[0-9a-f]{128}$\" }),\n});\nexport const SignedBootstrapIntentSchema: typeof SignedBootstrapIntentSchemaValue =\n SignedBootstrapIntentSchemaValue;\nexport type SignedBootstrapIntent = Static<typeof SignedBootstrapIntentSchema>;\n\nexport const bootstrapV1: ProfileEntry = {\n literal: BOOTSTRAP_PROFILE,\n documents: { intent: BootstrapIntentSchema, signed: SignedBootstrapIntentSchema },\n};\n","// dsg.kernel.standing-order-activation/1\n// Owner: dsg-kernel. The record event selects the one standing-order\n// activation that API and worker may resolve. The revocation reference is\n// the activation-time observation only; consumers must independently resolve\n// the current revocation head before every authority use.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Orn, Reference, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const STANDING_ORDER_ACTIVATION_PROFILE = \"dsg.kernel.standing-order-activation/1\" as const;\nexport const STANDING_ORDER_ACTIVATION_EVENT_KIND = \"standing_order_activated\" as const;\n\nconst StandingOrderModeSchemaValue = Type.Union([\n Type.Literal(\"synthetic-test-only\"),\n Type.Literal(\"human-authority\"),\n]);\nexport const StandingOrderModeSchema: typeof StandingOrderModeSchemaValue =\n StandingOrderModeSchemaValue;\nexport type StandingOrderMode = Static<typeof StandingOrderModeSchema>;\n\n/** The immutable descriptor retained with the activation event. */\nconst StandingOrderActivationSchemaValue = closed({\n profile: Type.Literal(STANDING_ORDER_ACTIVATION_PROFILE),\n /** Stable identity carried in the descriptor. The event's `activation`\n * reference points to this descriptor, avoiding a digest cycle. */\n activationId: Orn,\n /** Compare-and-set precondition. Null is valid only for the first head. */\n expectedPreviousActivation: Type.Union([Reference, Type.Null()]),\n law: Reference,\n enrollment: Reference,\n intent: Reference,\n roots: Reference,\n /** Activation-time observation. It never substitutes for a current read. */\n revocation: Reference,\n actor: Orn,\n mode: StandingOrderModeSchema,\n activatedAt: UtcSecond,\n});\nexport const StandingOrderActivationSchema: typeof StandingOrderActivationSchemaValue =\n StandingOrderActivationSchemaValue;\nexport type StandingOrderActivation = Static<typeof StandingOrderActivationSchema>;\n\n/** Append-only record event carrying the descriptor selected by the stream head. */\nconst StandingOrderActivationEventSchemaValue = closed({\n profile: Type.Literal(STANDING_ORDER_ACTIVATION_PROFILE),\n kind: Type.Literal(STANDING_ORDER_ACTIVATION_EVENT_KIND),\n stream: Orn,\n /** Reference to the canonical descriptor artifact. */\n activation: Reference,\n});\nexport const StandingOrderActivationEventSchema: typeof StandingOrderActivationEventSchemaValue =\n StandingOrderActivationEventSchemaValue;\nexport type StandingOrderActivationEvent = Static<typeof StandingOrderActivationEventSchema>;\n\n/** Detached signature over the canonical activation descriptor bytes. */\nconst SignedStandingOrderActivationSchemaValue = closed({\n body: StandingOrderActivationSchema,\n signer: Orn,\n signature: Type.String({ pattern: \"^[0-9a-f]{128}$\" }),\n});\nexport const SignedStandingOrderActivationSchema: typeof SignedStandingOrderActivationSchemaValue =\n SignedStandingOrderActivationSchemaValue;\nexport type SignedStandingOrderActivation = Static<typeof SignedStandingOrderActivationSchema>;\n\nexport const standingOrderActivationV1: ProfileEntry = {\n literal: STANDING_ORDER_ACTIVATION_PROFILE,\n rootDocument: \"event\",\n documents: {\n activation: StandingOrderActivationSchema,\n signed: SignedStandingOrderActivationSchema,\n event: StandingOrderActivationEventSchema,\n },\n};\n","// dsg.kernel.ordinary-authority/1\n// Owner: dsg-kernel (K02, M029/M030). The canonical ordinary-rights\n// artifact: who may issue law, exactly what they may permit, for how long,\n// and under which three ceilings. Closed and versioned; every set is an\n// explicit allow-list, never an omitted-means-unlimited default. A\n// verified finite enroll_human_root intent binds this document's digest as\n// both plan and resource spec. The revocation view a standing-order check\n// runs against stays in the kernel: independently supplied input, not a\n// wire document.\n//\n// Lifted verbatim from dsg-kernel packages/signing/src/enrollment.ts at\n// 00b33ac1.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const ORDINARY_AUTHORITY_PROFILE = \"dsg.kernel.ordinary-authority/1\" as const;\n\nconst names = Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true });\nconst ceilingValue = Type.Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });\n\nconst OrdinaryAuthoritySchemaValue = closed({\n version: Type.Literal(ORDINARY_AUTHORITY_PROFILE),\n reference: NonEmptyString,\n actor: Orn,\n publicKeyHex: Hex64,\n keyClass: Type.Union([Type.Literal(\"synthetic-test-only\"), Type.Literal(\"human-authority\")]),\n designation: closed({\n role: Type.Literal(\"law-issuer\"),\n designationReference: NonEmptyString,\n }),\n scope: closed({\n scopeReference: NonEmptyString,\n actions: names,\n workloadClasses: names,\n regions: names,\n }),\n validity: closed({ notBefore: UtcSecond, notAfter: UtcSecond }),\n ceilings: closed({\n gpuSecondsPerPersonUtcWeek: ceilingValue,\n usdMicroUnitsPerPersonUtcMonth: ceilingValue,\n usdMicroUnitsPerOrganizationUtcMonth: ceilingValue,\n }),\n revoked: Type.Boolean(),\n});\nexport const OrdinaryAuthoritySchema: typeof OrdinaryAuthoritySchemaValue =\n OrdinaryAuthoritySchemaValue;\nexport type OrdinaryAuthority = Static<typeof OrdinaryAuthoritySchema>;\n\nexport const ordinaryAuthorityV1: ProfileEntry = {\n literal: ORDINARY_AUTHORITY_PROFILE,\n rootDocument: \"authority\",\n documents: { authority: OrdinaryAuthoritySchema },\n};\n","// In-process contract versions of the dsg-run plane. Under ruling I7 these\n// are NOT profiles: an executor or provider adapter is a TypeScript plugin\n// interface inside one process, with no serialized shape or digest of its\n// own - its documents (operation requests, descriptors) already have\n// profiles. The literals live here so no consumer repo defines a\n// dsg.*.*/N string and the CI grep stays absolute. When R06 gives\n// executors a real serialized job document, THAT becomes a profile module\n// beside this file.\nexport const EXECUTOR_PROTOCOL_VERSION = \"dsg.run.executor/1\" as const;\nexport type ExecutorProtocolVersion = typeof EXECUTOR_PROTOCOL_VERSION;\n\nexport const PROVIDER_PROTOCOL_VERSION = \"dsg.run.provider/1\" as const;\nexport type ProviderProtocolVersion = typeof PROVIDER_PROTOCOL_VERSION;\n","// dsg.run.event/1\n// Owner: dsg-run (the plane ingests, stores, streams, and seals) with the\n// emitting library as the other side of the seam.\n//\n// One event a running workload emitted about itself. The workload writes\n// these as single JSON lines on standard output, prefixed `DSGEV `, and\n// knows nothing about how they travel: the executor that ran the job is\n// the only thing that knows where its output went.\n//\n// Two things are closed and two are open by design. The ENVELOPE is\n// closed: an unknown envelope field is a different protocol. The PAYLOAD\n// is open here and closed by the catalog the emitter declared and the\n// request pinned by digest - the plane validates the payload against that\n// catalog, so this profile does not need to know a modeler's vocabulary\n// to refuse an invalid instance of it.\n//\n// Ordering is the sequence number, never arrival and never the clock: a\n// transport may duplicate or reorder, and the stored stream is the same\n// either way. A gap is recorded as a fact, not smoothed over.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n SafeInt,\n UtcSecond,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const EVENT_PROFILE = \"dsg.run.event/1\" as const;\n\n/** The wire prefix that lets a collector pick these lines out of ordinary\n * job logs. One space, then the JSON object, then a newline. */\nexport const EVENT_LINE_PREFIX = \"DSGEV \" as const;\n\n/** The lifecycle spine every catalog carries without declaring it: the\n * kinds the console draws for any workload, whatever it models. A\n * workload emitting only started and finished is fully described. */\nexport const LIFECYCLE_KINDS = [\n \"started\",\n \"phase.entered\",\n \"phase.exited\",\n \"progress\",\n \"checkpoint\",\n \"artifact\",\n \"warning\",\n \"failure\",\n \"finished\",\n] as const;\n\nconst EventSchemaValue = closed({\n profile: Type.Literal(EVENT_PROFILE),\n /** The operation this event belongs to; injected into the job's\n * environment by the plane, never chosen by the workload. */\n operation: NonEmptyString,\n /** Monotonic within one operation, from 1. Ordering lives here. */\n sequence: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),\n at: UtcSecond,\n /** A lifecycle kind or one the pinned catalog declares. */\n kind: NonEmptyString,\n /** Digest of the catalog the payload validates against. */\n catalogSha256: Hex64,\n /** Validated against the catalog by digest, not by this schema: a\n * modeler's vocabulary is theirs, and the plane refuses a payload the\n * catalog does not admit. Artifacts are references, never contents. */\n payload: Type.Record(Type.String(), Type.Unknown()),\n});\nexport const EventSchema: typeof EventSchemaValue = EventSchemaValue;\nexport type Event = Static<typeof EventSchema>;\n\n/** What the plane seals into the outcome: the ordered stream's own digest,\n * the catalog it validated against, and the count - enough for an\n * offline reader holding the exported stream to recompute the verdict\n * without the plane. `truncatedAtSequence` is the event ceiling's mark:\n * a runaway logger is bounded, and the bound is visible rather than a\n * silently short stream. */\nconst EventStreamSealSchemaValue = closed({\n profile: Type.Literal(EVENT_PROFILE),\n operation: NonEmptyString,\n catalogSha256: Hex64,\n /** sha256 over the newline-joined canonical event lines, in sequence. */\n streamSha256: Hex64,\n eventCount: SafeInt,\n /** Sequence numbers missing from an otherwise ordered stream. */\n gaps: Type.Array(Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER })),\n truncatedAtSequence: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()]),\n});\nexport const EventStreamSealSchema: typeof EventStreamSealSchemaValue = EventStreamSealSchemaValue;\nexport type EventStreamSeal = Static<typeof EventStreamSealSchema>;\n\nexport const eventV1: ProfileEntry = {\n literal: EVENT_PROFILE,\n rootDocument: \"event\",\n documents: { event: EventSchema, streamSeal: EventStreamSealSchema },\n};\n","// dsg.run.request/1\n// Owner: dsg-run (POST /requests). The CLI builds this document from an\n// experiment; the plane fills the requester from the door's assertion and\n// never from a field on this shape.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n Reference,\n SafeInt,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const REQUEST_PROFILE = \"dsg.run.request/1\" as const;\n\nconst ExperimentRefSchemaValue = closed({\n digest: Hex64,\n title: NonEmptyString,\n workloadClass: NonEmptyString,\n});\nexport const ExperimentRefSchema: typeof ExperimentRefSchemaValue = ExperimentRefSchemaValue;\nexport type ExperimentRef = Static<typeof ExperimentRefSchema>;\n\nconst RequestCeilingsSchemaValue = closed({\n maxRunSeconds: SafeInt,\n maxGpuSeconds: SafeInt,\n maxParallelism: SafeInt,\n costBoundMicroUsd: SafeInt,\n});\nexport const RequestCeilingsSchema: typeof RequestCeilingsSchemaValue = RequestCeilingsSchemaValue;\nexport type RequestCeilings = Static<typeof RequestCeilingsSchema>;\n\nconst RunRequestSchemaValue = closed({\n profile: Type.Literal(REQUEST_PROFILE),\n experiment: ExperimentRefSchema,\n workload: Reference,\n inputs: Type.Array(Reference, { minItems: 1 }),\n ceilings: RequestCeilingsSchema,\n purpose: NonEmptyString,\n window: NonEmptyString,\n});\nexport const RunRequestSchema: typeof RunRequestSchemaValue = RunRequestSchemaValue;\nexport type RunRequest = Static<typeof RunRequestSchema>;\n\nexport const requestV1: ProfileEntry = {\n literal: REQUEST_PROFILE,\n rootDocument: \"request\",\n documents: { request: RunRequestSchema },\n};\n","// dsg.run.decision/1\n// Owner: dsg-kernel (the decisions route verifies the signature against\n// the decider's recorded public key). A decision is a signature, not a\n// session. The requester may not decide their own run.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, Hex64, NonEmptyString, Orn, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const DECISION_PROFILE = \"dsg.run.decision/1\" as const;\n\nconst RunDecisionSchemaValue = closed({\n profile: Type.Literal(DECISION_PROFILE),\n runId: NonEmptyString,\n requestDigest: Hex64,\n decision: Type.Union([Type.Literal(\"approved\"), Type.Literal(\"refused\")]),\n cause: Type.Union([NonEmptyString, Type.Null()]),\n decidedAt: UtcSecond,\n decider: Orn,\n signature: NonEmptyString,\n});\nexport const RunDecisionSchema: typeof RunDecisionSchemaValue = RunDecisionSchemaValue;\nexport type RunDecision = Static<typeof RunDecisionSchema>;\n\nexport const decisionV1: ProfileEntry = {\n literal: DECISION_PROFILE,\n rootDocument: \"decision\",\n documents: { decision: RunDecisionSchema },\n};\n","// dsg.run.run-summary/1\n// Owner: dsg-run (the plane writes it; the console and kernel status read\n// it). A gate with no decision is waiting, never approved or refused.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport {\n closed,\n Hex64,\n NonEmptyString,\n PersonReference,\n UtcSecond,\n type ProfileEntry,\n} from \"../primitives.js\";\n\nexport const RUN_SUMMARY_PROFILE = \"dsg.run.run-summary/1\" as const;\n\nconst RunSummaryDecisionSchemaValue = closed({\n outcome: Type.Union([Type.Literal(\"approved\"), Type.Literal(\"refused\")]),\n decider: PersonReference,\n decidedAt: UtcSecond,\n cause: Type.Union([NonEmptyString, Type.Null()]),\n byStandingOrder: Type.Boolean(),\n});\nexport const RunSummaryDecisionSchema: typeof RunSummaryDecisionSchemaValue =\n RunSummaryDecisionSchemaValue;\nexport type RunSummaryDecision = Static<typeof RunSummaryDecisionSchema>;\n\nconst RunSummarySchemaValue = closed({\n profile: Type.Literal(RUN_SUMMARY_PROFILE),\n runId: NonEmptyString,\n experimentDigest: Hex64,\n requester: Type.Union([PersonReference, Type.Null()]),\n decision: Type.Union([RunSummaryDecisionSchema, Type.Null()]),\n waitingOn: Type.Union([NonEmptyString, Type.Null()]),\n});\nexport const RunSummarySchema: typeof RunSummarySchemaValue = RunSummarySchemaValue;\nexport type RunSummary = Static<typeof RunSummarySchema>;\n\nexport const runSummaryV1: ProfileEntry = {\n literal: RUN_SUMMARY_PROFILE,\n rootDocument: \"summary\",\n documents: { summary: RunSummarySchema },\n};\n","// dsg.core.refusal/1\n// Owner: shared. Kernel, plane, and console read this one envelope.\n// Identity ladder codes are identity-verifier-spec.md section 3.5.\n// Login and request codes are person-loop-spec.md sections 4.1 and 4.2.\n// The sentence is what a person hears; identifiers do not belong here.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const REFUSAL_PROFILE = \"dsg.core.refusal/1\" as const;\n\nconst RefusalCodeSchemaValue = Type.Union([\n Type.Literal(\"assertion_invalid\"),\n Type.Literal(\"audience_mismatch\"),\n Type.Literal(\"expired\"),\n Type.Literal(\"issuer_unknown\"),\n Type.Literal(\"transport_unverified\"),\n Type.Literal(\"relay_untrusted\"),\n Type.Literal(\"identity_unbound\"),\n Type.Literal(\"binding_expired\"),\n Type.Literal(\"principal_suspended\"),\n Type.Literal(\"not_dsg_account\"),\n Type.Literal(\"session_expired\"),\n Type.Literal(\"unknown_workload_class\"),\n Type.Literal(\"image_not_pinned\"),\n Type.Literal(\"not_a_requester\"),\n Type.Literal(\"document_invalid\"),\n Type.Literal(\"self_decision\"),\n Type.Literal(\"no_ceiling\"),\n]);\nexport const RefusalCodeSchema: typeof RefusalCodeSchemaValue = RefusalCodeSchemaValue;\nexport type RefusalCode = Static<typeof RefusalCodeSchema>;\n\nconst RefusalSchemaValue = closed({\n profile: Type.Literal(REFUSAL_PROFILE),\n code: RefusalCodeSchema,\n sentence: NonEmptyString,\n});\nexport const RefusalSchema: typeof RefusalSchemaValue = RefusalSchemaValue;\nexport type Refusal = Static<typeof RefusalSchema>;\n\nexport const refusalV1: ProfileEntry = {\n literal: REFUSAL_PROFILE,\n rootDocument: \"refusal\",\n documents: { refusal: RefusalSchema },\n};\n","// dsg.core.refusal/2\n// Owner: shared. Adds the two codes the shared authentication contract\n// requires: a validator that cannot answer fails closed and says so, and a\n// human confirmation outside its window is its own refusal, not a generic\n// expiry. /1 is frozen; this ships beside it.\n//\n// `stage` and `correlationId` are optional additions (2026-09-11): the\n// system has not shipped, so this profile amends in place rather than\n// spawning a /3 for two backward-compatible optional fields. An existing\n// non-proxy refusal carries neither. A proxy hop (dsg-run-console) always\n// sends both: `stage: \"proxy\"` names which hop answered, `correlationId`\n// is the proxy's own request id, replacing the `X-DSG-Refusal-Stage` /\n// `X-Request-ID` header detour with in-body fields the same schema covers.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const REFUSAL_V2_PROFILE = \"dsg.core.refusal/2\" as const;\n\nconst RefusalCodeV2SchemaValue = Type.Union([\n Type.Literal(\"assertion_invalid\"),\n Type.Literal(\"audience_mismatch\"),\n Type.Literal(\"expired\"),\n Type.Literal(\"issuer_unknown\"),\n Type.Literal(\"transport_unverified\"),\n Type.Literal(\"relay_untrusted\"),\n Type.Literal(\"identity_unbound\"),\n Type.Literal(\"binding_expired\"),\n Type.Literal(\"principal_suspended\"),\n Type.Literal(\"not_dsg_account\"),\n Type.Literal(\"session_expired\"),\n Type.Literal(\"unknown_workload_class\"),\n Type.Literal(\"image_not_pinned\"),\n Type.Literal(\"not_a_requester\"),\n Type.Literal(\"document_invalid\"),\n Type.Literal(\"self_decision\"),\n Type.Literal(\"no_ceiling\"),\n Type.Literal(\"validation_unavailable\"),\n Type.Literal(\"confirmation_expired\"),\n]);\nexport const RefusalCodeV2Schema: typeof RefusalCodeV2SchemaValue = RefusalCodeV2SchemaValue;\nexport type RefusalCodeV2 = Static<typeof RefusalCodeV2Schema>;\n\nconst RefusalStageV2SchemaValue = Type.Union([\n Type.Literal(\"proxy\"),\n Type.Literal(\"provider\"),\n Type.Literal(\"identity_read\"),\n Type.Literal(\"plane\"),\n]);\nexport const RefusalStageV2Schema: typeof RefusalStageV2SchemaValue = RefusalStageV2SchemaValue;\nexport type RefusalStageV2 = Static<typeof RefusalStageV2Schema>;\n\nconst RefusalV2SchemaValue = closed({\n profile: Type.Literal(REFUSAL_V2_PROFILE),\n code: RefusalCodeV2Schema,\n sentence: NonEmptyString,\n stage: Type.Optional(RefusalStageV2Schema),\n correlationId: Type.Optional(NonEmptyString),\n});\nexport const RefusalV2Schema: typeof RefusalV2SchemaValue = RefusalV2SchemaValue;\nexport type RefusalV2 = Static<typeof RefusalV2Schema>;\n\nexport const refusalV2: ProfileEntry = {\n literal: REFUSAL_V2_PROFILE,\n rootDocument: \"refusal\",\n documents: { refusal: RefusalV2Schema },\n};\n","// dsg.core.google-identity/1\n// Owner: dsg-kernel. A verified Google identity, as the kernel sees it:\n// the Google account number is the only identity key and the email\n// address is a display label. The kernel carries googleSubject in the\n// shape \"accounts.google.com:<digits>\" and never compares email for\n// identity after the claim.\n//\n// This profile ships beside dsg.core.identity-binding/1, which remains\n// the frozen shape of the detached personal-key binding path. The real\n// authority is Google-attested, so a separate profile names what a\n// verified identity looks like on the wire today.\n//\n// googleSubject is required, email is optional. hostedDomain is set\n// when the verified token carries the hd claim; absent is its own\n// meaning, not the same as a missing value. audience is the client id\n// the token was minted for and is required.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const GOOGLE_IDENTITY_PROFILE = \"dsg.core.google-identity/1\" as const;\nexport const GOOGLE_SIGN_IN_ISSUER = \"https://accounts.google.com\" as const;\n\nconst GoogleAccountSubject = Type.String({\n pattern: \"^accounts\\\\.google\\\\.com:[0-9]+$\",\n});\n\nconst GoogleIdentitySchemaValue = closed({\n profile: Type.Literal(GOOGLE_IDENTITY_PROFILE),\n issuer: Type.Literal(GOOGLE_SIGN_IN_ISSUER),\n googleSubject: GoogleAccountSubject,\n audience: NonEmptyString,\n hostedDomain: Type.Optional(NonEmptyString),\n email: Type.Optional(NonEmptyString),\n});\nexport const GoogleIdentitySchema: typeof GoogleIdentitySchemaValue = GoogleIdentitySchemaValue;\nexport type GoogleIdentity = Static<typeof GoogleIdentitySchema>;\n\nexport const googleIdentityV1: ProfileEntry = {\n literal: GOOGLE_IDENTITY_PROFILE,\n rootDocument: \"googleIdentity\",\n documents: { googleIdentity: GoogleIdentitySchema },\n};\n","// Normalized organization refusal. HTTP adapters preserve code as their\n// reason field; their transport envelopes are documented separately.\n// Dependency outages are not verdicts about a person.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, type ProfileEntry } from \"../primitives.js\";\n\nexport const REFUSAL_V3_PROFILE = \"dsg.core.refusal/3\" as const;\n\nconst RefusalCodeV3SchemaValue = Type.Union([\n Type.Literal(\"organization_absent\"),\n Type.Literal(\"organization_exists\"),\n Type.Literal(\"domain_mismatch\"),\n Type.Literal(\"suspended\"),\n Type.Literal(\"organization_disabled\"),\n Type.Literal(\"claims_missing\"),\n Type.Literal(\"not_qualified\"),\n Type.Literal(\"subject_conflict\"),\n]);\nexport const RefusalCodeV3Schema: typeof RefusalCodeV3SchemaValue = RefusalCodeV3SchemaValue;\nexport type RefusalCodeV3 = Static<typeof RefusalCodeV3Schema>;\n\nconst RefusalStageV3SchemaValue = Type.Union([\n Type.Literal(\"proxy\"),\n Type.Literal(\"provider\"),\n Type.Literal(\"identity_read\"),\n Type.Literal(\"plane\"),\n Type.Literal(\"console\"),\n Type.Literal(\"kernel\"),\n Type.Literal(\"record\"),\n Type.Literal(\"claim\"),\n]);\nexport const RefusalStageV3Schema: typeof RefusalStageV3SchemaValue = RefusalStageV3SchemaValue;\nexport type RefusalStageV3 = Static<typeof RefusalStageV3Schema>;\n\nconst RefusalV3SchemaValue = closed({\n profile: Type.Literal(REFUSAL_V3_PROFILE),\n code: RefusalCodeV3Schema,\n sentence: NonEmptyString,\n stage: Type.Optional(RefusalStageV3Schema),\n correlationId: Type.Optional(NonEmptyString),\n detail: Type.Optional(NonEmptyString),\n});\nexport const RefusalV3Schema: typeof RefusalV3SchemaValue = RefusalV3SchemaValue;\nexport type RefusalV3 = Static<typeof RefusalV3Schema>;\n\nexport const refusalV3: ProfileEntry = {\n literal: REFUSAL_V3_PROFILE,\n rootDocument: \"refusal\",\n documents: { refusal: RefusalV3Schema },\n};\n","// dsg.core.identity-binding/1\n// Owner: dsg-kernel. A binding is a signed act through the door.\n// The CLI signs; the plane forwards; the kernel verifies and appends.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, Orn, UtcSecond, type ProfileEntry } from \"../primitives.js\";\n\nexport const IDENTITY_BINDING_PROFILE = \"dsg.core.identity-binding/1\" as const;\nexport const GOOGLE_SIGN_IN_ISSUER = \"https://accounts.google.com\" as const;\n\nconst IdentityBindingSchemaValue = closed({\n profile: Type.Literal(IDENTITY_BINDING_PROFILE),\n principal: Orn,\n issuer: Type.Literal(GOOGLE_SIGN_IN_ISSUER),\n subject: NonEmptyString,\n decider: Orn,\n boundAt: UtcSecond,\n signature: NonEmptyString,\n});\nexport const IdentityBindingSchema: typeof IdentityBindingSchemaValue = IdentityBindingSchemaValue;\nexport type IdentityBinding = Static<typeof IdentityBindingSchema>;\n\nexport const identityBindingV1: ProfileEntry = {\n literal: IDENTITY_BINDING_PROFILE,\n rootDocument: \"binding\",\n documents: { binding: IdentityBindingSchema },\n};\n","// dsg.organization.source/2\n// Closed authoring contracts for an organization source tree. These declarations\n// describe reviewed inputs only: they contain no live principals, grants,\n// admissions, activation state, or deployment authority.\nimport { type Static, Type } from \"@sinclair/typebox\";\nimport { closed, NonEmptyString, SafeInt, type ProfileEntry } from \"../primitives.js\";\n\nexport const ORGANIZATION_SOURCE_PROFILE = \"dsg.organization.source/2\" as const;\n\nexport const OrganizationSpaceSchema = Type.String({\n pattern: \"^[a-z][a-z0-9-]*(?:\\\\.[a-z][a-z0-9-]*)+$\",\n});\n\n/** A path interpreted relative to the organization source root. Filesystem\n * containment and symlink checks belong to the consumer that opens it. */\nexport const OrganizationDocumentPathSchema = Type.String({\n minLength: 1,\n pattern: \"^(?!/)(?!.*(?:^|/)\\\\.\\\\.(?:/|$))(?!.*//)(?!.*\\\\\\\\).+$\",\n});\n\nexport const OrganizationSourceLocationSchema = closed({\n repository: NonEmptyString,\n ref: NonEmptyString,\n subdirectory: OrganizationDocumentPathSchema,\n});\nexport type OrganizationSourceLocation = Static<typeof OrganizationSourceLocationSchema>;\nconst OrganizationSourceLocationV1Schema = closed({\n repository: Type.String(),\n ref: Type.String(),\n subdirectory: Type.String(),\n});\nexport type OrganizationSourceLocationV1 = Static<typeof OrganizationSourceLocationV1Schema>;\n\nexport const ProjectSourceSchema = closed({\n repository: NonEmptyString,\n revision: Type.String({ pattern: \"^(?:[0-9a-f]{40}|[0-9a-f]{64})$\" }),\n});\nexport type ProjectSource = Static<typeof ProjectSourceSchema>;\n\nconst UniquePaths = () => Type.Array(OrganizationDocumentPathSchema, { uniqueItems: true });\nconst UniqueNames = () => Type.Array(NonEmptyString, { uniqueItems: true });\n\n/** Frozen compatibility shape. Version one is loaded only through the explicit\n * compatibility path; it is never silently reinterpreted as version two. */\nexport const OrganizationRootV1Schema = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"organization\"),\n org: NonEmptyString,\n space: OrganizationSpaceSchema,\n identity: closed({\n principals: NonEmptyString,\n qualifications: NonEmptyString,\n designations: NonEmptyString,\n }),\n policies: NonEmptyString,\n vocabulary: NonEmptyString,\n admissions: NonEmptyString,\n deployment: NonEmptyString,\n source: Type.Optional(OrganizationSourceLocationV1Schema),\n});\nexport type OrganizationRootV1 = Static<typeof OrganizationRootV1Schema>;\n\nexport const OrganizationInstructionSchema = closed({\n layer: Type.Union([\n Type.Literal(\"constitution\"),\n Type.Literal(\"profile\"),\n Type.Literal(\"project\"),\n ]),\n source: OrganizationDocumentPathSchema,\n provenance: OrganizationDocumentPathSchema,\n});\nexport type OrganizationInstruction = Static<typeof OrganizationInstructionSchema>;\n\n/** The generic root requires only stable identity, accountability, purpose and\n * a selected profile. Optional declaration groups become required only when\n * that profile says so. */\nexport const OrganizationRootSchema = closed({\n schemaVersion: Type.Literal(2),\n kind: Type.Literal(\"organization\"),\n org: NonEmptyString,\n space: OrganizationSpaceSchema,\n owner: closed({\n responsibility: NonEmptyString,\n qualification: Type.Optional(OrganizationDocumentPathSchema),\n designation: Type.Optional(OrganizationDocumentPathSchema),\n }),\n purpose: NonEmptyString,\n profile: closed({\n document: OrganizationDocumentPathSchema,\n facts: Type.Record(\n Type.String({ pattern: \"^[a-z][a-z0-9-]*$\" }),\n OrganizationDocumentPathSchema,\n { additionalProperties: false },\n ),\n }),\n identity: Type.Optional(\n closed({\n principals: Type.Optional(OrganizationDocumentPathSchema),\n qualifications: Type.Optional(OrganizationDocumentPathSchema),\n designations: Type.Optional(OrganizationDocumentPathSchema),\n eligibility: Type.Optional(OrganizationDocumentPathSchema),\n }),\n ),\n policies: Type.Optional(\n closed({\n sources: Type.Array(OrganizationDocumentPathSchema, { minItems: 1, uniqueItems: true }),\n release: Type.Optional(OrganizationDocumentPathSchema),\n }),\n ),\n vocabulary: Type.Optional(OrganizationDocumentPathSchema),\n admissions: Type.Optional(OrganizationDocumentPathSchema),\n projects: Type.Optional(UniquePaths()),\n capabilities: Type.Optional(UniquePaths()),\n instructions: Type.Optional(Type.Array(OrganizationInstructionSchema)),\n documents: Type.Optional(UniquePaths()),\n archive: Type.Optional(OrganizationDocumentPathSchema),\n releases: Type.Optional(UniquePaths()),\n deployment: Type.Optional(OrganizationDocumentPathSchema),\n source: Type.Optional(OrganizationSourceLocationSchema),\n});\nexport type OrganizationRoot = Static<typeof OrganizationRootSchema>;\n\nexport const WorkspaceProfileSchema = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"workspace-profile\"),\n id: NonEmptyString,\n profile: Type.Literal(ORGANIZATION_SOURCE_PROFILE),\n version: Type.String({ pattern: \"^[1-9][0-9]*\\\\.[0-9]+\\\\.[0-9]+$\" }),\n requirements: closed({\n facts: UniqueNames(),\n minimumProjects: SafeInt,\n requiredCapabilities: UniqueNames(),\n instructions: Type.Boolean(),\n }),\n allowedCapabilityOrigins: Type.Array(\n Type.Union([Type.Literal(\"workspace\"), Type.Literal(\"official\"), Type.Literal(\"curated\")]),\n { uniqueItems: true },\n ),\n handling: closed({ required: Type.Boolean() }),\n readinessChecks: UniquePaths(),\n});\nexport type WorkspaceProfile = Static<typeof WorkspaceProfileSchema>;\n\nexport const ProjectMembershipSchema = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"project-membership\"),\n id: NonEmptyString,\n mode: Type.Union([Type.Literal(\"managed\"), Type.Literal(\"independent\")]),\n source: ProjectSourceSchema,\n role: NonEmptyString,\n contract: OrganizationDocumentPathSchema,\n handling: OrganizationDocumentPathSchema,\n state: Type.Union([Type.Literal(\"active\"), Type.Literal(\"suspended\"), Type.Literal(\"removed\")]),\n});\nexport type ProjectMembership = Static<typeof ProjectMembershipSchema>;\n\nexport const CapabilityOriginSchema = Type.Union([\n Type.Literal(\"workspace\"),\n Type.Literal(\"official\"),\n Type.Literal(\"curated\"),\n]);\nexport type CapabilityOrigin = Static<typeof CapabilityOriginSchema>;\n\n/** `declaration` and component `reference` point to their owning existing\n * capability/Definition formats; this schema does not duplicate them. */\nexport const CapabilitySelectionSchema = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"capability-selection\"),\n id: NonEmptyString,\n declaration: OrganizationDocumentPathSchema,\n components: Type.Array(\n closed({ id: NonEmptyString, reference: OrganizationDocumentPathSchema }),\n { uniqueItems: true },\n ),\n origin: CapabilityOriginSchema,\n dependencyLock: OrganizationDocumentPathSchema,\n requiredDispositions: UniqueNames(),\n});\nexport type CapabilitySelection = Static<typeof CapabilitySelectionSchema>;\n\nexport const ReleaseMemberKindSchema = Type.Union([\n Type.Literal(\"policy\"),\n Type.Literal(\"capability-admission\"),\n Type.Literal(\"workflow-publication\"),\n Type.Literal(\"contract-check\"),\n Type.Literal(\"target-readiness\"),\n Type.Literal(\"setup-condition\"),\n]);\nexport type ReleaseMemberKind = Static<typeof ReleaseMemberKindSchema>;\n\nexport const ReleaseDeclarationSchema = closed({\n schemaVersion: Type.Literal(1),\n kind: Type.Literal(\"release-declaration\"),\n name: NonEmptyString,\n selection: closed({ projects: UniqueNames(), capabilities: UniqueNames() }),\n members: Type.Array(\n closed({\n key: NonEmptyString,\n artifact: OrganizationDocumentPathSchema,\n kind: ReleaseMemberKindSchema,\n required: Type.Boolean(),\n acceptableDispositions: Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true }),\n }),\n ),\n predecessors: UniqueNames(),\n});\nexport type ReleaseDeclaration = Static<typeof ReleaseDeclarationSchema>;\n\nexport const organizationSourceV2: ProfileEntry = {\n literal: ORGANIZATION_SOURCE_PROFILE,\n rootDocument: \"organization\",\n documents: {\n organization: OrganizationRootSchema,\n workspaceProfile: WorkspaceProfileSchema,\n projectMembership: ProjectMembershipSchema,\n capabilitySelection: CapabilitySelectionSchema,\n releaseDeclaration: ReleaseDeclarationSchema,\n },\n};\n","export {\n closed,\n Hex64,\n NonEmptyString,\n Orn,\n PersonReference,\n Reference,\n SafeInt,\n UtcSecond,\n} from \"./primitives.js\";\nexport type { ProfileEntry } from \"./primitives.js\";\nexport {\n DISPATCH_CONSUME_PROFILE,\n DISPATCH_MAX_SKEW_SECONDS,\n DispatchConsumeRequestSchema,\n DispatchLeaseSchema,\n DispatchRefusalCodeSchema,\n DispatchRefusalSchema,\n} from \"./kernel/dispatch-consume.v1.js\";\nexport type {\n DispatchConsumeRequest,\n DispatchLease,\n DispatchRefusal,\n DispatchRefusalCode,\n} from \"./kernel/dispatch-consume.v1.js\";\nexport {\n AcceptedSchema,\n ExecutionDocumentSchema,\n ExecutionLawSchema,\n ExecutionResourcesSchema,\n OPERATION_PROFILE,\n OperationBeforeSchema,\n OperationCleanupSchema,\n OperationCostSchema,\n OperationEvidenceSchema,\n OperationExecutionSchema,\n OperationRequestSchema,\n OperationStatusSchema,\n ReadbackSchema,\n} from \"./run/operation.v1.js\";\nexport type {\n Accepted,\n ExecutionDocument,\n ExecutionLaw,\n ExecutionResources,\n OperationBefore,\n OperationCleanup,\n OperationCost,\n OperationEvidence,\n OperationExecution,\n OperationRequest,\n OperationStatus,\n Readback,\n} from \"./run/operation.v1.js\";\nexport {\n PRICE_PROFILE_REFERENCE,\n SCOPE_REFERENCE,\n SIGNED_LAW_DOMAIN,\n SIGNED_LAW_PROFILE,\n SignedLawBundleSchema,\n} from \"./infra/signed-law.v1.js\";\nexport {\n RESOURCE_DESCRIPTOR_KIND,\n RESOURCE_DESCRIPTOR_PROFILE,\n ResourceDescriptorSchema,\n} from \"./infra/resource-descriptor.v1.js\";\nexport type { ResourceDescriptor } from \"./infra/resource-descriptor.v1.js\";\nexport { ADOPTION_FACT_PROFILE, AdoptionFactSchema } from \"./infra/adoption-fact.v1.js\";\nexport type { AdoptionFact } from \"./infra/adoption-fact.v1.js\";\nexport type { SignedLawBundle } from \"./infra/signed-law.v1.js\";\nexport {\n REVOCATIONS_PROFILE,\n RevocationPointerSchema,\n RevocationSchema,\n} from \"./registry/revocations.v1.js\";\nexport type { RevocationPointer, RevocationSnapshot } from \"./registry/revocations.v1.js\";\nexport {\n BOOTSTRAP_PROFILE,\n BootstrapActionSchema,\n BootstrapIntentSchema,\n SignedBootstrapIntentSchema,\n} from \"./kernel/bootstrap.v1.js\";\nexport type {\n BootstrapAction,\n BootstrapIntent,\n SignedBootstrapIntent,\n} from \"./kernel/bootstrap.v1.js\";\nexport {\n STANDING_ORDER_ACTIVATION_EVENT_KIND,\n STANDING_ORDER_ACTIVATION_PROFILE,\n StandingOrderActivationEventSchema,\n StandingOrderActivationSchema,\n StandingOrderModeSchema,\n SignedStandingOrderActivationSchema,\n} from \"./kernel/standing-order-activation.v1.js\";\nexport type {\n StandingOrderActivation,\n StandingOrderActivationEvent,\n StandingOrderMode,\n SignedStandingOrderActivation,\n} from \"./kernel/standing-order-activation.v1.js\";\nexport {\n ORDINARY_AUTHORITY_PROFILE,\n OrdinaryAuthoritySchema,\n} from \"./kernel/ordinary-authority.v1.js\";\nexport type { OrdinaryAuthority } from \"./kernel/ordinary-authority.v1.js\";\nexport { EXECUTOR_PROTOCOL_VERSION, PROVIDER_PROTOCOL_VERSION } from \"./run/contract-versions.js\";\nexport type { ExecutorProtocolVersion, ProviderProtocolVersion } from \"./run/contract-versions.js\";\nexport {\n EVENT_PROFILE,\n EVENT_LINE_PREFIX,\n LIFECYCLE_KINDS,\n EventSchema,\n EventStreamSealSchema,\n} from \"./run/event.v1.js\";\nexport type { Event, EventStreamSeal } from \"./run/event.v1.js\";\nexport {\n REQUEST_PROFILE,\n ExperimentRefSchema,\n RequestCeilingsSchema,\n RunRequestSchema,\n} from \"./run/request.v1.js\";\nexport type { ExperimentRef, RequestCeilings, RunRequest } from \"./run/request.v1.js\";\nexport { DECISION_PROFILE, RunDecisionSchema } from \"./run/decision.v1.js\";\nexport type { RunDecision } from \"./run/decision.v1.js\";\nexport {\n RUN_SUMMARY_PROFILE,\n RunSummaryDecisionSchema,\n RunSummarySchema,\n} from \"./run/run-summary.v1.js\";\nexport type { RunSummary, RunSummaryDecision } from \"./run/run-summary.v1.js\";\nexport { REFUSAL_PROFILE, RefusalCodeSchema, RefusalSchema } from \"./core/refusal.v1.js\";\nexport type { Refusal, RefusalCode } from \"./core/refusal.v1.js\";\nexport {\n REFUSAL_V2_PROFILE,\n RefusalCodeV2Schema,\n RefusalStageV2Schema,\n RefusalV2Schema,\n} from \"./core/refusal.v2.js\";\nexport type { RefusalCodeV2, RefusalStageV2, RefusalV2 } from \"./core/refusal.v2.js\";\nexport {\n GOOGLE_IDENTITY_PROFILE,\n GOOGLE_SIGN_IN_ISSUER,\n GoogleIdentitySchema,\n} from \"./core/google-identity.v1.js\";\nexport type { GoogleIdentity } from \"./core/google-identity.v1.js\";\nexport {\n REFUSAL_V3_PROFILE,\n RefusalCodeV3Schema,\n RefusalStageV3Schema,\n RefusalV3Schema,\n} from \"./core/refusal.v3.js\";\nexport type { RefusalCodeV3, RefusalStageV3, RefusalV3 } from \"./core/refusal.v3.js\";\nexport { IDENTITY_BINDING_PROFILE, IdentityBindingSchema } from \"./core/identity-binding.v1.js\";\nexport type { IdentityBinding } from \"./core/identity-binding.v1.js\";\nexport {\n ORGANIZATION_SOURCE_PROFILE,\n CapabilityOriginSchema,\n CapabilitySelectionSchema,\n OrganizationDocumentPathSchema,\n OrganizationInstructionSchema,\n OrganizationRootSchema,\n OrganizationRootV1Schema,\n OrganizationSourceLocationSchema,\n OrganizationSpaceSchema,\n ProjectMembershipSchema,\n ProjectSourceSchema,\n ReleaseDeclarationSchema,\n ReleaseMemberKindSchema,\n WorkspaceProfileSchema,\n} from \"./organization/source.v2.js\";\nexport type {\n CapabilityOrigin,\n CapabilitySelection,\n OrganizationInstruction,\n OrganizationRoot,\n OrganizationRootV1,\n OrganizationSourceLocation,\n OrganizationSourceLocationV1,\n ProjectMembership,\n ProjectSource,\n ReleaseDeclaration,\n ReleaseMemberKind,\n WorkspaceProfile,\n} from \"./organization/source.v2.js\";\n\nimport type { ProfileEntry } from \"./primitives.js\";\nimport { dispatchConsumeV1 } from \"./kernel/dispatch-consume.v1.js\";\nimport { operationV1 } from \"./run/operation.v1.js\";\nimport { eventV1 } from \"./run/event.v1.js\";\nimport { requestV1 } from \"./run/request.v1.js\";\nimport { decisionV1 } from \"./run/decision.v1.js\";\nimport { runSummaryV1 } from \"./run/run-summary.v1.js\";\nimport { refusalV1 } from \"./core/refusal.v1.js\";\nimport { refusalV2 } from \"./core/refusal.v2.js\";\nimport { refusalV3 } from \"./core/refusal.v3.js\";\nimport { googleIdentityV1 } from \"./core/google-identity.v1.js\";\nimport { identityBindingV1 } from \"./core/identity-binding.v1.js\";\nimport { signedLawV1 } from \"./infra/signed-law.v1.js\";\nimport { resourceDescriptorV1 } from \"./infra/resource-descriptor.v1.js\";\nimport { adoptionFactV1 } from \"./infra/adoption-fact.v1.js\";\nimport { revocationsV1 } from \"./registry/revocations.v1.js\";\nimport { bootstrapV1 } from \"./kernel/bootstrap.v1.js\";\nimport { ordinaryAuthorityV1 } from \"./kernel/ordinary-authority.v1.js\";\nimport { standingOrderActivationV1 } from \"./kernel/standing-order-activation.v1.js\";\nimport { organizationSourceV2 } from \"./organization/source.v2.js\";\n/** Every profile this version of the package defines, keyed by literal.\n * Profile modules are added here as they are extracted; the rules test\n * and the schema emitter walk this registry, so a module that is not\n * registered does not exist. */\nexport const PROFILES = {\n [dispatchConsumeV1.literal]: dispatchConsumeV1,\n [operationV1.literal]: operationV1,\n [eventV1.literal]: eventV1,\n [requestV1.literal]: requestV1,\n [decisionV1.literal]: decisionV1,\n [runSummaryV1.literal]: runSummaryV1,\n [refusalV1.literal]: refusalV1,\n [refusalV2.literal]: refusalV2,\n [refusalV3.literal]: refusalV3,\n [googleIdentityV1.literal]: googleIdentityV1,\n [identityBindingV1.literal]: identityBindingV1,\n [signedLawV1.literal]: signedLawV1,\n [resourceDescriptorV1.literal]: resourceDescriptorV1,\n [adoptionFactV1.literal]: adoptionFactV1,\n [revocationsV1.literal]: revocationsV1,\n [bootstrapV1.literal]: bootstrapV1,\n [ordinaryAuthorityV1.literal]: ordinaryAuthorityV1,\n [standingOrderActivationV1.literal]: standingOrderActivationV1,\n [organizationSourceV2.literal]: organizationSourceV2,\n} satisfies Readonly<Record<string, ProfileEntry>>;\n"],"mappings":";;;;AAOA,MAAa,UAAiC,eAC5C,KAAK,OAAO,YAAY,EAAE,sBAAsB,MAAM,CAAC;;AAGzD,MAAa,QAAQ,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;;AAG9D,MAAa,YAAY,KAAK,OAAO,EACnC,SAAS,2DACX,CAAC;AAED,MAAa,iBAAiB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AAE1D,MAAa,UAAU,KAAK,QAAQ;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC;;;;;;AAOpF,MAAa,MAAM,KAAK,OAAO,EAAE,SAAS,YAAY,CAAC;;AAGvD,MAAa,YAAY,OAAO;CAC9B,KAAK;CACL,QAAQ,KAAK,OAAO,EAAE,SAAS,eAAe,CAAC;AACjD,CAAC;;;AAID,MAAa,kBAAkB,OAAO;CACpC,WAAW;CACX,aAAa;CACb,QAAQ;AACV,CAAC;;;ACbD,MAAa,2BAA2B;;AAGxC,MAAa,4BAA4B;AA0BzC,MAAa,+BAxB6B,OAAO;CAC/C,SAAS,KAAK,QAAQ,wBAAwB;;CAE9C,aAAa;;CAEb,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;;;CAGvC,SAAS;;CAET,gBAAgB;;CAEhB,WAAW;;;CAGX,aAAa;CACb,aAAa;;;;;;CAMb,SAAS,KAAK,QAAQ;AACxB,CAEE;AAwBF,MAAa,sBArBoB,OAAO;CACtC,SAAS,KAAK,QAAQ,wBAAwB;;CAE9C,SAAS;CACT,aAAa;CACb,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACvC,SAAS;CACT,gBAAgB;CAChB,WAAW;CACX,aAAa;CACb,YAAY;;;CAGZ,WAAW;;CAEX,gBAAgB,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAA;CAAmC,CAAC;CAC/E,SAAS,KAAK,QAAQ,4BAA4B;;;CAGlD,OAAO,KAAK,QAAQ;AACtB,CACoE;AAYpE,MAAa,4BAT0B,KAAK,MAAM;CAChD,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,uCAAuC;CACpD,KAAK,QAAQ,aAAa;AAC5B,CAEE;AAQF,MAAa,wBALsB,OAAO;CACxC,SAAS,KAAK,QAAQ,wBAAwB;CAC9C,MAAM;CACN,QAAQ,KAAK,MAAM,gBAAgB,EAAE,UAAU,EAAE,CAAC;AACpD,CACwE;AAGxE,MAAa,oBAAkC;CAC7C,SAAS;CACT,WAAW;EACT,SAAS;EACT,OAAO;EACP,SAAS;CACX;AACF;;;ACpFA,MAAa,oBAAoB;AAOjC,MAAa,2BALyB,OAAO;CAC3C,eAAe;CACf,eAAe;CACf,gBAAgB;AAClB,CAEE;AAOF,MAAa,qBAJmB,OAAO;CACrC,QAAQ;CACR,iBAAiB;AACnB,CACkE;AAelE,MAAa,0BAZwB,OAAO;CAC1C,eAAe,KAAK,QAAQ,CAAC;CAC7B,eAAe;CACf,KAAK;CACL,UAAU;CACV,QAAQ,KAAK,MAAM,SAAS;CAC5B,WAAW;CACX,WAAW;CACX,WAAW;CACX,SAAS;CACT,SAAS,KAAK,MAAM,SAAS;AAC/B,CAEE;AAOF,MAAa,wBAJsB,OAAO;CACxC,aAAa,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;CACrD,YAAY,KAAK,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;AAC7C,CACwE;AAexE,MAAa,yBAZuB,OAAO;CACzC,SAAS,KAAK,QAAQ,iBAAiB;CACvC,aAAa;CACb,MAAM;CACN,WAAW;CACX,oBAAoB;CACpB,QAAQ;CACR,YAAY;CACZ,UAAU;CACV,WAAW;CACX,aAAa;AACf,CAEE;AAWF,MAAa,iBARe,OAAO;CACjC,SAAS,KAAK,QAAQ,iBAAiB;CACvC,aAAa;CACb,UAAU;CACV,YAAY;CACZ,YAAY;CACZ,YAAY;AACd,CAC0D;AAW1D,MAAa,2BARyB,KAAK,MAAM;CAC/C,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,WAAW;CACxB,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,SAAS;AACxB,CAEE;AASF,MAAa,yBANuB,KAAK,MAAM;CAC7C,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,SAAS;AACxB,CAEE;AAIF,MAAa,0BADwB,KAAK,MAAM,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,QAAQ,OAAO,CAAC,CAE7F;AAQF,MAAa,sBALoB,KAAK,MAAM;CAC1C,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,aAAa;CAC1B,KAAK,QAAQ,YAAY;AAC3B,CACoE;AAapE,MAAa,iBAVe,OAAO;CACjC,aAAa;CACb,YAAY;CACZ,YAAY;CACZ,WAAW;CACX,SAAS;CACT,UAAU;CACV,aAAa,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAChD,MAAM;AACR,CAC0D;AAK1D,MAAa,wBAAwB;AAGrC,MAAa,cAA4B;CACvC,SAAS;CACT,WAAW;EACT,SAAS;EACT,UAAU;EACV,UAAU;CACZ;AACF;;;AC3IA,MAAa,8BAA8B;;;AAG3C,MAAa,2BAA2B;AAExC,MAAM,iBAAiB,KAAK,OAAO,EAAE,SAAS,wBAAwB,CAAC;AAwBvE,MAAa,2BAtByB,OAAO;CAC3C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,wBAAwB;CAC3C,eAAe;CACf,WAAW,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CAC1E,aAAa,KAAK,OAAO,EAAE,SAAS,oCAAoC,CAAC;CACzE,aAAa,KAAK,MAAM,CAAC,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACpE,kBAAkB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC7C,WAAW,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtC,WAAW,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtC,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC1C,gBAAgB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC3C,QAAQ;CACR,aAAa;CACb,cAAc;CACd,YAAY,KAAK,QAAQ,KAAK;CAC9B,SAAS,KAAK,QAAQ,SAAS;CAC/B,aAAa,OAAO;EAClB,YAAY,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EACvC,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC5C,CAAC;AACH,CAEE;AAGF,MAAa,uBAAqC;CAChD,SAAS;CACT,aACE;CACF,cAAc;CACd,WAAW,EAAE,YAAY,yBAAyB;AACpD;;;AC1CA,MAAa,qBAAqB;;AAElC,MAAa,oBAAoB;;;;;AAMjC,MAAa,kBAAkB;;;AAI/B,MAAa,0BAA0B;AAEvC,MAAM,iBAAiB,KAAK,MAAM,CAAC,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AAC9E,MAAM,YAAY,KAAK,OACrB;CACE,YAAY,KAAK,QAAQ,OAAO;CAChC,iBAAiB;CACjB,sBAAsB;CACtB,oBAAoB;CACpB,wBAAwB,KAAK,QAAQ,IAAI;CACzC,2BAA2B,KAAK,QAAQ,KAAK;AAC/C,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OAAO,EAC5B,SAAS,2DACX,CAAC;AACD,MAAM,gBAAgB,KAAK,OACzB;CACE,WAAW;CACX,sBAAsB;CACtB,gBAAgB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC5C,UAAU,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC7C,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AAChD,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,QAAQ,KAAK,OACjB;CACE,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CACrF,iBAAiB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC7F,WAAW,KAAK,MAAM,KAAK,QAAQ,kBAAkB,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC1F,SAAS,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CACxE,2BAA2B,KAAK,QAAQ,2BAA2B;AACrE,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,WAAW,KAAK,OACpB;CACE,OAAO,KAAK,QAAQ,KAAK;CACzB,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC9C,UAAU,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AAC/C,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,aAAa,KAAK,OACtB;CACE,mBAAmB;CACnB,YAAY,KAAK,QAAQ,IAAI;CAC7B,QAAQ,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;AACtF,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,UAAU,KAAK,OACnB;CACE,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAClC,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACpC,OAAO,KAAK,MAAM,CAAC,KAAK,QAAQ,QAAQ,GAAG,KAAK,QAAQ,cAAc,CAAC,CAAC;CACxE,OAAO,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AAC/D,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,oBAAoB,KAAK,OAC7B;CACE,WAAW,KAAK,MAAM,CAAC,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CAC1E,iBAAiB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC7F,cAAc,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CAC7E,eAAe,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACrE,gBAAgB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACtE,iBAAiB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CACvE,UAAU,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CAChE,SAAS,KAAK,QAAQ,SAAS;CAC/B,mBAAmB,KAAK,QAAQ,KAAK;AACvC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,eAAe,KAAK,OACxB;CACE,iBAAiB,KAAK,QAAQ,IAAI;CAClC,mBAAmB,KAAK,QAAQ,2BAA2B;CAC3D,UAAU,KAAK,OAAO,KAAK,OAAO,GAAG,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAC9E,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,eAAe,KAAK,OACxB;CACE,WAAW,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACvC,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,YAAY,GAAG,KAAK,QAAQ,UAAU,CAAC,CAAC;CACzE,UAAU,KAAK,QAAQ,KAAK;CAC5B,MAAM,KAAK,QAAQ,WAAW;CAC9B,OAAO,KAAK,QAAQ,iCAAiC;CACrD,OAAO,KAAK,OACV;EACE,YAAY,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;EACtD,iBAAiB,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;EAC3D,WAAW,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;EACrD,SAAS,KAAK,SAAS,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;CACrD,GACA,EAAE,sBAAsB,MAAM,CAChC;CACA,iBAAiB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,IAAM,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;CAC3E,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC9C,YAAY,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;AACjD,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OACrB;CACE,MAAM,KAAK,QAAQ,mBAAmB;CACtC,gBAAgB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CAC/E,gBAAgB,KAAK,MACnB,KAAK,MAAM;EACT,KAAK,QAAQ,mBAAmB;EAChC,KAAK,QAAQ,0BAA0B;EACvC,KAAK,QAAQ,uBAAuB;EACpC,KAAK,QAAQ,uBAAuB;CACtC,CAAC,GACD;EAAE,UAAU;EAAG,aAAa;CAAK,CACnC;CACA,SAAS,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC;CAChD,WAAW,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC9C,wBAAwB,KAAK,QAAQ,KAAK;CAC1C,wBAAwB,KAAK,QAAQ,IAAI;CACzC,sBAAsB,KAAK,QAAQ,KAAK;AAC1C,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAMA,WAAS,KAAK,OAAO,EAAE,SAAS,wBAAwB,CAAC;AAC/D,MAAM,eAAe,KAAK,OACxB;CACE,QAAQA;CACR,UAAU,KAAK,OACb,KAAK,OAAO,EAAE,SAAS,kCAAkC,CAAC,GAC1D,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC,GACzC;EAAE,sBAAsB;EAAO,eAAe;CAAE,CAClD;AACF,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,kBAAkB,KAAK,OAC3B;CACE,oBAAoB,KAAK,QAAQ;CACjC,yBAAyB,KAAK,QAAQ;CACtC,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC1C,iBAAiB,KAAK,QAAQ,KAAK;CACnC,iBAAiB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;EAAE,UAAU;EAAG,aAAa;CAAK,CAAC;CAC7F,cAAc,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;CAC7E,iBAAiB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC5C,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC1C,gBAAgB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;CAC3C,SAAS,KAAK,QAAQ,SAAS;AACjC,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OACrB;CACE,YAAY,KAAK,OACf;EACE,gBAAgB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EAC5C,mBAAmB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACjD,GACA,EAAE,sBAAsB,MAAM,CAChC;CACA,YAAY,KAAK,OACf;EACE,iBAAiB,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EAC5C,eAAe,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC;EAC1C,mBAAmB,KAAK,MAAM,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG;GAC3D,UAAU;GACV,aAAa;EACf,CAAC;CACH,GACA,EAAE,sBAAsB,MAAM,CAChC;CACA,UAAU,KAAK,OACb;EAAE,SAAS;EAAiB,OAAO;CAAgB,GACnD,EAAE,sBAAsB,MAAM,CAChC;AACF,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,mBAAmB,KAAK,OAC5B;CAAgB;CAAyB;AAAU,GACnD,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,cAAc,KAAK,OACvB;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,eAAe;CAClC,OAAO,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACnC,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,QAAQ,CAAC,CAAC;CAC1D;CACI;CACR;CACG;CACE;CACZ,UAAU,KAAK,OACb;EACE,4BAA4B;EAC5B,gCAAgC;EAChC,sCAAsC;CACxC,GACA,EAAE,sBAAsB,MAAM,CAChC;CACc;CACA;CACH;CACO;AACpB,GACA,EAAE,sBAAsB,MAAM,CAChC;AACA,MAAM,YAAY,KAAK,OACrB;CACE,WAAW,KAAK,QAAQ,SAAS;CACjC,UAAU,KAAK,MAAM;EACnB,KAAK,QAAQ,qBAAqB;EAClC,KAAK,QAAQ,iBAAiB;EAC9B,KAAK,QAAQ,oBAAoB;CACnC,CAAC;CACD,cAAc,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;CACvD,cAAc,KAAK,OAAO,EAAE,SAAS,kBAAkB,CAAC;AAC1D,GACA,EAAE,sBAAsB,MAAM,CAChC;AAkBA,MAAa,wBAjBW,KAAK,OAC3B;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,MAAM,CACf,KAAK,QAAQ,sBAAsB,GACnC,KAAK,QAAQ,8BAA8B,CAC7C,CAAC;CACD,UAAU,KAAK,QAAQ;CACvB,mBAAmB,KAAK,QAAQ;CAChC,SAAS;CACT,kBAAkB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC9C,eAAe,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;CACxD,yBAAyB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC1C;AACb,GACA,EAAE,sBAAsB,MAAM,CAEK;AAGrC,MAAa,cAA4B;CACvC,SAAS;CACT,aACE;CACF,WAAW,EAAE,QAAQ,sBAAsB;AAC7C;;;ACpQA,MAAa,wBAAwB;AAuBrC,MAAa,qBArBmB,OAAO;CACrC,SAAS,KAAK,QAAQ,qBAAqB;;CAE3C,MAAM;CACN,SAAS;;CAET,WAAW;;CAEX,YAAY,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;;CAEzE,gBAAgB;;;CAGhB,QAAQ,KAAK,MAAM,CACjB,KAAK,QAAQ,0BAA0B,GACvC,KAAK,QAAQ,uBAAuB,CACtC,CAAC;CACD,QAAQ;CACR,WAAW;CACX,UAAU,KAAK,QAAQ;AACzB,CACkE;AAGlE,MAAa,iBAA+B;CAC1C,SAAS;CACT,cAAc;CACd,WAAW,EAAE,MAAM,mBAAmB;AACxC;;;ACpCA,MAAa,sBAAsB;AAEnC,MAAMC,WAAS,EAAE,sBAAsB,MAAM;AAC7C,MAAM,OAAO,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;AACzC,MAAM,SAAS,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC;AACxD,MAAM,OAAO,KAAK,QAAQ;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC;AAqD1E,MAAa,mBAnDiB,KAAK,OACjC;CACE,QAAQ,KAAK,QAAQ,mBAAmB;CACxC,SAAS,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;CACtE,UAAU;CACV,WAAW;CACX,gBAAgB,KAAK,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;CAChD,UAAU,KAAK,QAAQ,IAAI;CAC3B,WAAW;CACX,SAAS,KAAK,MACZ,KAAK,OACH;EACE,MAAM,KAAK,MAAM;GACf,KAAK,QAAQ,WAAW;GACxB,KAAK,QAAQ,gBAAgB;GAC7B,KAAK,QAAQ,KAAK;GAClB,KAAK,QAAQ,OAAO;GACpB,KAAK,QAAQ,KAAK;EACpB,CAAC;EACD,IAAI;EACJ,aAAa;EACb,QAAQ;CACV,GACAA,QACF,CACF;CACA,cAAc,KAAK,MACjB,KAAK,OACH;EACE,WAAW;EACX,WAAW;EACX,MAAM,KAAK,MAAM;GACf,KAAK,QAAQ,OAAO;GACpB,KAAK,QAAQ,SAAS;GACtB,KAAK,QAAQ,WAAW;EAC1B,CAAC;EACD,QAAQ,KAAK,MAAM;GACjB,KAAK,QAAQ,QAAQ;GACrB,KAAK,QAAQ,QAAQ;GACrB,KAAK,QAAQ,YAAY;EAC3B,CAAC;EACD,aAAa;EACb,iBAAiB;EACjB,aAAa,KAAK,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;CAC/C,GACAA,QACF,CACF;AACF,GACAA,QAE4D;AAW9D,MAAa,0BARwB,KAAK,OACxC;CACE,SAAS,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;CACtE,QAAQ;CACR,KAAK,KAAK,OAAO,EAAE,SAAS,+CAA+C,CAAC;AAC9E,GACAA,QAGA;AAGF,MAAa,gBAA8B;CACzC,SAAS;CACT,WAAW;EAAE,UAAU;EAAkB,SAAS;CAAwB;AAC5E;;;ACvEA,MAAa,oBAAoB;AAQjC,MAAa,wBANsB,KAAK,MAAM;CAC5C,KAAK,QAAQ,0BAA0B;CACvC,KAAK,QAAQ,uBAAuB;CACpC,KAAK,QAAQ,uBAAuB;CACpC,KAAK,QAAQ,mBAAmB;AAClC,CACwE;AA8BxE,MAAa,wBA3BsB,OAAO;CACxC,SAAS,KAAK,QAAQ,iBAAiB;CACvC,WAAW;CACX,QAAQ;CACR,SAAS;CACT,WAAW;CACX,QAAQ;CACR,OAAO;CACP,WAAW,KAAK,MACd,OAAO;EACL,UAAU;EACV,YAAY;CACd,CAAC,GACD;EAAE,UAAU;EAAG,aAAa;CAAK,CACnC;CACA,YAAY;CACZ,qBAAqB;CACrB,WAAW;CACX,WAAW;CACX,SAAS,KAAK,QAAQ,CAAC;CACvB,MAAM,OAAO;EACX,UAAU,KAAK,QAAQ,KAAK;EAC5B,aAAa,KAAK,QAAQ;GAAE,SAAS;GAAG,SAAS,OAAO;EAAiB,CAAC;EAC1E,mBAAmB;CACrB,CAAC;CACD,UAAU,KAAK,QAAQ;AACzB,CACwE;AAOxE,MAAa,8BAJ4B,OAAO;CAC9C,MAAM;CACN,WAAW,KAAK,OAAO,EAAE,SAAS,kBAAkB,CAAC;AACvD,CAEE;AAGF,MAAa,cAA4B;CACvC,SAAS;CACT,WAAW;EAAE,QAAQ;EAAuB,QAAQ;CAA4B;AAClF;;;AC3DA,MAAa,oCAAoC;AACjD,MAAa,uCAAuC;AAMpD,MAAa,0BAJwB,KAAK,MAAM,CAC9C,KAAK,QAAQ,qBAAqB,GAClC,KAAK,QAAQ,iBAAiB,CAChC,CAEE;AAqBF,MAAa,gCAjB8B,OAAO;CAChD,SAAS,KAAK,QAAQ,iCAAiC;;;CAGvD,cAAc;;CAEd,4BAA4B,KAAK,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;CAC/D,KAAK;CACL,YAAY;CACZ,QAAQ;CACR,OAAO;;CAEP,YAAY;CACZ,OAAO;CACP,MAAM;CACN,aAAa;AACf,CAEE;AAWF,MAAa,qCAPmC,OAAO;CACrD,SAAS,KAAK,QAAQ,iCAAiC;CACvD,MAAM,KAAK,QAAQ,oCAAoC;CACvD,QAAQ;;CAER,YAAY;AACd,CAEE;AASF,MAAa,sCALoC,OAAO;CACtD,MAAM;CACN,QAAQ;CACR,WAAW,KAAK,OAAO,EAAE,SAAS,kBAAkB,CAAC;AACvD,CAEE;AAGF,MAAa,4BAA0C;CACrD,SAAS;CACT,cAAc;CACd,WAAW;EACT,YAAY;EACZ,QAAQ;EACR,OAAO;CACT;AACF;;;ACxDA,MAAa,6BAA6B;AAE1C,MAAM,QAAQ,KAAK,MAAM,gBAAgB;CAAE,UAAU;CAAG,aAAa;AAAK,CAAC;AAC3E,MAAM,eAAe,KAAK,QAAQ;CAAE,SAAS;CAAG,SAAS,OAAO;AAAiB,CAAC;AA0BlF,MAAa,0BAxBwB,OAAO;CAC1C,SAAS,KAAK,QAAQ,0BAA0B;CAChD,WAAW;CACX,OAAO;CACP,cAAc;CACd,UAAU,KAAK,MAAM,CAAC,KAAK,QAAQ,qBAAqB,GAAG,KAAK,QAAQ,iBAAiB,CAAC,CAAC;CAC3F,aAAa,OAAO;EAClB,MAAM,KAAK,QAAQ,YAAY;EAC/B,sBAAsB;CACxB,CAAC;CACD,OAAO,OAAO;EACZ,gBAAgB;EAChB,SAAS;EACT,iBAAiB;EACjB,SAAS;CACX,CAAC;CACD,UAAU,OAAO;EAAE,WAAW;EAAW,UAAU;CAAU,CAAC;CAC9D,UAAU,OAAO;EACf,4BAA4B;EAC5B,gCAAgC;EAChC,sCAAsC;CACxC,CAAC;CACD,SAAS,KAAK,QAAQ;AACxB,CAEE;AAGF,MAAa,sBAAoC;CAC/C,SAAS;CACT,cAAc;CACd,WAAW,EAAE,WAAW,wBAAwB;AAClD;;;AC5CA,MAAa,4BAA4B;AAGzC,MAAa,4BAA4B;;;ACkBzC,MAAa,gBAAgB;;;AAI7B,MAAa,oBAAoB;;;;AAKjC,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAmBA,MAAa,cAjBY,OAAO;CAC9B,SAAS,KAAK,QAAQ,aAAa;;;CAGnC,WAAW;;CAEX,UAAU,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC;CACvE,IAAI;;CAEJ,MAAM;;CAEN,eAAe;;;;CAIf,SAAS,KAAK,OAAO,KAAK,OAAO,GAAG,KAAK,QAAQ,CAAC;AACpD,CACoD;AAoBpD,MAAa,wBAXsB,OAAO;CACxC,SAAS,KAAK,QAAQ,aAAa;CACnC,WAAW;CACX,eAAe;;CAEf,cAAc;CACd,YAAY;;CAEZ,MAAM,KAAK,MAAM,KAAK,QAAQ;EAAE,SAAS;EAAG,SAAS,OAAO;CAAiB,CAAC,CAAC;CAC/E,qBAAqB,KAAK,MAAM,CAAC,KAAK,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AAC7E,CACwE;AAGxE,MAAa,UAAwB;CACnC,SAAS;CACT,cAAc;CACd,WAAW;EAAE,OAAO;EAAa,YAAY;CAAsB;AACrE;;;AChFA,MAAa,kBAAkB;AAO/B,MAAa,sBALoB,OAAO;CACtC,QAAQ;CACR,OAAO;CACP,eAAe;AACjB,CACoE;AASpE,MAAa,wBANsB,OAAO;CACxC,eAAe;CACf,eAAe;CACf,gBAAgB;CAChB,mBAAmB;AACrB,CACwE;AAYxE,MAAa,mBATiB,OAAO;CACnC,SAAS,KAAK,QAAQ,eAAe;CACrC,YAAY;CACZ,UAAU;CACV,QAAQ,KAAK,MAAM,WAAW,EAAE,UAAU,EAAE,CAAC;CAC7C,UAAU;CACV,SAAS;CACT,QAAQ;AACV,CAC8D;AAG9D,MAAa,YAA0B;CACrC,SAAS;CACT,cAAc;CACd,WAAW,EAAE,SAAS,iBAAiB;AACzC;;;AC1CA,MAAa,mBAAmB;AAYhC,MAAa,oBAVkB,OAAO;CACpC,SAAS,KAAK,QAAQ,gBAAgB;CACtC,OAAO;CACP,eAAe;CACf,UAAU,KAAK,MAAM,CAAC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CACxE,OAAO,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;CAC/C,WAAW;CACX,SAAS;CACT,WAAW;AACb,CACgE;AAGhE,MAAa,aAA2B;CACtC,SAAS;CACT,cAAc;CACd,WAAW,EAAE,UAAU,kBAAkB;AAC3C;;;ACbA,MAAa,sBAAsB;AASnC,MAAa,2BAPyB,OAAO;CAC3C,SAAS,KAAK,MAAM,CAAC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC;CACvE,SAAS;CACT,WAAW;CACX,OAAO,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;CAC/C,iBAAiB,KAAK,QAAQ;AAChC,CAEE;AAWF,MAAa,mBARiB,OAAO;CACnC,SAAS,KAAK,QAAQ,mBAAmB;CACzC,OAAO;CACP,kBAAkB;CAClB,WAAW,KAAK,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC;CACpD,UAAU,KAAK,MAAM,CAAC,0BAA0B,KAAK,KAAK,CAAC,CAAC;CAC5D,WAAW,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;AACrD,CAC8D;AAG9D,MAAa,eAA6B;CACxC,SAAS;CACT,cAAc;CACd,WAAW,EAAE,SAAS,iBAAiB;AACzC;;;ACjCA,MAAa,kBAAkB;AAqB/B,MAAa,oBAnBkB,KAAK,MAAM;CACxC,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,sBAAsB;CACnC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,qBAAqB;CAClC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,wBAAwB;CACrC,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,YAAY;AAC3B,CACgE;AAQhE,MAAa,gBALc,OAAO;CAChC,SAAS,KAAK,QAAQ,eAAe;CACrC,MAAM;CACN,UAAU;AACZ,CACwD;AAGxD,MAAa,YAA0B;CACrC,SAAS;CACT,cAAc;CACd,WAAW,EAAE,SAAS,cAAc;AACtC;;;AC5BA,MAAa,qBAAqB;AAuBlC,MAAa,sBArBoB,KAAK,MAAM;CAC1C,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,mBAAmB;CAChC,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,sBAAsB;CACnC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,qBAAqB;CAClC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,wBAAwB;CACrC,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,YAAY;CACzB,KAAK,QAAQ,wBAAwB;CACrC,KAAK,QAAQ,sBAAsB;AACrC,CACoE;AASpE,MAAa,uBANqB,KAAK,MAAM;CAC3C,KAAK,QAAQ,OAAO;CACpB,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,OAAO;AACtB,CACsE;AAUtE,MAAa,kBAPgB,OAAO;CAClC,SAAS,KAAK,QAAQ,kBAAkB;CACxC,MAAM;CACN,UAAU;CACV,OAAO,KAAK,SAAS,oBAAoB;CACzC,eAAe,KAAK,SAAS,cAAc;AAC7C,CAC4D;AAG5D,MAAa,YAA0B;CACrC,SAAS;CACT,cAAc;CACd,WAAW,EAAE,SAAS,gBAAgB;AACxC;;;AC9CA,MAAa,0BAA0B;AACvC,MAAa,wBAAwB;AAErC,MAAM,uBAAuB,KAAK,OAAO,EACvC,SAAS,mCACX,CAAC;AAUD,MAAa,uBARqB,OAAO;CACvC,SAAS,KAAK,QAAQ,uBAAuB;CAC7C,QAAQ,KAAK,QAAQ,qBAAqB;CAC1C,eAAe;CACf,UAAU;CACV,cAAc,KAAK,SAAS,cAAc;CAC1C,OAAO,KAAK,SAAS,cAAc;AACrC,CACsE;AAGtE,MAAa,mBAAiC;CAC5C,SAAS;CACT,cAAc;CACd,WAAW,EAAE,gBAAgB,qBAAqB;AACpD;;;ACnCA,MAAa,qBAAqB;AAYlC,MAAa,sBAVoB,KAAK,MAAM;CAC1C,KAAK,QAAQ,qBAAqB;CAClC,KAAK,QAAQ,qBAAqB;CAClC,KAAK,QAAQ,iBAAiB;CAC9B,KAAK,QAAQ,WAAW;CACxB,KAAK,QAAQ,uBAAuB;CACpC,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,kBAAkB;AACjC,CACoE;AAapE,MAAa,uBAVqB,KAAK,MAAM;CAC3C,KAAK,QAAQ,OAAO;CACpB,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,eAAe;CAC5B,KAAK,QAAQ,OAAO;CACpB,KAAK,QAAQ,SAAS;CACtB,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,OAAO;AACtB,CACsE;AAWtE,MAAa,kBARgB,OAAO;CAClC,SAAS,KAAK,QAAQ,kBAAkB;CACxC,MAAM;CACN,UAAU;CACV,OAAO,KAAK,SAAS,oBAAoB;CACzC,eAAe,KAAK,SAAS,cAAc;CAC3C,QAAQ,KAAK,SAAS,cAAc;AACtC,CAC4D;AAG5D,MAAa,YAA0B;CACrC,SAAS;CACT,cAAc;CACd,WAAW,EAAE,SAAS,gBAAgB;AACxC;;;AC3CA,MAAa,2BAA2B;AAYxC,MAAa,wBATsB,OAAO;CACxC,SAAS,KAAK,QAAQ,wBAAwB;CAC9C,WAAW;CACX,QAAQ,KAAK,QAAQC,6BAAqB;CAC1C,SAAS;CACT,SAAS;CACT,SAAS;CACT,WAAW;AACb,CACwE;AAGxE,MAAa,oBAAkC;CAC7C,SAAS;CACT,cAAc;CACd,WAAW,EAAE,SAAS,sBAAsB;AAC9C;;;AClBA,MAAa,8BAA8B;AAE3C,MAAa,0BAA0B,KAAK,OAAO,EACjD,SAAS,2CACX,CAAC;;;AAID,MAAa,iCAAiC,KAAK,OAAO;CACxD,WAAW;CACX,SAAS;AACX,CAAC;AAED,MAAa,mCAAmC,OAAO;CACrD,YAAY;CACZ,KAAK;CACL,cAAc;AAChB,CAAC;AAED,MAAM,qCAAqC,OAAO;CAChD,YAAY,KAAK,OAAO;CACxB,KAAK,KAAK,OAAO;CACjB,cAAc,KAAK,OAAO;AAC5B,CAAC;AAGD,MAAa,sBAAsB,OAAO;CACxC,YAAY;CACZ,UAAU,KAAK,OAAO,EAAE,SAAS,kCAAkC,CAAC;AACtE,CAAC;AAGD,MAAM,oBAAoB,KAAK,MAAM,gCAAgC,EAAE,aAAa,KAAK,CAAC;AAC1F,MAAM,oBAAoB,KAAK,MAAM,gBAAgB,EAAE,aAAa,KAAK,CAAC;;;AAI1E,MAAa,2BAA2B,OAAO;CAC7C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,cAAc;CACjC,KAAK;CACL,OAAO;CACP,UAAU,OAAO;EACf,YAAY;EACZ,gBAAgB;EAChB,cAAc;CAChB,CAAC;CACD,UAAU;CACV,YAAY;CACZ,YAAY;CACZ,YAAY;CACZ,QAAQ,KAAK,SAAS,kCAAkC;AAC1D,CAAC;AAGD,MAAa,gCAAgC,OAAO;CAClD,OAAO,KAAK,MAAM;EAChB,KAAK,QAAQ,cAAc;EAC3B,KAAK,QAAQ,SAAS;EACtB,KAAK,QAAQ,SAAS;CACxB,CAAC;CACD,QAAQ;CACR,YAAY;AACd,CAAC;;;;AAMD,MAAa,yBAAyB,OAAO;CAC3C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,cAAc;CACjC,KAAK;CACL,OAAO;CACP,OAAO,OAAO;EACZ,gBAAgB;EAChB,eAAe,KAAK,SAAS,8BAA8B;EAC3D,aAAa,KAAK,SAAS,8BAA8B;CAC3D,CAAC;CACD,SAAS;CACT,SAAS,OAAO;EACd,UAAU;EACV,OAAO,KAAK,OACV,KAAK,OAAO,EAAE,SAAS,oBAAoB,CAAC,GAC5C,gCACA,EAAE,sBAAsB,MAAM,CAChC;CACF,CAAC;CACD,UAAU,KAAK,SACb,OAAO;EACL,YAAY,KAAK,SAAS,8BAA8B;EACxD,gBAAgB,KAAK,SAAS,8BAA8B;EAC5D,cAAc,KAAK,SAAS,8BAA8B;EAC1D,aAAa,KAAK,SAAS,8BAA8B;CAC3D,CAAC,CACH;CACA,UAAU,KAAK,SACb,OAAO;EACL,SAAS,KAAK,MAAM,gCAAgC;GAAE,UAAU;GAAG,aAAa;EAAK,CAAC;EACtF,SAAS,KAAK,SAAS,8BAA8B;CACvD,CAAC,CACH;CACA,YAAY,KAAK,SAAS,8BAA8B;CACxD,YAAY,KAAK,SAAS,8BAA8B;CACxD,UAAU,KAAK,SAAS,YAAY,CAAC;CACrC,cAAc,KAAK,SAAS,YAAY,CAAC;CACzC,cAAc,KAAK,SAAS,KAAK,MAAM,6BAA6B,CAAC;CACrE,WAAW,KAAK,SAAS,YAAY,CAAC;CACtC,SAAS,KAAK,SAAS,8BAA8B;CACrD,UAAU,KAAK,SAAS,YAAY,CAAC;CACrC,YAAY,KAAK,SAAS,8BAA8B;CACxD,QAAQ,KAAK,SAAS,gCAAgC;AACxD,CAAC;AAGD,MAAa,yBAAyB,OAAO;CAC3C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,mBAAmB;CACtC,IAAI;CACJ,SAAS,KAAK,QAAQ,2BAA2B;CACjD,SAAS,KAAK,OAAO,EAAE,SAAS,kCAAkC,CAAC;CACnE,cAAc,OAAO;EACnB,OAAO,YAAY;EACnB,iBAAiB;EACjB,sBAAsB,YAAY;EAClC,cAAc,KAAK,QAAQ;CAC7B,CAAC;CACD,0BAA0B,KAAK,MAC7B,KAAK,MAAM;EAAC,KAAK,QAAQ,WAAW;EAAG,KAAK,QAAQ,UAAU;EAAG,KAAK,QAAQ,SAAS;CAAC,CAAC,GACzF,EAAE,aAAa,KAAK,CACtB;CACA,UAAU,OAAO,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;CAC7C,iBAAiB,YAAY;AAC/B,CAAC;AAGD,MAAa,0BAA0B,OAAO;CAC5C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,oBAAoB;CACvC,IAAI;CACJ,MAAM,KAAK,MAAM,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,QAAQ,aAAa,CAAC,CAAC;CACvE,QAAQ;CACR,MAAM;CACN,UAAU;CACV,UAAU;CACV,OAAO,KAAK,MAAM;EAAC,KAAK,QAAQ,QAAQ;EAAG,KAAK,QAAQ,WAAW;EAAG,KAAK,QAAQ,SAAS;CAAC,CAAC;AAChG,CAAC;AAGD,MAAa,yBAAyB,KAAK,MAAM;CAC/C,KAAK,QAAQ,WAAW;CACxB,KAAK,QAAQ,UAAU;CACvB,KAAK,QAAQ,SAAS;AACxB,CAAC;;;AAKD,MAAa,4BAA4B,OAAO;CAC9C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,sBAAsB;CACzC,IAAI;CACJ,aAAa;CACb,YAAY,KAAK,MACf,OAAO;EAAE,IAAI;EAAgB,WAAW;CAA+B,CAAC,GACxE,EAAE,aAAa,KAAK,CACtB;CACA,QAAQ;CACR,gBAAgB;CAChB,sBAAsB,YAAY;AACpC,CAAC;AAGD,MAAa,0BAA0B,KAAK,MAAM;CAChD,KAAK,QAAQ,QAAQ;CACrB,KAAK,QAAQ,sBAAsB;CACnC,KAAK,QAAQ,sBAAsB;CACnC,KAAK,QAAQ,gBAAgB;CAC7B,KAAK,QAAQ,kBAAkB;CAC/B,KAAK,QAAQ,iBAAiB;AAChC,CAAC;AAGD,MAAa,2BAA2B,OAAO;CAC7C,eAAe,KAAK,QAAQ,CAAC;CAC7B,MAAM,KAAK,QAAQ,qBAAqB;CACxC,MAAM;CACN,WAAW,OAAO;EAAE,UAAU,YAAY;EAAG,cAAc,YAAY;CAAE,CAAC;CAC1E,SAAS,KAAK,MACZ,OAAO;EACL,KAAK;EACL,UAAU;EACV,MAAM;EACN,UAAU,KAAK,QAAQ;EACvB,wBAAwB,KAAK,MAAM,gBAAgB;GAAE,UAAU;GAAG,aAAa;EAAK,CAAC;CACvF,CAAC,CACH;CACA,cAAc,YAAY;AAC5B,CAAC;AAGD,MAAa,uBAAqC;CAChD,SAAS;CACT,cAAc;CACd,WAAW;EACT,cAAc;EACd,kBAAkB;EAClB,mBAAmB;EACnB,qBAAqB;EACrB,oBAAoB;CACtB;AACF;;;;;;;ACRA,MAAa,WAAW;EACrB,kBAAkB,UAAU;EAC5B,YAAY,UAAU;EACtB,QAAQ,UAAU;EAClB,UAAU,UAAU;EACpB,WAAW,UAAU;EACrB,aAAa,UAAU;EACvB,UAAU,UAAU;EACpB,UAAU,UAAU;EACpB,UAAU,UAAU;EACpB,iBAAiB,UAAU;EAC3B,kBAAkB,UAAU;EAC5B,YAAY,UAAU;EACtB,qBAAqB,UAAU;EAC/B,eAAe,UAAU;EACzB,cAAc,UAAU;EACxB,YAAY,UAAU;EACtB,oBAAoB,UAAU;EAC9B,0BAA0B,UAAU;EACpC,qBAAqB,UAAU;AAClC"}
package/package.json CHANGED
@@ -1,7 +1,6 @@
1
1
  {
2
2
  "name": "@dynamicalsystems/idl",
3
- "version": "0.10.0",
4
- "description": "The DSG governed compute plane wire profiles: TypeBox schemas, profile literals, and Static types for every dsg.*.*/N shape. One meaning per profile, frozen per version.",
3
+ "version": "0.12.0",
5
4
  "homepage": "https://github.com/DynamicalSystemsGroup/dsg-idl#readme",
6
5
  "bugs": "https://github.com/DynamicalSystemsGroup/dsg-idl/issues",
7
6
  "license": "Apache-2.0",
package/schema/dsg-core-google-identity-v1.json ADDED
@@ -0,0 +1,39 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://github.com/DynamicalSystemsGroup/dsg-idl/schema/dsg-core-google-identity-v1.json",
4
+ "title": "dsg.core.google-identity/1",
5
+ "$defs": {
6
+ "googleIdentity": {
7
+ "additionalProperties": false,
8
+ "type": "object",
9
+ "required": ["profile", "issuer", "googleSubject", "audience"],
10
+ "properties": {
11
+ "profile": {
12
+ "const": "dsg.core.google-identity/1",
13
+ "type": "string"
14
+ },
15
+ "issuer": {
16
+ "const": "https://accounts.google.com",
17
+ "type": "string"
18
+ },
19
+ "googleSubject": {
20
+ "pattern": "^accounts\\.google\\.com:[0-9]+$",
21
+ "type": "string"
22
+ },
23
+ "audience": {
24
+ "minLength": 1,
25
+ "type": "string"
26
+ },
27
+ "hostedDomain": {
28
+ "minLength": 1,
29
+ "type": "string"
30
+ },
31
+ "email": {
32
+ "minLength": 1,
33
+ "type": "string"
34
+ }
35
+ }
36
+ }
37
+ },
38
+ "$ref": "#/$defs/googleIdentity"
39
+ }
package/schema/dsg-core-refusal-v3.json ADDED
@@ -0,0 +1,103 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://github.com/DynamicalSystemsGroup/dsg-idl/schema/dsg-core-refusal-v3.json",
4
+ "title": "dsg.core.refusal/3",
5
+ "$defs": {
6
+ "refusal": {
7
+ "additionalProperties": false,
8
+ "type": "object",
9
+ "required": ["profile", "code", "sentence"],
10
+ "properties": {
11
+ "profile": {
12
+ "const": "dsg.core.refusal/3",
13
+ "type": "string"
14
+ },
15
+ "code": {
16
+ "anyOf": [
17
+ {
18
+ "const": "organization_absent",
19
+ "type": "string"
20
+ },
21
+ {
22
+ "const": "organization_exists",
23
+ "type": "string"
24
+ },
25
+ {
26
+ "const": "domain_mismatch",
27
+ "type": "string"
28
+ },
29
+ {
30
+ "const": "suspended",
31
+ "type": "string"
32
+ },
33
+ {
34
+ "const": "organization_disabled",
35
+ "type": "string"
36
+ },
37
+ {
38
+ "const": "claims_missing",
39
+ "type": "string"
40
+ },
41
+ {
42
+ "const": "not_qualified",
43
+ "type": "string"
44
+ },
45
+ {
46
+ "const": "subject_conflict",
47
+ "type": "string"
48
+ }
49
+ ]
50
+ },
51
+ "sentence": {
52
+ "minLength": 1,
53
+ "type": "string"
54
+ },
55
+ "stage": {
56
+ "anyOf": [
57
+ {
58
+ "const": "proxy",
59
+ "type": "string"
60
+ },
61
+ {
62
+ "const": "provider",
63
+ "type": "string"
64
+ },
65
+ {
66
+ "const": "identity_read",
67
+ "type": "string"
68
+ },
69
+ {
70
+ "const": "plane",
71
+ "type": "string"
72
+ },
73
+ {
74
+ "const": "console",
75
+ "type": "string"
76
+ },
77
+ {
78
+ "const": "kernel",
79
+ "type": "string"
80
+ },
81
+ {
82
+ "const": "record",
83
+ "type": "string"
84
+ },
85
+ {
86
+ "const": "claim",
87
+ "type": "string"
88
+ }
89
+ ]
90
+ },
91
+ "correlationId": {
92
+ "minLength": 1,
93
+ "type": "string"
94
+ },
95
+ "detail": {
96
+ "minLength": 1,
97
+ "type": "string"
98
+ }
99
+ }
100
+ }
101
+ },
102
+ "$ref": "#/$defs/refusal"
103
+ }