@enterpriseai/cli 3.19.4 → 3.20.0

package/dist/lib/content-understanding-manifest.js

@@ -0,0 +1,265 @@
+/** Bounded document configuration accepted from any consultant harness. */
+import { isRecord } from './utils.js';
+export const CONTENT_UNDERSTANDING_KIND = 'eai.content-understanding';
+export const CONTENT_UNDERSTANDING_API_VERSION = '2025-11-01';
+export const CONTENT_UNDERSTANDING_MAX_BYTES = 16 * 1024;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+export const CANONICAL_TENANT_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const TYPES = ['string', 'date', 'time', 'number', 'integer', 'boolean', 'array', 'object', 'json'];
+const METHODS = ['extract', 'generate', 'classify'];
+const FIELD_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+const BOOLEAN_CONFIG = ['enableOcr', 'enableLayout', 'enableFormula', 'enableFigureAnalysis', 'enableFigureDescription',
+    'returnDetails', 'estimateFieldSourceAndConfidence', 'omitContent', 'enableSegment', 'segmentPerPage'];
+const FORMAT_CONFIG = { tableFormat: ['html', 'markdown'], chartFormat: ['chartJs', 'markdown'], annotationFormat: ['markdown', 'none'] };
+export class ContentUnderstandingError extends Error {
+    code;
+    operationId;
+    status;
+    constructor(code, message, operationId, status) {
+        super(message);
+        this.code = code;
+        this.operationId = operationId;
+        this.status = status;
+        this.name = 'ContentUnderstandingError';
+    }
+}
+function invalid(path, message) {
+    throw new ContentUnderstandingError('CU_INVALID_MANIFEST', `${path}: ${message}`);
+}
+function unsupported(path, message) {
+    throw new ContentUnderstandingError('CU_CAPABILITY_UNSUPPORTED', `${path}: ${message}`);
+}
+function object(value, path) {
+    if (!isRecord(value))
+        invalid(path, 'must be an object.');
+    return value;
+}
+function keys(value, allowed, path) {
+    if (Object.keys(value).some(key => !allowed.includes(key)))
+        unsupported(path, 'contains an unsupported setting.');
+}
+function text(value, path, identifier = false) {
+    if (typeof value !== 'string' || value.length === 0)
+        invalid(path, 'must be a nonempty exact string.');
+    if (identifier && !IDENTIFIER.test(value))
+        invalid(path, 'must be a bounded stable identifier.');
+    return value;
+}
+function optionalText(value, names, path, maximum = 1024) {
+    for (const name of names)
+        if (value[name] !== undefined && (typeof value[name] !== 'string' || value[name].length > maximum))
+            invalid(`${path}.${name}`, 'must be a bounded string.');
+}
+function fieldName(value, path) {
+    if (!FIELD_NAME.test(value))
+        invalid(path, 'field names must be ASCII identifiers of at most 64 characters.');
+}
+/** RFC 8785 input must contain Unicode scalar values, including authored keys. */
+function scalarStrings(value) {
+    const pending = [value], visited = new Set();
+    const loneSurrogate = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (typeof current === 'string' && loneSurrogate.test(current))
+            invalid('manifest', 'strings and keys must contain valid Unicode scalar values.');
+        if (current && typeof current === 'object' && !visited.has(current)) {
+            visited.add(current);
+            for (const [key, child] of Object.entries(current))
+                pending.push(key, child);
+        }
+    }
+}
+/** Validates and normalizes the launch leaf schema without reading auth, profiles or provider endpoints. */
+export function parseContentUnderstandingAnalyzer(value) {
+    scalarStrings(value);
+    const definition = object(value, 'analyzerDefinition');
+    keys(definition, ['schemaVersion', 'baseAnalyzerId', 'description', 'modelProfile', 'config', 'fieldSchema'], 'analyzerDefinition');
+    if (definition.schemaVersion !== undefined && definition.schemaVersion !== 1)
+        unsupported('analyzerDefinition.schemaVersion', 'only version 1 is supported.');
+    if (definition.baseAnalyzerId !== undefined && definition.baseAnalyzerId !== 'prebuilt-document')
+        unsupported('analyzerDefinition.baseAnalyzerId', 'only prebuilt-document is supported.');
+    if (definition.modelProfile !== undefined && definition.modelProfile !== 'default')
+        unsupported('analyzerDefinition.modelProfile', 'only the configured default profile is supported.');
+    optionalText(definition, ['description'], 'analyzerDefinition');
+    const suppliedConfig = definition.config === undefined ? {} : object(definition.config, 'analyzerDefinition.config');
+    keys(suppliedConfig, [...BOOLEAN_CONFIG, ...Object.keys(FORMAT_CONFIG)], 'analyzerDefinition.config');
+    for (const name of BOOLEAN_CONFIG)
+        if (suppliedConfig[name] !== undefined && typeof suppliedConfig[name] !== 'boolean')
+            invalid(`config.${name}`, 'must be an exact boolean.');
+    for (const name of ['omitContent', 'enableSegment', 'segmentPerPage'])
+        if (suppliedConfig[name] === true)
+            unsupported(`config.${name}`, 'hierarchical routing, segmentation and omitted content are unavailable in this launch mode.');
+    for (const [name, values] of Object.entries(FORMAT_CONFIG))
+        if (suppliedConfig[name] !== undefined && (typeof suppliedConfig[name] !== 'string' || !values.includes(suppliedConfig[name])))
+            unsupported(`config.${name}`, 'unsupported output format.');
+    const config = { returnDetails: true, estimateFieldSourceAndConfidence: true, ...suppliedConfig };
+    const schema = object(definition.fieldSchema, 'fieldSchema');
+    keys(schema, ['name', 'description', 'fields', 'definitions'], 'fieldSchema');
+    optionalText(schema, ['name'], 'fieldSchema', 64);
+    optionalText(schema, ['description'], 'fieldSchema');
+    const fields = object(schema.fields, 'fieldSchema.fields');
+    if (Object.keys(fields).length === 0)
+        invalid('fieldSchema.fields', 'at least one field is required.');
+    const definitions = schema.definitions === undefined ? {} : object(schema.definitions, 'fieldSchema.definitions');
+    let expandedNodes = 0, classifyCategories = 0;
+    function validateField(input, path, depth, references = []) {
+        if (++expandedNodes > 200)
+            invalid(path, 'expanded field validation exceeds 200 nodes.');
+        if (depth > 7)
+            invalid(path, 'expanded field nesting exceeds 7.');
+        const original = object(input, path);
+        keys(original, ['$ref', 'type', 'method', 'description', 'examples', 'estimateSourceAndConfidence', 'properties', 'items', 'enum', 'enumDescriptions'], path);
+        const field = original;
+        if (field.$ref !== undefined) {
+            if (typeof field.$ref !== 'string' || !/^#\/definitions\/[^/~]+$/.test(field.$ref))
+                unsupported(path, 'only finite local definition references are supported.');
+            const name = field.$ref.slice('#/definitions/'.length);
+            fieldName(name, path);
+            if (!Object.hasOwn(definitions, name))
+                invalid(path, 'definition reference is unresolved.');
+            if (references.includes(name))
+                invalid(path, 'definition references must not contain cycles.');
+            if (Object.keys(field).some(key => !['$ref', 'description', 'estimateSourceAndConfidence'].includes(key)))
+                invalid(path, 'reference overlays support only description and evidence.');
+            const overlays = { ...original };
+            delete overlays.$ref;
+            validateField({ ...object(definitions[name], `${path}.$ref`), ...overlays }, `${path}.$ref`, depth, [...references, name]);
+            return;
+        }
+        if (typeof field.type !== 'string' || !TYPES.includes(field.type))
+            unsupported(path, 'unsupported or missing field type.');
+        if (field.method !== undefined && (typeof field.method !== 'string' || !METHODS.includes(field.method)))
+            unsupported(path, 'unsupported field method.');
+        optionalText(field, ['description'], path);
+        if (typeof field.description === 'string' && (field.description.includes('{{') || field.description.includes('}}')))
+            invalid(path, 'typed field descriptions cannot contain context templates.');
+        if (field.examples !== undefined && (!Array.isArray(field.examples) || field.examples.length > 100 || !field.examples.every(item => typeof item === 'string' && item.length <= 1024)))
+            invalid(path, 'examples must be strings.');
+        if (field.estimateSourceAndConfidence !== undefined && typeof field.estimateSourceAndConfidence !== 'boolean')
+            invalid(path, 'evidence estimation must be an exact boolean.');
+        if ((field.method ?? 'extract') === 'extract' && (field.estimateSourceAndConfidence ?? config.estimateFieldSourceAndConfidence) !== true)
+            invalid(path, 'extract fields require effective source and confidence estimation.');
+        if (field.method === 'classify') {
+            if (field.type !== 'string' || !Array.isArray(field.enum) || field.enum.length === 0 || field.enum.length > 200 || !field.enum.every(item => typeof item === 'string' && item.length > 0 && item.length <= 200)
+                || new Set(field.enum).size !== field.enum.length)
+                invalid(path, 'classify requires a string field and a nonempty unique string enum.');
+            classifyCategories += field.enum.length;
+            if (classifyCategories > 300)
+                invalid(path, 'expanded classify categories exceed 300.');
+            if (field.enumDescriptions !== undefined) {
+                const descriptions = object(field.enumDescriptions, `${path}.enumDescriptions`);
+                if (Object.keys(descriptions).length !== field.enum.length || !field.enum.every(item => Object.hasOwn(descriptions, item)))
+                    invalid(path, 'enum descriptions must match all enum values exactly.');
+                for (const description of Object.values(descriptions))
+                    if (typeof description !== 'string' || description.length > 1024)
+                        invalid(path, 'enum descriptions must be bounded strings.');
+            }
+        }
+        else if (field.enum !== undefined || field.enumDescriptions !== undefined)
+            invalid(path, 'enum settings require classify.');
+        if (field.type === 'object') {
+            const properties = object(field.properties, `${path}.properties`);
+            if (Object.keys(properties).length === 0)
+                invalid(path, 'objects require properties.');
+            for (const [name, child] of Object.entries(properties)) {
+                fieldName(name, `${path}.properties`);
+                validateField(child, `${path}.properties.${name}`, depth + 1, references);
+            }
+        }
+        else if (field.properties !== undefined)
+            invalid(path, 'properties require object type.');
+        if (field.type === 'array')
+            validateField(field.items, `${path}.items`, depth + 1, references);
+        else if (field.items !== undefined)
+            invalid(path, 'items require array type.');
+    }
+    for (const [name, field] of Object.entries(fields)) {
+        fieldName(name, 'fieldSchema.fields');
+        validateField(field, `fields.${name}`, 1);
+    }
+    for (const [name, field] of Object.entries(definitions)) {
+        fieldName(name, 'fieldSchema.definitions');
+        validateField(field, `definitions.${name}`, 1, [name]);
+    }
+    return { ...structuredClone(definition), schemaVersion: 1, baseAnalyzerId: 'prebuilt-document', modelProfile: 'default', config };
+}
+/** Reject unsupported constructs for the entire bundle before resolving any authenticated command context. */
+export function parseContentUnderstandingManifest(value) {
+    scalarStrings(value);
+    const manifest = object(value, 'manifest');
+    keys(manifest, ['kind', 'schemaVersion', 'tenantId', 'bundleKey', 'provider', 'apiVersion', 'binding', 'documentTypes', 'classifier'], 'manifest');
+    if (manifest.kind !== CONTENT_UNDERSTANDING_KIND || manifest.schemaVersion !== 1)
+        unsupported('manifest', 'unsupported kind or schema version.');
+    if ((!CANONICAL_TENANT_ID.test(text(manifest.tenantId, 'tenantId')) || manifest.tenantId === '00000000-0000-0000-0000-000000000000'))
+        invalid('tenantId', 'must be a canonical UUID.');
+    text(manifest.bundleKey, 'bundleKey', true);
+    if (manifest.provider !== 'azure-content-understanding' || manifest.apiVersion !== CONTENT_UNDERSTANDING_API_VERSION)
+        unsupported('manifest', 'only the Azure document GA provider contract is supported.');
+    const binding = object(manifest.binding, 'binding');
+    keys(binding, ['appKey', 'workflowKey', 'documentLifecycle'], 'binding');
+    text(binding.appKey, 'binding.appKey', true);
+    text(binding.workflowKey, 'binding.workflowKey', true);
+    if (binding.documentLifecycle !== 'business-document-v1')
+        unsupported('binding.documentLifecycle', 'only business-document-v1 is supported.');
+    if (!Array.isArray(manifest.documentTypes) || manifest.documentTypes.length === 0 || manifest.documentTypes.length > 64)
+        invalid('documentTypes', 'must be a nonempty array.');
+    const codes = new Set();
+    const documentTypes = manifest.documentTypes.map((input, index) => {
+        const path = `documentTypes[${index}]`, doc = object(input, path);
+        keys(doc, ['code', 'name', 'description', 'category', 'contentUnderstanding'], path);
+        const code = text(doc.code, `${path}.code`, true);
+        text(doc.name, `${path}.name`);
+        optionalText(doc, ['description'], path);
+        if (doc.name.length > 200)
+            invalid(path, 'document name exceeds 200 characters.');
+        if (doc.category !== undefined)
+            text(doc.category, `${path}.category`, true);
+        if (code === 'Other')
+            invalid(path, 'Other is reserved for manual review and cannot be a document type.');
+        if (codes.has(code))
+            invalid(path, 'document type codes must be unique.');
+        codes.add(code);
+        const cu = object(doc.contentUnderstanding, `${path}.contentUnderstanding`);
+        keys(cu, ['analyzerDefinition'], `${path}.contentUnderstanding`);
+        return { ...structuredClone(doc), contentUnderstanding: { analyzerDefinition: parseContentUnderstandingAnalyzer(cu.analyzerDefinition) } };
+    });
+    if (manifest.classifier !== undefined) {
+        const classifier = object(manifest.classifier, 'classifier');
+        keys(classifier, ['classifierKey', 'displayName', 'description', 'definition'], 'classifier');
+        text(classifier.classifierKey, 'classifier.classifierKey', true);
+        text(classifier.displayName, 'classifier.displayName');
+        optionalText(classifier, ['description'], 'classifier');
+        if (classifier.displayName.length > 200)
+            invalid('classifier.displayName', 'exceeds 200 characters.');
+        const definition = object(classifier.definition, 'classifier.definition');
+        keys(definition, ['labels', 'minimumConfidence'], 'classifier.definition');
+        if (!Array.isArray(definition.labels) || definition.labels.length < 2 || definition.labels.length > 64)
+            invalid('classifier.definition.labels', 'flat classifiers require 2 to 64 labels.');
+        const labels = new Set();
+        for (const input of definition.labels) {
+            const label = object(input, 'classifier.definition.labels');
+            keys(label, ['key', 'displayName', 'description', 'documentTypeKey'], 'classifier.definition.labels');
+            const key = text(label.key, 'classifier.label.key', true);
+            if (labels.has(key))
+                invalid('classifier.definition.labels', 'label keys must be unique.');
+            labels.add(key);
+            text(label.displayName, 'classifier.label.displayName');
+            text(label.description, 'classifier.label.description');
+            text(label.documentTypeKey, 'classifier.label.documentTypeKey', true);
+            if (label.displayName.length > 200 || label.description.length > 1024)
+                invalid('classifier.label', 'display name or description exceeds its bound.');
+            if (key === 'Other' && label.documentTypeKey !== 'Other')
+                invalid('classifier.label', 'Other must route to the reserved manual review target Other.');
+            if (key !== 'Other' && !codes.has(label.documentTypeKey))
+                invalid('classifier.label', 'each non-Other label must reference a leaf in this bundle.');
+        }
+        if (definition.minimumConfidence !== undefined && (typeof definition.minimumConfidence !== 'number' || !Number.isFinite(definition.minimumConfidence) || definition.minimumConfidence < 0 || definition.minimumConfidence > 1))
+            invalid('classifier.minimumConfidence', 'must be between 0 and 1.');
+    }
+    const normalized = { ...structuredClone(manifest), documentTypes };
+    const snapshots = Object.fromEntries(documentTypes.map(doc => [doc.code, doc.contentUnderstanding.analyzerDefinition]));
+    if (Buffer.byteLength(JSON.stringify(snapshots), 'utf8') > CONTENT_UNDERSTANDING_MAX_BYTES)
+        invalid('manifest', 'combined leaf snapshots exceed the 16 KiB admission budget.');
+    return normalized;
+}
+//# sourceMappingURL=content-understanding-manifest.js.map

package/dist/lib/content-understanding-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-understanding-manifest.js","sourceRoot":"","sources":["../../src/lib/content-understanding-manifest.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AACtE,MAAM,CAAC,MAAM,iCAAiC,GAAG,YAAY,CAAC;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,CAAC;AACzD,MAAM,UAAU,GAAG,oCAAoC,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,gEAAgE,CAAC;AACpG,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACpG,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,sBAAsB,EAAE,yBAAyB;IACrH,eAAe,EAAE,kCAAkC,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AACzG,MAAM,aAAa,GAAsC,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;AAE7K,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAAwC;IAA+B;IAA5F,YAAqB,IAAY,EAAE,OAAe,EAAW,WAAoB,EAAW,MAAe;QACzG,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAQ;QAA4B,gBAAW,GAAX,WAAW,CAAS;QAAW,WAAM,GAAN,MAAM,CAAS;QACzF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1D,CAAC;CACF;AAoBD,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,MAAM,IAAI,yBAAyB,CAAC,qBAAqB,EAAE,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;AACpF,CAAC;AACD,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,EAAE,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;AAC1F,CAAC;AACD,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,IAAI,CAAC,KAA8B,EAAE,OAA0B,EAAE,IAAY;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;AACpH,CAAC;AACD,SAAS,IAAI,CAAC,KAAc,EAAE,IAAY,EAAE,UAAU,GAAG,KAAK;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;IACvG,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,YAAY,CAAC,KAA8B,EAAE,KAAwB,EAAE,IAAY,EAAE,OAAO,GAAG,IAAI;IAC1G,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;AACxL,CAAC;AACD,SAAS,SAAS,CAAC,KAAa,EAAE,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,iEAAiE,CAAC,CAAC;AAChH,CAAC;AACD,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,OAAO,GAAc,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAChE,MAAM,aAAa,GAAG,yEAAyE,CAAC;IAChG,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,UAAU,EAAE,4DAA4D,CAAC,CAAC;QAClJ,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACpI,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC;QAAE,WAAW,CAAC,kCAAkC,EAAE,8BAA8B,CAAC,CAAC;IAC9J,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,IAAI,UAAU,CAAC,cAAc,KAAK,mBAAmB;QAAE,WAAW,CAAC,mCAAmC,EAAE,sCAAsC,CAAC,CAAC;IAC3L,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS,IAAI,UAAU,CAAC,YAAY,KAAK,SAAS;QAAE,WAAW,CAAC,iCAAiC,EAAE,mDAAmD,CAAC,CAAC;IACxL,YAAY,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACrH,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACtG,KAAK,MAAM,IAAI,IAAI,cAAc;QAAE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAC/K,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,CAAC;QAAE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,WAAW,CAAC,UAAU,IAAI,EAAE,EAAE,6FAA6F,CAAC,CAAC;IACvO,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAW,CAAC,CAAC;YAAE,WAAW,CAAC,UAAU,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;IAClQ,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IAAC,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAAC,YAAY,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IACvL,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,oBAAoB,EAAE,iCAAiC,CAAC,CAAC;IACvG,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAClH,IAAI,aAAa,GAAG,CAAC,EAAE,kBAAkB,GAAG,CAAC,CAAC;IAC9C,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY,EAAE,KAAa,EAAE,aAAgC,EAAE;QACpG,IAAI,EAAE,aAAa,GAAG,GAAG;YAAE,OAAO,CAAC,IAAI,EAAE,8CAA8C,CAAC,CAAC;QACzF,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,6BAA6B,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9J,MAAM,KAAK,GAAG,QAAQ,CAAC;QACvB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,WAAW,CAAC,IAAI,EAAE,wDAAwD,CAAC,CAAC;YAChK,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACvD,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;YAC5F,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAC;YAC/F,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,2DAA2D,CAAC,CAAC;YACtL,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC,IAAI,CAAC;YACvD,aAAa,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC;QAC3H,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAE,WAAW,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QACxJ,YAAY,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,4DAA4D,CAAC,CAAC;QACjM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QAClO,IAAI,KAAK,CAAC,2BAA2B,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,2BAA2B,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,EAAE,+CAA+C,CAAC,CAAC;QAC9K,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,2BAA2B,IAAI,MAAM,CAAC,gCAAgC,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAC;QAC9N,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC;mBAC1M,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,EAAE,qEAAqE,CAAC,CAAC;YAC1I,kBAAkB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACxC,IAAI,kBAAkB,GAAG,GAAG;gBAAE,OAAO,CAAC,IAAI,EAAE,0CAA0C,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACzC,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC;gBAChF,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;oBAAE,OAAO,CAAC,IAAI,EAAE,uDAAuD,CAAC,CAAC;gBACnM,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;oBAAE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,IAAI;wBAAE,OAAO,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAC;YACvL,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;QAC9H,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;YACvF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;gBAAC,aAAa,CAAC,KAAK,EAAE,GAAG,IAAI,eAAe,IAAI,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;YAAC,CAAC;QAC/K,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,EAAE,iCAAiC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;aAC1F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAAC,aAAa,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACzI,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAAC,aAAa,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAChK,OAAO,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACpI,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;IACnJ,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC;QAAE,WAAW,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;IACjJ,IAAI,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,KAAK,sCAAsC,CAAC;QAAE,OAAO,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;IACvL,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,QAAQ,KAAK,6BAA6B,IAAI,QAAQ,CAAC,UAAU,KAAK,iCAAiC;QAAE,WAAW,CAAC,UAAU,EAAE,4DAA4D,CAAC,CAAC;IAC5M,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,mBAAmB,CAAC,EAAE,SAAS,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IAC/K,IAAI,OAAO,CAAC,iBAAiB,KAAK,sBAAsB;QAAE,WAAW,CAAC,2BAA2B,EAAE,yCAAyC,CAAC,CAAC;IAC9I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IAC/K,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,iBAAiB,KAAK,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5H,IAAK,GAAG,CAAC,IAAe,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAC;QAC1G,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,EAAE,qCAAqC,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;QAC9I,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,oBAAoB,EAAE,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAiD,CAAC;IAC5L,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;QAC9F,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAAC,YAAY,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;QAClL,IAAK,UAAU,CAAC,WAAsB,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;QAClH,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;QAAC,IAAI,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACtJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC;QAC5L,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,CAAC;YACnK,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,sBAAsB,EAAE,IAAI,CAAC,CAAC;YAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,kCAAkC,EAAE,IAAI,CAAC,CAAC;YACxL,IAAK,KAAK,CAAC,WAAsB,CAAC,MAAM,GAAG,GAAG,IAAK,KAAK,CAAC,WAAsB,CAAC,MAAM,GAAG,IAAI;gBAAE,OAAO,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;YAC7K,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO;gBAAE,OAAO,CAAC,kBAAkB,EAAE,8DAA8D,CAAC,CAAC;YACtJ,IAAI,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,eAAyB,CAAC;gBAAE,OAAO,CAAC,kBAAkB,EAAE,4DAA4D,CAAC,CAAC;QAChK,CAAC;QACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,OAAO,UAAU,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,iBAAiB,GAAG,CAAC,IAAI,UAAU,CAAC,iBAAiB,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,8BAA8B,EAAE,0BAA0B,CAAC,CAAC;IACtS,CAAC;IACD,MAAM,UAAU,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,EAAE,aAAa,EAA6C,CAAC;IAC9G,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,+BAA+B;QAAE,OAAO,CAAC,UAAU,EAAE,6DAA6D,CAAC,CAAC;IAC/K,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/lib/context.d.ts

@@ -6,6 +6,7 @@ import type { Ora } from 'ora';
 import { PlatformAPIClient } from './api.js';
 import { type TenantMembership } from './tenant-context.js';
 import type { StoredTokens } from './auth.js';
+import { ErrorCode } from './error-codes.js';
 export interface CommandContext {
     root: string;
     publicApiUrl: string;
@@ -29,6 +30,8 @@ export declare function resolveCommandContext(options?: {
     validatePublicApiUrl?: (url: string) => string;
     publicApiUrl?: string;
     pinPublicApiUrl?: boolean;
+    /** Let an owning command retain operation identity instead of exiting here. */
+    onError?: (code: ErrorCode, message?: string) => never;
 }): Promise<CommandContext>;
 /**
  * Normalise the output format — collapses the `--json` shorthand flag into `--format`.

package/dist/lib/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/lib/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAIL,KAAK,gBAAgB,EAGtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG9C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiD1B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAGvE"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/lib/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAML,KAAK,gBAAgB,EAGtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,SAAS,EAA+B,MAAM,kBAAkB,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC;CACxD,GAAG,OAAO,CAAC,cAAc,CAAC,CA2D1B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAGvE"}

package/dist/lib/context.js

@@ -5,8 +5,8 @@
 import ora from 'ora';
 import { findProjectRoot } from './config.js';
 import { PlatformAPIClient } from './api.js';
-import { resolvePublicApiUrl, resolveActiveTenantContext, TenantMembershipAuthError, } from './tenant-context.js';
-import { ErrorCode, exitWithError } from './error-codes.js';
+import { resolvePublicApiUrl, resolveActiveTenantContext, TenantMembershipAuthError, TenantLoginRequiredError, TenantAuthConfigMismatchError, } from './tenant-context.js';
+import { ErrorCode, errorCatalog, exitWithError } from './error-codes.js';
 /**
  * Resolve the full command context needed by every authenticated command.
  *
@@ -16,6 +16,7 @@ import { ErrorCode, exitWithError } from './error-codes.js';
 export async function resolveCommandContext(options) {
     const root = await findProjectRoot();
     if (!root) {
+        options?.onError?.(ErrorCode.E001);
         exitWithError(ErrorCode.E001);
     }
     const requestPolicy = options?.validatePublicApiUrl
@@ -39,9 +40,18 @@ export async function resolveCommandContext(options) {
         });
     }
     catch (error) {
+        if (error instanceof TenantLoginRequiredError) {
+            options?.onError?.(ErrorCode.E101);
+            exitWithError(ErrorCode.E101);
+        }
         if (error instanceof TenantMembershipAuthError) {
+            options?.onError?.(ErrorCode.E102);
             exitWithError(ErrorCode.E102);
         }
+        if (error instanceof TenantAuthConfigMismatchError) {
+            options?.onError?.(ErrorCode.E104, errorCatalog[ErrorCode.E104].message.replace('{details}', error.safeMessage));
+            exitWithError(ErrorCode.E104, { details: error.safeMessage });
+        }
         throw error;
     }
     const contextPublicApiUrl = options?.validatePublicApiUrl

package/dist/lib/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/lib/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,GAI1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAa5D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAO3C;IACC,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,aAAa,GAAuC,OAAO,EAAE,oBAAoB;QACrF,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAClE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,oBAAoB,GAAG,OAAO,EAAE,YAAY;WAC7C,MAAM,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,EAAE,oBAAoB;QAChD,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;QACpD,CAAC,CAAC,oBAAoB,CAAC;IACzB,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,0BAA0B,CAAC;YACzC,WAAW,EAAE,IAAI;YACjB,YAAY;YACZ,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;YACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,aAAa;YACb,eAAe,EAAE,OAAO,EAAE,eAAe;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,EAAE,oBAAoB;QACvD,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE;QACjF,qBAAqB,EAAE,aAAa,EAAE,QAAQ;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,mBAAmB;QACjC,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;QACjC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA4C;IAC1E,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IACzD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/lib/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,GAI9B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAa1E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAS3C;IACC,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,aAAa,GAAuC,OAAO,EAAE,oBAAoB;QACrF,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;QAClE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,oBAAoB,GAAG,OAAO,EAAE,YAAY;WAC7C,MAAM,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,EAAE,oBAAoB;QAChD,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,CAAC;QACpD,CAAC,CAAC,oBAAoB,CAAC;IACzB,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,0BAA0B,CAAC;YACzC,WAAW,EAAE,IAAI;YACjB,YAAY;YACZ,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;YACzC,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,YAAY,EAAE,OAAO,EAAE,YAAY;YACnC,aAAa;YACb,eAAe,EAAE,OAAO,EAAE,eAAe;SAC1C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACjH,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,EAAE,oBAAoB;QACvD,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC;QACpD,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE;QACjF,qBAAqB,EAAE,aAAa,EAAE,QAAQ;KAC/C,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,mBAAmB;QACjC,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;QACjC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA4C;IAC1E,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,OAAe;IACzD,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC"}

package/dist/lib/eai-managed-source-client-types.d.ts

@@ -15,17 +15,60 @@ export interface CliManagedSourceOperation extends CliManagedSourceScope {
     status: "accepted" | "publishing" | "pending_review" | "deploying" | "handoff_pending" | "completed" | "failed";
     githubLinkSessionId?: string;
     templateCommitSha: string;
-    bundleSha256: string;
+    bundleSha256?: string;
+    sourceProvenance?: {
+        kind: 'customer-merged-commit';
+        commitSha: string;
+        treeSha: string;
+        providerProofDigest: string;
+        predecessorReachable: true;
+        pullRequest: {
+            number: number;
+            headBranch: string;
+            baseBranch: string;
+            headSha: string;
+            baseSha: string;
+            mergedCommitSha: string;
+            mergedAt: string;
+        };
+        checks: {
+            name: string;
+            headSha: string;
+            conclusion: 'success';
+            runId: number;
+        }[];
+        providerReviews: {
+            id: number;
+            state: string;
+            commitSha: string;
+            userId: number;
+        }[];
+    };
+    customerAuthorization?: {
+        kind: 'authenticated-exact-commit';
+        actorId: string;
+        githubUserId: number;
+        pullRequestNumber: number;
+        mergedCommitSha: string;
+        authorizedAt: string;
+    };
     configHash: string;
     bundleSchemaVersion?: 'eai.cli_managed_source_bundle.v1' | 'eai.cli_managed_source_bundle.v2';
     reviewRepair?: CliManagedSourceReviewRepair;
     verifiedGithubUser: NonNullable<CliManagedGithubLinkSession["verifiedGithubUser"]>;
+    repositoryAuthority?: "eai-managed" | "customer-owned";
+    predecessor?: {
+        operationId: string;
+        integrityHash: string;
+        mergedCommitSha: string;
+    };
     repository: {
         owner: string;
         name: string;
         id?: number;
         nodeId?: string;
         defaultBranch?: string;
+        installationId?: string;
         private?: boolean;
     };
     review?: {

package/dist/lib/eai-managed-source-client-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eai-managed-source-client-types.d.ts","sourceRoot":"","sources":["../../src/lib/eai-managed-source-client-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,UAAU,CAAC;AAElB,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+GAA+G;AAC/G,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,aAAa,EAAE,qCAAqC,CAAC;IACrD,UAAU,EAAE,mBAAmB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EACF,UAAU,GACV,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,iBAAiB,GACjB,WAAW,GACX,QAAQ,CAAC;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,kCAAkC,GAAG,kCAAkC,CAAC;IAC9F,YAAY,CAAC,EAAE,4BAA4B,CAAC;IAC5C,kBAAkB,EAAE,WAAW,CAC7B,2BAA2B,CAAC,oBAAoB,CAAC,CAClD,CAAC;IACF,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,uEAAuE;QACvE,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,6DAA6D;QAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9D,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,eAAe,CAAA;KAAE,CAAC;CACxG;AAED,8GAA8G;AAC9G,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,yCAAyC,GAAG,yCAAyC,CAAC;IACrG,MAAM,EAAE,mCAAmC,GAAG,oCAAoC,CAAC;IACnF,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,2BAA2B,EAAE,MAAM,CAAC;IACpC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC"}
+{"version":3,"file":"eai-managed-source-client-types.d.ts","sourceRoot":"","sources":["../../src/lib/eai-managed-source-client-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,UAAU,CAAC;AAElB,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,2BAA2B,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+GAA+G;AAC/G,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE,aAAa,EAAE,qCAAqC,CAAC;IACrD,UAAU,EAAE,mBAAmB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EACF,UAAU,GACV,YAAY,GACZ,gBAAgB,GAChB,WAAW,GACX,iBAAiB,GACjB,WAAW,GACX,QAAQ,CAAC;IACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QACjB,IAAI,EAAE,wBAAwB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAC;QAChG,oBAAoB,EAAE,IAAI,CAAC;QAC3B,WAAW,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACrJ,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,SAAS,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClF,eAAe,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACrF,CAAC;IACF,qBAAqB,CAAC,EAAE;QACtB,IAAI,EAAE,4BAA4B,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAC1E,iBAAiB,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;KAC1E,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,kCAAkC,GAAG,kCAAkC,CAAC;IAC9F,YAAY,CAAC,EAAE,4BAA4B,CAAC;IAC5C,kBAAkB,EAAE,WAAW,CAC7B,2BAA2B,CAAC,oBAAoB,CAAC,CAClD,CAAC;IACF,mBAAmB,CAAC,EAAE,aAAa,GAAG,gBAAgB,CAAC;IACvD,WAAW,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,uEAAuE;QACvE,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,6DAA6D;QAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9D,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,eAAe,CAAA;KAAE,CAAC;CACxG;AAED,8GAA8G;AAC9G,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,yCAAyC,GAAG,yCAAyC,CAAC;IACrG,MAAM,EAAE,mCAAmC,GAAG,oCAAoC,CAAC;IACnF,cAAc,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,2BAA2B,EAAE,MAAM,CAAC;IACpC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC"}

package/dist/lib/eai-managed-source-operation-client.d.ts

@@ -9,6 +9,9 @@ export interface ExpectedCliManagedSourceOperation {
     bundleSchemaVersion?: CliManagedSourceOperation['bundleSchemaVersion'];
     githubLinkSessionId?: string;
     verifiedGithubUser?: CliManagedSourceOperation["verifiedGithubUser"];
+    sourceKind?: 'bundle' | 'customer-merged-commit';
+    sourceProvenance?: CliManagedSourceOperation['sourceProvenance'];
+    customerAuthorization?: CliManagedSourceOperation['customerAuthorization'];
 }
 /** Repeat submission of the same actor-scoped source snapshot cannot create duplicate bot publications. */
 export declare function cliManagedSourceIdempotencyKey(scope: CliManagedSourceScope, bundleSha256: string): string;

package/dist/lib/eai-managed-source-operation-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eai-managed-source-operation-client.d.ts","sourceRoot":"","sources":["../../src/lib/eai-managed-source-operation-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAiC,MAAM,UAAU,CAAC;AAG5E,OAAO,KAAK,EACV,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;CACtE;AAED,2GAA2G;AAC3G,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,MAAM,GACnB,MAAM,CAkBR;AAED,gGAAgG;AAChG,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,KAAK,EAAE,qBAAqB,EAC5B,QAAQ,CAAC,EAAE,iCAAiC,GAC3C,yBAAyB,CA2F3B;AAED,sGAAsG;AACtG,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,yBAAyB,GACnC,SAAS,GAAG,QAAQ,GAAG,YAAY,CAIrC;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,yBAAyB,CAAC,CAQpC;AAED,yFAAyF;AACzF,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,CAAC,EAAE,yBAAyB,EACnC,YAAY,GAAE;IAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAC3D,OAAO,CAAC,yBAAyB,CAAC,CAgEpC"}
+{"version":3,"file":"eai-managed-source-operation-client.d.ts","sourceRoot":"","sources":["../../src/lib/eai-managed-source-operation-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAiC,MAAM,UAAU,CAAC;AAG5E,OAAO,KAAK,EACV,yBAAyB,EACzB,qBAAqB,EACtB,MAAM,sCAAsC,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,yBAAyB,CAAC,oBAAoB,CAAC,CAAC;IACrE,UAAU,CAAC,EAAE,QAAQ,GAAG,wBAAwB,CAAC;IACjD,gBAAgB,CAAC,EAAE,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;IACjE,qBAAqB,CAAC,EAAE,yBAAyB,CAAC,uBAAuB,CAAC,CAAC;CAC5E;AAED,2GAA2G;AAC3G,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,qBAAqB,EAC5B,YAAY,EAAE,MAAM,GACnB,MAAM,CAkBR;AAED,gGAAgG;AAChG,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,KAAK,EAAE,qBAAqB,EAC5B,QAAQ,CAAC,EAAE,iCAAiC,GAC3C,yBAAyB,CAuJ3B;AAED,sGAAsG;AACtG,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,yBAAyB,GACnC,SAAS,GAAG,QAAQ,GAAG,YAAY,CAIrC;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,yBAAyB,CAAC,CAQpC;AAED,yFAAyF;AACzF,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7C,OAAO,CAAC,EAAE,yBAAyB,EACnC,YAAY,GAAE;IAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GAC3D,OAAO,CAAC,yBAAyB,CAAC,CAsEpC"}

package/dist/lib/eai-managed-source-operation-client.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { readManagedPublicResponseText } from "./api.js";
 import { CLI_MANAGED_SOURCE_LIMITS, ManagedSourceError, isManagedAppSourcePath } from "./eai-managed-source.js";
 import { CLI_MANAGED_SOURCE_OPERATION_ID } from "./eai-managed-identifiers.js";
@@ -22,11 +23,70 @@ export function cliManagedSourceIdempotencyKey(scope, bundleSha256) {
 }
 /** Every readback must retain the original actor, runtime scope and immutable source digest. */
 export function validateCliManagedSourceOperation(value, scope, expected) {
+    const provenance = value?.sourceProvenance;
+    const authorization = value?.customerAuthorization;
+    const customerCommit = provenance?.kind === 'customer-merged-commit';
+    if (provenance !== undefined || authorization !== undefined) {
+        if (!customerCommit || !authorization || authorization.kind !== 'authenticated-exact-commit'
+            || !['deploying', 'handoff_pending', 'completed', 'failed'].includes(value.status)
+            || value.repositoryAuthority !== 'customer-owned' || !value.predecessor
+            || value.bundleSha256 !== undefined || value.bundleSchemaVersion !== undefined
+            || value.upload !== undefined || value.reviewRepair !== undefined
+            || Object.keys(authorization).sort().join(',') !== 'actorId,authorizedAt,githubUserId,kind,mergedCommitSha,pullRequestNumber'
+            || Object.keys(provenance).sort().join(',') !== 'checks,commitSha,kind,predecessorReachable,providerProofDigest,providerReviews,pullRequest,treeSha'
+            || typeof provenance.commitSha !== 'string' || typeof provenance.treeSha !== 'string'
+            || typeof provenance.providerProofDigest !== 'string' || typeof authorization.authorizedAt !== 'string'
+            || !/^[a-f0-9]{40}$/.test(provenance.commitSha) || !/^[a-f0-9]{40}$/.test(provenance.treeSha)
+            || !/^sha256:[a-f0-9]{64}$/.test(provenance.providerProofDigest) || provenance.predecessorReachable !== true
+            || provenance.commitSha === value.predecessor.mergedCommitSha
+            || authorization.actorId !== scope.actorId || authorization.githubUserId !== value.verifiedGithubUser?.id
+            || authorization.pullRequestNumber !== provenance.pullRequest?.number
+            || authorization.mergedCommitSha !== provenance.commitSha
+            || !Number.isFinite(Date.parse(authorization.authorizedAt))
+            || !provenance.pullRequest || !Number.isSafeInteger(provenance.pullRequest.number) || provenance.pullRequest.number < 1
+            || Object.keys(provenance.pullRequest).sort().join(',') !== 'baseBranch,baseSha,headBranch,headSha,mergedAt,mergedCommitSha,number'
+            || typeof provenance.pullRequest.headBranch !== 'string' || !provenance.pullRequest.headBranch
+            || typeof provenance.pullRequest.mergedAt !== 'string'
+            || provenance.pullRequest.mergedCommitSha !== provenance.commitSha
+            || provenance.pullRequest.baseBranch !== value.repository?.defaultBranch
+            || !/^[a-f0-9]{40}$/.test(provenance.pullRequest.headSha) || !/^[a-f0-9]{40}$/.test(provenance.pullRequest.baseSha)
+            || !Number.isFinite(Date.parse(provenance.pullRequest.mergedAt))
+            || value.review?.mergedCommitSha !== provenance.commitSha || value.review?.workflowRunId !== undefined
+            || value.review?.number !== provenance.pullRequest.number || value.review?.headSha !== provenance.pullRequest.headSha
+            || value.review?.headBranch !== provenance.pullRequest.headBranch || value.review?.baseSha !== provenance.pullRequest.baseSha
+            || !Array.isArray(provenance.checks) || provenance.checks.length < 1 || provenance.checks.length > 100
+            || new Set(provenance.checks.map(check => check.runId)).size !== provenance.checks.length
+            || provenance.checks.some(check => !check || check.headSha !== provenance.pullRequest.headSha
+                || Object.keys(check).sort().join(',') !== 'conclusion,headSha,name,runId'
+                || check.conclusion !== 'success' || !Number.isSafeInteger(check.runId) || check.runId < 1
+                || typeof check.name !== 'string' || !check.name)
+            || !Array.isArray(provenance.providerReviews) || provenance.providerReviews.length > 100
+            || provenance.providerReviews.some(review => !review || !Number.isSafeInteger(review.id) || review.id < 1
+                || Object.keys(review).sort().join(',') !== 'commitSha,id,state,userId'
+                || !Number.isSafeInteger(review.userId) || review.userId < 1 || !/^[a-f0-9]{40}$/.test(review.commitSha)
+                || !['APPROVED', 'CHANGES_REQUESTED', 'COMMENTED', 'DISMISSED', 'PENDING'].includes(review.state))) {
+            throw new ManagedSourceError('MANAGED_SOURCE_BINDING_MISMATCH', 'Customer commit does not retain exact consent and provider provenance.');
+        }
+    }
+    const customerRepository = value?.repositoryAuthority === "customer-owned"
+        && value.repository?.private === true
+        && /^[a-z\d][a-z\d-]{0,38}$/i.test(value.repository.owner)
+        && value.repository.owner.toLowerCase() !== "eai-generated-apps"
+        && Number.isSafeInteger(value.repository.id) && (value.repository.id ?? 0) > 0
+        && typeof value.repository.nodeId === "string" && value.repository.nodeId.length > 0
+        && typeof value.repository.defaultBranch === "string" && value.repository.defaultBranch.length > 0
+        && /^[1-9][0-9]*$/.test(value.repository.installationId ?? "")
+        && /^cli-managed-[a-f0-9]{32}$/.test(value.predecessor?.operationId ?? "")
+        && /^sha256:[a-f0-9]{64}$/.test(value.predecessor?.integrityHash ?? "")
+        && /^[a-f0-9]{40}$/.test(value.predecessor?.mergedCommitSha ?? "");
     if (!value ||
         value.schemaVersion !== "eai.cli_managed_source_operation.v1" ||
         value.sourceMode !== "eai-cli-generated" ||
         !CLI_MANAGED_SOURCE_OPERATION_ID.test(value.operationId) ||
         (expected?.operationId && value.operationId !== expected.operationId) ||
+        (expected?.sourceKind && expected.sourceKind !== (customerCommit ? 'customer-merged-commit' : 'bundle')) ||
+        (expected?.sourceProvenance && !isDeepStrictEqual(expected.sourceProvenance, provenance)) ||
+        (expected?.customerAuthorization && !isDeepStrictEqual(expected.customerAuthorization, authorization)) ||
         value.actorId !== scope.actorId ||
         !scope.actorId ||
         value.tenantId !== scope.tenantId ||
@@ -34,7 +94,7 @@ export function validateCliManagedSourceOperation(value, scope, expected) {
         value.targetTenantId !== scope.targetTenantId ||
         value.environment !== scope.environment ||
         !/^[a-f0-9]{40}$/.test(value.templateCommitSha) ||
-        !/^sha256:[a-f0-9]{64}$/.test(value.bundleSha256) ||
+        (!customerCommit && !/^sha256:[a-f0-9]{64}$/.test(value.bundleSha256 ?? '')) ||
         !/^sha256:[a-f0-9]{64}$/.test(value.configHash) ||
         (expected?.templateCommitSha &&
             value.templateCommitSha !== expected.templateCommitSha) ||
@@ -53,7 +113,8 @@ export function validateCliManagedSourceOperation(value, scope, expected) {
             "completed",
             "failed",
         ].includes(value.status) ||
-        value.repository?.owner !== "eai-generated-apps" ||
+        !((value.repositoryAuthority === undefined || value.repositoryAuthority === "eai-managed")
+            && value.repository?.owner === "eai-generated-apps") && !customerRepository ||
         !/^[A-Za-z0-9_.-]+$/.test(value.repository?.name || "") ||
         value.verifiedGithubUser?.actorId !== scope.actorId ||
         !Number.isSafeInteger(value.verifiedGithubUser?.id) ||
@@ -141,6 +202,9 @@ export async function pollCliManagedSource(client, scope, operationId, options,
         configHash: initial?.configHash,
         githubLinkSessionId: initial?.githubLinkSessionId,
         verifiedGithubUser: initial?.verifiedGithubUser,
+        sourceKind: initial ? (initial.sourceProvenance ? 'customer-merged-commit' : 'bundle') : undefined,
+        sourceProvenance: initial?.sourceProvenance,
+        customerAuthorization: initial?.customerAuthorization,
     };
     while (true) {
         if (!operation) {
@@ -155,6 +219,9 @@ export async function pollCliManagedSource(client, scope, operationId, options,
         expected.configHash = operation.configHash;
         expected.githubLinkSessionId = operation.githubLinkSessionId;
         expected.verifiedGithubUser = operation.verifiedGithubUser;
+        expected.sourceKind = operation.sourceProvenance ? 'customer-merged-commit' : 'bundle';
+        expected.sourceProvenance = operation.sourceProvenance;
+        expected.customerAuthorization = operation.customerAuthorization;
         if (!options.wait ||
             classifyCliManagedSourceOperation(operation) !== "pending" ||
             operation.status === "pending_review" ||