npm - @knpkv/control-center - Versions diffs - 0.1.0 - Mend

@knpkv/control-center 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (664) hide show

package/dist/server/server/cli.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"cli.js","names":[],"sources":["../../../src/server/cliArguments.ts","../../../src/server/cliConfiguration.ts","../../../src/server/observability.ts","../../../src/server/cli.ts"],"sourcesContent":["/** Supported top-level CLI invocation after Node removes executable and script arguments. */\nexport type ControlCenterCliInvocation =\n | { readonly _tag: \"serve\" }\n | { readonly _tag: \"recover-owner\" }\n | { readonly _tag: \"backup\"; readonly archiveRoot: string }\n | { readonly _tag: \"verify-backup\"; readonly archiveRoot: string }\n | { readonly _tag: \"restore\"; readonly archiveRoot: string }\n | { readonly _tag: \"invalid\"; readonly command: string }\n\n/** Classify the exact supported CLI argument shapes without accepting trailing arguments. */\nexport const classifyControlCenterCliArguments = (\n arguments_: ReadonlyArray<string>\n): ControlCenterCliInvocation => {\n if (arguments_.length === 0) return { _tag: \"serve\" }\n if (arguments_.length === 1 && arguments_[0] === \"recover-owner\") {\n return { _tag: \"recover-owner\" }\n }\n const archiveRoot = arguments_[1]\n if (arguments_.length === 2 && archiveRoot !== undefined && archiveRoot !== \"\") {\n if (arguments_[0] === \"backup\") return { _tag: \"backup\", archiveRoot }\n if (arguments_[0] === \"verify-backup\") {\n return { _tag: \"verify-backup\", archiveRoot }\n }\n if (arguments_[0] === \"restore\") return { _tag: \"restore\", archiveRoot }\n }\n return { _tag: \"invalid\", command: arguments_.join(\" \") }\n}\n","import * as Crypto from \"effect/Crypto\"\nimport * as Effect from \"effect/Effect\"\nimport * as Encoding from \"effect/Encoding\"\nimport * as FileSystem from \"effect/FileSystem\"\nimport * as Option from \"effect/Option\"\nimport * as Path from \"effect/Path\"\nimport * as Predicate from \"effect/Predicate\"\nimport * as Result from \"effect/Result\"\n\nimport {\n boundDataRootMarkerContent as boundMarkerContent,\n type ControlCenterDataPaths,\n DATA_ROOT_DIRECTORY_MODE,\n DATA_ROOT_MARKER_MAX_BYTES,\n DATA_ROOT_MARKER_MODE,\n DATA_ROOT_MARKER_NAME,\n DATA_ROOT_MARKER_V1_CONTENT,\n DATA_ROOT_MARKER_V2_PREFIX,\n DATA_ROOT_PENDING_MARKER_PREFIX,\n DATA_ROOT_STAGING_PREFIX,\n decodeControlCenterDataPaths,\n decodeOperationalDataPaths,\n type FreshDataRootClaimConflict,\n inspectFreshDataRootClaim,\n publishDataRootMarker,\n publishFreshDataRootClaim,\n type StagedDataRootWriter,\n syncDataRootPath\n} from \"./DataRootProtocol.js\"\nimport { validateExistingControlCenterDatabase } from \"./persistence/Database.js\"\nimport { PersistenceConfigError } from \"./persistence/errors.js\"\n\n/** Validated filesystem paths derived from the untrusted data-root environment value. */\nexport { decodeControlCenterDataPaths }\nexport type { ControlCenterDataPaths }\n\nconst DATA_ROOT_OWNER_PROBE_PREFIX = \".control-center-owner-\"\nconst SQLITE_HEADER = Uint8Array.from([\n 0x53,\n 0x51,\n 0x4c,\n 0x69,\n 0x74,\n 0x65,\n 0x20,\n 0x66,\n 0x6f,\n 0x72,\n 0x6d,\n 0x61,\n 0x74,\n 0x20,\n 0x33,\n 0x00\n])\n\nconst hasNoControlCharacters = (value: string): boolean =>\n Array.from(value).every((character) => {\n const codePoint = character.codePointAt(0)\n return (\n codePoint !== undefined && !((codePoint >= 0 && codePoint <= 0x1f) || (codePoint >= 0x7f && codePoint <= 0x9f))\n )\n })\n\nconst hasRandomHexSuffix = (entry: string, prefix: string): boolean => {\n if (!entry.startsWith(prefix)) return false\n const suffix = entry.slice(prefix.length)\n return suffix.length === 32 && Array.from(suffix).every((character) => /[0-9a-f]/u.test(character))\n}\n\nconst configurationError = (): PersistenceConfigError =>\n new PersistenceConfigError({\n message: \"Control Center data root must identify a private, dedicated application directory\"\n })\n\nconst mapConfigurationError = <Value, Failure, Requirements>(\n effect: Effect.Effect<Value, Failure, Requirements>\n): Effect.Effect<Value, PersistenceConfigError, Requirements> => effect.pipe(Effect.mapError(configurationError))\n\nconst sameOwner = (left: FileSystem.File.Info, right: FileSystem.File.Info): boolean =>\n Option.isSome(left.uid) && Option.isSome(right.uid) && left.uid.value === right.uid.value\n\nconst sameIdentity = (left: FileSystem.File.Info, right: FileSystem.File.Info): boolean =>\n left.dev === right.dev &&\n Option.isSome(left.ino) &&\n Option.isSome(right.ino) &&\n left.ino.value === right.ino.value &&\n sameOwner(left, right)\n\ninterface MarkerPublication {\n readonly claimBasename: string\n readonly cryptoService: Crypto.Crypto\n readonly dataRoot: string\n readonly fileSystem: FileSystem.FileSystem\n readonly markerPath: string\n readonly targetBasename: string\n}\n\ninterface LegacyDataRootValidation {\n readonly dataPaths: ControlCenterDataPaths\n readonly fileSystem: FileSystem.FileSystem\n readonly path: Path.Path\n readonly rootInfo: FileSystem.File.Info\n}\n\ninterface ProcessOwnershipVerification {\n readonly cryptoService: Crypto.Crypto\n readonly dataRoot: string\n readonly fileSystem: FileSystem.FileSystem\n readonly initialRootInfo: FileSystem.File.Info\n readonly path: Path.Path\n}\n\ninterface FreshDataRootPublication {\n readonly cryptoService: Crypto.Crypto\n readonly dataRoot: string\n readonly fileSystem: FileSystem.FileSystem\n readonly parent: string\n readonly path: Path.Path\n}\n\ninterface PendingMarkerCleanup {\n readonly dataRoot: string\n readonly fileSystem: FileSystem.FileSystem\n readonly path: Path.Path\n readonly rootInfo: FileSystem.File.Info\n}\n\ninterface LostClaimDetection {\n readonly fileSystem: FileSystem.FileSystem\n readonly parent: string\n readonly path: Path.Path\n readonly requestedClaimBasename: string\n}\n\ntype DataRootMarker =\n | { readonly _tag: \"Legacy\" }\n | { readonly _tag: \"Bound\"; readonly claimBasename: string; readonly targetBasename: string }\n\nconst decodeMarkerBasename = (\n path: Path.Path,\n encodedBasename: string\n): Result.Result<string, PersistenceConfigError> => {\n const decodedBasename = Encoding.decodeBase64UrlString(encodedBasename)\n if (\n Result.isFailure(decodedBasename) ||\n decodedBasename.success.length === 0 ||\n decodedBasename.success.length > 4_096 ||\n !hasNoControlCharacters(decodedBasename.success) ||\n decodedBasename.success === \".\" ||\n decodedBasename.success === \"..\" ||\n path.basename(decodedBasename.success) !== decodedBasename.success ||\n Encoding.encodeBase64Url(decodedBasename.success) !== encodedBasename\n ) {\n return Result.fail(configurationError())\n }\n return Result.succeed(decodedBasename.success)\n}\n\nconst decodeDataRootMarker = (\n path: Path.Path,\n content: string\n): Result.Result<DataRootMarker, PersistenceConfigError> => {\n if (content === DATA_ROOT_MARKER_V1_CONTENT) return Result.succeed({ _tag: \"Legacy\" })\n if (!content.startsWith(DATA_ROOT_MARKER_V2_PREFIX) || !content.endsWith(\"\\n\")) {\n return Result.fail(configurationError())\n }\n const encodedFields = content.slice(DATA_ROOT_MARKER_V2_PREFIX.length, -1).split(\"\\ntarget-basename:\")\n if (encodedFields.length !== 2) return Result.fail(configurationError())\n const encodedClaim = encodedFields[0]\n const encodedTarget = encodedFields[1]\n if (encodedClaim === undefined || encodedTarget === undefined) return Result.fail(configurationError())\n const claimBasename = decodeMarkerBasename(path, encodedClaim)\n if (Result.isFailure(claimBasename)) return Result.fail(claimBasename.failure)\n if (claimBasename.success.startsWith(DATA_ROOT_STAGING_PREFIX)) return Result.fail(configurationError())\n const targetBasename = decodeMarkerBasename(path, encodedTarget)\n if (Result.isFailure(targetBasename)) return Result.fail(targetBasename.failure)\n return Result.succeed({\n _tag: \"Bound\",\n claimBasename: claimBasename.success,\n targetBasename: targetBasename.success\n })\n}\n\nconst validatePrivateDirectory = Effect.fn(\"ControlCenterCli.validatePrivateDirectory\")(function*(\n fileSystem: FileSystem.FileSystem,\n dataRoot: string\n) {\n const canonicalRoot = yield* mapConfigurationError(fileSystem.realPath(dataRoot))\n const info = yield* mapConfigurationError(fileSystem.stat(dataRoot))\n if (\n canonicalRoot !== dataRoot ||\n info.type !== \"Directory\" ||\n (info.mode & 0o777) !== DATA_ROOT_DIRECTORY_MODE ||\n Option.isNone(info.uid) ||\n Option.isNone(info.ino)\n ) {\n return yield* configurationError()\n }\n return info\n})\n\nconst validateMarker = Effect.fn(\"ControlCenterCli.validateDataRootMarker\")(function*(\n fileSystem: FileSystem.FileSystem,\n path: Path.Path,\n markerPath: string,\n rootInfo: FileSystem.File.Info\n) {\n const canonicalMarker = yield* mapConfigurationError(fileSystem.realPath(markerPath))\n const markerInfo = yield* mapConfigurationError(fileSystem.stat(markerPath))\n if (\n canonicalMarker !== markerPath ||\n markerInfo.type !== \"File\" ||\n (markerInfo.mode & 0o777) !== DATA_ROOT_MARKER_MODE ||\n !sameOwner(rootInfo, markerInfo) ||\n Number(markerInfo.size) > DATA_ROOT_MARKER_MAX_BYTES\n ) {\n return yield* configurationError()\n }\n const content = yield* mapConfigurationError(fileSystem.readFileString(markerPath))\n return yield* Effect.fromResult(decodeDataRootMarker(path, content))\n})\n\nconst validateMarkerForClaim = Effect.fn(\"ControlCenterCli.validateDataRootMarkerForClaim\")(function*(\n fileSystem: FileSystem.FileSystem,\n path: Path.Path,\n markerPath: string,\n rootInfo: FileSystem.File.Info,\n claimBasename: string,\n targetBasename: string\n) {\n const marker = yield* validateMarker(fileSystem, path, markerPath, rootInfo)\n if (\n marker._tag === \"Bound\" &&\n (marker.claimBasename !== claimBasename || marker.targetBasename !== targetBasename)\n ) {\n return yield* configurationError()\n }\n return marker\n})\n\nconst validateLegacyDataRoot = Effect.fn(\"ControlCenterCli.validateLegacyDataRoot\")(function*(\n request: LegacyDataRootValidation\n) {\n const { dataPaths, fileSystem, path, rootInfo } = request\n const databasePath = path.join(dataPaths.dataRoot, \"control-center.db\")\n const canonicalDatabase = yield* mapConfigurationError(fileSystem.realPath(databasePath))\n const databaseInfo = yield* mapConfigurationError(fileSystem.stat(databasePath))\n if (\n canonicalDatabase !== databasePath ||\n databaseInfo.type !== \"File\" ||\n !sameOwner(rootInfo, databaseInfo) ||\n Number(databaseInfo.size) < SQLITE_HEADER.length\n ) {\n return yield* configurationError()\n }\n\n const header = yield* Effect.scoped(\n mapConfigurationError(fileSystem.open(databasePath, { flag: \"r\" })).pipe(\n Effect.flatMap((file) => mapConfigurationError(file.readAlloc(SQLITE_HEADER.length)))\n )\n )\n if (\n Option.isNone(header) ||\n header.value.length !== SQLITE_HEADER.length ||\n !SQLITE_HEADER.every((byte, index) => header.value[index] === byte)\n ) return yield* configurationError()\n\n // The exact current schema is the durable identity shared by pre-marker\n // builds. Inspecting a scoped snapshot prevents SQLite journal\n // recovery or WAL bookkeeping from mutating a root before it is adopted.\n yield* Effect.scoped(\n Effect.gen(function*() {\n const snapshotRoot = yield* mapConfigurationError(\n fileSystem.makeTempDirectoryScoped({ prefix: \"control-center-legacy-snapshot-\" })\n )\n const snapshotDatabase = path.join(snapshotRoot, \"control-center.db\")\n yield* mapConfigurationError(fileSystem.copyFile(databasePath, snapshotDatabase))\n\n for (const suffix of [\"-wal\", \"-journal\"]) {\n const sidecar = `${databasePath}${suffix}`\n if (!(yield* mapConfigurationError(fileSystem.exists(sidecar)))) continue\n const canonicalSidecar = yield* mapConfigurationError(fileSystem.realPath(sidecar))\n const sidecarInfo = yield* mapConfigurationError(fileSystem.stat(sidecar))\n if (\n canonicalSidecar !== sidecar ||\n sidecarInfo.type !== \"File\" ||\n !sameOwner(rootInfo, sidecarInfo)\n ) return yield* configurationError()\n yield* mapConfigurationError(fileSystem.copyFile(sidecar, `${snapshotDatabase}${suffix}`))\n }\n\n yield* validateExistingControlCenterDatabase({\n blobRoot: path.join(snapshotRoot, \"blobs\"),\n busyTimeoutMilliseconds: dataPaths.persistenceConfig.busyTimeoutMilliseconds,\n databaseUrl: `file:${snapshotDatabase}`,\n maxConnections: dataPaths.persistenceConfig.maxConnections\n }).pipe(Effect.mapError(configurationError))\n })\n )\n})\n\nconst syncPath = Effect.fn(\"ControlCenterCli.syncDataRootPath\")(function*(\n _fileSystem: FileSystem.FileSystem,\n target: string\n) {\n yield* syncDataRootPath(target)\n})\n\nconst publishMarker = Effect.fn(\"ControlCenterCli.publishDataRootMarker\")(function*(\n request: MarkerPublication\n) {\n yield* publishDataRootMarker(request.dataRoot, request.claimBasename, request.targetBasename)\n})\n\nconst removeValidPendingMarkers = Effect.fn(\"ControlCenterCli.removeValidPendingMarkers\")(function*(\n request: PendingMarkerCleanup,\n claimBasename: string,\n targetBasename: string\n) {\n const { dataRoot, fileSystem, path, rootInfo } = request\n const entries = yield* mapConfigurationError(fileSystem.readDirectory(dataRoot))\n const pendingNames = entries.filter((entry) => hasRandomHexSuffix(entry, DATA_ROOT_PENDING_MARKER_PREFIX))\n const validPendingPaths: Array<string> = []\n\n for (const pendingName of pendingNames) {\n const pendingPath = path.join(dataRoot, pendingName)\n const canonicalPending = yield* mapConfigurationError(fileSystem.realPath(pendingPath))\n const pendingInfo = yield* mapConfigurationError(fileSystem.stat(pendingPath))\n if (\n canonicalPending !== pendingPath ||\n pendingInfo.type !== \"File\" ||\n (pendingInfo.mode & 0o777) !== DATA_ROOT_MARKER_MODE ||\n !sameOwner(rootInfo, pendingInfo) ||\n Number(pendingInfo.size) > boundMarkerContent(claimBasename, targetBasename).length\n ) return yield* configurationError()\n\n const content = yield* mapConfigurationError(fileSystem.readFileString(pendingPath))\n if (\n !DATA_ROOT_MARKER_V1_CONTENT.startsWith(content) &&\n !boundMarkerContent(claimBasename, targetBasename).startsWith(content)\n ) return yield* configurationError()\n validPendingPaths.push(pendingPath)\n }\n\n for (const pendingPath of validPendingPaths) {\n const removed = yield* fileSystem.remove(pendingPath).pipe(Effect.result)\n if (Result.isFailure(removed) && removed.failure.reason._tag !== \"NotFound\") {\n return yield* configurationError()\n }\n }\n\n if (pendingNames.length > 0) yield* syncPath(fileSystem, dataRoot)\n})\n\nconst verifyProcessOwnership = Effect.fn(\"ControlCenterCli.verifyProcessOwnership\")(function*(\n request: ProcessOwnershipVerification\n) {\n const { cryptoService, dataRoot, fileSystem, initialRootInfo, path } = request\n const isExpectedRoot = (info: FileSystem.File.Info): boolean =>\n info.type === \"Directory\" &&\n (info.mode & 0o777) === DATA_ROOT_DIRECTORY_MODE &&\n sameIdentity(initialRootInfo, info)\n\n yield* Effect.scoped(\n Effect.uninterruptible(\n Effect.gen(function*() {\n const directory = yield* mapConfigurationError(fileSystem.open(dataRoot, { flag: \"r\" }))\n const directoryInfo = yield* mapConfigurationError(directory.stat)\n if (!isExpectedRoot(directoryInfo)) return yield* configurationError()\n\n const assertIdentity = Effect.gen(function*() {\n const current = yield* directory.stat.pipe(Effect.result)\n const named = yield* fileSystem.stat(dataRoot).pipe(Effect.result)\n const resolved = yield* fileSystem.realPath(dataRoot).pipe(Effect.result)\n if (\n Result.isFailure(current) ||\n Result.isFailure(named) ||\n Result.isFailure(resolved) ||\n resolved.success !== dataRoot ||\n !isExpectedRoot(current.success) ||\n !sameIdentity(current.success, named.success)\n ) return yield* configurationError()\n })\n\n yield* assertIdentity\n const random = yield* mapConfigurationError(cryptoService.randomBytes(16))\n const probePath = path.join(dataRoot, `${DATA_ROOT_OWNER_PROBE_PREFIX}${Encoding.encodeHex(random)}`)\n const probe = yield* mapConfigurationError(\n fileSystem.open(probePath, { flag: \"wx\", mode: DATA_ROOT_MARKER_MODE })\n )\n yield* Effect.addFinalizer(() =>\n fileSystem.remove(probePath, { force: true }).pipe(\n Effect.andThen(directory.sync),\n Effect.ignore\n )\n )\n yield* mapConfigurationError(fileSystem.chmod(probePath, DATA_ROOT_MARKER_MODE))\n const probeInfo = yield* mapConfigurationError(probe.stat)\n if (\n probeInfo.type !== \"File\" ||\n (probeInfo.mode & 0o777) !== DATA_ROOT_MARKER_MODE ||\n !sameOwner(directoryInfo, probeInfo)\n ) return yield* configurationError()\n\n yield* assertIdentity\n yield* mapConfigurationError(fileSystem.remove(probePath))\n yield* mapConfigurationError(directory.sync)\n yield* assertIdentity\n })\n )\n )\n})\n\nconst resolveStagingRoot = (path: Path.Path, parent: string, target: string): Option.Option<string> => {\n const name = path.basename(target)\n return !path.isAbsolute(target) && target === name && name.startsWith(DATA_ROOT_STAGING_PREFIX)\n ? Option.some(path.join(parent, name))\n : Option.none()\n}\n\nconst isBase64UrlPrefix = (value: string): boolean =>\n Array.from(value).every((character) => /[0-9A-Za-z_-]/u.test(character))\n\nconst isPotentialBoundMarkerPrefix = (path: Path.Path, content: string): boolean => {\n if (DATA_ROOT_MARKER_V2_PREFIX.startsWith(content)) return true\n if (!content.startsWith(DATA_ROOT_MARKER_V2_PREFIX)) return false\n const remaining = content.slice(DATA_ROOT_MARKER_V2_PREFIX.length)\n const claimTerminator = remaining.indexOf(\"\\n\")\n if (claimTerminator === -1) return isBase64UrlPrefix(remaining)\n const encodedClaim = remaining.slice(0, claimTerminator)\n if (!isBase64UrlPrefix(encodedClaim)) return false\n\n const targetLabel = \"target-basename:\"\n const targetField = remaining.slice(claimTerminator + 1)\n if (targetLabel.startsWith(targetField)) return true\n if (!targetField.startsWith(targetLabel)) return false\n const encodedTargetWithTerminator = targetField.slice(targetLabel.length)\n if (!encodedTargetWithTerminator.endsWith(\"\\n\")) return isBase64UrlPrefix(encodedTargetWithTerminator)\n return Result.isSuccess(decodeDataRootMarker(path, content))\n}\n\nconst isPotentialMarkerPrefix = (path: Path.Path, content: string): boolean =>\n DATA_ROOT_MARKER_V1_CONTENT.startsWith(content) || isPotentialBoundMarkerPrefix(path, content)\n\nconst validateProtocolArtifact = Effect.fn(\"ControlCenterCli.validateDataRootProtocolArtifact\")(function*(\n fileSystem: FileSystem.FileSystem,\n path: Path.Path,\n stagingRoot: string,\n rootInfo: FileSystem.File.Info,\n entry: string\n) {\n const isFinalMarker = entry === DATA_ROOT_MARKER_NAME\n const isOwnerProbe = hasRandomHexSuffix(entry, DATA_ROOT_OWNER_PROBE_PREFIX)\n const isPendingMarker = hasRandomHexSuffix(entry, DATA_ROOT_PENDING_MARKER_PREFIX)\n if (!isFinalMarker && !isOwnerProbe && !isPendingMarker) return false\n\n const artifactPath = path.join(stagingRoot, entry)\n const canonicalArtifact = yield* mapConfigurationError(fileSystem.realPath(artifactPath))\n const artifactInfo = yield* mapConfigurationError(fileSystem.stat(artifactPath))\n if (\n canonicalArtifact !== artifactPath ||\n artifactInfo.type !== \"File\" ||\n (artifactInfo.mode & 0o777) !== DATA_ROOT_MARKER_MODE ||\n !sameOwner(rootInfo, artifactInfo)\n ) return yield* configurationError()\n\n if (isFinalMarker) {\n if (Number(artifactInfo.size) > DATA_ROOT_MARKER_MAX_BYTES) return yield* configurationError()\n const content = yield* mapConfigurationError(fileSystem.readFileString(artifactPath))\n const marker = decodeDataRootMarker(path, content)\n if (\n Result.isFailure(marker) ||\n (marker.success._tag === \"Bound\" && marker.success.targetBasename !== path.basename(stagingRoot))\n ) return yield* configurationError()\n return true\n }\n\n if (isOwnerProbe) {\n if (Number(artifactInfo.size) !== 0) return yield* configurationError()\n return true\n }\n\n if (Number(artifactInfo.size) > DATA_ROOT_MARKER_MAX_BYTES) return yield* configurationError()\n const content = yield* mapConfigurationError(fileSystem.readFileString(artifactPath))\n const completeMarker = decodeDataRootMarker(path, content)\n if (\n Result.isSuccess(completeMarker) &&\n completeMarker.success._tag === \"Bound\" &&\n completeMarker.success.targetBasename !== path.basename(stagingRoot)\n ) return yield* configurationError()\n if (!isPotentialMarkerPrefix(path, content)) return yield* configurationError()\n return true\n})\n\nconst inspectLostDataRootClaims = Effect.fn(\"ControlCenterCli.inspectLostDataRootClaims\")(function*(\n request: LostClaimDetection\n) {\n const { fileSystem, parent, path, requestedClaimBasename } = request\n const entries = yield* mapConfigurationError(fileSystem.readDirectory(parent))\n for (const entry of entries) {\n if (!entry.startsWith(DATA_ROOT_STAGING_PREFIX) || path.basename(entry) !== entry) continue\n const stagingRoot = path.join(parent, entry)\n const rootInfo = yield* validatePrivateDirectory(fileSystem, stagingRoot)\n const stagingEntries = yield* mapConfigurationError(fileSystem.readDirectory(stagingRoot))\n let hasDurableEntry = false\n for (const name of stagingEntries) {\n if (!(yield* validateProtocolArtifact(fileSystem, path, stagingRoot, rootInfo, name))) {\n hasDurableEntry = true\n }\n }\n if (!hasDurableEntry) continue\n\n const marker = yield* validateMarker(\n fileSystem,\n path,\n path.join(stagingRoot, DATA_ROOT_MARKER_NAME),\n rootInfo\n )\n if (marker._tag === \"Legacy\") return yield* configurationError()\n if (marker.targetBasename !== entry) return yield* configurationError()\n if (marker.claimBasename !== requestedClaimBasename) continue\n\n const boundClaim = path.join(parent, marker.claimBasename)\n const claimedTarget = yield* fileSystem.readLink(boundClaim).pipe(Effect.result)\n if (Result.isFailure(claimedTarget) || claimedTarget.success !== entry) {\n return yield* configurationError()\n }\n }\n})\n\nconst refuseLostDataRootClaim = Effect.fn(\"ControlCenterCli.refuseLostDataRootClaim\")(function*(\n request: LostClaimDetection\n) {\n for (let attempt = 0; attempt < 3; attempt += 1) {\n const inspected = yield* inspectLostDataRootClaims(request).pipe(Effect.result)\n if (Result.isSuccess(inspected)) return\n if (attempt === 2) return yield* Effect.fail(inspected.failure)\n yield* Effect.yieldNow\n }\n})\n\nconst resolveClaimedDataRoot = Effect.fn(\"ControlCenterCli.resolveClaimedDataRoot\")(function*(\n request: FreshDataRootPublication\n) {\n const { cryptoService, dataRoot, fileSystem, parent, path } = request\n const canonicalRoot = yield* mapConfigurationError(fileSystem.realPath(dataRoot))\n if (canonicalRoot === dataRoot) return dataRoot\n\n const claimedTarget = yield* mapConfigurationError(fileSystem.readLink(dataRoot))\n const stagingRoot = resolveStagingRoot(path, parent, claimedTarget)\n if (Option.isNone(stagingRoot)) return yield* configurationError()\n\n const stagingInfo = yield* validatePrivateDirectory(fileSystem, stagingRoot.value)\n const marker = yield* validateMarkerForClaim(\n fileSystem,\n path,\n path.join(stagingRoot.value, DATA_ROOT_MARKER_NAME),\n stagingInfo,\n path.basename(dataRoot),\n path.basename(stagingRoot.value)\n )\n if (marker._tag === \"Legacy\") return yield* configurationError()\n yield* verifyProcessOwnership({\n cryptoService,\n dataRoot: stagingRoot.value,\n fileSystem,\n initialRootInfo: stagingInfo,\n path\n })\n return stagingRoot.value\n})\n\nconst publishFreshDataRoot = Effect.fn(\"ControlCenterCli.publishFreshDataRoot\")(function*(\n request: FreshDataRootPublication\n) {\n const location = yield* inspectFreshDataRootClaim(request.dataRoot).pipe(Effect.mapError(configurationError))\n yield* publishFreshDataRootClaim(location, false, () => Effect.void).pipe(\n Effect.mapError((error) =>\n Predicate.isTagged(error, \"FreshDataRootClaimConflict\") || Predicate.isTagged(error, \"DataRootProtocolError\")\n ? configurationError()\n : error\n )\n )\n})\n\n/**\n * Populate and exclusively publish a genuinely fresh configured data root.\n * The initializer may be interrupted while its unclaimed staging root is cleaned;\n * the completed root is exposed only by the final relative-symlink claim.\n */\nexport const claimFreshControlCenterDataRoot = Effect.fn(\"claimFreshControlCenterDataRoot\")(function*<\n Failure,\n Requirements\n>(\n dataPaths: ControlCenterDataPaths,\n initialize: (\n writer: StagedDataRootWriter\n ) => Effect.Effect<void, Failure, Requirements>\n): Effect.fn.Return<\n ControlCenterDataPaths,\n Failure | FreshDataRootClaimConflict | PersistenceConfigError,\n Crypto.Crypto | FileSystem.FileSystem | Path.Path | Requirements\n> {\n const fileSystem = yield* FileSystem.FileSystem\n const path = yield* Path.Path\n const parent = path.dirname(dataPaths.dataRoot)\n const claimBasename = path.basename(dataPaths.dataRoot)\n if (claimBasename.startsWith(DATA_ROOT_STAGING_PREFIX)) return yield* configurationError()\n if (yield* mapConfigurationError(fileSystem.exists(dataPaths.dataRoot))) {\n return yield* configurationError()\n }\n yield* mapConfigurationError(fileSystem.makeDirectory(parent, { recursive: true }))\n yield* refuseLostDataRootClaim({\n fileSystem,\n parent,\n path,\n requestedClaimBasename: claimBasename\n })\n const location = yield* inspectFreshDataRootClaim(dataPaths.dataRoot).pipe(Effect.mapError(configurationError))\n return yield* publishFreshDataRootClaim(location, true, initialize).pipe(\n Effect.mapError((error) => Predicate.isTagged(error, \"DataRootProtocolError\") ? configurationError() : error)\n )\n})\n\n/** Resolve an already-prepared data root without creating, repairing, cleaning, or migrating it. */\nexport const resolvePreparedControlCenterDataRoot = Effect.fn(\n \"resolvePreparedControlCenterDataRoot\"\n)(function*(\n dataPaths: ControlCenterDataPaths\n): Effect.fn.Return<ControlCenterDataPaths, PersistenceConfigError, FileSystem.FileSystem | Path.Path> {\n const fileSystem = yield* FileSystem.FileSystem\n const path = yield* Path.Path\n const parent = path.dirname(dataPaths.dataRoot)\n const claimBasename = path.basename(dataPaths.dataRoot)\n if (claimBasename.startsWith(DATA_ROOT_STAGING_PREFIX)) return yield* configurationError()\n if (!(yield* mapConfigurationError(fileSystem.exists(dataPaths.dataRoot)))) {\n return yield* configurationError()\n }\n\n const canonicalRoot = yield* mapConfigurationError(fileSystem.realPath(dataPaths.dataRoot))\n let operationalPaths = dataPaths\n if (canonicalRoot !== dataPaths.dataRoot) {\n const claimedTarget = yield* mapConfigurationError(fileSystem.readLink(dataPaths.dataRoot))\n const stagingRoot = resolveStagingRoot(path, parent, claimedTarget)\n if (Option.isNone(stagingRoot) || stagingRoot.value !== canonicalRoot) {\n return yield* configurationError()\n }\n operationalPaths = yield* decodeOperationalDataPaths(stagingRoot.value)\n }\n\n const rootInfo = yield* validatePrivateDirectory(fileSystem, operationalPaths.dataRoot)\n const markerPath = path.join(operationalPaths.dataRoot, DATA_ROOT_MARKER_NAME)\n if (!(yield* mapConfigurationError(fileSystem.exists(markerPath)))) return yield* configurationError()\n const marker = yield* validateMarkerForClaim(\n fileSystem,\n path,\n markerPath,\n rootInfo,\n claimBasename,\n path.basename(operationalPaths.dataRoot)\n )\n if (marker._tag !== \"Bound\") return yield* configurationError()\n return operationalPaths\n})\n\n/** Create or verify a dedicated data root and return its canonical operational paths. */\nexport const prepareControlCenterDataRoot = Effect.fn(\"prepareControlCenterDataRoot\")(function*(\n dataPaths: ControlCenterDataPaths\n): Effect.fn.Return<ControlCenterDataPaths, PersistenceConfigError, Crypto.Crypto | FileSystem.FileSystem | Path.Path> {\n const cryptoService = yield* Crypto.Crypto\n const fileSystem = yield* FileSystem.FileSystem\n const path = yield* Path.Path\n const parent = path.dirname(dataPaths.dataRoot)\n const claimBasename = path.basename(dataPaths.dataRoot)\n if (claimBasename.startsWith(DATA_ROOT_STAGING_PREFIX)) return yield* configurationError()\n const existed = yield* mapConfigurationError(fileSystem.exists(dataPaths.dataRoot))\n\n if (!existed) {\n yield* mapConfigurationError(fileSystem.makeDirectory(parent, { recursive: true }))\n yield* refuseLostDataRootClaim({\n fileSystem,\n parent,\n path,\n requestedClaimBasename: claimBasename\n })\n yield* publishFreshDataRoot({\n cryptoService,\n dataRoot: dataPaths.dataRoot,\n fileSystem,\n parent,\n path\n })\n }\n\n const operationalRoot = yield* resolveClaimedDataRoot({\n cryptoService,\n dataRoot: dataPaths.dataRoot,\n fileSystem,\n parent,\n path\n })\n const operationalPaths = operationalRoot === dataPaths.dataRoot\n ? dataPaths\n : yield* decodeOperationalDataPaths(operationalRoot)\n\n const rootInfo = yield* validatePrivateDirectory(fileSystem, operationalPaths.dataRoot)\n const targetBasename = path.basename(operationalPaths.dataRoot)\n const markerPath = path.join(operationalPaths.dataRoot, DATA_ROOT_MARKER_NAME)\n const hasMarker = yield* mapConfigurationError(fileSystem.exists(markerPath))\n const existingMarker = hasMarker\n ? Option.some(\n yield* validateMarkerForClaim(\n fileSystem,\n path,\n markerPath,\n rootInfo,\n claimBasename,\n targetBasename\n )\n )\n : Option.none<DataRootMarker>()\n yield* verifyProcessOwnership({\n cryptoService,\n dataRoot: operationalPaths.dataRoot,\n fileSystem,\n initialRootInfo: rootInfo,\n path\n })\n if (Option.isNone(existingMarker)) {\n yield* validateLegacyDataRoot({ dataPaths: operationalPaths, fileSystem, path, rootInfo })\n yield* removeValidPendingMarkers(\n {\n dataRoot: operationalPaths.dataRoot,\n fileSystem,\n path,\n rootInfo\n },\n claimBasename,\n targetBasename\n )\n yield* publishMarker({\n claimBasename,\n cryptoService,\n dataRoot: operationalPaths.dataRoot,\n fileSystem,\n markerPath,\n targetBasename\n })\n } else {\n yield* removeValidPendingMarkers(\n {\n dataRoot: operationalPaths.dataRoot,\n fileSystem,\n path,\n rootInfo\n },\n claimBasename,\n targetBasename\n )\n if (existingMarker.value._tag === \"Legacy\") {\n yield* publishMarker({\n claimBasename,\n cryptoService,\n dataRoot: operationalPaths.dataRoot,\n fileSystem,\n markerPath,\n targetBasename\n })\n }\n }\n const finalMarker = yield* validateMarkerForClaim(\n fileSystem,\n path,\n markerPath,\n rootInfo,\n claimBasename,\n targetBasename\n )\n if (finalMarker._tag !== \"Bound\") return yield* configurationError()\n return operationalPaths\n})\n","import * as Config from \"effect/Config\"\nimport * as ConfigProvider from \"effect/ConfigProvider\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Schema from \"effect/Schema\"\nimport { FetchHttpClient } from \"effect/unstable/http\"\nimport { OtlpLogger, OtlpSerialization, OtlpTracer } from \"effect/unstable/observability\"\n\nconst resource = {\n serviceName: \"control-center\"\n}\n\nconst activation = Config.all({\n baseEndpoint: Config.string(\"OTEL_EXPORTER_OTLP_ENDPOINT\").pipe(Config.withDefault(\"\")),\n disabled: Config.string(\"OTEL_SDK_DISABLED\").pipe(Config.withDefault(\"\")),\n logsEndpoint: Config.string(\"OTEL_EXPORTER_OTLP_LOGS_ENDPOINT\").pipe(Config.withDefault(\"\")),\n logsExporters: Config.string(\"OTEL_LOGS_EXPORTER\").pipe(Config.withDefault(\"\")),\n logsProtocol: Config.string(\"OTEL_EXPORTER_OTLP_LOGS_PROTOCOL\").pipe(Config.withDefault(\"\")),\n protocol: Config.string(\"OTEL_EXPORTER_OTLP_PROTOCOL\").pipe(Config.withDefault(\"http/protobuf\")),\n tracesEndpoint: Config.string(\"OTEL_EXPORTER_OTLP_TRACES_ENDPOINT\").pipe(Config.withDefault(\"\")),\n tracesExporters: Config.string(\"OTEL_TRACES_EXPORTER\").pipe(Config.withDefault(\"\")),\n tracesProtocol: Config.string(\"OTEL_EXPORTER_OTLP_TRACES_PROTOCOL\").pipe(Config.withDefault(\"\"))\n})\n\nconst includesOtlp = (exporters: string): boolean =>\n exporters.split(\",\").some((exporter) => exporter.trim().toLowerCase() === \"otlp\")\n\nconst OtlpHttpProtocol = Schema.Literals([\"http/json\", \"http/protobuf\"])\ntype OtlpHttpProtocol = typeof OtlpHttpProtocol.Type\ntype OtlpSignal = \"logs\" | \"traces\"\n\nconst optionalIntegerConfigurationKeys = new Set([\n \"OTEL_BLRP_EXPORT_TIMEOUT\",\n \"OTEL_BLRP_MAX_EXPORT_BATCH_SIZE\",\n \"OTEL_BLRP_SCHEDULE_DELAY\",\n \"OTEL_BSP_EXPORT_TIMEOUT\",\n \"OTEL_BSP_MAX_EXPORT_BATCH_SIZE\",\n \"OTEL_BSP_SCHEDULE_DELAY\",\n \"OTEL_EXPORTER_OTLP_LOGS_TIMEOUT\",\n \"OTEL_EXPORTER_OTLP_TIMEOUT\",\n \"OTEL_EXPORTER_OTLP_TRACES_TIMEOUT\"\n])\n\nconst positiveScheduleDelayConfigurationKeys = new Set([\n \"OTEL_BLRP_SCHEDULE_DELAY\",\n \"OTEL_BSP_SCHEDULE_DELAY\"\n])\n\nclass ObservabilityConfigurationError extends Schema.TaggedErrorClass<ObservabilityConfigurationError>()(\n \"ObservabilityConfigurationError\",\n {\n reason: Schema.Literals([\"invalid-endpoint\", \"unsupported-protocol\"]),\n signal: Schema.Literals([\"logs\", \"traces\"])\n }\n) {}\n\nconst validateSignalEndpoint = Effect.fn(\"ControlCenterObservability.validateSignalEndpoint\")(function*(\n signal: OtlpSignal,\n endpoint: string\n) {\n if (endpoint === \"\") return\n const url = yield* Schema.decodeUnknownEffect(Schema.URLFromString)(endpoint).pipe(\n Effect.mapError(() => new ObservabilityConfigurationError({ reason: \"invalid-endpoint\", signal }))\n )\n if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n return yield* new ObservabilityConfigurationError({ reason: \"invalid-endpoint\", signal })\n }\n})\n\nconst resolveProtocol = Effect.fn(\"ControlCenterObservability.resolveProtocol\")(function*(\n signal: OtlpSignal,\n signalProtocol: string,\n baseProtocol: string\n) {\n const protocol = (signalProtocol.trim() === \"\" ? baseProtocol : signalProtocol).trim().toLowerCase()\n return yield* Schema.decodeUnknownEffect(OtlpHttpProtocol)(protocol).pipe(\n Effect.mapError(() => new ObservabilityConfigurationError({ reason: \"unsupported-protocol\", signal }))\n )\n})\n\nconst defaultEndpointLayer = ConfigProvider.layerAdd(\n ConfigProvider.fromEnv({ env: { OTEL_EXPORTER_OTLP_ENDPOINT: \"http://localhost:4318\" } })\n)\n\nconst parseSdkDisabled = Effect.fn(\"ControlCenterObservability.parseSdkDisabled\")(function*(value: string) {\n const normalized = value.trim().toLowerCase()\n if (normalized === \"true\") return true\n if (normalized === \"\" || normalized === \"false\") return false\n yield* Effect.logWarning(\"Ignoring invalid OTEL_SDK_DISABLED value; expected true or false.\")\n return false\n})\n\nconst decodeIntegerConfigurationValue = Schema.decodeUnknownOption(Schema.toCodecStringTree(Schema.Int))\n\nconst sanitizedConfigProvider = (\n provider: ConfigProvider.ConfigProvider,\n sdkDisabled: boolean\n): ConfigProvider.ConfigProvider =>\n ConfigProvider.make((path) => {\n if (path.length === 1 && path[0] === \"OTEL_SDK_DISABLED\") {\n return Effect.succeed(ConfigProvider.makeValue(sdkDisabled ? \"true\" : \"false\"))\n }\n return provider.load(path).pipe(\n Effect.map((node) => {\n if (\n path.length !== 1 ||\n typeof path[0] !== \"string\" ||\n !optionalIntegerConfigurationKeys.has(path[0]) ||\n node === undefined\n ) {\n return node\n }\n const value = node.value\n if (value === undefined) return undefined\n const integer = decodeIntegerConfigurationValue(value)\n return Option.isNone(integer) ||\n (positiveScheduleDelayConfigurationKeys.has(path[0]) && integer.value <= 0)\n ? undefined\n : node\n })\n )\n })\n\nconst serializationLayer = (protocol: OtlpHttpProtocol) =>\n protocol === \"http/json\" ? OtlpSerialization.layerJson : OtlpSerialization.layerProtobuf\n\nconst loggerLayer = (protocol: OtlpHttpProtocol) =>\n OtlpLogger.layerFromConfig({ resource }).pipe(\n Layer.provide(serializationLayer(protocol)),\n Layer.provide(defaultEndpointLayer)\n )\n\nconst tracerLayer = (protocol: OtlpHttpProtocol) =>\n OtlpTracer.layerFromConfig({ resource }).pipe(\n Layer.provide(serializationLayer(protocol)),\n Layer.provide(defaultEndpointLayer)\n )\n\nexport const controlCenterTelemetryLayer = Effect.gen(function*() {\n const configured = yield* activation\n const sdkDisabled = yield* parseSdkDisabled(configured.disabled)\n if (sdkDisabled) return Layer.empty\n\n const provider = yield* ConfigProvider.ConfigProvider\n\n const logsEnabled = includesOtlp(configured.logsExporters)\n const tracesEnabled = includesOtlp(configured.tracesExporters)\n if (logsEnabled) {\n yield* validateSignalEndpoint(\n \"logs\",\n configured.logsEndpoint === \"\" ? configured.baseEndpoint : configured.logsEndpoint\n )\n }\n if (tracesEnabled) {\n yield* validateSignalEndpoint(\n \"traces\",\n configured.tracesEndpoint === \"\" ? configured.baseEndpoint : configured.tracesEndpoint\n )\n }\n const logsProtocol = logsEnabled\n ? yield* resolveProtocol(\"logs\", configured.logsProtocol, configured.protocol)\n : \"http/protobuf\"\n const tracesProtocol = tracesEnabled\n ? yield* resolveProtocol(\"traces\", configured.tracesProtocol, configured.protocol)\n : \"http/protobuf\"\n\n return Layer.merge(\n logsEnabled ? loggerLayer(logsProtocol) : Layer.empty,\n tracesEnabled ? tracerLayer(tracesProtocol) : Layer.empty\n ).pipe(Layer.provide(ConfigProvider.layer(sanitizedConfigProvider(provider, sdkDisabled))))\n}).pipe(Layer.unwrap)\n\nexport const ControlCenterObservabilityLive = controlCenterTelemetryLayer.pipe(Layer.provide(FetchHttpClient.layer))\n","#!/usr/bin/env node\nimport { NodeRuntime, NodeServices } from \"@effect/platform-node\"\nimport * as Cause from \"effect/Cause\"\nimport * as Config from \"effect/Config\"\nimport * as Context from \"effect/Context\"\nimport * as Effect from \"effect/Effect\"\nimport * as Exit from \"effect/Exit\"\nimport * as Layer from \"effect/Layer\"\nimport * as Option from \"effect/Option\"\nimport * as Path from \"effect/Path\"\nimport * as Predicate from \"effect/Predicate\"\nimport * as Redacted from \"effect/Redacted\"\nimport * as Schema from \"effect/Schema\"\nimport * as Scope from \"effect/Scope\"\nimport * as Stdio from \"effect/Stdio\"\nimport * as Stream from \"effect/Stream\"\n\nimport { AgentProvider } from \"../api/agent.js\"\nimport { PersonId, WorkspaceId } from \"../domain/identifiers.js\"\nimport { TerminalRecovery, terminalRecoveryLayer } from \"./auth/TerminalRecovery.js\"\nimport { classifyControlCenterCliArguments } from \"./cliArguments.js\"\nimport {\n decodeControlCenterDataPaths,\n prepareControlCenterDataRoot,\n resolvePreparedControlCenterDataRoot\n} from \"./cliConfiguration.js\"\nimport { ControlCenterObservabilityLive } from \"./observability.js\"\nimport {\n type BackupVerification,\n createOfflineVerifiedBackup,\n restoreBackup,\n verifyBackup\n} from \"./persistence/backup/index.js\"\nimport { DatabaseInitializationError } from \"./persistence/errors.js\"\nimport { WorkspaceName } from \"./persistence/repositories/models.js\"\nimport { ControlCenterBootstrap } from \"./runtime/Bootstrap.js\"\nimport { makeControlCenterServer } from \"./runtime/ControlCenterServer.js\"\nimport { ServerLifecycle } from \"./runtime/ServerLifecycle.js\"\nimport { decodeBindConfig } from \"./security/BindConfig.js\"\n\nconst DEFAULT_WORKSPACE_ID = WorkspaceId.make(\"01890f6f-6d6a-7cc0-98d2-000000000001\")\nconst DEFAULT_OWNER_ID = PersonId.make(\"01890f6f-6d6a-7cc0-98d2-000000000002\")\n\nconst commaSeparated = (value: string): ReadonlyArray<string> =>\n value\n .split(\",\")\n .map((part) => part.trim())\n .filter((part) => part.length > 0)\n\nconst dataRootConfiguration = Config.string(\"CONTROL_CENTER_DATA_ROOT\").pipe(Config.withDefault(\".control-center\"))\n\nconst serverConfiguration = Config.all({\n agentClaudeExecutable: Config.string(\"CONTROL_CENTER_AGENT_CLAUDE_EXECUTABLE\").pipe(Config.withDefault(\"\")),\n agentClaudeModel: Config.string(\"CONTROL_CENTER_AGENT_CLAUDE_MODEL\").pipe(Config.withDefault(\"\")),\n agentCodexExecutable: Config.string(\"CONTROL_CENTER_AGENT_CODEX_EXECUTABLE\").pipe(Config.withDefault(\"\")),\n agentCodexModel: Config.string(\"CONTROL_CENTER_AGENT_CODEX_MODEL\").pipe(Config.withDefault(\"\")),\n agentCwd: Config.string(\"CONTROL_CENTER_AGENT_CWD\").pipe(Config.withDefault(\"\")),\n agentProviders: Config.string(\"CONTROL_CENTER_AGENT_PROVIDERS\").pipe(Config.withDefault(\"\")),\n allowedHosts: Config.string(\"CONTROL_CENTER_ALLOWED_HOSTS\").pipe(Config.withDefault(\"\")),\n allowedOrigins: Config.string(\"CONTROL_CENTER_ALLOWED_ORIGINS\").pipe(Config.withDefault(\"\")),\n allowInsecureLan: Config.boolean(\"CONTROL_CENTER_ALLOW_INSECURE_LAN\").pipe(Config.withDefault(false)),\n directTlsCertificateRef: Config.string(\"CONTROL_CENTER_TLS_CERTIFICATE_REF\").pipe(Config.withDefault(\"\")),\n directTlsPrivateKeyRef: Config.string(\"CONTROL_CENTER_TLS_PRIVATE_KEY_REF\").pipe(Config.withDefault(\"\")),\n host: Config.string(\"CONTROL_CENTER_HOST\").pipe(Config.withDefault(\"127.0.0.1\")),\n port: Config.int(\"CONTROL_CENTER_PORT\").pipe(Config.withDefault(4173)),\n publicOrigin: Config.string(\"CONTROL_CENTER_PUBLIC_ORIGIN\").pipe(Config.withDefault(\"\")),\n trustedProxyAddresses: Config.string(\"CONTROL_CENTER_TRUSTED_PROXY_ADDRESSES\").pipe(Config.withDefault(\"\"))\n})\n\nconst writeStdoutLine = (value: string) =>\n Stdio.Stdio.use((stdio) => Stream.make(`${value}\\n`).pipe(Stream.run(stdio.stdout())))\n\nconst writeStderrLine = (value: string) =>\n Stdio.Stdio.use((stdio) => Stream.make(`${value}\\n`).pipe(Stream.run(stdio.stderr())))\n\nconst verificationLine = (complete: string, degraded: string, verification: BackupVerification): string =>\n verification._tag === \"Complete\"\n ? complete\n : `${degraded} ${verification.reproducibleBlobGaps.length} reproducible cache gaps.`\n\nclass ControlCenterCliUsageError extends Schema.TaggedErrorClass<ControlCenterCliUsageError>()(\n \"ControlCenterCliUsageError\",\n { command: Schema.String }\n) {}\n\nconst program = Effect.scoped(\n Effect.gen(function*() {\n const path = yield* Path.Path\n const stdio = yield* Stdio.Stdio\n const invocation = classifyControlCenterCliArguments(yield* stdio.args)\n if (invocation._tag === \"invalid\") {\n yield* writeStderrLine(\n \"Usage: control-center [recover-owner | backup <archive> | verify-backup <archive> | restore <archive>]\"\n )\n return yield* new ControlCenterCliUsageError({ command: invocation.command })\n }\n\n if (invocation._tag === \"verify-backup\") {\n const verification = yield* verifyBackup(invocation.archiveRoot)\n yield* writeStdoutLine(verificationLine(\"Backup verified.\", \"Backup verified with\", verification))\n return\n }\n\n const configuredDataRoot = yield* dataRootConfiguration\n if (invocation._tag === \"restore\") {\n const restored = yield* restoreBackup({\n archiveRoot: invocation.archiveRoot,\n configuredDataRoot\n })\n yield* writeStdoutLine(verificationLine(\"Backup restored.\", \"Backup restored with\", restored.verification))\n return\n }\n\n const configuredDataPaths = yield* decodeControlCenterDataPaths(configuredDataRoot)\n if (invocation._tag === \"backup\") {\n const existingDataPaths = yield* resolvePreparedControlCenterDataRoot(configuredDataPaths)\n const published = yield* createOfflineVerifiedBackup({\n destination: invocation.archiveRoot,\n persistenceConfig: existingDataPaths.persistenceConfig\n })\n yield* writeStdoutLine(verificationLine(\"Backup created.\", \"Backup created with\", published.verification))\n return\n }\n\n const dataPaths = yield* prepareControlCenterDataRoot(configuredDataPaths)\n\n if (invocation._tag === \"recover-owner\") {\n const recoveryServices = yield* Layer.build(terminalRecoveryLayer(dataPaths.persistenceConfig))\n const recovery = Context.get(recoveryServices, TerminalRecovery)\n const issued = yield* recovery.issueOwnerRecovery({\n workspaceId: DEFAULT_WORKSPACE_ID,\n actor: { _tag: \"human\", personId: DEFAULT_OWNER_ID },\n revokeExistingOwnerSessions: true\n })\n yield* writeStdoutLine(`Recovery pairing code: ${Redacted.value(issued.pairingCode)}`)\n return\n }\n\n const programScope = yield* Effect.scope\n const observabilityScope = yield* Scope.fork(programScope)\n const observabilityServices = yield* Layer.buildWithScope(ControlCenterObservabilityLive, observabilityScope)\n return yield* Effect.gen(function*() {\n const configured = yield* serverConfiguration\n const agentProviders = yield* Schema.decodeUnknownEffect(Schema.Array(AgentProvider).check(Schema.isUnique()))(\n commaSeparated(configured.agentProviders)\n )\n const agentCwd = agentProviders.length === 0\n ? null\n : yield* Schema.decodeUnknownEffect(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty()))(\n configured.agentCwd\n )\n const allowedHosts = commaSeparated(configured.allowedHosts)\n const allowedOrigins = commaSeparated(configured.allowedOrigins)\n const trustedProxyAddresses = commaSeparated(configured.trustedProxyAddresses)\n const hasDirectTlsInput = configured.directTlsCertificateRef.length > 0 ||\n configured.directTlsPrivateKeyRef.length > 0\n const bindConfig = yield* decodeBindConfig({\n host: configured.host,\n port: configured.port,\n allowInsecureLan: configured.allowInsecureLan,\n ...(configured.publicOrigin.length > 0 ? { publicOrigin: configured.publicOrigin } : {}),\n ...(allowedHosts.length > 0 ? { allowedHosts } : {}),\n ...(allowedOrigins.length > 0 ? { allowedOrigins } : {}),\n ...(trustedProxyAddresses.length > 0 ? { trustedProxyAddresses } : {}),\n ...(hasDirectTlsInput\n ? {\n directTls: {\n certificateRef: configured.directTlsCertificateRef,\n privateKeyRef: configured.directTlsPrivateKeyRef\n }\n }\n : {})\n })\n const staticRoot = yield* path.fromFileUrl(new URL(\"../../client\", import.meta.url))\n const services = yield* Layer.build(\n makeControlCenterServer({\n bindConfig,\n firstPartyPluginRuntime: true,\n bootstrap: {\n owner: { _tag: \"human\", personId: DEFAULT_OWNER_ID },\n workspaceId: DEFAULT_WORKSPACE_ID,\n workspaceName: WorkspaceName.make(\"Control Center\")\n },\n persistenceConfig: dataPaths.persistenceConfig,\n releaseAgent: agentCwd === null\n ? null\n : {\n cwd: agentCwd,\n enabledProviders: agentProviders,\n ...(configured.agentCodexExecutable.length > 0\n ? { codexExecutable: configured.agentCodexExecutable }\n : {}),\n ...(configured.agentCodexModel.length > 0 ? { codexModel: configured.agentCodexModel } : {}),\n ...(configured.agentClaudeExecutable.length > 0\n ? { claudeExecutable: configured.agentClaudeExecutable }\n : {}),\n ...(configured.agentClaudeModel.length > 0 ? { claudeModel: configured.agentClaudeModel } : {})\n },\n secretRoot: dataPaths.secretRoot,\n staticAssets: { root: staticRoot }\n })\n )\n const bootstrap = Context.get(services, ControlCenterBootstrap)\n const lifecycle = Context.get(services, ServerLifecycle)\n yield* lifecycle.registerDrainHook({\n hookId: \"telemetry.otlp-export\",\n run: Scope.close(observabilityScope, Exit.void)\n })\n\n yield* writeStdoutLine(`Control Center listening at ${bindConfig.publicOrigin}`)\n if (bootstrap._tag === \"pairing-issued\") {\n yield* writeStdoutLine(`Pairing code: ${Redacted.value(bootstrap.pairingCode)}`)\n } else if (bootstrap._tag === \"already-initialized\") {\n yield* writeStdoutLine(\"Workspace ready. Use an existing paired browser.\")\n }\n return yield* Effect.never.pipe(\n Effect.onInterrupt(() =>\n writeStdoutLine(\"Control Center draining.\").pipe(\n Effect.andThen(lifecycle.drainWithin(\"10 seconds\")),\n Effect.flatMap((result) => {\n switch (result._tag) {\n case \"Drained\":\n return writeStdoutLine(\"Control Center drained.\")\n case \"DeadlineExceeded\":\n return writeStderrLine(\"Control Center drain deadline reached.\")\n case \"HooksFailed\":\n return writeStderrLine(`Control Center drain hooks failed: ${result.hookIds.join(\", \")}.`)\n }\n })\n )\n )\n )\n }).pipe(Effect.provide(observabilityServices))\n })\n)\n\nconst findDatabaseInitializationError = (\n value: unknown,\n remainingWrapperDepth = 2\n): DatabaseInitializationError | null => {\n if (Schema.is(DatabaseInitializationError)(value)) return value\n if (\n remainingWrapperDepth > 0 &&\n Predicate.hasProperty(value, \"_tag\") &&\n value._tag === \"ServeError\" &&\n Predicate.hasProperty(value, \"cause\")\n ) {\n return findDatabaseInitializationError(value.cause, remainingWrapperDepth - 1)\n }\n return null\n}\n\nconst reportProgramFailure = <E>(cause: Cause.Cause<E>) => {\n const error = Cause.findErrorOption(cause)\n const isUsageError = Option.exists(\n error,\n (value) => Predicate.hasProperty(value, \"_tag\") && value._tag === \"ControlCenterCliUsageError\"\n )\n if (isUsageError) return Effect.failCause(cause)\n const databaseInitializationError = Option.flatMap(\n error,\n (value) => Option.fromNullishOr(findDatabaseInitializationError(value))\n )\n if (Option.isSome(databaseInitializationError)) {\n const operation = databaseInitializationError.value.operation\n return writeStderrLine(`Control Center command failed (DatabaseInitializationError: ${operation}).`).pipe(\n Effect.andThen(\n operation === \"verify-schema\"\n ? writeStderrLine(\n \"The database schema does not match this pre-stable build. Back up the data root if needed, \" +\n \"then explicitly recreate local development data or choose a new CONTROL_CENTER_DATA_ROOT. \" +\n \"Automatic migrations are disabled until schema stability.\"\n )\n : Effect.void\n ),\n Effect.andThen(Effect.failCause(cause))\n )\n }\n const errorTag = Option.flatMap(\n error,\n (value) =>\n Predicate.hasProperty(value, \"_tag\") && typeof value._tag === \"string\"\n ? Option.some(value._tag)\n : Option.none<string>()\n )\n const message = Option.match(errorTag, {\n onNone: () => \"Control Center command failed unexpectedly.\",\n onSome: (tag) => `Control Center command failed (${tag}).`\n })\n return writeStderrLine(message).pipe(Effect.andThen(Effect.failCause(cause)))\n}\n\nNodeRuntime.runMain(\n program.pipe(\n Effect.catchCause(reportProgramFailure),\n Effect.provide(NodeServices.layer)\n ),\n { disableErrorReporting: true }\n)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,IAAa,qCACX,eAC+B;CAC/B,IAAI,WAAW,WAAW,GAAG,OAAO,EAAE,MAAM,QAAQ;CACpD,IAAI,WAAW,WAAW,KAAK,WAAW,OAAO,iBAC/C,OAAO,EAAE,MAAM,gBAAgB;CAEjC,MAAM,cAAc,WAAW;CAC/B,IAAI,WAAW,WAAW,KAAK,gBAAgB,KAAA,KAAa,gBAAgB,IAAI;EAC9E,IAAI,WAAW,OAAO,UAAU,OAAO;GAAE,MAAM;GAAU;EAAY;EACrE,IAAI,WAAW,OAAO,iBACpB,OAAO;GAAE,MAAM;GAAiB;EAAY;EAE9C,IAAI,WAAW,OAAO,WAAW,OAAO;GAAE,MAAM;GAAW;EAAY;CACzE;CACA,OAAO;EAAE,MAAM;EAAW,SAAS,WAAW,KAAK,GAAG;CAAE;AAC1D;;;ACUA,IAAM,+BAA+B;AACrC,IAAM,gBAAgB,WAAW,KAAK;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,IAAM,0BAA0B,UAC9B,MAAM,KAAK,KAAK,CAAC,CAAC,OAAO,cAAc;CACrC,MAAM,YAAY,UAAU,YAAY,CAAC;CACzC,OACE,cAAc,KAAA,KAAa,EAAG,aAAa,KAAK,aAAa,MAAU,aAAa,OAAQ,aAAa;AAE7G,CAAC;AAEH,IAAM,sBAAsB,OAAe,WAA4B;CACrE,IAAI,CAAC,MAAM,WAAW,MAAM,GAAG,OAAO;CACtC,MAAM,SAAS,MAAM,MAAM,OAAO,MAAM;CACxC,OAAO,OAAO,WAAW,MAAM,MAAM,KAAK,MAAM,CAAC,CAAC,OAAO,cAAc,YAAY,KAAK,SAAS,CAAC;AACpG;AAEA,IAAM,2BACJ,IAAI,uBAAuB,EACzB,SAAS,oFACX,CAAC;AAEH,IAAM,yBACJ,WAC+D,OAAO,KAAK,OAAO,SAAS,kBAAkB,CAAC;AAEhH,IAAM,aAAa,MAA4B,UAC7C,OAAO,OAAO,KAAK,GAAG,KAAK,OAAO,OAAO,MAAM,GAAG,KAAK,KAAK,IAAI,UAAU,MAAM,IAAI;AAEtF,IAAM,gBAAgB,MAA4B,UAChD,KAAK,QAAQ,MAAM,OACnB,OAAO,OAAO,KAAK,GAAG,KACtB,OAAO,OAAO,MAAM,GAAG,KACvB,KAAK,IAAI,UAAU,MAAM,IAAI,SAC7B,UAAU,MAAM,KAAK;AAoDvB,IAAM,wBACJ,MACA,oBACkD;CAClD,MAAM,kBAAkB,SAAS,sBAAsB,eAAe;CACtE,IACE,OAAO,UAAU,eAAe,KAChC,gBAAgB,QAAQ,WAAW,KACnC,gBAAgB,QAAQ,SAAS,QACjC,CAAC,uBAAuB,gBAAgB,OAAO,KAC/C,gBAAgB,YAAY,OAC5B,gBAAgB,YAAY,QAC5B,KAAK,SAAS,gBAAgB,OAAO,MAAM,gBAAgB,WAC3D,SAAS,gBAAgB,gBAAgB,OAAO,MAAM,iBAEtD,OAAO,OAAO,KAAK,mBAAmB,CAAC;CAEzC,OAAO,OAAO,QAAQ,gBAAgB,OAAO;AAC/C;AAEA,IAAM,wBACJ,MACA,YAC0D;CAC1D,IAAI,YAAA,wCAAyC,OAAO,OAAO,QAAQ,EAAE,MAAM,SAAS,CAAC;CACrF,IAAI,CAAC,QAAQ,WAAA,qDAAqC,KAAK,CAAC,QAAQ,SAAS,IAAI,GAC3E,OAAO,OAAO,KAAK,mBAAmB,CAAC;CAEzC,MAAM,gBAAgB,QAAQ,MAAM,2BAA2B,QAAQ,EAAE,CAAC,CAAC,MAAM,oBAAoB;CACrG,IAAI,cAAc,WAAW,GAAG,OAAO,OAAO,KAAK,mBAAmB,CAAC;CACvE,MAAM,eAAe,cAAc;CACnC,MAAM,gBAAgB,cAAc;CACpC,IAAI,iBAAiB,KAAA,KAAa,kBAAkB,KAAA,GAAW,OAAO,OAAO,KAAK,mBAAmB,CAAC;CACtG,MAAM,gBAAgB,qBAAqB,MAAM,YAAY;CAC7D,IAAI,OAAO,UAAU,aAAa,GAAG,OAAO,OAAO,KAAK,cAAc,OAAO;CAC7E,IAAI,cAAc,QAAQ,WAAA,2BAAmC,GAAG,OAAO,OAAO,KAAK,mBAAmB,CAAC;CACvG,MAAM,iBAAiB,qBAAqB,MAAM,aAAa;CAC/D,IAAI,OAAO,UAAU,cAAc,GAAG,OAAO,OAAO,KAAK,eAAe,OAAO;CAC/E,OAAO,OAAO,QAAQ;EACpB,MAAM;EACN,eAAe,cAAc;EAC7B,gBAAgB,eAAe;CACjC,CAAC;AACH;AAEA,IAAM,2BAA2B,OAAO,GAAG,2CAA2C,CAAC,CAAC,WACtF,YACA,UACA;CACA,MAAM,gBAAgB,OAAO,sBAAsB,WAAW,SAAS,QAAQ,CAAC;CAChF,MAAM,OAAO,OAAO,sBAAsB,WAAW,KAAK,QAAQ,CAAC;CACnE,IACE,kBAAkB,YAClB,KAAK,SAAS,gBACb,KAAK,OAAO,SAAA,OACb,OAAO,OAAO,KAAK,GAAG,KACtB,OAAO,OAAO,KAAK,GAAG,GAEtB,OAAO,OAAO,mBAAmB;CAEnC,OAAO;AACT,CAAC;AAED,IAAM,iBAAiB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAC1E,YACA,MACA,YACA,UACA;CACA,MAAM,kBAAkB,OAAO,sBAAsB,WAAW,SAAS,UAAU,CAAC;CACpF,MAAM,aAAa,OAAO,sBAAsB,WAAW,KAAK,UAAU,CAAC;CAC3E,IACE,oBAAoB,cACpB,WAAW,SAAS,WACnB,WAAW,OAAO,SAAA,OACnB,CAAC,UAAU,UAAU,UAAU,KAC/B,OAAO,WAAW,IAAI,IAAA,MAEtB,OAAO,OAAO,mBAAmB;CAEnC,MAAM,UAAU,OAAO,sBAAsB,WAAW,eAAe,UAAU,CAAC;CAClF,OAAO,OAAO,OAAO,WAAW,qBAAqB,MAAM,OAAO,CAAC;AACrE,CAAC;AAED,IAAM,yBAAyB,OAAO,GAAG,iDAAiD,CAAC,CAAC,WAC1F,YACA,MACA,YACA,UACA,eACA,gBACA;CACA,MAAM,SAAS,OAAO,eAAe,YAAY,MAAM,YAAY,QAAQ;CAC3E,IACE,OAAO,SAAS,YACf,OAAO,kBAAkB,iBAAiB,OAAO,mBAAmB,iBAErE,OAAO,OAAO,mBAAmB;CAEnC,OAAO;AACT,CAAC;AAED,IAAM,yBAAyB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,EAAE,WAAW,YAAY,MAAM,aAAa;CAClD,MAAM,eAAe,KAAK,KAAK,UAAU,UAAU,mBAAmB;CACtE,MAAM,oBAAoB,OAAO,sBAAsB,WAAW,SAAS,YAAY,CAAC;CACxF,MAAM,eAAe,OAAO,sBAAsB,WAAW,KAAK,YAAY,CAAC;CAC/E,IACE,sBAAsB,gBACtB,aAAa,SAAS,UACtB,CAAC,UAAU,UAAU,YAAY,KACjC,OAAO,aAAa,IAAI,IAAI,cAAc,QAE1C,OAAO,OAAO,mBAAmB;CAGnC,MAAM,SAAS,OAAO,OAAO,OAC3B,sBAAsB,WAAW,KAAK,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAClE,OAAO,SAAS,SAAS,sBAAsB,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC,CACtF,CACF;CACA,IACE,OAAO,OAAO,MAAM,KACpB,OAAO,MAAM,WAAW,cAAc,UACtC,CAAC,cAAc,OAAO,MAAM,UAAU,OAAO,MAAM,WAAW,IAAI,GAClE,OAAO,OAAO,mBAAmB;CAKnC,OAAO,OAAO,OACZ,OAAO,IAAI,aAAY;EACrB,MAAM,eAAe,OAAO,sBAC1B,WAAW,wBAAwB,EAAE,QAAQ,kCAAkC,CAAC,CAClF;EACA,MAAM,mBAAmB,KAAK,KAAK,cAAc,mBAAmB;EACpE,OAAO,sBAAsB,WAAW,SAAS,cAAc,gBAAgB,CAAC;EAEhF,KAAK,MAAM,UAAU,CAAC,QAAQ,UAAU,GAAG;GACzC,MAAM,UAAU,GAAG,eAAe;GAClC,IAAI,EAAE,OAAO,sBAAsB,WAAW,OAAO,OAAO,CAAC,IAAI;GACjE,MAAM,mBAAmB,OAAO,sBAAsB,WAAW,SAAS,OAAO,CAAC;GAClF,MAAM,cAAc,OAAO,sBAAsB,WAAW,KAAK,OAAO,CAAC;GACzE,IACE,qBAAqB,WACrB,YAAY,SAAS,UACrB,CAAC,UAAU,UAAU,WAAW,GAChC,OAAO,OAAO,mBAAmB;GACnC,OAAO,sBAAsB,WAAW,SAAS,SAAS,GAAG,mBAAmB,QAAQ,CAAC;EAC3F;EAEA,OAAO,sCAAsC;GAC3C,UAAU,KAAK,KAAK,cAAc,OAAO;GACzC,yBAAyB,UAAU,kBAAkB;GACrD,aAAa,QAAQ;GACrB,gBAAgB,UAAU,kBAAkB;EAC9C,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC;CAC7C,CAAC,CACH;AACF,CAAC;AAED,IAAM,WAAW,OAAO,GAAG,mCAAmC,CAAC,CAAC,WAC9D,aACA,QACA;CACA,OAAO,iBAAiB,MAAM;AAChC,CAAC;AAED,IAAM,gBAAgB,OAAO,GAAG,wCAAwC,CAAC,CAAC,WACxE,SACA;CACA,OAAO,sBAAsB,QAAQ,UAAU,QAAQ,eAAe,QAAQ,cAAc;AAC9F,CAAC;AAED,IAAM,4BAA4B,OAAO,GAAG,4CAA4C,CAAC,CAAC,WACxF,SACA,eACA,gBACA;CACA,MAAM,EAAE,UAAU,YAAY,MAAM,aAAa;CAEjD,MAAM,gBAAe,OADE,sBAAsB,WAAW,cAAc,QAAQ,CAAC,EAAA,CAClD,QAAQ,UAAU,mBAAmB,OAAO,+BAA+B,CAAC;CACzG,MAAM,oBAAmC,CAAC;CAE1C,KAAK,MAAM,eAAe,cAAc;EACtC,MAAM,cAAc,KAAK,KAAK,UAAU,WAAW;EACnD,MAAM,mBAAmB,OAAO,sBAAsB,WAAW,SAAS,WAAW,CAAC;EACtF,MAAM,cAAc,OAAO,sBAAsB,WAAW,KAAK,WAAW,CAAC;EAC7E,IACE,qBAAqB,eACrB,YAAY,SAAS,WACpB,YAAY,OAAO,SAAA,OACpB,CAAC,UAAU,UAAU,WAAW,KAChC,OAAO,YAAY,IAAI,IAAI,2BAAmB,eAAe,cAAc,CAAC,CAAC,QAC7E,OAAO,OAAO,mBAAmB;EAEnC,MAAM,UAAU,OAAO,sBAAsB,WAAW,eAAe,WAAW,CAAC;EACnF,IACE,CAAA,uCAA6B,WAAW,OAAO,KAC/C,CAAC,2BAAmB,eAAe,cAAc,CAAC,CAAC,WAAW,OAAO,GACrE,OAAO,OAAO,mBAAmB;EACnC,kBAAkB,KAAK,WAAW;CACpC;CAEA,KAAK,MAAM,eAAe,mBAAmB;EAC3C,MAAM,UAAU,OAAO,WAAW,OAAO,WAAW,CAAC,CAAC,KAAK,OAAO,MAAM;EACxE,IAAI,OAAO,UAAU,OAAO,KAAK,QAAQ,QAAQ,OAAO,SAAS,YAC/D,OAAO,OAAO,mBAAmB;CAErC;CAEA,IAAI,aAAa,SAAS,GAAG,OAAO,SAAS,YAAY,QAAQ;AACnE,CAAC;AAED,IAAM,yBAAyB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,EAAE,eAAe,UAAU,YAAY,iBAAiB,SAAS;CACvE,MAAM,kBAAkB,SACtB,KAAK,SAAS,gBACb,KAAK,OAAO,SAAA,OACb,aAAa,iBAAiB,IAAI;CAEpC,OAAO,OAAO,OACZ,OAAO,gBACL,OAAO,IAAI,aAAY;EACrB,MAAM,YAAY,OAAO,sBAAsB,WAAW,KAAK,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC;EACvF,MAAM,gBAAgB,OAAO,sBAAsB,UAAU,IAAI;EACjE,IAAI,CAAC,eAAe,aAAa,GAAG,OAAO,OAAO,mBAAmB;EAErE,MAAM,iBAAiB,OAAO,IAAI,aAAY;GAC5C,MAAM,UAAU,OAAO,UAAU,KAAK,KAAK,OAAO,MAAM;GACxD,MAAM,QAAQ,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACjE,MAAM,WAAW,OAAO,WAAW,SAAS,QAAQ,CAAC,CAAC,KAAK,OAAO,MAAM;GACxE,IACE,OAAO,UAAU,OAAO,KACxB,OAAO,UAAU,KAAK,KACtB,OAAO,UAAU,QAAQ,KACzB,SAAS,YAAY,YACrB,CAAC,eAAe,QAAQ,OAAO,KAC/B,CAAC,aAAa,QAAQ,SAAS,MAAM,OAAO,GAC5C,OAAO,OAAO,mBAAmB;EACrC,CAAC;EAED,OAAO;EACP,MAAM,SAAS,OAAO,sBAAsB,cAAc,YAAY,EAAE,CAAC;EACzE,MAAM,YAAY,KAAK,KAAK,UAAU,GAAG,+BAA+B,SAAS,UAAU,MAAM,GAAG;EACpG,MAAM,QAAQ,OAAO,sBACnB,WAAW,KAAK,WAAW;GAAE,MAAM;GAAM,MAAA;EAA4B,CAAC,CACxE;EACA,OAAO,OAAO,mBACZ,WAAW,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,KAC5C,OAAO,QAAQ,UAAU,IAAI,GAC7B,OAAO,MACT,CACF;EACA,OAAO,sBAAsB,WAAW,MAAM,WAAA,GAAgC,CAAC;EAC/E,MAAM,YAAY,OAAO,sBAAsB,MAAM,IAAI;EACzD,IACE,UAAU,SAAS,WAClB,UAAU,OAAO,SAAA,OAClB,CAAC,UAAU,eAAe,SAAS,GACnC,OAAO,OAAO,mBAAmB;EAEnC,OAAO;EACP,OAAO,sBAAsB,WAAW,OAAO,SAAS,CAAC;EACzD,OAAO,sBAAsB,UAAU,IAAI;EAC3C,OAAO;CACT,CAAC,CACH,CACF;AACF,CAAC;AAED,IAAM,sBAAsB,MAAiB,QAAgB,WAA0C;CACrG,MAAM,OAAO,KAAK,SAAS,MAAM;CACjC,OAAO,CAAC,KAAK,WAAW,MAAM,KAAK,WAAW,QAAQ,KAAK,WAAA,2BAAmC,IAC1F,OAAO,KAAK,KAAK,KAAK,QAAQ,IAAI,CAAC,IACnC,OAAO,KAAK;AAClB;AAEA,IAAM,qBAAqB,UACzB,MAAM,KAAK,KAAK,CAAC,CAAC,OAAO,cAAc,iBAAiB,KAAK,SAAS,CAAC;AAEzE,IAAM,gCAAgC,MAAiB,YAA6B;CAClF,IAAA,sDAA+B,WAAW,OAAO,GAAG,OAAO;CAC3D,IAAI,CAAC,QAAQ,WAAA,qDAAqC,GAAG,OAAO;CAC5D,MAAM,YAAY,QAAQ,MAAM,2BAA2B,MAAM;CACjE,MAAM,kBAAkB,UAAU,QAAQ,IAAI;CAC9C,IAAI,oBAAoB,IAAI,OAAO,kBAAkB,SAAS;CAE9D,IAAI,CAAC,kBADgB,UAAU,MAAM,GAAG,eACjB,CAAY,GAAG,OAAO;CAE7C,MAAM,cAAc;CACpB,MAAM,cAAc,UAAU,MAAM,kBAAkB,CAAC;CACvD,IAAI,YAAY,WAAW,WAAW,GAAG,OAAO;CAChD,IAAI,CAAC,YAAY,WAAW,WAAW,GAAG,OAAO;CACjD,MAAM,8BAA8B,YAAY,MAAM,EAAkB;CACxE,IAAI,CAAC,4BAA4B,SAAS,IAAI,GAAG,OAAO,kBAAkB,2BAA2B;CACrG,OAAO,OAAO,UAAU,qBAAqB,MAAM,OAAO,CAAC;AAC7D;AAEA,IAAM,2BAA2B,MAAiB,YAAA,uCACpB,WAAW,OAAO,KAAK,6BAA6B,MAAM,OAAO;AAE/F,IAAM,2BAA2B,OAAO,GAAG,mDAAmD,CAAC,CAAC,WAC9F,YACA,MACA,aACA,UACA,OACA;CACA,MAAM,gBAAgB,UAAU;CAChC,MAAM,eAAe,mBAAmB,OAAO,4BAA4B;CAC3E,MAAM,kBAAkB,mBAAmB,OAAO,+BAA+B;CACjF,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,iBAAiB,OAAO;CAEhE,MAAM,eAAe,KAAK,KAAK,aAAa,KAAK;CACjD,MAAM,oBAAoB,OAAO,sBAAsB,WAAW,SAAS,YAAY,CAAC;CACxF,MAAM,eAAe,OAAO,sBAAsB,WAAW,KAAK,YAAY,CAAC;CAC/E,IACE,sBAAsB,gBACtB,aAAa,SAAS,WACrB,aAAa,OAAO,SAAA,OACrB,CAAC,UAAU,UAAU,YAAY,GACjC,OAAO,OAAO,mBAAmB;CAEnC,IAAI,eAAe;EACjB,IAAI,OAAO,aAAa,IAAI,IAAA,MAAgC,OAAO,OAAO,mBAAmB;EAE7F,MAAM,SAAS,qBAAqB,MAAM,OADnB,sBAAsB,WAAW,eAAe,YAAY,CAAC,CACnC;EACjD,IACE,OAAO,UAAU,MAAM,KACtB,OAAO,QAAQ,SAAS,WAAW,OAAO,QAAQ,mBAAmB,KAAK,SAAS,WAAW,GAC/F,OAAO,OAAO,mBAAmB;EACnC,OAAO;CACT;CAEA,IAAI,cAAc;EAChB,IAAI,OAAO,aAAa,IAAI,MAAM,GAAG,OAAO,OAAO,mBAAmB;EACtE,OAAO;CACT;CAEA,IAAI,OAAO,aAAa,IAAI,IAAA,MAAgC,OAAO,OAAO,mBAAmB;CAC7F,MAAM,UAAU,OAAO,sBAAsB,WAAW,eAAe,YAAY,CAAC;CACpF,MAAM,iBAAiB,qBAAqB,MAAM,OAAO;CACzD,IACE,OAAO,UAAU,cAAc,KAC/B,eAAe,QAAQ,SAAS,WAChC,eAAe,QAAQ,mBAAmB,KAAK,SAAS,WAAW,GACnE,OAAO,OAAO,mBAAmB;CACnC,IAAI,CAAC,wBAAwB,MAAM,OAAO,GAAG,OAAO,OAAO,mBAAmB;CAC9E,OAAO;AACT,CAAC;AAED,IAAM,4BAA4B,OAAO,GAAG,4CAA4C,CAAC,CAAC,WACxF,SACA;CACA,MAAM,EAAE,YAAY,QAAQ,MAAM,2BAA2B;CAC7D,MAAM,UAAU,OAAO,sBAAsB,WAAW,cAAc,MAAM,CAAC;CAC7E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,CAAC,MAAM,WAAA,2BAAmC,KAAK,KAAK,SAAS,KAAK,MAAM,OAAO;EACnF,MAAM,cAAc,KAAK,KAAK,QAAQ,KAAK;EAC3C,MAAM,WAAW,OAAO,yBAAyB,YAAY,WAAW;EACxE,MAAM,iBAAiB,OAAO,sBAAsB,WAAW,cAAc,WAAW,CAAC;EACzF,IAAI,kBAAkB;EACtB,KAAK,MAAM,QAAQ,gBACjB,IAAI,EAAE,OAAO,yBAAyB,YAAY,MAAM,aAAa,UAAU,IAAI,IACjF,kBAAkB;EAGtB,IAAI,CAAC,iBAAiB;EAEtB,MAAM,SAAS,OAAO,eACpB,YACA,MACA,KAAK,KAAK,aAAa,qBAAqB,GAC5C,QACF;EACA,IAAI,OAAO,SAAS,UAAU,OAAO,OAAO,mBAAmB;EAC/D,IAAI,OAAO,mBAAmB,OAAO,OAAO,OAAO,mBAAmB;EACtE,IAAI,OAAO,kBAAkB,wBAAwB;EAErD,MAAM,aAAa,KAAK,KAAK,QAAQ,OAAO,aAAa;EACzD,MAAM,gBAAgB,OAAO,WAAW,SAAS,UAAU,CAAC,CAAC,KAAK,OAAO,MAAM;EAC/E,IAAI,OAAO,UAAU,aAAa,KAAK,cAAc,YAAY,OAC/D,OAAO,OAAO,mBAAmB;CAErC;AACF,CAAC;AAED,IAAM,0BAA0B,OAAO,GAAG,0CAA0C,CAAC,CAAC,WACpF,SACA;CACA,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;EAC/C,MAAM,YAAY,OAAO,0BAA0B,OAAO,CAAC,CAAC,KAAK,OAAO,MAAM;EAC9E,IAAI,OAAO,UAAU,SAAS,GAAG;EACjC,IAAI,YAAY,GAAG,OAAO,OAAO,OAAO,KAAK,UAAU,OAAO;EAC9D,OAAO,OAAO;CAChB;AACF,CAAC;AAED,IAAM,yBAAyB,OAAO,GAAG,yCAAyC,CAAC,CAAC,WAClF,SACA;CACA,MAAM,EAAE,eAAe,UAAU,YAAY,QAAQ,SAAS;CAE9D,KAAI,OADyB,sBAAsB,WAAW,SAAS,QAAQ,CAAC,OAC1D,UAAU,OAAO;CAGvC,MAAM,cAAc,mBAAmB,MAAM,QAAQ,OADxB,sBAAsB,WAAW,SAAS,QAAQ,CAAC,CACd;CAClE,IAAI,OAAO,OAAO,WAAW,GAAG,OAAO,OAAO,mBAAmB;CAEjE,MAAM,cAAc,OAAO,yBAAyB,YAAY,YAAY,KAAK;CASjF,KAAI,OARkB,uBACpB,YACA,MACA,KAAK,KAAK,YAAY,OAAA,sBAA4B,GAClD,aACA,KAAK,SAAS,QAAQ,GACtB,KAAK,SAAS,YAAY,KAAK,CACjC,EAAA,CACW,SAAS,UAAU,OAAO,OAAO,mBAAmB;CAC/D,OAAO,uBAAuB;EAC5B;EACA,UAAU,YAAY;EACtB;EACA,iBAAiB;EACjB;CACF,CAAC;CACD,OAAO,YAAY;AACrB,CAAC;AAED,IAAM,uBAAuB,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAC9E,SACA;CAEA,OAAO,0BAA0B,OADT,0BAA0B,QAAQ,QAAQ,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC,GACjE,aAAa,OAAO,IAAI,CAAC,CAAC,KACnE,OAAO,UAAU,UACf,UAAU,SAAS,OAAO,4BAA4B,KAAK,UAAU,SAAS,OAAO,uBAAuB,IACxG,mBAAmB,IACnB,KACN,CACF;AACF,CAAC;AAO8C,OAAO,GAAG,iCAAiC,CAAC,CAAC,WAI1F,WACA,YAOA;CACA,MAAM,aAAa,OAAO,WAAW;CACrC,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,SAAS,KAAK,QAAQ,UAAU,QAAQ;CAC9C,MAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ;CACtD,IAAI,cAAc,WAAA,2BAAmC,GAAG,OAAO,OAAO,mBAAmB;CACzF,IAAI,OAAO,sBAAsB,WAAW,OAAO,UAAU,QAAQ,CAAC,GACpE,OAAO,OAAO,mBAAmB;CAEnC,OAAO,sBAAsB,WAAW,cAAc,QAAQ,EAAE,WAAW,KAAK,CAAC,CAAC;CAClF,OAAO,wBAAwB;EAC7B;EACA;EACA;EACA,wBAAwB;CAC1B,CAAC;CAED,OAAO,OAAO,0BAA0B,OADhB,0BAA0B,UAAU,QAAQ,CAAC,CAAC,KAAK,OAAO,SAAS,kBAAkB,CAAC,GAC5D,MAAM,UAAU,CAAC,CAAC,KAClE,OAAO,UAAU,UAAU,UAAU,SAAS,OAAO,uBAAuB,IAAI,mBAAmB,IAAI,KAAK,CAC9G;AACF,CAAC;;AAGD,IAAa,uCAAuC,OAAO,GACzD,sCACF,CAAC,CAAC,WACA,WACqG;CACrG,MAAM,aAAa,OAAO,WAAW;CACrC,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,SAAS,KAAK,QAAQ,UAAU,QAAQ;CAC9C,MAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ;CACtD,IAAI,cAAc,WAAA,2BAAmC,GAAG,OAAO,OAAO,mBAAmB;CACzF,IAAI,EAAE,OAAO,sBAAsB,WAAW,OAAO,UAAU,QAAQ,CAAC,IACtE,OAAO,OAAO,mBAAmB;CAGnC,MAAM,gBAAgB,OAAO,sBAAsB,WAAW,SAAS,UAAU,QAAQ,CAAC;CAC1F,IAAI,mBAAmB;CACvB,IAAI,kBAAkB,UAAU,UAAU;EAExC,MAAM,cAAc,mBAAmB,MAAM,QAAQ,OADxB,sBAAsB,WAAW,SAAS,UAAU,QAAQ,CAAC,CACxB;EAClE,IAAI,OAAO,OAAO,WAAW,KAAK,YAAY,UAAU,eACtD,OAAO,OAAO,mBAAmB;EAEnC,mBAAmB,OAAO,2BAA2B,YAAY,KAAK;CACxE;CAEA,MAAM,WAAW,OAAO,yBAAyB,YAAY,iBAAiB,QAAQ;CACtF,MAAM,aAAa,KAAK,KAAK,iBAAiB,UAAU,qBAAqB;CAC7E,IAAI,EAAE,OAAO,sBAAsB,WAAW,OAAO,UAAU,CAAC,IAAI,OAAO,OAAO,mBAAmB;CASrG,KAAI,OARkB,uBACpB,YACA,MACA,YACA,UACA,eACA,KAAK,SAAS,iBAAiB,QAAQ,CACzC,EAAA,CACW,SAAS,SAAS,OAAO,OAAO,mBAAmB;CAC9D,OAAO;AACT,CAAC;;AAGD,IAAa,+BAA+B,OAAO,GAAG,8BAA8B,CAAC,CAAC,WACpF,WACqH;CACrH,MAAM,gBAAgB,OAAO,OAAO;CACpC,MAAM,aAAa,OAAO,WAAW;CACrC,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,SAAS,KAAK,QAAQ,UAAU,QAAQ;CAC9C,MAAM,gBAAgB,KAAK,SAAS,UAAU,QAAQ;CACtD,IAAI,cAAc,WAAA,2BAAmC,GAAG,OAAO,OAAO,mBAAmB;CAGzF,IAAI,EAAC,OAFkB,sBAAsB,WAAW,OAAO,UAAU,QAAQ,CAAC,IAEpE;EACZ,OAAO,sBAAsB,WAAW,cAAc,QAAQ,EAAE,WAAW,KAAK,CAAC,CAAC;EAClF,OAAO,wBAAwB;GAC7B;GACA;GACA;GACA,wBAAwB;EAC1B,CAAC;EACD,OAAO,qBAAqB;GAC1B;GACA,UAAU,UAAU;GACpB;GACA;GACA;EACF,CAAC;CACH;CAEA,MAAM,kBAAkB,OAAO,uBAAuB;EACpD;EACA,UAAU,UAAU;EACpB;EACA;EACA;CACF,CAAC;CACD,MAAM,mBAAmB,oBAAoB,UAAU,WACnD,YACA,OAAO,2BAA2B,eAAe;CAErD,MAAM,WAAW,OAAO,yBAAyB,YAAY,iBAAiB,QAAQ;CACtF,MAAM,iBAAiB,KAAK,SAAS,iBAAiB,QAAQ;CAC9D,MAAM,aAAa,KAAK,KAAK,iBAAiB,UAAU,qBAAqB;CAE7E,MAAM,kBAAiB,OADE,sBAAsB,WAAW,OAAO,UAAU,CAAC,KAExE,OAAO,KACP,OAAO,uBACL,YACA,MACA,YACA,UACA,eACA,cACF,CACF,IACE,OAAO,KAAqB;CAChC,OAAO,uBAAuB;EAC5B;EACA,UAAU,iBAAiB;EAC3B;EACA,iBAAiB;EACjB;CACF,CAAC;CACD,IAAI,OAAO,OAAO,cAAc,GAAG;EACjC,OAAO,uBAAuB;GAAE,WAAW;GAAkB;GAAY;GAAM;EAAS,CAAC;EACzF,OAAO,0BACL;GACE,UAAU,iBAAiB;GAC3B;GACA;GACA;EACF,GACA,eACA,cACF;EACA,OAAO,cAAc;GACnB;GACA;GACA,UAAU,iBAAiB;GAC3B;GACA;GACA;EACF,CAAC;CACH,OAAO;EACL,OAAO,0BACL;GACE,UAAU,iBAAiB;GAC3B;GACA;GACA;EACF,GACA,eACA,cACF;EACA,IAAI,eAAe,MAAM,SAAS,UAChC,OAAO,cAAc;GACnB;GACA;GACA,UAAU,iBAAiB;GAC3B;GACA;GACA;EACF,CAAC;CAEL;CASA,KAAI,OARuB,uBACzB,YACA,MACA,YACA,UACA,eACA,cACF,EAAA,CACgB,SAAS,SAAS,OAAO,OAAO,mBAAmB;CACnE,OAAO;AACT,CAAC;;;ACpwBD,IAAM,WAAW,EACf,aAAa,iBACf;AAEA,IAAM,aAAa,OAAO,IAAI;CAC5B,cAAc,OAAO,OAAO,6BAA6B,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACtF,UAAU,OAAO,OAAO,mBAAmB,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACxE,cAAc,OAAO,OAAO,kCAAkC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC3F,eAAe,OAAO,OAAO,oBAAoB,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC9E,cAAc,OAAO,OAAO,kCAAkC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC3F,UAAU,OAAO,OAAO,6BAA6B,CAAC,CAAC,KAAK,OAAO,YAAY,eAAe,CAAC;CAC/F,gBAAgB,OAAO,OAAO,oCAAoC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC/F,iBAAiB,OAAO,OAAO,sBAAsB,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAClF,gBAAgB,OAAO,OAAO,oCAAoC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;AACjG,CAAC;AAED,IAAM,gBAAgB,cACpB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,aAAa,SAAS,KAAK,CAAC,CAAC,YAAY,MAAM,MAAM;AAElF,IAAM,mBAAmB,OAAO,SAAS,CAAC,aAAa,eAAe,CAAC;AAIvE,IAAM,mDAAmC,IAAI,IAAI;CAC/C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,IAAM,yDAAyC,IAAI,IAAI,CACrD,4BACA,yBACF,CAAC;AAED,IAAM,kCAAN,cAA8C,OAAO,iBAAkD,CAAC,CACtG,mCACA;CACE,QAAQ,OAAO,SAAS,CAAC,oBAAoB,sBAAsB,CAAC;CACpE,QAAQ,OAAO,SAAS,CAAC,QAAQ,QAAQ,CAAC;AAC5C,CACF,CAAC,CAAC,CAAC;AAEH,IAAM,yBAAyB,OAAO,GAAG,mDAAmD,CAAC,CAAC,WAC5F,QACA,UACA;CACA,IAAI,aAAa,IAAI;CACrB,MAAM,MAAM,OAAO,OAAO,oBAAoB,OAAO,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,KAC5E,OAAO,eAAe,IAAI,gCAAgC;EAAE,QAAQ;EAAoB;CAAO,CAAC,CAAC,CACnG;CACA,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAC/C,OAAO,OAAO,IAAI,gCAAgC;EAAE,QAAQ;EAAoB;CAAO,CAAC;AAE5F,CAAC;AAED,IAAM,kBAAkB,OAAO,GAAG,4CAA4C,CAAC,CAAC,WAC9E,QACA,gBACA,cACA;CACA,MAAM,YAAY,eAAe,KAAK,MAAM,KAAK,eAAe,eAAA,CAAgB,KAAK,CAAC,CAAC,YAAY;CACnG,OAAO,OAAO,OAAO,oBAAoB,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,KACnE,OAAO,eAAe,IAAI,gCAAgC;EAAE,QAAQ;EAAwB;CAAO,CAAC,CAAC,CACvG;AACF,CAAC;AAED,IAAM,uBAAuB,eAAe,SAC1C,eAAe,QAAQ,EAAE,KAAK,EAAE,6BAA6B,wBAAwB,EAAE,CAAC,CAC1F;AAEA,IAAM,mBAAmB,OAAO,GAAG,6CAA6C,CAAC,CAAC,WAAU,OAAe;CACzG,MAAM,aAAa,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,IAAI,eAAe,QAAQ,OAAO;CAClC,IAAI,eAAe,MAAM,eAAe,SAAS,OAAO;CACxD,OAAO,OAAO,WAAW,mEAAmE;CAC5F,OAAO;AACT,CAAC;AAED,IAAM,kCAAkC,OAAO,oBAAoB,OAAO,kBAAkB,OAAO,GAAG,CAAC;AAEvG,IAAM,2BACJ,UACA,gBAEA,eAAe,MAAM,SAAS;CAC5B,IAAI,KAAK,WAAW,KAAK,KAAK,OAAO,qBACnC,OAAO,OAAO,QAAQ,eAAe,UAAU,cAAc,SAAS,OAAO,CAAC;CAEhF,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,KACzB,OAAO,KAAK,SAAS;EACnB,IACE,KAAK,WAAW,KAChB,OAAO,KAAK,OAAO,YACnB,CAAC,iCAAiC,IAAI,KAAK,EAAE,KAC7C,SAAS,KAAA,GAET,OAAO;EAET,MAAM,QAAQ,KAAK;EACnB,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAChC,MAAM,UAAU,gCAAgC,KAAK;EACrD,OAAO,OAAO,OAAO,OAAO,KACvB,uCAAuC,IAAI,KAAK,EAAE,KAAK,QAAQ,SAAS,IACzE,KAAA,IACA;CACN,CAAC,CACH;AACF,CAAC;AAEH,IAAM,sBAAsB,aAC1B,aAAa,cAAc,kBAAkB,YAAY,kBAAkB;AAE7E,IAAM,eAAe,aACnB,WAAW,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,KACvC,MAAM,QAAQ,mBAAmB,QAAQ,CAAC,GAC1C,MAAM,QAAQ,oBAAoB,CACpC;AAEF,IAAM,eAAe,aACnB,WAAW,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,KACvC,MAAM,QAAQ,mBAAmB,QAAQ,CAAC,GAC1C,MAAM,QAAQ,oBAAoB,CACpC;AAoCF,IAAa,iCAlC8B,OAAO,IAAI,aAAY;CAChE,MAAM,aAAa,OAAO;CAC1B,MAAM,cAAc,OAAO,iBAAiB,WAAW,QAAQ;CAC/D,IAAI,aAAa,OAAO,MAAM;CAE9B,MAAM,WAAW,OAAO,eAAe;CAEvC,MAAM,cAAc,aAAa,WAAW,aAAa;CACzD,MAAM,gBAAgB,aAAa,WAAW,eAAe;CAC7D,IAAI,aACF,OAAO,uBACL,QACA,WAAW,iBAAiB,KAAK,WAAW,eAAe,WAAW,YACxE;CAEF,IAAI,eACF,OAAO,uBACL,UACA,WAAW,mBAAmB,KAAK,WAAW,eAAe,WAAW,cAC1E;CAEF,MAAM,eAAe,cACjB,OAAO,gBAAgB,QAAQ,WAAW,cAAc,WAAW,QAAQ,IAC3E;CACJ,MAAM,iBAAiB,gBACnB,OAAO,gBAAgB,UAAU,WAAW,gBAAgB,WAAW,QAAQ,IAC/E;CAEJ,OAAO,MAAM,MACX,cAAc,YAAY,YAAY,IAAI,MAAM,OAChD,gBAAgB,YAAY,cAAc,IAAI,MAAM,KACtD,CAAC,CAAC,KAAK,MAAM,QAAQ,eAAe,MAAM,wBAAwB,UAAU,WAAW,CAAC,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC,KAAK,MAAM,MAEgC,CAAA,CAA4B,KAAK,MAAM,QAAQ,gBAAgB,KAAK,CAAC;;;ACrInH,IAAM,uBAAuB,YAAY,KAAK,sCAAsC;AACpF,IAAM,mBAAmB,SAAS,KAAK,sCAAsC;AAE7E,IAAM,kBAAkB,UACtB,MACG,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,KAAK,SAAS,CAAC;AAErC,IAAM,wBAAwB,OAAO,OAAO,0BAA0B,CAAC,CAAC,KAAK,OAAO,YAAY,iBAAiB,CAAC;AAElH,IAAM,sBAAsB,OAAO,IAAI;CACrC,uBAAuB,OAAO,OAAO,wCAAwC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC1G,kBAAkB,OAAO,OAAO,mCAAmC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAChG,sBAAsB,OAAO,OAAO,uCAAuC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACxG,iBAAiB,OAAO,OAAO,kCAAkC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC9F,UAAU,OAAO,OAAO,0BAA0B,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC/E,gBAAgB,OAAO,OAAO,gCAAgC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC3F,cAAc,OAAO,OAAO,8BAA8B,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACvF,gBAAgB,OAAO,OAAO,gCAAgC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CAC3F,kBAAkB,OAAO,QAAQ,mCAAmC,CAAC,CAAC,KAAK,OAAO,YAAY,KAAK,CAAC;CACpG,yBAAyB,OAAO,OAAO,oCAAoC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACxG,wBAAwB,OAAO,OAAO,oCAAoC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACvG,MAAM,OAAO,OAAO,qBAAqB,CAAC,CAAC,KAAK,OAAO,YAAY,WAAW,CAAC;CAC/E,MAAM,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,OAAO,YAAY,IAAI,CAAC;CACrE,cAAc,OAAO,OAAO,8BAA8B,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;CACvF,uBAAuB,OAAO,OAAO,wCAAwC,CAAC,CAAC,KAAK,OAAO,YAAY,EAAE,CAAC;AAC5G,CAAC;AAED,IAAM,mBAAmB,UACvB,MAAM,MAAM,KAAK,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC;AAEvF,IAAM,mBAAmB,UACvB,MAAM,MAAM,KAAK,UAAU,OAAO,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC;AAEvF,IAAM,oBAAoB,UAAkB,UAAkB,iBAC5D,aAAa,SAAS,aAClB,WACA,GAAG,SAAS,GAAG,aAAa,qBAAqB,OAAO;AAE9D,IAAM,6BAAN,cAAyC,OAAO,iBAA6C,CAAC,CAC5F,8BACA,EAAE,SAAS,OAAO,OAAO,CAC3B,CAAC,CAAC,CAAC;AAEH,IAAM,UAAU,OAAO,OACrB,OAAO,IAAI,aAAY;CACrB,MAAM,OAAO,OAAO,KAAK;CAEzB,MAAM,aAAa,kCAAkC,QAAO,OADvC,MAAM,MAAA,CACuC,IAAI;CACtE,IAAI,WAAW,SAAS,WAAW;EACjC,OAAO,gBACL,wGACF;EACA,OAAO,OAAO,IAAI,2BAA2B,EAAE,SAAS,WAAW,QAAQ,CAAC;CAC9E;CAEA,IAAI,WAAW,SAAS,iBAAiB;EAEvC,OAAO,gBAAgB,iBAAiB,oBAAoB,wBAAwB,OADxD,aAAa,WAAW,WAAW,CACiC,CAAC;EACjG;CACF;CAEA,MAAM,qBAAqB,OAAO;CAClC,IAAI,WAAW,SAAS,WAAW;EAKjC,OAAO,gBAAgB,iBAAiB,oBAAoB,yBAAwB,OAJ5D,cAAc;GACpC,aAAa,WAAW;GACxB;EACF,CAAC,EACmF,CAAS,YAAY,CAAC;EAC1G;CACF;CAEA,MAAM,sBAAsB,OAAO,6BAA6B,kBAAkB;CAClF,IAAI,WAAW,SAAS,UAAU;EAChC,MAAM,oBAAoB,OAAO,qCAAqC,mBAAmB;EAKzF,OAAO,gBAAgB,iBAAiB,mBAAmB,wBAAuB,OAJzD,4BAA4B;GACnD,aAAa,WAAW;GACxB,mBAAmB,kBAAkB;EACvC,CAAC,EACiF,CAAU,YAAY,CAAC;EACzG;CACF;CAEA,MAAM,YAAY,OAAO,6BAA6B,mBAAmB;CAEzE,IAAI,WAAW,SAAS,iBAAiB;EACvC,MAAM,mBAAmB,OAAO,MAAM,MAAM,sBAAsB,UAAU,iBAAiB,CAAC;EAE9F,MAAM,SAAS,OADE,QAAQ,IAAI,kBAAkB,gBACzB,CAAA,CAAS,mBAAmB;GAChD,aAAa;GACb,OAAO;IAAE,MAAM;IAAS,UAAU;GAAiB;GACnD,6BAA6B;EAC/B,CAAC;EACD,OAAO,gBAAgB,0BAA0B,SAAS,MAAM,OAAO,WAAW,GAAG;EACrF;CACF;CAEA,MAAM,eAAe,OAAO,OAAO;CACnC,MAAM,qBAAqB,OAAO,MAAM,KAAK,YAAY;CACzD,MAAM,wBAAwB,OAAO,MAAM,eAAe,gCAAgC,kBAAkB;CAC5G,OAAO,OAAO,OAAO,IAAI,aAAY;EACnC,MAAM,aAAa,OAAO;EAC1B,MAAM,iBAAiB,OAAO,OAAO,oBAAoB,OAAO,MAAM,aAAa,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC,CAAC,CAC5G,eAAe,WAAW,cAAc,CAC1C;EACA,MAAM,WAAW,eAAe,WAAW,IACvC,OACA,OAAO,OAAO,oBAAoB,OAAO,OAAO,MAAM,OAAO,UAAU,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC,CAC/F,WAAW,QACb;EACF,MAAM,eAAe,eAAe,WAAW,YAAY;EAC3D,MAAM,iBAAiB,eAAe,WAAW,cAAc;EAC/D,MAAM,wBAAwB,eAAe,WAAW,qBAAqB;EAC7E,MAAM,oBAAoB,WAAW,wBAAwB,SAAS,KACpE,WAAW,uBAAuB,SAAS;EAC7C,MAAM,aAAa,OAAO,iBAAiB;GACzC,MAAM,WAAW;GACjB,MAAM,WAAW;GACjB,kBAAkB,WAAW;GAC7B,GAAI,WAAW,aAAa,SAAS,IAAI,EAAE,cAAc,WAAW,aAAa,IAAI,CAAC;GACtF,GAAI,aAAa,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;GAClD,GAAI,eAAe,SAAS,IAAI,EAAE,eAAe,IAAI,CAAC;GACtD,GAAI,sBAAsB,SAAS,IAAI,EAAE,sBAAsB,IAAI,CAAC;GACpE,GAAI,oBACA,EACA,WAAW;IACT,gBAAgB,WAAW;IAC3B,eAAe,WAAW;GAC5B,EACF,IACE,CAAC;EACP,CAAC;EACD,MAAM,aAAa,OAAO,KAAK,YAAY,IAAI,IAAI,gBAAgB,OAAO,KAAK,GAAG,CAAC;EACnF,MAAM,WAAW,OAAO,MAAM,MAC5B,wBAAwB;GACtB;GACA,yBAAyB;GACzB,WAAW;IACT,OAAO;KAAE,MAAM;KAAS,UAAU;IAAiB;IACnD,aAAa;IACb,eAAe,cAAc,KAAK,gBAAgB;GACpD;GACA,mBAAmB,UAAU;GAC7B,cAAc,aAAa,OACvB,OACA;IACA,KAAK;IACL,kBAAkB;IAClB,GAAI,WAAW,qBAAqB,SAAS,IACzC,EAAE,iBAAiB,WAAW,qBAAqB,IACnD,CAAC;IACL,GAAI,WAAW,gBAAgB,SAAS,IAAI,EAAE,YAAY,WAAW,gBAAgB,IAAI,CAAC;IAC1F,GAAI,WAAW,sBAAsB,SAAS,IAC1C,EAAE,kBAAkB,WAAW,sBAAsB,IACrD,CAAC;IACL,GAAI,WAAW,iBAAiB,SAAS,IAAI,EAAE,aAAa,WAAW,iBAAiB,IAAI,CAAC;GAC/F;GACF,YAAY,UAAU;GACtB,cAAc,EAAE,MAAM,WAAW;EACnC,CAAC,CACH;EACA,MAAM,YAAY,QAAQ,IAAI,UAAU,sBAAsB;EAC9D,MAAM,YAAY,QAAQ,IAAI,UAAU,eAAe;EACvD,OAAO,UAAU,kBAAkB;GACjC,QAAQ;GACR,KAAK,MAAM,MAAM,oBAAoB,KAAK,IAAI;EAChD,CAAC;EAED,OAAO,gBAAgB,+BAA+B,WAAW,cAAc;EAC/E,IAAI,UAAU,SAAS,kBACrB,OAAO,gBAAgB,iBAAiB,SAAS,MAAM,UAAU,WAAW,GAAG;OAC1E,IAAI,UAAU,SAAS,uBAC5B,OAAO,gBAAgB,kDAAkD;EAE3E,OAAO,OAAO,OAAO,MAAM,KACzB,OAAO,kBACL,gBAAgB,0BAA0B,CAAC,CAAC,KAC1C,OAAO,QAAQ,UAAU,YAAY,YAAY,CAAC,GAClD,OAAO,SAAS,WAAW;GACzB,QAAQ,OAAO,MAAf;IACE,KAAK,WACH,OAAO,gBAAgB,yBAAyB;IAClD,KAAK,oBACH,OAAO,gBAAgB,wCAAwC;IACjE,KAAK,eACH,OAAO,gBAAgB,sCAAsC,OAAO,QAAQ,KAAK,IAAI,EAAE,EAAE;GAC7F;EACF,CAAC,CACH,CACF,CACF;CACF,CAAC,CAAC,CAAC,KAAK,OAAO,QAAQ,qBAAqB,CAAC;AAC/C,CAAC,CACH;AAEA,IAAM,mCACJ,OACA,wBAAwB,MACe;CACvC,IAAI,OAAO,GAAG,2BAA2B,CAAC,CAAC,KAAK,GAAG,OAAO;CAC1D,IACE,wBAAwB,KACxB,UAAU,YAAY,OAAO,MAAM,KACnC,MAAM,SAAS,gBACf,UAAU,YAAY,OAAO,OAAO,GAEpC,OAAO,gCAAgC,MAAM,OAAO,wBAAwB,CAAC;CAE/E,OAAO;AACT;AAEA,IAAM,wBAA2B,UAA0B;CACzD,MAAM,QAAQ,MAAM,gBAAgB,KAAK;CAKzC,IAJqB,OAAO,OAC1B,QACC,UAAU,UAAU,YAAY,OAAO,MAAM,KAAK,MAAM,SAAS,4BAEhE,GAAc,OAAO,OAAO,UAAU,KAAK;CAC/C,MAAM,8BAA8B,OAAO,QACzC,QACC,UAAU,OAAO,cAAc,gCAAgC,KAAK,CAAC,CACxE;CACA,IAAI,OAAO,OAAO,2BAA2B,GAAG;EAC9C,MAAM,YAAY,4BAA4B,MAAM;EACpD,OAAO,gBAAgB,+DAA+D,UAAU,GAAG,CAAC,CAAC,KACnG,OAAO,QACL,cAAc,kBACV,gBACA,gPAGF,IACE,OAAO,IACb,GACA,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CACxC;CACF;CACA,MAAM,WAAW,OAAO,QACtB,QACC,UACC,UAAU,YAAY,OAAO,MAAM,KAAK,OAAO,MAAM,SAAS,WAC1D,OAAO,KAAK,MAAM,IAAI,IACtB,OAAO,KAAa,CAC5B;CAKA,OAAO,gBAJS,OAAO,MAAM,UAAU;EACrC,cAAc;EACd,SAAS,QAAQ,kCAAkC,IAAI;CACzD,CACuB,CAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,OAAO,UAAU,KAAK,CAAC,CAAC;AAC9E;AAEA,YAAY,QACV,QAAQ,KACN,OAAO,WAAW,oBAAoB,GACtC,OAAO,QAAQ,aAAa,KAAK,CACnC,GACA,EAAE,uBAAuB,KAAK,CAChC"}

package/dist/server/server/cliArguments.d.ts ADDED Viewed

@@ -0,0 +1,21 @@
+/** Supported top-level CLI invocation after Node removes executable and script arguments. */
+export type ControlCenterCliInvocation = {
+    readonly _tag: "serve";
+} | {
+    readonly _tag: "recover-owner";
+} | {
+    readonly _tag: "backup";
+    readonly archiveRoot: string;
+} | {
+    readonly _tag: "verify-backup";
+    readonly archiveRoot: string;
+} | {
+    readonly _tag: "restore";
+    readonly archiveRoot: string;
+} | {
+    readonly _tag: "invalid";
+    readonly command: string;
+};
+/** Classify the exact supported CLI argument shapes without accepting trailing arguments. */
+export declare const classifyControlCenterCliArguments: (arguments_: ReadonlyArray<string>) => ControlCenterCliInvocation;
+//# sourceMappingURL=cliArguments.d.ts.map

package/dist/server/server/cliArguments.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"cliArguments.d.ts","sourceRoot":"","sources":["../../../src/server/cliArguments.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,6FAA6F;AAC7F,eAAO,MAAM,iCAAiC,GAC5C,YAAY,aAAa,CAAC,MAAM,CAAC,KAChC,0BAcF,CAAA"}

package/dist/server/server/cliConfiguration.d.ts ADDED Viewed

@@ -0,0 +1,20 @@
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { type ControlCenterDataPaths, decodeControlCenterDataPaths, type FreshDataRootClaimConflict, type StagedDataRootWriter } from "./DataRootProtocol.js";
+import { PersistenceConfigError } from "./persistence/errors.js";
+/** Validated filesystem paths derived from the untrusted data-root environment value. */
+export { decodeControlCenterDataPaths };
+export type { ControlCenterDataPaths };
+/**
+ * Populate and exclusively publish a genuinely fresh configured data root.
+ * The initializer may be interrupted while its unclaimed staging root is cleaned;
+ * the completed root is exposed only by the final relative-symlink claim.
+ */
+export declare const claimFreshControlCenterDataRoot: <Failure, Requirements>(dataPaths: ControlCenterDataPaths, initialize: (writer: StagedDataRootWriter) => Effect.Effect<void, Failure, Requirements>) => Effect.Effect<ControlCenterDataPaths, PersistenceConfigError | FreshDataRootClaimConflict | Failure, Crypto.Crypto | FileSystem.FileSystem | Path.Path | Requirements>;
+/** Resolve an already-prepared data root without creating, repairing, cleaning, or migrating it. */
+export declare const resolvePreparedControlCenterDataRoot: (dataPaths: ControlCenterDataPaths) => Effect.Effect<ControlCenterDataPaths, PersistenceConfigError, FileSystem.FileSystem | Path.Path>;
+/** Create or verify a dedicated data root and return its canonical operational paths. */
+export declare const prepareControlCenterDataRoot: (dataPaths: ControlCenterDataPaths) => Effect.Effect<ControlCenterDataPaths, PersistenceConfigError, Crypto.Crypto | FileSystem.FileSystem | Path.Path>;
+//# sourceMappingURL=cliConfiguration.d.ts.map

package/dist/server/server/cliConfiguration.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"cliConfiguration.d.ts","sourceRoot":"","sources":["../../../src/server/cliConfiguration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAA;AAE/C,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AAInC,OAAO,EAEL,KAAK,sBAAsB,EAS3B,4BAA4B,EAE5B,KAAK,0BAA0B,EAI/B,KAAK,oBAAoB,EAE1B,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAEhE,yFAAyF;AACzF,OAAO,EAAE,4BAA4B,EAAE,CAAA;AACvC,YAAY,EAAE,sBAAsB,EAAE,CAAA;AAwiBtC;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,GAC1C,OAAO,EACP,YAAY,0DAIF,oBAAoB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,2KAyB/C,CAAA;AAEF,oGAAoG;AACpG,eAAO,MAAM,oCAAoC,yIAsC/C,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,4BAA4B,yJAkHvC,CAAA"}

package/dist/server/server/governance/governedActionAuthority.d.ts ADDED Viewed

@@ -0,0 +1,54 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { type GovernedActionAttemptV1 as GovernedActionAttempt, type GovernedActionAuthorizationV1 as GovernedActionAuthorization, type GovernedActionEnvelopeV1 as GovernedActionEnvelope, type GovernedActionEvidenceSet as GovernedActionEvidence, type GovernedActionPluginConnectionAuthorityDigest, type GovernedActionPluginConnectionRevision, type GovernedActionPolicyEvaluationV1 as GovernedActionPolicyEvaluation, type GovernedActionTargetSnapshotV1 as GovernedActionTargetSnapshot } from "../../domain/governedAction/index.js";
+import type { PluginConnectionId, WorkspaceId } from "../../domain/identifiers.js";
+import type { NegotiatedPluginDescriptorV1 } from "../../domain/plugins/descriptor.js";
+import type { ProviderId } from "../../domain/sourceRevision.js";
+import type { UtcTimestamp } from "../../domain/utcTimestamp.js";
+import type { SessionSummary } from "../auth/models.js";
+import { type VerifiedGovernedActionEnvelope } from "./governedActionDigests.js";
+declare const GovernedActionAuthorityRejected_base: Schema.Class<GovernedActionAuthorityRejected, Schema.TaggedStruct<"GovernedActionAuthorityRejected", {
+    readonly mismatches: Schema.$Array<Schema.Literals<readonly ["authorization-action-mismatch", "authorization-workspace-mismatch", "authorization-connection-mismatch", "authorization-connection-revision-mismatch", "authorization-connection-authority-mismatch", "authorization-envelope-mismatch", "authorization-idempotency-mismatch", "authorization-payload-mismatch", "authorization-evidence-mismatch", "authorization-policy-mismatch", "authorization-revision-mismatch", "authorization-capability-mismatch", "authorization-permission-mismatch", "authorization-outside-proposal-window", "authorization-expired", "authorization-session-expired", "evidence-not-current", "evidence-set-changed", "evidence-workspace-mismatch", "session-id-mismatch", "session-actor-mismatch", "session-workspace-mismatch", "session-permission-mismatch", "session-revoked", "authorization-session-chronology", "current-plugin-connection-mismatch", "current-plugin-workspace-mismatch", "current-plugin-provider-mismatch", "current-plugin-revision-mismatch", "current-plugin-authority-mismatch", "current-plugin-unavailable", "current-plugin-mismatch", "current-capability-unavailable", "current-capability-version-mismatch", "current-policy-denied", "current-policy-mismatch", "current-target-workspace-mismatch", "current-target-entity-mismatch", "current-target-type-mismatch", "current-target-source-mismatch", "current-target-revision-mismatch", "attempt-action-mismatch", "attempt-authorization-mismatch", "attempt-workspace-mismatch", "attempt-connection-mismatch", "attempt-envelope-mismatch", "attempt-idempotency-mismatch", "attempt-policy-evaluation-mismatch", "attempt-revision-mismatch", "attempt-outside-authorization-window"]>>;
+}>, import("effect/Cause").YieldableError>;
+/** Fail-closed reasons why a structurally valid action cannot dispatch. */
+export declare class GovernedActionAuthorityRejected extends GovernedActionAuthorityRejected_base {
+}
+/** Trusted live plugin, policy, session, and evidence inputs required immediately before dispatch. */
+export interface VerifyGovernedActionDispatchAuthorityInput {
+    readonly envelope: GovernedActionEnvelope;
+    readonly authorization: GovernedActionAuthorization;
+    readonly attempt: GovernedActionAttempt;
+    readonly currentEvidence: GovernedActionEvidence;
+    readonly currentPlugin: {
+        readonly authorityDigest: GovernedActionPluginConnectionAuthorityDigest;
+        readonly connectionId: PluginConnectionId;
+        readonly enabled: boolean;
+        readonly negotiated: NegotiatedPluginDescriptorV1;
+        readonly providerId: ProviderId;
+        readonly revision: GovernedActionPluginConnectionRevision;
+        readonly workspaceId: WorkspaceId;
+    };
+    readonly currentPolicy: GovernedActionPolicyEvaluation;
+    readonly currentTarget: GovernedActionTargetSnapshot;
+    readonly session: SessionSummary;
+    readonly evaluatedAt: UtcTimestamp;
+}
+declare class VerifiedDispatchAuthority {
+    #private;
+    constructor(envelope: VerifiedGovernedActionEnvelope, authorization: GovernedActionAuthorization, attempt: GovernedActionAttempt);
+    /** Canonically verified envelope approved for one exact dispatch attempt. */
+    get envelope(): VerifiedGovernedActionEnvelope;
+    /** Human grant proven to match the verified action envelope and current session. */
+    get authorization(): GovernedActionAuthorization;
+    /** Single durable dispatch intent proven to match the verified human grant. */
+    get attempt(): GovernedActionAttempt;
+}
+/** Nominal server-only proof consumed by the internal provider-dispatch engine. */
+export type VerifiedGovernedActionDispatchAuthority = VerifiedDispatchAuthority;
+/**
+ * Recompute cryptographic bindings, current evidence, session authority, and aggregate identity.
+ * Provider dispatch accepts only the nominal proof returned by this function.
+ */
+export declare const verifyGovernedActionDispatchAuthority: (input: VerifyGovernedActionDispatchAuthorityInput) => Effect.Effect<VerifiedDispatchAuthority, import("./governedActionDigests.js").GovernedActionDigestError | import("./governedActionDigests.js").GovernedActionBindingMismatch | GovernedActionAuthorityRejected, import("effect/Crypto").Crypto>;
+export {};
+//# sourceMappingURL=governedActionAuthority.d.ts.map

package/dist/server/server/governance/governedActionAuthority.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"governedActionAuthority.d.ts","sourceRoot":"","sources":["../../../../src/server/governance/governedActionAuthority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EACL,KAAK,uBAAuB,IAAI,qBAAqB,EAIrD,KAAK,6BAA6B,IAAI,2BAA2B,EACjE,KAAK,wBAAwB,IAAI,sBAAsB,EACvD,KAAK,yBAAyB,IAAI,sBAAsB,EACxD,KAAK,6CAA6C,EAClD,KAAK,sCAAsC,EAC3C,KAAK,gCAAgC,IAAI,8BAA8B,EACvE,KAAK,8BAA8B,IAAI,4BAA4B,EACpE,MAAM,sCAAsC,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAGL,KAAK,8BAA8B,EAEpC,MAAM,4BAA4B,CAAA;;;;AAEnC,2EAA2E;AAC3E,qBAAa,+BAAgC,SAAQ,oCAWpD;CAAG;AAEJ,sGAAsG;AACtG,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAA;IAChD,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,eAAe,EAAE,6CAA6C,CAAA;QACvE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAA;QACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAA;QACjD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;QAC/B,QAAQ,CAAC,QAAQ,EAAE,sCAAsC,CAAA;QACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;KAClC,CAAA;IACD,QAAQ,CAAC,aAAa,EAAE,8BAA8B,CAAA;IACtD,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAA;IACpD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAA;CACnC;AAED,cAAM,yBAAyB;;gBAM3B,QAAQ,EAAE,8BAA8B,EACxC,aAAa,EAAE,2BAA2B,EAC1C,OAAO,EAAE,qBAAqB;IAOhC,6EAA6E;IAC7E,IAAI,QAAQ,IAAI,8BAA8B,CAE7C;IAED,oFAAoF;IACpF,IAAI,aAAa,IAAI,2BAA2B,CAE/C;IAED,+EAA+E;IAC/E,IAAI,OAAO,IAAI,qBAAqB,CAEnC;CACF;AAED,mFAAmF;AACnF,MAAM,MAAM,uCAAuC,GAAG,yBAAyB,CAAA;AAoH/E;;;GAGG;AACH,eAAO,MAAM,qCAAqC,wSAyBhD,CAAA"}