@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/harness/pi-rpc/authorization/authorization-store.js

@@ -0,0 +1,235 @@
+import { makeNodeRuntimeError } from "../../../runtime/errors.js";
+import { countPiRpcUnsettledPermits, readActivePiRpcAuthorization, readLatestPiRpcAuthorization, readPiRpcAuthorizationRevision, readPiRpcPlanRow, } from "./database.js";
+import { compactPiRpcTerminalPermits } from "./permit-compaction-store.js";
+import { requirePiRpcIdentifier, requirePiRpcRevision, requirePiRpcTimestampMs, } from "./policy.js";
+import { projectPiRpcAuthorization, projectPiRpcPlan } from "./projection.js";
+import { withPiRpcReplay } from "./replay-store.js";
+const validatePolicy = (policy) => ({
+    adapterVersion: requirePiRpcRevision(policy.adapterVersion, "The Pi RPC adapter version"),
+    conversationPolicyRevision: requirePiRpcRevision(policy.conversationPolicyRevision, "The Pi RPC conversation policy revision"),
+    vouchPolicyRevision: requirePiRpcRevision(policy.vouchPolicyRevision, "The Pi RPC vouch policy revision"),
+});
+const assertPolicyMatchesPlan = (policy, plan) => {
+    if (policy.adapterVersion === plan.adapterVersion &&
+        policy.conversationPolicyRevision === plan.conversationPolicyRevision &&
+        policy.vouchPolicyRevision === plan.vouchPolicyRevision)
+        return;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC integration plan policy revision is stale.", true);
+};
+const requireApplyPlan = (database, planId, recordedAtMs) => {
+    const plan = readPiRpcPlanRow(database, requirePiRpcIdentifier(planId, "The Pi RPC plan identifier"));
+    if (plan === undefined)
+        throw makeNodeRuntimeError("resource_not_found", "The Pi RPC integration plan was not found.");
+    if (recordedAtMs < plan.createdAtMs || recordedAtMs >= plan.expiresAtMs)
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC integration plan is expired or temporally invalid.", true);
+    return plan;
+};
+const assertAuthorizationReplaceable = (database, latest) => {
+    if (latest?.state === "cleanup_unknown" || latest?.state === "revoking")
+        throw makeNodeRuntimeError("storage_conflict", "The previous Pi RPC authorization is revoking or cleanup_unknown.", true);
+    if (latest?.state === "active" &&
+        countPiRpcUnsettledPermits(database, latest.authorizationRevision) > 0)
+        throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization has unsettled process permits.", true);
+};
+const replaceAuthorization = (database, latest, context) => {
+    database
+        .prepare(`UPDATE pi_rpc_authorization_revisions
+       SET state = 'replaced', replaced_by_revision = ?, updated_at = ?
+       WHERE authorization_revision = ?`)
+        .run(context.nextRevision, context.recordedAt, latest.authorizationRevision);
+};
+const authorizationInsertValues = ({ plan, recordedAt, revision, }) => [
+    revision,
+    plan.planId,
+    plan.planDigest,
+    plan.interpreterPath,
+    plan.interpreterDevice,
+    plan.interpreterInode,
+    plan.interpreterSizeBytes,
+    plan.interpreterSha256,
+    plan.interpreterArchitecture,
+    plan.entryPath,
+    plan.entryDevice,
+    plan.entryInode,
+    plan.entrySizeBytes,
+    plan.entrySha256,
+    plan.packageRootPath,
+    plan.packageRootDevice,
+    plan.packageRootInode,
+    plan.closureSha256,
+    plan.adapterVersion,
+    plan.ownerKindsJson,
+    plan.conversationPolicyRevision,
+    plan.vouchPolicyRevision,
+    recordedAt,
+    recordedAt,
+];
+const insertAuthorization = (database, context) => {
+    database
+        .prepare(`INSERT INTO pi_rpc_authorization_revisions(
+        authorization_revision, integration, state, plan_id, plan_digest,
+        interpreter_path, interpreter_device, interpreter_inode,
+        interpreter_size_bytes, interpreter_sha256, interpreter_architecture,
+        entry_path, entry_device, entry_inode, entry_size_bytes, entry_sha256,
+        package_root_path, package_root_device,
+        package_root_inode, closure_sha256, adapter_version, owner_kinds_json,
+        conversation_policy_revision, vouch_policy_revision, created_at,
+        updated_at
+      ) VALUES (?, 'pi-rpc', 'active', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(...authorizationInsertValues(context));
+};
+const projectAuthorizationRevision = (database, revision) => {
+    const inserted = readPiRpcAuthorizationRevision(database, revision);
+    if (inserted !== undefined)
+        return projectPiRpcAuthorization(database, inserted);
+    throw makeNodeRuntimeError("storage_corrupt", "The Pi RPC authorization revision was not persisted.");
+};
+const persistAppliedAuthorization = (database, context) => {
+    const { latest, plan, recordedAt } = context;
+    const revision = (latest?.authorizationRevision ?? 0) + 1;
+    if (latest?.state === "active")
+        replaceAuthorization(database, latest, {
+            nextRevision: revision,
+            recordedAt,
+        });
+    insertAuthorization(database, { plan, recordedAt, revision });
+    return revision;
+};
+const applyAuthorization = (database, input) => {
+    const recordedAtMs = requirePiRpcTimestampMs(input.recordedAt, "The Pi RPC apply timestamp");
+    const plan = requireApplyPlan(database, input.planId, recordedAtMs);
+    projectPiRpcPlan(database, plan);
+    assertPolicyMatchesPlan(validatePolicy(input.policy), plan);
+    const latest = readLatestPiRpcAuthorization(database);
+    assertAuthorizationReplaceable(database, latest);
+    const nextRevision = persistAppliedAuthorization(database, {
+        plan,
+        recordedAt: input.recordedAt,
+        ...(latest === undefined ? {} : { latest }),
+    });
+    return {
+        authorization: projectAuthorizationRevision(database, nextRevision),
+        method: "integration.apply.pi-rpc",
+        recordedAt: input.recordedAt,
+    };
+};
+export const applyPiRpcIntegrationAuthorization = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.apply.pi-rpc" }, input.onNewResult === undefined
+    ? () => applyAuthorization(database, input)
+    : {
+        onNewResult: input.onNewResult,
+        run: () => applyAuthorization(database, input),
+    });
+const requireActiveAuthorization = (database) => {
+    const active = readActivePiRpcAuthorization(database);
+    if (active !== undefined)
+        return active;
+    throw makeNodeRuntimeError("resource_not_found", "The Pi RPC integration authorization is not active.");
+};
+const invalidateIssuedPermits = (database, context) => Number(database
+    .prepare(`UPDATE pi_rpc_authorization_permits
+         SET state = 'terminal', terminal_at = ?, terminal_at_ms = ?,
+           terminal_reason = 'revoked_before_start'
+         WHERE authorization_revision = ? AND state = 'issued'`)
+    .run(context.recordedAt, context.recordedAtMs, context.revision).changes);
+const requireRemovalTiming = (active, recordedAt) => {
+    const recordedAtMs = requirePiRpcTimestampMs(recordedAt, "The Pi RPC remove timestamp");
+    const authorizationAtMs = requirePiRpcTimestampMs(active.createdAt, "The Pi RPC authorization timestamp");
+    if (recordedAtMs >= authorizationAtMs)
+        return recordedAtMs;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC remove timestamp is not monotonic.");
+};
+const markAuthorizationRevoking = (database, active, recordedAt) => {
+    database
+        .prepare(`UPDATE pi_rpc_authorization_revisions
+       SET state = 'revoking', revocation_started_at = ?, updated_at = ?
+       WHERE authorization_revision = ?`)
+        .run(recordedAt, recordedAt, active.authorizationRevision);
+};
+const readProjectedAuthorization = (database, revision) => {
+    const row = readPiRpcAuthorizationRevision(database, revision);
+    if (row !== undefined)
+        return projectPiRpcAuthorization(database, row);
+    throw makeNodeRuntimeError("storage_corrupt", "The Pi RPC authorization revision could not be read.");
+};
+const beginRemoval = (database, input) => {
+    const active = requireActiveAuthorization(database);
+    const recordedAtMs = requireRemovalTiming(active, input.recordedAt);
+    markAuthorizationRevoking(database, active, input.recordedAt);
+    const invalidatedIssuedPermits = invalidateIssuedPermits(database, {
+        recordedAt: input.recordedAt,
+        recordedAtMs,
+        revision: active.authorizationRevision,
+    });
+    compactPiRpcTerminalPermits(database, recordedAtMs);
+    return {
+        authorization: readProjectedAuthorization(database, active.authorizationRevision),
+        invalidatedIssuedPermits,
+        method: "integration.remove.pi-rpc",
+        recordedAt: input.recordedAt,
+    };
+};
+export const beginPiRpcIntegrationRevocation = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.remove.pi-rpc" }, input.onNewResult === undefined
+    ? () => beginRemoval(database, input)
+    : {
+        onNewResult: input.onNewResult,
+        run: () => beginRemoval(database, input),
+    });
+const readRevokingAuthorization = (database) => {
+    const latest = readLatestPiRpcAuthorization(database);
+    if (latest?.state === "revoking")
+        return latest;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization is not revoking.");
+};
+const requireRevocablePermits = (database, authorization, outcome) => {
+    const remaining = countPiRpcUnsettledPermits(database, authorization.authorizationRevision);
+    if (outcome !== "revoked" || remaining === 0)
+        return remaining;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC authorization still has unsettled permits.", true);
+};
+const requireRemovalSettlement = (database, authorization, input) => {
+    const remaining = requireRevocablePermits(database, authorization, input.outcome);
+    const recordedAtMs = requirePiRpcTimestampMs(input.recordedAt, "The Pi RPC revocation settlement timestamp");
+    const startedAt = authorization.revocationStartedAt;
+    if (startedAt !== null &&
+        recordedAtMs >=
+            requirePiRpcTimestampMs(startedAt, "The Pi RPC revocation timestamp"))
+        return remaining;
+    throw makeNodeRuntimeError("storage_conflict", "The Pi RPC revocation settlement timestamp is not monotonic.");
+};
+const updateRemovalOutcome = (database, authorization, input) => {
+    const assignments = input.outcome === "revoked"
+        ? "state = 'revoked', terminalized_at = ?, cleanup_unknown_at = NULL"
+        : "state = 'cleanup_unknown', terminalized_at = NULL, cleanup_unknown_at = ?";
+    database
+        .prepare(`UPDATE pi_rpc_authorization_revisions SET ${assignments}, updated_at = ?
+       WHERE authorization_revision = ?`)
+        .run(input.recordedAt, input.recordedAt, authorization.authorizationRevision);
+};
+const settleRemoval = (database, input) => {
+    const authorization = readRevokingAuthorization(database);
+    const remaining = requireRemovalSettlement(database, authorization, input);
+    updateRemovalOutcome(database, authorization, input);
+    const projection = readProjectedAuthorization(database, authorization.authorizationRevision);
+    return {
+        authorization: projection,
+        method: "integration.remove.settle.pi-rpc",
+        recordedAt: input.recordedAt,
+        remainingUnsettledPermits: remaining,
+    };
+};
+export const settlePiRpcIntegrationRevocation = (database, input) => withPiRpcReplay(database, { ...input, method: "integration.remove.settle.pi-rpc" }, () => settleRemoval(database, input));
+export const showPiRpcIntegrationAuthorization = (database) => {
+    const latest = readLatestPiRpcAuthorization(database);
+    if (latest === undefined)
+        return undefined;
+    const unsettled = countPiRpcUnsettledPermits(database, latest.authorizationRevision);
+    return {
+        activeUnsettledPermits: latest.state === "active" ? unsettled : 0,
+        authorization: projectPiRpcAuthorization(database, latest),
+        revokingUnsettledPermits: latest.state === "revoking" || latest.state === "cleanup_unknown"
+            ? unsettled
+            : 0,
+    };
+};
+//# sourceMappingURL=authorization-store.js.map

package/dist/harness/pi-rpc/authorization/authorization-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-store.js","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/authorization-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EACL,0BAA0B,EAG1B,4BAA4B,EAC5B,4BAA4B,EAC5B,8BAA8B,EAC9B,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AA4BpD,MAAM,cAAc,GAAG,CACrB,MAAmC,EACN,EAAE,CAAC,CAAC;IACjC,cAAc,EAAE,oBAAoB,CAClC,MAAM,CAAC,cAAc,EACrB,4BAA4B,CAC7B;IACD,0BAA0B,EAAE,oBAAoB,CAC9C,MAAM,CAAC,0BAA0B,EACjC,yCAAyC,CAC1C;IACD,mBAAmB,EAAE,oBAAoB,CACvC,MAAM,CAAC,mBAAmB,EAC1B,kCAAkC,CACnC;CACF,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAC9B,MAAmC,EACnC,IAAkB,EACZ,EAAE;IACR,IACE,MAAM,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC7C,MAAM,CAAC,0BAA0B,KAAK,IAAI,CAAC,0BAA0B;QACrE,MAAM,CAAC,mBAAmB,KAAK,IAAI,CAAC,mBAAmB;QAEvD,OAAO;IACT,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,uDAAuD,EACvD,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,QAAsB,EACtB,MAAc,EACd,YAAoB,EACN,EAAE;IAChB,MAAM,IAAI,GAAG,gBAAgB,CAC3B,QAAQ,EACR,sBAAsB,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAC7D,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,oBAAoB,CACxB,oBAAoB,EACpB,4CAA4C,CAC7C,CAAC;IACJ,IAAI,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,IAAI,IAAI,CAAC,WAAW;QACrE,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,+DAA+D,EAC/D,IAAI,CACL,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,8BAA8B,GAAG,CACrC,QAAsB,EACtB,MAAyC,EACnC,EAAE;IACR,IAAI,MAAM,EAAE,KAAK,KAAK,iBAAiB,IAAI,MAAM,EAAE,KAAK,KAAK,UAAU;QACrE,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,mEAAmE,EACnE,IAAI,CACL,CAAC;IACJ,IACE,MAAM,EAAE,KAAK,KAAK,QAAQ;QAC1B,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC;QAEtE,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,yDAAyD,EACzD,IAAI,CACL,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,MAA6B,EAC7B,OAAuE,EACjE,EAAE;IACR,QAAQ;SACL,OAAO,CACN;;wCAEkC,CACnC;SACA,GAAG,CACF,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,qBAAqB,CAC7B,CAAC;AACN,CAAC,CAAC;AAQF,MAAM,yBAAyB,GAAG,CAAC,EACjC,IAAI,EACJ,UAAU,EACV,QAAQ,GACmB,EAAgC,EAAE,CAAC;IAC9D,QAAQ;IACR,IAAI,CAAC,MAAM;IACX,IAAI,CAAC,UAAU;IACf,IAAI,CAAC,eAAe;IACpB,IAAI,CAAC,iBAAiB;IACtB,IAAI,CAAC,gBAAgB;IACrB,IAAI,CAAC,oBAAoB;IACzB,IAAI,CAAC,iBAAiB;IACtB,IAAI,CAAC,uBAAuB;IAC5B,IAAI,CAAC,SAAS;IACd,IAAI,CAAC,WAAW;IAChB,IAAI,CAAC,UAAU;IACf,IAAI,CAAC,cAAc;IACnB,IAAI,CAAC,WAAW;IAChB,IAAI,CAAC,eAAe;IACpB,IAAI,CAAC,iBAAiB;IACtB,IAAI,CAAC,gBAAgB;IACrB,IAAI,CAAC,aAAa;IAClB,IAAI,CAAC,cAAc;IACnB,IAAI,CAAC,cAAc;IACnB,IAAI,CAAC,0BAA0B;IAC/B,IAAI,CAAC,mBAAmB;IACxB,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,QAAsB,EACtB,OAAmC,EAC7B,EAAE;IACR,QAAQ;SACL,OAAO,CACN;;;;;;;;;;yCAUmC,CACpC;SACA,GAAG,CAAC,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,CACnC,QAAsB,EACtB,QAAgB,EACc,EAAE;IAChC,MAAM,QAAQ,GAAG,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,SAAS;QACxB,OAAO,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,2BAA2B,GAAG,CAClC,QAAsB,EACtB,OAAoC,EAC5B,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,qBAAqB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ;QAC5B,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE;YACrC,YAAY,EAAE,QAAQ;YACtB,UAAU;SACX,CAAC,CAAC;IACL,mBAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,QAAsB,EACtB,KAGC,EACY,EAAE;IACf,MAAM,YAAY,GAAG,uBAAuB,CAC1C,KAAK,CAAC,UAAU,EAChB,4BAA4B,CAC7B,CAAC;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpE,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjC,uBAAuB,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACtD,8BAA8B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,2BAA2B,CAAC,QAAQ,EAAE;QACzD,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO;QACL,aAAa,EAAE,4BAA4B,CAAC,QAAQ,EAAE,YAAY,CAAC;QACnE,MAAM,EAAE,0BAA0B;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,QAAsB,EACtB,KAAiB,EACe,EAAE,CAClC,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAChD,KAAK,CAAC,WAAW,KAAK,SAAS;IAC7B,CAAC,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;IAC3C,CAAC,CAAC;QACE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;KAC/C,CACN,CAAC;AAEJ,MAAM,0BAA0B,GAAG,CACjC,QAAsB,EACC,EAAE;IACzB,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,oBAAoB,CACxB,oBAAoB,EACpB,qDAAqD,CACtD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC9B,QAAsB,EACtB,OAIC,EACO,EAAE,CACV,MAAM,CACJ,QAAQ;KACL,OAAO,CACN;;;+DAGuD,CACxD;KACA,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC3E,CAAC;AAEJ,MAAM,oBAAoB,GAAG,CAC3B,MAA6B,EAC7B,UAAkB,EACV,EAAE;IACV,MAAM,YAAY,GAAG,uBAAuB,CAC1C,UAAU,EACV,6BAA6B,CAC9B,CAAC;IACF,MAAM,iBAAiB,GAAG,uBAAuB,CAC/C,MAAM,CAAC,SAAS,EAChB,oCAAoC,CACrC,CAAC;IACF,IAAI,YAAY,IAAI,iBAAiB;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,+CAA+C,CAChD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAChC,QAAsB,EACtB,MAA6B,EAC7B,UAAkB,EACZ,EAAE;IACR,QAAQ;SACL,OAAO,CACN;;wCAEkC,CACnC;SACA,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,QAAsB,EACtB,QAAgB,EACc,EAAE;IAChC,MAAM,GAAG,GAAG,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,yBAAyB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,QAAsB,EACtB,KAAwB,EACJ,EAAE;IACtB,MAAM,MAAM,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACpE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,wBAAwB,GAAG,uBAAuB,CAAC,QAAQ,EAAE;QACjE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,qBAAqB;KACvC,CAAC,CAAC;IACH,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,OAAO;QACL,aAAa,EAAE,0BAA0B,CACvC,QAAQ,EACR,MAAM,CAAC,qBAAqB,CAC7B;QACD,wBAAwB;QACxB,MAAM,EAAE,2BAA2B;QACnC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;AACJ,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,QAAsB,EACtB,KAAwB,EACe,EAAE,CACzC,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,EACjD,KAAK,CAAC,WAAW,KAAK,SAAS;IAC7B,CAAC,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC;IACrC,CAAC,CAAC;QACE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC;KACzC,CACN,CAAC;AAEJ,MAAM,yBAAyB,GAAG,CAChC,QAAsB,EACC,EAAE;IACzB,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,KAAK,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;AACJ,CAAC,CAAC;AAIF,MAAM,uBAAuB,GAAG,CAC9B,QAAsB,EACtB,aAAoC,EACpC,OAAuB,EACf,EAAE;IACV,MAAM,SAAS,GAAG,0BAA0B,CAC1C,QAAQ,EACR,aAAa,CAAC,qBAAqB,CACpC,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,uDAAuD,EACvD,IAAI,CACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAC/B,QAAsB,EACtB,aAAoC,EACpC,KAA+D,EACvD,EAAE;IACV,MAAM,SAAS,GAAG,uBAAuB,CACvC,QAAQ,EACR,aAAa,EACb,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,YAAY,GAAG,uBAAuB,CAC1C,KAAK,CAAC,UAAU,EAChB,4CAA4C,CAC7C,CAAC;IACF,MAAM,SAAS,GAAG,aAAa,CAAC,mBAAmB,CAAC;IACpD,IACE,SAAS,KAAK,IAAI;QAClB,YAAY;YACV,uBAAuB,CAAC,SAAS,EAAE,iCAAiC,CAAC;QAEvE,OAAO,SAAS,CAAC;IACnB,MAAM,oBAAoB,CACxB,kBAAkB,EAClB,8DAA8D,CAC/D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,QAAsB,EACtB,aAAoC,EACpC,KAA+D,EACzD,EAAE;IACR,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,CAAC,mEAAmE;QACrE,CAAC,CAAC,2EAA2E,CAAC;IAClF,QAAQ;SACL,OAAO,CACN,6CAA6C,WAAW;wCACtB,CACnC;SACA,GAAG,CACF,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,EAChB,aAAa,CAAC,qBAAqB,CACpC,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,QAAsB,EACtB,KAEC,EACoB,EAAE;IACvB,MAAM,aAAa,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,wBAAwB,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAC3E,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,0BAA0B,CAC3C,QAAQ,EACR,aAAa,CAAC,qBAAqB,CACpC,CAAC;IACF,OAAO;QACL,aAAa,EAAE,UAAU;QACzB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,yBAAyB,EAAE,SAAS;KACrC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAC9C,QAAsB,EACtB,KAEC,EACuC,EAAE,CAC1C,eAAe,CACb,QAAQ,EACR,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,EACxD,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CACrC,CAAC;AAUJ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAC/C,QAAsB,EACC,EAAE;IACzB,MAAM,MAAM,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,0BAA0B,CAC1C,QAAQ,EACR,MAAM,CAAC,qBAAqB,CAC7B,CAAC;IACF,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjE,aAAa,EAAE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1D,wBAAwB,EACtB,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB;YAC/D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC;KACR,CAAC;AACJ,CAAC,CAAC"}

package/dist/harness/pi-rpc/authorization/database.d.ts

@@ -0,0 +1,99 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { PiRpcAuthorizationState, PiRpcOwnerKind, PiRpcPermitState, PiRpcPermitTerminalReason } from "./types.js";
+export type PiRpcPlanRow = {
+    readonly adapterVersion: string;
+    readonly closureSha256: string;
+    readonly conversationPolicyRevision: string;
+    readonly createdAt: string;
+    readonly createdAtMs: number;
+    readonly entryDevice: number;
+    readonly entryInode: number;
+    readonly entryPath: string;
+    readonly entrySha256: string;
+    readonly entrySizeBytes: number;
+    readonly expiresAt: string;
+    readonly expiresAtMs: number;
+    readonly integration: "pi-rpc";
+    readonly interpreterArchitecture: "arm64" | "x64";
+    readonly interpreterDevice: number;
+    readonly interpreterInode: number;
+    readonly interpreterPath: string;
+    readonly interpreterSha256: string;
+    readonly interpreterSizeBytes: number;
+    readonly interpreterVersion: "24.19.0";
+    readonly ownerKindsJson: string;
+    readonly packageRootDevice: number;
+    readonly packageRootInode: number;
+    readonly packageRootPath: string;
+    readonly planBytes: number;
+    readonly planDigest: string;
+    readonly planId: string;
+    readonly planJson: string;
+    readonly targetAdapter: "pi-rpc";
+    readonly vouchPolicyRevision: string;
+};
+export type PiRpcManifestRow = {
+    readonly closureSha256: string;
+    readonly excludedBinEntryCount: number;
+    readonly fileCount: number;
+    readonly manifestBytes: number;
+    readonly packageManifestSha256: string;
+    readonly packageName: string;
+    readonly packageRootDevice: number;
+    readonly packageRootInode: number;
+    readonly packageRootPath: string;
+    readonly packageVersion: string;
+    readonly totalBytes: number;
+};
+export type PiRpcManifestEntryRow = {
+    readonly byteCount: number;
+    readonly executable: number;
+    readonly ordinal: number;
+    readonly relativePath: string;
+    readonly sha256: string;
+};
+export type PiRpcAuthorizationRow = Omit<PiRpcPlanRow, "createdAtMs" | "expiresAt" | "expiresAtMs" | "integration" | "interpreterVersion" | "planBytes" | "planJson" | "targetAdapter"> & {
+    readonly authorizationRevision: number;
+    readonly cleanupUnknownAt: null | string;
+    readonly createdAt: string;
+    readonly revocationStartedAt: null | string;
+    readonly state: PiRpcAuthorizationState;
+    readonly terminalizedAt: null | string;
+    readonly updatedAt: string;
+};
+export type PiRpcPermitRow = {
+    readonly adapterVersion: string;
+    readonly authorizationRevision: number;
+    readonly closureSha256: string;
+    readonly conversationPolicyRevision: string;
+    readonly dispatchingAt: null | string;
+    readonly dispatchingAtMs: null | number;
+    readonly entrySha256: string;
+    readonly expiresAt: string;
+    readonly expiresAtMs: number;
+    readonly fenceId: string;
+    readonly interpreterSha256: string;
+    readonly issuedAt: string;
+    readonly issuedAtMs: number;
+    readonly ownerKind: PiRpcOwnerKind;
+    readonly permitId: string;
+    readonly processTreeId: null | string;
+    readonly runtimeSessionId: string;
+    readonly scopeCommandId: string;
+    readonly startedAt: null | string;
+    readonly startedAtMs: null | number;
+    readonly state: PiRpcPermitState;
+    readonly terminalAt: null | string;
+    readonly terminalAtMs: null | number;
+    readonly terminalReason: null | PiRpcPermitTerminalReason;
+    readonly vouchPolicyRevision: string;
+};
+export declare const readPiRpcPlanRow: (database: DatabaseSync, planId: string) => PiRpcPlanRow | undefined;
+export declare const readPiRpcManifestRow: (database: DatabaseSync, closureSha256: string) => PiRpcManifestRow | undefined;
+export declare const readPiRpcManifestEntryRows: (database: DatabaseSync, closureSha256: string) => readonly PiRpcManifestEntryRow[];
+export declare const readLatestPiRpcAuthorization: (database: DatabaseSync) => PiRpcAuthorizationRow | undefined;
+export declare const readActivePiRpcAuthorization: (database: DatabaseSync) => PiRpcAuthorizationRow | undefined;
+export declare const readPiRpcAuthorizationRevision: (database: DatabaseSync, revision: number) => PiRpcAuthorizationRow | undefined;
+export declare const readPiRpcPermitRow: (database: DatabaseSync, permitId: string) => PiRpcPermitRow | undefined;
+export declare const countPiRpcUnsettledPermits: (database: DatabaseSync, revision: number) => number;
+//# sourceMappingURL=database.d.ts.map

package/dist/harness/pi-rpc/authorization/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,KAAK,EACV,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,KAAK,CAAC;IAClD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,YAAY,EACV,aAAa,GACb,WAAW,GACX,aAAa,GACb,aAAa,GACb,oBAAoB,GACpB,WAAW,GACX,UAAU,GACV,eAAe,CAClB,GAAG;IACF,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,IAAI,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,yBAAyB,CAAC;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC,CAAC;AAkEF,eAAO,MAAM,gBAAgB,GAC3B,UAAU,YAAY,EACtB,QAAQ,MAAM,KACb,YAAY,GAAG,SACqD,CAAC;AAExE,eAAO,MAAM,oBAAoB,GAC/B,UAAU,YAAY,EACtB,eAAe,MAAM,KACpB,gBAAgB,GAAG,SAeiC,CAAC;AAExD,eAAO,MAAM,0BAA0B,GACrC,UAAU,YAAY,EACtB,eAAe,MAAM,KACpB,SAAS,qBAAqB,EAQqC,CAAC;AASvE,eAAO,MAAM,4BAA4B,GACvC,UAAU,YAAY,KACrB,qBAAqB,GAAG,SACkD,CAAC;AAE9E,eAAO,MAAM,4BAA4B,GACvC,UAAU,YAAY,KACrB,qBAAqB,GAAG,SACkC,CAAC;AAE9D,eAAO,MAAM,8BAA8B,GACzC,UAAU,YAAY,EACtB,UAAU,MAAM,KACf,qBAAqB,GAAG,SAG4B,CAAC;AAExD,eAAO,MAAM,kBAAkB,GAC7B,UAAU,YAAY,EACtB,UAAU,MAAM,KACf,cAAc,GAAG,SACyD,CAAC;AAE9E,eAAO,MAAM,0BAA0B,GACrC,UAAU,YAAY,EACtB,UAAU,MAAM,KACf,MASM,CAAC"}

package/dist/harness/pi-rpc/authorization/database.js

@@ -0,0 +1,94 @@
+const PLAN_SELECT = `SELECT
+  adapter_version AS adapterVersion, closure_sha256 AS closureSha256,
+  conversation_policy_revision AS conversationPolicyRevision,
+  created_at AS createdAt, created_at_ms AS createdAtMs,
+  entry_device AS entryDevice, entry_inode AS entryInode,
+  entry_size_bytes AS entrySizeBytes,
+  entry_path AS entryPath, entry_sha256 AS entrySha256,
+  expires_at AS expiresAt, expires_at_ms AS expiresAtMs,
+  integration AS integration,
+  interpreter_architecture AS interpreterArchitecture,
+  interpreter_device AS interpreterDevice,
+  interpreter_inode AS interpreterInode, interpreter_path AS interpreterPath,
+  interpreter_sha256 AS interpreterSha256,
+  interpreter_size_bytes AS interpreterSizeBytes,
+  interpreter_version AS interpreterVersion,
+  owner_kinds_json AS ownerKindsJson,
+  package_root_device AS packageRootDevice,
+  package_root_inode AS packageRootInode,
+  package_root_path AS packageRootPath, plan_bytes AS planBytes,
+  plan_digest AS planDigest, plan_id AS planId, plan_json AS planJson,
+  target_adapter AS targetAdapter, vouch_policy_revision AS vouchPolicyRevision
+ FROM pi_rpc_authorization_plans WHERE plan_id = ?`;
+const AUTHORIZATION_SELECT = `SELECT
+  adapter_version AS adapterVersion,
+  authorization_revision AS authorizationRevision,
+  cleanup_unknown_at AS cleanupUnknownAt,
+  closure_sha256 AS closureSha256,
+  conversation_policy_revision AS conversationPolicyRevision,
+  created_at AS createdAt, entry_device AS entryDevice,
+  entry_inode AS entryInode, entry_path AS entryPath,
+  entry_sha256 AS entrySha256, entry_size_bytes AS entrySizeBytes,
+  interpreter_architecture AS interpreterArchitecture,
+  interpreter_device AS interpreterDevice,
+  interpreter_inode AS interpreterInode, interpreter_path AS interpreterPath,
+  interpreter_sha256 AS interpreterSha256,
+  interpreter_size_bytes AS interpreterSizeBytes,
+  owner_kinds_json AS ownerKindsJson,
+  package_root_device AS packageRootDevice,
+  package_root_inode AS packageRootInode,
+  package_root_path AS packageRootPath, plan_digest AS planDigest,
+  plan_id AS planId, revocation_started_at AS revocationStartedAt,
+  state AS state, terminalized_at AS terminalizedAt,
+  updated_at AS updatedAt, vouch_policy_revision AS vouchPolicyRevision
+ FROM pi_rpc_authorization_revisions WHERE integration = 'pi-rpc'`;
+const PERMIT_SELECT = `SELECT
+  adapter_version AS adapterVersion,
+  authorization_revision AS authorizationRevision,
+  closure_sha256 AS closureSha256,
+  conversation_policy_revision AS conversationPolicyRevision,
+  dispatching_at AS dispatchingAt, dispatching_at_ms AS dispatchingAtMs,
+  entry_sha256 AS entrySha256, expires_at AS expiresAt,
+  expires_at_ms AS expiresAtMs, fence_id AS fenceId,
+  interpreter_sha256 AS interpreterSha256, issued_at AS issuedAt,
+  issued_at_ms AS issuedAtMs, owner_kind AS ownerKind,
+  permit_id AS permitId, process_tree_id AS processTreeId,
+  runtime_session_id AS runtimeSessionId, scope_command_id AS scopeCommandId,
+  started_at AS startedAt, started_at_ms AS startedAtMs, state AS state,
+  terminal_at AS terminalAt, terminal_at_ms AS terminalAtMs,
+  terminal_reason AS terminalReason,
+  vouch_policy_revision AS vouchPolicyRevision
+ FROM pi_rpc_authorization_permits WHERE permit_id = ?`;
+export const readPiRpcPlanRow = (database, planId) => database.prepare(PLAN_SELECT).get(planId);
+export const readPiRpcManifestRow = (database, closureSha256) => database
+    .prepare(`SELECT closure_sha256 AS closureSha256,
+        excluded_bin_entry_count AS excludedBinEntryCount,
+        file_count AS fileCount,
+        manifest_bytes AS manifestBytes,
+        package_manifest_sha256 AS packageManifestSha256,
+        package_name AS packageName,
+        package_root_device AS packageRootDevice,
+        package_root_inode AS packageRootInode,
+        package_root_path AS packageRootPath, package_version AS packageVersion,
+        total_bytes AS totalBytes
+       FROM pi_rpc_artifact_manifests WHERE closure_sha256 = ?`)
+    .get(closureSha256);
+export const readPiRpcManifestEntryRows = (database, closureSha256) => database
+    .prepare(`SELECT byte_count AS byteCount, executable AS executable,
+        ordinal AS ordinal, relative_path AS relativePath, sha256 AS sha256
+       FROM pi_rpc_artifact_manifest_entries WHERE closure_sha256 = ?
+       ORDER BY ordinal ASC`)
+    .all(closureSha256);
+const readAuthorization = (database, suffix) => database.prepare(`${AUTHORIZATION_SELECT} ${suffix}`).get();
+export const readLatestPiRpcAuthorization = (database) => readAuthorization(database, "ORDER BY authorization_revision DESC LIMIT 1");
+export const readActivePiRpcAuthorization = (database) => readAuthorization(database, "AND state = 'active' LIMIT 1");
+export const readPiRpcAuthorizationRevision = (database, revision) => database
+    .prepare(`${AUTHORIZATION_SELECT} AND authorization_revision = ? LIMIT 1`)
+    .get(revision);
+export const readPiRpcPermitRow = (database, permitId) => database.prepare(PERMIT_SELECT).get(permitId);
+export const countPiRpcUnsettledPermits = (database, revision) => database
+    .prepare(`SELECT COUNT(*) AS value FROM pi_rpc_authorization_permits
+         WHERE authorization_revision = ?
+           AND state IN ('issued', 'dispatching', 'started')`)
+    .get(revision).value;
+//# sourceMappingURL=database.js.map

package/dist/harness/pi-rpc/authorization/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/database.ts"],"names":[],"mappings":"AAgHA,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;mDAqB+B,CAAC;AAEpD,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;kEAqBqC,CAAC;AAEnE,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;uDAgBiC,CAAC;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,QAAsB,EACtB,MAAc,EACY,EAAE,CAC5B,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;AAExE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAsB,EACtB,aAAqB,EACS,EAAE,CAChC,QAAQ;KACL,OAAO,CACN;;;;;;;;;;+DAUyD,CAC1D;KACA,GAAG,CAAC,aAAa,CAAiC,CAAC;AAExD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,QAAsB,EACtB,aAAqB,EACa,EAAE,CACpC,QAAQ;KACL,OAAO,CACN;;;4BAGsB,CACvB;KACA,GAAG,CAAC,aAAa,CAAgD,CAAC;AAEvE,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,MAAc,EACqB,EAAE,CACrC,QAAQ,CAAC,OAAO,CAAC,GAAG,oBAAoB,IAAI,MAAM,EAAE,CAAC,CAAC,GAAG,EACtB,CAAC;AAEtC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAsB,EACa,EAAE,CACrC,iBAAiB,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAsB,EACa,EAAE,CACrC,iBAAiB,CAAC,QAAQ,EAAE,8BAA8B,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,QAAsB,EACtB,QAAgB,EACmB,EAAE,CACrC,QAAQ;KACL,OAAO,CAAC,GAAG,oBAAoB,yCAAyC,CAAC;KACzE,GAAG,CAAC,QAAQ,CAAsC,CAAC;AAExD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,QAAsB,EACtB,QAAgB,EACY,EAAE,CAC9B,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,QAAQ,CAA+B,CAAC;AAE9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,QAAsB,EACtB,QAAgB,EACR,EAAE,CAER,QAAQ;KACL,OAAO,CACN;;6DAEqD,CACtD;KACA,GAAG,CAAC,QAAQ,CAChB,CAAC,KAAK,CAAC"}

package/dist/harness/pi-rpc/authorization/index.d.ts

@@ -0,0 +1,7 @@
+export { applyPiRpcIntegrationAuthorization, beginPiRpcIntegrationRevocation, settlePiRpcIntegrationRevocation, showPiRpcIntegrationAuthorization, } from "./authorization-store.js";
+export { dispatchPiRpcIntegrationPermit, issuePiRpcIntegrationPermit, listPiRpcUnsettledPermits, settlePiRpcIntegrationPermit, startPiRpcIntegrationPermit, } from "./permit-store.js";
+export { createPiRpcIntegrationPlan, readPiRpcIntegrationPlan, } from "./plan-store.js";
+export { recoverPiRpcAuthorizationStorage } from "./recovery-store.js";
+export type { PiRpcArtifactManifest, PiRpcArtifactManifestEntry, PiRpcAuthorizationProjection, PiRpcIntegrationPlanRecord, PiRpcIntegrationPlanTarget, PiRpcOwnerKind, PiRpcPermitProjection, PiRpcPermitTerminalReason, PiRpcPolicyRevisionSnapshot, } from "./types.js";
+export { PI_RPC_OWNER_KINDS } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/harness/pi-rpc/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,+BAA+B,EAC/B,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,EAC1B,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/harness/pi-rpc/authorization/index.js

@@ -0,0 +1,6 @@
+export { applyPiRpcIntegrationAuthorization, beginPiRpcIntegrationRevocation, settlePiRpcIntegrationRevocation, showPiRpcIntegrationAuthorization, } from "./authorization-store.js";
+export { dispatchPiRpcIntegrationPermit, issuePiRpcIntegrationPermit, listPiRpcUnsettledPermits, settlePiRpcIntegrationPermit, startPiRpcIntegrationPermit, } from "./permit-store.js";
+export { createPiRpcIntegrationPlan, readPiRpcIntegrationPlan, } from "./plan-store.js";
+export { recoverPiRpcAuthorizationStorage } from "./recovery-store.js";
+export { PI_RPC_OWNER_KINDS } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/harness/pi-rpc/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,+BAA+B,EAC/B,gCAAgC,EAChC,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAYvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/harness/pi-rpc/authorization/permit-compaction-store.d.ts

@@ -0,0 +1,3 @@
+import type { DatabaseSync } from "node:sqlite";
+export declare const compactPiRpcTerminalPermits: (database: DatabaseSync, recordedAtMs: number) => void;
+//# sourceMappingURL=permit-compaction-store.d.ts.map

package/dist/harness/pi-rpc/authorization/permit-compaction-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit-compaction-store.d.ts","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/permit-compaction-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmGhD,eAAO,MAAM,2BAA2B,GACtC,UAAU,YAAY,EACtB,cAAc,MAAM,KACnB,IAmBF,CAAC"}

package/dist/harness/pi-rpc/authorization/permit-compaction-store.js

@@ -0,0 +1,61 @@
+import { PI_RPC_MAX_TERMINAL_PERMITS, PI_RPC_TERMINAL_RETENTION_MS, } from "./policy.js";
+const SELECT_AGED_TERMINAL_SQL = `SELECT
+  authorization_revision AS authorizationRevision,
+  sequence AS sequence, terminal_reason AS terminalReason
+FROM pi_rpc_authorization_permits
+WHERE state = 'terminal' AND terminal_at_ms < ?
+ORDER BY terminal_at_ms ASC, sequence ASC`;
+const SELECT_OVERFLOW_TERMINAL_SQL = `SELECT
+  authorization_revision AS authorizationRevision,
+  sequence AS sequence, terminal_reason AS terminalReason
+FROM pi_rpc_authorization_permits
+WHERE state = 'terminal'
+ORDER BY terminal_at_ms ASC, sequence ASC
+LIMIT ?`;
+const selectTerminalRows = (database, query, value) => database.prepare(query).all(value);
+const groupTerminalRows = (rows) => {
+    const grouped = new Map();
+    rows.forEach((row) => {
+        const key = `${String(row.authorizationRevision)}:${row.terminalReason}`;
+        const existing = grouped.get(key);
+        if (existing === undefined)
+            grouped.set(key, {
+                count: 1,
+                reason: row.terminalReason,
+                revision: row.authorizationRevision,
+            });
+        else
+            existing.count += 1;
+    });
+    return grouped;
+};
+const upsertPermitRollups = (database, grouped) => {
+    const upsert = database.prepare(`INSERT INTO pi_rpc_authorization_permit_rollups(
+      authorization_revision, terminal_reason, count
+    ) VALUES (?, ?, ?)
+    ON CONFLICT(authorization_revision, terminal_reason)
+    DO UPDATE SET count = count + excluded.count`);
+    grouped.forEach((entry) => {
+        upsert.run(entry.revision, entry.reason, entry.count);
+    });
+};
+const evictTerminalRows = (database, rows) => {
+    if (rows.length === 0)
+        return;
+    upsertPermitRollups(database, groupTerminalRows(rows));
+    const remove = database.prepare("DELETE FROM pi_rpc_authorization_permits WHERE sequence = ?");
+    rows.forEach((row) => {
+        remove.run(row.sequence);
+    });
+};
+const countTerminalPermits = (database) => database
+    .prepare("SELECT COUNT(*) AS value FROM pi_rpc_authorization_permits WHERE state = 'terminal'")
+    .get().value;
+export const compactPiRpcTerminalPermits = (database, recordedAtMs) => {
+    evictTerminalRows(database, selectTerminalRows(database, SELECT_AGED_TERMINAL_SQL, recordedAtMs - PI_RPC_TERMINAL_RETENTION_MS));
+    const count = countTerminalPermits(database);
+    if (count <= PI_RPC_MAX_TERMINAL_PERMITS)
+        return;
+    evictTerminalRows(database, selectTerminalRows(database, SELECT_OVERFLOW_TERMINAL_SQL, count - PI_RPC_MAX_TERMINAL_PERMITS));
+};
+//# sourceMappingURL=permit-compaction-store.js.map

package/dist/harness/pi-rpc/authorization/permit-compaction-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit-compaction-store.js","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/permit-compaction-store.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAGrB,MAAM,wBAAwB,GAAG;;;;;0CAKS,CAAC;AAE3C,MAAM,4BAA4B,GAAG;;;;;;QAM7B,CAAC;AAcT,MAAM,kBAAkB,GAAG,CACzB,QAAsB,EACtB,KAAa,EACb,KAAa,EACiB,EAAE,CAChC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAA4C,CAAC;AAEhF,MAAM,iBAAiB,GAAG,CACxB,IAAkC,EACA,EAAE;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IACvD,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS;YACxB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBACf,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,GAAG,CAAC,cAAc;gBAC1B,QAAQ,EAAE,GAAG,CAAC,qBAAqB;aACpC,CAAC,CAAC;;YACA,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,QAAsB,EACtB,OAAyC,EACnC,EAAE;IACR,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAC7B;;;;iDAI6C,CAC9C,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EACtB,IAAkC,EAC5B,EAAE;IACR,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAC7B,6DAA6D,CAC9D,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,QAAsB,EAAU,EAAE,CAE5D,QAAQ;KACL,OAAO,CACN,qFAAqF,CACtF;KACA,GAAG,EACP,CAAC,KAAK,CAAC;AAEV,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,QAAsB,EACtB,YAAoB,EACd,EAAE;IACR,iBAAiB,CACf,QAAQ,EACR,kBAAkB,CAChB,QAAQ,EACR,wBAAwB,EACxB,YAAY,GAAG,4BAA4B,CAC5C,CACF,CAAC;IACF,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,KAAK,IAAI,2BAA2B;QAAE,OAAO;IACjD,iBAAiB,CACf,QAAQ,EACR,kBAAkB,CAChB,QAAQ,EACR,4BAA4B,EAC5B,KAAK,GAAG,2BAA2B,CACpC,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/harness/pi-rpc/authorization/permit-store.d.ts

@@ -0,0 +1,38 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { PiRpcCommandInput, PiRpcOwnerKind, PiRpcPermitProjection, PiRpcPermitTerminalReason, PiRpcPolicyRevisionSnapshot, PiRpcReplayResult } from "./types.js";
+type PermitIdentity = {
+    readonly authorizationRevision: string;
+    readonly closureSha256: string;
+    readonly entrySha256: string;
+    readonly interpreterSha256: string;
+    readonly policy: PiRpcPolicyRevisionSnapshot;
+};
+type IssueInput = PiRpcCommandInput & PermitIdentity & {
+    readonly fenceId: string;
+    readonly ownerKind: PiRpcOwnerKind;
+    readonly permitId: string;
+    readonly runtimeSessionId: string;
+    readonly scopeCommandId: string;
+};
+type PermitMutationResult = {
+    readonly method: "integration.permit.dispatch.pi-rpc" | "integration.permit.issue.pi-rpc" | "integration.permit.settle.pi-rpc" | "integration.permit.start.pi-rpc";
+    readonly permit: PiRpcPermitProjection;
+    readonly recordedAt: string;
+};
+export declare const issuePiRpcIntegrationPermit: (database: DatabaseSync, input: IssueInput) => PiRpcReplayResult<PermitMutationResult>;
+type PermitCommand = PiRpcCommandInput & {
+    readonly permitId: string;
+};
+export declare const dispatchPiRpcIntegrationPermit: (database: DatabaseSync, input: PermitCommand) => PiRpcReplayResult<PermitMutationResult>;
+type StartInput = PermitCommand & {
+    readonly identity: PermitIdentity;
+    readonly processTreeId: string;
+};
+export declare const startPiRpcIntegrationPermit: (database: DatabaseSync, input: StartInput) => PiRpcReplayResult<PermitMutationResult>;
+type SettleInput = PermitCommand & {
+    readonly reason: PiRpcPermitTerminalReason;
+};
+export declare const settlePiRpcIntegrationPermit: (database: DatabaseSync, input: SettleInput) => PiRpcReplayResult<PermitMutationResult>;
+export declare const listPiRpcUnsettledPermits: (database: DatabaseSync, authorizationRevision: string, limit?: number) => readonly PiRpcPermitProjection[];
+export {};
+//# sourceMappingURL=permit-store.d.ts.map

package/dist/harness/pi-rpc/authorization/permit-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit-store.d.ts","sourceRoot":"","sources":["../../../../src/harness/pi-rpc/authorization/permit-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwBhD,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB,KAAK,cAAc,GAAG;IACpB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;CAC9C,CAAC;AAEF,KAAK,UAAU,GAAG,iBAAiB,GACjC,cAAc,GAAG;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEJ,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,MAAM,EACX,oCAAoC,GACpC,iCAAiC,GACjC,kCAAkC,GAClC,iCAAiC,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAiSF,eAAO,MAAM,2BAA2B,GACtC,UAAU,YAAY,EACtB,OAAO,UAAU,KAChB,iBAAiB,CAAC,oBAAoB,CAKtC,CAAC;AAEJ,KAAK,aAAa,GAAG,iBAAiB,GAAG;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8CF,eAAO,MAAM,8BAA8B,GACzC,UAAU,YAAY,EACtB,OAAO,aAAa,KACnB,iBAAiB,CAAC,oBAAoB,CAKtC,CAAC;AAEJ,KAAK,UAAU,GAAG,aAAa,GAAG;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,CAAC;AAwDF,eAAO,MAAM,2BAA2B,GACtC,UAAU,YAAY,EACtB,OAAO,UAAU,KAChB,iBAAiB,CAAC,oBAAoB,CAKtC,CAAC;AAEJ,KAAK,WAAW,GAAG,aAAa,GAAG;IACjC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C,CAAC;AAkKF,eAAO,MAAM,4BAA4B,GACvC,UAAU,YAAY,EACtB,OAAO,WAAW,KACjB,iBAAiB,CAAC,oBAAoB,CAKtC,CAAC;AAYJ,eAAO,MAAM,yBAAyB,GACpC,UAAU,YAAY,EACtB,uBAAuB,MAAM,EAC7B,QAAO,MAA+C,KACrD,SAAS,qBAAqB,EAiBhC,CAAC"}