@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/runtime/process/resource/integration-authorization-manager.js

@@ -0,0 +1,353 @@
+import { createHash, randomUUID } from "node:crypto";
+import { DatabaseSync } from "node:sqlite";
+import { Effect, Ref, Semaphore } from "effect";
+import { applyMigrations, configureDatabase, LATEST_SCHEMA_VERSION, } from "../../../storage/migrations.js";
+import { asNodeRuntimeError, makeNodeRuntimeError, } from "../../errors.js";
+import { dispatchCodexIntegrationPermit, issueCodexIntegrationPermit, listCodexUnsettledPermits, settleCodexIntegrationPermit, showCodexIntegrationAuthorization, startCodexIntegrationPermit, } from "./integration-authorization/index.js";
+import { hasAuthorizedSpawn, hasCodexAuthorizationRevocation, hasPiRpcAuthorizationRevocation, processResourceManagerAuthorizedSpawn, processResourceManagerRevokeCodexAuthorization, processResourceManagerRevokePiRpcAuthorization, } from "./internal-spawn.js";
+const codexDenied = () => makeNodeRuntimeError("transport_failed", "The process consumer is not source-enabled.");
+const codexLocallyFenced = () => makeNodeRuntimeError("transport_failed", "The process consumer is locally fenced after a durable authorization failure.");
+const managerError = (message) => makeNodeRuntimeError("transport_failed", message);
+const nowIso = () => new Date().toISOString();
+const hashedSuffix = (value) => createHash("sha256").update(value).digest("hex").slice(0, 48);
+const commandIdFor = (phase, seed) => `ia.${phase}.${hashedSuffix(seed)}`;
+const requestDigestFor = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const storageFailure = (error, message) => asNodeRuntimeError(error, "storage_failed", message);
+const codexOwner = (owner) => {
+    if (owner.kind === "codex-probe") {
+        return owner.commandId !== undefined;
+    }
+    if (owner.kind === "codex-session") {
+        return (owner.commandId !== undefined &&
+            owner.sessionId !== undefined &&
+            owner.workspaceId !== undefined);
+    }
+    return false;
+};
+const openAuthorizationDatabase = (databasePath) => Effect.try({
+    catch: (error) => storageFailure(error, "Failed to open integration authorization storage."),
+    try: () => {
+        const database = new DatabaseSync(databasePath);
+        configureDatabase(database);
+        database.exec("PRAGMA busy_timeout = 2000;");
+        applyMigrations(database, LATEST_SCHEMA_VERSION, nowIso());
+        return database;
+    },
+});
+const closeAuthorizationDatabase = (database) => Effect.sync(() => {
+    database.close();
+}).pipe(Effect.result, Effect.asVoid);
+const withAuthorizationDatabase = (databasePath, use) => Effect.acquireUseRelease(openAuthorizationDatabase(databasePath), use, closeAuthorizationDatabase);
+const withSerializedDatabase = (runtime, use) => runtime.semaphore.withPermit(withAuthorizationDatabase(runtime.databasePath, use));
+const showAuthorization = (database) => Effect.try({
+    catch: (error) => storageFailure(error, "Failed to read integration authorization."),
+    try: () => showCodexIntegrationAuthorization(database),
+});
+const requireLocalFenceOpen = (runtime) => Ref.get(runtime.lifecycleFence).pipe(Effect.flatMap((fenced) => fenced ? Effect.fail(codexLocallyFenced()) : Effect.void));
+const isDurableLifecycleFailure = (error) => error.code === "resource_not_found" ||
+    error.code === "storage_conflict" ||
+    error.code === "storage_corrupt" ||
+    error.code === "storage_failed";
+const engageLocalFence = (runtime) => Ref.set(runtime.lifecycleFence, true);
+const runLifecycleOperation = (runtime, use) => withSerializedDatabase(runtime, use).pipe(Effect.catch((error) => isDurableLifecycleFailure(error)
+    ? engageLocalFence(runtime).pipe(Effect.andThen(Effect.fail(error)))
+    : Effect.fail(error)));
+const resolveActiveAuthorization = Effect.fn("CodexAuth.resolveActiveAuthorization")(function* (database, owner, request) {
+    const shown = yield* showAuthorization(database);
+    if (shown?.authorization.state !== "active" ||
+        shown.authorization.executablePath !== request.executable ||
+        !shown.authorization.ownerKinds.includes(owner.kind)) {
+        return yield* Effect.fail(codexDenied());
+    }
+    return shown.authorization;
+});
+const issuePermitInput = (input) => {
+    const fenceId = `fence_${randomUUID().replaceAll("-", "")}`;
+    return {
+        commandId: commandIdFor("issue", `${input.owner.commandId}:${input.owner.kind}:${input.request.executable}:${fenceId}`),
+        fenceId,
+        ownerKind: input.owner.kind,
+        policy: input.policy,
+        recordedAt: nowIso(),
+        requestDigest: requestDigestFor({
+            owner: input.owner,
+            phase: "issue",
+            policy: input.policy,
+            request: {
+                arguments_: input.request.arguments_,
+                executable: input.request.executable,
+                workingDirectory: input.request.workingDirectory,
+            },
+        }),
+        scopeCommandId: input.owner.commandId,
+        scopeSessionId: input.owner.kind === "codex-session" ? input.owner.sessionId : undefined,
+    };
+};
+const issuePermit = Effect.fn("CodexAuth.issuePermit")(function* (database, input) {
+    const requestInput = issuePermitInput(input);
+    return yield* Effect.try({
+        catch: (error) => storageFailure(error, "Failed to issue integration permit."),
+        try: () => issueCodexIntegrationPermit(database, requestInput).permit,
+    });
+});
+const dispatchPermitInput = (input) => ({
+    commandId: commandIdFor("dispatch", input.permitId),
+    permitId: input.permitId,
+    policy: input.policy,
+    recordedAt: nowIso(),
+    requestDigest: requestDigestFor({
+        permitId: input.permitId,
+        phase: "dispatch",
+        policy: input.policy,
+        revision: input.revision,
+    }),
+    revision: input.revision,
+});
+const dispatchPermit = Effect.fn("CodexAuth.dispatchPermit")(function* (database, input) {
+    const requestInput = dispatchPermitInput(input);
+    return yield* Effect.try({
+        catch: (error) => storageFailure(error, "Failed to dispatch integration permit."),
+        try: () => dispatchCodexIntegrationPermit(database, requestInput).permit,
+    });
+});
+const startPermitInput = (input) => ({
+    commandId: commandIdFor("start", `${input.permitId}:${input.processTreeId}`),
+    permitId: input.permitId,
+    policy: input.policy,
+    processTreeId: input.processTreeId,
+    recordedAt: nowIso(),
+    requestDigest: requestDigestFor({
+        permitId: input.permitId,
+        phase: "start",
+        policy: input.policy,
+        processTreeId: input.processTreeId,
+        revision: input.revision,
+    }),
+    revision: input.revision,
+});
+const startPermit = Effect.fn("CodexAuth.startPermit")(function* (database, input) {
+    const requestInput = startPermitInput(input);
+    const result = yield* Effect.try({
+        catch: (error) => storageFailure(error, "Failed to start integration permit."),
+        try: () => startCodexIntegrationPermit(database, requestInput),
+    });
+    if (result.permit.state !== "started") {
+        return yield* Effect.fail(codexDenied());
+    }
+});
+const settlePermit = Effect.fn("CodexAuth.settlePermit")(function* (database, input) {
+    const recordedAt = nowIso();
+    yield* Effect.try({
+        catch: (error) => storageFailure(error, "Failed to settle integration permit."),
+        try: () => settleCodexIntegrationPermit(database, {
+            commandId: commandIdFor("settle", `${input.permitId}:${input.reason}`),
+            permitId: input.permitId,
+            reason: input.reason,
+            recordedAt,
+            requestDigest: requestDigestFor({
+                permitId: input.permitId,
+                phase: "settle",
+                reason: input.reason,
+            }),
+        }),
+    });
+});
+const listRecoveryPermits = (database, revision) => Effect.try({
+    catch: (error) => storageFailure(error, "Failed to query unsettled integration permits."),
+    try: () => listCodexUnsettledPermits(database, revision, 8),
+});
+const issuedRecoveryReason = (expiresAt) => Date.parse(nowIso()) >= Date.parse(expiresAt) ? "expired" : "failed";
+const recoverIssuedPermit = (database, revision, permit) => {
+    const reason = issuedRecoveryReason(permit.expiresAt);
+    return Effect.try({
+        catch: (error) => storageFailure(error, "Failed to settle issued permit during recovery."),
+        try: () => settleCodexIntegrationPermit(database, {
+            commandId: commandIdFor("recover-issued", `${permit.id}:${reason}`),
+            permitId: permit.id,
+            reason,
+            recordedAt: nowIso(),
+            requestDigest: requestDigestFor({
+                permitId: permit.id,
+                phase: "recover-issued",
+                reason,
+                revision,
+            }),
+        }),
+    }).pipe(Effect.asVoid);
+};
+const ensureRecoverySetMatches = (permits, unsettledCount) => permits.length === unsettledCount
+    ? Effect.void
+    : Effect.fail(makeNodeRuntimeError("storage_conflict", "The integration permit recovery set is inconsistent."));
+const recoverPermit = (database, revision, permit) => permit.state === "dispatching" || permit.state === "started"
+    ? settlePermit(database, {
+        permitId: permit.id,
+        reason: "cleanup_unknown",
+    })
+    : recoverIssuedPermit(database, revision, permit);
+const recoverUnsettledPermits = Effect.fn("CodexAuth.recoverUnsettledPermits")(function* (database) {
+    const shown = yield* showAuthorization(database);
+    if (shown === undefined)
+        return;
+    const unsettledCount = shown.activeUnsettledPermits + shown.revokingUnsettledPermits;
+    if (unsettledCount === 0)
+        return;
+    const revision = shown.authorization.revision;
+    const permits = yield* listRecoveryPermits(database, revision);
+    yield* ensureRecoverySetMatches(permits, unsettledCount);
+    yield* Effect.all(permits.map((permit) => recoverPermit(database, revision, permit)), {
+        concurrency: 1,
+        discard: true,
+    });
+});
+const policyFromAuthorization = (authorization) => ({
+    adapterVersion: authorization.adapterVersion,
+    sandboxPolicyRevision: authorization.sandboxPolicyRevision,
+    vouchPolicyRevision: authorization.vouchPolicyRevision,
+});
+const settleLaunchPermit = (input, reason) => runLifecycleOperation(input.runtime, (database) => settlePermit(database, {
+    permitId: input.permit.id,
+    reason,
+}));
+const startLaunchPermit = (input, processTreeId) => runLifecycleOperation(input.runtime, (database) => startPermit(database, {
+    permitId: input.permit.id,
+    policy: input.policy,
+    processTreeId,
+    revision: input.authorization.revision,
+}));
+const launchPermitCallbacks = (input) => ({
+    onLaunchFailed: (reason) => settleLaunchPermit(input, reason),
+    onPreparedToStart: (processTreeId) => startLaunchPermit(input, processTreeId),
+    onTreeSettled: (reason) => settleLaunchPermit(input, reason),
+});
+const codexVouchTarget = (input) => ({
+    adapter: "codex",
+    adapterVersion: input.policy.adapterVersion,
+    executablePath: input.authorization.executablePath,
+    ownerKinds: input.authorization.ownerKinds,
+    sandboxPolicyRevision: input.policy.sandboxPolicyRevision,
+    sha256: input.authorization.executableSha256,
+    vouchPolicyRevision: input.policy.vouchPolicyRevision,
+});
+const codexLaunchAuthorizationFromPermit = (input) => {
+    const callbacks = launchPermitCallbacks(input);
+    const launchAuthorization = {
+        authorizationRevision: input.authorization.revision,
+        fenceId: input.permit.fenceId,
+        onLaunchFailed: callbacks.onLaunchFailed,
+        onPreparedToStart: callbacks.onPreparedToStart,
+        onTreeSettled: callbacks.onTreeSettled,
+        permitId: input.permit.id,
+        policy: input.policy,
+        vouchTarget: codexVouchTarget(input),
+    };
+    return Object.freeze({ codex: Object.freeze(launchAuthorization) });
+};
+const issueAndDispatchPermit = Effect.fn("CodexAuth.issueAndDispatchPermit")(function* (input) {
+    const permit = yield* issuePermit(input.database, {
+        owner: input.owner,
+        policy: input.policy,
+        request: input.request,
+    });
+    const dispatch = yield* dispatchPermit(input.database, {
+        permitId: permit.id,
+        policy: input.policy,
+        revision: input.authorization.revision,
+    });
+    if (dispatch.state !== "dispatching") {
+        return yield* Effect.fail(codexDenied());
+    }
+    return dispatch;
+});
+const authorizeCodexLaunchInDatabase = (input) => Effect.gen(function* () {
+    yield* requireLocalFenceOpen(input.runtime);
+    const authorization = yield* resolveActiveAuthorization(input.database, input.owner, input.request);
+    const policy = policyFromAuthorization(authorization);
+    const permit = yield* issueAndDispatchPermit({
+        authorization,
+        database: input.database,
+        owner: input.owner,
+        policy,
+        request: input.request,
+    });
+    return codexLaunchAuthorizationFromPermit({
+        authorization,
+        permit,
+        policy,
+        runtime: input.runtime,
+    });
+});
+const authorizeCodexLaunch = Effect.fn("CodexAuth.authorizeLaunch")(function* (runtime, request) {
+    const owner = request.owner;
+    if (!codexOwner(owner))
+        return yield* Effect.fail(codexDenied());
+    return yield* withSerializedDatabase(runtime, (database) => authorizeCodexLaunchInDatabase({
+        database,
+        owner,
+        request,
+        runtime,
+    }));
+});
+const spawnWithCodexAuthorization = (manager, runtime, request) => Effect.gen(function* () {
+    if (!hasAuthorizedSpawn(manager)) {
+        return yield* Effect.fail(managerError("The native process manager does not accept private authorization."));
+    }
+    const authorization = yield* authorizeCodexLaunch(runtime, request);
+    return yield* manager[processResourceManagerAuthorizedSpawn](request, authorization);
+});
+const piRpcManagerCapabilities = (manager) => {
+    const revoke = hasPiRpcAuthorizationRevocation(manager)
+        ? manager[processResourceManagerRevokePiRpcAuthorization]
+        : undefined;
+    const spawn = hasAuthorizedSpawn(manager)
+        ? manager[processResourceManagerAuthorizedSpawn]
+        : undefined;
+    return {
+        ...(revoke === undefined
+            ? {}
+            : { [processResourceManagerRevokePiRpcAuthorization]: revoke }),
+        ...(spawn === undefined
+            ? {}
+            : {
+                [processResourceManagerAuthorizedSpawn]: (request, authorization) => (request.owner.kind === "pi-rpc-probe" ||
+                    request.owner.kind === "pi-rpc-session") &&
+                    authorization?.piRpc !== undefined &&
+                    authorization.codex === undefined
+                    ? spawn(request, authorization)
+                    : Effect.fail(codexDenied()),
+            }),
+    };
+};
+const authorizationManagerService = (manager, runtime) => {
+    const revoke = hasCodexAuthorizationRevocation(manager)
+        ? manager[processResourceManagerRevokeCodexAuthorization]
+        : undefined;
+    return {
+        ...piRpcManagerCapabilities(manager),
+        activeCount: manager.activeCount,
+        health: manager.health,
+        ...(revoke === undefined
+            ? {}
+            : { [processResourceManagerRevokeCodexAuthorization]: revoke }),
+        refresh: manager.refresh,
+        spawn: (request) => request.owner.kind === "codex-probe" ||
+            request.owner.kind === "codex-session"
+            ? spawnWithCodexAuthorization(manager, runtime, request)
+            : manager.spawn(request),
+    };
+};
+const withCodexIntegrationDatabase = Effect.fn("CodexAuth.withIntegrationDatabase")(function* (input) {
+    const runtime = {
+        databasePath: input.databasePath,
+        lifecycleFence: yield* Ref.make(false),
+        semaphore: yield* Semaphore.make(1),
+    };
+    yield* withSerializedDatabase(runtime, recoverUnsettledPermits);
+    return authorizationManagerService(input.manager, runtime);
+});
+export const withCodexIntegrationAuthorization = (input) => input.enabled
+    ? withCodexIntegrationDatabase({
+        databasePath: input.databasePath,
+        manager: input.manager,
+    })
+    : Effect.succeed(input.manager);
+//# sourceMappingURL=integration-authorization-manager.js.map

package/dist/runtime/process/resource/integration-authorization-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-authorization-manager.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/integration-authorization-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAc,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE5D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,GAC5B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,+BAA+B,EAC/B,qCAAqC,EACrC,8CAA8C,EAC9C,8CAA8C,GAC/C,MAAM,qBAAqB,CAAC;AAwB7B,MAAM,WAAW,GAAG,GAAqB,EAAE,CACzC,oBAAoB,CAClB,kBAAkB,EAClB,6CAA6C,CAC9C,CAAC;AAEJ,MAAM,kBAAkB,GAAG,GAAqB,EAAE,CAChD,oBAAoB,CAClB,kBAAkB,EAClB,+EAA+E,CAChF,CAAC;AAEJ,MAAM,YAAY,GAAG,CAAC,OAAe,EAAoB,EAAE,CACzD,oBAAoB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAQpD,MAAM,MAAM,GAAG,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAEtD,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAC7C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEhE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CAC3D,MAAM,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAEtC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAU,EAAE,CAClD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnE,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,OAAe,EAAoB,EAAE,CAC3E,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAEvD,MAAM,UAAU,GAAG,CACjB,KAA4C,EACjB,EAAE;IAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,CACL,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,KAAK,CAAC,SAAS,KAAK,SAAS;YAC7B,KAAK,CAAC,WAAW,KAAK,SAAS,CAChC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAChC,YAAoB,EAC2B,EAAE,CACjD,MAAM,CAAC,GAAG,CAAC;IACT,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CACZ,KAAK,EACL,mDAAmD,CACpD;IACH,GAAG,EAAE,GAAG,EAAE;QACR,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;QAChD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,eAAe,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC,CAAC;AAEL,MAAM,0BAA0B,GAAG,CAAC,QAAsB,EAAE,EAAE,CAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;IACf,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AAExC,MAAM,yBAAyB,GAAG,CAChC,YAAoB,EACpB,GAAwE,EAC/B,EAAE,CAC3C,MAAM,CAAC,iBAAiB,CACtB,yBAAyB,CAAC,YAAY,CAAC,EACvC,GAAG,EACH,0BAA0B,CAC3B,CAAC;AAEJ,MAAM,sBAAsB,GAAG,CAC7B,OAAoC,EACpC,GAAwE,EAC/B,EAAE,CAC3C,OAAO,CAAC,SAAS,CAAC,UAAU,CAC1B,yBAAyB,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CACrD,CAAC;AAEJ,MAAM,iBAAiB,GAAG,CACxB,QAAsB,EAItB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC;IACT,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,2CAA2C,CAAC;IACpE,GAAG,EAAE,GAAG,EAAE,CAAC,iCAAiC,CAAC,QAAQ,CAAC;CACvD,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,CAC5B,OAAoC,EACG,EAAE,CACzC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAClC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACxB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CACzD,CACF,CAAC;AAEJ,MAAM,yBAAyB,GAAG,CAAC,KAAuB,EAAW,EAAE,CACrE,KAAK,CAAC,IAAI,KAAK,oBAAoB;IACnC,KAAK,CAAC,IAAI,KAAK,kBAAkB;IACjC,KAAK,CAAC,IAAI,KAAK,iBAAiB;IAChC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC;AAElC,MAAM,gBAAgB,GAAG,CACvB,OAAoC,EACf,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAEhE,MAAM,qBAAqB,GAAG,CAC5B,OAAoC,EACpC,GAAwE,EAC/B,EAAE,CAC3C,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,yBAAyB,CAAC,KAAK,CAAC;IAC9B,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CACvB,CACF,CAAC;AAEJ,MAAM,0BAA0B,GAAG,MAAM,CAAC,EAAE,CAC1C,sCAAsC,CACvC,CAAC,QAAQ,CAAC,EACT,QAAsB,EACtB,KAAuB,EACvB,OAAqC;IAErC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IACE,KAAK,EAAE,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,KAAK,CAAC,aAAa,CAAC,cAAc,KAAK,OAAO,CAAC,UAAU;QACzD,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EACpD,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,aAAa,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,KAIzB,EAAE,EAAE;IACH,MAAM,OAAO,GAAG,SAAS,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5D,OAAO;QACL,SAAS,EAAE,YAAY,CACrB,OAAO,EACP,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,EAAE,CACtF;QACD,OAAO;QACP,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,MAAM,EAAE;QACpB,aAAa,EAAE,gBAAgB,CAAC;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE;gBACP,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;gBACpC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;gBACpC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;aACjD;SACF,CAAC;QACF,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;QACrC,cAAc,EACZ,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAC9D,QAAsB,EACtB,KAIC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,qCAAqC,CAAC;QAC9D,GAAG,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM;KACtE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,KAI5B,EAAE,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;IACnD,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,EAAE;IACpB,aAAa,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,QAAQ,EAAE,KAAK,CAAC,QAAQ;CACzB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EACpE,QAAsB,EACtB,KAIC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,wCAAwC,CAAC;QACjE,GAAG,EAAE,GAAG,EAAE,CAAC,8BAA8B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM;KACzE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,KAKzB,EAAE,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;IAC5E,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,aAAa,EAAE,KAAK,CAAC,aAAa;IAClC,UAAU,EAAE,MAAM,EAAE;IACpB,aAAa,EAAE,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,QAAQ,EAAE,KAAK,CAAC,QAAQ;CACzB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,EAC9D,QAAsB,EACtB,KAKC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,qCAAqC,CAAC;QAC9D,GAAG,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC;KAC/D,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,EAChE,QAAsB,EACtB,KAIC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAC5B,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAChB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,sCAAsC,CAAC;QAC/D,GAAG,EAAE,GAAG,EAAE,CACR,4BAA4B,CAAC,QAAQ,EAAE;YACrC,SAAS,EAAE,YAAY,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACtE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;YACV,aAAa,EAAE,gBAAgB,CAAC;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;SACH,CAAC;KACL,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,QAAsB,EAAE,QAAgB,EAAE,EAAE,CACvE,MAAM,CAAC,GAAG,CAAC;IACT,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,gDAAgD,CAAC;IACzE,GAAG,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC5D,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,CAAC,SAAiB,EAAwB,EAAE,CACvE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAEvE,MAAM,mBAAmB,GAAG,CAC1B,QAAsB,EACtB,QAAgB,EAChB,MAA2D,EAC3D,EAAE;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,GAAG,CAAC;QAChB,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,cAAc,CAAC,KAAK,EAAE,iDAAiD,CAAC;QAC1E,GAAG,EAAE,GAAG,EAAE,CACR,4BAA4B,CAAC,QAAQ,EAAE;YACrC,SAAS,EAAE,YAAY,CAAC,gBAAgB,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,EAAE,CAAC;YACnE,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM;YACN,UAAU,EAAE,MAAM,EAAE;YACpB,aAAa,EAAE,gBAAgB,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,KAAK,EAAE,gBAAgB;gBACvB,MAAM;gBACN,QAAQ;aACT,CAAC;SACH,CAAC;KACL,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAC/B,OAA2B,EAC3B,cAAsB,EACtB,EAAE,CACF,OAAO,CAAC,MAAM,KAAK,cAAc;IAC/B,CAAC,CAAC,MAAM,CAAC,IAAI;IACb,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,oBAAoB,CAClB,kBAAkB,EAClB,sDAAsD,CACvD,CACF,CAAC;AAER,MAAM,aAAa,GAAG,CACpB,QAAsB,EACtB,QAAgB,EAChB,MAIC,EACD,EAAE,CACF,MAAM,CAAC,KAAK,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;IAC1D,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE;QACrB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,MAAM,EAAE,iBAAiB;KAC1B,CAAC;IACJ,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAEtD,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAC5E,QAAQ,CAAC,EAAE,QAAsB;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,cAAc,GAClB,KAAK,CAAC,sBAAsB,GAAG,KAAK,CAAC,wBAAwB,CAAC;IAChE,IAAI,cAAc,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/D,KAAK,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACzD,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAClE;QACE,WAAW,EAAE,CAAC;QACd,OAAO,EAAE,IAAI;KACd,CACF,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,aAIhC,EAAe,EAAE,CAAC,CAAC;IAClB,cAAc,EAAE,aAAa,CAAC,cAAc;IAC5C,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;IAC1D,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;CACvD,CAAC,CAAC;AAiBH,MAAM,kBAAkB,GAAG,CACzB,KAA0B,EAC1B,MAA0E,EAC1E,EAAE,CACF,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChD,YAAY,CAAC,QAAQ,EAAE;IACrB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;IACzB,MAAM;CACP,CAAC,CACH,CAAC;AAEJ,MAAM,iBAAiB,GAAG,CAAC,KAA0B,EAAE,aAAqB,EAAE,EAAE,CAC9E,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChD,WAAW,CAAC,QAAQ,EAAE;IACpB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;IACzB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,aAAa;IACb,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;CACvC,CAAC,CACH,CAAC;AAEJ,MAAM,qBAAqB,GAAG,CAC5B,KAA0B,EAI1B,EAAE,CAAC,CAAC;IACJ,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC;IAC7D,iBAAiB,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC;IAC7E,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC;CAC7D,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CACvB,KAA0B,EACe,EAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO;IAChB,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;IAC3C,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc;IAClD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU;IAC1C,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;IACzD,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,gBAAgB;IAC5C,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB;CACtD,CAAC,CAAC;AAEH,MAAM,kCAAkC,GAAG,CAAC,KAK3C,EAA8B,EAAE;IAC/B,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,mBAAmB,GAA6B;QACpD,qBAAqB,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;QACnD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC7B,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACzB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC;KACrC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAC1E,QAAQ,CAAC,EAAE,KAMV;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE;QAChD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;QACrD,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;KACvC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CACF,CAAC;AAEF,MAAM,8BAA8B,GAAG,CAAC,KAKvC,EAA+D,EAAE,CAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,0BAA0B,CACrD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,OAAO,CACd,CAAC;IACF,MAAM,MAAM,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC;QAC3C,aAAa;QACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,OAAO,kCAAkC,CAAC;QACxC,aAAa;QACb,MAAM;QACN,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,MAAM,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,QAAQ,CAAC,EAC3E,OAAoC,EACpC,OAAqC;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACzD,8BAA8B,CAAC;QAC7B,QAAQ;QACR,KAAK;QACL,OAAO;QACP,OAAO;KACR,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAClC,OAAsC,EACtC,OAAoC,EACpC,OAAqC,EACrC,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,YAAY,CACV,mEAAmE,CACpE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAC1D,OAAO,EACP,aAAa,CACd,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,wBAAwB,GAAG,CAAC,OAAsC,EAAE,EAAE;IAC1E,MAAM,MAAM,GAAG,+BAA+B,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC;QACvC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC;QAChD,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,CAAC,8CAA8C,CAAC,EAAE,MAAM,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,CAAC,qCAAqC,CAAC,EAAE,CACvC,OAAqC,EACrC,aAA0C,EAC1C,EAAE,CACF,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;oBACpC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC;oBAC1C,aAAa,EAAE,KAAK,KAAK,SAAS;oBAClC,aAAa,CAAC,KAAK,KAAK,SAAS;oBAC/B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC;oBAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aACjC,CAAC;KACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAClC,OAAsC,EACtC,OAAoC,EACpC,EAAE;IACF,MAAM,MAAM,GAAG,+BAA+B,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,8CAA8C,CAAC;QACzD,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,GAAG,wBAAwB,CAAC,OAAO,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,MAAM,KAAK,SAAS;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,CAAC,8CAA8C,CAAC,EAAE,MAAM,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,CAAC,OAAqC,EAAE,EAAE,CAC/C,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACpC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;YACpC,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACxD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;KAC7B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,4BAA4B,GAAG,MAAM,CAAC,EAAE,CAC5C,mCAAmC,CACpC,CAAC,QAAQ,CAAC,EAAE,KAGZ;IACC,MAAM,OAAO,GAAgC;QAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtC,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;KACpC,CAAC;IACF,KAAK,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAChE,OAAO,2BAA2B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,KAIjD,EAIC,EAAE,CACF,KAAK,CAAC,OAAO;IACX,CAAC,CAAC,4BAA4B,CAAC;QAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACJ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC"}

package/dist/runtime/process/resource/integration-authorization-storage.d.ts

@@ -0,0 +1,2 @@
+export * from "./integration-authorization/index.js";
+//# sourceMappingURL=integration-authorization-storage.d.ts.map

package/dist/runtime/process/resource/integration-authorization-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-authorization-storage.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/integration-authorization-storage.ts"],"names":[],"mappings":"AAAA,cAAc,sCAAsC,CAAC"}

package/dist/runtime/process/resource/integration-authorization-storage.js

@@ -0,0 +1,2 @@
+export * from "./integration-authorization/index.js";
+//# sourceMappingURL=integration-authorization-storage.js.map

package/dist/runtime/process/resource/integration-authorization-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-authorization-storage.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/integration-authorization-storage.ts"],"names":[],"mappings":"AAAA,cAAc,sCAAsC,CAAC"}

package/dist/runtime/process/resource/internal-spawn.d.ts

@@ -0,0 +1,27 @@
+import type { Effect, Scope } from "effect";
+import type { NodeRuntimeError } from "../../errors.js";
+import type { ManagedProcess, ProcessLaunchAuthorization, ProcessResourceLaunchRequest, ProcessResourceManagerService } from "./contract.js";
+export declare const processResourceManagerAuthorizedSpawn: unique symbol;
+export declare const processResourceManagerRevokeCodexAuthorization: unique symbol;
+export declare const processResourceManagerRevokePiRpcAuthorization: unique symbol;
+export type ProcessResourceManagerAuthorizedSpawn = (request: ProcessResourceLaunchRequest, authorization?: ProcessLaunchAuthorization) => Effect.Effect<ManagedProcess, NodeRuntimeError, Scope.Scope>;
+export type CodexAuthorizationCleanup = {
+    readonly matchedTrees: number;
+    readonly state: "clean" | "cleanup_unknown";
+};
+export type ProcessResourceManagerRevokeCodexAuthorization = (authorizationRevision: string) => Effect.Effect<CodexAuthorizationCleanup, NodeRuntimeError>;
+export type PiRpcAuthorizationCleanup = CodexAuthorizationCleanup;
+export type ProcessResourceManagerRevokePiRpcAuthorization = (authorizationRevision: string) => Effect.Effect<PiRpcAuthorizationCleanup, NodeRuntimeError>;
+export type ProcessResourceManagerWithAuthorizedSpawn = ProcessResourceManagerService & {
+    readonly [processResourceManagerAuthorizedSpawn]: ProcessResourceManagerAuthorizedSpawn;
+};
+export type ProcessResourceManagerWithCodexRevocation = ProcessResourceManagerService & {
+    readonly [processResourceManagerRevokeCodexAuthorization]: ProcessResourceManagerRevokeCodexAuthorization;
+};
+export type ProcessResourceManagerWithPiRpcRevocation = ProcessResourceManagerService & {
+    readonly [processResourceManagerRevokePiRpcAuthorization]: ProcessResourceManagerRevokePiRpcAuthorization;
+};
+export declare const hasAuthorizedSpawn: (manager: ProcessResourceManagerService) => manager is ProcessResourceManagerWithAuthorizedSpawn;
+export declare const hasCodexAuthorizationRevocation: (manager: ProcessResourceManagerService) => manager is ProcessResourceManagerWithCodexRevocation;
+export declare const hasPiRpcAuthorizationRevocation: (manager: ProcessResourceManagerService) => manager is ProcessResourceManagerWithPiRpcRevocation;
+//# sourceMappingURL=internal-spawn.d.ts.map

package/dist/runtime/process/resource/internal-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-spawn.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/internal-spawn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAE5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC9B,MAAM,eAAe,CAAC;AAEvB,eAAO,MAAM,qCAAqC,eAEjD,CAAC;AAEF,eAAO,MAAM,8CAA8C,eAE1D,CAAC;AAEF,eAAO,MAAM,8CAA8C,eAE1D,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG,CAClD,OAAO,EAAE,4BAA4B,EACrC,aAAa,CAAC,EAAE,0BAA0B,KACvC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAElE,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,8CAA8C,GAAG,CAC3D,qBAAqB,EAAE,MAAM,KAC1B,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAElE,MAAM,MAAM,8CAA8C,GAAG,CAC3D,qBAAqB,EAAE,MAAM,KAC1B,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;AAEhE,MAAM,MAAM,yCAAyC,GACnD,6BAA6B,GAAG;IAC9B,QAAQ,CAAC,CAAC,qCAAqC,CAAC,EAAE,qCAAqC,CAAC;CACzF,CAAC;AAEJ,MAAM,MAAM,yCAAyC,GACnD,6BAA6B,GAAG;IAC9B,QAAQ,CAAC,CAAC,8CAA8C,CAAC,EAAE,8CAA8C,CAAC;CAC3G,CAAC;AAEJ,MAAM,MAAM,yCAAyC,GACnD,6BAA6B,GAAG;IAC9B,QAAQ,CAAC,CAAC,8CAA8C,CAAC,EAAE,8CAA8C,CAAC;CAC3G,CAAC;AAEJ,eAAO,MAAM,kBAAkB,GAC7B,SAAS,6BAA6B,KACrC,OAAO,IAAI,yCACoC,CAAC;AAEnD,eAAO,MAAM,+BAA+B,GAC1C,SAAS,6BAA6B,KACrC,OAAO,IAAI,yCAC6C,CAAC;AAE5D,eAAO,MAAM,+BAA+B,GAC1C,SAAS,6BAA6B,KACrC,OAAO,IAAI,yCAC6C,CAAC"}

package/dist/runtime/process/resource/internal-spawn.js

@@ -0,0 +1,7 @@
+export const processResourceManagerAuthorizedSpawn = Symbol("@maiaos/node/runtime/process/resource/authorized-spawn");
+export const processResourceManagerRevokeCodexAuthorization = Symbol("@maiaos/node/runtime/process/resource/revoke-codex-authorization");
+export const processResourceManagerRevokePiRpcAuthorization = Symbol("@maiaos/node/runtime/process/resource/revoke-pi-rpc-authorization");
+export const hasAuthorizedSpawn = (manager) => processResourceManagerAuthorizedSpawn in manager;
+export const hasCodexAuthorizationRevocation = (manager) => processResourceManagerRevokeCodexAuthorization in manager;
+export const hasPiRpcAuthorizationRevocation = (manager) => processResourceManagerRevokePiRpcAuthorization in manager;
+//# sourceMappingURL=internal-spawn.js.map

package/dist/runtime/process/resource/internal-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-spawn.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/internal-spawn.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CACzD,wDAAwD,CACzD,CAAC;AAEF,MAAM,CAAC,MAAM,8CAA8C,GAAG,MAAM,CAClE,kEAAkE,CACnE,CAAC;AAEF,MAAM,CAAC,MAAM,8CAA8C,GAAG,MAAM,CAClE,mEAAmE,CACpE,CAAC;AAqCF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAAsC,EACgB,EAAE,CACxD,qCAAqC,IAAI,OAAO,CAAC;AAEnD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,OAAsC,EACgB,EAAE,CACxD,8CAA8C,IAAI,OAAO,CAAC;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,OAAsC,EACgB,EAAE,CACxD,8CAA8C,IAAI,OAAO,CAAC"}

package/dist/runtime/process/resource/launch-authority.d.ts

@@ -0,0 +1,5 @@
+import { Effect } from "effect";
+import { type NodeRuntimeError } from "../../errors.js";
+import type { RegisteredProcessResourceLaunchRequest } from "./contract.js";
+export declare const verifyProcessLaunchAuthority: (request: RegisteredProcessResourceLaunchRequest) => Effect.Effect<void, NodeRuntimeError, never>;
+//# sourceMappingURL=launch-authority.d.ts.map

package/dist/runtime/process/resource/launch-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-authority.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/launch-authority.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,eAAe,CAAC;AAiC5E,eAAO,MAAM,4BAA4B,mGAuBvC,CAAC"}

package/dist/runtime/process/resource/launch-authority.js

@@ -0,0 +1,37 @@
+import { lstat, realpath } from "node:fs/promises";
+import { Effect } from "effect";
+import { makeNodeRuntimeError } from "../../errors.js";
+const repositoryChangedError = () => makeNodeRuntimeError("repository_invalid", "The repository authority changed at the process launch boundary.");
+const verifyDirectory = Effect.fn("ProcessResourceManager.verifyDirectory")(function* (path, expected) {
+    const [resolved, metadata] = yield* Effect.tryPromise({
+        catch: repositoryChangedError,
+        try: () => Promise.all([realpath(path), lstat(path, { bigint: true })]),
+    });
+    const owned = typeof process.getuid !== "function" ||
+        metadata.uid === BigInt(process.getuid());
+    if (resolved !== path ||
+        !metadata.isDirectory() ||
+        metadata.isSymbolicLink() ||
+        !owned ||
+        metadata.dev !== BigInt(expected.device) ||
+        metadata.ino !== BigInt(expected.inode)) {
+        return yield* Effect.fail(repositoryChangedError());
+    }
+});
+export const verifyProcessLaunchAuthority = Effect.fn("ProcessResourceManager.verifyLaunchAuthority")(function* (request) {
+    if (request.owner.kind !== "interactive-terminal")
+        return;
+    const authority = request.repositoryAuthority;
+    if (request.workingDirectory !== authority?.rootPath) {
+        return yield* Effect.fail(makeNodeRuntimeError("repository_invalid", "The interactive Terminal repository authority is unavailable."));
+    }
+    yield* verifyDirectory(authority.rootPath, {
+        device: authority.rootDevice,
+        inode: authority.rootInode,
+    });
+    yield* verifyDirectory(authority.gitCommonDirectory, {
+        device: authority.gitCommonDevice,
+        inode: authority.gitCommonInode,
+    });
+});
+//# sourceMappingURL=launch-authority.js.map

package/dist/runtime/process/resource/launch-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-authority.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/launch-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAI9E,MAAM,sBAAsB,GAAG,GAAqB,EAAE,CACpD,oBAAoB,CAClB,oBAAoB,EACpB,kEAAkE,CACnE,CAAC;AAEJ,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,wCAAwC,CAAC,CACzE,QAAQ,CAAC,EACP,IAAY,EACZ,QAA6D;IAE7D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACpD,KAAK,EAAE,sBAAsB;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,MAAM,KAAK,GACT,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;QACpC,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,IACE,QAAQ,KAAK,IAAI;QACjB,CAAC,QAAQ,CAAC,WAAW,EAAE;QACvB,QAAQ,CAAC,cAAc,EAAE;QACzB,CAAC,KAAK;QACN,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxC,QAAQ,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EACvC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,EAAE,CACnD,8CAA8C,CAC/C,CAAC,QAAQ,CAAC,EACT,OAA+C;IAE/C,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,sBAAsB;QAAE,OAAO;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAC9C,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,QAAQ,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,oBAAoB,CAClB,oBAAoB,EACpB,+DAA+D,CAChE,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE;QACzC,MAAM,EAAE,SAAS,CAAC,UAAU;QAC5B,KAAK,EAAE,SAAS,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,kBAAkB,EAAE;QACnD,MAAM,EAAE,SAAS,CAAC,eAAe;QACjC,KAAK,EAAE,SAAS,CAAC,cAAc;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/runtime/process/resource/launch-gate.d.ts

@@ -0,0 +1,19 @@
+import type { ChildProcess } from "node:child_process";
+import type { Readable } from "node:stream";
+import { Effect } from "effect";
+import { type NodeRuntimeError } from "../../errors.js";
+import type { RegisteredProcessResourceLaunchRequest } from "./contract.js";
+import type { LaunchLeaderIdentity } from "./process-identity.js";
+export type GatedProcess = {
+    readonly acknowledgement: Readable;
+    readonly child: ChildProcess;
+};
+/**
+ * Numeric PID/PGID signalling cannot bind the launch-gate child to the
+ * identity later registered by Maia. Until an OS helper supplies that atomic
+ * ownership, this internal gate fails before calling child_process.spawn.
+ */
+export declare const spawnGatedProcess: (_request: RegisteredProcessResourceLaunchRequest) => Effect.Effect<GatedProcess, NodeRuntimeError, never>;
+/** Kept as an explicit fail-closed seam for the future identity-bound helper. */
+export declare const startRegisteredProcess: (_gated: GatedProcess, _expectedIdentity: LaunchLeaderIdentity) => Effect.Effect<void, NodeRuntimeError, never>;
+//# sourceMappingURL=launch-gate.d.ts.map

package/dist/runtime/process/resource/launch-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-gate.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/launch-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B,CAAC;AAQF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,4GAM7B,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,iHAOjC,CAAC"}

package/dist/runtime/process/resource/launch-gate.js

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import { makeNodeRuntimeError } from "../../errors.js";
+const launchUnavailable = () => makeNodeRuntimeError("transport_failed", "Identity-bound managed process spawning is unavailable.");
+/**
+ * Numeric PID/PGID signalling cannot bind the launch-gate child to the
+ * identity later registered by Maia. Until an OS helper supplies that atomic
+ * ownership, this internal gate fails before calling child_process.spawn.
+ */
+export const spawnGatedProcess = Effect.fn("ProcessLaunchGate.unavailable")(function* (_request) {
+    return yield* Effect.fail(launchUnavailable());
+});
+/** Kept as an explicit fail-closed seam for the future identity-bound helper. */
+export const startRegisteredProcess = Effect.fn("ProcessLaunchGate.releaseUnavailable")(function* (_gated, _expectedIdentity) {
+    return yield* Effect.fail(launchUnavailable());
+});
+//# sourceMappingURL=launch-gate.js.map

package/dist/runtime/process/resource/launch-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-gate.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/launch-gate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAU9E,MAAM,iBAAiB,GAAG,GAAqB,EAAE,CAC/C,oBAAoB,CAClB,kBAAkB,EAClB,yDAAyD,CAC1D,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CACzE,QAAQ,CAAC,EACP,QAAgD;IAEhD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACjD,CAAC,CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAC7C,sCAAsC,CACvC,CAAC,QAAQ,CAAC,EACT,MAAoB,EACpB,iBAAuC;IAEvC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC"}

package/dist/runtime/process/resource/linux-process-identity.d.ts

@@ -0,0 +1,13 @@
+export type LinuxProcessIdentity = {
+    readonly processGroupId: number;
+    readonly processId: number;
+    readonly startTimeTicks: bigint;
+};
+/** Parses the PID, owner process group, and kernel start tick from /proc/PID/stat. */
+export declare const parseLinuxProcessIdentity: (output: string) => LinuxProcessIdentity | undefined;
+export declare const isSameLinuxProcessIdentity: (left: LinuxProcessIdentity, right: LinuxProcessIdentity) => boolean;
+export declare const isStableOwnedLinuxProcess: (expected: {
+    readonly processGroupId: number;
+    readonly processId: number;
+}, before: LinuxProcessIdentity, after: LinuxProcessIdentity) => boolean;
+//# sourceMappingURL=linux-process-identity.d.ts.map

package/dist/runtime/process/resource/linux-process-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-process-identity.d.ts","sourceRoot":"","sources":["../../../../src/runtime/process/resource/linux-process-identity.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAcF,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,MAAM,KACb,oBAAoB,GAAG,SAmBzB,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACrC,MAAM,oBAAoB,EAC1B,OAAO,oBAAoB,KAC1B,OAG2C,CAAC;AAE/C,eAAO,MAAM,yBAAyB,GACpC,UAAU;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzE,QAAQ,oBAAoB,EAC5B,OAAO,oBAAoB,KAC1B,OAIwC,CAAC"}

package/dist/runtime/process/resource/linux-process-identity.js

@@ -0,0 +1,40 @@
+const parsePositiveInteger = (value) => {
+    if (!/^[0-9]+$/u.test(value))
+        return;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;
+};
+const parseStartTimeTicks = (value) => {
+    if (!/^[0-9]+$/u.test(value))
+        return;
+    const parsed = BigInt(value);
+    return parsed >= 0n ? parsed : undefined;
+};
+/** Parses the PID, owner process group, and kernel start tick from /proc/PID/stat. */
+export const parseLinuxProcessIdentity = (output) => {
+    const commandStart = output.indexOf("(");
+    const commandEnd = output.lastIndexOf(")");
+    if (commandStart < 1 || commandEnd <= commandStart)
+        return;
+    const processId = parsePositiveInteger(output.slice(0, commandStart).trim());
+    const fields = output
+        .slice(commandEnd + 1)
+        .trim()
+        .split(/\s+/u);
+    const processGroupId = parsePositiveInteger(fields[2] ?? "");
+    const startTimeTicks = parseStartTimeTicks(fields[19] ?? "");
+    if (processId === undefined ||
+        processGroupId === undefined ||
+        startTimeTicks === undefined) {
+        return;
+    }
+    return { processGroupId, processId, startTimeTicks };
+};
+export const isSameLinuxProcessIdentity = (left, right) => left.processId === right.processId &&
+    left.processGroupId === right.processGroupId &&
+    left.startTimeTicks === right.startTimeTicks;
+export const isStableOwnedLinuxProcess = (expected, before, after) => before.processId === expected.processId &&
+    before.processGroupId === expected.processGroupId &&
+    after.processGroupId === expected.processGroupId &&
+    isSameLinuxProcessIdentity(before, after);
+//# sourceMappingURL=linux-process-identity.js.map

package/dist/runtime/process/resource/linux-process-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux-process-identity.js","sourceRoot":"","sources":["../../../../src/runtime/process/resource/linux-process-identity.ts"],"names":[],"mappings":"AAMA,MAAM,oBAAoB,GAAG,CAAC,KAAa,EAAsB,EAAE;IACjE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAsB,EAAE;IAChE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3C,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACoB,EAAE;IACpC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,IAAI,YAAY;QAAE,OAAO;IAC3D,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM;SAClB,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IACE,SAAS,KAAK,SAAS;QACvB,cAAc,KAAK,SAAS;QAC5B,cAAc,KAAK,SAAS,EAC5B,CAAC;QACD,OAAO;IACT,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,IAA0B,EAC1B,KAA2B,EAClB,EAAE,CACX,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;IAClC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;IAC5C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC;AAE/C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAyE,EACzE,MAA4B,EAC5B,KAA2B,EAClB,EAAE,CACX,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;IACvC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;IACjD,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;IAChD,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC"}