@msn-control/liftoff 0.11.2 → 0.12.0

package/dist/adapters/state/azure-blob.d.ts

@@ -0,0 +1,43 @@
+import { type AzureBlobAccessProvider, type AzureBlobStateBinding, type AzureStateRequest, type AzureStateResponse, type AzureStateTokenProvider, type AzureStateTransport, type StateBackendAdapter, type StateBackendLease, type StateBackendMetadata, type StateExecutionContext } from '../../domain/repair/stateful.js';
+export type { AzureBlobAccessProvider, AzureStateRequest, AzureStateResponse, AzureStateTokenProvider, AzureStateTransport } from '../../domain/repair/stateful.js';
+export declare function azureStateUrl(binding: AzureBlobStateBinding, target: AzureStateRequest['target']): string;
+export declare class FetchAzureStateTransport implements AzureStateTransport {
+    private readonly options;
+    constructor(options: {
+        tokens: AzureStateTokenProvider;
+        fetch?: typeof globalThis.fetch;
+        timeoutMs?: number;
+        maxResponseBytes?: number;
+        now?: () => number;
+    });
+    toJSON(): {
+        transport: string;
+    };
+    request(request: AzureStateRequest): Promise<AzureStateResponse>;
+    private perform;
+}
+export declare class AzureBlobStateBackend implements StateBackendAdapter {
+    #private;
+    private readonly options;
+    readonly binding: AzureBlobStateBinding;
+    constructor(binding: AzureBlobStateBinding, options: {
+        transport: AzureStateTransport;
+        access: AzureBlobAccessProvider;
+        now?: () => number;
+        maxStateBytes?: number;
+    });
+    toJSON(): {
+        backendRef: string;
+        kind: 'azurerm';
+    };
+    private now;
+    assertAccess(context: StateExecutionContext, write: boolean, signal?: AbortSignal): Promise<void>;
+    private request;
+    metadata(context: StateExecutionContext, signal?: AbortSignal): Promise<StateBackendMetadata>;
+    private held;
+    readPrivate(expected: StateBackendMetadata, context: StateExecutionContext, lease?: StateBackendLease, signal?: AbortSignal): Promise<Uint8Array>;
+    acquire(expected: StateBackendMetadata, context: StateExecutionContext, operationId: string, signal?: AbortSignal): Promise<StateBackendLease>;
+    private check;
+    writePrivate(request: Parameters<StateBackendAdapter['writePrivate']>[0]): Promise<StateBackendMetadata>;
+    remove(request: Parameters<StateBackendAdapter['remove']>[0]): Promise<StateBackendMetadata>;
+}

package/dist/adapters/state/azure-blob.js

@@ -0,0 +1,335 @@
+import { randomUUID } from 'node:crypto';
+import { StateMigrationError } from '../../domain/repair/stateful.js';
+import { inspectStateBytes, stateAssert, stateBindingDigest, stateMetadataMatches, stateSnapshotMatches } from '../../domain/repair/stateful-invariants.js';
+import { boundedStateOperation } from '../../domain/repair/stateful-bounded.js';
+const responseHeaders = [
+    'etag', 'content-length', 'x-ms-version-id', 'x-ms-server-encrypted',
+    'x-ms-error-code', 'x-ms-lease-id', 'x-ms-lease-status', 'x-ms-lease-state',
+    'x-ms-meta-liftoff-operation'
+];
+const requestHeaders = new Set([
+    'if-match', 'if-none-match', 'x-ms-lease-id', 'x-ms-lease-action', 'x-ms-lease-duration',
+    'x-ms-proposed-lease-id', 'x-ms-blob-type', 'x-ms-meta-liftoff-operation', 'content-type'
+]);
+export function azureStateUrl(binding, target) {
+    stateBindingDigest(binding);
+    const base = `https://${binding.account}.blob.core.windows.net/${binding.container}`;
+    return target === 'container'
+        ? `${base}?restype=container&comp=metadata`
+        : `${base}/${binding.key.split('/').map(encodeURIComponent).join('/')}${target === 'lease' ? '?comp=lease' : ''}`;
+}
+export class FetchAzureStateTransport {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    toJSON() { return { transport: 'azure-blob-private-capture' }; }
+    async request(request) {
+        stateBindingDigest(request.binding);
+        stateAssert(request.target !== 'container' || request.method === 'HEAD', 'invalid-binding');
+        stateAssert(request.target !== 'lease' || request.method === 'PUT', 'invalid-binding');
+        const timeoutMs = this.options.timeoutMs ?? 15_000;
+        stateAssert(timeoutMs > 0 && timeoutMs <= 120_000, 'invalid-binding');
+        const signal = AbortSignal.any([AbortSignal.timeout(timeoutMs), ...(request.signal ? [request.signal] : [])]);
+        return boundedStateOperation(signal, () => this.perform(request, signal));
+    }
+    async perform(request, signal) {
+        try {
+            const token = await this.options.tokens.getToken({
+                tenantId: request.binding.tenantId, principalId: request.context.principalId,
+                scope: 'https://storage.azure.com/.default', signal
+            });
+            stateAssert(token.tenantId === request.binding.tenantId && token.principalId === request.context.principalId
+                && token.expiresAt > (this.options.now?.() ?? Date.now()) + 30_000 && typeof token.token === 'string'
+                && token.token.length > 0 && !/[\r\n]/.test(token.token), 'access-denied');
+            const headers = {};
+            for (const [name, value] of Object.entries(request.headers ?? {})) {
+                stateAssert(requestHeaders.has(name) && !/[\r\n]/.test(value), 'invalid-binding');
+                headers[name] = value;
+            }
+            headers.authorization = `Bearer ${token.token}`;
+            headers['x-ms-version'] = '2023-11-03';
+            headers['x-ms-date'] = new Date(this.options.now?.() ?? Date.now()).toUTCString();
+            headers['x-ms-client-request-id'] = request.operationId ?? randomUUID();
+            const response = await (this.options.fetch ?? globalThis.fetch)(azureStateUrl(request.binding, request.target), {
+                method: request.method, headers, redirect: 'error', signal,
+                ...(request.body ? { body: Buffer.from(request.body) } : {})
+            });
+            const safeHeaders = {};
+            for (const name of responseHeaders) {
+                const value = response.headers.get(name);
+                if (value !== null)
+                    safeHeaders[name] = value;
+            }
+            const maxBytes = this.options.maxResponseBytes ?? 32 * 1024 * 1024;
+            const length = Number(response.headers.get('content-length') ?? 0);
+            stateAssert(Number.isSafeInteger(length) && length >= 0 && (request.method === 'HEAD' || length <= maxBytes), 'storage-limit');
+            const parts = [];
+            let size = 0;
+            const reader = request.method === 'HEAD' ? undefined : response.body?.getReader();
+            if (reader) {
+                try {
+                    while (true) {
+                        const chunk = await reader.read();
+                        if (chunk.done)
+                            break;
+                        size += chunk.value.byteLength;
+                        stateAssert(size <= maxBytes, 'storage-limit');
+                        parts.push(chunk.value);
+                    }
+                }
+                finally {
+                    await reader.cancel().catch(() => undefined);
+                }
+            }
+            return { status: response.status, headers: safeHeaders, body: Buffer.concat(parts) };
+        }
+        catch (error) {
+            if (error instanceof StateMigrationError)
+                throw error;
+            if (signal.aborted)
+                throw new StateMigrationError(request.signal?.aborted ? 'cancelled' : 'timeout');
+            throw new StateMigrationError('access-denied');
+        }
+    }
+}
+function successful(response, allowed) {
+    if (allowed.includes(response.status))
+        return;
+    if (response.status === 409 || response.status === 412)
+        throw new StateMigrationError('stale-state');
+    if (response.status === 401 || response.status === 403)
+        throw new StateMigrationError('access-denied');
+    if (response.status === 408 || response.status === 504)
+        throw new StateMigrationError('timeout');
+    throw new StateMigrationError('incomplete-observation');
+}
+class AzureLease {
+    backendId;
+    send;
+    now;
+    absent;
+    #leaseId = null;
+    #lost = false;
+    #released = false;
+    #removed = false;
+    #expiresAt = 0;
+    #renewal = null;
+    #timer = null;
+    get kind() { return this.#leaseId ? 'blob-lease' : 'conditional-create'; }
+    get leaseId() { return this.#leaseId; }
+    constructor(backendId, send, now, absent) {
+        this.backendId = backendId;
+        this.send = send;
+        this.now = now;
+        this.absent = absent;
+    }
+    async lock(etag) {
+        stateAssert(!this.#leaseId && !this.#lost && !this.#released, 'lock-lost');
+        const id = randomUUID();
+        const response = await this.send({
+            'x-ms-lease-action': 'acquire', 'x-ms-lease-duration': '60', 'x-ms-proposed-lease-id': id, 'if-match': etag
+        });
+        successful(response, [201]);
+        stateAssert(response.headers['x-ms-lease-id'] === id, 'lock-lost');
+        this.#leaseId = id;
+        this.#expiresAt = this.now() + 55_000;
+        this.#timer = setInterval(() => { void this.renew().catch(() => undefined); }, 20_000);
+        this.#timer.unref?.();
+    }
+    async renew() {
+        if (this.#renewal)
+            return this.#renewal;
+        if (this.#released || this.#removed || this.#lost || !this.#leaseId)
+            return;
+        this.#renewal = (async () => {
+            try {
+                stateAssert(this.now() < this.#expiresAt, 'lock-lost');
+                const response = await this.send({ 'x-ms-lease-action': 'renew', 'x-ms-lease-id': this.#leaseId });
+                successful(response, [200]);
+                this.#expiresAt = this.now() + 55_000;
+            }
+            catch {
+                this.#lost = true;
+                throw new StateMigrationError('lock-lost');
+            }
+        })();
+        try {
+            await this.#renewal;
+        }
+        finally {
+            this.#renewal = null;
+        }
+    }
+    async assertHeld() {
+        stateAssert(!this.#released && !this.#lost, 'lock-lost');
+        if (this.#removed)
+            return;
+        if (!this.#leaseId) {
+            stateAssert(await this.absent(), 'stale-state');
+            return;
+        }
+        await this.renew();
+        stateAssert(!this.#lost && this.now() < this.#expiresAt, 'lock-lost');
+    }
+    markRemoved() {
+        this.#removed = true;
+        if (this.#timer)
+            clearInterval(this.#timer);
+    }
+    async release() {
+        if (this.#timer)
+            clearInterval(this.#timer);
+        if (this.#released)
+            return;
+        await this.#renewal?.catch(() => undefined);
+        this.#released = true;
+        if (!this.#leaseId || this.#removed)
+            return;
+        const response = await this.send({ 'x-ms-lease-action': 'release', 'x-ms-lease-id': this.#leaseId });
+        if (![200, 404].includes(response.status))
+            throw new StateMigrationError('lock-lost');
+    }
+}
+export class AzureBlobStateBackend {
+    options;
+    binding;
+    #leases = new WeakSet();
+    constructor(binding, options) {
+        this.options = options;
+        stateBindingDigest(binding);
+        this.binding = Object.freeze(structuredClone(binding));
+    }
+    toJSON() { return { backendRef: stateBindingDigest(this.binding), kind: 'azurerm' }; }
+    now() { return this.options.now?.() ?? Date.now(); }
+    async assertAccess(context, write, signal) {
+        const access = await this.options.access.observe(this.binding, context, write, signal);
+        stateAssert(access.bindingDigest === stateBindingDigest(this.binding) && access.ownerId === this.binding.ownerId
+            && access.hostId === context.hostId && access.principalId === context.principalId, 'ownership-mismatch');
+        stateAssert(access.network === this.binding.network && access.reachable && access.canRead
+            && (!write || access.canWrite) && access.expiresAt > this.now(), 'access-denied');
+        stateAssert(access.serverSideEncryption && access.versioning && access.softDelete, 'unsupported-encryption');
+    }
+    request(context, fields) {
+        return this.options.transport.request({ ...fields, binding: this.binding, context });
+    }
+    async metadata(context, signal) {
+        await this.assertAccess(context, false, signal);
+        const response = await this.request(context, { method: 'HEAD', target: 'blob', signal });
+        if (response.status === 404) {
+            stateAssert(response.headers['x-ms-error-code'] === 'BlobNotFound', 'incomplete-observation');
+            successful(await this.request(context, { method: 'HEAD', target: 'container', signal }), [200]);
+            return {
+                backendId: this.binding.id, bindingDigest: stateBindingDigest(this.binding),
+                exists: false, version: null, etag: null, size: 0, observedAt: this.now()
+            };
+        }
+        successful(response, [200]);
+        const etag = response.headers.etag;
+        const version = response.headers['x-ms-version-id'] ?? etag;
+        const size = Number(response.headers['content-length']);
+        stateAssert(typeof etag === 'string' && /^"0x[a-fA-F0-9]+"$/.test(etag)
+            && typeof version === 'string' && version.length <= 128 && !/[\x00-\x1f]/.test(version), 'incomplete-observation');
+        stateAssert(response.headers['x-ms-server-encrypted'] === 'true', 'unsupported-encryption');
+        stateAssert(Number.isSafeInteger(size) && size >= 0, 'incomplete-observation');
+        const operationId = response.headers['x-ms-meta-liftoff-operation'];
+        return {
+            backendId: this.binding.id, bindingDigest: stateBindingDigest(this.binding),
+            exists: true, version, etag, size, observedAt: this.now(),
+            ...(operationId && /^[a-f0-9-]{36}$/.test(operationId) ? { operationId } : {})
+        };
+    }
+    async held(lease) {
+        stateAssert(lease instanceof AzureLease && this.#leases.has(lease) && lease.backendId === this.binding.id, 'lock-lost');
+        await lease.assertHeld();
+        return lease;
+    }
+    async readPrivate(expected, context, lease, signal) {
+        await this.assertAccess(context, false, signal);
+        const held = lease ? await this.held(lease) : null;
+        stateAssert(expected.backendId === this.binding.id && expected.bindingDigest === stateBindingDigest(this.binding)
+            && expected.exists && expected.etag, 'stale-state');
+        stateAssert(expected.size <= (this.options.maxStateBytes ?? 32 * 1024 * 1024), 'storage-limit');
+        const response = await this.request(context, {
+            method: 'GET', target: 'blob', headers: {
+                'if-match': expected.etag, ...(held?.leaseId ? { 'x-ms-lease-id': held.leaseId } : {})
+            }, signal
+        });
+        successful(response, [200]);
+        stateAssert(response.headers.etag === expected.etag && response.body.byteLength === expected.size, 'stale-state');
+        stateAssert(stateMetadataMatches(expected, await this.metadata(context, signal)), 'stale-state');
+        if (held)
+            await held.assertHeld();
+        return response.body;
+    }
+    async acquire(expected, context, operationId, signal) {
+        await this.assertAccess(context, true, signal);
+        stateAssert(stateMetadataMatches(expected, await this.metadata(context, signal)), 'stale-state');
+        const lease = new AzureLease(this.binding.id, (headers) => this.request(context, {
+            method: 'PUT', target: 'lease', headers, operationId,
+            ...(headers['x-ms-lease-action'] === 'acquire' ? { signal } : {})
+        }), () => this.now(), async () => !(await this.metadata(context, signal)).exists);
+        this.#leases.add(lease);
+        if (expected.exists)
+            await lease.lock(expected.etag);
+        else
+            await lease.assertHeld();
+        return lease;
+    }
+    async check(expected, context, lease, signal) {
+        const metadata = await this.metadata(context, signal);
+        const bytes = metadata.exists ? await this.readPrivate(metadata, context, lease, signal) : null;
+        try {
+            stateAssert(stateSnapshotMatches(expected, inspectStateBytes(metadata, bytes).snapshot), 'stale-state');
+        }
+        finally {
+            bytes?.fill(0);
+        }
+        await lease.assertHeld();
+    }
+    async writePrivate(request) {
+        await this.assertAccess(request.context, true, request.signal);
+        const lease = await this.held(request.lease);
+        await this.check(request.expected, request.context, lease, request.signal);
+        const candidate = inspectStateBytes({ ...request.expected, exists: true, size: request.bytes.byteLength }, request.bytes).snapshot;
+        if (request.expected.exists) {
+            stateAssert(candidate.lineage === request.expected.lineage && candidate.serial >= request.expected.serial, 'stale-state');
+            stateAssert(lease.leaseId, 'lock-lost');
+        }
+        const response = await this.request(request.context, {
+            method: 'PUT', target: 'blob', body: request.bytes, operationId: request.operationId, signal: request.signal,
+            headers: {
+                'x-ms-blob-type': 'BlockBlob', 'content-type': 'application/json',
+                'x-ms-meta-liftoff-operation': request.operationId,
+                ...(request.expected.exists
+                    ? { 'if-match': request.expected.etag, 'x-ms-lease-id': lease.leaseId }
+                    : { 'if-none-match': '*' })
+            }
+        });
+        successful(response, [201]);
+        const current = await this.metadata(request.context, request.signal);
+        stateAssert(current.etag === response.headers.etag && current.operationId === request.operationId, 'stale-state');
+        // An absent blob cannot be leased. Its first publication is an atomic create,
+        // followed by acquisition against that exact ETag, before source retirement.
+        if (!lease.leaseId)
+            await lease.lock(current.etag);
+        await lease.assertHeld();
+        return current;
+    }
+    async remove(request) {
+        await this.assertAccess(request.context, true, request.signal);
+        const lease = await this.held(request.lease);
+        await this.check(request.expected, request.context, lease, request.signal);
+        stateAssert(request.expected.exists && request.expected.etag && lease.leaseId, 'stale-state');
+        const response = await this.request(request.context, {
+            method: 'DELETE', target: 'blob', operationId: request.operationId, signal: request.signal,
+            headers: { 'if-match': request.expected.etag, 'x-ms-lease-id': lease.leaseId }
+        });
+        successful(response, [202]);
+        lease.markRemoved();
+        const current = await this.metadata(request.context, request.signal);
+        stateAssert(!current.exists, 'verification-incomplete');
+        return current;
+    }
+}
+//# sourceMappingURL=azure-blob.js.map

package/dist/adapters/state/azure-blob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-blob.js","sourceRoot":"","sources":["../../../src/adapters/state/azure-blob.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAYpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAC/F,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAMhF,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,uBAAuB;IACpE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB;IAC3E,6BAA6B;CACrB,CAAC;AACX,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,EAAE,qBAAqB;IACxF,wBAAwB,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,cAAc;CAC1F,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,OAA8B,EAAE,MAAmC;IAC/F,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,WAAW,OAAO,CAAC,OAAO,0BAA0B,OAAO,CAAC,SAAS,EAAE,CAAC;IACrF,OAAO,MAAM,KAAK,WAAW;QAC3B,CAAC,CAAC,GAAG,IAAI,kCAAkC;QAC3C,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,OAAO,wBAAwB;IACN,OAAO;IAApC,YAA6B,OAM5B;uBAN4B,OAAO;IAMhC,CAAC;IAEL,MAAM,KAA4B,OAAO,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;IAEvF,KAAK,CAAC,OAAO,CAAC,OAA0B;QACtC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAC5F,WAAW,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QACnD,WAAW,CAAC,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9G,OAAO,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,MAAmB;QACnE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC/C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBAC5E,KAAK,EAAE,oCAAoC,EAAE,MAAM;aACpD,CAAC,CAAC;YACH,WAAW,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,WAAW;mBACvG,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;mBAClG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,CAAC;YAC7E,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC;YAChD,OAAO,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;YACvC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAClF,OAAO,CAAC,wBAAwB,CAAC,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC9G,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;gBAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC,CAAC;YACH,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,KAAK,KAAK,IAAI;oBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAChD,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YACnE,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,IAAI,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;YAC/H,MAAM,KAAK,GAAiB,EAAE,CAAC;YAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YAClF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,OAAO,IAAI,EAAE,CAAC;wBACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBAClC,IAAI,KAAK,CAAC,IAAI;4BAAE,MAAM;wBACtB,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC/B,WAAW,CAAC,IAAI,IAAI,QAAQ,EAAE,eAAe,CAAC,CAAC;wBAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;wBAAS,CAAC;oBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;YAC7D,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrG,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,QAA4B,EAAE,OAA0B;IAC1E,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACrG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACvG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU;IAYH,SAAS;IACD,IAAI;IACJ,GAAG;IACH,MAAM;IAdzB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,KAAK,GAAG,KAAK,CAAC;IACd,SAAS,GAAG,KAAK,CAAC;IAClB,QAAQ,GAAG,KAAK,CAAC;IACjB,UAAU,GAAG,CAAC,CAAC;IACf,QAAQ,GAAyB,IAAI,CAAC;IACtC,MAAM,GAA0C,IAAI,CAAC;IACrD,IAAI,IAAI,KAA0C,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC/G,IAAI,OAAO,KAAoB,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEtD,YACW,SAAiB,EACT,IAAsE,EACtE,GAAiB,EACjB,MAA8B;yBAHtC,SAAS;oBACD,IAAI;mBACJ,GAAG;sBACH,MAAM;IACtB,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;YAC/B,mBAAmB,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI;SAC5G,CAAC,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,WAAW,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC5E,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,QAAS,EAAE,CAAC,CAAC;gBACpG,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;gBAClB,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,QAAQ,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,WAAW,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,WAAW;QACT,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM;YAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACxF,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IAG6B,OAAO;IAF3D,OAAO,CAAwB;IACxC,OAAO,GAAG,IAAI,OAAO,EAAc,CAAC;IACpC,YAAY,OAA8B,EAAmB,OAK5D;uBAL4D,OAAO;QAMlE,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAA8C,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACvH,GAAG,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEpE,KAAK,CAAC,YAAY,CAAC,OAA8B,EAAE,KAAc,EAAE,MAAoB;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACvF,WAAW,CAAC,MAAM,CAAC,aAAa,KAAK,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO;eAC3G,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3G,WAAW,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO;eACpF,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;QACpF,WAAW,CAAC,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAC/G,CAAC;IAEO,OAAO,CAAC,OAA8B,EAAE,MAAsD;QACpG,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA8B,EAAE,MAAoB;QACjE,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,cAAc,EAAE,wBAAwB,CAAC,CAAC;YAC9F,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAChG,OAAO;gBACL,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC3E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACxD,WAAW,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;eAClE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACrH,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC5F,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpE,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC3E,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACzD,GAAG,CAAC,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAwB;QACzC,WAAW,CAAC,KAAK,YAAY,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACxH,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAA8B,EAAE,OAA8B,EAAE,KAAyB,EAAE,MAAoB;QAC/H,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,WAAW,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,aAAa,KAAK,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;eAC5G,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACtD,WAAW,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;QAChG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAC3C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;gBACtC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvF,EAAE,MAAM;SACV,CAAC,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAClH,WAAW,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACjG,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAA8B,EAAE,OAA8B,EAAE,WAAmB,EAAE,MAAoB;QACrH,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,WAAW,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,IAAI,UAAU,CAC1B,IAAI,CAAC,OAAO,CAAC,EAAE,EACf,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YACjC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW;YACpD,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,EACF,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAChB,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAC3D,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC;;YACjD,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,QAAuB,EAAE,OAA8B,EAAE,KAAiB,EAAE,MAAoB;QAClH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,IAAI,CAAC;YAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;gBACxG,CAAC;YAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3B,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA2D;QAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;QACnI,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5B,WAAW,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC,MAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAO,EAAE,aAAa,CAAC,CAAC;YAC5H,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE;YACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;YAC5G,OAAO,EAAE;gBACP,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB;gBACjE,6BAA6B,EAAE,OAAO,CAAC,WAAW;gBAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM;oBACzB,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAK,EAAE,eAAe,EAAE,KAAK,CAAC,OAAQ,EAAE;oBACzE,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;aAC9B;SACF,CAAC,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAClH,8EAA8E;QAC9E,6EAA6E;QAC7E,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAqD;QAChE,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE;YACnD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;YAC1F,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE;SAC/E,CAAC,CAAC;QACH,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,KAAK,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACxD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/adapters/state/darwin-capabilities.d.ts

@@ -0,0 +1,33 @@
+import { type DarwinStateKeychainReference, type DarwinStateVolumeObservation, type DarwinStateStorageProfile, type DarwinStateStorageProfileOptions, type DarwinStateSystemBridge, type ProtectedVolumeAttestor, type StateEncryptionKeyProvider, type StateExecutionContext, type StateRegisteredExecutable } from '../../domain/repair/stateful.js';
+export type { DarwinStateSystemBridge } from '../../domain/repair/stateful.js';
+export declare class PythonDarwinStateSystemBridge implements DarwinStateSystemBridge {
+    private readonly python;
+    private readonly workingDirectory;
+    constructor(python: StateRegisteredExecutable, workingDirectory: string);
+    request(operation: 'volume' | 'keychain-metadata' | 'keychain-secret', input: object, signal?: AbortSignal): Promise<Record<string, unknown>>;
+}
+export declare function observeDarwinStateVolume(bridge: DarwinStateSystemBridge, directory: string, signal?: AbortSignal): Promise<DarwinStateVolumeObservation>;
+export declare class DarwinFileVaultVolumeAttestor implements ProtectedVolumeAttestor {
+    #private;
+    private readonly options;
+    constructor(options: {
+        bridge: DarwinStateSystemBridge;
+        root: string;
+        volumeId: string;
+        now?: () => number;
+    });
+    verify(directory: string, context: StateExecutionContext): ReturnType<ProtectedVolumeAttestor['verify']>;
+}
+export declare function darwinStateKeyReferenceId(reference: DarwinStateKeychainReference): string;
+export declare class DarwinKeychainStateKeyProvider implements StateEncryptionKeyProvider {
+    private readonly reference;
+    private readonly bridge;
+    readonly keyRef: string;
+    constructor(reference: DarwinStateKeychainReference, bridge: DarwinStateSystemBridge);
+    describe(keyRef: string, context: StateExecutionContext): ReturnType<StateEncryptionKeyProvider['describe']>;
+    withKey<T>(keyRef: string, action: (key: Uint8Array) => Promise<T>): Promise<T>;
+    toJSON(): {
+        keyRef: string;
+    };
+}
+export declare function createDarwinStateStorageProfile(options: DarwinStateStorageProfileOptions): Promise<DarwinStateStorageProfile>;

package/dist/adapters/state/darwin-capabilities.js

@@ -0,0 +1,146 @@
+import { randomUUID } from 'node:crypto';
+import { lstat, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { StateMigrationError } from '../../domain/repair/stateful.js';
+import { stateAssert, stateObjectDigest } from '../../domain/repair/stateful-invariants.js';
+import { darwinStateSystemProgram } from './darwin-system-program.js';
+import { nativeStateHostId, runPrivateStateProcess } from './native-system.js';
+import { DarwinPosixStateLockProvider } from './posix-native-lock.js';
+import { EncryptedStateWorkspace, FilesystemProtectedArtifactStorage } from './protected-workspace.js';
+export class PythonDarwinStateSystemBridge {
+    python;
+    workingDirectory;
+    constructor(python, workingDirectory) {
+        this.python = python;
+        this.workingDirectory = workingDirectory;
+    }
+    async request(operation, input, signal) {
+        stateAssert(process.platform === 'darwin', 'unsupported-native-platform');
+        const result = await runPrivateStateProcess({
+            executable: this.python, args: ['-I', '-S', '-B', '-c', darwinStateSystemProgram],
+            cwd: this.workingDirectory, stdin: Buffer.from(JSON.stringify({ ...input, operation })),
+            timeoutMs: 40_000, maximumBytes: 32_768, signal
+        });
+        try {
+            stateAssert(result.exitCode === 0, operation === 'volume' ? 'protected-workspace-required' : 'key-unavailable');
+            const reply = JSON.parse(Buffer.from(result.stdout).toString('utf8'));
+            stateAssert(reply.ok === true, operation === 'volume' ? 'protected-workspace-required' : 'key-unavailable');
+            return reply;
+        }
+        catch (error) {
+            if (error instanceof StateMigrationError)
+                throw error;
+            throw new StateMigrationError(operation === 'volume' ? 'protected-workspace-required' : 'key-unavailable');
+        }
+        finally {
+            result.stdout.fill(0);
+            result.stderr.fill(0);
+        }
+    }
+}
+export async function observeDarwinStateVolume(bridge, directory, signal) {
+    stateAssert(path.isAbsolute(directory) && await realpath(directory) === directory, 'unsafe-path');
+    const observed = await bridge.request('volume', { directory }, signal);
+    stateAssert(observed.canonicalDirectory === directory && typeof observed.volumeId === 'string'
+        && /^[a-fA-F0-9-]{36}$/.test(observed.volumeId) && typeof observed.deviceNode === 'string'
+        && /^\/dev\/disk[0-9]+(?:s[0-9]+)*$/.test(observed.deviceNode), 'protected-workspace-required');
+    return {
+        canonicalDirectory: directory, deviceNode: observed.deviceNode, volumeId: observed.volumeId,
+        filesystem: typeof observed.filesystem === 'string' ? observed.filesystem : '',
+        fileVault: observed.fileVault === true, encrypted: observed.encrypted === true, locked: observed.locked !== false,
+        ownerUid: Number(observed.ownerUid), mode: Number(observed.mode), aclEntries: Number(observed.aclEntries),
+        hostId: nativeStateHostId()
+    };
+}
+export class DarwinFileVaultVolumeAttestor {
+    options;
+    #cache = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async verify(directory, context) {
+        stateAssert(process.platform === 'darwin' && context.hostId === nativeStateHostId(), 'unsupported-native-platform');
+        const relative = path.relative(this.options.root, directory);
+        stateAssert(relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative)), 'unsafe-path');
+        const current = await lstat(directory);
+        stateAssert(current.isDirectory() && !current.isSymbolicLink() && current.uid === process.getuid?.()
+            && (current.mode & 0o077) === 0 && await realpath(directory) === directory, 'unsafe-path');
+        const now = this.options.now?.() ?? Date.now();
+        const directoryStamp = stateObjectDigest({ dev: current.dev, ino: current.ino, mode: current.mode, ctime: current.ctimeMs });
+        let cached = this.#cache.get(directory);
+        if (!cached || cached.expiresAt <= now || cached.directoryStamp !== directoryStamp) {
+            cached = { observation: await observeDarwinStateVolume(this.options.bridge, directory), expiresAt: now + 10_000, directoryStamp };
+            this.#cache.set(directory, cached);
+        }
+        const observed = cached.observation;
+        stateAssert(observed.volumeId === this.options.volumeId && observed.filesystem === 'apfs'
+            && observed.fileVault && observed.encrypted && !observed.locked
+            && observed.ownerUid === process.getuid?.() && (observed.mode & 0o077) === 0 && observed.aclEntries === 0, 'protected-workspace-required');
+        return {
+            canonicalDirectory: directory, hostId: nativeStateHostId(), encryptedVolume: true, privateAccess: true,
+            storageClass: 'protected-state-workspace', expiresAt: cached.expiresAt
+        };
+    }
+}
+export function darwinStateKeyReferenceId(reference) {
+    return `keychain:${stateObjectDigest(reference)}`;
+}
+export class DarwinKeychainStateKeyProvider {
+    reference;
+    bridge;
+    keyRef;
+    constructor(reference, bridge) {
+        this.reference = reference;
+        this.bridge = bridge;
+        stateAssert(path.isAbsolute(reference.keychainPath)
+            && /^org\.liftoff\.state\.[a-zA-Z0-9_.:-]{1,160}$/.test(reference.service)
+            && /^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,159}$/.test(reference.account), 'key-unavailable');
+        this.reference = Object.freeze(structuredClone(reference));
+        this.keyRef = darwinStateKeyReferenceId(this.reference);
+    }
+    async describe(keyRef, context) {
+        stateAssert(keyRef === this.keyRef && context.projectId === this.reference.account && context.hostId === nativeStateHostId(), 'key-unavailable');
+        const observed = await this.bridge.request('keychain-metadata', { reference: this.reference });
+        stateAssert(observed.present === true && observed.uid === process.getuid?.(), 'key-unavailable');
+        return { keyRef, ownerId: this.reference.account, hostId: nativeStateHostId(), storage: 'external-key-provider', algorithm: 'aes-256-gcm' };
+    }
+    async withKey(keyRef, action) {
+        stateAssert(keyRef === this.keyRef, 'key-unavailable');
+        const observed = await this.bridge.request('keychain-secret', { reference: this.reference });
+        stateAssert(observed.uid === process.getuid?.() && typeof observed.value === 'string', 'key-unavailable');
+        const stored = Buffer.from(observed.value, 'base64');
+        delete observed.value;
+        try {
+            const encoded = stored.toString('ascii').trim();
+            stateAssert(/^[A-Za-z0-9+/]{43}=$/.test(encoded), 'key-unavailable');
+            const key = Buffer.from(encoded, 'base64');
+            try {
+                stateAssert(key.length === 32, 'key-unavailable');
+                return await action(key);
+            }
+            finally {
+                key.fill(0);
+            }
+        }
+        finally {
+            stored.fill(0);
+        }
+    }
+    toJSON() { return { keyRef: this.keyRef }; }
+}
+export async function createDarwinStateStorageProfile(options) {
+    stateAssert(options.tools.hostId === nativeStateHostId(), 'unsupported-native-platform');
+    const bridge = new PythonDarwinStateSystemBridge(options.tools.python, options.workspaceRoot);
+    const observed = await observeDarwinStateVolume(bridge, options.workspaceRoot);
+    stateAssert(observed.filesystem === 'apfs' && observed.fileVault && observed.encrypted && !observed.locked
+        && observed.ownerUid === process.getuid?.() && (observed.mode & 0o077) === 0 && observed.aclEntries === 0, 'protected-workspace-required');
+    stateAssert(options.keyReference.account === options.projectId, 'ownership-mismatch');
+    const volume = new DarwinFileVaultVolumeAttestor({ bridge, root: options.workspaceRoot, volumeId: observed.volumeId });
+    const keys = new DarwinKeychainStateKeyProvider(options.keyReference, bridge);
+    const storage = new FilesystemProtectedArtifactStorage(options.workspaceRoot, volume);
+    const workspace = new EncryptedStateWorkspace({
+        workspaceId: options.workspaceId ?? randomUUID(), keyRef: keys.keyRef, ownerId: options.projectId, storage, keys
+    });
+    return { workspace, volume, keys, keyRef: keys.keyRef, locks: new DarwinPosixStateLockProvider({ python: options.tools.python }), hostId: nativeStateHostId() };
+}
+//# sourceMappingURL=darwin-capabilities.js.map

package/dist/adapters/state/darwin-capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin-capabilities.js","sourceRoot":"","sources":["../../../src/adapters/state/darwin-capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAKpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAIvG,MAAM,OAAO,6BAA6B;IACX,MAAM;IAA8C,gBAAgB;IAAjG,YAA6B,MAAiC,EAAmB,gBAAwB;sBAA5E,MAAM;gCAA8C,gBAAgB;IAAW,CAAC;IAC7G,KAAK,CAAC,OAAO,CAAC,SAA6D,EAAE,KAAa,EAAE,MAAoB;QAC9G,WAAW,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,CAAC;YACjF,GAAG,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACvF,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM;SAChD,CAAC,CAAC;QACH,IAAI,CAAC;YACH,WAAW,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAChH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;YACjG,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC5G,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC7G,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA+B,EAAE,SAAiB,EAAE,MAAoB;IAExE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,aAAa,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;IACvE,WAAW,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;WACzF,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;WACvF,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAClG,OAAO;QACL,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3F,UAAU,EAAE,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QAC9E,SAAS,EAAE,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,KAAK;QACjH,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzG,MAAM,EAAE,iBAAiB,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,6BAA6B;IAEX,OAAO;IADpC,MAAM,GAAG,IAAI,GAAG,EAAoG,CAAC;IACrH,YAA6B,OAK5B;uBAL4B,OAAO;IAKhC,CAAC;IACL,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,OAA8B;QAC5D,WAAW,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7D,WAAW,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;eAC/F,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,aAAa,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,cAAc,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7H,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YACnF,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC;YAClI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,WAAW,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM;eACpF,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM;eAC5D,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC7I,OAAO;YACL,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI;YACtG,YAAY,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;SACvE,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,SAAuC;IAC/E,OAAO,YAAY,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,8BAA8B;IAEZ,SAAS;IAAiD,MAAM;IADpF,MAAM,CAAS;IACxB,YAA6B,SAAuC,EAAmB,MAA+B;yBAAzF,SAAS;sBAAiD,MAAM;QAC3F,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC;eAC9C,+CAA+C,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;eACvE,qCAAqC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,OAA8B;QAC3D,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,WAAW,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACjG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAC9I,CAAC;IACD,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,MAAuC;QACtE,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7F,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAClD,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;oBAAS,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAyB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CACjE;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAAyC;IAC7F,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,iBAAiB,EAAE,EAAE,6BAA6B,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,WAAW,CAAC,QAAQ,CAAC,UAAU,KAAK,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM;WACrG,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC7I,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvH,MAAM,IAAI,GAAG,IAAI,8BAA8B,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,kCAAkC,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI;KACjH,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;AAClK,CAAC"}

package/dist/adapters/state/darwin-native-host.d.ts

@@ -0,0 +1,32 @@
+import { type DarwinAzureReaderReference, type DarwinStateSystemBridge, type NativeStateHost, type ProtectedVolumeAttestor, type StateExecutionContext } from '../../domain/repair/stateful.js';
+export declare function assertEnvironmentOnlyProviders(directory: string): Promise<void>;
+export declare class DarwinKeychainAzureReader {
+    private readonly options;
+    readonly identityDigest: string;
+    constructor(options: {
+        reference: DarwinAzureReaderReference;
+        bridge: DarwinStateSystemBridge;
+        fetch?: typeof globalThis.fetch;
+    });
+    private json;
+    resolve(context: StateExecutionContext, resourceIds: readonly string[], signal?: AbortSignal): Promise<Readonly<Record<string, string>>>;
+}
+/**
+ * Observes an encrypted, private staging directory and a genuinely read-only
+ * Azure identity. Isolation here is staging/HOME/config isolation, NOT an OS
+ * sandbox; only the separately inspected fixed provider/module contract may run.
+ */
+export declare class DarwinObservedStateHost implements NativeStateHost {
+    #private;
+    private readonly options;
+    constructor(options: {
+        root: string;
+        context: StateExecutionContext;
+        volume: ProtectedVolumeAttestor;
+        reader: DarwinKeychainAzureReader;
+    });
+    verify(directory: string): ReturnType<NativeStateHost['verify']>;
+    privateEnvironment(directory: string): Promise<Readonly<Record<string, string>>>;
+    terminateProcessTree(pid: number): Promise<void>;
+    quiesce(): Promise<void>;
+}