@rs-native-kit/version-check 0.1.2

package/lib/module/data/config/ConfigDocumentValidator.js

@@ -0,0 +1,185 @@
+"use strict";
+
+import { parseVersion } from "../../domain/engines/semver/SemVerEngine.js";
+/** Doc 03 §2.2 — serialized document size cap, enforced before parsing even begins. */
+export const CONFIG_ENVELOPE_MAX_BYTES = 64 * 1024;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
+const HTTPS_URL_PATTERN = /^https:\/\//;
+const APP_STORE_ID_PATTERN = /^[0-9]{6,12}$/;
+const ANDROID_PACKAGE_PATTERN = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$/;
+const AMAZON_ASIN_PATTERN = /^[A-Z0-9]{10}$/;
+const HUAWEI_APP_ID_PATTERN = /^[0-9]{6,12}$/;
+const SCHEMA_VERSION_PATTERN = /^\d+\.\d+$/;
+function isPlainObject(v) {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Hand-rolled, zero-dependency structural validator (Prompt 1 §9.3 — no ajv) that walks
+ * a SignedConfigEnvelope against the JSON Schema in doc 03 §6: required-field presence,
+ * type checks, enum membership, and additionalProperties:false at every level (unknown
+ * fields are rejected, not silently ignored — §2.1's downgrade-attack rationale).
+ */
+export class ConfigDocumentValidator {
+  validateSchema(doc) {
+    const errors = [];
+    if (typeof doc === 'string' && doc.length > CONFIG_ENVELOPE_MAX_BYTES) {
+      // Cheap byte-length check that short-circuits pathological payloads (§2.2, VM-1007
+      // is raised by the caller — this method only reports the schema-shape verdict).
+      errors.push(`Envelope exceeds ${CONFIG_ENVELOPE_MAX_BYTES} bytes before parsing`);
+      return {
+        valid: false,
+        errors
+      };
+    }
+    let envelope = doc;
+    if (typeof doc === 'string') {
+      try {
+        envelope = JSON.parse(doc);
+      } catch (error) {
+        return {
+          valid: false,
+          errors: [`Envelope is not valid JSON: ${String(error)}`]
+        };
+      }
+    }
+    if (!isPlainObject(envelope)) {
+      return {
+        valid: false,
+        errors: ['Envelope must be a JSON object']
+      };
+    }
+    this.checkAdditionalProperties(envelope, ['schemaVersion', 'payload', 'signature'], 'envelope', errors);
+    this.requireField(envelope, 'schemaVersion', 'string', errors, 'envelope');
+    this.requireField(envelope, 'payload', 'object', errors, 'envelope');
+    this.requireField(envelope, 'signature', 'object', errors, 'envelope');
+    if (typeof envelope.schemaVersion === 'string' && !SCHEMA_VERSION_PATTERN.test(envelope.schemaVersion)) {
+      errors.push('envelope.schemaVersion must match ^\\d+\\.\\d+$');
+    }
+    if (isPlainObject(envelope.signature)) {
+      const sig = envelope.signature;
+      this.checkAdditionalProperties(sig, ['algorithm', 'keyId', 'value', 'signedAt'], 'signature', errors);
+      this.requireField(sig, 'algorithm', 'string', errors, 'signature');
+      this.requireField(sig, 'keyId', 'string', errors, 'signature');
+      this.requireField(sig, 'value', 'string', errors, 'signature');
+      this.requireField(sig, 'signedAt', 'string', errors, 'signature');
+      if (typeof sig.algorithm === 'string' && !['ed25519', 'hmac-sha256', 'none'].includes(sig.algorithm)) {
+        errors.push('signature.algorithm must be one of ed25519 | hmac-sha256 | none');
+      }
+    }
+    if (isPlainObject(envelope.payload)) {
+      this.validatePayloadShape(envelope.payload, errors);
+    }
+    return {
+      valid: errors.length === 0,
+      errors
+    };
+  }
+  validateBoundaries(doc) {
+    const fieldErrors = new Map();
+    const envelope = typeof doc === 'string' ? safeParse(doc) : doc;
+    const payload = isPlainObject(envelope) ? envelope.payload : undefined;
+    if (!isPlainObject(payload)) {
+      return {
+        valid: true,
+        fieldErrors
+      };
+    }
+    const network = payload.network;
+    if (isPlainObject(network)) {
+      const timeout = network.requestTimeoutMs;
+      if (typeof timeout === 'number' && timeout <= 0) {
+        fieldErrors.set('network.requestTimeoutMs', 'must be > 0');
+      }
+      const retry = network.retry;
+      if (isPlainObject(retry)) {
+        const maxAttempts = retry.maxAttempts;
+        if (typeof maxAttempts === 'number' && (maxAttempts < 0 || maxAttempts > 10)) {
+          fieldErrors.set('network.retry.maxAttempts', 'must be between 0 and 10');
+        }
+        const baseDelayMs = retry.baseDelayMs;
+        if (typeof baseDelayMs === 'number' && baseDelayMs <= 0) {
+          fieldErrors.set('network.retry.baseDelayMs', 'must be > 0');
+        }
+      }
+    }
+    const cache = payload.cache;
+    if (isPlainObject(cache) && typeof cache.ttlMs === 'number' && cache.ttlMs < 0) {
+      fieldErrors.set('cache.ttlMs', 'must be >= 0');
+    }
+    if (typeof payload.localVersionIdentifier === 'string' && !this.isValidSemVer(payload.localVersionIdentifier)) {
+      fieldErrors.set('localVersionIdentifier', 'not a valid SemVer string');
+    }
+    const alerts = payload.alerts;
+    if (isPlainObject(alerts) && typeof alerts.forceUpdateBelow === 'string' && !this.isValidSemVer(alerts.forceUpdateBelow)) {
+      fieldErrors.set('alerts.forceUpdateBelow', 'not a valid SemVer string');
+    }
+    if (typeof payload.remoteConfigUrl === 'string' && !HTTPS_URL_PATTERN.test(payload.remoteConfigUrl)) {
+      fieldErrors.set('remoteConfigUrl', 'must use https://');
+    }
+    const stores = payload.stores;
+    if (isPlainObject(stores)) {
+      this.checkStoreShape(stores, 'ios', 'appStoreId', APP_STORE_ID_PATTERN, fieldErrors);
+      this.checkStoreShape(stores, 'android', 'packageName', ANDROID_PACKAGE_PATTERN, fieldErrors);
+      this.checkStoreShape(stores, 'huawei', 'appId', HUAWEI_APP_ID_PATTERN, fieldErrors);
+      this.checkStoreShape(stores, 'amazon', 'asin', AMAZON_ASIN_PATTERN, fieldErrors);
+      const custom = stores.custom;
+      if (isPlainObject(custom) && typeof custom.url === 'string' && !HTTPS_URL_PATTERN.test(custom.url)) {
+        fieldErrors.set('stores.custom.url', 'must use https://');
+      }
+    }
+    return {
+      valid: fieldErrors.size === 0,
+      fieldErrors
+    };
+  }
+  isValidSemVer(v) {
+    if (!SEMVER_PATTERN.test(v)) return false;
+    try {
+      parseVersion(v);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  checkStoreShape(stores, key, field, pattern, fieldErrors) {
+    const entry = stores[key];
+    if (isPlainObject(entry) && typeof entry[field] === 'string') {
+      const value = entry[field];
+      if (!pattern.test(value)) {
+        fieldErrors.set(`stores.${key}.${field}`, `"${value}" has invalid shape`);
+      }
+    }
+  }
+  validatePayloadShape(payload, errors) {
+    this.checkAdditionalProperties(payload, ['localVersionIdentifier', 'remoteConfigUrl', 'cache', 'network', 'alerts', 'stores', 'security', 'schemaVersion'], 'payload', errors);
+  }
+  requireField(obj, field, type, errors, context) {
+    const value = obj[field];
+    if (value === undefined) {
+      errors.push(`${context}.${field} is required`);
+      return;
+    }
+    if (type === 'string' && typeof value !== 'string') {
+      errors.push(`${context}.${field} must be a string`);
+    }
+    if (type === 'object' && !isPlainObject(value)) {
+      errors.push(`${context}.${field} must be an object`);
+    }
+  }
+  checkAdditionalProperties(obj, allowed, context, errors) {
+    for (const key of Object.keys(obj)) {
+      if (!allowed.includes(key)) {
+        errors.push(`${context}.${key} is not a recognized field`);
+      }
+    }
+  }
+}
+function safeParse(input) {
+  try {
+    return JSON.parse(input);
+  } catch {
+    return null;
+  }
+}
+//# sourceMappingURL=ConfigDocumentValidator.js.map

package/lib/module/data/config/ConfigDocumentValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["parseVersion","CONFIG_ENVELOPE_MAX_BYTES","SEMVER_PATTERN","HTTPS_URL_PATTERN","APP_STORE_ID_PATTERN","ANDROID_PACKAGE_PATTERN","AMAZON_ASIN_PATTERN","HUAWEI_APP_ID_PATTERN","SCHEMA_VERSION_PATTERN","isPlainObject","v","Array","isArray","ConfigDocumentValidator","validateSchema","doc","errors","length","push","valid","envelope","JSON","parse","error","String","checkAdditionalProperties","requireField","schemaVersion","test","signature","sig","algorithm","includes","payload","validatePayloadShape","validateBoundaries","fieldErrors","Map","safeParse","undefined","network","timeout","requestTimeoutMs","set","retry","maxAttempts","baseDelayMs","cache","ttlMs","localVersionIdentifier","isValidSemVer","alerts","forceUpdateBelow","remoteConfigUrl","stores","checkStoreShape","custom","url","size","key","field","pattern","entry","value","obj","type","context","allowed","Object","keys","input"],"sourceRoot":"../../../../src","sources":["data/config/ConfigDocumentValidator.ts"],"mappings":";;AAAA,SAASA,YAAY,QAAQ,6CAA0C;AAQvE;AACA,OAAO,MAAMC,yBAAyB,GAAG,EAAE,GAAG,IAAI;AAElD,MAAMC,cAAc,GAAG,sDAAsD;AAC7E,MAAMC,iBAAiB,GAAG,aAAa;AACvC,MAAMC,oBAAoB,GAAG,eAAe;AAC5C,MAAMC,uBAAuB,GAAG,uCAAuC;AACvE,MAAMC,mBAAmB,GAAG,gBAAgB;AAC5C,MAAMC,qBAAqB,GAAG,eAAe;AAC7C,MAAMC,sBAAsB,GAAG,YAAY;AAE3C,SAASC,aAAaA,CAACC,CAAU,EAAgC;EAC/D,OAAO,OAAOA,CAAC,KAAK,QAAQ,IAAIA,CAAC,KAAK,IAAI,IAAI,CAACC,KAAK,CAACC,OAAO,CAACF,CAAC,CAAC;AACjE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMG,uBAAuB,CAA6B;EAC/DC,cAAcA,CAACC,GAAsB,EAA0B;IAC7D,MAAMC,MAAgB,GAAG,EAAE;IAE3B,IAAI,OAAOD,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACE,MAAM,GAAGhB,yBAAyB,EAAE;MACrE;MACA;MACAe,MAAM,CAACE,IAAI,CACT,oBAAoBjB,yBAAyB,uBAC/C,CAAC;MACD,OAAO;QAAEkB,KAAK,EAAE,KAAK;QAAEH;MAAO,CAAC;IACjC;IAEA,IAAII,QAAiB,GAAGL,GAAG;IAC3B,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;MAC3B,IAAI;QACFK,QAAQ,GAAGC,IAAI,CAACC,KAAK,CAACP,GAAG,CAAC;MAC5B,CAAC,CAAC,OAAOQ,KAAK,EAAE;QACd,OAAO;UACLJ,KAAK,EAAE,KAAK;UACZH,MAAM,EAAE,CAAC,+BAA+BQ,MAAM,CAACD,KAAK,CAAC,EAAE;QACzD,CAAC;MACH;IACF;IAEA,IAAI,CAACd,aAAa,CAACW,QAAQ,CAAC,EAAE;MAC5B,OAAO;QAAED,KAAK,EAAE,KAAK;QAAEH,MAAM,EAAE,CAAC,gCAAgC;MAAE,CAAC;IACrE;IAEA,IAAI,CAACS,yBAAyB,CAC5BL,QAAQ,EACR,CAAC,eAAe,EAAE,SAAS,EAAE,WAAW,CAAC,EACzC,UAAU,EACVJ,MACF,CAAC;IACD,IAAI,CAACU,YAAY,CAACN,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAEJ,MAAM,EAAE,UAAU,CAAC;IAC1E,IAAI,CAACU,YAAY,CAACN,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAEJ,MAAM,EAAE,UAAU,CAAC;IACpE,IAAI,CAACU,YAAY,CAACN,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAEJ,MAAM,EAAE,UAAU,CAAC;IAEtE,IACE,OAAOI,QAAQ,CAACO,aAAa,KAAK,QAAQ,IAC1C,CAACnB,sBAAsB,CAACoB,IAAI,CAACR,QAAQ,CAACO,aAAa,CAAC,EACpD;MACAX,MAAM,CAACE,IAAI,CAAC,iDAAiD,CAAC;IAChE;IAEA,IAAIT,aAAa,CAACW,QAAQ,CAACS,SAAS,CAAC,EAAE;MACrC,MAAMC,GAAG,GAAGV,QAAQ,CAACS,SAAS;MAC9B,IAAI,CAACJ,yBAAyB,CAC5BK,GAAG,EACH,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,EAC3C,WAAW,EACXd,MACF,CAAC;MACD,IAAI,CAACU,YAAY,CAACI,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAEd,MAAM,EAAE,WAAW,CAAC;MAClE,IAAI,CAACU,YAAY,CAACI,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAEd,MAAM,EAAE,WAAW,CAAC;MAC9D,IAAI,CAACU,YAAY,CAACI,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAEd,MAAM,EAAE,WAAW,CAAC;MAC9D,IAAI,CAACU,YAAY,CAACI,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAEd,MAAM,EAAE,WAAW,CAAC;MACjE,IACE,OAAOc,GAAG,CAACC,SAAS,KAAK,QAAQ,IACjC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,CAACC,QAAQ,CAACF,GAAG,CAACC,SAAS,CAAC,EAC3D;QACAf,MAAM,CAACE,IAAI,CACT,iEACF,CAAC;MACH;IACF;IAEA,IAAIT,aAAa,CAACW,QAAQ,CAACa,OAAO,CAAC,EAAE;MACnC,IAAI,CAACC,oBAAoB,CAACd,QAAQ,CAACa,OAAO,EAAEjB,MAAM,CAAC;IACrD;IAEA,OAAO;MAAEG,KAAK,EAAEH,MAAM,CAACC,MAAM,KAAK,CAAC;MAAED;IAAO,CAAC;EAC/C;EAEAmB,kBAAkBA,CAACpB,GAAsB,EAA4B;IACnE,MAAMqB,WAAW,GAAG,IAAIC,GAAG,CAAiB,CAAC;IAC7C,MAAMjB,QAAQ,GACZ,OAAOL,GAAG,KAAK,QAAQ,GACnBuB,SAAS,CAACvB,GAAG,CAAC,GACbA,GAA+B;IACtC,MAAMkB,OAAO,GAAGxB,aAAa,CAACW,QAAQ,CAAC,GAClCA,QAAQ,CAACa,OAAO,GACjBM,SAAS;IAEb,IAAI,CAAC9B,aAAa,CAACwB,OAAO,CAAC,EAAE;MAC3B,OAAO;QAAEd,KAAK,EAAE,IAAI;QAAEiB;MAAY,CAAC;IACrC;IAEA,MAAMI,OAAO,GAAGP,OAAO,CAACO,OAA8C;IACtE,IAAI/B,aAAa,CAAC+B,OAAO,CAAC,EAAE;MAC1B,MAAMC,OAAO,GAAGD,OAAO,CAACE,gBAAgB;MACxC,IAAI,OAAOD,OAAO,KAAK,QAAQ,IAAIA,OAAO,IAAI,CAAC,EAAE;QAC/CL,WAAW,CAACO,GAAG,CAAC,0BAA0B,EAAE,aAAa,CAAC;MAC5D;MACA,MAAMC,KAAK,GAAGJ,OAAO,CAACI,KAA4C;MAClE,IAAInC,aAAa,CAACmC,KAAK,CAAC,EAAE;QACxB,MAAMC,WAAW,GAAGD,KAAK,CAACC,WAAW;QACrC,IACE,OAAOA,WAAW,KAAK,QAAQ,KAC9BA,WAAW,GAAG,CAAC,IAAIA,WAAW,GAAG,EAAE,CAAC,EACrC;UACAT,WAAW,CAACO,GAAG,CACb,2BAA2B,EAC3B,0BACF,CAAC;QACH;QACA,MAAMG,WAAW,GAAGF,KAAK,CAACE,WAAW;QACrC,IAAI,OAAOA,WAAW,KAAK,QAAQ,IAAIA,WAAW,IAAI,CAAC,EAAE;UACvDV,WAAW,CAACO,GAAG,CAAC,2BAA2B,EAAE,aAAa,CAAC;QAC7D;MACF;IACF;IAEA,MAAMI,KAAK,GAAGd,OAAO,CAACc,KAA4C;IAClE,IACEtC,aAAa,CAACsC,KAAK,CAAC,IACpB,OAAOA,KAAK,CAACC,KAAK,KAAK,QAAQ,IAC/BD,KAAK,CAACC,KAAK,GAAG,CAAC,EACf;MACAZ,WAAW,CAACO,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC;IAChD;IAEA,IACE,OAAOV,OAAO,CAACgB,sBAAsB,KAAK,QAAQ,IAClD,CAAC,IAAI,CAACC,aAAa,CAACjB,OAAO,CAACgB,sBAAsB,CAAC,EACnD;MACAb,WAAW,CAACO,GAAG,CAAC,wBAAwB,EAAE,2BAA2B,CAAC;IACxE;IAEA,MAAMQ,MAAM,GAAGlB,OAAO,CAACkB,MAA6C;IACpE,IACE1C,aAAa,CAAC0C,MAAM,CAAC,IACrB,OAAOA,MAAM,CAACC,gBAAgB,KAAK,QAAQ,IAC3C,CAAC,IAAI,CAACF,aAAa,CAACC,MAAM,CAACC,gBAAgB,CAAC,EAC5C;MACAhB,WAAW,CAACO,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;IACzE;IAEA,IACE,OAAOV,OAAO,CAACoB,eAAe,KAAK,QAAQ,IAC3C,CAAClD,iBAAiB,CAACyB,IAAI,CAACK,OAAO,CAACoB,eAAe,CAAC,EAChD;MACAjB,WAAW,CAACO,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACzD;IAEA,MAAMW,MAAM,GAAGrB,OAAO,CAACqB,MAA6C;IACpE,IAAI7C,aAAa,CAAC6C,MAAM,CAAC,EAAE;MACzB,IAAI,CAACC,eAAe,CAClBD,MAAM,EACN,KAAK,EACL,YAAY,EACZlD,oBAAoB,EACpBgC,WACF,CAAC;MACD,IAAI,CAACmB,eAAe,CAClBD,MAAM,EACN,SAAS,EACT,aAAa,EACbjD,uBAAuB,EACvB+B,WACF,CAAC;MACD,IAAI,CAACmB,eAAe,CAClBD,MAAM,EACN,QAAQ,EACR,OAAO,EACP/C,qBAAqB,EACrB6B,WACF,CAAC;MACD,IAAI,CAACmB,eAAe,CAClBD,MAAM,EACN,QAAQ,EACR,MAAM,EACNhD,mBAAmB,EACnB8B,WACF,CAAC;MACD,MAAMoB,MAAM,GAAGF,MAAM,CAACE,MAA6C;MACnE,IACE/C,aAAa,CAAC+C,MAAM,CAAC,IACrB,OAAOA,MAAM,CAACC,GAAG,KAAK,QAAQ,IAC9B,CAACtD,iBAAiB,CAACyB,IAAI,CAAC4B,MAAM,CAACC,GAAG,CAAC,EACnC;QACArB,WAAW,CAACO,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;MAC3D;IACF;IAEA,OAAO;MAAExB,KAAK,EAAEiB,WAAW,CAACsB,IAAI,KAAK,CAAC;MAAEtB;IAAY,CAAC;EACvD;EAEQc,aAAaA,CAACxC,CAAS,EAAW;IACxC,IAAI,CAACR,cAAc,CAAC0B,IAAI,CAAClB,CAAC,CAAC,EAAE,OAAO,KAAK;IACzC,IAAI;MACFV,YAAY,CAACU,CAAC,CAAC;MACf,OAAO,IAAI;IACb,CAAC,CAAC,MAAM;MACN,OAAO,KAAK;IACd;EACF;EAEQ6C,eAAeA,CACrBD,MAA+B,EAC/BK,GAAW,EACXC,KAAa,EACbC,OAAe,EACfzB,WAAgC,EAC1B;IACN,MAAM0B,KAAK,GAAGR,MAAM,CAACK,GAAG,CAAwC;IAChE,IAAIlD,aAAa,CAACqD,KAAK,CAAC,IAAI,OAAOA,KAAK,CAACF,KAAK,CAAC,KAAK,QAAQ,EAAE;MAC5D,MAAMG,KAAK,GAAGD,KAAK,CAACF,KAAK,CAAW;MACpC,IAAI,CAACC,OAAO,CAACjC,IAAI,CAACmC,KAAK,CAAC,EAAE;QACxB3B,WAAW,CAACO,GAAG,CACb,UAAUgB,GAAG,IAAIC,KAAK,EAAE,EACxB,IAAIG,KAAK,qBACX,CAAC;MACH;IACF;EACF;EAEQ7B,oBAAoBA,CAC1BD,OAAgC,EAChCjB,MAAgB,EACV;IACN,IAAI,CAACS,yBAAyB,CAC5BQ,OAAO,EACP,CACE,wBAAwB,EACxB,iBAAiB,EACjB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,eAAe,CAChB,EACD,SAAS,EACTjB,MACF,CAAC;EACH;EAEQU,YAAYA,CAClBsC,GAA4B,EAC5BJ,KAAa,EACbK,IAAyB,EACzBjD,MAAgB,EAChBkD,OAAe,EACT;IACN,MAAMH,KAAK,GAAGC,GAAG,CAACJ,KAAK,CAAC;IACxB,IAAIG,KAAK,KAAKxB,SAAS,EAAE;MACvBvB,MAAM,CAACE,IAAI,CAAC,GAAGgD,OAAO,IAAIN,KAAK,cAAc,CAAC;MAC9C;IACF;IACA,IAAIK,IAAI,KAAK,QAAQ,IAAI,OAAOF,KAAK,KAAK,QAAQ,EAAE;MAClD/C,MAAM,CAACE,IAAI,CAAC,GAAGgD,OAAO,IAAIN,KAAK,mBAAmB,CAAC;IACrD;IACA,IAAIK,IAAI,KAAK,QAAQ,IAAI,CAACxD,aAAa,CAACsD,KAAK,CAAC,EAAE;MAC9C/C,MAAM,CAACE,IAAI,CAAC,GAAGgD,OAAO,IAAIN,KAAK,oBAAoB,CAAC;IACtD;EACF;EAEQnC,yBAAyBA,CAC/BuC,GAA4B,EAC5BG,OAAiB,EACjBD,OAAe,EACflD,MAAgB,EACV;IACN,KAAK,MAAM2C,GAAG,IAAIS,MAAM,CAACC,IAAI,CAACL,GAAG,CAAC,EAAE;MAClC,IAAI,CAACG,OAAO,CAACnC,QAAQ,CAAC2B,GAAG,CAAC,EAAE;QAC1B3C,MAAM,CAACE,IAAI,CAAC,GAAGgD,OAAO,IAAIP,GAAG,4BAA4B,CAAC;MAC5D;IACF;EACF;AACF;AAEA,SAASrB,SAASA,CAACgC,KAAa,EAAW;EACzC,IAAI;IACF,OAAOjD,IAAI,CAACC,KAAK,CAACgD,KAAK,CAAC;EAC1B,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF","ignoreList":[]}

package/lib/module/data/config/ConfigLoader.js

@@ -0,0 +1,82 @@
+"use strict";
+
+import { ConsoleLogSink } from "../../shared/logging/Logger.js";
+import { validateOptions } from "./ConfigValidator.js";
+
+/**
+ * Synchronous default-merge (doc 03 §4.2 tier 4 only). Kept as a plain function, not
+ * just a method on ConfigLoader, so the DI composition root (src/di/container.ts) can
+ * validate + resolve synchronously at configure()-time (doc 02 §1.3's fail-fast
+ * requirement) without awaiting a Promise, and so ConfigResolutionPipeline can call it
+ * as its always-valid tier-4 floor (doc 03 §7.2's termination guarantee).
+ */
+export function resolveConfigSync(defaults) {
+  validateOptions(defaults);
+  return {
+    appVersion: defaults.appVersion ?? null,
+    logging: {
+      level: defaults.logging?.level ?? 'warn',
+      sink: defaults.logging?.sink ?? new ConsoleLogSink()
+    },
+    cache: {
+      ttlMs: defaults.cache?.ttlMs ?? 21_600_000,
+      storage: defaults.cache?.storage ?? 'persistent',
+      bustOnManualCheck: defaults.cache?.bustOnManualCheck ?? true
+    },
+    fallback: {
+      onNetworkError: defaults.fallback?.onNetworkError ?? 'useCache',
+      defaultConfig: defaults.fallback?.defaultConfig ?? null,
+      requestTimeoutMs: defaults.fallback?.requestTimeoutMs ?? 8_000,
+      retry: {
+        maxAttempts: defaults.fallback?.retry?.maxAttempts ?? 3,
+        backoff: defaults.fallback?.retry?.backoff ?? 'exponential-jitter',
+        baseDelayMs: defaults.fallback?.retry?.baseDelayMs ?? 500
+      }
+    },
+    stores: defaults.stores,
+    policy: {
+      forceUpdateBelow: defaults.policy?.forceUpdateBelow ?? null,
+      reminderIntervalMs: defaults.policy?.reminderIntervalMs ?? 259_200_000,
+      rolloutPercentage: defaults.policy?.rolloutPercentage ?? 100
+    },
+    strictReadiness: defaults.strictReadiness ?? false,
+    remoteConfigUrl: defaults.remoteConfigUrl ?? null,
+    security: {
+      signatureAlgorithm: defaults.security?.signatureAlgorithm ?? 'none',
+      trustedKeyIds: defaults.security?.trustedKeyIds ?? []
+    },
+    schemaVersion: '1.0'
+  };
+}
+
+/**
+ * Doc 03 §0's IConfigProvider implementation — thin wrapper around
+ * ConfigResolutionPipeline that adds change-detection so subscribe() only fires when a
+ * later resolution actually differs from the last one (§4.4 hot-update contract).
+ */
+export class ConfigLoader {
+  listeners = new Set();
+  lastResolved = null;
+  constructor(pipeline) {
+    this.pipeline = pipeline;
+  }
+  async resolve(defaults) {
+    const config = this.pipeline ? (await this.pipeline.resolve(defaults)).config : resolveConfigSync(defaults);
+    const changed = this.lastResolved !== null && JSON.stringify(this.lastResolved) !== JSON.stringify(config);
+    this.lastResolved = config;
+    if (changed) {
+      for (const listener of Array.from(this.listeners)) listener(config);
+    }
+    return config;
+  }
+  async load(request) {
+    return this.resolve(request.defaults);
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+}
+//# sourceMappingURL=ConfigLoader.js.map

package/lib/module/data/config/ConfigLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ConsoleLogSink","validateOptions","resolveConfigSync","defaults","appVersion","logging","level","sink","cache","ttlMs","storage","bustOnManualCheck","fallback","onNetworkError","defaultConfig","requestTimeoutMs","retry","maxAttempts","backoff","baseDelayMs","stores","policy","forceUpdateBelow","reminderIntervalMs","rolloutPercentage","strictReadiness","remoteConfigUrl","security","signatureAlgorithm","trustedKeyIds","schemaVersion","ConfigLoader","listeners","Set","lastResolved","constructor","pipeline","resolve","config","changed","JSON","stringify","listener","Array","from","load","request","subscribe","add","delete"],"sourceRoot":"../../../../src","sources":["data/config/ConfigLoader.ts"],"mappings":";;AAOA,SAASA,cAAc,QAAQ,gCAA6B;AAE5D,SAASC,eAAe,QAAQ,sBAAmB;;AAEnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAC/BC,QAA+B,EACD;EAC9BF,eAAe,CAACE,QAAQ,CAAC;EAEzB,OAAO;IACLC,UAAU,EAAED,QAAQ,CAACC,UAAU,IAAI,IAAI;IACvCC,OAAO,EAAE;MACPC,KAAK,EAAEH,QAAQ,CAACE,OAAO,EAAEC,KAAK,IAAI,MAAM;MACxCC,IAAI,EAAEJ,QAAQ,CAACE,OAAO,EAAEE,IAAI,IAAI,IAAIP,cAAc,CAAC;IACrD,CAAC;IACDQ,KAAK,EAAE;MACLC,KAAK,EAAEN,QAAQ,CAACK,KAAK,EAAEC,KAAK,IAAI,UAAU;MAC1CC,OAAO,EAAEP,QAAQ,CAACK,KAAK,EAAEE,OAAO,IAAI,YAAY;MAChDC,iBAAiB,EAAER,QAAQ,CAACK,KAAK,EAAEG,iBAAiB,IAAI;IAC1D,CAAC;IACDC,QAAQ,EAAE;MACRC,cAAc,EAAEV,QAAQ,CAACS,QAAQ,EAAEC,cAAc,IAAI,UAAU;MAC/DC,aAAa,EAAEX,QAAQ,CAACS,QAAQ,EAAEE,aAAa,IAAI,IAAI;MACvDC,gBAAgB,EAAEZ,QAAQ,CAACS,QAAQ,EAAEG,gBAAgB,IAAI,KAAK;MAC9DC,KAAK,EAAE;QACLC,WAAW,EAAEd,QAAQ,CAACS,QAAQ,EAAEI,KAAK,EAAEC,WAAW,IAAI,CAAC;QACvDC,OAAO,EAAEf,QAAQ,CAACS,QAAQ,EAAEI,KAAK,EAAEE,OAAO,IAAI,oBAAoB;QAClEC,WAAW,EAAEhB,QAAQ,CAACS,QAAQ,EAAEI,KAAK,EAAEG,WAAW,IAAI;MACxD;IACF,CAAC;IACDC,MAAM,EAAEjB,QAAQ,CAACiB,MAAM;IACvBC,MAAM,EAAE;MACNC,gBAAgB,EAAEnB,QAAQ,CAACkB,MAAM,EAAEC,gBAAgB,IAAI,IAAI;MAC3DC,kBAAkB,EAAEpB,QAAQ,CAACkB,MAAM,EAAEE,kBAAkB,IAAI,WAAW;MACtEC,iBAAiB,EAAErB,QAAQ,CAACkB,MAAM,EAAEG,iBAAiB,IAAI;IAC3D,CAAC;IACDC,eAAe,EAAEtB,QAAQ,CAACsB,eAAe,IAAI,KAAK;IAClDC,eAAe,EAAEvB,QAAQ,CAACuB,eAAe,IAAI,IAAI;IACjDC,QAAQ,EAAE;MACRC,kBAAkB,EAAEzB,QAAQ,CAACwB,QAAQ,EAAEC,kBAAkB,IAAI,MAAM;MACnEC,aAAa,EAAE1B,QAAQ,CAACwB,QAAQ,EAAEE,aAAa,IAAI;IACrD,CAAC;IACDC,aAAa,EAAE;EACjB,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,YAAY,CAA4B;EAClCC,SAAS,GAAG,IAAIC,GAAG,CAElC,CAAC;EACKC,YAAY,GAAwC,IAAI;EAEhEC,WAAWA,CAAkBC,QAAmC,EAAE;IAAA,KAArCA,QAAmC,GAAnCA,QAAmC;EAAG;EAEnE,MAAMC,OAAOA,CACXlC,QAA+B,EACQ;IACvC,MAAMmC,MAAM,GAAG,IAAI,CAACF,QAAQ,GACxB,CAAC,MAAM,IAAI,CAACA,QAAQ,CAACC,OAAO,CAAClC,QAAQ,CAAC,EAAEmC,MAAM,GAC9CpC,iBAAiB,CAACC,QAAQ,CAAC;IAE/B,MAAMoC,OAAO,GACX,IAAI,CAACL,YAAY,KAAK,IAAI,IAC1BM,IAAI,CAACC,SAAS,CAAC,IAAI,CAACP,YAAY,CAAC,KAAKM,IAAI,CAACC,SAAS,CAACH,MAAM,CAAC;IAC9D,IAAI,CAACJ,YAAY,GAAGI,MAAM;IAC1B,IAAIC,OAAO,EAAE;MACX,KAAK,MAAMG,QAAQ,IAAIC,KAAK,CAACC,IAAI,CAAC,IAAI,CAACZ,SAAS,CAAC,EAAEU,QAAQ,CAACJ,MAAM,CAAC;IACrE;IACA,OAAOA,MAAM;EACf;EAEA,MAAMO,IAAIA,CACRC,OAA0B,EACa;IACvC,OAAO,IAAI,CAACT,OAAO,CAACS,OAAO,CAAC3C,QAAQ,CAAC;EACvC;EAEA4C,SAASA,CACPL,QAAwD,EAC3C;IACb,IAAI,CAACV,SAAS,CAACgB,GAAG,CAACN,QAAQ,CAAC;IAC5B,OAAO,MAAM;MACX,IAAI,CAACV,SAAS,CAACiB,MAAM,CAACP,QAAQ,CAAC;IACjC,CAAC;EACH;AACF","ignoreList":[]}

package/lib/module/data/config/ConfigProvider.js

@@ -0,0 +1,58 @@
+"use strict";
+
+import { ConfigResolutionPipeline } from "./ConfigResolutionPipeline.js";
+/**
+ * IConfigProvider adapter around ConfigResolutionPipeline — resolve()/load() delegate
+ * straight through, and subscribe() adds the doc 03 §4.4 "hot-update" behavior the raw
+ * pipeline doesn't provide on its own: a background poll that re-runs resolution and
+ * notifies listeners only when the resolved config actually changed.
+ */
+export class ConfigProvider {
+  listeners = new Set();
+  timer = null;
+  lastConfig = null;
+  lastOptions = null;
+  constructor(deps) {
+    this.pipeline = new ConfigResolutionPipeline(deps);
+    this.refreshIntervalMs = deps.refreshIntervalMs ?? 0;
+  }
+  async resolve(defaults) {
+    this.lastOptions = defaults;
+    const {
+      config
+    } = await this.pipeline.resolve(defaults);
+    this.lastConfig = config;
+    return config;
+  }
+  load(request) {
+    return this.resolve(request.defaults);
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    this.ensurePolling();
+    return () => {
+      this.listeners.delete(listener);
+      if (this.listeners.size === 0 && this.timer) {
+        clearInterval(this.timer);
+        this.timer = null;
+      }
+    };
+  }
+  ensurePolling() {
+    if (this.timer || this.refreshIntervalMs <= 0 || !this.lastOptions) return;
+    this.timer = setInterval(() => {
+      void this.refresh();
+    }, this.refreshIntervalMs);
+  }
+  async refresh() {
+    if (!this.lastOptions) return;
+    // A background poll tick must never surface as an unhandled rejection — the
+    // pipeline already reports validation/network failures via its own onError hook.
+    const result = await this.pipeline.resolve(this.lastOptions).catch(() => null);
+    if (!result) return;
+    if (JSON.stringify(result.config) === JSON.stringify(this.lastConfig)) return;
+    this.lastConfig = result.config;
+    for (const listener of this.listeners) listener(result.config);
+  }
+}
+//# sourceMappingURL=ConfigProvider.js.map

package/lib/module/data/config/ConfigProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ConfigResolutionPipeline","ConfigProvider","listeners","Set","timer","lastConfig","lastOptions","constructor","deps","pipeline","refreshIntervalMs","resolve","defaults","config","load","request","subscribe","listener","add","ensurePolling","delete","size","clearInterval","setInterval","refresh","result","catch","JSON","stringify"],"sourceRoot":"../../../../src","sources":["data/config/ConfigProvider.ts"],"mappings":";;AAAA,SAASA,wBAAwB,QAAQ,+BAA4B;AAerE;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,cAAc,CAA4B;EAGpCC,SAAS,GAAG,IAAIC,GAAG,CAElC,CAAC;EACKC,KAAK,GAA0C,IAAI;EACnDC,UAAU,GAAwC,IAAI;EACtDC,WAAW,GAAiC,IAAI;EAExDC,WAAWA,CAACC,IAAwB,EAAE;IACpC,IAAI,CAACC,QAAQ,GAAG,IAAIT,wBAAwB,CAACQ,IAAI,CAAC;IAClD,IAAI,CAACE,iBAAiB,GAAGF,IAAI,CAACE,iBAAiB,IAAI,CAAC;EACtD;EAEA,MAAMC,OAAOA,CACXC,QAA+B,EACQ;IACvC,IAAI,CAACN,WAAW,GAAGM,QAAQ;IAC3B,MAAM;MAAEC;IAAO,CAAC,GAAG,MAAM,IAAI,CAACJ,QAAQ,CAACE,OAAO,CAACC,QAAQ,CAAC;IACxD,IAAI,CAACP,UAAU,GAAGQ,MAAM;IACxB,OAAOA,MAAM;EACf;EAEAC,IAAIA,CAACC,OAA0B,EAAyC;IACtE,OAAO,IAAI,CAACJ,OAAO,CAACI,OAAO,CAACH,QAAQ,CAAC;EACvC;EAEAI,SAASA,CACPC,QAAwD,EAC3C;IACb,IAAI,CAACf,SAAS,CAACgB,GAAG,CAACD,QAAQ,CAAC;IAC5B,IAAI,CAACE,aAAa,CAAC,CAAC;IACpB,OAAO,MAAM;MACX,IAAI,CAACjB,SAAS,CAACkB,MAAM,CAACH,QAAQ,CAAC;MAC/B,IAAI,IAAI,CAACf,SAAS,CAACmB,IAAI,KAAK,CAAC,IAAI,IAAI,CAACjB,KAAK,EAAE;QAC3CkB,aAAa,CAAC,IAAI,CAAClB,KAAK,CAAC;QACzB,IAAI,CAACA,KAAK,GAAG,IAAI;MACnB;IACF,CAAC;EACH;EAEQe,aAAaA,CAAA,EAAS;IAC5B,IAAI,IAAI,CAACf,KAAK,IAAI,IAAI,CAACM,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAACJ,WAAW,EAAE;IACpE,IAAI,CAACF,KAAK,GAAGmB,WAAW,CAAC,MAAM;MAC7B,KAAK,IAAI,CAACC,OAAO,CAAC,CAAC;IACrB,CAAC,EAAE,IAAI,CAACd,iBAAiB,CAAC;EAC5B;EAEA,MAAcc,OAAOA,CAAA,EAAkB;IACrC,IAAI,CAAC,IAAI,CAAClB,WAAW,EAAE;IACvB;IACA;IACA,MAAMmB,MAAM,GAAG,MAAM,IAAI,CAAChB,QAAQ,CAC/BE,OAAO,CAAC,IAAI,CAACL,WAAW,CAAC,CACzBoB,KAAK,CAAC,MAAM,IAAI,CAAC;IACpB,IAAI,CAACD,MAAM,EAAE;IACb,IAAIE,IAAI,CAACC,SAAS,CAACH,MAAM,CAACZ,MAAM,CAAC,KAAKc,IAAI,CAACC,SAAS,CAAC,IAAI,CAACvB,UAAU,CAAC,EACnE;IACF,IAAI,CAACA,UAAU,GAAGoB,MAAM,CAACZ,MAAM;IAC/B,KAAK,MAAMI,QAAQ,IAAI,IAAI,CAACf,SAAS,EAAEe,QAAQ,CAACQ,MAAM,CAACZ,MAAM,CAAC;EAChE;AACF","ignoreList":[]}

package/lib/module/data/config/ConfigResolutionPipeline.js

@@ -0,0 +1,268 @@
+"use strict";
+
+import { ConsoleLogSink } from "../../shared/logging/Logger.js";
+import { resolveConfigSync } from "./ConfigLoader.js";
+import { CONFIG_ENVELOPE_MAX_BYTES } from "./ConfigDocumentValidator.js";
+import { BoundaryValidationException, ConfigSizeLimitExceededException, SchemaValidationException, SignatureVerificationException, UntrustedKeyIdException, toVersionManagerException } from "../../domain/errors/VersionManagerException.js";
+/**
+ * Doc 03's ConfigResolutionPipeline — orchestrates §3.2 (schema -> boundary -> signature
+ * validation), §4.2 (per-field precedence merge, env > remote > local > default), §4.3
+ * (access path), §7.2 (cascading fallback), §7.3 (field vs whole-document fallback), and
+ * §7.4 (quarantine + circuit breaker). Lives in src/data/config/ per doc 03 §0.
+ */
+export class ConfigResolutionPipeline {
+  quarantinedFingerprints = new Set();
+  consecutiveRemoteFailures = 0;
+  circuitOpenUntil = 0;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async resolve(defaults) {
+    // Tier 4 — always present, validated synchronously at configure()-time already by
+    // ConfigLoader.resolveConfigSync (doc 02 §1.3 fail-fast); re-run here defensively so
+    // this pipeline is safe to call standalone (e.g. from tests).
+    const tier4 = resolveConfigSync(defaults);
+    const trustedKeys = {
+      algorithm: tier4.security.signatureAlgorithm,
+      keys: new Set(tier4.security.trustedKeyIds)
+    };
+    const [envelopeTier1, envelopeTier3] = await Promise.all([this.deps.envOverrides.read().catch(() => ({})), this.readLocal(trustedKeys)]);
+    const remoteResult = await this.readRemote(defaults, trustedKeys);
+
+    // §7.2 whole-tier cascade: if the remote tier failed outright, prefer the last known
+    // valid *fully resolved* config over recomputing fresh from local+default, so a
+    // network hiccup doesn't regress an app back to weaker settings every single check.
+    if (remoteResult.status === 'failed') {
+      const cached = await this.deps.cache.getLastValid().catch(() => null);
+      if (cached) {
+        return {
+          config: cached,
+          tier: 'remote' /* cache reflects a prior remote win */
+        };
+      }
+    }
+    const tier2 = remoteResult.status === 'ok' ? remoteResult.payload : null;
+    const tier3 = envelopeTier3;
+    const merged = mergeConfig(tier4, tier3, tier2, envelopeTier1);
+    const tier = tier2 ? 'remote' : tier3 ? 'local' : envelopeTier1 && Object.keys(envelopeTier1).length > 0 ? 'env' : 'default';
+    await this.deps.cache.setLastValid(merged).catch(() => {
+      // Cache-write failures never block resolution (§7.2's guarantee is about read
+      // fallback; a write failure here just means the *next* remote outage won't have a
+      // warm cache to fall back to — already surfaced via CacheWriteException elsewhere).
+    });
+    return {
+      config: merged,
+      tier
+    };
+  }
+  async readLocal(trustedKeys) {
+    const raw = await this.deps.local.read().catch(() => null);
+    if (raw === null || raw === undefined) return null;
+    const verified = await this.validateAndVerify(raw, 'local', trustedKeys);
+    return verified;
+  }
+  async readRemote(defaults, trustedKeys) {
+    const url = defaults.remoteConfigUrl;
+    if (!url) return {
+      status: 'absent'
+    };
+    if (this.deps.clock.now() < this.circuitOpenUntil) {
+      // §7.4 circuit breaker: skip attempting remote fetch entirely during the cooldown.
+      return {
+        status: 'failed'
+      };
+    }
+    let raw;
+    try {
+      raw = await this.deps.remote.fetch(url, {
+        timeoutMs: defaults.fallback?.requestTimeoutMs ?? 8_000,
+        headers: defaults.configSources?.remoteFetchHeaders
+      });
+    } catch (error) {
+      this.recordRemoteFailure();
+      this.report(toVersionManagerException(error));
+      return {
+        status: 'failed'
+      };
+    }
+    const fingerprint = fingerprintOf(raw);
+    if (this.quarantinedFingerprints.has(fingerprint)) {
+      // §7.4: same bad bytes seen again within the session — fail silently (no
+      // re-validation, no re-logging) but still counts as a circuit-breaker failure.
+      this.recordRemoteFailure();
+      return {
+        status: 'failed'
+      };
+    }
+    const verified = await this.validateAndVerify(raw, 'remote', trustedKeys, fingerprint);
+    if (verified === null) {
+      this.recordRemoteFailure();
+      return {
+        status: 'failed'
+      };
+    }
+    this.consecutiveRemoteFailures = 0;
+    this.circuitOpenUntil = 0;
+    return {
+      status: 'ok',
+      payload: verified
+    };
+  }
+  recordRemoteFailure() {
+    this.consecutiveRemoteFailures++;
+    const threshold = this.deps.circuitBreakerThreshold ?? 5;
+    if (this.consecutiveRemoteFailures >= threshold) {
+      const cooldown = this.deps.circuitBreakerCooldownMs ?? 5 * 60_000;
+      this.circuitOpenUntil = this.deps.clock.now() + cooldown;
+    }
+  }
+
+  /**
+   * §3.2 sequence: schema -> boundary -> canonicalize -> verify signature. Returns the
+   * validated payload (with any boundary-failed fields stripped per §7.3's field-level
+   * fallback) or null if the whole document must be rejected (schema failure or
+   * signature failure — §7.3's whole-document fallback).
+   */
+  async validateAndVerify(raw, tier, trustedKeys, fingerprint) {
+    const sizeCheck = typeof raw === 'string' ? raw.length : JSON.stringify(raw).length;
+    if (sizeCheck > CONFIG_ENVELOPE_MAX_BYTES) {
+      this.report(new ConfigSizeLimitExceededException({
+        message: `${tier} config envelope exceeds ${CONFIG_ENVELOPE_MAX_BYTES} bytes`
+      }));
+      return null;
+    }
+    const schemaResult = this.deps.validator.validateSchema(raw);
+    if (!schemaResult.valid) {
+      this.report(new SchemaValidationException({
+        message: `${tier} config document failed schema validation: ${schemaResult.errors.join('; ')}`,
+        metadata: {
+          tier,
+          errors: schemaResult.errors
+        }
+      }));
+      return null; // whole-document fallback (§7.3)
+    }
+    const envelope = typeof raw === 'string' ? JSON.parse(raw) : raw;
+
+    // Signature verification — required for remote always, required for local unless
+    // algorithm is "none" in a dev build (enforced inside SignatureVerifier, §3.1).
+    if (envelope.signature.algorithm !== 'none' && !trustedKeys.keys.has(envelope.signature.keyId)) {
+      this.report(new UntrustedKeyIdException({
+        message: `${tier} config signature.keyId "${envelope.signature.keyId}" is not in security.trustedKeyIds`,
+        metadata: {
+          tier
+        }
+      }));
+      if (fingerprint) this.quarantinedFingerprints.add(fingerprint);
+      return null;
+    }
+    const sigResult = await this.deps.signatureVerifier.verify(envelope, trustedKeys);
+    if (!sigResult.valid) {
+      this.report(new SignatureVerificationException({
+        message: `${tier} config signature verification failed: ${sigResult.reason ?? 'unknown reason'}`,
+        metadata: {
+          tier
+        }
+      }));
+      if (fingerprint) this.quarantinedFingerprints.add(fingerprint);
+      return null; // whole-document fallback (§7.3) — an untrusted signature taints every field
+    }
+
+    // §7.3 field-level fallback: only the offending fields are dropped, not the whole doc.
+    const boundaryResult = this.deps.validator.validateBoundaries(raw);
+    if (!boundaryResult.valid) {
+      this.report(new BoundaryValidationException({
+        message: `${tier} config document failed boundary validation on: ${Array.from(boundaryResult.fieldErrors.keys()).join(', ')}`,
+        metadata: {
+          tier,
+          fields: Array.from(boundaryResult.fieldErrors.entries())
+        }
+      }));
+      return stripFields(envelope.payload, boundaryResult.fieldErrors);
+    }
+    return envelope.payload;
+  }
+  report(error) {
+    if (this.deps.onError) {
+      this.deps.onError(error);
+    } else {
+      new ConsoleLogSink().write({
+        level: 'error',
+        message: error.message,
+        timestamp: this.deps.clock.now(),
+        metadata: {
+          code: error.code
+        }
+      });
+    }
+  }
+}
+function fingerprintOf(raw) {
+  const str = typeof raw === 'string' ? raw : JSON.stringify(raw);
+  // Cheap non-cryptographic fingerprint — this is a quarantine dedupe key, not a
+  // security boundary (signature verification is what actually protects integrity).
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    hash = Math.imul(31, hash) + str.charCodeAt(i) | 0;
+  }
+  return `${str.length}:${hash}`;
+}
+function stripFields(payload, fieldErrors) {
+  const clone = JSON.parse(JSON.stringify(payload));
+  for (const path of fieldErrors.keys()) {
+    const segments = path.split('.');
+    let cursor = clone;
+    for (let i = 0; i < segments.length - 1; i++) {
+      const next = cursor[segments[i]];
+      if (typeof next !== 'object' || next === null) break;
+      cursor = next;
+    }
+    delete cursor[segments[segments.length - 1]];
+  }
+  return clone;
+}
+function firstDefined(...values) {
+  for (const v of values) {
+    if (v !== undefined && v !== null) return v;
+  }
+  return undefined;
+}
+
+/**
+ * Doc 03 §4.2 precedence matrix — per-field deep merge, honoring which tiers each field
+ * group is eligible to appear in (not every field accepts every tier; e.g. env never
+ * overrides cache.storage or stores.*, and security.* is tier-4-only).
+ */
+function mergeConfig(tier4, tier3, tier2, tier1) {
+  return {
+    appVersion: firstDefined(tier1.localVersionIdentifier, tier4.appVersion) ?? null,
+    logging: tier4.logging,
+    cache: {
+      ttlMs: firstDefined(tier1.cache?.ttlMs, tier2?.cache?.ttlMs, tier3?.cache?.ttlMs, tier4.cache.ttlMs) ?? 21_600_000,
+      storage: firstDefined(tier2?.cache?.storage, tier3?.cache?.storage, tier4.cache.storage) ?? 'persistent',
+      bustOnManualCheck: tier4.cache.bustOnManualCheck
+    },
+    fallback: {
+      onNetworkError: tier4.fallback.onNetworkError,
+      defaultConfig: tier4.fallback.defaultConfig,
+      requestTimeoutMs: firstDefined(tier1.network?.requestTimeoutMs, tier2?.network?.requestTimeoutMs, tier3?.network?.requestTimeoutMs, tier4.fallback.requestTimeoutMs) ?? 8_000,
+      retry: {
+        maxAttempts: firstDefined(tier1.network?.retry?.maxAttempts, tier2?.network?.retry?.maxAttempts, tier3?.network?.retry?.maxAttempts, tier4.fallback.retry.maxAttempts) ?? 3,
+        backoff: firstDefined(tier2?.network?.retry?.backoff, tier3?.network?.retry?.backoff, tier4.fallback.retry.backoff) ?? 'exponential-jitter',
+        baseDelayMs: firstDefined(tier1.network?.retry?.baseDelayMs, tier2?.network?.retry?.baseDelayMs, tier3?.network?.retry?.baseDelayMs, tier4.fallback.retry.baseDelayMs) ?? 500
+      }
+    },
+    stores: firstDefined(tier2?.stores, tier3?.stores) ?? tier4.stores,
+    policy: {
+      forceUpdateBelow: firstDefined(tier1.alerts?.forceUpdateBelow, tier2?.alerts?.forceUpdateBelow, tier3?.alerts?.forceUpdateBelow, tier4.policy.forceUpdateBelow ?? undefined) ?? null,
+      reminderIntervalMs: firstDefined(tier1.alerts?.reminderDelayMs, tier2?.alerts?.reminderDelayMs, tier3?.alerts?.reminderDelayMs, tier4.policy.reminderIntervalMs) ?? 259_200_000,
+      rolloutPercentage: tier4.policy.rolloutPercentage
+    },
+    strictReadiness: tier4.strictReadiness,
+    remoteConfigUrl: firstDefined(tier1.remoteConfigUrl, tier4.remoteConfigUrl ?? undefined) ?? null,
+    // security.* is tier-4-only, never overridden by a loaded document (§4.2).
+    security: tier4.security,
+    schemaVersion: firstDefined(tier1.schemaVersion, tier2?.schemaVersion, tier3?.schemaVersion, tier4.schemaVersion) ?? '1.0'
+  };
+}
+//# sourceMappingURL=ConfigResolutionPipeline.js.map

package/lib/module/data/config/ConfigResolutionPipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["ConsoleLogSink","resolveConfigSync","CONFIG_ENVELOPE_MAX_BYTES","BoundaryValidationException","ConfigSizeLimitExceededException","SchemaValidationException","SignatureVerificationException","UntrustedKeyIdException","toVersionManagerException","ConfigResolutionPipeline","quarantinedFingerprints","Set","consecutiveRemoteFailures","circuitOpenUntil","constructor","deps","resolve","defaults","tier4","trustedKeys","algorithm","security","signatureAlgorithm","keys","trustedKeyIds","envelopeTier1","envelopeTier3","Promise","all","envOverrides","read","catch","readLocal","remoteResult","readRemote","status","cached","cache","getLastValid","config","tier","tier2","payload","tier3","merged","mergeConfig","Object","length","setLastValid","raw","local","undefined","verified","validateAndVerify","url","remoteConfigUrl","clock","now","remote","fetch","timeoutMs","fallback","requestTimeoutMs","headers","configSources","remoteFetchHeaders","error","recordRemoteFailure","report","fingerprint","fingerprintOf","has","threshold","circuitBreakerThreshold","cooldown","circuitBreakerCooldownMs","sizeCheck","JSON","stringify","message","schemaResult","validator","validateSchema","valid","errors","join","metadata","envelope","parse","signature","keyId","add","sigResult","signatureVerifier","verify","reason","boundaryResult","validateBoundaries","Array","from","fieldErrors","fields","entries","stripFields","onError","write","level","timestamp","code","str","hash","i","Math","imul","charCodeAt","clone","path","segments","split","cursor","next","firstDefined","values","v","tier1","appVersion","localVersionIdentifier","logging","ttlMs","storage","bustOnManualCheck","onNetworkError","defaultConfig","network","retry","maxAttempts","backoff","baseDelayMs","stores","policy","forceUpdateBelow","alerts","reminderIntervalMs","reminderDelayMs","rolloutPercentage","strictReadiness","schemaVersion"],"sourceRoot":"../../../../src","sources":["data/config/ConfigResolutionPipeline.ts"],"mappings":";;AAAA,SAASA,cAAc,QAAQ,gCAA6B;AAC5D,SAASC,iBAAiB,QAAQ,mBAAgB;AAClD,SAASC,yBAAyB,QAAQ,8BAA2B;AAQrE,SACEC,2BAA2B,EAC3BC,gCAAgC,EAChCC,yBAAyB,EACzBC,8BAA8B,EAC9BC,uBAAuB,EACvBC,yBAAyB,QACpB,gDAA6C;AAoCpD;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,wBAAwB,CAAC;EACnBC,uBAAuB,GAAG,IAAIC,GAAG,CAAS,CAAC;EACpDC,yBAAyB,GAAG,CAAC;EAC7BC,gBAAgB,GAAG,CAAC;EAE5BC,WAAWA,CAAkBC,IAAkC,EAAE;IAAA,KAApCA,IAAkC,GAAlCA,IAAkC;EAAG;EAElE,MAAMC,OAAOA,CACXC,QAA+B,EACE;IACjC;IACA;IACA;IACA,MAAMC,KAAK,GAAGjB,iBAAiB,CAACgB,QAAQ,CAAC;IACzC,MAAME,WAA0B,GAAG;MACjCC,SAAS,EAAEF,KAAK,CAACG,QAAQ,CAACC,kBAAkB;MAC5CC,IAAI,EAAE,IAAIZ,GAAG,CAACO,KAAK,CAACG,QAAQ,CAACG,aAAa;IAC5C,CAAC;IAED,MAAM,CAACC,aAAa,EAAEC,aAAa,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CACvD,IAAI,CAACb,IAAI,CAACc,YAAY,CAACC,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAC/C,IAAI,CAACC,SAAS,CAACb,WAAW,CAAC,CAC5B,CAAC;IAEF,MAAMc,YAAY,GAAG,MAAM,IAAI,CAACC,UAAU,CAACjB,QAAQ,EAAEE,WAAW,CAAC;;IAEjE;IACA;IACA;IACA,IAAIc,YAAY,CAACE,MAAM,KAAK,QAAQ,EAAE;MACpC,MAAMC,MAAM,GAAG,MAAM,IAAI,CAACrB,IAAI,CAACsB,KAAK,CAACC,YAAY,CAAC,CAAC,CAACP,KAAK,CAAC,MAAM,IAAI,CAAC;MACrE,IAAIK,MAAM,EAAE;QACV,OAAO;UACLG,MAAM,EAAEH,MAAM;UACdI,IAAI,EAAE,QAAQ,CAAC;QACjB,CAAC;MACH;IACF;IAEA,MAAMC,KAAK,GAAGR,YAAY,CAACE,MAAM,KAAK,IAAI,GAAGF,YAAY,CAACS,OAAO,GAAG,IAAI;IACxE,MAAMC,KAAK,GAAGjB,aAAa;IAE3B,MAAMkB,MAAM,GAAGC,WAAW,CAAC3B,KAAK,EAAEyB,KAAK,EAAEF,KAAK,EAAEhB,aAAa,CAAC;IAC9D,MAAMe,IAAgB,GAAGC,KAAK,GAC1B,QAAQ,GACRE,KAAK,GACH,OAAO,GACPlB,aAAa,IAAIqB,MAAM,CAACvB,IAAI,CAACE,aAAa,CAAC,CAACsB,MAAM,GAAG,CAAC,GACpD,KAAK,GACL,SAAS;IAEjB,MAAM,IAAI,CAAChC,IAAI,CAACsB,KAAK,CAACW,YAAY,CAACJ,MAAM,CAAC,CAACb,KAAK,CAAC,MAAM;MACrD;MACA;MACA;IAAA,CACD,CAAC;IAEF,OAAO;MAAEQ,MAAM,EAAEK,MAAM;MAAEJ;IAAK,CAAC;EACjC;EAEA,MAAcR,SAASA,CACrBb,WAA0B,EACoB;IAC9C,MAAM8B,GAAG,GAAG,MAAM,IAAI,CAAClC,IAAI,CAACmC,KAAK,CAACpB,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,IAAI,CAAC;IAC1D,IAAIkB,GAAG,KAAK,IAAI,IAAIA,GAAG,KAAKE,SAAS,EAAE,OAAO,IAAI;IAElD,MAAMC,QAAQ,GAAG,MAAM,IAAI,CAACC,iBAAiB,CAACJ,GAAG,EAAE,OAAO,EAAE9B,WAAW,CAAC;IACxE,OAAOiC,QAAQ;EACjB;EAEA,MAAclB,UAAUA,CACtBjB,QAA+B,EAC/BE,WAA0B,EAK1B;IACA,MAAMmC,GAAG,GAAGrC,QAAQ,CAACsC,eAAe;IACpC,IAAI,CAACD,GAAG,EAAE,OAAO;MAAEnB,MAAM,EAAE;IAAS,CAAC;IAErC,IAAI,IAAI,CAACpB,IAAI,CAACyC,KAAK,CAACC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC5C,gBAAgB,EAAE;MACjD;MACA,OAAO;QAAEsB,MAAM,EAAE;MAAS,CAAC;IAC7B;IAEA,IAAIc,GAAsB;IAC1B,IAAI;MACFA,GAAG,GAAG,MAAM,IAAI,CAAClC,IAAI,CAAC2C,MAAM,CAACC,KAAK,CAACL,GAAG,EAAE;QACtCM,SAAS,EAAE3C,QAAQ,CAAC4C,QAAQ,EAAEC,gBAAgB,IAAI,KAAK;QACvDC,OAAO,EAAE9C,QAAQ,CAAC+C,aAAa,EAAEC;MACnC,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,IAAI,CAACC,mBAAmB,CAAC,CAAC;MAC1B,IAAI,CAACC,MAAM,CAAC5D,yBAAyB,CAAC0D,KAAK,CAAC,CAAC;MAC7C,OAAO;QAAE/B,MAAM,EAAE;MAAS,CAAC;IAC7B;IAEA,MAAMkC,WAAW,GAAGC,aAAa,CAACrB,GAAG,CAAC;IACtC,IAAI,IAAI,CAACvC,uBAAuB,CAAC6D,GAAG,CAACF,WAAW,CAAC,EAAE;MACjD;MACA;MACA,IAAI,CAACF,mBAAmB,CAAC,CAAC;MAC1B,OAAO;QAAEhC,MAAM,EAAE;MAAS,CAAC;IAC7B;IAEA,MAAMiB,QAAQ,GAAG,MAAM,IAAI,CAACC,iBAAiB,CAC3CJ,GAAG,EACH,QAAQ,EACR9B,WAAW,EACXkD,WACF,CAAC;IACD,IAAIjB,QAAQ,KAAK,IAAI,EAAE;MACrB,IAAI,CAACe,mBAAmB,CAAC,CAAC;MAC1B,OAAO;QAAEhC,MAAM,EAAE;MAAS,CAAC;IAC7B;IAEA,IAAI,CAACvB,yBAAyB,GAAG,CAAC;IAClC,IAAI,CAACC,gBAAgB,GAAG,CAAC;IACzB,OAAO;MAAEsB,MAAM,EAAE,IAAI;MAAEO,OAAO,EAAEU;IAAS,CAAC;EAC5C;EAEQe,mBAAmBA,CAAA,EAAS;IAClC,IAAI,CAACvD,yBAAyB,EAAE;IAChC,MAAM4D,SAAS,GAAG,IAAI,CAACzD,IAAI,CAAC0D,uBAAuB,IAAI,CAAC;IACxD,IAAI,IAAI,CAAC7D,yBAAyB,IAAI4D,SAAS,EAAE;MAC/C,MAAME,QAAQ,GAAG,IAAI,CAAC3D,IAAI,CAAC4D,wBAAwB,IAAI,CAAC,GAAG,MAAM;MACjE,IAAI,CAAC9D,gBAAgB,GAAG,IAAI,CAACE,IAAI,CAACyC,KAAK,CAACC,GAAG,CAAC,CAAC,GAAGiB,QAAQ;IAC1D;EACF;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE,MAAcrB,iBAAiBA,CAC7BJ,GAAsB,EACtBT,IAAwB,EACxBrB,WAA0B,EAC1BkD,WAAoB,EAC0B;IAC9C,MAAMO,SAAS,GACb,OAAO3B,GAAG,KAAK,QAAQ,GAAGA,GAAG,CAACF,MAAM,GAAG8B,IAAI,CAACC,SAAS,CAAC7B,GAAG,CAAC,CAACF,MAAM;IACnE,IAAI6B,SAAS,GAAG1E,yBAAyB,EAAE;MACzC,IAAI,CAACkE,MAAM,CACT,IAAIhE,gCAAgC,CAAC;QACnC2E,OAAO,EAAE,GAAGvC,IAAI,4BAA4BtC,yBAAyB;MACvE,CAAC,CACH,CAAC;MACD,OAAO,IAAI;IACb;IAEA,MAAM8E,YAAY,GAAG,IAAI,CAACjE,IAAI,CAACkE,SAAS,CAACC,cAAc,CAACjC,GAAG,CAAC;IAC5D,IAAI,CAAC+B,YAAY,CAACG,KAAK,EAAE;MACvB,IAAI,CAACf,MAAM,CACT,IAAI/D,yBAAyB,CAAC;QAC5B0E,OAAO,EAAE,GAAGvC,IAAI,8CAA8CwC,YAAY,CAACI,MAAM,CAACC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC9FC,QAAQ,EAAE;UAAE9C,IAAI;UAAE4C,MAAM,EAAEJ,YAAY,CAACI;QAAO;MAChD,CAAC,CACH,CAAC;MACD,OAAO,IAAI,CAAC,CAAC;IACf;IAEA,MAAMG,QAAQ,GACZ,OAAOtC,GAAG,KAAK,QAAQ,GAAG4B,IAAI,CAACW,KAAK,CAACvC,GAAG,CAAC,GAAGA,GACrB;;IAEzB;IACA;IACA,IACEsC,QAAQ,CAACE,SAAS,CAACrE,SAAS,KAAK,MAAM,IACvC,CAACD,WAAW,CAACI,IAAI,CAACgD,GAAG,CAACgB,QAAQ,CAACE,SAAS,CAACC,KAAK,CAAC,EAC/C;MACA,IAAI,CAACtB,MAAM,CACT,IAAI7D,uBAAuB,CAAC;QAC1BwE,OAAO,EAAE,GAAGvC,IAAI,4BAA4B+C,QAAQ,CAACE,SAAS,CAACC,KAAK,oCAAoC;QACxGJ,QAAQ,EAAE;UAAE9C;QAAK;MACnB,CAAC,CACH,CAAC;MACD,IAAI6B,WAAW,EAAE,IAAI,CAAC3D,uBAAuB,CAACiF,GAAG,CAACtB,WAAW,CAAC;MAC9D,OAAO,IAAI;IACb;IAEA,MAAMuB,SAAS,GAAG,MAAM,IAAI,CAAC7E,IAAI,CAAC8E,iBAAiB,CAACC,MAAM,CACxDP,QAAQ,EACRpE,WACF,CAAC;IACD,IAAI,CAACyE,SAAS,CAACT,KAAK,EAAE;MACpB,IAAI,CAACf,MAAM,CACT,IAAI9D,8BAA8B,CAAC;QACjCyE,OAAO,EAAE,GAAGvC,IAAI,0CAA0CoD,SAAS,CAACG,MAAM,IAAI,gBAAgB,EAAE;QAChGT,QAAQ,EAAE;UAAE9C;QAAK;MACnB,CAAC,CACH,CAAC;MACD,IAAI6B,WAAW,EAAE,IAAI,CAAC3D,uBAAuB,CAACiF,GAAG,CAACtB,WAAW,CAAC;MAC9D,OAAO,IAAI,CAAC,CAAC;IACf;;IAEA;IACA,MAAM2B,cAAc,GAAG,IAAI,CAACjF,IAAI,CAACkE,SAAS,CAACgB,kBAAkB,CAAChD,GAAG,CAAC;IAClE,IAAI,CAAC+C,cAAc,CAACb,KAAK,EAAE;MACzB,IAAI,CAACf,MAAM,CACT,IAAIjE,2BAA2B,CAAC;QAC9B4E,OAAO,EAAE,GAAGvC,IAAI,mDAAmD0D,KAAK,CAACC,IAAI,CAACH,cAAc,CAACI,WAAW,CAAC7E,IAAI,CAAC,CAAC,CAAC,CAAC8D,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7HC,QAAQ,EAAE;UACR9C,IAAI;UACJ6D,MAAM,EAAEH,KAAK,CAACC,IAAI,CAACH,cAAc,CAACI,WAAW,CAACE,OAAO,CAAC,CAAC;QACzD;MACF,CAAC,CACH,CAAC;MACD,OAAOC,WAAW,CAAChB,QAAQ,CAAC7C,OAAO,EAAEsD,cAAc,CAACI,WAAW,CAAC;IAClE;IAEA,OAAOb,QAAQ,CAAC7C,OAAO;EACzB;EAEQ0B,MAAMA,CAACF,KAA8B,EAAQ;IACnD,IAAI,IAAI,CAACnD,IAAI,CAACyF,OAAO,EAAE;MACrB,IAAI,CAACzF,IAAI,CAACyF,OAAO,CAACtC,KAAK,CAAC;IAC1B,CAAC,MAAM;MACL,IAAIlE,cAAc,CAAC,CAAC,CAACyG,KAAK,CAAC;QACzBC,KAAK,EAAE,OAAO;QACd3B,OAAO,EAAEb,KAAK,CAACa,OAAO;QACtB4B,SAAS,EAAE,IAAI,CAAC5F,IAAI,CAACyC,KAAK,CAACC,GAAG,CAAC,CAAC;QAChC6B,QAAQ,EAAE;UAAEsB,IAAI,EAAE1C,KAAK,CAAC0C;QAAK;MAC/B,CAAC,CAAC;IACJ;EACF;AACF;AAEA,SAAStC,aAAaA,CAACrB,GAAsB,EAAU;EACrD,MAAM4D,GAAG,GAAG,OAAO5D,GAAG,KAAK,QAAQ,GAAGA,GAAG,GAAG4B,IAAI,CAACC,SAAS,CAAC7B,GAAG,CAAC;EAC/D;EACA;EACA,IAAI6D,IAAI,GAAG,CAAC;EACZ,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGF,GAAG,CAAC9D,MAAM,EAAEgE,CAAC,EAAE,EAAE;IACnCD,IAAI,GAAIE,IAAI,CAACC,IAAI,CAAC,EAAE,EAAEH,IAAI,CAAC,GAAGD,GAAG,CAACK,UAAU,CAACH,CAAC,CAAC,GAAI,CAAC;EACtD;EACA,OAAO,GAAGF,GAAG,CAAC9D,MAAM,IAAI+D,IAAI,EAAE;AAChC;AAEA,SAASP,WAAWA,CAClB7D,OAAqC,EACrC0D,WAAwC,EACV;EAC9B,MAAMe,KAA8B,GAAGtC,IAAI,CAACW,KAAK,CAACX,IAAI,CAACC,SAAS,CAACpC,OAAO,CAAC,CAAC;EAC1E,KAAK,MAAM0E,IAAI,IAAIhB,WAAW,CAAC7E,IAAI,CAAC,CAAC,EAAE;IACrC,MAAM8F,QAAQ,GAAGD,IAAI,CAACE,KAAK,CAAC,GAAG,CAAC;IAChC,IAAIC,MAA+B,GAAGJ,KAAK;IAC3C,KAAK,IAAIJ,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGM,QAAQ,CAACtE,MAAM,GAAG,CAAC,EAAEgE,CAAC,EAAE,EAAE;MAC5C,MAAMS,IAAI,GAAGD,MAAM,CAACF,QAAQ,CAACN,CAAC,CAAC,CAAW;MAC1C,IAAI,OAAOS,IAAI,KAAK,QAAQ,IAAIA,IAAI,KAAK,IAAI,EAAE;MAC/CD,MAAM,GAAGC,IAA+B;IAC1C;IACA,OAAOD,MAAM,CAACF,QAAQ,CAACA,QAAQ,CAACtE,MAAM,GAAG,CAAC,CAAC,CAAW;EACxD;EACA,OAAOoE,KAAK;AACd;AAEA,SAASM,YAAYA,CAAI,GAAGC,MAAgC,EAAiB;EAC3E,KAAK,MAAMC,CAAC,IAAID,MAAM,EAAE;IACtB,IAAIC,CAAC,KAAKxE,SAAS,IAAIwE,CAAC,KAAK,IAAI,EAAE,OAAOA,CAAC;EAC7C;EACA,OAAOxE,SAAS;AAClB;;AAEA;AACA;AACA;AACA;AACA;AACA,SAASN,WAAWA,CAClB3B,KAAmC,EACnCyB,KAA0C,EAC1CF,KAA0C,EAC1CmF,KAA4C,EACd;EAC9B,OAAO;IACLC,UAAU,EACRJ,YAAY,CAACG,KAAK,CAACE,sBAAsB,EAAE5G,KAAK,CAAC2G,UAAU,CAAC,IAAI,IAAI;IACtEE,OAAO,EAAE7G,KAAK,CAAC6G,OAAO;IACtB1F,KAAK,EAAE;MACL2F,KAAK,EACHP,YAAY,CACVG,KAAK,CAACvF,KAAK,EAAE2F,KAAK,EAClBvF,KAAK,EAAEJ,KAAK,EAAE2F,KAAK,EACnBrF,KAAK,EAAEN,KAAK,EAAE2F,KAAK,EACnB9G,KAAK,CAACmB,KAAK,CAAC2F,KACd,CAAC,IAAI,UAAU;MACjBC,OAAO,EACLR,YAAY,CACVhF,KAAK,EAAEJ,KAAK,EAAE4F,OAAO,EACrBtF,KAAK,EAAEN,KAAK,EAAE4F,OAAO,EACrB/G,KAAK,CAACmB,KAAK,CAAC4F,OACd,CAAC,IAAI,YAAY;MACnBC,iBAAiB,EAAEhH,KAAK,CAACmB,KAAK,CAAC6F;IACjC,CAAC;IACDrE,QAAQ,EAAE;MACRsE,cAAc,EAAEjH,KAAK,CAAC2C,QAAQ,CAACsE,cAAc;MAC7CC,aAAa,EAAElH,KAAK,CAAC2C,QAAQ,CAACuE,aAAa;MAC3CtE,gBAAgB,EACd2D,YAAY,CACVG,KAAK,CAACS,OAAO,EAAEvE,gBAAgB,EAC/BrB,KAAK,EAAE4F,OAAO,EAAEvE,gBAAgB,EAChCnB,KAAK,EAAE0F,OAAO,EAAEvE,gBAAgB,EAChC5C,KAAK,CAAC2C,QAAQ,CAACC,gBACjB,CAAC,IAAI,KAAK;MACZwE,KAAK,EAAE;QACLC,WAAW,EACTd,YAAY,CACVG,KAAK,CAACS,OAAO,EAAEC,KAAK,EAAEC,WAAW,EACjC9F,KAAK,EAAE4F,OAAO,EAAEC,KAAK,EAAEC,WAAW,EAClC5F,KAAK,EAAE0F,OAAO,EAAEC,KAAK,EAAEC,WAAW,EAClCrH,KAAK,CAAC2C,QAAQ,CAACyE,KAAK,CAACC,WACvB,CAAC,IAAI,CAAC;QACRC,OAAO,EACLf,YAAY,CACVhF,KAAK,EAAE4F,OAAO,EAAEC,KAAK,EAAEE,OAAO,EAC9B7F,KAAK,EAAE0F,OAAO,EAAEC,KAAK,EAAEE,OAAO,EAC9BtH,KAAK,CAAC2C,QAAQ,CAACyE,KAAK,CAACE,OACvB,CAAC,IAAI,oBAAoB;QAC3BC,WAAW,EACThB,YAAY,CACVG,KAAK,CAACS,OAAO,EAAEC,KAAK,EAAEG,WAAW,EACjChG,KAAK,EAAE4F,OAAO,EAAEC,KAAK,EAAEG,WAAW,EAClC9F,KAAK,EAAE0F,OAAO,EAAEC,KAAK,EAAEG,WAAW,EAClCvH,KAAK,CAAC2C,QAAQ,CAACyE,KAAK,CAACG,WACvB,CAAC,IAAI;MACT;IACF,CAAC;IACDC,MAAM,EAAEjB,YAAY,CAAChF,KAAK,EAAEiG,MAAM,EAAE/F,KAAK,EAAE+F,MAAM,CAAC,IAAIxH,KAAK,CAACwH,MAAM;IAClEC,MAAM,EAAE;MACNC,gBAAgB,EACdnB,YAAY,CACVG,KAAK,CAACiB,MAAM,EAAED,gBAAgB,EAC9BnG,KAAK,EAAEoG,MAAM,EAAED,gBAAgB,EAC/BjG,KAAK,EAAEkG,MAAM,EAAED,gBAAgB,EAC/B1H,KAAK,CAACyH,MAAM,CAACC,gBAAgB,IAAIzF,SACnC,CAAC,IAAI,IAAI;MACX2F,kBAAkB,EAChBrB,YAAY,CACVG,KAAK,CAACiB,MAAM,EAAEE,eAAe,EAC7BtG,KAAK,EAAEoG,MAAM,EAAEE,eAAe,EAC9BpG,KAAK,EAAEkG,MAAM,EAAEE,eAAe,EAC9B7H,KAAK,CAACyH,MAAM,CAACG,kBACf,CAAC,IAAI,WAAW;MAClBE,iBAAiB,EAAE9H,KAAK,CAACyH,MAAM,CAACK;IAClC,CAAC;IACDC,eAAe,EAAE/H,KAAK,CAAC+H,eAAe;IACtC1F,eAAe,EACbkE,YAAY,CAACG,KAAK,CAACrE,eAAe,EAAErC,KAAK,CAACqC,eAAe,IAAIJ,SAAS,CAAC,IACvE,IAAI;IACN;IACA9B,QAAQ,EAAEH,KAAK,CAACG,QAAQ;IACxB6H,aAAa,EACXzB,YAAY,CACVG,KAAK,CAACsB,aAAa,EACnBzG,KAAK,EAAEyG,aAAa,EACpBvG,KAAK,EAAEuG,aAAa,EACpBhI,KAAK,CAACgI,aACR,CAAC,IAAI;EACT,CAAC;AACH","ignoreList":[]}