@sentropic/h2a-runtime 0.98.6 → 0.98.7-rc.2

package/dist/gateway-host/live-object-store.js

@@ -0,0 +1,447 @@
+/** R1 (LIVE §4): host-owned committed objects, never an alternate or a checkout.
+ * The composition owner supplies an authorized clone/scope and local source.
+ * No source config, refs, hooks, transport or credentials are consulted here.
+ * Receipt publication follows pack verification, private pin and durable sync.
+ */
+import { execFileSync, spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, createWriteStream, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { validateLiveScope, validateRetentionReceipt, validateRetentionRequest, } from "../vendor/engram-live/contracts.js";
+const snapshot = (value) => JSON.parse(JSON.stringify(value));
+const canonicalPath = (path) => existsSync(path) ? realpathSync(path) : resolve(path);
+const within = (parent, child) => {
+    const tail = relative(parent, child);
+    return tail === "" || (!isAbsolute(tail) && tail !== ".." && !tail.startsWith(`..${sep}`));
+};
+function syncPath(path) {
+    const fd = openSync(path, "r");
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function durableJson(path, value, generation) {
+    const tmp = generation ? join(generation, `${randomUUID()}.tmp`) : `${path}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(value) + "\n", { mode: 0o600, flag: "wx" });
+        syncPath(tmp);
+        renameSync(tmp, path);
+        syncPath(resolve(path, ".."));
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+}
+function syncTree(path) {
+    for (const name of readdirSync(path)) {
+        const file = join(path, name);
+        if (statSync(file).isDirectory())
+            syncTree(file);
+        else
+            syncPath(file);
+    }
+    syncPath(path);
+}
+function bytesIn(path) {
+    return readdirSync(path).reduce((sum, name) => {
+        const file = join(path, name);
+        const stat = statSync(file);
+        return sum + (stat.isDirectory() ? bytesIn(file) : stat.size);
+    }, 0);
+}
+// Only the observed generation is removed; age authorizes fencing, never
+// concurrent shared writes. Publications consume sources in that generation.
+function takeoverStaleLock(lockPath) {
+    let observed;
+    try {
+        observed = readdirSync(lockPath);
+        if (Date.now() - statSync(lockPath).mtimeMs <= 60_000)
+            throw new Error("store_busy");
+    }
+    catch (error) {
+        if (error.message === "store_busy")
+            throw error;
+        if (error.code === "ENOENT" || !existsSync(lockPath))
+            throw new Error("store_busy");
+        throw error;
+    }
+    for (const oldToken of observed)
+        rmSync(join(lockPath, oldToken), { recursive: true, force: true });
+    try {
+        rmdirSync(lockPath);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw new Error("store_busy");
+    }
+}
+export function createLiveObjectStore(options) {
+    const scope = snapshot(options.scope);
+    const algorithm = options.algorithm;
+    if (!validateLiveScope(scope).ok || scope.worktree !== undefined)
+        throw new Error("invalid retention scope");
+    if (algorithm !== "sha1" && algorithm !== "sha256")
+        throw new Error("invalid retention algorithm");
+    if (!Number.isSafeInteger(options.quotaBytes) || options.quotaBytes < 0)
+        throw new Error("invalid object quota");
+    const quota = options.quotaBytes;
+    const root = realpathSync(options.root);
+    const commonDir = canonicalPath(options.source.commonDir);
+    for (const source of [commonDir, ...options.source.worktreeRoots.map(canonicalPath)]) {
+        if (within(source, root) || within(root, source))
+            throw new Error("private object store must be outside source roots");
+    }
+    const scopeKey = createHash("sha256").update(JSON.stringify([scope.tenant, scope.clone])).digest("hex");
+    const metadataDir = join(root, "live-object-store", scopeKey, algorithm);
+    const gitDir = join(metadataDir, "objects.git");
+    const requests = join(metadataDir, "requests");
+    const receipts = join(metadataDir, "receipts");
+    const gaps = join(metadataDir, "gaps");
+    const empty = join(metadataDir, "empty");
+    for (const dir of [join(root, "live-object-store"), join(root, "live-object-store", scopeKey), metadataDir, requests, receipts, gaps, empty]) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const noConfig = join(metadataDir, "no-config");
+    if (!existsSync(noConfig))
+        writeFileSync(noConfig, "", { mode: 0o600, flag: "wx" });
+    // Whitelist the environment: inherited Git config, alternates, SSH commands,
+    // credentials, templates and exec-path overrides must never reach Git.
+    const env = {
+        PATH: process.env.PATH, HOME: metadataDir, XDG_CONFIG_HOME: metadataDir,
+        XDG_RUNTIME_DIR: metadataDir, TMPDIR: metadataDir,
+        GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_SYSTEM: noConfig, GIT_CONFIG_GLOBAL: noConfig,
+        GIT_TERMINAL_PROMPT: "0", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1",
+        GIT_OPTIONAL_LOCKS: "0", GIT_ATTR_NOSYSTEM: "1", LC_ALL: "C",
+    };
+    const flags = ["--no-optional-locks", "-c", `core.hooksPath=${empty}`, "-c", "core.fsmonitor=false",
+        "-c", "protocol.allow=never", "-c", "gc.auto=0", "-c", "maintenance.auto=false"];
+    const git = (dir, args, extraEnv = {}) => execFileSync("git", [...flags, `--git-dir=${dir}`, ...args], {
+        cwd: metadataDir, env: { ...env, ...extraEnv }, encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"], timeout: 30_000, maxBuffer: 1024 * 1024,
+    }).trim();
+    const init = (dir) => {
+        git(dir, ["init", "--bare", `--object-format=${algorithm}`, `--template=${empty}`, dir]);
+        // git init honors the caller's umask for its top directory. Create that
+        // directory ourselves before invoking it (all descendants stay protected).
+    };
+    if (!existsSync(join(gitDir, "HEAD"))) {
+        mkdirSync(gitDir, { mode: 0o700 });
+        init(gitDir);
+    }
+    mkdirSync(join(gitDir, "refs", "h2a", "retained"), { recursive: true, mode: 0o700 });
+    const acquisitionLockPath = join(metadataDir, "acquisition.lock");
+    const checkScope = (candidate, format) => {
+        if (!validateLiveScope(candidate).ok || candidate.worktree !== undefined ||
+            candidate.tenant !== scope.tenant || candidate.clone !== scope.clone)
+            throw new Error("retention scope mismatch");
+        if (format !== algorithm)
+            throw new Error("retention algorithm mismatch");
+    };
+    const pin = (oid) => `refs/h2a/retained/${oid}`;
+    const backupRef = (oid) => `h2a-live-object:${scopeKey}:${algorithm}:${oid}`;
+    const requestPath = (oid) => join(requests, `${oid}.json`);
+    const receiptPath = (oid) => join(receipts, `${oid}.json`);
+    const acknowledgePin = (oid, generation) => {
+        durableJson(receiptPath(oid), { scope, algorithm, oid,
+            receivedAt: (options.now ?? Date.now)(), backupRef: backupRef(oid) }, generation);
+    };
+    const readRequest = (oid) => {
+        const request = JSON.parse(readFileSync(requestPath(oid), "utf8"));
+        if (!validateRetentionRequest(request).ok || request.oid !== oid)
+            throw new Error("invalid durable retention request");
+        checkScope(request.scope, request.algorithm);
+        return request;
+    };
+    const verified = (dir, oid) => {
+        if (git(dir, ["cat-file", "-t", oid]) !== "commit")
+            throw new Error("retention root must be committed history");
+        // Includes parents, trees and blobs. A tip alone is never sufficient.
+        git(dir, ["fsck", "--strict", "--no-reflogs", "--no-dangling", oid]);
+    };
+    async function recordReceipt(candidate) {
+        const receipt = snapshot(candidate);
+        if (!validateRetentionReceipt(receipt).ok)
+            throw new Error("invalid retention receipt scope or fields");
+        checkScope(receipt.scope, receipt.algorithm);
+        if (!existsSync(requestPath(receipt.oid)))
+            throw new Error("retention receipt has no recorded request");
+        readRequest(receipt.oid);
+        if (receipt.backupRef !== backupRef(receipt.oid))
+            throw new Error("retention backup reference mismatch");
+        if (git(gitDir, ["rev-parse", "--verify", pin(receipt.oid)]) !== receipt.oid)
+            throw new Error("unprotected retention pin");
+        if (hasReceipt(receipt.oid))
+            return { received: true };
+        await withAcquisitionLock(async (generation) => {
+            verified(gitDir, receipt.oid);
+            syncTree(gitDir);
+            durableJson(receiptPath(receipt.oid), receipt, generation);
+        });
+        return { received: true };
+    }
+    // Single-receipt fast path: one file read plus one rev-parse, no full scan
+    // and no fsck. recordRequest uses this instead of a full load per request.
+    function hasReceipt(oid) {
+        try {
+            if (!existsSync(receiptPath(oid)))
+                return false;
+            const receipt = JSON.parse(readFileSync(receiptPath(oid), "utf8"));
+            if (!validateRetentionReceipt(receipt).ok || receipt.oid !== oid)
+                return false;
+            if (receipt.scope.tenant !== scope.tenant || receipt.scope.clone !== scope.clone ||
+                receipt.scope.worktree !== undefined || receipt.algorithm !== algorithm)
+                return false;
+            if (receipt.backupRef !== backupRef(oid))
+                return false;
+            readRequest(oid);
+            return git(gitDir, ["rev-parse", "--verify", pin(oid)]) === oid;
+        }
+        catch {
+            return false;
+        }
+    }
+    async function loadReceipts(query) {
+        checkScope(query.scope, query.algorithm);
+        const loaded = [];
+        for (const name of readdirSync(receipts).filter((name) => name.endsWith(".json")).sort()) {
+            // Quarantine: one corrupt receipt, foreign receipt, missing request or
+            // missing pin skips that entry instead of failing the whole pass. The
+            // skipped OID stays pending and is reacquired on retry.
+            try {
+                const receipt = JSON.parse(readFileSync(join(receipts, name), "utf8"));
+                if (!validateRetentionReceipt(receipt).ok || name !== `${receipt.oid}.json`)
+                    continue;
+                if (receipt.scope.tenant !== scope.tenant || receipt.scope.clone !== scope.clone ||
+                    receipt.scope.worktree !== undefined || receipt.algorithm !== algorithm)
+                    continue;
+                try {
+                    readRequest(receipt.oid);
+                }
+                catch {
+                    continue;
+                }
+                if (receipt.backupRef !== backupRef(receipt.oid))
+                    continue;
+                let pinned;
+                try {
+                    pinned = git(gitDir, ["rev-parse", "--verify", pin(receipt.oid)]);
+                }
+                catch {
+                    continue;
+                }
+                if (pinned !== receipt.oid)
+                    continue;
+                loaded.push(receipt);
+            }
+            catch {
+                continue;
+            }
+        }
+        return { receipts: loaded };
+    }
+    async function acquire(request, stage) {
+        // This git-dir has only host-created config. Only immutable source objects
+        // are exposed to pack-objects; source refs/config/index are never loaded.
+        const sourceObjects = join(commonDir, "objects");
+        // Borrowing a source alternate would make both authority and availability
+        // ambiguous. Report a gap; never create an alternate in the private store.
+        if (existsSync(join(sourceObjects, "info", "alternates")))
+            throw new Error("source alternates not authorized");
+        const remaining = quota - bytesIn(join(gitDir, "objects"));
+        if (remaining <= 0)
+            throw new Error("quota_exhausted");
+        // Exclude retained history using only host-owned refs. The private store
+        // is a read-only, ephemeral alternate for this command, so exclusions
+        // also work after the corresponding root disappeared from the source.
+        const incoming = join(stage, "incoming.pack");
+        const child = spawn("git", [...flags, `--git-dir=${stage}`, "pack-objects", "--stdout", "--revs",
+            "--no-use-bitmap-index", "--no-reuse-delta", "--no-reuse-object"], {
+            cwd: metadataDir, env: { ...env, GIT_OBJECT_DIRECTORY: sourceObjects, GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, "objects") }, stdio: ["pipe", "pipe", "pipe"],
+        });
+        const closed = new Promise((resolve, reject) => {
+            child.once("error", reject);
+            child.once("close", resolve);
+        });
+        // Stream exclusions with backpressure: the number of retained refs has no
+        // fixed ceiling and must never be limited by execFileSync's maxBuffer.
+        const retained = spawn("git", [...flags, `--git-dir=${gitDir}`, "for-each-ref",
+            "--format=^%(objectname)", "refs/h2a/retained"], {
+            cwd: metadataDir, env, stdio: ["ignore", "pipe", "pipe"],
+        });
+        const retainedClosed = new Promise((resolve, reject) => {
+            retained.once("error", reject);
+            retained.once("close", resolve);
+        });
+        // Drain errors, but never retain/log potentially sensitive source text.
+        child.stderr.resume();
+        retained.stderr.resume();
+        child.stdin.on("error", () => { });
+        child.stdin.write(`${request.oid}\n`);
+        let count = 0;
+        let timedOut = false;
+        const timer = setTimeout(() => { timedOut = true; child.kill("SIGKILL"); retained.kill("SIGKILL"); }, 30_000);
+        const transfers = [
+            pipeline(retained.stdout, child.stdin),
+            pipeline(child.stdout, new Transform({ transform(chunk, _encoding, callback) {
+                    count += chunk.length;
+                    callback(count > remaining ? new Error("quota_exhausted") : null, count > remaining ? undefined : chunk);
+                } }), createWriteStream(incoming, { flags: "wx", mode: 0o600 })),
+        ];
+        try {
+            const [code, retainedCode] = await Promise.all([closed, retainedClosed, ...transfers]);
+            if (code !== 0 || retainedCode !== 0 || timedOut)
+                throw new Error("objects_unavailable");
+        }
+        finally {
+            clearTimeout(timer);
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill("SIGKILL");
+            if (retained.exitCode === null && retained.signalCode === null)
+                retained.kill("SIGKILL");
+            await Promise.allSettled([closed, retainedClosed, ...transfers]);
+        }
+        // index-pack writes alongside incoming; move the complete verified
+        // pair into staging's object db before connectivity verification.
+        writeFileSync(join(stage, "objects", "info", "alternates"), join(gitDir, "objects") + "\n", { flag: "wx", mode: 0o600 });
+        const hash = git(stage, ["index-pack", "--strict", incoming]);
+        const stagedPacks = join(stage, "objects", "pack");
+        renameSync(incoming, join(stagedPacks, `pack-${hash}.pack`));
+        renameSync(join(stage, "incoming.idx"), join(stagedPacks, `pack-${hash}.idx`));
+        // Closure is verified over the incoming objects plus retained objects;
+        // this alternate exists only inside the disposable acquisition generation.
+        verified(stage, request.oid);
+        if (bytesIn(join(gitDir, "objects")) + bytesIn(stagedPacks) > quota)
+            throw new Error("quota_exhausted");
+        // Install the pack before its index. A crash can leave an unindexed
+        // orphan pack, never an index referring to an absent pack.
+        for (const name of readdirSync(stagedPacks).sort((a, b) => Number(b.endsWith(".pack")) - Number(a.endsWith(".pack")))) {
+            renameSync(join(stagedPacks, name), join(gitDir, "objects", "pack", name));
+        }
+        syncTree(join(gitDir, "objects"));
+        // Every publication consumes a source in this generation. A takeover
+        // removes those sources before a successor is admitted; even a holder
+        // suspended inside rename cannot publish after being fenced.
+        const stagedPin = join(stage, "pin");
+        writeFileSync(stagedPin, request.oid + "\n", { flag: "wx", mode: 0o600 });
+        syncPath(stagedPin);
+        renameSync(stagedPin, join(gitDir, pin(request.oid)));
+        syncPath(join(gitDir, "refs", "h2a", "retained"));
+        syncPath(join(gitDir, "refs", "h2a"));
+        syncPath(join(gitDir, "refs"));
+        syncPath(gitDir);
+        syncPath(metadataDir);
+        acknowledgePin(request.oid, stage);
+    }
+    async function withAcquisitionLock(action) {
+        const token = randomUUID();
+        const candidate = `${acquisitionLockPath}.${token}.candidate`;
+        const generation = join(acquisitionLockPath, token);
+        let locked = false;
+        try {
+            mkdirSync(candidate, { mode: 0o700 });
+            mkdirSync(join(candidate, token), { mode: 0o700 });
+            init(join(candidate, token));
+            for (;;) {
+                try {
+                    renameSync(candidate, acquisitionLockPath);
+                    locked = true;
+                    break;
+                }
+                catch (error) {
+                    if (!["EEXIST", "ENOTEMPTY"].includes(error.code ?? ""))
+                        throw error;
+                }
+                takeoverStaleLock(acquisitionLockPath);
+            }
+            await action(generation);
+        }
+        finally {
+            rmSync(candidate, { recursive: true, force: true });
+            if (locked) {
+                rmSync(generation, { recursive: true, force: true });
+                try {
+                    rmdirSync(acquisitionLockPath);
+                }
+                catch (error) {
+                    if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error.code ?? ""))
+                        throw error;
+                }
+            }
+        }
+    }
+    async function recordRequest(input) {
+        const request = snapshot(input);
+        if (!validateRetentionRequest(request).ok)
+            throw new Error("invalid retention request scope or fields");
+        checkScope(request.scope, request.algorithm);
+        if (!existsSync(requestPath(request.oid)))
+            durableJson(requestPath(request.oid), request);
+        else
+            readRequest(request.oid);
+        if (hasReceipt(request.oid))
+            return { received: true };
+        try {
+            await withAcquisitionLock(async (generation) => {
+                try {
+                    let pinned = false;
+                    try {
+                        pinned = git(gitDir, ["rev-parse", "--verify", pin(request.oid)]) === request.oid;
+                    }
+                    catch { /* not acquired */ }
+                    if (pinned) {
+                        // Recover a pin whose receipt was interrupted, without the source.
+                        verified(gitDir, request.oid);
+                        syncTree(gitDir);
+                        acknowledgePin(request.oid, generation);
+                    }
+                    else
+                        await acquire(request, generation);
+                }
+                catch (error) {
+                    const code = error.code;
+                    if (code && ["EACCES", "EROFS", "EIO", "ENOSPC"].includes(code))
+                        throw error;
+                    // A fenced holder cannot overwrite its successor's gap or receipt.
+                    if (!existsSync(generation))
+                        return;
+                    const reason = error.message === "quota_exhausted" ? "quota_exhausted" : "objects_unavailable";
+                    try {
+                        durableJson(join(gaps, `${request.oid}.json`), { reason }, generation);
+                    }
+                    catch (failure) {
+                        if (failure.code !== "ENOENT")
+                            throw failure;
+                    }
+                }
+            });
+        }
+        catch (error) {
+            if (error.message !== "store_busy")
+                throw error;
+            // Durable request remains pending; contention never writes a shared gap.
+        }
+        return { received: true };
+    }
+    async function pending() {
+        const acknowledged = new Set((await loadReceipts({ scope, algorithm })).receipts.map((receipt) => receipt.oid));
+        return readdirSync(requests).filter((name) => name.endsWith(".json")).sort().flatMap((name) => {
+            const request = readRequest(name.slice(0, -5));
+            if (acknowledged.has(request.oid))
+                return [];
+            const gapPath = join(gaps, name);
+            const reason = existsSync(gapPath) ? JSON.parse(readFileSync(gapPath, "utf8")).reason : "store_busy";
+            return [{ request, reason }];
+        });
+    }
+    return { gitDir, acquisitionLockPath, recordRequest, recordReceipt, loadReceipts, pending,
+        async retryPending() { for (const { request } of await pending())
+            await recordRequest(request); },
+        backupManifest: () => ({ gitDir, metadataDir, scope: snapshot(scope) }),
+    };
+}
+//# sourceMappingURL=live-object-store.js.map

package/dist/gateway-host/live-object-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-object-store.js","sourceRoot":"","sources":["../../src/gateway-host/live-object-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EACxE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAChG,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EACL,iBAAiB,EAAE,wBAAwB,EAAE,wBAAwB,GAGtE,MAAM,oCAAoC,CAAC;AAwB5C,MAAM,QAAQ,GAAG,CAAI,KAAQ,EAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAC5E,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAW,EAAE;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACnF,CAAC;AACD,SAAS,WAAW,CAAC,IAAY,EAAE,KAAc,EAAE,UAAmB;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IACjG,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAC7C,CAAC;AACD,SAAS,QAAQ,CAAC,IAAY;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;;YAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjB,CAAC;AACD,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,EAAE,CAAC,CAAC,CAAC;AACR,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAe,CAAC,OAAO,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAC3D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/G,MAAM,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC;QAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAC5B,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC3E,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7G,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;IACjC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxG,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjF,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7I,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW;QACvE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW;QACjD,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ;QAClF,mBAAmB,EAAE,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG;QAC7E,kBAAkB,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG;KAC7D,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB;QACjG,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,WAA8B,EAAE,EAAU,EAAE,CACpF,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE;QAC3D,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM;QAChE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI;KAC3E,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;QAC3B,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,mBAAmB,SAAS,EAAE,EAAE,cAAc,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACzF,wEAAwE;QACxE,2EAA2E;IAC7E,CAAC,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAAC,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC5F,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,SAAoB,EAAE,MAAoB,EAAE,EAAE;QAChE,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS;YACpE,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACtH,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5E,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,qBAAqB,GAAG,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,mBAAmB,QAAQ,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;IACrF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,UAAkB,EAAE,EAAE;QACzD,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG;YACnD,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACtF,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAuB,EAAE;QACvD,MAAM,OAAO,GAAwB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvH,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,OAAO,CAAC;IAC/D,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAClD,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChH,sEAAsE;QACtE,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC;IAEF,KAAK,UAAU,aAAa,CAAC,SAA8B;QACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACxG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACxG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3H,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvD,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,SAAS,UAAU,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAChD,MAAM,OAAO,GAAwB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC/E,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;gBAC5E,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC1F,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvD,WAAW,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,KAA4B;QACtD,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAA0B,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzF,uEAAuE;YACvE,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAwB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC5F,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,OAAO;oBAAE,SAAS;gBACtF,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;oBAC5E,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;oBAAE,SAAS;gBACtF,IAAI,CAAC;oBAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACrD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC3D,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC9F,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG;oBAAE,SAAS;gBACrC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAA4B,EAAE,KAAa;QAChE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjD,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC/G,MAAM,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3D,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvD,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,aAAa,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ;YAC9F,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,EAAE;YACnE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,oBAAoB,EAAE,aAAa,EAAE,gCAAgC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACnK,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,aAAa,MAAM,EAAE,EAAE,cAAc;YAC5E,yBAAyB,EAAE,mBAAmB,CAAC,EAAE;YACjD,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,wEAAwE;QACxE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAChD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACzE,IAAI,KAAK,GAAG,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9G,MAAM,SAAS,GAAG;YAChB,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;YACtC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;oBACjF,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;oBACtB,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC3G,CAAC,EAAE,CAAC,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACjE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;YACvF,IAAI,IAAI,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC3F,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzF,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC;QAC7D,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC;QAC/E,uEAAuE;QACvE,2EAA2E;QAC3E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxG,oEAAoE;QACpE,2DAA2D;QAC3D,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAClC,qEAAqE;QACrE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxF,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,mBAAmB,CAAC,MAA6C;QAC9E,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,GAAG,mBAAmB,IAAI,KAAK,YAAY,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7B,SAAS,CAAC;gBACR,IAAI,CAAC;oBAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,MAAM;gBAAC,CAAC;gBACzE,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;wBAAE,MAAM,KAAK,CAAC;gBAClG,CAAC;gBACD,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC;oBAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;gBAAC,CAAC;gBACvC,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC;wBAAE,MAAM,KAAK,CAAC;gBAAC,CAAC;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,KAA0B;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACxG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;;YACrF,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;gBAC3C,IAAI,CAAC;oBACH,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,IAAI,CAAC;wBAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;oBACvH,IAAI,MAAM,EAAE,CAAC;wBACX,mEAAmE;wBACnE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;wBAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAChD,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;oBAC1C,CAAC;;wBAAM,MAAM,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;oBACnD,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC7E,mEAAmE;oBACnE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;wBAAE,OAAO;oBACpC,MAAM,MAAM,GAAS,KAAe,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,CAAC;oBAC/G,IAAI,CAAC;wBAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;oBAAC,CAAC;oBAC/E,OAAO,OAAO,EAAE,CAAC;wBAAC,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,OAAO,CAAC;oBAAC,CAAC;gBAC9F,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAe,CAAC,OAAO,KAAK,YAAY;gBAAE,MAAM,KAAK,CAAC;YAC3D,yEAAyE;QAC3E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,UAAU,OAAO;QACpB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAChH,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5F,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAQ,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YAC1G,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO;QACvF,KAAK,CAAC,YAAY,KAAK,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,OAAO,EAAE;YAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjG,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/gateway-host/live-registration.d.ts

@@ -0,0 +1,162 @@
+import { NON_ACTIVATING_LIFECYCLE_KINDS } from "../vendor/engram-live/contracts.js";
+import type { DeclarationRevocationDto, IdentityUncertaintyState, NonActivatingLifecycleKind, OidAlgorithm, RevocationReason } from "../vendor/engram-live/contracts.js";
+import { type LiveDeclarationRecord } from "./live-declarations.js";
+export declare function normalizeRootCommits(shas: ReadonlyArray<string>): string;
+export declare function computeDurableWorkspaceId(rootCommitSHA: string, worktreeRelPath: string): string;
+export interface LiveWorkspaceProbe {
+    /** Authorized root: resolved real path of the observed worktree. */
+    readonly worktreeRealpath: string;
+    /** Resolved git-dir (`.git/worktrees/<name>` for a linked worktree). */
+    readonly gitDir: string;
+    /** Resolved common-dir real path, shared by linked worktrees. */
+    readonly commonDirRealpath: string;
+    /** "" for the main worktree, else the linked-worktree name. */
+    readonly worktreeName: string;
+    /** Repository object format; undefined when Git cannot report it. */
+    readonly oidAlgorithm?: OidAlgorithm;
+    /** Normalized root commits; undefined when history is missing. */
+    readonly rootCommits?: string;
+    /** Preserved public `ws:` fingerprint; absent with missing_history. */
+    readonly workspaceFingerprint?: string;
+    /** Project fingerprint (empty main-worktree component); may be absent. */
+    readonly projectFingerprint?: string;
+    /** A `shallow` graft file exists in the common dir. */
+    readonly shallow: boolean;
+    /** Explicit identity/coverage uncertainty labels, never silent. */
+    readonly identityUncertainty: readonly IdentityUncertaintyState[];
+}
+/**
+ * Probe a worktree's live identity with read-only Git plumbing. Every
+ * invocation disables optional locks (`--no-optional-locks`, LIVE §7) and
+ * never writes to the observed worktree, its index or its refs. Returns
+ * undefined when the path is not a Git worktree; missing (unborn HEAD) or
+ * shallow history is a successful probe with explicit uncertainty.
+ */
+export declare function probeLiveWorkspace(cwd: string): LiveWorkspaceProbe | undefined;
+/**
+ * Classify a host lifecycle event against live declarations. Bind, upload,
+ * code-workspace creation and session open/end never activate or remove a
+ * declaration: the only outcome is "no-activation-change". Unknown kinds
+ * are refused. Pinned to NON_ACTIVATING_LIFECYCLE_KINDS, never a copy.
+ */
+export declare function classifyLifecycleEvent(kind: NonActivatingLifecycleKind): "no-activation-change";
+export type LiveOperation = "activate" | "list" | "status" | "resolve" | "remove" | "remove-clone" | "rebind" | "replay";
+export interface LiveAuthorizationRequest {
+    readonly operation: LiveOperation;
+    /** Stable local scope `local:<host-owner-id>`; never a sentropic tenant. */
+    readonly tenant: string;
+    readonly path?: string;
+    readonly declarationId?: string;
+    readonly hostFingerprint?: string;
+}
+export interface LiveAuthorizationDecision {
+    readonly ok: boolean;
+    readonly reason?: string;
+    readonly principal?: string;
+}
+export interface LiveAuthority {
+    authorize(request: LiveAuthorizationRequest): LiveAuthorizationDecision;
+}
+/**
+ * Default authority until L7a: deny everything explicitly. Local identity
+ * verification is L7a work; until it exists, no declaration API is usable,
+ * and denial is an error — never a successful empty result (A01).
+ */
+export declare const unverifiedLocalLiveAuthority: LiveAuthority;
+export interface LiveWorkScope {
+    readonly declarationId: string;
+    readonly cloneId: string;
+}
+/**
+ * Cancellation/purge seam. Removal stops scheduled (delayed) work and
+ * requests a purge of PRIVATE local snapshots and derived indexes only;
+ * authorized committed history is never deleted by live (LIVE §10).
+ */
+export interface LiveWorkController {
+    cancelScheduledWork(scope: LiveWorkScope): boolean;
+    requestPrivatePurge(scope: LiveWorkScope): boolean;
+    hasInFlightWork(scope: LiveWorkScope): boolean;
+}
+export declare const inertLiveWorkController: LiveWorkController;
+export declare class LiveAccessRefused extends Error {
+    readonly operation: LiveOperation;
+    readonly reason: string;
+    constructor(operation: LiveOperation, reason: string);
+}
+export interface LiveRegistrationOptions {
+    /** Durable h2a root (outside every observed worktree); injected, never a worktree. */
+    readonly root: string;
+    /**
+     * Stable local scope `local:<host-owner-id>`; defaults to the OS owner.
+     * PROVISIONAL until L7a supplies the verified owner scope — never a
+     * sentropic tenant inferred from a workspace id.
+     */
+    readonly tenant?: string;
+    /** Authority seam; defaults to {@link unverifiedLocalLiveAuthority} (L7a completes verification). */
+    readonly authority?: LiveAuthority;
+    /** Work-control seam; defaults to {@link inertLiveWorkController}. */
+    readonly workController?: LiveWorkController;
+    /** Injectable clock for deterministic timestamps. */
+    readonly now?: () => string;
+}
+export interface ActivateLiveRequest {
+    readonly path: string;
+}
+export interface RemoveLiveRequest {
+    readonly path: string;
+    /** Mandatory: every revocation names its reason (contract DTO). */
+    readonly reason: RevocationReason;
+}
+export interface RemoveCloneLiveRequest {
+    readonly cloneId: string;
+    /** Mandatory: every revocation names its reason (contract DTO). */
+    readonly reason: RevocationReason;
+}
+export interface RebindLiveRequest {
+    readonly path: string;
+    readonly sentropicWorkspaceId: string;
+    readonly issuer: string;
+}
+export interface RemoveLiveResult {
+    readonly removed: boolean;
+    readonly canceledWork: boolean;
+    readonly purgeRequested: boolean;
+    /** The contract revocation, present exactly when a declaration was removed. */
+    readonly revocation?: DeclarationRevocationDto;
+}
+export interface RemoveCloneLiveResult {
+    /** Number of declarations revoked. */
+    readonly removed: number;
+    /** One contract revocation per revoked declaration, in declarationId order. */
+    readonly revocations: readonly DeclarationRevocationDto[];
+    readonly canceledWork: boolean;
+    readonly purgeRequested: boolean;
+}
+export interface ResolvedLivePath {
+    readonly declaration: LiveDeclarationRecord;
+    readonly relativePath: string;
+}
+export interface LiveRegistration {
+    readonly authority: LiveAuthority;
+    probe(cwd: string): LiveWorkspaceProbe | undefined;
+    /** Explicit activation, once per worktree; idempotent re-activation replays the existing declaration. */
+    activate(request: ActivateLiveRequest): {
+        declaration: LiveDeclarationRecord;
+        created: boolean;
+    };
+    list(): readonly LiveDeclarationRecord[];
+    status(path: string): LiveDeclarationRecord | undefined;
+    /** Path-resolution seam: the declaration covering `path`, with its relative path. */
+    resolvePath(path: string): ResolvedLivePath | undefined;
+    /** Stop work, cancel delayed jobs, revoke the declaration with its reason, request a private purge, then unregister. */
+    remove(request: RemoveLiveRequest): RemoveLiveResult;
+    /** Withdraw a whole clone: revoke EACH of its declarations, one revocation each. */
+    removeClone(request: RemoveCloneLiveRequest): RemoveCloneLiveResult;
+    /** Server/issuer-bound product live intent; requires fresh revalidation, bumps the binding revision. */
+    rebind(request: RebindLiveRequest): LiveDeclarationRecord;
+    /** Host-startup replay of durable declarations, without renewed activation. */
+    replay(): readonly LiveDeclarationRecord[];
+}
+export declare function createLiveRegistration(options: LiveRegistrationOptions): LiveRegistration;
+export { NON_ACTIVATING_LIFECYCLE_KINDS };
+//# sourceMappingURL=live-registration.d.ts.map

package/dist/gateway-host/live-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-registration.d.ts","sourceRoot":"","sources":["../../src/gateway-host/live-registration.ts"],"names":[],"mappings":"AA4CA,OAAO,EAGL,8BAA8B,EAM/B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAEV,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,YAAY,EACZ,gBAAgB,EAGjB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EAIL,KAAK,qBAAqB,EAE3B,MAAM,wBAAwB,CAAC;AAUhC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAIxE;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB,MAAM,CAKR;AAMD,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,mBAAmB,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACnE;AAeD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAkG9E;AAMD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,0BAA0B,GAAG,sBAAsB,CAK/F;AAMD,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,MAAM,GACN,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,QAAQ,CAAC;AAEb,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,yBAAyB,CAAC;CACzE;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,aAE1C,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;IACnD,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;IACnD,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;CAChD;AAED,eAAO,MAAM,uBAAuB,EAAE,kBAIrC,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,MAAM;CAK1B;AAED,MAAM,WAAW,uBAAuB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACnD,yGAAyG;IACzG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG;QAAE,WAAW,EAAE,qBAAqB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACjG,IAAI,IAAI,SAAS,qBAAqB,EAAE,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAC;IACxD,qFAAqF;IACrF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACxD,wHAAwH;IACxH,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAAC;IACrD,oFAAoF;IACpF,WAAW,CAAC,OAAO,EAAE,sBAAsB,GAAG,qBAAqB,CAAC;IACpE,wGAAwG;IACxG,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,qBAAqB,CAAC;IAC1D,+EAA+E;IAC/E,MAAM,IAAI,SAAS,qBAAqB,EAAE,CAAC;CAC5C;AAOD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAgQlB;AAID,OAAO,EAAE,8BAA8B,EAAE,CAAC"}