@sentropic/h2a 0.98.5 → 0.98.7-rc.1

package/dist/runtime/identity/possession.d.ts

@@ -0,0 +1,34 @@
+import { LockTimeoutError } from '../local-files/locks.js';
+export declare const digestBytes: (bytes: string | Buffer) => string;
+export declare class BindingCommitIntegrityError extends Error {
+    readonly reasonCode = "binding-commit-integrity";
+    readonly retryable = false;
+    constructor(detail: string);
+}
+export declare class BindingFenceStaleError extends LockTimeoutError {
+    constructor();
+}
+export declare class BindingCommitConflictError extends LockTimeoutError {
+    constructor();
+}
+export interface ProofSource {
+    file: string;
+    dev: number;
+    ino: number;
+    size: number;
+    mtimeMs: number;
+    ctimeMs: number;
+    offset: number;
+    length: number;
+    sha256: string;
+}
+export interface PossessionReceipt {
+    instance: string;
+    sources: ProofSource[];
+    publicKeySha256: string;
+}
+export declare const isPreparedPossession: (receipt: PossessionReceipt) => boolean;
+export declare function preparePossession(root: string, instance: string): PossessionReceipt | undefined;
+export declare function receiptMatches(root: string, receipt: PossessionReceipt, cold?: boolean): boolean;
+export declare function withPossession<T>(root: string, receipt: PossessionReceipt, fn: () => T): T;
+//# sourceMappingURL=possession.d.ts.map

package/dist/runtime/identity/possession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"possession.d.ts","sourceRoot":"","sources":["../../../src/runtime/identity/possession.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGzE,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,GAAG,MAAM,KAAG,MAA0D,CAAC;AAChH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,UAAU,8BAA8B;IACjD,QAAQ,CAAC,SAAS,SAAS;gBACf,MAAM,EAAE,MAAM;CAC3B;AACD,qBAAa,sBAAuB,SAAQ,gBAAgB;;CAE3D;AACD,qBAAa,0BAA2B,SAAQ,gBAAgB;;CAE/D;AACD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IACvF,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAChD;AACD,MAAM,WAAW,iBAAiB;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;CAAE;AAEzG,eAAO,MAAM,oBAAoB,GAAE,SAAQ,iBAAiB,KAAE,OAAsC,CAAC;AAwBrG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAsC/F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,UAAQ,GAAG,OAAO,CAoB9F;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAK1F"}

package/dist/runtime/identity/possession.js

@@ -0,0 +1,162 @@
+// Preparation parses sources outside identity possession. Admission reads only
+// the receipt's fixed ranges and file metadata, under the registry lock.
+import { createHash, createPublicKey, randomBytes, sign, verify } from 'node:crypto';
+import { closeSync, existsSync, fstatSync, openSync, readFileSync, readSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { withLockSync, LockTimeoutError } from '../local-files/locks.js';
+import { syncDirectory, syncFile } from './durable.js';
+export const digestBytes = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export class BindingCommitIntegrityError extends Error {
+    reasonCode = 'binding-commit-integrity';
+    retryable = false;
+    constructor(detail) { super(`Identity binding commit integrity: ${detail}`, { cause: 'identity_storage_failed' }); }
+}
+export class BindingFenceStaleError extends LockTimeoutError {
+    constructor() { super('identity/.lock', undefined, 0); this.message = 'Identity possession receipt changed; prepare again outside the fence'; }
+}
+export class BindingCommitConflictError extends LockTimeoutError {
+    constructor() { super('identity/.lock', undefined, 0); this.message = 'Identity binding CAS conflict; the existing winner is retained'; }
+}
+const verifiedReceipts = new WeakSet();
+export const isPreparedPossession = (receipt) => verifiedReceipts.has(receipt);
+const stamp = (file, offset, bytes) => {
+    const st = statSync(file);
+    return { file, dev: st.dev, ino: st.ino, size: st.size, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs,
+        offset, length: bytes.length, sha256: digestBytes(bytes) };
+};
+function rows(file) {
+    if (!existsSync(file))
+        return [];
+    const bytes = readFileSync(file);
+    if (bytes.length && bytes.at(-1) !== 10)
+        throw new BindingCommitIntegrityError('unterminated registry source');
+    const out = [];
+    let offset = 0;
+    for (let end = bytes.indexOf(10); end !== -1; end = bytes.indexOf(10, offset)) {
+        const line = bytes.subarray(offset, end + 1);
+        if (line.toString().trim()) {
+            let row;
+            try {
+                row = JSON.parse(line.toString());
+            }
+            catch {
+                throw new BindingCommitIntegrityError('invalid registry source');
+            }
+            if (!row || typeof row !== 'object' || Array.isArray(row))
+                throw new BindingCommitIntegrityError('invalid registry record');
+            out.push({ row, offset, bytes: line });
+        }
+        offset = end + 1;
+    }
+    return out;
+}
+export function preparePossession(root, instance) {
+    const keyName = instance.replace(/[:/]/g, '-');
+    const privateFile = join(root, 'keys', `${keyName}.key.pem`);
+    const publicFile = join(root, 'keys', `${keyName}.pub.pem`);
+    if (!existsSync(privateFile) || !existsSync(publicFile))
+        return undefined;
+    return withLockSync(join(root, 'registry', '.lock'), () => {
+        const privateBytes = readFileSync(privateFile);
+        const publicBytes = readFileSync(publicFile);
+        const instancesFile = join(root, 'registry', 'instances.jsonl');
+        const keysFile = join(root, 'registry', 'keys.jsonl');
+        const registrations = rows(instancesFile);
+        const registration = registrations.find(({ row }) => row.id === instance);
+        const events = rows(keysFile);
+        if (!registration || !Array.isArray(registration.row.publicKeys))
+            return undefined;
+        const active = new Set(registration.row.publicKeys);
+        for (const { row } of events)
+            if (row.instance === instance && row.type === 'added')
+                active.add(row.publicKey);
+        for (const { row } of events)
+            if (row.instance === instance && row.type === 'revoked')
+                active.delete(row.publicKey);
+        try {
+            const expected = createPublicKey(privateBytes).export({ type: 'spki', format: 'der' });
+            if (!expected.equals(createPublicKey(publicBytes).export({ type: 'spki', format: 'der' })))
+                return undefined;
+            const nonce = randomBytes(32);
+            const signature = sign(null, nonce, privateBytes);
+            if (![...active].some(pem => verify(null, nonce, pem, signature)))
+                return undefined;
+        }
+        catch {
+            return undefined;
+        }
+        for (const file of [privateFile, publicFile, instancesFile, ...(existsSync(keysFile) ? [keysFile] : [])])
+            syncFile(file);
+        syncDirectory(root);
+        const sources = [stamp(privateFile, 0, privateBytes), stamp(publicFile, 0, publicBytes),
+            stamp(instancesFile, registration.offset, registration.bytes),
+            ...(existsSync(keysFile) ? [stamp(keysFile, 0, Buffer.alloc(0))] : [])];
+        const publicPem = publicBytes.toString();
+        if (!registration.row.publicKeys.includes(publicPem)) {
+            const added = events.find(({ row }) => row.instance === instance && row.type === 'added' && row.publicKey === publicPem);
+            if (!added)
+                return undefined;
+            sources.push(stamp(keysFile, added.offset, added.bytes));
+        }
+        // An absent key-event source is observed again at admission.
+        if (!existsSync(keysFile))
+            sources.push({ file: keysFile, dev: 0, ino: 0, size: 0, mtimeMs: 0, ctimeMs: 0, offset: 0, length: 0, sha256: digestBytes('') });
+        const receipt = { instance, sources: sources.map(s => ({ ...s, file: s.file.slice(root.length + 1) })), publicKeySha256: digestBytes(publicBytes) };
+        verifiedReceipts.add(receipt);
+        return receipt;
+    }, { timeoutMs: 250 });
+}
+export function receiptMatches(root, receipt, cold = false) {
+    if (!receipt || typeof receipt.instance !== 'string' || !Array.isArray(receipt.sources) || receipt.sources.length < 3)
+        return false;
+    for (const source of receipt.sources) {
+        if (!/^(keys\/[A-Za-z0-9._-]+\.(key|pub)\.pem|registry\/(instances|keys)\.jsonl)$/.test(source.file))
+            return false;
+        const file = join(root, source.file);
+        if (source.ino === 0) {
+            if (!cold && existsSync(file))
+                return false;
+            continue;
+        }
+        let fd;
+        try {
+            fd = openSync(file, 'r');
+            const st = fstatSync(fd);
+            if (st.dev !== source.dev || st.ino !== source.ino || st.size < source.size)
+                return false;
+            if (!cold && (st.size !== source.size || st.mtimeMs !== source.mtimeMs || st.ctimeMs !== source.ctimeMs))
+                return false;
+            if (!Number.isSafeInteger(source.offset) || !Number.isSafeInteger(source.length) || source.offset < 0 || source.length < 0 || source.offset + source.length > st.size)
+                return false;
+            const bytes = Buffer.alloc(source.length);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const n = readSync(fd, bytes, offset, bytes.length - offset, source.offset + offset);
+                if (!n)
+                    return false;
+                offset += n;
+            }
+            if (digestBytes(bytes) !== source.sha256)
+                return false;
+            const current = statSync(file);
+            if (current.ino !== st.ino || current.dev !== st.dev || current.size !== st.size || current.ctimeMs !== st.ctimeMs)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        finally {
+            if (fd !== undefined)
+                closeSync(fd);
+        }
+    }
+    return true;
+}
+export function withPossession(root, receipt, fn) {
+    return withLockSync(join(root, 'registry', '.lock'), () => {
+        if (!isPreparedPossession(receipt) || !receiptMatches(root, receipt))
+            throw new BindingFenceStaleError();
+        return fn();
+    }, { timeoutMs: 250 });
+}
+//# sourceMappingURL=possession.js.map

package/dist/runtime/identity/possession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"possession.js","sourceRoot":"","sources":["../../../src/runtime/identity/possession.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,UAAU,GAAG,0BAA0B,CAAC;IACxC,SAAS,GAAG,KAAK,CAAC;IAC3B,YAAY,MAAc,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC;CAC7H;AACD,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAC1D,gBAAgB,KAAK,CAAC,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,sEAAsE,CAAC,CAAC,CAAC;CAChJ;AACD,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IAC9D,gBAAe,KAAK,CAAC,gBAAgB,EAAC,SAAS,EAAC,CAAC,CAAC,CAAC,CAAA,IAAI,CAAC,OAAO,GAAC,gEAAgE,CAAC,CAAA,CAAC;CACnI;AAMD,MAAM,gBAAgB,GAAC,IAAI,OAAO,EAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAC,CAAC,OAAyB,EAAS,EAAE,CAAA,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACrG,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,KAAa,EAAe,EAAE;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;QAC9F,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/D,CAAC,CAAC;AACF,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,EAAE,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,CAAC;IAC/B,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,2BAA2B,CAAC,yBAAyB,CAAC,CAAC;YAAC,CAAC;YACtH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,2BAA2B,CAAC,yBAAyB,CAAC,CAAC;YAC5H,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,UAAU,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE;QACxD,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAAC,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAsB,CAAC,CAAC;QAChE,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM;YAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC;QACzH,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM;YAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC;QAC9H,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7G,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzH,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,WAAW,CAAC;YACrF,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC;YAC7D,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAE,YAAY,CAAC,GAAG,CAAC,UAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAC,GAAG,EAAC,EAAC,EAAE,CAAA,GAAG,CAAC,QAAQ,KAAG,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAG,OAAO,IAAI,GAAG,CAAC,SAAS,KAAG,SAAS,CAAC,CAAC;YAC7G,IAAG,CAAC,KAAK;gBAAC,OAAO,SAAS,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,MAAM,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,6DAA6D;QAC7D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5J,MAAM,OAAO,GAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAClJ,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAA,OAAO,OAAO,CAAC;IAC/C,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAA0B,EAAE,IAAI,GAAG,KAAK;IACnF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpI,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,6EAA6E,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QAChF,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC1F,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACpL,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YAC1D,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;gBAAC,IAAI,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAAC,MAAM,IAAI,CAAC,CAAC;YAAC,CAAC;YAC1J,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,EAAE,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;QACnI,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,EAAE,KAAK,SAAS;gBAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAI,IAAY,EAAE,OAA0B,EAAE,EAAW;IACrF,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE;QACxD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACzG,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;AACzB,CAAC"}

package/dist/runtime/identity/worker.js

@@ -28,6 +28,8 @@ function classify(err) {
         return { cause: "storage_readonly", message };
     if (code === "EACCES" || code === "EPERM")
         return { cause: "storage_permission_denied", message };
+    if (err instanceof Error && err.cause === 'identity_storage_failed')
+        return { cause: 'identity_storage_failed', message };
     if (err instanceof Error && err.name === "LockTimeoutError") {
         return { cause: "identity_timeout", message };
     }
@@ -85,9 +87,10 @@ process.on("message", (raw) => {
             ? { declaredCapabilities: req.request.declaredCapabilities }
             : {})
     };
-    const budgetMs = Number.isFinite(req.budgetMs) && req.budgetMs > 0 ? req.budgetMs : 20_000;
+    const budgetMs = Number.isFinite(req.budgetMs) && req.budgetMs >= 0 ? req.budgetMs : 20_000;
     const startNs = process.hrtime.bigint();
-    const remainingMs = () => budgetMs - Number((process.hrtime.bigint() - startNs) / 1000000n);
+    const parentDeadline = req.deadlineNs && /^[0-9]{1,30}$/.test(req.deadlineNs) ? BigInt(req.deadlineNs) : undefined;
+    const remainingMs = () => Math.min(budgetMs - Number(process.hrtime.bigint() - startNs) / 1_000_000, parentDeadline === undefined ? Infinity : Number(parentDeadline - process.hrtime.bigint()) / 1_000_000);
     const cancellableDelay = (ms) => new Promise((resolve) => {
         if (abort.signal.aborted)
             return resolve();
@@ -109,13 +112,14 @@ process.on("message", (raw) => {
     const mintMemo = {};
     const prepCache = {};
     let attempt = 0;
+    let sequence = 0;
     const resolveWithRetry = async () => {
         while (!abort.signal.aborted) {
             const budget = remainingMs();
             if (budget <= 0)
                 throw new LockTimeoutError("identity", undefined, budgetMs);
             try {
-                return await resolveLiveIdentityAsync(input, {
+                const identity = await resolveLiveIdentityAsync(input, {
                     signal: abort.signal,
                     deadlineMs: budget,
                     // Fail a contended registration fast so the identity lock is not held
@@ -123,8 +127,13 @@ process.on("message", (raw) => {
                     registryLockTimeoutMs: 250,
                     mintMemo,
                     prepCache,
-                    attempt
+                    attempt,
+                    ...(req.diagnosticKey && /^[0-9a-f]{64}$/.test(req.diagnosticKey) ? { diagnosticKey: Buffer.from(req.diagnosticKey, 'hex') } : {}),
+                    onBlocker: (diagnostic, stabilityKey) => send({ kind: 'identity_observation', v: 1, attemptId: req.attemptId ?? req.traceAttemptId ?? 'legacy-parent', sequence: ++sequence, diagnostic, stabilityKey })
                 });
+                if (remainingMs() <= 0)
+                    throw new LockTimeoutError('identity/.lock', undefined, budgetMs);
+                return identity;
             }
             catch (err) {
                 attempt += 1;
@@ -173,7 +182,9 @@ process.on("message", (raw) => {
     })
         .catch((err) => {
         const { cause, message } = classify(err);
-        send({ kind: "identity_error", v: 1, cause, message });
+        const diagnostic = err?.diagnostic;
+        const safeMessage = message.replaceAll(req.request.root, '<store-root>').replace(/\/(?:[^\s,;:]+\/)+[^\s,;:]+/g, '<path>');
+        send({ kind: "identity_error", v: 1, cause, message: safeMessage, ...(diagnostic ? { diagnostic } : {}) });
     })
         .finally(() => {
         // The worker's whole job is one resolution; exit so no orphan lingers to

package/dist/runtime/identity/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../../src/runtime/identity/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AA6B1E,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAI,GAAyC,EAAE,IAAI,CAAC;IAC9D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IACpE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;IAClG,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,wEAAwE;IACxE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,OAAgB;IAC5B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;AACpC,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE;IACrC,MAAM,GAAG,GAAG,GAAoC,CAAC;IACjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO;IAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,8EAA8E;QAC9E,kDAAkD;QAClD,KAAK,CAAC,KAAK,CAAE,GAA2B,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,OAAO;QAAE,OAAO;IACvD,OAAO,GAAG,IAAI,CAAC;IACf,MAAM,GAAG,GAAG,GAAqB,CAAC;IAClC,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,iBAAiB,CACf,cAAc,CAAC;QACb,IAAI,EAAE,gBAAgB;QACtB,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAA6B;QACtC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QACtB,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QACtB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;QACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,GAAW,EAAE,CAC/B,QAAQ,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,QAAU,CAAC,CAAC;IAEtE,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,0EAA0E;IAC1E,gFAAgF;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,QAAQ,GAAwD,EAAE,CAAC;IACzE,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;QAClC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACH,OAAO,MAAM,wBAAwB,CAAC,KAAK,EAAE;oBAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,MAAM;oBAClB,sEAAsE;oBACtE,sEAAsE;oBACtE,qBAAqB,EAAE,GAAG;oBAC1B,QAAQ;oBACR,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC;gBACpC,IAAI,GAAG,YAAY,gBAAgB,IAAI,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,KAAK,gBAAgB,EAAE;SACpB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,CAAC;YACJ,QAAQ,EAAE;gBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;oBAC9C,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;gBACP,sEAAsE;gBACtE,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,EAAE;gBAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;gBAC3C,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;gBACP,wEAAwE;gBACxE,wEAAwE;gBACxE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;aAC/D;SACF,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,yEAAyE;QACzE,2DAA2D;QAC3D,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;IAC5B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../../src/runtime/identity/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAgC1E,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAI,GAAyC,EAAE,IAAI,CAAC;IAC9D,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IACpE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;IAClG,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,yBAAyB;QAAE,OAAO,EAAC,KAAK,EAAC,yBAAyB,EAAC,OAAO,EAAC,CAAC;IACtH,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,wEAAwE;IACxE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,OAAgB;IAC5B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;AACpC,IAAI,OAAO,GAAG,KAAK,CAAC;AAEpB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE;IACrC,MAAM,GAAG,GAAG,GAAoC,CAAC;IACjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO;IAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,8EAA8E;QAC9E,kDAAkD;QAClD,KAAK,CAAC,KAAK,CAAE,GAA2B,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,OAAO;QAAE,OAAO;IACvD,OAAO,GAAG,IAAI,CAAC;IACf,MAAM,GAAG,GAAG,GAAqB,CAAC;IAClC,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,iBAAiB,CACf,cAAc,CAAC;QACb,IAAI,EAAE,gBAAgB;QACtB,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAA6B;QACtC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QACtB,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QACtB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;QACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACxC,MAAM,cAAc,GAAC,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA,CAAC,CAAA,SAAS,CAAC;IAC7G,MAAM,WAAW,GAAG,GAAW,EAAE,CAC/B,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,SAAS,EACvE,cAAc,KAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,GAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAC,SAAS,CAAC,CAAC;IAEtG,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAiB,EAAE,CACrD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,0EAA0E;IAC1E,gFAAgF;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,QAAQ,GAAwD,EAAE,CAAC;IACzE,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;QAClC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAC,MAAM,wBAAwB,CAAC,KAAK,EAAE;oBACnD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,MAAM;oBAClB,sEAAsE;oBACtE,sEAAsE;oBACtE,qBAAqB,EAAE,GAAG;oBAC1B,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACN,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAC,aAAa,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAC,KAAK,CAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/H,SAAS,EAAE,CAAC,UAAU,EAAC,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,sBAAsB,EAAC,CAAC,EAAC,CAAC,EAAC,SAAS,EAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,cAAc,IAAI,eAAe,EAAC,QAAQ,EAAC,EAAE,QAAQ,EAAC,UAAU,EAAC,YAAY,EAAC,CAAC;iBAC7L,CAAC,CAAC;gBACH,IAAG,WAAW,EAAE,IAAE,CAAC;oBAAC,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAC,SAAS,EAAC,QAAQ,CAAC,CAAC;gBACpF,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,GAAG,CAAC;gBACpC,IAAI,GAAG,YAAY,gBAAgB,IAAI,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,KAAK,gBAAgB,EAAE;SACpB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,IAAI,CAAC;YACH,IAAI,EAAE,mBAAmB;YACzB,CAAC,EAAE,CAAC;YACJ,QAAQ,EAAE;gBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;oBAC9C,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;gBACP,sEAAsE;gBACtE,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,EAAE;gBAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;gBAC3C,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;gBACP,wEAAwE;gBACxE,wEAAwE;gBACxE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;aAC/D;SACF,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAE,GAA6B,EAAE,UAAU,CAAC;QAC5D,MAAM,WAAW,GAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC,OAAO,CAAC,8BAA8B,EAAC,QAAQ,CAAC,CAAC;QACvH,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,yEAAyE;QACzE,2DAA2D;QAC3D,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;IAC5B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1B,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC"}

package/dist/runtime/live/contracts.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Live Git Indexing — L6a (H): h2a-side core contract view.
+ *
+ * The neutral contract FROZE at @sentropic/engram-live 0.1.0 (graphify
+ * 70ebdfee, PR rhanka/engram#359): H no longer carries its own declaration
+ * vocabulary, validators or identity derivations. This module re-exports the
+ * consumed contract surface — the underlying contracts.js takes zero imports,
+ * so this re-export stays data-pure (types, constants and deterministic
+ * validation only; no I/O, no host state) — and adds only H-core-owned pure
+ * policy (isLocalLiveTenant below).
+ *
+ * PRE-RELEASE CONSUMPTION (spec §11): @sentropic/engram-live is not
+ * published yet — and it is os-bounded (linux), so even a digest-pinned
+ * packed prerelease consumed through a `file:` dependency breaks
+ * cross-platform install and packed redistribution (smoke). H therefore
+ * vendors the portable contract entry (dist/contracts.js, extracted
+ * byte-identical from the pinned tarball built from graphify@70ebdfee;
+ * provenance and per-file integrity pinned by the GUARD test in h2a-runtime
+ * live-registration.test.ts) under ../../vendor/engram-live, with no
+ * external dependency and no neighboring checkout imported: at publication
+ * time this becomes an exact registry version pin. The
+ * derivations (deriveCloneIdentity / deriveWorktreeIdentity /
+ * deriveDeclarationIdentity) live in the /integration entry and are consumed
+ * by the runtime side only — core never imports the factory entry, keeping
+ * copyable DTOs separate from factory imports per spec §3.
+ *
+ * RETIRED H VOCABULARY (L6a realignment; L6a is not consumed yet, so the
+ * break is local-only, no migration replay):
+ * - hostScope -> tenant (the value stays a `local:<id>` scope)
+ * - capability -> liveCapability (the value stays "live")
+ * - revision -> declarationRevision
+ * - workspaceFingerprint -> hostFingerprint (declaration level)
+ * - policy "live-git-1" -> POLICY_VERSION "live-git-indexing/1"
+ * - nested binding {sentropicWorkspaceId, issuer, bindingRevision} ->
+ *   flat serverWorkspaceId / serverIssuer / bindingRevision
+ * - nested clone {cloneId, commonDirRealpath, projectFingerprint} ->
+ *   CloneIdentityDto {hostScope, commonDirRealpath,
+ *   commonDirProjectFingerprint, cloneId, oidAlgorithm}
+ * - nested worktree {worktreeId, path, workspaceFingerprint} ->
+ *   WorktreeIdentityDto {cloneId, worktreeId, worktreePath, gitDir,
+ *   worktreeFingerprint}
+ * - newline-joined sha256 identity derivations -> the three canonical
+ *   public derivations (runtime side, see above).
+ */
+export { CONTRACT_NAME, CONTRACT_VERSION, EXPLICIT_LIVE_CAPABILITY, IDENTITY_UNCERTAINTY_STATES, INITIAL_BINDING_REVISION, INITIAL_DECLARATION_REVISION, NON_ACTIVATING_LIFECYCLE_KINDS, POLICY_VERSION, isIdentityUncertaintyState, isNonActivatingLifecycleKind, isRevocationReason, validateCloneIdentity, validateDeclarationRevocation, validatePrivatePurgeRequest, validateWorkspaceDeclaration, validateWorktreeIdentity, } from "../../vendor/engram-live/contracts.js";
+export type { CloneIdentityDto, DeclarationRevocationDto, IdentityUncertaintyState, NonActivatingLifecycleKind, OidAlgorithm, PrivatePurgeRequestDto, RevocationReason, ValidationResult, WorkspaceDeclarationDto, WorktreeIdentityDto, } from "../../vendor/engram-live/contracts.js";
+/**
+ * H tenant guard: the live tenant is ALWAYS a stable local scope
+ * `local:<host-owner-id>`, never a sentropic tenant inferred from a
+ * workspace id. The verified owner scope and principal proof are L7a work;
+ * until then the tenant default is provisional (see the runtime
+ * live-registration service).
+ */
+export declare function isLocalLiveTenant(value: unknown): value is string;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/runtime/live/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/live/contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,4BAA4B,EAC5B,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,EAClB,qBAAqB,EACrB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAOjE"}

package/dist/runtime/live/contracts.js

@@ -0,0 +1,59 @@
+/**
+ * Live Git Indexing — L6a (H): h2a-side core contract view.
+ *
+ * The neutral contract FROZE at @sentropic/engram-live 0.1.0 (graphify
+ * 70ebdfee, PR rhanka/engram#359): H no longer carries its own declaration
+ * vocabulary, validators or identity derivations. This module re-exports the
+ * consumed contract surface — the underlying contracts.js takes zero imports,
+ * so this re-export stays data-pure (types, constants and deterministic
+ * validation only; no I/O, no host state) — and adds only H-core-owned pure
+ * policy (isLocalLiveTenant below).
+ *
+ * PRE-RELEASE CONSUMPTION (spec §11): @sentropic/engram-live is not
+ * published yet — and it is os-bounded (linux), so even a digest-pinned
+ * packed prerelease consumed through a `file:` dependency breaks
+ * cross-platform install and packed redistribution (smoke). H therefore
+ * vendors the portable contract entry (dist/contracts.js, extracted
+ * byte-identical from the pinned tarball built from graphify@70ebdfee;
+ * provenance and per-file integrity pinned by the GUARD test in h2a-runtime
+ * live-registration.test.ts) under ../../vendor/engram-live, with no
+ * external dependency and no neighboring checkout imported: at publication
+ * time this becomes an exact registry version pin. The
+ * derivations (deriveCloneIdentity / deriveWorktreeIdentity /
+ * deriveDeclarationIdentity) live in the /integration entry and are consumed
+ * by the runtime side only — core never imports the factory entry, keeping
+ * copyable DTOs separate from factory imports per spec §3.
+ *
+ * RETIRED H VOCABULARY (L6a realignment; L6a is not consumed yet, so the
+ * break is local-only, no migration replay):
+ * - hostScope -> tenant (the value stays a `local:<id>` scope)
+ * - capability -> liveCapability (the value stays "live")
+ * - revision -> declarationRevision
+ * - workspaceFingerprint -> hostFingerprint (declaration level)
+ * - policy "live-git-1" -> POLICY_VERSION "live-git-indexing/1"
+ * - nested binding {sentropicWorkspaceId, issuer, bindingRevision} ->
+ *   flat serverWorkspaceId / serverIssuer / bindingRevision
+ * - nested clone {cloneId, commonDirRealpath, projectFingerprint} ->
+ *   CloneIdentityDto {hostScope, commonDirRealpath,
+ *   commonDirProjectFingerprint, cloneId, oidAlgorithm}
+ * - nested worktree {worktreeId, path, workspaceFingerprint} ->
+ *   WorktreeIdentityDto {cloneId, worktreeId, worktreePath, gitDir,
+ *   worktreeFingerprint}
+ * - newline-joined sha256 identity derivations -> the three canonical
+ *   public derivations (runtime side, see above).
+ */
+export { CONTRACT_NAME, CONTRACT_VERSION, EXPLICIT_LIVE_CAPABILITY, IDENTITY_UNCERTAINTY_STATES, INITIAL_BINDING_REVISION, INITIAL_DECLARATION_REVISION, NON_ACTIVATING_LIFECYCLE_KINDS, POLICY_VERSION, isIdentityUncertaintyState, isNonActivatingLifecycleKind, isRevocationReason, validateCloneIdentity, validateDeclarationRevocation, validatePrivatePurgeRequest, validateWorkspaceDeclaration, validateWorktreeIdentity, } from "../../vendor/engram-live/contracts.js";
+/**
+ * H tenant guard: the live tenant is ALWAYS a stable local scope
+ * `local:<host-owner-id>`, never a sentropic tenant inferred from a
+ * workspace id. The verified owner scope and principal proof are L7a work;
+ * until then the tenant default is provisional (see the runtime
+ * live-registration service).
+ */
+export function isLocalLiveTenant(value) {
+    return (typeof value === "string" &&
+        value.startsWith("local:") &&
+        value.trim().length > "local:".length &&
+        !value.includes("\0"));
+}
+//# sourceMappingURL=contracts.js.map

package/dist/runtime/live/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/runtime/live/contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,4BAA4B,EAC5B,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,EAClB,qBAAqB,EACrB,6BAA6B,EAC7B,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,uCAAuC,CAAC;AAc/C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QACrC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CACtB,CAAC;AACJ,CAAC"}

package/dist/runtime/local-files/identity-fence.d.ts

@@ -0,0 +1,164 @@
+/** Identity binding fence, FINAL v6 (A+B). Strict v2/v4 discrimination,
+ * qualified death proofs, bounded legacy NSpid evidence, shared succession,
+ * durable journal/slot repair before retirement, and monotone diagnostics.
+ * Upgrade retains its own protocol bindings. No operator call or signal is
+ * used by automatic recovery; every unsupported blocker waits for release.
+ */
+import { type PreparedBindingSlots } from "../identity/binding-commit.js";
+import { LockTimeoutError, type LockObservation } from "./locks.js";
+import { type HostKind, type LegacyLockHolder, type LockRec, type PrefixLockLease, type PublishStatus, type BreakLockAsOperatorOptions, type OperatorBreakResult, type SelfIdent } from "./succession-lock.js";
+/** The one identity fence protocol (also carried by every v2 record). */
+export declare const IDENTITY_BINDING_FENCE_PROTOCOL = "identity-binding-fence-v1";
+type RecordPlatform = "linux" | "darwin" | "win32" | "other";
+type RecordPublication = "link" | "o-excl";
+/** The v2 identity lock record (R2 contract). Strictly validated; never mixed
+ *  with `hostname`/`startedAt`/`acquiredAt` or any unknown field. */
+export interface IdentityLockRec {
+    readonly recordVersion: 2;
+    readonly protocol: typeof IDENTITY_BINDING_FENCE_PROTOCOL;
+    readonly platform: RecordPlatform;
+    readonly publication: RecordPublication;
+    readonly hostKind: HostKind;
+    readonly host: string | null;
+    readonly boot: string | null;
+    readonly ns: string | null;
+    readonly timeNs: string | null;
+    readonly pid: number;
+    readonly start: string | null;
+    readonly token: string;
+    readonly fenceEpoch: string;
+    readonly at: number;
+    readonly target?: string;
+    readonly operator?: true;
+}
+/**
+ * This process's fresh identity context (R2: renewed at every decision; the
+ * machine-id falls back to /var/lib/dbus/machine-id when /etc/machine-id is
+ * absent). Never memoized, unlike the upgrade path's `me()`.
+ */
+export declare function identitySelf(): SelfIdent;
+/** Diagnostic view of what blocks an identity acquisition (never a raw machine-id). */
+export type IdentityLockRead = "absent" | "corrupt" | "unknown" | {
+    kind: "io-error";
+    code: string;
+} | {
+    kind: "v2";
+    rec: IdentityLockRec;
+    bytes: Buffer;
+} | {
+    kind: "adapter";
+    rec: LockRec;
+    bytes: Buffer;
+} | {
+    kind: "legacy";
+    holder: LegacyLockHolder;
+    bytes: Buffer;
+    eligible?: boolean;
+} | {
+    kind: "cull";
+    bytes: Buffer;
+};
+/**
+ * Reader for `identity/.lock` and its SUCC chain. Distinguishes (R6): the v2
+ * record, the 0.98.5 succession format (adapter — publication link is
+ * recognized, anchors are used as-is, never completed), the legacy binding
+ * record, the historical cull fence, an explicit unknown version/protocol
+ * (never downgraded), corruption, absence and I/O errors.
+ */
+export declare function readIdentityLock(path: string): IdentityLockRead;
+/**
+ * R1 filesystem guard: automatic recovery is authorized only when the REAL
+ * identity directory sits on an explicitly whitelisted local filesystem.
+ * tmpfs, NFS, SMB, FUSE, OverlayFS, virtiofs, 9p, ZFS and unknown types or a
+ * statfs error all refuse it (wait for normal release instead).
+ */
+export declare function identityFsQualified(dir: string): boolean;
+/**
+ * Publication (R2): tmp (wx, byte-count-checked write, fsync, close) then
+ * `link(2)`, then a directory fsync. On a qualified link incapacity the
+ * exclusive-create fallback registers `publication:"o-excl"` — such records
+ * are never recovered automatically. EEXIST stays a contention signal; real
+ * storage errors are never masked.
+ */
+export type IdentityPublishStatus = PublishStatus & {
+    publication?: RecordPublication;
+};
+export declare function publishIdentityRecord(path: string, rec: IdentityLockRec, atomicOnly?: boolean): IdentityPublishStatus;
+export interface IdentityBlockerInfo {
+    readonly blockerType: "LOCK" | "SUCC" | "unknown";
+    readonly pid: number | "unknown";
+    readonly machineClass: "local" | "other" | "unknown";
+    readonly machineFingerprint?: string;
+    readonly bootClass: "current" | "other" | "unknown";
+    readonly ns: string | "unknown";
+    readonly start: string | "unknown";
+    readonly generation: string;
+    readonly target: string | "unknown";
+    readonly reasonCode: string;
+    readonly reason: string;
+    readonly retryCondition: "interval" | "blocker-change";
+}
+export interface IdentityLockDiagnostic extends IdentityBlockerInfo {
+    readonly elapsedMs: number;
+    readonly budgetMs: number;
+    readonly lock: string;
+    readonly stable: boolean;
+    readonly retryAfterMs?: number;
+    /** R6 conditional literal, present only for a stable legacy blocker. */
+    readonly legacyNote?: string;
+    /** Operator command with a root placeholder, never an absolute path. */
+    readonly command?: string;
+}
+/** R7 common literal; absent values render as "unknown". */
+export declare function diagnosticMessage(d: IdentityLockDiagnostic): string;
+export declare class IdentityLockTimeoutError extends LockTimeoutError {
+    readonly diagnostic: IdentityLockDiagnostic;
+    constructor(lockPath: string, diagnostic: IdentityLockDiagnostic);
+}
+export interface IdentityFenceOptions {
+    readonly onBlocker?: (info: IdentityBlockerInfo, stabilityKey: string) => void;
+    readonly diagnosticKey?: Buffer;
+    /** Monotone budget bounding the whole wait (default 5000 ms). */
+    readonly timeoutMs?: number;
+    readonly pollMs?: number;
+    /** L0 passive observation, same contract as the store locks. */
+    readonly observe?: (event: LockObservation) => void;
+    /** Cooperative cancellation while WAITING (async variant only). */
+    readonly signal?: AbortSignal;
+    /** Diagnostic label (default: the lock path relative to the store root). */
+    readonly relativeLockPath?: string;
+}
+export interface IdentityFenceLease extends PrefixLockLease {
+    beginMutation(): void;
+    endMutation(): void;
+    /** Publication actually used for this fence (o-excl is never recovered). */
+    readonly publication: RecordPublication;
+    /** True when acquisition recovered a provably dead previous holder. */
+    readonly recovered: boolean;
+}
+export declare function repairIdentityJournal(dir: string, held: () => boolean, slots: PreparedBindingSlots): void;
+/** Identity operator uses the same election and repair barrier; upgrade stays separate. */
+export declare function breakIdentityLockAsOperator(lockPath: string, options: BreakLockAsOperatorOptions): OperatorBreakResult;
+/** Synchronous identity fence (CLI / sync binding writer). */
+export declare function withIdentityFenceSync<T>(lockPath: string, fn: (lease: IdentityFenceLease) => T, options?: IdentityFenceOptions): T;
+/** Asynchronous identity fence (the identity worker's binding transaction). */
+export declare function withIdentityFence<T>(lockPath: string, fn: (lease: IdentityFenceLease) => T | Promise<T>, options?: IdentityFenceOptions): Promise<T>;
+export interface TailNeutralized {
+    readonly offset: number;
+    readonly length: number;
+    readonly sha256: string;
+}
+/**
+ * Terminate an unterminated final suffix of the journal with exactly one
+ * appended `\n` (R5). No byte before the suffix is ever rewritten or removed;
+ * the operation is idempotent. `offset`/`length` are in bytes, `sha256` covers
+ * the ORIGINAL suffix without the added separator; no content is exposed.
+ */
+export declare function neutralizeBindingsTail(file: string, held?: () => boolean): TailNeutralized | undefined;
+/**
+ * Attest the journal's durability after a recovery (R5 idempotence): a visible
+ * separator whose previous fsync is unattested is fsynced now, content-free.
+ */
+export declare function attestBindingsTailDurable(file: string): void;
+export {};
+//# sourceMappingURL=identity-fence.d.ts.map

package/dist/runtime/local-files/identity-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-fence.d.ts","sourceRoot":"","sources":["../../../src/runtime/local-files/identity-fence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoBH,OAAO,EAA2C,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAInH,OAAO,EAEL,gBAAgB,EAGhB,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAcL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,yEAAyE;AACzE,eAAO,MAAM,+BAA+B,8BAA8B,CAAC;AA+B3E,KAAK,cAAc,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAC7D,KAAK,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C;qEACqE;AACrE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,+BAA+B,CAAC;IAC1D,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;CAC1B;AAaD;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,SAAS,CAWxC;AAiFD,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,SAAS,GACT,SAAS,GACT;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAIpC;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CA0D/D;AAwCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMxD;AA2BD;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAExF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,UAAM,GAAG,qBAAqB,CAgDjH;AAkBD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,UAAU,GAAG,gBAAgB,CAAC;CACxD;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+ID,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAenE;AAED,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;gBAEhC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,sBAAsB;CAMjE;AAMD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,aAAa,IAAI,IAAI,CAAC;IACtB,WAAW,IAAI,IAAI,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AA2JD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,EAAE,KAAK,EAAC,oBAAoB,GAAG,IAAI,CAMxG;AAED,2FAA2F;AAC3F,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CA2BtH;AA6UD,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,CAAC,EACpC,OAAO,GAAE,oBAAyB,GACjC,CAAC,CAEH;AA0CD,+EAA+E;AAC/E,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EACjD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CAEZ;AA6FD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAeD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,OAAoB,GAAG,eAAe,GAAG,SAAS,CAkElH;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAkB5D"}