@sentropic/llm-mesh 0.32.4 → 0.34.0

package/dist/node/seat-onboarding-record.js

@@ -0,0 +1,86 @@
+//
+// Stage-2 seat-record read: re-read and re-validate the stage-1 seat record
+// (bundle + onboarding + binding + versions) and re-derive the launch gate.
+// A stored gate that disagrees with the derivation is a tampered record.
+// Internal module: not exported from the package entry points.
+import { lstat, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { validateSeatBundle } from '../enrollment/seat-bundle.js';
+import { seatLaunchGate, validateSeatOnboarding, } from '../enrollment/seat-onboarding.js';
+import { SEAT_RECORD_REL_PATH, fail, isRecord } from './seat-stage-write.js';
+/**
+ * Read and re-validate the seat record of a staged seat directory. Throws a
+ * StageRefusal (via `fail`) on any mismatch, missing or symlinked record.
+ */
+export async function readSeatRecord(input) {
+    const { seatDir } = input;
+    const seatSt = await lstat(seatDir).catch(() => null);
+    if (!seatSt || seatSt.isSymbolicLink() || !seatSt.isDirectory()) {
+        fail('onboarding-shape-unverified', 'seatDir must be an existing directory');
+    }
+    const recordPath = join(seatDir, SEAT_RECORD_REL_PATH);
+    const recordSt = await lstat(recordPath).catch(() => null);
+    if (!recordSt || recordSt.isSymbolicLink() || !recordSt.isFile()) {
+        fail('onboarding-shape-unverified', 'seat record missing or not a regular file');
+    }
+    let record;
+    try {
+        record = JSON.parse(await readFile(recordPath, 'utf8'));
+    }
+    catch {
+        fail('onboarding-shape-unverified', 'seat record is not JSON');
+    }
+    if (!isRecord(record))
+        fail('onboarding-shape-unverified', 'seat record must be an object');
+    const badRecordKey = Object.keys(record).find((k) => !['version', 'bundle', 'onboarding', 'launchGate', 'authFiles'].includes(k));
+    if (badRecordKey)
+        fail('onboarding-unknown-field', `unknown seat record field: ${badRecordKey}`);
+    if (record['version'] !== 1)
+        fail('onboarding-schema-mismatch', 'seat record version must be 1');
+    const bundleResult = validateSeatBundle(record['bundle'], { trustedAuthority: 'consumer' });
+    if (!bundleResult.ok)
+        fail(bundleResult.code, bundleResult.detail);
+    const bundle = bundleResult.bundle;
+    const cli = bundle.identity.cli;
+    let onboarding = null;
+    let onboardingStatus = 'absent';
+    if (record['onboarding'] !== null && record['onboarding'] !== undefined) {
+        const blockResult = validateSeatOnboarding(record['onboarding']);
+        if (!blockResult.ok)
+            fail(blockResult.code, blockResult.detail);
+        onboarding = blockResult.block;
+        onboardingStatus = 'present';
+        const lifecycle = bundle.lifecycle;
+        if (onboarding.cli !== cli ||
+            onboarding.seatRef !== bundle.identity.seatRef ||
+            onboarding.accountBinding !== bundle.provenance.accountBinding ||
+            onboarding.consent.ownerScope !== bundle.identity.ownerScope ||
+            onboarding.lineage.epoch !== lifecycle.epoch ||
+            onboarding.lineage.generation !== lifecycle.generation ||
+            onboarding.lineage.operationId !== lifecycle.operationId) {
+            fail('onboarding-lineage-mismatch', 'seat record binding mismatch');
+        }
+        if (bundle.identity.nativeCliVersion !== onboarding.nativeCliVersion) {
+            fail('onboarding-version-mismatch', 'record version mismatch');
+        }
+    }
+    if (bundle.identity.ownerScope !== input.ownerScope) {
+        fail('onboarding-lineage-mismatch', 'ownerScope does not match the seat record');
+    }
+    if (bundle.identity.nativeCliVersion !== undefined && bundle.identity.nativeCliVersion !== input.expectedNativeCliVersion) {
+        fail('onboarding-version-mismatch', 'bundle nativeCliVersion does not match the expected version');
+    }
+    if (onboarding && onboarding.nativeCliVersion !== input.expectedNativeCliVersion) {
+        fail('onboarding-version-mismatch', 'block nativeCliVersion does not match the expected version');
+    }
+    const derivedGate = seatLaunchGate(cli, onboardingStatus);
+    if (JSON.stringify(record['launchGate']) !== JSON.stringify(derivedGate)) {
+        fail('onboarding-lineage-mismatch', 'stored launchGate disagrees with the re-derived gate');
+    }
+    const authFiles = record['authFiles'];
+    if (!Array.isArray(authFiles) || authFiles.some((n) => typeof n !== 'string')) {
+        fail('onboarding-schema-mismatch', 'seat record authFiles must be a string list');
+    }
+    return { bundle, onboarding, onboardingStatus, launchGate: derivedGate, authFiles: authFiles };
+}
+//# sourceMappingURL=seat-onboarding-record.js.map

package/dist/node/seat-onboarding-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-record.js","sourceRoot":"","sources":["../../src/node/seat-onboarding-record.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,+DAA+D;AAE/D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE7E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAIpC;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC,6BAA6B,EAAE,uCAAuC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,6BAA6B,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,6BAA6B,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,IAAI,YAAY;QAAE,IAAI,CAAC,0BAA0B,EAAE,8BAA8B,YAAY,EAAE,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;IAChC,IAAI,UAAU,GAA4B,IAAI,CAAC;IAC/C,IAAI,gBAAgB,GAAyB,QAAQ,CAAC;IACtD,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,EAAE;YAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAChE,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC;QAC/B,gBAAgB,GAAG,SAAS,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IACE,UAAU,CAAC,GAAG,KAAK,GAAG;YACtB,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO;YAC9C,UAAU,CAAC,cAAc,KAAK,MAAM,CAAC,UAAU,CAAC,cAAc;YAC9D,UAAU,CAAC,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,UAAU;YAC5D,UAAU,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;YAC5C,UAAU,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;YACtD,UAAU,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EACxD,CAAC;YACD,IAAI,CAAC,6BAA6B,EAAE,8BAA8B,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC;YACrE,IAAI,CAAC,6BAA6B,EAAE,yBAAyB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACpD,IAAI,CAAC,6BAA6B,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC1H,IAAI,CAAC,6BAA6B,EAAE,6DAA6D,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,UAAU,IAAI,UAAU,CAAC,gBAAgB,KAAK,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACjF,IAAI,CAAC,6BAA6B,EAAE,4DAA4D,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,6BAA6B,EAAE,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,4BAA4B,EAAE,6CAA6C,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAqB,EAAE,CAAC;AAC7G,CAAC"}

package/dist/node/seat-onboarding-stage1.d.ts

@@ -0,0 +1,11 @@
+import type { SeatStageInput, SeatStageResult } from './seat-onboarding-types.js';
+/**
+ * Stage 1, batch and two-phase: phase 1 validates every envelope (bundle,
+ * agy tuple, auth allowlist, onboarding binding, versions, digests, size
+ * bounds, claude minimized projection) and refuses the whole batch on the
+ * first failure with zero bytes written; an absent block is valid and
+ * stages with a closed launch gate. Phase 2 writes auth files at their
+ * storage names plus the seat record, per seat.
+ */
+export declare function materialiseSeatEnvelopes(input: SeatStageInput): Promise<SeatStageResult>;
+//# sourceMappingURL=seat-onboarding-stage1.d.ts.map

package/dist/node/seat-onboarding-stage1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-stage1.d.ts","sourceRoot":"","sources":["../../src/node/seat-onboarding-stage1.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,cAAc,EAGd,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAkCpC;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAoF9F"}

package/dist/node/seat-onboarding-stage1.js

@@ -0,0 +1,121 @@
+//
+// Stage 1 (seat stage): batch two-phase materialization of validated seat
+// envelopes into per-seat directories, plus the library-owned seat record.
+import { chmod, lstat, mkdir } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { validateSeatEnvelope, } from '../enrollment/seat-onboarding.js';
+import { SEAT_RECORD_REL_PATH, asResult, decodeBase64, fail, isRecord, sha256Hex, utf8, writeExclusive, assertCleanAncestors, DIR_MODE, } from './seat-stage-write.js';
+/** Auth `.claude.json` minimized-projection key set (stage-1 check, §3.3). */
+const CLAUDE_AUTH_MINIMIZED_KEYS = ['oauthAccount', 'hasCompletedOnboarding', 'lastOnboardingVersion'];
+function checkClaudeAuthMinimized(files) {
+    const raw = files['.claude.json'];
+    if (raw === undefined)
+        return;
+    let obj;
+    try {
+        obj = JSON.parse(new TextDecoder().decode(decodeBase64(raw)));
+    }
+    catch {
+        fail('onboarding-shape-unverified', 'auth .claude.json is not JSON');
+    }
+    if (!isRecord(obj))
+        fail('onboarding-shape-unverified', 'auth .claude.json must be an object');
+    for (const key of Object.keys(obj)) {
+        if (!CLAUDE_AUTH_MINIMIZED_KEYS.includes(key)) {
+            fail('onboarding-shape-unverified', `non-minimized auth .claude.json key: ${key}`);
+        }
+    }
+}
+/**
+ * Stage 1, batch and two-phase: phase 1 validates every envelope (bundle,
+ * agy tuple, auth allowlist, onboarding binding, versions, digests, size
+ * bounds, claude minimized projection) and refuses the whole batch on the
+ * first failure with zero bytes written; an absent block is valid and
+ * stages with a closed launch gate. Phase 2 writes auth files at their
+ * storage names plus the seat record, per seat.
+ */
+export async function materialiseSeatEnvelopes(input) {
+    try {
+        if (!isRecord(input) || !Array.isArray(input['seats']) || input['seats'].length === 0) {
+            fail('schema-mismatch', 'seats must be a non-empty array');
+        }
+        const ownerScope = input['ownerScope'];
+        if (typeof ownerScope !== 'string' || ownerScope.length === 0)
+            fail('schema-mismatch', 'ownerScope is required');
+        const expectedVersions = (input['expectedNativeCliVersions'] ?? {});
+        const validated = [];
+        const seenDirs = new Set();
+        for (const seat of input['seats']) {
+            if (!isRecord(seat) || typeof seat['seatDir'] !== 'string' || seat['seatDir'].length === 0) {
+                fail('schema-mismatch', 'each seat needs a seatDir');
+            }
+            const seatDir = resolve(seat['seatDir']);
+            if (seenDirs.has(seatDir))
+                fail('schema-mismatch', 'duplicate seatDir in batch');
+            seenDirs.add(seatDir);
+            const env = validateSeatEnvelope(seat['envelope'], { trustedAuthority: 'consumer' });
+            if (!env.ok)
+                fail(env.code, env.detail);
+            const { bundle, files, onboarding, onboardingStatus, launchGate } = env;
+            if (bundle.identity.ownerScope !== ownerScope) {
+                fail('onboarding-lineage-mismatch', 'bundle ownerScope does not match the stage ownerScope');
+            }
+            const expected = expectedVersions[bundle.identity.cli];
+            if (expected !== undefined && bundle.identity.nativeCliVersion !== expected) {
+                fail('onboarding-version-mismatch', 'bundle nativeCliVersion does not match the expected version');
+            }
+            if (bundle.identity.cli === 'claude')
+                checkClaudeAuthMinimized(files);
+            const existing = await lstat(seatDir).catch(() => null);
+            if (existing)
+                fail('onboarding-shape-unverified', `seatDir already exists: ${seatDir}`);
+            await assertCleanAncestors(seatDir);
+            validated.push({ seatDir, bundle, files, onboarding, onboardingStatus, launchGate });
+        }
+        const seats = [];
+        for (const v of validated) {
+            await mkdir(v.seatDir, { recursive: true, mode: DIR_MODE });
+            await chmod(v.seatDir, DIR_MODE);
+            const authFiles = Object.keys(v.files).sort();
+            for (const name of authFiles) {
+                await writeExclusive([v.seatDir], join(v.seatDir, name), decodeBase64(v.files[name]));
+            }
+            const record = {
+                version: 1,
+                bundle: v.bundle,
+                onboarding: v.onboarding,
+                launchGate: v.launchGate,
+                authFiles,
+            };
+            const recordBytes = utf8(`${JSON.stringify(record, null, 2)}\n`);
+            await writeExclusive([v.seatDir], join(v.seatDir, SEAT_RECORD_REL_PATH), recordBytes);
+            seats.push({
+                seatRef: v.bundle.identity.seatRef,
+                cli: v.bundle.identity.cli,
+                authFiles,
+                seatRecordSha256: sha256Hex(recordBytes),
+                onboardingStatus: v.onboardingStatus,
+                launchGate: v.launchGate,
+                onboarding: v.onboarding
+                    ? {
+                        files: v.onboarding.files.map((f) => ({
+                            destKey: f.destKey,
+                            format: f.format,
+                            sha256: f.sha256,
+                            byteLength: f.byteLength,
+                        })),
+                        nativeCliVersion: v.onboarding.nativeCliVersion,
+                        capturedAt: v.onboarding.capturedAt,
+                        lineage: v.onboarding.lineage,
+                        ...(v.onboarding.reboundFrom ? { reboundFrom: v.onboarding.reboundFrom } : {}),
+                    }
+                    : null,
+            });
+        }
+        return { ok: true, receipt: { seats } };
+    }
+    catch (error) {
+        return asResult(error);
+    }
+}
+//# sourceMappingURL=seat-onboarding-stage1.js.map

package/dist/node/seat-onboarding-stage1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-stage1.js","sourceRoot":"","sources":["../../src/node/seat-onboarding-stage1.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAE3E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EACL,oBAAoB,GAIrB,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,QAAQ,EACR,SAAS,EACT,IAAI,EACJ,cAAc,EACd,oBAAoB,EACpB,QAAQ,GACT,MAAM,uBAAuB,CAAC;AAE/B,8EAA8E;AAC9E,MAAM,0BAA0B,GAAG,CAAC,cAAc,EAAE,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;AAEvG,SAAS,wBAAwB,CAAC,KAA6B;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,6BAA6B,EAAE,+BAA+B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,6BAA6B,EAAE,qCAAqC,CAAC,CAAC;IAC/F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,6BAA6B,EAAE,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAqB;IAClE,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QACjH,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAqC,CAAC;QACxG,MAAM,SAAS,GAOV,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAkC,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3F,IAAI,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;YACjF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;YACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC9C,IAAI,CAAC,6BAA6B,EAAE,uDAAuD,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBAC5E,IAAI,CAAC,6BAA6B,EAAE,6DAA6D,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ;gBAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,QAAQ;gBAAE,IAAI,CAAC,6BAA6B,EAAE,2BAA2B,OAAO,EAAE,CAAC,CAAC;YACxF,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,MAAM,GAAG;gBACb,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS;aACV,CAAC;YACF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,WAAW,CAAC,CAAC;YACtF,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;gBAClC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;gBAC1B,SAAS;gBACT,gBAAgB,EAAE,SAAS,CAAC,WAAW,CAAC;gBACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;oBACtB,CAAC,CAAC;wBACE,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACpC,OAAO,EAAE,CAAC,CAAC,OAAO;4BAClB,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,MAAM,EAAE,CAAC,CAAC,MAAM;4BAChB,UAAU,EAAE,CAAC,CAAC,UAAU;yBACzB,CAAC,CAAC;wBACH,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB;wBAC/C,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU;wBACnC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO;wBAC7B,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/E;oBACH,CAAC,CAAC,IAAI;aACT,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/node/seat-onboarding-stage2.d.ts

@@ -0,0 +1,10 @@
+import type { SeatCellInput, SeatCellResult } from './seat-onboarding-types.js';
+/**
+ * Stage 2, one seat into one fresh cell HOME. Re-reads and re-validates the
+ * seat record (binding + versions), re-derives the launch gate (a stored
+ * gate that disagrees is a tampered record), refuses a closed gate with
+ * `onboarding-required` before any write, then writes as single writer per
+ * owned destination. The seatDir is opened read-only and never mutated.
+ */
+export declare function materialiseCellHome(input: SeatCellInput): Promise<SeatCellResult>;
+//# sourceMappingURL=seat-onboarding-stage2.d.ts.map

package/dist/node/seat-onboarding-stage2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-stage2.d.ts","sourceRoot":"","sources":["../../src/node/seat-onboarding-stage2.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,aAAa,EACb,cAAc,EAEf,MAAM,4BAA4B,CAAC;AAUpC;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAiFvF"}

package/dist/node/seat-onboarding-stage2.js

@@ -0,0 +1,110 @@
+//
+// Stage 2 (cell stage): seed one fresh cell HOME from a staged seat record.
+// Single writer per owned destination; the seatDir is opened read-only.
+import { lstat, readdir, readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { SEAT_ENVELOPE_AUTH_FILES } from '../enrollment/seat-onboarding.js';
+import { authCellDest, planOnboardingWrites, receiptRelPath } from './seat-onboarding-cell-compose.js';
+import { readSeatRecord } from './seat-onboarding-record.js';
+import { asResult, fail, isRecord, sha256Hex, writeExclusive, assertCleanAncestors, } from './seat-stage-write.js';
+/**
+ * Stage 2, one seat into one fresh cell HOME. Re-reads and re-validates the
+ * seat record (binding + versions), re-derives the launch gate (a stored
+ * gate that disagrees is a tampered record), refuses a closed gate with
+ * `onboarding-required` before any write, then writes as single writer per
+ * owned destination. The seatDir is opened read-only and never mutated.
+ */
+export async function materialiseCellHome(input) {
+    try {
+        if (!isRecord(input))
+            fail('schema-mismatch', 'input must be an object');
+        for (const key of ['seatDir', 'cellHome', 'workspaceDir', 'expectedNativeCliVersion', 'ownerScope']) {
+            if (typeof input[key] !== 'string' || input[key].length === 0)
+                fail('schema-mismatch', `${key} is required`);
+        }
+        if (!isRecord(input['configDirs']))
+            fail('schema-mismatch', 'configDirs is required');
+        const seatDir = resolve(input.seatDir);
+        const cellHome = resolve(input.cellHome);
+        const workspaceDir = resolve(input.workspaceDir);
+        const configDirs = {
+            claudeConfigDir: resolve(input.configDirs['claudeConfigDir']),
+            codexHome: resolve(input.configDirs['codexHome']),
+            xdgConfigHome: resolve(input.configDirs['xdgConfigHome']),
+        };
+        const record = await readSeatRecord({
+            seatDir,
+            expectedNativeCliVersion: input.expectedNativeCliVersion,
+            ownerScope: input.ownerScope,
+        });
+        const { bundle, onboarding, launchGate } = record;
+        const cli = bundle.identity.cli;
+        if (!launchGate.eligible)
+            fail('onboarding-required', 'launch gate is closed for this seat');
+        const wsSt = await lstat(workspaceDir).catch(() => null);
+        if (!wsSt || wsSt.isSymbolicLink() || !wsSt.isDirectory()) {
+            fail('onboarding-shape-unverified', 'workspaceDir must be an existing directory');
+        }
+        if (onboarding && onboarding.cellSynthesis.length > 0) {
+            // Q2: the trust write is allowed only for the bench-created empty workspace.
+            const entries = await readdir(workspaceDir);
+            if (entries.length > 0) {
+                fail('onboarding-shape-unverified', 'trust write is limited to the empty bench-created workspace (Q2)');
+            }
+        }
+        const cellSt = await lstat(cellHome).catch(() => null);
+        if (cellSt)
+            fail('onboarding-shape-unverified', 'cellHome must be fresh (not pre-existing)');
+        for (const dir of Object.values(configDirs)) {
+            const st = await lstat(dir).catch(() => null);
+            if (st)
+                fail('onboarding-shape-unverified', `configDir must be fresh: ${dir}`);
+        }
+        const roots = [cellHome, configDirs.claudeConfigDir, configDirs.codexHome, configDirs.xdgConfigHome];
+        for (const root of roots)
+            await assertCleanAncestors(root);
+        // plan every write before writing any byte
+        const writes = [];
+        const allowlist = SEAT_ENVELOPE_AUTH_FILES[cli];
+        for (const name of record.authFiles) {
+            if (!allowlist.includes(name))
+                fail('unknown-field', `auth file not allowlisted for ${cli}: ${name}`);
+            const src = join(seatDir, name);
+            const st = await lstat(src).catch(() => null);
+            if (!st || st.isSymbolicLink() || !st.isFile()) {
+                fail('onboarding-shape-unverified', `auth file missing in seatDir: ${name}`);
+            }
+            const bytes = new Uint8Array(await readFile(src));
+            if (cli === 'claude' && name === '.claude.json')
+                continue; // composed below
+            writes.push({ path: authCellDest(name, cellHome, configDirs), bytes, cls: 'auth' });
+        }
+        if (onboarding) {
+            writes.push(...await planOnboardingWrites({
+                cli,
+                onboarding,
+                seatDir,
+                cellHome,
+                workspaceDir,
+                configDirs,
+                claudeMcpConfig: input.claudeMcpConfig,
+                codexMcpServers: input.codexMcpServers,
+            }));
+        }
+        for (const w of writes)
+            await writeExclusive(roots, w.path, w.bytes);
+        const files = writes
+            .map((w) => ({
+            cellRelPath: receiptRelPath(w.path, cellHome, configDirs),
+            class: w.cls,
+            sha256: sha256Hex(w.bytes),
+            byteLength: w.bytes.length,
+        }))
+            .sort((a, b) => a.cellRelPath.localeCompare(b.cellRelPath));
+        return { ok: true, receipt: { files } };
+    }
+    catch (error) {
+        return asResult(error);
+    }
+}
+//# sourceMappingURL=seat-onboarding-stage2.js.map

package/dist/node/seat-onboarding-stage2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-stage2.js","sourceRoot":"","sources":["../../src/node/seat-onboarding-stage2.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACvG,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAO7D,OAAO,EACL,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,SAAS,EACT,cAAc,EACd,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAoB;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QACzE,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,0BAA0B,EAAE,YAAY,CAAU,EAAE,CAAC;YAC7G,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAK,KAAK,CAAC,GAAG,CAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,iBAAiB,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAAE,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,UAAU,GAAuB;YACrC,eAAe,EAAE,OAAO,CAAE,KAAK,CAAC,UAAqC,CAAC,iBAAiB,CAAC,CAAC;YACzF,SAAS,EAAE,OAAO,CAAE,KAAK,CAAC,UAAqC,CAAC,WAAW,CAAC,CAAC;YAC7E,aAAa,EAAE,OAAO,CAAE,KAAK,CAAC,UAAqC,CAAC,eAAe,CAAC,CAAC;SACtF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,OAAO;YACP,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,IAAI,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,6BAA6B,EAAE,4CAA4C,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,UAAU,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,6EAA6E;YAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,6BAA6B,EAAE,kEAAkE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,IAAI,CAAC,6BAA6B,EAAE,2CAA2C,CAAC,CAAC;QAC7F,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,EAAE;gBAAE,IAAI,CAAC,6BAA6B,EAAE,4BAA4B,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3D,2CAA2C;QAC3C,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,eAAe,EAAE,iCAAiC,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/C,IAAI,CAAC,6BAA6B,EAAE,iCAAiC,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc;gBAAE,SAAS,CAAC,iBAAiB;YAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,CAAC;gBACxC,GAAG;gBACH,UAAU;gBACV,OAAO;gBACP,QAAQ;gBACR,YAAY;gBACZ,UAAU;gBACV,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,eAAe,EAAE,KAAK,CAAC,eAAe;aACvC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;YACzD,KAAK,EAAE,CAAC,CAAC,GAAG;YACZ,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;SAC3B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/node/seat-onboarding-types.d.ts

@@ -0,0 +1,106 @@
+import type { SeatBundleV1, SeatCli, SeatLineageTuple } from '../enrollment/seat-bundle.js';
+import type { SeatLaunchGate, SeatOnboardingDestKey, SeatOnboardingFormat, SeatOnboardingStatus, SeatOnboardingV1 } from '../enrollment/seat-onboarding.js';
+import type { StageCode } from './seat-stage-write.js';
+export interface SeatStageInputSeat {
+    envelope: unknown;
+    seatDir: string;
+}
+export interface SeatStageInput {
+    seats: readonly SeatStageInputSeat[];
+    ownerScope: string;
+    expectedNativeCliVersions: Partial<Record<SeatCli, string>>;
+}
+export interface SeatStageReceiptOnboarding {
+    files: Array<{
+        destKey: SeatOnboardingDestKey;
+        format: SeatOnboardingFormat;
+        sha256: string;
+        byteLength: number;
+    }>;
+    nativeCliVersion: string;
+    capturedAt: string;
+    lineage: SeatLineageTuple;
+    reboundFrom?: SeatLineageTuple;
+}
+export interface SeatStageReceiptEntry {
+    seatRef: string;
+    cli: SeatCli;
+    authFiles: string[];
+    seatRecordSha256: string;
+    onboardingStatus: SeatOnboardingStatus;
+    launchGate: SeatLaunchGate;
+    onboarding: SeatStageReceiptOnboarding | null;
+}
+export interface SeatStageReceipt {
+    seats: SeatStageReceiptEntry[];
+}
+export type SeatStageResult = {
+    ok: true;
+    receipt: SeatStageReceipt;
+} | {
+    ok: false;
+    code: StageCode;
+    detail: string;
+};
+export interface SeatCellConfigDirs {
+    claudeConfigDir: string;
+    codexHome: string;
+    xdgConfigHome: string;
+}
+export interface SeatCodexMcpServer {
+    name: string;
+    command: string;
+    args: readonly string[];
+    defaultToolsApprovalMode?: 'approve';
+}
+export interface SeatCellInput {
+    seatDir: string;
+    cellHome: string;
+    workspaceDir: string;
+    configDirs: SeatCellConfigDirs;
+    expectedNativeCliVersion: string;
+    ownerScope: string;
+    claudeMcpConfig?: Record<string, unknown>;
+    codexMcpServers?: readonly SeatCodexMcpServer[];
+}
+export type SeatCellFileClass = 'auth' | 'onboarding' | 'synthesized' | 'composed';
+export interface SeatCellReceiptFile {
+    cellRelPath: string;
+    class: SeatCellFileClass;
+    sha256: string;
+    byteLength: number;
+}
+export interface SeatCellReceipt {
+    files: SeatCellReceiptFile[];
+}
+export type SeatCellResult = {
+    ok: true;
+    receipt: SeatCellReceipt;
+} | {
+    ok: false;
+    code: StageCode;
+    detail: string;
+};
+export type SeatEraseResult = {
+    ok: true;
+    survivingPaths: string[];
+} | {
+    ok: false;
+    code: StageCode;
+    detail: string;
+};
+/** One planned exclusive write, staged before any byte is written. */
+export interface PlannedWrite {
+    path: string;
+    bytes: Uint8Array;
+    cls: SeatCellFileClass;
+}
+/** Re-validated stage-1 seat record (stage 2 reads it, never trusts it). */
+export interface SeatRecordView {
+    bundle: SeatBundleV1;
+    onboarding: SeatOnboardingV1 | null;
+    onboardingStatus: SeatOnboardingStatus;
+    launchGate: SeatLaunchGate;
+    authFiles: string[];
+}
+//# sourceMappingURL=seat-onboarding-types.d.ts.map

package/dist/node/seat-onboarding-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-types.d.ts","sourceRoot":"","sources":["../../src/node/seat-onboarding-types.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,KAAK,CAAC;QACX,OAAO,EAAE,qBAAqB,CAAC;QAC/B,MAAM,EAAE,oBAAoB,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,EAAE,0BAA0B,GAAG,IAAI,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAInD,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,wBAAwB,CAAC,EAAE,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,eAAe,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACjD;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnF,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAInD,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAInD,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,GAAG,EAAE,iBAAiB,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpC,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/node/seat-onboarding-types.js

@@ -0,0 +1,6 @@
+//
+// Shared input / receipt types for the two-stage seat materialization and
+// erasure. Types only: no IO, imported by every sibling stage module and
+// re-exported from the public barrel.
+export {};
+//# sourceMappingURL=seat-onboarding-types.js.map

package/dist/node/seat-onboarding-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-onboarding-types.js","sourceRoot":"","sources":["../../src/node/seat-onboarding-types.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,sCAAsC"}

package/dist/node/seat-stage-write.d.ts

@@ -0,0 +1,25 @@
+import type { SeatValidationCode } from '../enrollment/seat-bundle.js';
+import { type SeatOnboardingCode } from '../enrollment/seat-onboarding.js';
+export declare const SEAT_RECORD_REL_PATH: string;
+export declare const DIR_MODE = 448;
+export type StageCode = SeatOnboardingCode | SeatValidationCode;
+export declare function fail(code: StageCode, detail: string): never;
+export declare const asResult: (error: unknown) => {
+    ok: false;
+    code: StageCode;
+    detail: string;
+};
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+export declare const utf8: (text: string) => Uint8Array;
+export declare const sha256Hex: (bytes: Uint8Array) => string;
+export declare const decodeBase64: (value: string) => Uint8Array;
+export declare const withinRoot: (root: string, path: string) => boolean;
+/** Walk every existing ancestor of `path` and refuse any symlink in the chain. */
+export declare function assertCleanAncestors(path: string): Promise<void>;
+/**
+ * Single-writer exclusive write: the resolved path must stay inside one of
+ * `roots`, no component of the chain may be a symlink, the target must not
+ * pre-exist, parents are created 0700 and the file 0600 with `wx`.
+ */
+export declare function writeExclusive(roots: readonly string[], absPath: string, bytes: Uint8Array): Promise<void>;
+//# sourceMappingURL=seat-stage-write.d.ts.map

package/dist/node/seat-stage-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-stage-write.d.ts","sourceRoot":"","sources":["../../src/node/seat-stage-write.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEhG,eAAO,MAAM,oBAAoB,QAAiD,CAAC;AAEnF,eAAO,MAAM,QAAQ,MAAQ,CAAC;AAG9B,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAWhE,wBAAgB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAE3D;AAED,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAIrF,CAAC;AAEF,eAAO,MAAM,QAAQ,UAAW,OAAO,qCAC+B,CAAC;AAEvE,eAAO,MAAM,IAAI,SAAU,MAAM,KAAG,UAA4C,CAAC;AAEjF,eAAO,MAAM,SAAS,UAAW,UAAU,KAAG,MAA0D,CAAC;AAEzG,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,UAA0D,CAAC;AAExG,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,MAAM,KAAG,OAGvD,CAAC;AAEF,kFAAkF;AAClF,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtE;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhH"}

package/dist/node/seat-stage-write.js

@@ -0,0 +1,93 @@
+//
+// Shared fail-closed write primitives for the seat materialization stages.
+// Internal module: not exported from the package entry points.
+import { chmod, lstat, mkdir, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { SeatOnboardingError } from '../enrollment/seat-onboarding.js';
+export const SEAT_RECORD_REL_PATH = join('.sentropic-seat', 'seat-record.v1.json');
+export const DIR_MODE = 0o700;
+const FILE_MODE = 0o600;
+class StageRefusal extends Error {
+    code;
+    constructor(code, detail) {
+        super(detail);
+        this.name = 'StageRefusal';
+        this.code = code;
+    }
+}
+export function fail(code, detail) {
+    throw new StageRefusal(code, detail);
+}
+export const asResult = (error) => {
+    if (error instanceof StageRefusal)
+        return { ok: false, code: error.code, detail: error.message };
+    if (error instanceof SeatOnboardingError)
+        return { ok: false, code: error.code, detail: error.message };
+    throw error;
+};
+export const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+export const utf8 = (text) => new TextEncoder().encode(text);
+export const sha256Hex = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export const decodeBase64 = (value) => new Uint8Array(Buffer.from(value, 'base64'));
+export const withinRoot = (root, path) => {
+    const rel = relative(resolve(root), resolve(path));
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+};
+/** Walk every existing ancestor of `path` and refuse any symlink in the chain. */
+export async function assertCleanAncestors(path) {
+    let current = resolve(path);
+    for (;;) {
+        let st;
+        try {
+            st = await lstat(current);
+        }
+        catch {
+            const parent = dirname(current);
+            if (parent === current)
+                return;
+            current = parent;
+            continue;
+        }
+        if (st.isSymbolicLink())
+            fail('onboarding-shape-unverified', `symlinked ancestor: ${current}`);
+        const parent = dirname(current);
+        if (parent === current)
+            return;
+        current = parent;
+    }
+}
+/**
+ * Single-writer exclusive write: the resolved path must stay inside one of
+ * `roots`, no component of the chain may be a symlink, the target must not
+ * pre-exist, parents are created 0700 and the file 0600 with `wx`.
+ */
+export async function writeExclusive(roots, absPath, bytes) {
+    const resolved = resolve(absPath);
+    const root = roots.find((r) => withinRoot(r, resolved));
+    if (!root)
+        fail('onboarding-shape-unverified', `path escapes the stage root: ${absPath}`);
+    const rel = relative(resolve(root), resolved);
+    const parts = rel.split(sep);
+    let current = resolve(root);
+    for (let i = 0; i < parts.length; i += 1) {
+        current = join(current, parts[i]);
+        let st;
+        try {
+            st = await lstat(current);
+        }
+        catch {
+            break; // this component and everything below it do not exist yet
+        }
+        if (st.isSymbolicLink())
+            fail('onboarding-shape-unverified', `symlink in path: ${current}`);
+        if (i === parts.length - 1)
+            fail('onboarding-shape-unverified', `pre-existing target: ${current}`);
+        if (!st.isDirectory())
+            fail('onboarding-shape-unverified', `non-directory in path: ${current}`);
+    }
+    await mkdir(dirname(resolved), { recursive: true, mode: DIR_MODE });
+    await writeFile(resolved, bytes, { flag: 'wx', mode: FILE_MODE });
+    await chmod(resolved, FILE_MODE);
+}
+//# sourceMappingURL=seat-stage-write.js.map

package/dist/node/seat-stage-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-stage-write.js","sourceRoot":"","sources":["../../src/node/seat-stage-write.ts"],"names":[],"mappings":"AAAA,EAAE;AACF,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAA2B,MAAM,kCAAkC,CAAC;AAEhG,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAC9B,MAAM,SAAS,GAAG,KAAK,CAAC;AAIxB,MAAM,YAAa,SAAQ,KAAK;IACrB,IAAI,CAAY;IACzB,YAAY,IAAe,EAAE,MAAc;QACzC,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,IAAI,CAAC,IAAe,EAAE,MAAc;IAClD,MAAM,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAkD,EAAE;IACzF,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACjG,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACxG,MAAM,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC3E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;IAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO;YAC/B,OAAO,GAAG,MAAM,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,IAAI,CAAC,6BAA6B,EAAE,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO;QAC/B,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAwB,EAAE,OAAe,EAAE,KAAiB;IAC/F,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,6BAA6B,EAAE,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,0DAA0D;QACnE,CAAC;QACD,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,IAAI,CAAC,6BAA6B,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,6BAA6B,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,6BAA6B,EAAE,0BAA0B,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC"}