@tiangong-lca/cli 0.0.24 → 0.0.26

package/dist/src/lib/dataset-maintenance-protected-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-protected-run.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yBAAyB,IAAI,+BAA+B,EAC5D,uBAAuB,IAAI,6BAA6B,EACxD,sBAAsB,IAAI,4BAA4B,EACtD,aAAa,IAAI,mBAAmB,GACrC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,GAIf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,0BAA0B,EAC1B,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,GAS1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,wBAAwB,GAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,EAClC,6BAA6B,EAC7B,+BAA+B,GAEhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAkEpD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,IAAI,eAAe,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QAC7E,MAAM,IAAI,QAAQ,CAAC,kDAAkD,EAAE;YACrE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,KAAK,CAAC,OAA8C;IAC3D,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO;QACL,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACnD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,IAAI,EACF,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrF,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAA4C;IAMhE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,OAItC;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,yDAAyD,EAAE;YAC5F,IAAI,EAAE,qDAAqD;YAC3D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,8BAA8B,CAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,KAAc;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,cAAc,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,MAAM,OAAO,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,MAAM,OAAO,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,8BAA8B,MAAM,OAAO,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,MAAM,OAAO,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,MAAM,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAoC;IAEpC,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,GAAG,QAAQ,CAAC,SAAS;YACrB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,MAAM,OAAO,CAAC;YACrF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,MAAM,OAAO,CAAC;YACzF,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,MAAM,OAAO,CAAC;YAC7F,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC5B,QAAQ,CAAC,MAAM,EACf,iCAAiC,MAAM,OAAO,CAC/C;YACD,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC;AACJ,CAAC;AAaD,SAAS,yCAAyC,CAChD,OAA8C,EAC9C,YAA8C;IAE9C,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE;YAChE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,MAAM;QACd,CAAC,CAAC,OAAO,CAAC,gBAAgB;YACxB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,sEAAsE,EAAE;YACzF,IAAI,EAAE,iDAAiD;YACvD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,kBAAkB;KAC1B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,CAAC;QACjD,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,KAAK,EAAE,8BAA8B;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,oCAAoC,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpE,6BAA6B,CAAC;QAC5B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,6BAA6B,CAAC;QAC5B,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,YAAY,CAAC,uBAAuB,CAAC;QACnC,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,WAAW;QACxC,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAAC;QACpD,MAAM;KACP,CAAC,CAAC;IACH,YAAY,CAAC,sBAAsB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;QAChD,gBAAgB,EAAE,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,QAAQ,CAAC,wBAAwB;YACnC,CAAC,CAAC,OAAO,CAAC,gBAAgB;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC;QAC1C,MAAM;QACN,QAAQ;QACR,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;KACjD,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,mCAAmC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QAClE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QACjE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,0CAA0C,CAAC;QACxF,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACrE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACtE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QAClE,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC;QAC5E,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC;QACpE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAuC,CAAC;KAC3E,CAAC;IACF,OAAO;QACL,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,cAAc,CAAC,QAAQ;QACnC,YAAY,EAAE,gBAAgB,CAAC,QAAQ;QACvC,MAAM;QACN,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA8C;IAE9C,OAAO,yCAAyC,CAAC,OAAO,EAAE;QACxD,YAAY;QACZ,SAAS,EAAE,oBAAoB;QAC/B,cAAc,EAAE,qBAAqB;QACrC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,sBAAsB;QACrC,uBAAuB,EAAE,gCAAgC;QACzD,sBAAsB,EAAE,+BAA+B;QACvD,aAAa,EAAE,+BAA+B;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,OAK9B;IACC,IACE,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACrE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QAC3E,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;QACvE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,kGAAkG,EAClG;YACE,IAAI,EAAE,gDAAgD;YACtD,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE;gBACP,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC3D,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACjD,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACzD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;aAClD;SACF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAItB;IACC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,uBAAuB,CAAC,OAIhC;IACC,6BAA6B,CAAC;QAC5B,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;QACjC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACpD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAGrC;IACC,MAAM,4BAA4B,CAAC;QACjC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,OAGxC;IACC,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB;KAChE,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,OAKC,EACD,YAAuC;IASvC,MAAM,SAAS,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,CAAU,CAAC;IACjG,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;YAC/C,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe;YACjD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI;SACL,CAAC,CAAC;QACH,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9C,eAAe,EAAE,YAAY,CAAC,MAAM,EAAE;YACtC,KAAK;YACL,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO,EAAE;YACP,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;YACvC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;YACnC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;SACzC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAKpC;IAQC,OAAO,qCAAqC,CAAC,OAAO,EAAE;QACpD,WAAW,EAAE,oCAAoC;QACjD,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAAkB,EAClB,QAAoC;IAEpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;IACxE,IACE,CAAC,YAAY,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,cAAc,KAAK,4BAA4B,CAAC,aAAa;QACpE,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QACzC,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACnD,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC3C,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC7C,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,MAAM,CAAC,eAAe,KAAK,KAAK,EAChC,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;YAClF,IAAI,EAAE,8CAA8C;YACpD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,KAAK,UAAU,6BAA6B,CAC1C,OAIC,EACD,YAAuC;IAKvC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,WAAW,GAAG,KAAK,CAAC;IAC5D,MAAM,KAAK,GACT,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;gBAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACzC,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,kBAAkB;gBAC/B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE;oBACZ,MAAM,EAAE,eAAe;oBACvB,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,mCAAmC;4BACzC,OAAO,EACL,8EAA8E;4BAChF,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;yBAC7B;qBACF;oBACD,gBAAgB,EAAE,IAAI;oBACtB,mBAAmB,EAAE,IAAI;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;YAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACzC,KAAK;YACL,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,0BAA0B,GAC9B,KAAK,CAAC,gBAAgB,KAAK,cAAc,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC/E,IACE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC;YAC3D,YAAY,CAAC,KAAK,EAAE,IAAI,QAAQ,EAChC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,YAAY,EAAE,MAAM,YAAY,CAAC,eAAe,CAAC;wBAC/C,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;wBAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;wBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;wBACnC,KAAK;wBACL,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;qBACnC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;oBAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACzC,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,2BAA2B;oBACxC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;gBACH,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;oBACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,SAAS;gBACX,CAAC;gBACD,OAAO;oBACL,KAAK;oBACL,YAAY,EAAE;wBACZ,MAAM,EAAE,eAAe;wBACvB,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,yCAAyC;gCAC/C,OAAO,EACL,2EAA2E;gCAC7E,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;6BAC7B;yBACF;wBACD,gBAAgB,EAAE,IAAI;wBACtB,mBAAmB,EAAE,IAAI;qBAC1B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAI5B;IAIC,OAAO,6BAA6B,CAAC,OAAO,EAAE;QAC5C,aAAa,EAAE,6BAA6B;QAC5C,WAAW,EAAE,yBAAyB;QACtC,eAAe,EAAE,wBAAwB;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAMpB;IACC,OAAO;QACL,cAAc,EAAE,4BAA4B,CAAC,aAAa;QAC1D,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;QAC3D,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;QACnC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;QAChD,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe;QAC1D,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW;QAC9C,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY;QAChD,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;QACtC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,OAAO,CAAC,KAAK;QAC9B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAyC;IACxE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAKrC;IACC,IAAI,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACpC,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EACzC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC1C,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAC3C,OAAO,CAAC,YAAY,CAAC,gBAAgB,CACtC,CAAC;QACF,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;YACvE,0BAA0B,EAAE,UAAU,CACpC,wCAAwC,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CACrF;YACD,mCAAmC,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B;SACtF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QAC7C,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAC9C,OAAO,CAAC,YAAY,CAAC,mBAAmB,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,yCAAyC,CACpE,CAAC;IACF,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,IACE,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;QAClC,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc;QACjD,CAAC,yBAAyB;QAC1B,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EACvD,CAAC;QACD,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAC1C,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAkBD,KAAK,UAAU,6BAA6B,CAC1C,OAA8C,EAC9C,YAAwC,EACxC,YAA0C;IAE1C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,CAAC,aAAa,CAC/B,YAAY,CAAC,SAAS,CAAC,kBAAkB,EACzC,EAAE,MAAM,EAAE,iCAAiC,YAAY,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAC/E,KAAK,IAAI,EAAE;QACT,yBAAyB,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,EAAE;YAC/D,cAAc,EAAE,4BAA4B,CAAC,aAAa;YAC1D,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU;YAC5C,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe;YACtD,SAAS,EAAE,YAAY,CAAC,QAAQ;YAChC,WAAW,EAAE,YAAY,CAAC,UAAU;YACpC,aAAa,EAAE,YAAY,CAAC,YAAY;YACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW;YAC1C,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY;YAC5C,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW;YAC9C,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK;YAClC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,sBAAsB,CAC3C,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EACrC,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAChB,6FAA6F,EAC7F;gBACE,IAAI,EAAE,8CAA8C;gBACpD,QAAQ,EAAE,CAAC;aACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;YAChD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,qBAAqB,CAAC;YACpB,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,SAAS,GAAmC,IAAI,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;gBAClD,OAAO;gBACP,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,uBAAuB,CAAC;gBACtB,QAAQ;gBACR,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAE1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,qBAAqB,CAAC;gBAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,gBAAgB;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC;gBACzD,OAAO;gBACP,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,cAAc,CAC3C,YAAY,EACZ,QAAQ,CAAC,QAAQ,EACjB,KAAK,CAAC,OAAO,CAAC,CACf,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAC;YAC5E,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;gBAC/D,KAAK,EAAE,iBAAiB;gBACxB,sBAAsB,EAAE,UAAU,CAAC,cAAc,CAAC;gBAClD,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC;aAC9C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC5C,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa;aAC9C,CAAC,CAAC;YACH,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;gBAC/D,cAAc,EAAE,4BAA4B,CAAC,aAAa;gBAC1D,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;gBAC7C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBACxC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;gBAClD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC1C,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;gBAC5C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;gBAC9B,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC1C,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;gBACxD,sBAAsB,EAAE,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC7D,sBAAsB,EAAE,SAAS,CAAC,YAAY;gBAC9C,oBAAoB,EAAE,SAAS,CAAC,UAAU;gBAC1C,YAAY,EAAE,KAAK,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,MAAM,CAAC,WAAW,CACrC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAChE;gBACD,eAAe,EAAE,CAAC;gBAClB,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC;gBAClD,SAAS;gBACT,WAAW,EAAE,KAAK,CAAC,OAAO;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;oBACrD,OAAO;oBACP,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,SAAS,GAAG,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACpF,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;oBAC/D,KAAK,EAAE,SAAS;oBAChB,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE;oBACtE,cAAc,EAAE,CAAC;oBACjB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;oBACxC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACzC,cAAc,EAAE,4BAA4B;oBAC5C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,OAAO;YAChB,QAAQ;YACR,SAAS;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,4BAA4B,CAAC;YAC3B,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAA8C;IAE9C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,6BAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACtD,aAAa,EAAE,iBAAiB;QAChC,cAAc,EAAE,+BAA+B;QAC/C,gBAAgB,EAAE,2BAA2B;QAC7C,aAAa,EAAE,sBAAsB;QACrC,eAAe,EAAE,yBAAyB;QAC1C,qBAAqB,EAAE,8BAA8B;QACrD,kBAAkB,EAAE,kCAAkC;QACtD,cAAc,EAAE,4BAA4B;QAC5C,YAAY,EAAE,qBAAqB;QACnC,iBAAiB,EAAE,0BAA0B;QAC7C,cAAc,EAAE,8BAA8B;QAC9C,cAAc,EAAE,4BAA4B;QAC5C,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,wBAAwB;IACxB,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;IACrB,yBAAyB;IACzB,uBAAuB;IACvB,sBAAsB;IACtB,WAAW;IACX,uBAAuB;IACvB,KAAK;IACL,YAAY;IACZ,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,yBAAyB;IACzB,yCAAyC;IACzC,aAAa;IACb,YAAY;IACZ,aAAa;IACb,6BAA6B;IAC7B,6BAA6B;IAC7B,qBAAqB;IACrB,qCAAqC;IACrC,4BAA4B;IAC5B,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC","sourcesContent":["import { appendFileSync, chmodSync, existsSync } from 'node:fs';\nimport path from 'node:path';\nimport { buildAliasPlanRequest } from './dataset-maintenance-alias-request.js';\nimport {\n  ensurePrivateArtifactDirectory,\n  readProtectedJsonArtifact,\n  writePrivateImmutableJson,\n} from './dataset-maintenance-protected-artifacts.js';\nimport {\n  assertDerivativeBaselines as assertSharedDerivativeBaselines,\n  assertStrictBeforeState as assertSharedStrictBeforeState,\n  assertSupportSnapshots as assertSharedSupportSnapshots,\n  projectedRows as sharedProjectedRows,\n} from './dataset-maintenance-protected-before.js';\nimport {\n  isJsonObject,\n  parseMaintenancePlan,\n  readJsonFile,\n  sha256Json,\n  sha256Text,\n  stableJsonText,\n  type DatasetMaintenancePlan,\n  type DatasetMaintenanceRemoteRow,\n  type JsonObject,\n} from './dataset-maintenance-contract.js';\nimport {\n  PROTECTED_EXECUTION_CONTRACT,\n  assertProtectedApprovalBindings,\n  assertProtectedFreezeMatchesPlan,\n  buildProtectedAdmitRequest,\n  buildProtectedExecutionIdentity,\n  buildProtectedPreflightRequest,\n  parseProtectedAdmissionProof,\n  parseProtectedApproval,\n  parseProtectedFreeze,\n  parseProtectedGateProof,\n  parseProtectedPreflightProof,\n  parseProtectedStatusProof,\n  type DatasetMaintenanceProtectedApproval,\n  type DatasetMaintenanceProtectedFreeze,\n  type ProtectedAdmissionProof,\n  type ProtectedExecutionIdentity,\n  type ProtectedExecutionStatusProof,\n  type ProtectedGateProof,\n  type ProtectedPreflightProof,\n  type ProtectedReportStatus,\n} from './dataset-maintenance-protected-contract.js';\nimport {\n  assertProtectedPreparationPlanSha256,\n  assertProtectedProductionProjectRef,\n} from './dataset-maintenance-protected-preparation.js';\nimport {\n  verifyProtectedExecution,\n  type ProtectedVerificationResult,\n} from './dataset-maintenance-protected-verify.js';\nimport { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';\nimport {\n  admitMaintenanceAliasExecution,\n  captureMaintenanceAliasExecutionGate,\n  fetchMaintenanceAccountRows,\n  normalizeMaintenancePageSize,\n  preflightMaintenanceAliasExecution,\n  readMaintenanceAliasExecution,\n  resolveMaintenanceRemoteContext,\n  type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\nimport { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\nimport { withStateFileLock } from './state-lock.js';\n\nexport type RunDatasetMaintenanceProtectedOptions = {\n  planPath: string;\n  freezePath: string;\n  approvalPath: string;\n  outDir: string;\n  commit: boolean;\n  statusOnly: boolean;\n  approveExecution?: string;\n  confirm?: string;\n  waitSeconds?: number;\n  pollMs?: number;\n  pageSize?: number;\n  timeoutMs?: number;\n  env: NodeJS.ProcessEnv;\n  fetchImpl: FetchLike;\n  now?: Date;\n  sleep?: (ms: number) => Promise<void>;\n};\n\nexport type DatasetMaintenanceProtectedReport = {\n  schema_version: typeof PROTECTED_EXECUTION_CONTRACT.report_schema;\n  generated_at_utc: string;\n  mode: 'commit' | 'status_only';\n  status: ProtectedReportStatus;\n  request_id: string;\n  identity_sha256: string;\n  plan_sha256: string;\n  operation_id: string;\n  actor: { user_id: string; email: string };\n  project_ref: string;\n  admission: ProtectedAdmissionProof | null;\n  database_status: ProtectedExecutionStatusProof | null;\n  issues: Array<{ code: string; message: string; details?: unknown }>;\n  artifacts: {\n    execution_seal: string;\n    preflight_evidence: string;\n    gate_receipts: string;\n    submission_attempt: string;\n    admission_response: string;\n    admission_transport_error: string;\n    status_progress: string;\n    primary_readback: string;\n    reference_readback: string;\n    audit_readback: string;\n    derivative_readback: string;\n    terminal_report: string;\n    attempt_report: string;\n  };\n};\n\ntype PreparedProtectedExecution = {\n  planPath: string;\n  planDir: string;\n  freezePath: string;\n  approvalPath: string;\n  outDir: string;\n  plan: DatasetMaintenancePlan;\n  freeze: DatasetMaintenanceProtectedFreeze;\n  approval: DatasetMaintenanceProtectedApproval;\n  identity: ProtectedExecutionIdentity;\n  aliasPlanRequest: JsonObject;\n  artifacts: DatasetMaintenanceProtectedReport['artifacts'];\n};\n\nconst DEFAULT_POLL_MS = 10_000;\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nfunction normalizeWaitSeconds(value?: number): number {\n  const normalized = value ?? 0;\n  if (!Number.isInteger(normalized) || normalized < 0 || normalized > 86_400) {\n    throw new CliError('waitSeconds must be an integer between 0 and 86400.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_WAIT_INVALID',\n      exitCode: 2,\n    });\n  }\n  return normalized;\n}\n\nfunction normalizePollMs(value?: number): number {\n  const normalized = value ?? DEFAULT_POLL_MS;\n  if (!Number.isInteger(normalized) || normalized < 100 || normalized > 60_000) {\n    throw new CliError('pollMs must be an integer between 100 and 60000.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_POLL_INVALID',\n      exitCode: 2,\n    });\n  }\n  return normalized;\n}\n\nfunction clock(options: RunDatasetMaintenanceProtectedOptions): Date {\n  return options.now ?? new Date();\n}\n\nfunction errorDetails(error: unknown): { name: string; message: string; code: string | null } {\n  return {\n    name: error instanceof Error ? error.name : 'Error',\n    message: error instanceof Error ? error.message : String(error),\n    code:\n      error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'\n        ? error.code\n        : null,\n  };\n}\n\nfunction readArtifact(options: { filePath: string; label: string }): {\n  resolved: string;\n  value: unknown;\n  text: string;\n  file_sha256: string;\n} {\n  const artifact = readProtectedJsonArtifact(options);\n  return {\n    resolved: artifact.resolved,\n    value: artifact.value,\n    text: artifact.text,\n    file_sha256: artifact.file_sha256,\n  };\n}\n\nfunction assertCanonicalParsedArtifact(options: {\n  label: string;\n  text: string;\n  value: unknown;\n}): void {\n  if (options.text !== `${stableJsonText(options.value)}\\n`) {\n    throw new CliError(`${options.label} must be canonical JSON with exactly one final newline.`, {\n      code: 'DATASET_MAINTENANCE_PROTECTED_ARTIFACT_NONCANONICAL',\n      exitCode: 2,\n    });\n  }\n}\n\nfunction ensurePrivateDirectory(directory: string): void {\n  ensurePrivateArtifactDirectory(directory);\n}\n\nfunction appendPrivateJsonLine(filePath: string, value: unknown): string {\n  const resolved = path.resolve(filePath);\n  ensurePrivateDirectory(path.dirname(resolved));\n  appendFileSync(resolved, `${stableJsonText(value)}\\n`, {\n    encoding: 'utf8',\n    flag: 'a',\n    mode: 0o600,\n  });\n  chmodSync(resolved, 0o600);\n  return resolved;\n}\n\nfunction nextAttemptReportPath(outDir: string): string {\n  let attempt = 1;\n  while (attemptArtifactPaths(outDir, attempt).some((filePath) => existsSync(filePath))) {\n    attempt += 1;\n  }\n  return attemptArtifactPaths(outDir, attempt)[0]!;\n}\n\nfunction attemptArtifactPaths(outDir: string, attempt: number): string[] {\n  const suffix = `attempt-${String(attempt).padStart(4, '0')}`;\n  return [\n    path.join(outDir, `protected-run-report.${suffix}.json`),\n    path.join(outDir, `protected-audit-readback.${suffix}.json`),\n    path.join(outDir, `protected-primary-readback.${suffix}.json`),\n    path.join(outDir, `protected-reference-readback.${suffix}.json`),\n    path.join(outDir, `protected-derivative-readback.${suffix}.json`),\n  ];\n}\n\nfunction allocateAttemptArtifacts(\n  prepared: PreparedProtectedExecution,\n): PreparedProtectedExecution {\n  const attemptReport = nextAttemptReportPath(prepared.outDir);\n  const suffix = path.basename(attemptReport, '.json').replace('protected-run-report.', '');\n  return {\n    ...prepared,\n    artifacts: {\n      ...prepared.artifacts,\n      audit_readback: path.join(prepared.outDir, `protected-audit-readback.${suffix}.json`),\n      primary_readback: path.join(prepared.outDir, `protected-primary-readback.${suffix}.json`),\n      reference_readback: path.join(prepared.outDir, `protected-reference-readback.${suffix}.json`),\n      derivative_readback: path.join(\n        prepared.outDir,\n        `protected-derivative-readback.${suffix}.json`,\n      ),\n      attempt_report: attemptReport,\n    },\n  };\n}\n\ntype ProtectedPreparationDependencies = {\n  readArtifact: typeof readArtifact;\n  parsePlan: typeof parseMaintenancePlan;\n  buildAliasPlan: typeof buildAliasPlanRequest;\n  parseFreeze: typeof parseProtectedFreeze;\n  parseApproval: typeof parseProtectedApproval;\n  assertFreezeMatchesPlan: typeof assertProtectedFreezeMatchesPlan;\n  assertApprovalBindings: typeof assertProtectedApprovalBindings;\n  buildIdentity: typeof buildProtectedExecutionIdentity;\n};\n\nfunction prepareProtectedExecutionWithDependencies(\n  options: RunDatasetMaintenanceProtectedOptions,\n  dependencies: ProtectedPreparationDependencies,\n): PreparedProtectedExecution {\n  if (options.commit === options.statusOnly) {\n    throw new CliError('Choose exactly one of commit or statusOnly.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_MODE_INVALID',\n      exitCode: 2,\n    });\n  }\n  if (\n    options.commit &&\n    (!options.approveExecution ||\n      !SHA256.test(options.approveExecution) ||\n      typeof options.confirm !== 'string' ||\n      !options.confirm.trim())\n  ) {\n    throw new CliError('Protected commit requires the exact approval hash and account email.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_APPROVAL_REQUIRED',\n      exitCode: 2,\n    });\n  }\n  normalizeWaitSeconds(options.waitSeconds);\n  normalizePollMs(options.pollMs);\n  normalizeMaintenancePageSize(options.pageSize);\n\n  const planArtifact = dependencies.readArtifact({\n    filePath: options.planPath,\n    label: 'Maintenance plan',\n  });\n  const freezeArtifact = dependencies.readArtifact({\n    filePath: options.freezePath,\n    label: 'Protected execution freeze',\n  });\n  const approvalArtifact = dependencies.readArtifact({\n    filePath: options.approvalPath,\n    label: 'Protected execution approval',\n  });\n  const plan = dependencies.parsePlan(planArtifact.value);\n  if (options.commit) {\n    assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');\n  }\n  const planPath = planArtifact.resolved;\n  const planDir = path.dirname(planPath);\n  const aliasPlanRequest = dependencies.buildAliasPlan({ plan, planDir });\n  const freeze = dependencies.parseFreeze(freezeArtifact.value);\n  const approval = dependencies.parseApproval(approvalArtifact.value);\n  assertCanonicalParsedArtifact({\n    label: 'Protected execution freeze',\n    text: freezeArtifact.text,\n    value: freeze,\n  });\n  assertCanonicalParsedArtifact({\n    label: 'Protected execution approval',\n    text: approvalArtifact.text,\n    value: approval,\n  });\n  dependencies.assertFreezeMatchesPlan({\n    plan,\n    planFileSha256: planArtifact.file_sha256,\n    aliasPlanRequestSha256: sha256Json(aliasPlanRequest),\n    freeze,\n  });\n  dependencies.assertApprovalBindings({\n    approval,\n    freeze,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    approvalFileSha256: approvalArtifact.file_sha256,\n    approveExecution: options.statusOnly\n      ? approval.approval_identity_sha256\n      : options.approveExecution,\n  });\n  const identity = dependencies.buildIdentity({\n    freeze,\n    approval,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    approvalFileSha256: approvalArtifact.file_sha256,\n  });\n  if (options.commit) {\n    assertProtectedProductionProjectRef(identity.project_ref);\n  }\n  const outDir = path.resolve(options.outDir);\n  const artifacts = {\n    execution_seal: path.join(outDir, 'protected-execution-seal.json'),\n    preflight_evidence: path.join(outDir, 'protected-preflight-evidence.json'),\n    gate_receipts: path.join(outDir, 'protected-gate-receipts.jsonl'),\n    submission_attempt: path.join(outDir, 'protected-submission-attempt.json'),\n    admission_response: path.join(outDir, 'protected-admission-response.json'),\n    admission_transport_error: path.join(outDir, 'protected-admission-transport-error.json'),\n    status_progress: path.join(outDir, 'protected-status-progress.jsonl'),\n    primary_readback: path.join(outDir, 'protected-primary-readback.json'),\n    reference_readback: path.join(outDir, 'protected-reference-readback.json'),\n    audit_readback: path.join(outDir, 'protected-audit-readback.json'),\n    derivative_readback: path.join(outDir, 'protected-derivative-readback.json'),\n    terminal_report: path.join(outDir, 'protected-terminal-report.json'),\n    attempt_report: path.join(outDir, 'protected-run-report.unallocated.json'),\n  };\n  return {\n    planPath,\n    planDir,\n    freezePath: freezeArtifact.resolved,\n    approvalPath: approvalArtifact.resolved,\n    outDir,\n    plan,\n    freeze,\n    approval,\n    identity,\n    aliasPlanRequest,\n    artifacts,\n  };\n}\n\nfunction prepareProtectedExecution(\n  options: RunDatasetMaintenanceProtectedOptions,\n): PreparedProtectedExecution {\n  return prepareProtectedExecutionWithDependencies(options, {\n    readArtifact,\n    parsePlan: parseMaintenancePlan,\n    buildAliasPlan: buildAliasPlanRequest,\n    parseFreeze: parseProtectedFreeze,\n    parseApproval: parseProtectedApproval,\n    assertFreezeMatchesPlan: assertProtectedFreezeMatchesPlan,\n    assertApprovalBindings: assertProtectedApprovalBindings,\n    buildIdentity: buildProtectedExecutionIdentity,\n  });\n}\n\nfunction assertContextBindings(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n  confirm?: string;\n  commit: boolean;\n}): void {\n  if (\n    options.context.project_ref !== options.prepared.identity.project_ref ||\n    options.context.account.user_id !== options.prepared.identity.actor.user_id ||\n    options.context.account.email !== options.prepared.identity.actor.email ||\n    (options.commit && options.confirm !== options.context.account.email)\n  ) {\n    throw new CliError(\n      'Authenticated RLS context does not match the sealed production project, actor, and confirmation.',\n      {\n        code: 'DATASET_MAINTENANCE_PROTECTED_CONTEXT_MISMATCH',\n        exitCode: 1,\n        details: {\n          expected_project_ref: options.prepared.identity.project_ref,\n          observed_project_ref: options.context.project_ref,\n          expected_user_id: options.prepared.identity.actor.user_id,\n          observed_user_id: options.context.account.user_id,\n        },\n      },\n    );\n  }\n}\n\nfunction projectedRows(options: {\n  plan: DatasetMaintenancePlan;\n  planDir: string;\n  currentRows: DatasetMaintenanceRemoteRow[];\n}): DatasetMaintenanceRemoteRow[] {\n  return sharedProjectedRows(options);\n}\n\nfunction assertStrictBeforeState(options: {\n  prepared: PreparedProtectedExecution;\n  currentRows: DatasetMaintenanceRemoteRow[];\n  completeness: unknown;\n}): void {\n  assertSharedStrictBeforeState({\n    plan: options.prepared.plan,\n    planDir: options.prepared.planDir,\n    actorUserId: options.prepared.identity.actor.user_id,\n    currentRows: options.currentRows,\n    completeness: options.completeness,\n  });\n}\n\nasync function assertSupportSnapshots(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<void> {\n  await assertSharedSupportSnapshots({\n    plan: options.prepared.plan,\n    actorUserId: options.prepared.identity.actor.user_id,\n    context: options.context,\n  });\n}\n\nasync function assertDerivativeBaselines(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<void> {\n  await assertSharedDerivativeBaselines({\n    actorUserId: options.prepared.identity.actor.user_id,\n    context: options.context,\n    derivativeTargets: options.prepared.identity.derivative_targets,\n  });\n}\n\ntype ProtectedGateDependencies = {\n  captureGate: typeof captureMaintenanceAliasExecutionGate;\n  parseGate: typeof parseProtectedGateProof;\n  appendReceipt: typeof appendPrivateJsonLine;\n  nowIso: () => string;\n};\n\nasync function captureProtectedGatesWithDependencies(\n  options: {\n    prepared: PreparedProtectedExecution;\n    context: DatasetMaintenanceRemoteContext;\n    preflight: ProtectedPreflightProof;\n    receiptPath: string;\n  },\n  dependencies: ProtectedGateDependencies,\n): Promise<{\n  proofs: ProtectedGateProof[];\n  results: {\n    primary_support_plan: ProtectedGateProof['result'];\n    execution_unused: ProtectedGateProof['result'];\n    derivative_quiescence: ProtectedGateProof['result'];\n  };\n}> {\n  const gateNames = ['primary_support_plan', 'execution_unused', 'derivative_quiescence'] as const;\n  const proofs: ProtectedGateProof[] = [];\n  for (const gate of gateNames) {\n    const raw = await dependencies.captureGate({\n      context: options.context,\n      requestId: options.prepared.identity.request_id,\n      preflightToken: options.preflight.preflight_token,\n      gateName: gate,\n    });\n    const proof = dependencies.parseGate(raw, {\n      identity: options.prepared.identity,\n      preflight: options.preflight,\n      gate,\n    });\n    dependencies.appendReceipt(options.receiptPath, {\n      observed_at_utc: dependencies.nowIso(),\n      proof,\n      raw_response_sha256: sha256Json(raw),\n    });\n    proofs.push(proof);\n  }\n  return {\n    proofs,\n    results: {\n      primary_support_plan: proofs[0]!.result,\n      execution_unused: proofs[1]!.result,\n      derivative_quiescence: proofs[2]!.result,\n    },\n  };\n}\n\nasync function captureProtectedGates(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n  preflight: ProtectedPreflightProof;\n  receiptPath: string;\n}): Promise<{\n  proofs: ProtectedGateProof[];\n  results: {\n    primary_support_plan: ProtectedGateProof['result'];\n    execution_unused: ProtectedGateProof['result'];\n    derivative_quiescence: ProtectedGateProof['result'];\n  };\n}> {\n  return captureProtectedGatesWithDependencies(options, {\n    captureGate: captureMaintenanceAliasExecutionGate,\n    parseGate: parseProtectedGateProof,\n    appendReceipt: appendPrivateJsonLine,\n    nowIso: () => new Date().toISOString(),\n  });\n}\n\nfunction validateExistingMarker(\n  markerPath: string,\n  identity: ProtectedExecutionIdentity,\n): JsonObject | null {\n  if (!existsSync(markerPath)) return null;\n  const marker = readJsonFile(markerPath, 'Protected submission attempt');\n  if (\n    !isJsonObject(marker) ||\n    marker.schema_version !== PROTECTED_EXECUTION_CONTRACT.marker_schema ||\n    marker.request_id !== identity.request_id ||\n    marker.identity_sha256 !== identity.identity_sha256 ||\n    marker.plan_sha256 !== identity.plan_sha256 ||\n    marker.operation_id !== identity.operation_id ||\n    marker.max_admit_posts !== 1 ||\n    marker.automatic_retry !== false\n  ) {\n    throw new CliError('Existing protected submission marker is foreign or malformed.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_MARKER_INVALID',\n      exitCode: 1,\n    });\n  }\n  return marker;\n}\n\ntype ProtectedReadDependencies = {\n  readExecution: typeof readMaintenanceAliasExecution;\n  parseStatus: typeof parseProtectedStatusProof;\n  verifyExecution: typeof verifyProtectedExecution;\n  nowMs: () => number;\n};\n\nasync function readAndVerifyWithDependencies(\n  options: {\n    command: RunDatasetMaintenanceProtectedOptions;\n    prepared: PreparedProtectedExecution;\n    context: DatasetMaintenanceRemoteContext;\n  },\n  dependencies: ProtectedReadDependencies,\n): Promise<{\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}> {\n  const waitSeconds = normalizeWaitSeconds(options.command.waitSeconds);\n  const pollMs = normalizePollMs(options.command.pollMs);\n  const deadline = dependencies.nowMs() + waitSeconds * 1_000;\n  const sleep =\n    options.command.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  while (true) {\n    let raw: JsonObject;\n    try {\n      raw = await dependencies.readExecution({\n        context: options.context,\n        requestId: options.prepared.identity.request_id,\n      });\n    } catch (error) {\n      appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n        observed_at_utc: new Date().toISOString(),\n        result: 'read_error',\n        retry_scope: 'status_read_only',\n        error: errorDetails(error),\n      });\n      if (dependencies.nowMs() < deadline) {\n        await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n        continue;\n      }\n      return {\n        proof: null,\n        verification: {\n          status: 'indeterminate',\n          issues: [\n            {\n              code: 'PROTECTED_STATUS_READ_UNAVAILABLE',\n              message:\n                'Protected execution status could not be read; admission must not be retried.',\n              details: errorDetails(error),\n            },\n          ],\n          account_readback: null,\n          derivative_readback: null,\n        },\n      };\n    }\n    const proof = dependencies.parseStatus(raw, options.prepared.identity);\n    appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n      observed_at_utc: new Date().toISOString(),\n      proof,\n      raw_response_sha256: sha256Json(raw),\n    });\n    const waitForAdmissionVisibility =\n      proof.execution_status === 'not_admitted' && dependencies.nowMs() < deadline;\n    if (\n      (proof.status !== 'pending' && !waitForAdmissionVisibility) ||\n      dependencies.nowMs() >= deadline\n    ) {\n      try {\n        return {\n          proof,\n          verification: await dependencies.verifyExecution({\n            plan: options.prepared.plan,\n            planDir: options.prepared.planDir,\n            identity: options.prepared.identity,\n            proof,\n            context: options.context,\n            pageSize: options.command.pageSize,\n          }),\n        };\n      } catch (error) {\n        appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n          observed_at_utc: new Date().toISOString(),\n          result: 'verification_error',\n          retry_scope: 'independent_readback_only',\n          request_id: proof.request_id,\n          error: errorDetails(error),\n        });\n        if (dependencies.nowMs() < deadline) {\n          await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n          continue;\n        }\n        return {\n          proof,\n          verification: {\n            status: 'indeterminate',\n            issues: [\n              {\n                code: 'PROTECTED_TERMINAL_READBACK_UNAVAILABLE',\n                message:\n                  'Terminal proof was returned but independent RLS readback was unavailable.',\n                details: errorDetails(error),\n              },\n            ],\n            account_readback: null,\n            derivative_readback: null,\n          },\n        };\n      }\n    }\n    await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n  }\n}\n\nasync function readAndVerify(options: {\n  command: RunDatasetMaintenanceProtectedOptions;\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<{\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}> {\n  return readAndVerifyWithDependencies(options, {\n    readExecution: readMaintenanceAliasExecution,\n    parseStatus: parseProtectedStatusProof,\n    verifyExecution: verifyProtectedExecution,\n    nowMs: Date.now,\n  });\n}\n\nfunction buildReport(options: {\n  command: RunDatasetMaintenanceProtectedOptions;\n  prepared: PreparedProtectedExecution;\n  admission: ProtectedAdmissionProof | null;\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}): DatasetMaintenanceProtectedReport {\n  return {\n    schema_version: PROTECTED_EXECUTION_CONTRACT.report_schema,\n    generated_at_utc: new Date().toISOString(),\n    mode: options.command.statusOnly ? 'status_only' : 'commit',\n    status: options.verification.status,\n    request_id: options.prepared.identity.request_id,\n    identity_sha256: options.prepared.identity.identity_sha256,\n    plan_sha256: options.prepared.plan.plan_sha256,\n    operation_id: options.prepared.plan.operation_id,\n    actor: options.prepared.identity.actor,\n    project_ref: options.prepared.identity.project_ref,\n    admission: options.admission,\n    database_status: options.proof,\n    issues: options.verification.issues,\n    artifacts: options.prepared.artifacts,\n  };\n}\n\nfunction canonicalTerminalReport(report: DatasetMaintenanceProtectedReport): JsonObject {\n  return {\n    schema_version: report.schema_version,\n    artifact_kind: 'protected_terminal_canonical',\n    status: report.status,\n    request_id: report.request_id,\n    identity_sha256: report.identity_sha256,\n    plan_sha256: report.plan_sha256,\n    operation_id: report.operation_id,\n    actor: report.actor,\n    project_ref: report.project_ref,\n    database_status: report.database_status,\n    issues: report.issues,\n  };\n}\n\nfunction persistVerificationArtifacts(options: {\n  prepared: PreparedProtectedExecution;\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n  report: DatasetMaintenanceProtectedReport;\n}): void {\n  if (options.proof?.primary_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.audit_readback,\n      options.proof.primary_readback,\n    );\n  }\n  if (options.verification.account_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.primary_readback,\n      options.verification.account_readback,\n    );\n    writePrivateImmutableJson(options.prepared.artifacts.reference_readback, {\n      projected_reference_sha256: sha256Json(\n        maintenanceProjectedReferenceFingerprint(options.verification.account_readback.rows),\n      ),\n      expected_projected_reference_sha256: options.prepared.plan.projected_reference_sha256,\n    });\n  }\n  if (options.verification.derivative_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.derivative_readback,\n      options.verification.derivative_readback,\n    );\n  }\n  const terminalReadbackRetryable = options.verification.issues.some(\n    (entry) => entry.code === 'PROTECTED_TERMINAL_READBACK_UNAVAILABLE',\n  );\n  writePrivateImmutableJson(options.prepared.artifacts.attempt_report, options.report);\n  if (\n    options.proof &&\n    options.proof.status !== 'pending' &&\n    options.proof.execution_status !== 'not_admitted' &&\n    !terminalReadbackRetryable &&\n    !existsSync(options.prepared.artifacts.terminal_report)\n  ) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.terminal_report,\n      canonicalTerminalReport(options.report),\n    );\n  }\n}\n\ntype ProtectedRuntimeDependencies = {\n  withStateLock: typeof withStateFileLock;\n  resolveContext: typeof resolveMaintenanceRemoteContext;\n  fetchAccountRows: typeof fetchMaintenanceAccountRows;\n  assertSupport: typeof assertSupportSnapshots;\n  assertBaselines: typeof assertDerivativeBaselines;\n  buildPreflightRequest: typeof buildProtectedPreflightRequest;\n  preflightExecution: typeof preflightMaintenanceAliasExecution;\n  parsePreflight: typeof parseProtectedPreflightProof;\n  captureGates: typeof captureProtectedGates;\n  buildAdmitRequest: typeof buildProtectedAdmitRequest;\n  admitExecution: typeof admitMaintenanceAliasExecution;\n  parseAdmission: typeof parseProtectedAdmissionProof;\n  readAndVerify: typeof readAndVerify;\n};\n\nasync function runPreparedProtectedExecution(\n  options: RunDatasetMaintenanceProtectedOptions,\n  basePrepared: PreparedProtectedExecution,\n  dependencies: ProtectedRuntimeDependencies,\n): Promise<DatasetMaintenanceProtectedReport> {\n  ensurePrivateDirectory(basePrepared.outDir);\n  return dependencies.withStateLock(\n    basePrepared.artifacts.submission_attempt,\n    { reason: `dataset_maintenance_protected_${basePrepared.identity.request_id}` },\n    async () => {\n      writePrivateImmutableJson(basePrepared.artifacts.execution_seal, {\n        schema_version: PROTECTED_EXECUTION_CONTRACT.freeze_schema,\n        request_id: basePrepared.identity.request_id,\n        identity_sha256: basePrepared.identity.identity_sha256,\n        plan_path: basePrepared.planPath,\n        freeze_path: basePrepared.freezePath,\n        approval_path: basePrepared.approvalPath,\n        plan_sha256: basePrepared.plan.plan_sha256,\n        operation_id: basePrepared.plan.operation_id,\n        project_ref: basePrepared.identity.project_ref,\n        actor: basePrepared.identity.actor,\n        bindings: basePrepared.identity.bindings,\n      });\n      const prepared = allocateAttemptArtifacts(basePrepared);\n      const existingMarker = validateExistingMarker(\n        prepared.artifacts.submission_attempt,\n        prepared.identity,\n      );\n      if (options.commit && existingMarker) {\n        throw new CliError(\n          'A protected submission marker already exists. Use status-only; admission cannot be retried.',\n          {\n            code: 'DATASET_MAINTENANCE_PROTECTED_ATTEMPT_EXISTS',\n            exitCode: 1,\n          },\n        );\n      }\n      const context = await dependencies.resolveContext({\n        env: options.env,\n        fetchImpl: options.fetchImpl,\n        timeoutMs: options.timeoutMs,\n        now: options.now,\n      });\n      assertContextBindings({\n        prepared,\n        context,\n        confirm: options.confirm,\n        commit: options.commit,\n      });\n\n      let admission: ProtectedAdmissionProof | null = null;\n      if (options.commit) {\n        const current = await dependencies.fetchAccountRows({\n          context,\n          userId: prepared.identity.actor.user_id,\n          pageSize: options.pageSize,\n        });\n        assertStrictBeforeState({\n          prepared,\n          currentRows: current.rows,\n          completeness: current.completeness,\n        });\n        await dependencies.assertSupport({ prepared, context });\n        await dependencies.assertBaselines({ prepared, context });\n\n        const preflightRequest = dependencies.buildPreflightRequest({\n          identity: prepared.identity,\n          plan: prepared.aliasPlanRequest,\n          freeze: prepared.freeze,\n          approval: prepared.approval,\n        });\n        const preflightRaw = await dependencies.preflightExecution({\n          context,\n          request: preflightRequest,\n        });\n        const preflight = dependencies.parsePreflight(\n          preflightRaw,\n          prepared.identity,\n          clock(options),\n        );\n        const { preflight_token: preflightToken, ...preflightEvidence } = preflight;\n        writePrivateImmutableJson(prepared.artifacts.preflight_evidence, {\n          proof: preflightEvidence,\n          preflight_token_sha256: sha256Text(preflightToken),\n          raw_response_sha256: sha256Json(preflightRaw),\n        });\n        const gates = await dependencies.captureGates({\n          prepared,\n          context,\n          preflight,\n          receiptPath: prepared.artifacts.gate_receipts,\n        });\n        writePrivateImmutableJson(prepared.artifacts.submission_attempt, {\n          schema_version: PROTECTED_EXECUTION_CONTRACT.marker_schema,\n          prepared_at_utc: clock(options).toISOString(),\n          request_id: prepared.identity.request_id,\n          identity_sha256: prepared.identity.identity_sha256,\n          plan_sha256: prepared.identity.plan_sha256,\n          operation_id: prepared.identity.operation_id,\n          actor: prepared.identity.actor,\n          project_ref: prepared.identity.project_ref,\n          preflight_proof_sha256: preflight.preflight_proof_sha256,\n          preflight_token_sha256: sha256Text(preflight.preflight_token),\n          preflight_completed_at: preflight.completed_at,\n          preflight_expires_at: preflight.expires_at,\n          gate_results: gates.results,\n          gate_receipt_sha256: Object.fromEntries(\n            gates.proofs.map((proof) => [proof.gate, proof.receipt_sha256]),\n          ),\n          max_admit_posts: 1,\n          automatic_retry: false,\n        });\n\n        const admitRequest = dependencies.buildAdmitRequest({\n          preflight,\n          gateResults: gates.results,\n        });\n        try {\n          const admissionRaw = await dependencies.admitExecution({\n            context,\n            request: admitRequest,\n          });\n          admission = dependencies.parseAdmission(admissionRaw, prepared.identity, preflight);\n          writePrivateImmutableJson(prepared.artifacts.admission_response, {\n            proof: admission,\n            raw_response_sha256: sha256Json(admissionRaw),\n          });\n        } catch (error) {\n          writePrivateImmutableJson(prepared.artifacts.admission_transport_error, {\n            schema_version: 1,\n            request_id: prepared.identity.request_id,\n            observed_at_utc: new Date().toISOString(),\n            classification: 'ambiguous_consumed_attempt',\n            error: errorDetails(error),\n          });\n        }\n      }\n\n      const readback = await dependencies.readAndVerify({ command: options, prepared, context });\n      const report = buildReport({\n        command: options,\n        prepared,\n        admission,\n        proof: readback.proof,\n        verification: readback.verification,\n      });\n      persistVerificationArtifacts({\n        prepared,\n        proof: readback.proof,\n        verification: readback.verification,\n        report,\n      });\n      return report;\n    },\n  );\n}\n\nexport async function runDatasetMaintenanceProtected(\n  options: RunDatasetMaintenanceProtectedOptions,\n): Promise<DatasetMaintenanceProtectedReport> {\n  const prepared = prepareProtectedExecution(options);\n  return runPreparedProtectedExecution(options, prepared, {\n    withStateLock: withStateFileLock,\n    resolveContext: resolveMaintenanceRemoteContext,\n    fetchAccountRows: fetchMaintenanceAccountRows,\n    assertSupport: assertSupportSnapshots,\n    assertBaselines: assertDerivativeBaselines,\n    buildPreflightRequest: buildProtectedPreflightRequest,\n    preflightExecution: preflightMaintenanceAliasExecution,\n    parsePreflight: parseProtectedPreflightProof,\n    captureGates: captureProtectedGates,\n    buildAdmitRequest: buildProtectedAdmitRequest,\n    admitExecution: admitMaintenanceAliasExecution,\n    parseAdmission: parseProtectedAdmissionProof,\n    readAndVerify,\n  });\n}\n\nexport const __testInternals = {\n  allocateAttemptArtifacts,\n  appendPrivateJsonLine,\n  assertCanonicalParsedArtifact,\n  assertContextBindings,\n  assertDerivativeBaselines,\n  assertStrictBeforeState,\n  assertSupportSnapshots,\n  buildReport,\n  canonicalTerminalReport,\n  clock,\n  errorDetails,\n  nextAttemptReportPath,\n  normalizePollMs,\n  normalizeWaitSeconds,\n  prepareProtectedExecution,\n  prepareProtectedExecutionWithDependencies,\n  projectedRows,\n  readArtifact,\n  readAndVerify,\n  readAndVerifyWithDependencies,\n  runPreparedProtectedExecution,\n  captureProtectedGates,\n  captureProtectedGatesWithDependencies,\n  persistVerificationArtifacts,\n  validateExistingMarker,\n  writePrivateImmutableJson,\n};\n"]}

package/dist/src/lib/dataset-maintenance-protected-seal.js

@@ -0,0 +1,160 @@
+import path from 'node:path';
+import { readProtectedJsonArtifact, readProtectedTextArtifact, materializePrivateArtifactDirectoryAtomically, writePrivateImmutableJson, writePrivateImmutableText, } from './dataset-maintenance-protected-artifacts.js';
+import { sha256Text, stableJsonText } from './dataset-maintenance-contract.js';
+import { parseProtectedFreeze } from './dataset-maintenance-protected-contract.js';
+import { assertProtectedProductionProjectRef, parseProtectedApprovalRequest, sealProtectedApproval, } from './dataset-maintenance-protected-preparation.js';
+import { CliError } from './errors.js';
+export const PROTECTED_APPROVAL_SEAL_ARTIFACTS = {
+    human_approval_text: 'protected-human-approval.txt',
+    approval: 'protected-approval.json',
+    report: 'protected-approval-seal-report.json',
+};
+const DEFAULT_SEAL_DEPENDENCIES = {
+    readJson: readProtectedJsonArtifact,
+    readText: readProtectedTextArtifact,
+    parseFreeze: parseProtectedFreeze,
+    parseApprovalRequest: parseProtectedApprovalRequest,
+    sealApproval: sealProtectedApproval,
+    writeJson: writePrivateImmutableJson,
+    writeText: writePrivateImmutableText,
+    materializeArtifacts: materializePrivateArtifactDirectoryAtomically,
+};
+const SHA256 = /^[a-f0-9]{64}$/u;
+function requiredToken(value, label) {
+    if (!value || value.trim() !== value) {
+        throw new CliError(`${label} must be a non-empty canonical string.`, {
+            code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',
+            exitCode: 2,
+        });
+    }
+    return value;
+}
+function requiredHash(value, label) {
+    const token = requiredToken(value, label);
+    if (!SHA256.test(token)) {
+        throw new CliError(`${label} must be a lowercase SHA-256 digest.`, {
+            code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',
+            exitCode: 2,
+        });
+    }
+    return token;
+}
+function assertCanonicalJsonArtifact(options) {
+    if (options.text !== `${stableJsonText(options.value)}\n`) {
+        throw new CliError(`${options.label} must be canonical JSON with one final newline.`, {
+            code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_NONCANONICAL',
+            exitCode: 2,
+        });
+    }
+}
+function artifactPaths(outDir) {
+    const resolved = path.resolve(outDir);
+    return Object.fromEntries(Object.entries(PROTECTED_APPROVAL_SEAL_ARTIFACTS).map(([key, name]) => [
+        key,
+        path.join(resolved, name),
+    ]));
+}
+export async function sealDatasetMaintenanceProtectedApproval(options, dependencies = DEFAULT_SEAL_DEPENDENCIES) {
+    const freezePath = requiredToken(options.freezePath, 'freezePath');
+    const approvalRequestPath = requiredToken(options.approvalRequestPath, 'approvalRequestPath');
+    const humanApprovalPath = requiredToken(options.humanApprovalPath, 'humanApprovalPath');
+    const outDir = requiredToken(options.outDir, 'outDir');
+    const approveFreezeFile = requiredHash(options.approveFreezeFile, 'approveFreezeFile');
+    const approveRequest = requiredHash(options.approveRequest, 'approveRequest');
+    const approveText = requiredHash(options.approveText, 'approveText');
+    const confirm = requiredToken(options.confirm, 'confirm');
+    const approvedAtUtc = requiredToken(options.approvedAtUtc, 'approvedAtUtc');
+    const freezeArtifact = dependencies.readJson({
+        filePath: freezePath,
+        label: 'Protected execution freeze',
+    });
+    const freeze = dependencies.parseFreeze(freezeArtifact.value);
+    assertProtectedProductionProjectRef(freeze.project_ref);
+    assertCanonicalJsonArtifact({
+        label: 'Protected execution freeze',
+        text: freezeArtifact.text,
+        value: freeze,
+    });
+    if (approveFreezeFile !== freezeArtifact.file_sha256) {
+        throw new CliError('Explicit freeze file hash does not match the supplied freeze bytes.', {
+            code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_FREEZE_MISMATCH',
+            exitCode: 1,
+        });
+    }
+    const requestArtifact = dependencies.readJson({
+        filePath: approvalRequestPath,
+        label: 'Protected approval request',
+    });
+    const request = dependencies.parseApprovalRequest(requestArtifact.value);
+    assertCanonicalJsonArtifact({
+        label: 'Protected approval request',
+        text: requestArtifact.text,
+        value: request,
+    });
+    const humanApproval = dependencies.readText(humanApprovalPath);
+    const approval = dependencies.sealApproval({
+        approvalRequest: request,
+        freeze,
+        freezeFileSha256: freezeArtifact.file_sha256,
+        humanApprovalText: humanApproval.text,
+        approveRequestSha256: approveRequest,
+        approveTextSha256: approveText,
+        approvedAtUtc,
+        confirmAccountEmail: confirm,
+    });
+    const paths = artifactPaths(outDir);
+    const report = {
+        schema_version: 'dataset-alias-protected-approval-seal-report.v1',
+        generated_at_utc: (options.now ?? new Date()).toISOString(),
+        approval_authority_at_utc: approvedAtUtc,
+        status: 'sealed',
+        execution_submitted: false,
+        environment: 'production',
+        project_ref: freeze.project_ref,
+        account: freeze.account,
+        plan_sha256: freeze.plan.plan_sha256,
+        operation_id: freeze.plan.operation_id,
+        freeze_file_sha256: freezeArtifact.file_sha256,
+        freeze_sha256: freeze.freeze_sha256,
+        approval_request_file_sha256: requestArtifact.file_sha256,
+        approval_request_sha256: request.request_sha256,
+        approval_text_sha256: request.approval_text_sha256,
+        approval_file_sha256: approval.file_sha256,
+        approval_identity_sha256: approval.value.approval_identity_sha256,
+        assertions: {
+            byte_exact_human_text: true,
+            explicit_freeze_file_hash: true,
+            explicit_request_hash: true,
+            explicit_text_hash: true,
+            explicit_account_confirmation: true,
+            authentication_calls: 0,
+            network_calls: 0,
+            database_calls: 0,
+            preflight_calls: 0,
+            gate_calls: 0,
+            admission_calls: 0,
+            execution_calls: 0,
+        },
+        artifacts: paths,
+        artifact_sha256: {
+            human_approval_text: sha256Text(humanApproval.text),
+            approval: approval.file_sha256,
+            report: null,
+        },
+    };
+    dependencies.materializeArtifacts(outDir, (stagingDirectory) => {
+        const staging = artifactPaths(stagingDirectory);
+        dependencies.writeText(staging.human_approval_text, humanApproval.text);
+        dependencies.writeText(staging.approval, approval.canonical_file_text);
+        dependencies.writeJson(staging.report, report);
+    });
+    return report;
+}
+export const __testInternals = {
+    DEFAULT_SEAL_DEPENDENCIES,
+    artifactPaths,
+    assertCanonicalJsonArtifact,
+    requiredHash,
+    requiredToken,
+};
+//# sourceMappingURL=dataset-maintenance-protected-seal.js.map

package/dist/src/lib/dataset-maintenance-protected-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-protected-seal.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-seal.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6CAA6C,EAC7C,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,mBAAmB,EAAE,8BAA8B;IACnD,QAAQ,EAAE,yBAAyB;IACnC,MAAM,EAAE,qCAAqC;CACrC,CAAC;AAsEX,MAAM,yBAAyB,GAA8B;IAC3D,QAAQ,EAAE,yBAAyB;IACnC,QAAQ,EAAE,yBAAyB;IACnC,WAAW,EAAE,oBAAoB;IACjC,oBAAoB,EAAE,6BAA6B;IACnD,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,yBAAyB;IACpC,oBAAoB,EAAE,6CAA6C;CACpE,CAAC;AAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,wCAAwC,EAAE;YACnE,IAAI,EAAE,kDAAkD;YACxD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,sCAAsC,EAAE;YACjE,IAAI,EAAE,kDAAkD;YACxD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,2BAA2B,CAAC,OAIpC;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,iDAAiD,EAAE;YACpF,IAAI,EAAE,iDAAiD;YACvD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACrE,GAAG;QACH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1B,CAAC,CAC2D,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,OAAuD,EACvD,eAA0C,yBAAyB;IAEnE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,mBAAmB,GAAG,aAAa,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC9F,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC;QAC3C,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9D,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,2BAA2B,CAAC;QAC1B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,iBAAiB,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,qEAAqE,EAAE;YACxF,IAAI,EAAE,oDAAoD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC;QAC5C,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzE,2BAA2B,CAAC;QAC1B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC;QACzC,eAAe,EAAE,OAAO;QACxB,MAAM;QACN,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,iBAAiB,EAAE,aAAa,CAAC,IAAI;QACrC,oBAAoB,EAAE,cAAc;QACpC,iBAAiB,EAAE,WAAW;QAC9B,aAAa;QACb,mBAAmB,EAAE,OAAO;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAkD;QAC5D,cAAc,EAAE,iDAAiD;QACjE,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC3D,yBAAyB,EAAE,aAAa;QACxC,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,KAAK;QAC1B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACtC,kBAAkB,EAAE,cAAc,CAAC,WAAW;QAC9C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,4BAA4B,EAAE,eAAe,CAAC,WAAW;QACzD,uBAAuB,EAAE,OAAO,CAAC,cAAc;QAC/C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,oBAAoB,EAAE,QAAQ,CAAC,WAAW;QAC1C,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,wBAAwB;QACjE,UAAU,EAAE;YACV,qBAAqB,EAAE,IAAI;YAC3B,yBAAyB,EAAE,IAAI;YAC/B,qBAAqB,EAAE,IAAI;YAC3B,kBAAkB,EAAE,IAAI;YACxB,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;SACnB;QACD,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE;YACf,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC;YACnD,QAAQ,EAAE,QAAQ,CAAC,WAAW;YAC9B,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IACF,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAChD,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACxE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACvE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,yBAAyB;IACzB,aAAa;IACb,2BAA2B;IAC3B,YAAY;IACZ,aAAa;CACd,CAAC","sourcesContent":["import path from 'node:path';\nimport {\n  readProtectedJsonArtifact,\n  readProtectedTextArtifact,\n  materializePrivateArtifactDirectoryAtomically,\n  writePrivateImmutableJson,\n  writePrivateImmutableText,\n} from './dataset-maintenance-protected-artifacts.js';\nimport { sha256Text, stableJsonText } from './dataset-maintenance-contract.js';\nimport { parseProtectedFreeze } from './dataset-maintenance-protected-contract.js';\nimport {\n  assertProtectedProductionProjectRef,\n  parseProtectedApprovalRequest,\n  sealProtectedApproval,\n} from './dataset-maintenance-protected-preparation.js';\nimport { CliError } from './errors.js';\n\nexport const PROTECTED_APPROVAL_SEAL_ARTIFACTS = {\n  human_approval_text: 'protected-human-approval.txt',\n  approval: 'protected-approval.json',\n  report: 'protected-approval-seal-report.json',\n} as const;\n\nexport type SealDatasetMaintenanceProtectedApprovalOptions = {\n  freezePath: string;\n  approvalRequestPath: string;\n  humanApprovalPath: string;\n  outDir: string;\n  approveFreezeFile: string;\n  approveRequest: string;\n  approveText: string;\n  confirm: string;\n  approvedAtUtc: string;\n  now?: Date;\n};\n\nexport type DatasetMaintenanceProtectedApprovalSealReport = {\n  schema_version: 'dataset-alias-protected-approval-seal-report.v1';\n  generated_at_utc: string;\n  approval_authority_at_utc: string;\n  status: 'sealed';\n  execution_submitted: false;\n  environment: 'production';\n  project_ref: string;\n  account: { user_id: string; email: string };\n  plan_sha256: string;\n  operation_id: string;\n  freeze_file_sha256: string;\n  freeze_sha256: string;\n  approval_request_file_sha256: string;\n  approval_request_sha256: string;\n  approval_text_sha256: string;\n  approval_file_sha256: string;\n  approval_identity_sha256: string;\n  assertions: {\n    byte_exact_human_text: true;\n    explicit_freeze_file_hash: true;\n    explicit_request_hash: true;\n    explicit_text_hash: true;\n    explicit_account_confirmation: true;\n    authentication_calls: 0;\n    network_calls: 0;\n    database_calls: 0;\n    preflight_calls: 0;\n    gate_calls: 0;\n    admission_calls: 0;\n    execution_calls: 0;\n  };\n  artifacts: {\n    human_approval_text: string;\n    approval: string;\n    report: string;\n  };\n  artifact_sha256: {\n    human_approval_text: string;\n    approval: string;\n    report: null;\n  };\n};\n\ntype SealProtectedDependencies = {\n  readJson: typeof readProtectedJsonArtifact;\n  readText: typeof readProtectedTextArtifact;\n  parseFreeze: typeof parseProtectedFreeze;\n  parseApprovalRequest: typeof parseProtectedApprovalRequest;\n  sealApproval: typeof sealProtectedApproval;\n  writeJson: typeof writePrivateImmutableJson;\n  writeText: typeof writePrivateImmutableText;\n  materializeArtifacts: typeof materializePrivateArtifactDirectoryAtomically;\n};\n\nconst DEFAULT_SEAL_DEPENDENCIES: SealProtectedDependencies = {\n  readJson: readProtectedJsonArtifact,\n  readText: readProtectedTextArtifact,\n  parseFreeze: parseProtectedFreeze,\n  parseApprovalRequest: parseProtectedApprovalRequest,\n  sealApproval: sealProtectedApproval,\n  writeJson: writePrivateImmutableJson,\n  writeText: writePrivateImmutableText,\n  materializeArtifacts: materializePrivateArtifactDirectoryAtomically,\n};\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nfunction requiredToken(value: string, label: string): string {\n  if (!value || value.trim() !== value) {\n    throw new CliError(`${label} must be a non-empty canonical string.`, {\n      code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',\n      exitCode: 2,\n    });\n  }\n  return value;\n}\n\nfunction requiredHash(value: string, label: string): string {\n  const token = requiredToken(value, label);\n  if (!SHA256.test(token)) {\n    throw new CliError(`${label} must be a lowercase SHA-256 digest.`, {\n      code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',\n      exitCode: 2,\n    });\n  }\n  return token;\n}\n\nfunction assertCanonicalJsonArtifact(options: {\n  label: string;\n  text: string;\n  value: unknown;\n}): void {\n  if (options.text !== `${stableJsonText(options.value)}\\n`) {\n    throw new CliError(`${options.label} must be canonical JSON with one final newline.`, {\n      code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_NONCANONICAL',\n      exitCode: 2,\n    });\n  }\n}\n\nfunction artifactPaths(outDir: string): DatasetMaintenanceProtectedApprovalSealReport['artifacts'] {\n  const resolved = path.resolve(outDir);\n  return Object.fromEntries(\n    Object.entries(PROTECTED_APPROVAL_SEAL_ARTIFACTS).map(([key, name]) => [\n      key,\n      path.join(resolved, name),\n    ]),\n  ) as DatasetMaintenanceProtectedApprovalSealReport['artifacts'];\n}\n\nexport async function sealDatasetMaintenanceProtectedApproval(\n  options: SealDatasetMaintenanceProtectedApprovalOptions,\n  dependencies: SealProtectedDependencies = DEFAULT_SEAL_DEPENDENCIES,\n): Promise<DatasetMaintenanceProtectedApprovalSealReport> {\n  const freezePath = requiredToken(options.freezePath, 'freezePath');\n  const approvalRequestPath = requiredToken(options.approvalRequestPath, 'approvalRequestPath');\n  const humanApprovalPath = requiredToken(options.humanApprovalPath, 'humanApprovalPath');\n  const outDir = requiredToken(options.outDir, 'outDir');\n  const approveFreezeFile = requiredHash(options.approveFreezeFile, 'approveFreezeFile');\n  const approveRequest = requiredHash(options.approveRequest, 'approveRequest');\n  const approveText = requiredHash(options.approveText, 'approveText');\n  const confirm = requiredToken(options.confirm, 'confirm');\n  const approvedAtUtc = requiredToken(options.approvedAtUtc, 'approvedAtUtc');\n\n  const freezeArtifact = dependencies.readJson({\n    filePath: freezePath,\n    label: 'Protected execution freeze',\n  });\n  const freeze = dependencies.parseFreeze(freezeArtifact.value);\n  assertProtectedProductionProjectRef(freeze.project_ref);\n  assertCanonicalJsonArtifact({\n    label: 'Protected execution freeze',\n    text: freezeArtifact.text,\n    value: freeze,\n  });\n  if (approveFreezeFile !== freezeArtifact.file_sha256) {\n    throw new CliError('Explicit freeze file hash does not match the supplied freeze bytes.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_FREEZE_MISMATCH',\n      exitCode: 1,\n    });\n  }\n\n  const requestArtifact = dependencies.readJson({\n    filePath: approvalRequestPath,\n    label: 'Protected approval request',\n  });\n  const request = dependencies.parseApprovalRequest(requestArtifact.value);\n  assertCanonicalJsonArtifact({\n    label: 'Protected approval request',\n    text: requestArtifact.text,\n    value: request,\n  });\n  const humanApproval = dependencies.readText(humanApprovalPath);\n  const approval = dependencies.sealApproval({\n    approvalRequest: request,\n    freeze,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    humanApprovalText: humanApproval.text,\n    approveRequestSha256: approveRequest,\n    approveTextSha256: approveText,\n    approvedAtUtc,\n    confirmAccountEmail: confirm,\n  });\n  const paths = artifactPaths(outDir);\n  const report: DatasetMaintenanceProtectedApprovalSealReport = {\n    schema_version: 'dataset-alias-protected-approval-seal-report.v1',\n    generated_at_utc: (options.now ?? new Date()).toISOString(),\n    approval_authority_at_utc: approvedAtUtc,\n    status: 'sealed',\n    execution_submitted: false,\n    environment: 'production',\n    project_ref: freeze.project_ref,\n    account: freeze.account,\n    plan_sha256: freeze.plan.plan_sha256,\n    operation_id: freeze.plan.operation_id,\n    freeze_file_sha256: freezeArtifact.file_sha256,\n    freeze_sha256: freeze.freeze_sha256,\n    approval_request_file_sha256: requestArtifact.file_sha256,\n    approval_request_sha256: request.request_sha256,\n    approval_text_sha256: request.approval_text_sha256,\n    approval_file_sha256: approval.file_sha256,\n    approval_identity_sha256: approval.value.approval_identity_sha256,\n    assertions: {\n      byte_exact_human_text: true,\n      explicit_freeze_file_hash: true,\n      explicit_request_hash: true,\n      explicit_text_hash: true,\n      explicit_account_confirmation: true,\n      authentication_calls: 0,\n      network_calls: 0,\n      database_calls: 0,\n      preflight_calls: 0,\n      gate_calls: 0,\n      admission_calls: 0,\n      execution_calls: 0,\n    },\n    artifacts: paths,\n    artifact_sha256: {\n      human_approval_text: sha256Text(humanApproval.text),\n      approval: approval.file_sha256,\n      report: null,\n    },\n  };\n  dependencies.materializeArtifacts(outDir, (stagingDirectory) => {\n    const staging = artifactPaths(stagingDirectory);\n    dependencies.writeText(staging.human_approval_text, humanApproval.text);\n    dependencies.writeText(staging.approval, approval.canonical_file_text);\n    dependencies.writeJson(staging.report, report);\n  });\n  return report;\n}\n\nexport const __testInternals = {\n  DEFAULT_SEAL_DEPENDENCIES,\n  artifactPaths,\n  assertCanonicalJsonArtifact,\n  requiredHash,\n  requiredToken,\n};\n"]}

package/dist/src/lib/dataset-maintenance-protected-toolchain.js

@@ -0,0 +1,86 @@
+import { isJsonObject } from './dataset-maintenance-contract.js';
+import { CliError } from './errors.js';
+export const PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA = 'dataset-alias-protected-toolchain-evidence.v1';
+const SHA256 = /^[a-f0-9]{64}$/u;
+const GIT_SHA = /^[a-f0-9]{40}$/u;
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u;
+const WORKSPACE_ISSUE = /^https:\/\/github\.com\/tiangong-lca\/workspace\/issues\/\d+$/u;
+function invalid(message) {
+    throw new CliError(message, {
+        code: 'DATASET_MAINTENANCE_PROTECTED_TOOLCHAIN_INVALID',
+        exitCode: 2,
+    });
+}
+function token(value, label) {
+    if (typeof value !== 'string' || !value.trim()) {
+        return invalid(`${label} must be a non-empty string.`);
+    }
+    return value.trim();
+}
+function exact(value, expected, label) {
+    if (value !== expected)
+        return invalid(`${label} must equal ${expected}.`);
+    return expected;
+}
+function digest(value, label) {
+    const result = token(value, label);
+    return SHA256.test(result) ? result : invalid(`${label} must be a lowercase SHA-256 digest.`);
+}
+function commit(value, label) {
+    const result = token(value, label);
+    return GIT_SHA.test(result) ? result : invalid(`${label} must be a lowercase 40-hex git SHA.`);
+}
+export function parseProtectedToolchainEvidence(value, expected) {
+    if (!isJsonObject(value) ||
+        !isJsonObject(value.database_engine) ||
+        !isJsonObject(value.cli) ||
+        !isJsonObject(value.workspace)) {
+        return invalid('Protected toolchain evidence must contain database, CLI, and workspace objects.');
+    }
+    exact(value.schema_version, PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA, 'schema_version');
+    exact(value.environment, 'production', 'environment');
+    const projectRef = token(value.project_ref, 'project_ref');
+    if (projectRef !== expected.projectRef) {
+        return invalid('Toolchain evidence does not bind the authenticated production project.');
+    }
+    const verifiedAtUtc = token(value.verified_at_utc, 'verified_at_utc');
+    const verifiedAtMs = Date.parse(verifiedAtUtc);
+    if (!Number.isFinite(verifiedAtMs) || new Date(verifiedAtMs).toISOString() !== verifiedAtUtc) {
+        return invalid('verified_at_utc must be a canonical UTC ISO timestamp.');
+    }
+    const packageVersion = token(value.cli.package_version, 'cli.package_version');
+    if (!VERSION.test(packageVersion) || packageVersion !== expected.cliVersion) {
+        return invalid('Toolchain evidence does not bind the running published CLI version.');
+    }
+    const integrationIssueUrl = token(value.workspace.integration_issue_url, 'workspace.integration_issue_url');
+    if (!WORKSPACE_ISSUE.test(integrationIssueUrl)) {
+        return invalid('workspace.integration_issue_url must identify a tracked workspace Issue.');
+    }
+    return {
+        schema_version: PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA,
+        environment: 'production',
+        project_ref: projectRef,
+        verified_at_utc: verifiedAtUtc,
+        database_engine: {
+            repository: exact(value.database_engine.repository, 'tiangong-lca/database-engine', 'database_engine.repository'),
+            production_main_commit_sha: commit(value.database_engine.production_main_commit_sha, 'database_engine.production_main_commit_sha'),
+            production_readback_evidence_sha256: digest(value.database_engine.production_readback_evidence_sha256, 'database_engine.production_readback_evidence_sha256'),
+            status: exact(value.database_engine.status, 'released_and_read_back', 'database_engine.status'),
+        },
+        cli: {
+            repository: exact(value.cli.repository, 'tiangong-lca/tiangong-cli', 'cli.repository'),
+            package_name: exact(value.cli.package_name, '@tiangong-lca/cli', 'cli.package_name'),
+            package_version: packageVersion,
+            release_commit_sha: commit(value.cli.release_commit_sha, 'cli.release_commit_sha'),
+            release_evidence_sha256: digest(value.cli.release_evidence_sha256, 'cli.release_evidence_sha256'),
+            status: exact(value.cli.status, 'published_and_verified', 'cli.status'),
+        },
+        workspace: {
+            repository: exact(value.workspace.repository, 'tiangong-lca/workspace', 'workspace.repository'),
+            integration_commit_sha: commit(value.workspace.integration_commit_sha, 'workspace.integration_commit_sha'),
+            integration_issue_url: integrationIssueUrl,
+            status: exact(value.workspace.status, 'integrated', 'workspace.status'),
+        },
+    };
+}
+//# sourceMappingURL=dataset-maintenance-protected-toolchain.js.map

package/dist/src/lib/dataset-maintenance-protected-toolchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-protected-toolchain.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-toolchain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,mCAAmC,GAC9C,+CAAwD,CAAC;AAE3D,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAClC,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,eAAe,GAAG,gEAAgE,CAAC;AA6BzF,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,iDAAiD;QACvD,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAmB,KAAc,EAAE,QAAW,EAAE,KAAa;IACzE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,GAAG,KAAK,eAAe,QAAQ,GAAG,CAAC,CAAC;IAC3E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAc,EACd,QAAoD;IAEpD,IACE,CAAC,YAAY,CAAC,KAAK,CAAC;QACpB,CAAC,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;QACpC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QACxB,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAC9B,CAAC;QACD,OAAO,OAAO,CACZ,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,mCAAmC,EAAE,gBAAgB,CAAC,CAAC;IACnF,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,wEAAwE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;QAC7F,OAAO,OAAO,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,cAAc,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC,qEAAqE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,mBAAmB,GAAG,KAAK,CAC/B,KAAK,CAAC,SAAS,CAAC,qBAAqB,EACrC,iCAAiC,CAClC,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,0EAA0E,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,cAAc,EAAE,mCAAmC;QACnD,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,aAAa;QAC9B,eAAe,EAAE;YACf,UAAU,EAAE,KAAK,CACf,KAAK,CAAC,eAAe,CAAC,UAAU,EAChC,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,0BAA0B,EAAE,MAAM,CAChC,KAAK,CAAC,eAAe,CAAC,0BAA0B,EAChD,4CAA4C,CAC7C;YACD,mCAAmC,EAAE,MAAM,CACzC,KAAK,CAAC,eAAe,CAAC,mCAAmC,EACzD,qDAAqD,CACtD;YACD,MAAM,EAAE,KAAK,CACX,KAAK,CAAC,eAAe,CAAC,MAAM,EAC5B,wBAAwB,EACxB,wBAAwB,CACzB;SACF;QACD,GAAG,EAAE;YACH,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,2BAA2B,EAAE,gBAAgB,CAAC;YACtF,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;YACpF,eAAe,EAAE,cAAc;YAC/B,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;YAClF,uBAAuB,EAAE,MAAM,CAC7B,KAAK,CAAC,GAAG,CAAC,uBAAuB,EACjC,6BAA6B,CAC9B;YACD,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,wBAAwB,EAAE,YAAY,CAAC;SACxE;QACD,SAAS,EAAE;YACT,UAAU,EAAE,KAAK,CACf,KAAK,CAAC,SAAS,CAAC,UAAU,EAC1B,wBAAwB,EACxB,sBAAsB,CACvB;YACD,sBAAsB,EAAE,MAAM,CAC5B,KAAK,CAAC,SAAS,CAAC,sBAAsB,EACtC,kCAAkC,CACnC;YACD,qBAAqB,EAAE,mBAAmB;YAC1C,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,kBAAkB,CAAC;SACxE;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { isJsonObject } from './dataset-maintenance-contract.js';\nimport { CliError } from './errors.js';\n\nexport const PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA =\n  'dataset-alias-protected-toolchain-evidence.v1' as const;\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\nconst GIT_SHA = /^[a-f0-9]{40}$/u;\nconst VERSION = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$/u;\nconst WORKSPACE_ISSUE = /^https:\\/\\/github\\.com\\/tiangong-lca\\/workspace\\/issues\\/\\d+$/u;\n\nexport type DatasetMaintenanceProtectedToolchainEvidence = {\n  schema_version: typeof PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA;\n  environment: 'production';\n  project_ref: string;\n  verified_at_utc: string;\n  database_engine: {\n    repository: 'tiangong-lca/database-engine';\n    production_main_commit_sha: string;\n    production_readback_evidence_sha256: string;\n    status: 'released_and_read_back';\n  };\n  cli: {\n    repository: 'tiangong-lca/tiangong-cli';\n    package_name: '@tiangong-lca/cli';\n    package_version: string;\n    release_commit_sha: string;\n    release_evidence_sha256: string;\n    status: 'published_and_verified';\n  };\n  workspace: {\n    repository: 'tiangong-lca/workspace';\n    integration_commit_sha: string;\n    integration_issue_url: string;\n    status: 'integrated';\n  };\n};\n\nfunction invalid(message: string): never {\n  throw new CliError(message, {\n    code: 'DATASET_MAINTENANCE_PROTECTED_TOOLCHAIN_INVALID',\n    exitCode: 2,\n  });\n}\n\nfunction token(value: unknown, label: string): string {\n  if (typeof value !== 'string' || !value.trim()) {\n    return invalid(`${label} must be a non-empty string.`);\n  }\n  return value.trim();\n}\n\nfunction exact<T extends string>(value: unknown, expected: T, label: string): T {\n  if (value !== expected) return invalid(`${label} must equal ${expected}.`);\n  return expected;\n}\n\nfunction digest(value: unknown, label: string): string {\n  const result = token(value, label);\n  return SHA256.test(result) ? result : invalid(`${label} must be a lowercase SHA-256 digest.`);\n}\n\nfunction commit(value: unknown, label: string): string {\n  const result = token(value, label);\n  return GIT_SHA.test(result) ? result : invalid(`${label} must be a lowercase 40-hex git SHA.`);\n}\n\nexport function parseProtectedToolchainEvidence(\n  value: unknown,\n  expected: { projectRef: string; cliVersion: string },\n): DatasetMaintenanceProtectedToolchainEvidence {\n  if (\n    !isJsonObject(value) ||\n    !isJsonObject(value.database_engine) ||\n    !isJsonObject(value.cli) ||\n    !isJsonObject(value.workspace)\n  ) {\n    return invalid(\n      'Protected toolchain evidence must contain database, CLI, and workspace objects.',\n    );\n  }\n  exact(value.schema_version, PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA, 'schema_version');\n  exact(value.environment, 'production', 'environment');\n  const projectRef = token(value.project_ref, 'project_ref');\n  if (projectRef !== expected.projectRef) {\n    return invalid('Toolchain evidence does not bind the authenticated production project.');\n  }\n  const verifiedAtUtc = token(value.verified_at_utc, 'verified_at_utc');\n  const verifiedAtMs = Date.parse(verifiedAtUtc);\n  if (!Number.isFinite(verifiedAtMs) || new Date(verifiedAtMs).toISOString() !== verifiedAtUtc) {\n    return invalid('verified_at_utc must be a canonical UTC ISO timestamp.');\n  }\n  const packageVersion = token(value.cli.package_version, 'cli.package_version');\n  if (!VERSION.test(packageVersion) || packageVersion !== expected.cliVersion) {\n    return invalid('Toolchain evidence does not bind the running published CLI version.');\n  }\n  const integrationIssueUrl = token(\n    value.workspace.integration_issue_url,\n    'workspace.integration_issue_url',\n  );\n  if (!WORKSPACE_ISSUE.test(integrationIssueUrl)) {\n    return invalid('workspace.integration_issue_url must identify a tracked workspace Issue.');\n  }\n  return {\n    schema_version: PROTECTED_TOOLCHAIN_EVIDENCE_SCHEMA,\n    environment: 'production',\n    project_ref: projectRef,\n    verified_at_utc: verifiedAtUtc,\n    database_engine: {\n      repository: exact(\n        value.database_engine.repository,\n        'tiangong-lca/database-engine',\n        'database_engine.repository',\n      ),\n      production_main_commit_sha: commit(\n        value.database_engine.production_main_commit_sha,\n        'database_engine.production_main_commit_sha',\n      ),\n      production_readback_evidence_sha256: digest(\n        value.database_engine.production_readback_evidence_sha256,\n        'database_engine.production_readback_evidence_sha256',\n      ),\n      status: exact(\n        value.database_engine.status,\n        'released_and_read_back',\n        'database_engine.status',\n      ),\n    },\n    cli: {\n      repository: exact(value.cli.repository, 'tiangong-lca/tiangong-cli', 'cli.repository'),\n      package_name: exact(value.cli.package_name, '@tiangong-lca/cli', 'cli.package_name'),\n      package_version: packageVersion,\n      release_commit_sha: commit(value.cli.release_commit_sha, 'cli.release_commit_sha'),\n      release_evidence_sha256: digest(\n        value.cli.release_evidence_sha256,\n        'cli.release_evidence_sha256',\n      ),\n      status: exact(value.cli.status, 'published_and_verified', 'cli.status'),\n    },\n    workspace: {\n      repository: exact(\n        value.workspace.repository,\n        'tiangong-lca/workspace',\n        'workspace.repository',\n      ),\n      integration_commit_sha: commit(\n        value.workspace.integration_commit_sha,\n        'workspace.integration_commit_sha',\n      ),\n      integration_issue_url: integrationIssueUrl,\n      status: exact(value.workspace.status, 'integrated', 'workspace.status'),\n    },\n  };\n}\n"]}