npm - @tiangong-lca/cli - Versions diffs - 0.0.24 → 0.0.26 - Mend

@tiangong-lca/cli 0.0.24 → 0.0.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (28) hide show

package/dist/src/lib/dataset-maintenance-protected-verify.js ADDED Viewed

@@ -0,0 +1,435 @@
+import { loadMaintenanceDesiredPayload } from './dataset-maintenance-alias-request.js';
+import { isJsonObject, maintenanceRowKey, sha256Json, snapshotRemoteRow, } from './dataset-maintenance-contract.js';
+import { PROTECTED_EXECUTION_COUNTS, parseProtectedDerivativeSnapshot, } from './dataset-maintenance-protected-contract.js';
+import { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';
+import { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';
+import { fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceDerivativeTargetRows, } from './dataset-maintenance-remote.js';
+const SHA256 = /^[a-f0-9]{64}$/u;
+function issue(code, message, details) {
+    return { code, message, ...(details === undefined ? {} : { details }) };
+}
+function requiredString(value) {
+    return typeof value === 'string' && value.trim() ? value : null;
+}
+export function inspectProtectedLiveDerivative(row) {
+    const raw = row.raw;
+    const jsonOrdered = isJsonObject(raw.json_ordered) ? raw.json_ordered : null;
+    const extractedText = requiredString(raw.extracted_text);
+    const extractedMd = requiredString(raw.extracted_md);
+    const embeddingAt = requiredString(raw.embedding_ft_at);
+    if (row.state_code !== 0 ||
+        !jsonOrdered ||
+        !extractedText ||
+        !extractedMd ||
+        raw.embedding_ft === null ||
+        raw.embedding_ft === undefined ||
+        !embeddingAt ||
+        !Number.isFinite(Date.parse(embeddingAt))) {
+        return null;
+    }
+    return {
+        table: row.table,
+        id: row.id,
+        version: row.version,
+        user_id: row.user_id,
+        state_code: 0,
+        json_ordered_sha256: sha256Json(jsonOrdered),
+        extracted_text_present: true,
+        extracted_md_present: true,
+        embedding_ft_present: true,
+        embedding_ft_at: embeddingAt,
+    };
+}
+function expectedFinalRows(options) {
+    const rows = new Map(options.rows.map((row) => [maintenanceRowKey(row), { ...row }]));
+    for (const action of options.plan.actions) {
+        const current = rows.get(maintenanceRowKey(action));
+        if (current) {
+            rows.set(maintenanceRowKey(action), {
+                ...current,
+                json_ordered: loadMaintenanceDesiredPayload(options.planDir, action),
+            });
+        }
+    }
+    return [...rows.values()].sort((left, right) => maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)));
+}
+function verifyStatusStructure(options) {
+    const { identity, proof } = options;
+    const issues = [];
+    const notAdmitted = proof.execution_status === 'not_admitted';
+    const dispatchCountValid = proof.dispatch_count === 1 ||
+        (proof.dispatch_count === 0 &&
+            (proof.execution_status === 'failed' || proof.execution_status === 'indeterminate'));
+    if ((notAdmitted && (proof.attempt_count !== 0 || proof.dispatch_count !== 0)) ||
+        (!notAdmitted && (proof.attempt_count !== 1 || !dispatchCountValid))) {
+        issues.push(issue('PROTECTED_ATTEMPT_DISPATCH_COUNT_INVALID', 'Database did not prove the one-attempt, at-most-one-dispatch execution policy.', { attempt_count: proof.attempt_count, dispatch_count: proof.dispatch_count }));
+    }
+    if (proof.plan_sha256 !== identity.plan_sha256 || proof.operation_id !== identity.operation_id) {
+        issues.push(issue('PROTECTED_EXECUTION_IDENTITY_MISMATCH', 'Database status does not round-trip the sealed plan identity.'));
+    }
+    const categoryMatches = (proof.status === 'passed' && proof.execution_status === 'completed') ||
+        (proof.status === 'failed' &&
+            (proof.execution_status === 'failed' || proof.execution_status === 'completed')) ||
+        (proof.status === 'indeterminate' &&
+            (proof.execution_status === 'not_admitted' || proof.execution_status === 'indeterminate')) ||
+        (proof.status === 'pending' &&
+            ['dispatching', 'dispatched', 'running', 'derivatives_pending'].includes(proof.execution_status));
+    if (!categoryMatches) {
+        issues.push(issue('PROTECTED_STATUS_CATEGORY_INVALID', 'Database status category is inconsistent with its execution ledger state.', { status: proof.status, execution_status: proof.execution_status }));
+    }
+    if (!notAdmitted) {
+        const gateNames = proof.gates.map((gate) => gate.gate);
+        const receiptHashes = proof.gates.map((gate) => gate.receipt_sha256);
+        const gateClosureValid = proof.gate_count === 3 &&
+            proof.gates.length === 3 &&
+            new Set(gateNames).size === 3 &&
+            new Set(receiptHashes).size === 3 &&
+            proof.gates.every((gate) => gate.observed_sha256 === gate.expected_sha256 && gate.status === 'passed');
+        if (!gateClosureValid) {
+            issues.push(issue('PROTECTED_GATE_CLOSURE_INVALID', 'Database did not round-trip three unique server-captured gate receipts.', proof.gates));
+        }
+    }
+    return issues;
+}
+function verifyAuditClosure(proof) {
+    const audit = proof.primary_readback;
+    const closure = audit?.closure;
+    let closureHashMatches = false;
+    if (isJsonObject(closure) && typeof closure.live_closure_proof_sha256 === 'string') {
+        const proofMaterial = { ...closure };
+        const closureSha256 = String(proofMaterial.live_closure_proof_sha256);
+        delete proofMaterial.ok;
+        delete proofMaterial.row_count;
+        delete proofMaterial.exchange_count;
+        delete proofMaterial.live_closure_proof_sha256;
+        closureHashMatches = sha256Json(proofMaterial) === closureSha256;
+    }
+    if (!audit ||
+        audit.row_count !== PROTECTED_EXECUTION_COUNTS.action_count ||
+        audit.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count ||
+        audit.alias_audit_count !== PROTECTED_EXECUTION_COUNTS.audit_count ||
+        audit.live_closure_proof !== true ||
+        !isJsonObject(closure) ||
+        closure.schema_version !== 'dataset-alias-primary-closure.v1' ||
+        closure.ok !== true ||
+        closure.actor_user_id !== proof.actor_user_id ||
+        closure.batch_count !== PROTECTED_EXECUTION_COUNTS.batch_count ||
+        closure.action_count !== PROTECTED_EXECUTION_COUNTS.action_count ||
+        closure.distinct_action_count !== PROTECTED_EXECUTION_COUNTS.action_count ||
+        closure.flowproperty_count !== PROTECTED_EXECUTION_COUNTS.flowproperty_count ||
+        closure.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count ||
+        closure.process_count !== PROTECTED_EXECUTION_COUNTS.process_count ||
+        closure.support_reference_count !== 6 ||
+        closure.flowproperty_support_count !== 2 ||
+        closure.unitgroup_support_count !== 2 ||
+        closure.source_unitgroup_support_count !== 2 ||
+        closure.invalid_action_count !== 0 ||
+        closure.invalid_support_count !== 0 ||
+        !Array.isArray(closure.action_evidence) ||
+        closure.action_evidence.length !== PROTECTED_EXECUTION_COUNTS.action_count ||
+        closure.action_evidence.some((entry) => !isJsonObject(entry)) ||
+        !Array.isArray(closure.support_evidence) ||
+        closure.support_evidence.length !== 6 ||
+        closure.support_evidence.some((entry) => !isJsonObject(entry)) ||
+        closure.row_count !== PROTECTED_EXECUTION_COUNTS.action_count ||
+        closure.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count ||
+        closure.live_closure_proof !== true ||
+        !closureHashMatches) {
+        return [
+            issue('PROTECTED_AUDIT_CLOSURE_INVALID', 'Terminal execution did not prove the exact 52-row, 59-exchange, 55-audit primary closure.', audit),
+        ];
+    }
+    return [];
+}
+function terminalTargetKey(target) {
+    return `${target.table}\u0000${target.id}\u0000${target.version}`;
+}
+function verifyTerminalTargets(options) {
+    const issues = [];
+    const batch = options.proof.derivative_readback;
+    if (batch.proof_level !== 'causal_terminal' || batch.proof_deferred !== false) {
+        return [
+            issue('PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID', 'Terminal proof must use the full causal-terminal evidence level.'),
+        ];
+    }
+    const targets = batch.targets;
+    const keys = targets.map(terminalTargetKey);
+    if (batch.schema_version !== 'dataset-derivative-rebuild-batch-status.v1' ||
+        batch.batch_id !== options.identity.request_id ||
+        batch.status !== 'completed' ||
+        batch.code !== 'DERIVATIVE_BATCH_COMPLETED' ||
+        batch.causal_terminal_proof !== true ||
+        batch.target_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||
+        batch.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count ||
+        batch.process_count !== PROTECTED_EXECUTION_COUNTS.process_count ||
+        batch.completed_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||
+        batch.nonterminal_count !== 0 ||
+        batch.failed_count !== 0 ||
+        batch.invalid_proof_count !== 0 ||
+        targets.length !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||
+        new Set(keys).size !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||
+        new Set(targets.map((target) => target.ordinal)).size !==
+            PROTECTED_EXECUTION_COUNTS.derivative_target_count) {
+        return [
+            issue('PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID', 'Terminal proof must contain exactly 50 unique derivative targets.'),
+        ];
+    }
+    const frozen = new Map(options.identity.derivative_targets.map((target) => [terminalTargetKey(target), target]));
+    for (const [index, target] of targets.entries()) {
+        const expected = frozen.get(terminalTargetKey(target));
+        if (!expected ||
+            target.ordinal !== index + 1 ||
+            target.request_id === options.identity.request_id ||
+            target.source_baseline_snapshot_sha256 !== expected.baseline_snapshot_sha256) {
+            issues.push(issue('PROTECTED_DERIVATIVE_TARGET_IDENTITY_MISMATCH', 'Terminal derivative proof contains a foreign or changed target.', { table: target.table, id: target.id, version: target.version }));
+            continue;
+        }
+        if (target.status !== 'completed' ||
+            !target.phase ||
+            !target.completed_snapshot_sha256 ||
+            !SHA256.test(target.expected_snapshot_sha256) ||
+            !SHA256.test(target.completed_snapshot_sha256) ||
+            target.completed_snapshot_sha256 === target.expected_snapshot_sha256 ||
+            !target.primary_matches ||
+            !target.terminal_snapshot_matches ||
+            !target.proposals_committed ||
+            !target.derivative_fresh ||
+            !target.lifecycle_complete ||
+            !target.terminal_audit_present ||
+            Object.values(target.residue).some((count) => count !== 0) ||
+            !target.causal_terminal_proof) {
+            issues.push(issue('PROTECTED_DERIVATIVE_TARGET_NOT_TERMINAL', 'Derivative target lacks causal completed/live equality or retains queue, failure, or fence state.', { table: target.table, id: target.id, version: target.version }));
+        }
+    }
+    return issues;
+}
+function verifyFinalAccountRows(options) {
+    const issues = [];
+    if (!options.plan.snapshot_completeness ||
+        !isSnapshotCompletenessCompatible(options.completeness, options.plan.snapshot_completeness, Object.keys(options.plan.snapshot_completeness.entity_counts))) {
+        issues.push(issue('PROTECTED_FINAL_SNAPSHOT_INCOMPLETE', 'Final RLS account scan does not prove the same complete table census as the plan.'));
+        return issues;
+    }
+    const expectedKeys = new Set([
+        ...options.plan.actions.map(maintenanceRowKey),
+        ...options.plan.protected_rows.map(maintenanceRowKey),
+    ]);
+    const actualKeys = new Set(options.rows.map(maintenanceRowKey));
+    if (expectedKeys.size !== actualKeys.size ||
+        [...expectedKeys].some((key) => !actualKeys.has(key))) {
+        issues.push(issue('PROTECTED_FINAL_ACCOUNT_CENSUS_DRIFT', 'Final RLS account rows contain missing or unexpected entities.'));
+    }
+    const current = new Map(options.rows.map((row) => [maintenanceRowKey(row), row]));
+    for (const protectedRow of options.plan.protected_rows) {
+        const row = current.get(maintenanceRowKey(protectedRow));
+        if (!row || snapshotRemoteRow(row).row_sha256 !== protectedRow.row_sha256) {
+            issues.push(issue('PROTECTED_ROW_DRIFT', 'A protected non-action row changed.', protectedRow));
+        }
+    }
+    for (const action of options.plan.actions) {
+        const row = current.get(maintenanceRowKey(action));
+        const desired = loadMaintenanceDesiredPayload(options.planDir, action);
+        if (!row ||
+            row.user_id !== action.expected_user_id ||
+            row.state_code !== 0 ||
+            sha256Json(row.json_ordered) !== sha256Json(desired) ||
+            row.model_id !== action.before?.model_id ||
+            row.rule_verification !== action.before?.rule_verification) {
+            issues.push(issue('PROTECTED_ACTION_READBACK_MISMATCH', 'An action row does not match the desired owner-draft payload.', { action_id: action.action_id }));
+        }
+    }
+    const projected = expectedFinalRows({
+        plan: options.plan,
+        planDir: options.planDir,
+        rows: options.rows,
+    });
+    if (sha256Json(maintenanceProjectedReferenceFingerprint(projected)) !==
+        options.plan.projected_reference_sha256) {
+        issues.push(issue('PROTECTED_REFERENCE_CLOSURE_MISMATCH', 'Final reference closure does not match the frozen projected closure.'));
+    }
+    return issues;
+}
+function matchLiveTargets(options) {
+    const proofs = new Map(options.proofs.map((proof) => [terminalTargetKey(proof), proof]));
+    const snapshots = new Map(options.snapshots.map((snapshot) => [terminalTargetKey(snapshot), snapshot]));
+    const live = new Map(options.live.map((row) => [terminalTargetKey(row), row]));
+    const actions = new Map(options.plan.actions.map((action) => [maintenanceRowKey(action), action]));
+    const issues = [];
+    const expectedKeys = new Set(options.identity.derivative_targets.map(terminalTargetKey));
+    const liveKeys = options.live.map(terminalTargetKey);
+    const snapshotKeys = options.snapshots.map(terminalTargetKey);
+    if (liveKeys.length !== expectedKeys.size ||
+        new Set(liveKeys).size !== expectedKeys.size ||
+        snapshotKeys.length !== expectedKeys.size ||
+        new Set(snapshotKeys).size !== expectedKeys.size ||
+        [...expectedKeys].some((key) => !live.has(key) || !snapshots.has(key))) {
+        issues.push(issue('PROTECTED_DERIVATIVE_LIVE_SET_MISMATCH', 'Independent derivative rows and snapshots must be unique and exactly match all 50 frozen targets.'));
+    }
+    for (const target of options.identity.derivative_targets) {
+        const key = terminalTargetKey(target);
+        const row = live.get(key);
+        const proof = proofs.get(key);
+        const snapshot = snapshots.get(key);
+        const action = actions.get(key);
+        if (!row ||
+            !proof ||
+            !snapshot ||
+            !action?.desired_payload ||
+            row.user_id !== options.identity.actor.user_id ||
+            row.state_code !== 0 ||
+            snapshot.user_id !== options.identity.actor.user_id ||
+            snapshot.state_code !== 0 ||
+            row.json_ordered_sha256 !== action.desired_payload.sha256 ||
+            snapshot.json_ordered_sha256 !== row.json_ordered_sha256 ||
+            snapshot.snapshot_sha256 !== proof.completed_snapshot_sha256 ||
+            !snapshot.extracted_md_sha256 ||
+            !snapshot.embedding_ft_sha256 ||
+            !snapshot.embedding_ft_at) {
+            issues.push(issue('PROTECTED_DERIVATIVE_LIVE_MISMATCH', 'Independent RLS derivative readback does not match the terminal database proof.', { table: target.table, id: target.id, version: target.version }));
+        }
+    }
+    return issues;
+}
+async function fetchProtectedDerivativeSnapshots(options) {
+    const snapshots = [];
+    const targets = options.identity.derivative_targets;
+    for (let offset = 0; offset < targets.length; offset += 5) {
+        const chunk = targets.slice(offset, offset + 5);
+        snapshots.push(...(await Promise.all(chunk.map(async (target) => parseProtectedDerivativeSnapshot(await fetchMaintenanceDerivativeSnapshot({
+            context: options.context,
+            table: target.table,
+            id: target.id,
+            version: target.version,
+        }), {
+            table: target.table,
+            id: target.id,
+            version: target.version,
+            userId: target.user_id,
+        })))));
+    }
+    return snapshots;
+}
+async function verifyProtectedExecutionWithDependencies(options, dependencies) {
+    const { fetchAccountRows, fetchDerivativeRows, fetchSnapshots } = dependencies;
+    const structuralIssues = verifyStatusStructure({
+        identity: options.identity,
+        proof: options.proof,
+    });
+    if (structuralIssues.length) {
+        return {
+            status: options.proof.status === 'indeterminate' ? 'indeterminate' : 'failed',
+            issues: structuralIssues,
+            account_readback: null,
+            derivative_readback: null,
+        };
+    }
+    if (options.proof.execution_status === 'not_admitted') {
+        return {
+            status: 'indeterminate',
+            issues: [
+                issue('PROTECTED_EXECUTION_NOT_FOUND', 'The server has a protected preflight but no admitted execution; admission must not be retried.'),
+            ],
+            account_readback: null,
+            derivative_readback: null,
+        };
+    }
+    if (options.proof.status === 'pending') {
+        return { status: 'pending', issues: [], account_readback: null, derivative_readback: null };
+    }
+    if (options.proof.status === 'indeterminate') {
+        return {
+            status: 'indeterminate',
+            issues: [
+                issue('PROTECTED_EXECUTION_INDETERMINATE', 'Database reported an indeterminate terminal execution; admission must not be retried.', options.proof.failure),
+            ],
+            account_readback: null,
+            derivative_readback: null,
+        };
+    }
+    if (options.proof.status === 'failed') {
+        return {
+            status: 'failed',
+            issues: [
+                issue('PROTECTED_EXECUTION_FAILED', 'Database reported a definitive protected execution failure.', options.proof.failure),
+            ],
+            account_readback: null,
+            derivative_readback: null,
+        };
+    }
+    const issues = [
+        ...verifyAuditClosure(options.proof),
+        ...verifyTerminalTargets({ identity: options.identity, proof: options.proof }),
+    ];
+    if (issues.length) {
+        return { status: 'failed', issues, account_readback: null, derivative_readback: null };
+    }
+    const account = await fetchAccountRows({
+        context: options.context,
+        userId: options.identity.actor.user_id,
+        pageSize: options.pageSize,
+    });
+    issues.push(...verifyFinalAccountRows({
+        plan: options.plan,
+        planDir: options.planDir,
+        rows: account.rows,
+        completeness: account.completeness,
+    }));
+    const derivative = await fetchDerivativeRows({
+        context: options.context,
+        targets: options.identity.derivative_targets,
+    });
+    const live = derivative.rows.map(inspectProtectedLiveDerivative);
+    if (live.some((row) => row === null)) {
+        issues.push(issue('PROTECTED_DERIVATIVE_LIVE_INVALID', 'A live derivative row lacks primary JSON, extracted markdown, embedding, or timestamps.'));
+    }
+    const validLive = live.filter((row) => row !== null);
+    const snapshots = await fetchSnapshots({
+        context: options.context,
+        identity: options.identity,
+    });
+    if (validLive.length === PROTECTED_EXECUTION_COUNTS.derivative_target_count) {
+        const terminalProofs = options.proof.derivative_readback.proof_level === 'causal_terminal'
+            ? options.proof.derivative_readback.targets
+            : [];
+        issues.push(...matchLiveTargets({
+            proofs: terminalProofs,
+            live: validLive,
+            snapshots,
+            plan: options.plan,
+            identity: options.identity,
+        }));
+    }
+    return {
+        status: issues.length ? 'failed' : 'passed',
+        issues,
+        account_readback: {
+            rows: account.rows,
+            source_urls: account.source_urls,
+            completeness: account.completeness,
+        },
+        derivative_readback: {
+            rows: validLive,
+            snapshots,
+            source_urls: derivative.source_urls,
+        },
+    };
+}
+export async function verifyProtectedExecution(options) {
+    return verifyProtectedExecutionWithDependencies(options, {
+        fetchAccountRows: fetchMaintenanceAccountRows,
+        fetchDerivativeRows: fetchMaintenanceDerivativeTargetRows,
+        fetchSnapshots: fetchProtectedDerivativeSnapshots,
+    });
+}
+export const __testInternals = {
+    expectedFinalRows,
+    fetchProtectedDerivativeSnapshots,
+    inspectProtectedLiveDerivative,
+    matchLiveTargets,
+    verifyAuditClosure,
+    verifyFinalAccountRows,
+    verifyStatusStructure,
+    verifyTerminalTargets,
+    verifyProtectedExecutionWithDependencies,
+};
+//# sourceMappingURL=dataset-maintenance-protected-verify.js.map

package/dist/src/lib/dataset-maintenance-protected-verify.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"dataset-maintenance-protected-verify.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAMjC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,oCAAoC,GAGrC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAoCjC,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB;IAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA0C;IAE1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,IACE,GAAG,CAAC,UAAU,KAAK,CAAC;QACpB,CAAC,WAAW;QACZ,CAAC,aAAa;QACd,CAAC,WAAW;QACZ,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,YAAY,KAAK,SAAS;QAC9B,CAAC,WAAW;QACZ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,CAAU;QACtB,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC;QAC5C,sBAAsB,EAAE,IAAI;QAC5B,oBAAoB,EAAE,IAAI;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,eAAe,EAAE,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAI1B;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBAClC,GAAG,OAAO;gBACV,YAAY,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC7C,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAG9B;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,KAAK,cAAc,CAAC;IAC9D,MAAM,kBAAkB,GACtB,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC;YACzB,CAAC,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC,CAAC;IACzF,IACE,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACpE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,gFAAgF,EAChF,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAC7E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/F,MAAM,CAAC,IAAI,CACT,KAAK,CACH,uCAAuC,EACvC,+DAA+D,CAChE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,WAAW,CAAC;QACrE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;YACxB,CAAC,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,WAAW,CAAC,CAAC;QAClF,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe;YAC/B,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc,IAAI,KAAK,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC;QAC5F,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CACtE,KAAK,CAAC,gBAAgB,CACvB,CAAC,CAAC;IACP,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,2EAA2E,EAC3E,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CACnE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,MAAM,gBAAgB,GACpB,KAAK,CAAC,UAAU,KAAK,CAAC;YACtB,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACxB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;YAC7B,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CACpF,CAAC;QACJ,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gCAAgC,EAChC,yEAAyE,EACzE,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACtE,OAAO,aAAa,CAAC,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,SAAS,CAAC;QAC/B,OAAO,aAAa,CAAC,cAAc,CAAC;QACpC,OAAO,aAAa,CAAC,yBAAyB,CAAC;QAC/C,kBAAkB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,aAAa,CAAC;IACnE,CAAC;IACD,IACE,CAAC,KAAK;QACN,KAAK,CAAC,SAAS,KAAK,0BAA0B,CAAC,YAAY;QAC3D,KAAK,CAAC,cAAc,KAAK,0BAA0B,CAAC,cAAc;QAClE,KAAK,CAAC,iBAAiB,KAAK,0BAA0B,CAAC,WAAW;QAClE,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,CAAC,YAAY,CAAC,OAAO,CAAC;QACtB,OAAO,CAAC,cAAc,KAAK,kCAAkC;QAC7D,OAAO,CAAC,EAAE,KAAK,IAAI;QACnB,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC7C,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW;QAC9D,OAAO,CAAC,YAAY,KAAK,0BAA0B,CAAC,YAAY;QAChE,OAAO,CAAC,qBAAqB,KAAK,0BAA0B,CAAC,YAAY;QACzE,OAAO,CAAC,kBAAkB,KAAK,0BAA0B,CAAC,kBAAkB;QAC5E,OAAO,CAAC,UAAU,KAAK,0BAA0B,CAAC,UAAU;QAC5D,OAAO,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;QAClE,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,0BAA0B,KAAK,CAAC;QACxC,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,8BAA8B,KAAK,CAAC;QAC5C,OAAO,CAAC,oBAAoB,KAAK,CAAC;QAClC,OAAO,CAAC,qBAAqB,KAAK,CAAC;QACnC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QACvC,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,0BAA0B,CAAC,YAAY;QAC1E,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACxC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QACrC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO,CAAC,SAAS,KAAK,0BAA0B,CAAC,YAAY;QAC7D,OAAO,CAAC,cAAc,KAAK,0BAA0B,CAAC,cAAc;QACpE,OAAO,CAAC,kBAAkB,KAAK,IAAI;QACnC,CAAC,kBAAkB,EACnB,CAAC;QACD,OAAO;YACL,KAAK,CACH,iCAAiC,EACjC,2FAA2F,EAC3F,KAAK,CACN;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsD;IAC/E,OAAO,GAAG,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,OAG9B;IACC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAChD,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC9E,OAAO;YACL,KAAK,CACH,6CAA6C,EAC7C,kEAAkE,CACnE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IACE,KAAK,CAAC,cAAc,KAAK,4CAA4C;QACrE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU;QAC9C,KAAK,CAAC,MAAM,KAAK,WAAW;QAC5B,KAAK,CAAC,IAAI,KAAK,4BAA4B;QAC3C,KAAK,CAAC,qBAAqB,KAAK,IAAI;QACpC,KAAK,CAAC,YAAY,KAAK,0BAA0B,CAAC,uBAAuB;QACzE,KAAK,CAAC,UAAU,KAAK,0BAA0B,CAAC,UAAU;QAC1D,KAAK,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;QAChE,KAAK,CAAC,eAAe,KAAK,0BAA0B,CAAC,uBAAuB;QAC5E,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAC7B,KAAK,CAAC,YAAY,KAAK,CAAC;QACxB,KAAK,CAAC,mBAAmB,KAAK,CAAC;QAC/B,OAAO,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB;QACrE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,uBAAuB;QACzE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACnD,0BAA0B,CAAC,uBAAuB,EACpD,CAAC;QACD,OAAO;YACL,KAAK,CACH,6CAA6C,EAC7C,mEAAmE,CACpE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,OAAO,KAAK,KAAK,GAAG,CAAC;YAC5B,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU;YACjD,MAAM,CAAC,+BAA+B,KAAK,QAAQ,CAAC,wBAAwB,EAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,+CAA+C,EAC/C,iEAAiE,EACjE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,MAAM,CAAC,KAAK;YACb,CAAC,MAAM,CAAC,yBAAyB;YACjC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;YAC7C,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC9C,MAAM,CAAC,yBAAyB,KAAK,MAAM,CAAC,wBAAwB;YACpE,CAAC,MAAM,CAAC,eAAe;YACvB,CAAC,MAAM,CAAC,yBAAyB;YACjC,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,MAAM,CAAC,gBAAgB;YACxB,CAAC,MAAM,CAAC,kBAAkB;YAC1B,CAAC,MAAM,CAAC,sBAAsB;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,CAAC,MAAM,CAAC,qBAAqB,EAC7B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,mGAAmG,EACnG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAK/B;IACC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB;QACnC,CAAC,gCAAgC,CAC/B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,qCAAqC,EACrC,mFAAmF,CACpF,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChE,IACE,YAAY,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QACrC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,gEAAgE,CACjE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,qBAAqB,EAAE,qCAAqC,EAAE,YAAY,CAAC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,gBAAgB;YACvC,GAAG,CAAC,UAAU,KAAK,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC;YACpD,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ;YACxC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAC1D,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oCAAoC,EACpC,+DAA+D,EAC/D,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAChC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IACE,UAAU,CAAC,wCAAwC,CAAC,SAAS,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,0BAA0B,EACvC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,sEAAsE,CACvE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAMzB;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAC1E,CAAC;IACF,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IACE,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI;QACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;QAC5C,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI;QACzC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;QAChD,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACtE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,wCAAwC,EACxC,mGAAmG,CACpG,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IACE,CAAC,GAAG;YACJ,CAAC,KAAK;YACN,CAAC,QAAQ;YACT,CAAC,MAAM,EAAE,eAAe;YACxB,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC9C,GAAG,CAAC,UAAU,KAAK,CAAC;YACpB,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YACnD,QAAQ,CAAC,UAAU,KAAK,CAAC;YACzB,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC,eAAe,CAAC,MAAM;YACzD,QAAQ,CAAC,mBAAmB,KAAK,GAAG,CAAC,mBAAmB;YACxD,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,yBAAyB;YAC5D,CAAC,QAAQ,CAAC,mBAAmB;YAC7B,CAAC,QAAQ,CAAC,mBAAmB;YAC7B,CAAC,QAAQ,CAAC,eAAe,EACzB,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oCAAoC,EACpC,iFAAiF,EACjF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,OAGhD;IACC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACnB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACzB,gCAAgC,CAC9B,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,EACF;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CACF,CACF,CACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD,KAAK,UAAU,wCAAwC,CACrD,OAOC,EACD,YAA+C;IAE/C,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC/E,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;YAC7E,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE;gBACN,KAAK,CACH,+BAA+B,EAC/B,gGAAgG,CACjG;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE;gBACN,KAAK,CACH,mCAAmC,EACnC,uFAAuF,EACvF,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,KAAK,CACH,4BAA4B,EAC5B,6DAA6D,EAC7D,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAC/E,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,GAAG,sBAAsB,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,yFAAyF,CAC1F,CACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAA0C,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB,EAAE,CAAC;QAC5E,MAAM,cAAc,GAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,WAAW,KAAK,iBAAiB;YACjE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CACT,GAAG,gBAAgB,CAAC;YAClB,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC3C,MAAM;QACN,gBAAgB,EAAE;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAO9C;IACC,OAAO,wCAAwC,CAAC,OAAO,EAAE;QACvD,gBAAgB,EAAE,2BAA2B;QAC7C,mBAAmB,EAAE,oCAAoC;QACzD,cAAc,EAAE,iCAAiC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,iBAAiB;IACjB,iCAAiC;IACjC,8BAA8B;IAC9B,gBAAgB;IAChB,kBAAkB;IAClB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,wCAAwC;CACzC,CAAC","sourcesContent":["import { loadMaintenanceDesiredPayload } from './dataset-maintenance-alias-request.js';\nimport {\n isJsonObject,\n maintenanceRowKey,\n sha256Json,\n snapshotRemoteRow,\n type DatasetMaintenancePlan,\n type DatasetMaintenanceRemoteRow,\n} from './dataset-maintenance-contract.js';\nimport {\n PROTECTED_EXECUTION_COUNTS,\n parseProtectedDerivativeSnapshot,\n type ProtectedDerivativeSnapshot,\n type ProtectedExecutionIdentity,\n type ProtectedExecutionStatusProof,\n type ProtectedReportStatus,\n type ProtectedTerminalTargetProof,\n} from './dataset-maintenance-protected-contract.js';\nimport { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';\nimport { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';\nimport {\n fetchMaintenanceAccountRows,\n fetchMaintenanceDerivativeSnapshot,\n fetchMaintenanceDerivativeTargetRows,\n type DatasetMaintenanceDerivativeRemoteRow,\n type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nexport type ProtectedVerificationIssue = {\n code: string;\n message: string;\n details?: unknown;\n};\n\nexport type ProtectedLiveDerivativeReadback = {\n table: 'flows' | 'processes';\n id: string;\n version: string;\n user_id: string;\n state_code: 0;\n json_ordered_sha256: string;\n extracted_text_present: true;\n extracted_md_present: true;\n embedding_ft_present: true;\n embedding_ft_at: string;\n};\n\nexport type ProtectedVerificationResult = {\n status: ProtectedReportStatus;\n issues: ProtectedVerificationIssue[];\n account_readback: {\n rows: DatasetMaintenanceRemoteRow[];\n source_urls: string[];\n completeness: unknown;\n } | null;\n derivative_readback: {\n rows: ProtectedLiveDerivativeReadback[];\n snapshots: ProtectedDerivativeSnapshot[];\n source_urls: string[];\n } | null;\n};\n\nfunction issue(code: string, message: string, details?: unknown): ProtectedVerificationIssue {\n return { code, message, ...(details === undefined ? {} : { details }) };\n}\n\nfunction requiredString(value: unknown): string | null {\n return typeof value === 'string' && value.trim() ? value : null;\n}\n\nexport function inspectProtectedLiveDerivative(\n row: DatasetMaintenanceDerivativeRemoteRow,\n): ProtectedLiveDerivativeReadback | null {\n const raw = row.raw;\n const jsonOrdered = isJsonObject(raw.json_ordered) ? raw.json_ordered : null;\n const extractedText = requiredString(raw.extracted_text);\n const extractedMd = requiredString(raw.extracted_md);\n const embeddingAt = requiredString(raw.embedding_ft_at);\n if (\n row.state_code !== 0 ||\n !jsonOrdered ||\n !extractedText ||\n !extractedMd ||\n raw.embedding_ft === null ||\n raw.embedding_ft === undefined ||\n !embeddingAt ||\n !Number.isFinite(Date.parse(embeddingAt))\n ) {\n return null;\n }\n return {\n table: row.table,\n id: row.id,\n version: row.version,\n user_id: row.user_id,\n state_code: 0 as const,\n json_ordered_sha256: sha256Json(jsonOrdered),\n extracted_text_present: true,\n extracted_md_present: true,\n embedding_ft_present: true,\n embedding_ft_at: embeddingAt,\n };\n}\n\nfunction expectedFinalRows(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n rows: DatasetMaintenanceRemoteRow[];\n}): DatasetMaintenanceRemoteRow[] {\n const rows = new Map(options.rows.map((row) => [maintenanceRowKey(row), { ...row }]));\n for (const action of options.plan.actions) {\n const current = rows.get(maintenanceRowKey(action));\n if (current) {\n rows.set(maintenanceRowKey(action), {\n ...current,\n json_ordered: loadMaintenanceDesiredPayload(options.planDir, action),\n });\n }\n }\n return [...rows.values()].sort((left, right) =>\n maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)),\n );\n}\n\nfunction verifyStatusStructure(options: {\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n}): ProtectedVerificationIssue[] {\n const { identity, proof } = options;\n const issues: ProtectedVerificationIssue[] = [];\n const notAdmitted = proof.execution_status === 'not_admitted';\n const dispatchCountValid =\n proof.dispatch_count === 1 ||\n (proof.dispatch_count === 0 &&\n (proof.execution_status === 'failed' || proof.execution_status === 'indeterminate'));\n if (\n (notAdmitted && (proof.attempt_count !== 0 || proof.dispatch_count !== 0)) ||\n (!notAdmitted && (proof.attempt_count !== 1 || !dispatchCountValid))\n ) {\n issues.push(\n issue(\n 'PROTECTED_ATTEMPT_DISPATCH_COUNT_INVALID',\n 'Database did not prove the one-attempt, at-most-one-dispatch execution policy.',\n { attempt_count: proof.attempt_count, dispatch_count: proof.dispatch_count },\n ),\n );\n }\n if (proof.plan_sha256 !== identity.plan_sha256 || proof.operation_id !== identity.operation_id) {\n issues.push(\n issue(\n 'PROTECTED_EXECUTION_IDENTITY_MISMATCH',\n 'Database status does not round-trip the sealed plan identity.',\n ),\n );\n }\n const categoryMatches =\n (proof.status === 'passed' && proof.execution_status === 'completed') ||\n (proof.status === 'failed' &&\n (proof.execution_status === 'failed' || proof.execution_status === 'completed')) ||\n (proof.status === 'indeterminate' &&\n (proof.execution_status === 'not_admitted' || proof.execution_status === 'indeterminate')) ||\n (proof.status === 'pending' &&\n ['dispatching', 'dispatched', 'running', 'derivatives_pending'].includes(\n proof.execution_status,\n ));\n if (!categoryMatches) {\n issues.push(\n issue(\n 'PROTECTED_STATUS_CATEGORY_INVALID',\n 'Database status category is inconsistent with its execution ledger state.',\n { status: proof.status, execution_status: proof.execution_status },\n ),\n );\n }\n if (!notAdmitted) {\n const gateNames = proof.gates.map((gate) => gate.gate);\n const receiptHashes = proof.gates.map((gate) => gate.receipt_sha256);\n const gateClosureValid =\n proof.gate_count === 3 &&\n proof.gates.length === 3 &&\n new Set(gateNames).size === 3 &&\n new Set(receiptHashes).size === 3 &&\n proof.gates.every(\n (gate) => gate.observed_sha256 === gate.expected_sha256 && gate.status === 'passed',\n );\n if (!gateClosureValid) {\n issues.push(\n issue(\n 'PROTECTED_GATE_CLOSURE_INVALID',\n 'Database did not round-trip three unique server-captured gate receipts.',\n proof.gates,\n ),\n );\n }\n }\n return issues;\n}\n\nfunction verifyAuditClosure(proof: ProtectedExecutionStatusProof): ProtectedVerificationIssue[] {\n const audit = proof.primary_readback;\n const closure = audit?.closure;\n let closureHashMatches = false;\n if (isJsonObject(closure) && typeof closure.live_closure_proof_sha256 === 'string') {\n const proofMaterial = { ...closure };\n const closureSha256 = String(proofMaterial.live_closure_proof_sha256);\n delete proofMaterial.ok;\n delete proofMaterial.row_count;\n delete proofMaterial.exchange_count;\n delete proofMaterial.live_closure_proof_sha256;\n closureHashMatches = sha256Json(proofMaterial) === closureSha256;\n }\n if (\n !audit ||\n audit.row_count !== PROTECTED_EXECUTION_COUNTS.action_count ||\n audit.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count ||\n audit.alias_audit_count !== PROTECTED_EXECUTION_COUNTS.audit_count ||\n audit.live_closure_proof !== true ||\n !isJsonObject(closure) ||\n closure.schema_version !== 'dataset-alias-primary-closure.v1' ||\n closure.ok !== true ||\n closure.actor_user_id !== proof.actor_user_id ||\n closure.batch_count !== PROTECTED_EXECUTION_COUNTS.batch_count ||\n closure.action_count !== PROTECTED_EXECUTION_COUNTS.action_count ||\n closure.distinct_action_count !== PROTECTED_EXECUTION_COUNTS.action_count ||\n closure.flowproperty_count !== PROTECTED_EXECUTION_COUNTS.flowproperty_count ||\n closure.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count ||\n closure.process_count !== PROTECTED_EXECUTION_COUNTS.process_count ||\n closure.support_reference_count !== 6 ||\n closure.flowproperty_support_count !== 2 ||\n closure.unitgroup_support_count !== 2 ||\n closure.source_unitgroup_support_count !== 2 ||\n closure.invalid_action_count !== 0 ||\n closure.invalid_support_count !== 0 ||\n !Array.isArray(closure.action_evidence) ||\n closure.action_evidence.length !== PROTECTED_EXECUTION_COUNTS.action_count ||\n closure.action_evidence.some((entry) => !isJsonObject(entry)) ||\n !Array.isArray(closure.support_evidence) ||\n closure.support_evidence.length !== 6 ||\n closure.support_evidence.some((entry) => !isJsonObject(entry)) ||\n closure.row_count !== PROTECTED_EXECUTION_COUNTS.action_count ||\n closure.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count ||\n closure.live_closure_proof !== true ||\n !closureHashMatches\n ) {\n return [\n issue(\n 'PROTECTED_AUDIT_CLOSURE_INVALID',\n 'Terminal execution did not prove the exact 52-row, 59-exchange, 55-audit primary closure.',\n audit,\n ),\n ];\n }\n return [];\n}\n\nfunction terminalTargetKey(target: { table: string; id: string; version: string }): string {\n return `${target.table}\\u0000${target.id}\\u0000${target.version}`;\n}\n\nfunction verifyTerminalTargets(options: {\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n}): ProtectedVerificationIssue[] {\n const issues: ProtectedVerificationIssue[] = [];\n const batch = options.proof.derivative_readback;\n if (batch.proof_level !== 'causal_terminal' || batch.proof_deferred !== false) {\n return [\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID',\n 'Terminal proof must use the full causal-terminal evidence level.',\n ),\n ];\n }\n const targets = batch.targets;\n const keys = targets.map(terminalTargetKey);\n if (\n batch.schema_version !== 'dataset-derivative-rebuild-batch-status.v1' ||\n batch.batch_id !== options.identity.request_id ||\n batch.status !== 'completed' ||\n batch.code !== 'DERIVATIVE_BATCH_COMPLETED' ||\n batch.causal_terminal_proof !== true ||\n batch.target_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||\n batch.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count ||\n batch.process_count !== PROTECTED_EXECUTION_COUNTS.process_count ||\n batch.completed_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||\n batch.nonterminal_count !== 0 ||\n batch.failed_count !== 0 ||\n batch.invalid_proof_count !== 0 ||\n targets.length !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||\n new Set(keys).size !== PROTECTED_EXECUTION_COUNTS.derivative_target_count ||\n new Set(targets.map((target) => target.ordinal)).size !==\n PROTECTED_EXECUTION_COUNTS.derivative_target_count\n ) {\n return [\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID',\n 'Terminal proof must contain exactly 50 unique derivative targets.',\n ),\n ];\n }\n const frozen = new Map(\n options.identity.derivative_targets.map((target) => [terminalTargetKey(target), target]),\n );\n for (const [index, target] of targets.entries()) {\n const expected = frozen.get(terminalTargetKey(target));\n if (\n !expected ||\n target.ordinal !== index + 1 ||\n target.request_id === options.identity.request_id ||\n target.source_baseline_snapshot_sha256 !== expected.baseline_snapshot_sha256\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_IDENTITY_MISMATCH',\n 'Terminal derivative proof contains a foreign or changed target.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n continue;\n }\n if (\n target.status !== 'completed' ||\n !target.phase ||\n !target.completed_snapshot_sha256 ||\n !SHA256.test(target.expected_snapshot_sha256) ||\n !SHA256.test(target.completed_snapshot_sha256) ||\n target.completed_snapshot_sha256 === target.expected_snapshot_sha256 ||\n !target.primary_matches ||\n !target.terminal_snapshot_matches ||\n !target.proposals_committed ||\n !target.derivative_fresh ||\n !target.lifecycle_complete ||\n !target.terminal_audit_present ||\n Object.values(target.residue).some((count) => count !== 0) ||\n !target.causal_terminal_proof\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_NOT_TERMINAL',\n 'Derivative target lacks causal completed/live equality or retains queue, failure, or fence state.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n }\n }\n return issues;\n}\n\nfunction verifyFinalAccountRows(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n rows: DatasetMaintenanceRemoteRow[];\n completeness: unknown;\n}): ProtectedVerificationIssue[] {\n const issues: ProtectedVerificationIssue[] = [];\n if (\n !options.plan.snapshot_completeness ||\n !isSnapshotCompletenessCompatible(\n options.completeness,\n options.plan.snapshot_completeness,\n Object.keys(options.plan.snapshot_completeness.entity_counts),\n )\n ) {\n issues.push(\n issue(\n 'PROTECTED_FINAL_SNAPSHOT_INCOMPLETE',\n 'Final RLS account scan does not prove the same complete table census as the plan.',\n ),\n );\n return issues;\n }\n const expectedKeys = new Set([\n ...options.plan.actions.map(maintenanceRowKey),\n ...options.plan.protected_rows.map(maintenanceRowKey),\n ]);\n const actualKeys = new Set(options.rows.map(maintenanceRowKey));\n if (\n expectedKeys.size !== actualKeys.size ||\n [...expectedKeys].some((key) => !actualKeys.has(key))\n ) {\n issues.push(\n issue(\n 'PROTECTED_FINAL_ACCOUNT_CENSUS_DRIFT',\n 'Final RLS account rows contain missing or unexpected entities.',\n ),\n );\n }\n const current = new Map(options.rows.map((row) => [maintenanceRowKey(row), row]));\n for (const protectedRow of options.plan.protected_rows) {\n const row = current.get(maintenanceRowKey(protectedRow));\n if (!row || snapshotRemoteRow(row).row_sha256 !== protectedRow.row_sha256) {\n issues.push(\n issue('PROTECTED_ROW_DRIFT', 'A protected non-action row changed.', protectedRow),\n );\n }\n }\n for (const action of options.plan.actions) {\n const row = current.get(maintenanceRowKey(action));\n const desired = loadMaintenanceDesiredPayload(options.planDir, action);\n if (\n !row ||\n row.user_id !== action.expected_user_id ||\n row.state_code !== 0 ||\n sha256Json(row.json_ordered) !== sha256Json(desired) ||\n row.model_id !== action.before?.model_id ||\n row.rule_verification !== action.before?.rule_verification\n ) {\n issues.push(\n issue(\n 'PROTECTED_ACTION_READBACK_MISMATCH',\n 'An action row does not match the desired owner-draft payload.',\n { action_id: action.action_id },\n ),\n );\n }\n }\n const projected = expectedFinalRows({\n plan: options.plan,\n planDir: options.planDir,\n rows: options.rows,\n });\n if (\n sha256Json(maintenanceProjectedReferenceFingerprint(projected)) !==\n options.plan.projected_reference_sha256\n ) {\n issues.push(\n issue(\n 'PROTECTED_REFERENCE_CLOSURE_MISMATCH',\n 'Final reference closure does not match the frozen projected closure.',\n ),\n );\n }\n return issues;\n}\n\nfunction matchLiveTargets(options: {\n proofs: ProtectedTerminalTargetProof[];\n live: ProtectedLiveDerivativeReadback[];\n snapshots: ProtectedDerivativeSnapshot[];\n plan: DatasetMaintenancePlan;\n identity: ProtectedExecutionIdentity;\n}): ProtectedVerificationIssue[] {\n const proofs = new Map(options.proofs.map((proof) => [terminalTargetKey(proof), proof]));\n const snapshots = new Map(\n options.snapshots.map((snapshot) => [terminalTargetKey(snapshot), snapshot]),\n );\n const live = new Map(options.live.map((row) => [terminalTargetKey(row), row]));\n const actions = new Map(\n options.plan.actions.map((action) => [maintenanceRowKey(action), action]),\n );\n const issues: ProtectedVerificationIssue[] = [];\n const expectedKeys = new Set(options.identity.derivative_targets.map(terminalTargetKey));\n const liveKeys = options.live.map(terminalTargetKey);\n const snapshotKeys = options.snapshots.map(terminalTargetKey);\n if (\n liveKeys.length !== expectedKeys.size ||\n new Set(liveKeys).size !== expectedKeys.size ||\n snapshotKeys.length !== expectedKeys.size ||\n new Set(snapshotKeys).size !== expectedKeys.size ||\n [...expectedKeys].some((key) => !live.has(key) || !snapshots.has(key))\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_SET_MISMATCH',\n 'Independent derivative rows and snapshots must be unique and exactly match all 50 frozen targets.',\n ),\n );\n }\n for (const target of options.identity.derivative_targets) {\n const key = terminalTargetKey(target);\n const row = live.get(key);\n const proof = proofs.get(key);\n const snapshot = snapshots.get(key);\n const action = actions.get(key);\n if (\n !row ||\n !proof ||\n !snapshot ||\n !action?.desired_payload ||\n row.user_id !== options.identity.actor.user_id ||\n row.state_code !== 0 ||\n snapshot.user_id !== options.identity.actor.user_id ||\n snapshot.state_code !== 0 ||\n row.json_ordered_sha256 !== action.desired_payload.sha256 ||\n snapshot.json_ordered_sha256 !== row.json_ordered_sha256 ||\n snapshot.snapshot_sha256 !== proof.completed_snapshot_sha256 ||\n !snapshot.extracted_md_sha256 ||\n !snapshot.embedding_ft_sha256 ||\n !snapshot.embedding_ft_at\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_MISMATCH',\n 'Independent RLS derivative readback does not match the terminal database proof.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n }\n }\n return issues;\n}\n\nasync function fetchProtectedDerivativeSnapshots(options: {\n context: DatasetMaintenanceRemoteContext;\n identity: ProtectedExecutionIdentity;\n}): Promise<ProtectedDerivativeSnapshot[]> {\n const snapshots: ProtectedDerivativeSnapshot[] = [];\n const targets = options.identity.derivative_targets;\n for (let offset = 0; offset < targets.length; offset += 5) {\n const chunk = targets.slice(offset, offset + 5);\n snapshots.push(\n ...(await Promise.all(\n chunk.map(async (target) =>\n parseProtectedDerivativeSnapshot(\n await fetchMaintenanceDerivativeSnapshot({\n context: options.context,\n table: target.table,\n id: target.id,\n version: target.version,\n }),\n {\n table: target.table,\n id: target.id,\n version: target.version,\n userId: target.user_id,\n },\n ),\n ),\n )),\n );\n }\n return snapshots;\n}\n\ntype ProtectedVerificationDependencies = {\n fetchAccountRows: typeof fetchMaintenanceAccountRows;\n fetchDerivativeRows: typeof fetchMaintenanceDerivativeTargetRows;\n fetchSnapshots: typeof fetchProtectedDerivativeSnapshots;\n};\n\nasync function verifyProtectedExecutionWithDependencies(\n options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n context: DatasetMaintenanceRemoteContext;\n pageSize?: number;\n },\n dependencies: ProtectedVerificationDependencies,\n): Promise<ProtectedVerificationResult> {\n const { fetchAccountRows, fetchDerivativeRows, fetchSnapshots } = dependencies;\n const structuralIssues = verifyStatusStructure({\n identity: options.identity,\n proof: options.proof,\n });\n if (structuralIssues.length) {\n return {\n status: options.proof.status === 'indeterminate' ? 'indeterminate' : 'failed',\n issues: structuralIssues,\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.execution_status === 'not_admitted') {\n return {\n status: 'indeterminate',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_NOT_FOUND',\n 'The server has a protected preflight but no admitted execution; admission must not be retried.',\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.status === 'pending') {\n return { status: 'pending', issues: [], account_readback: null, derivative_readback: null };\n }\n if (options.proof.status === 'indeterminate') {\n return {\n status: 'indeterminate',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_INDETERMINATE',\n 'Database reported an indeterminate terminal execution; admission must not be retried.',\n options.proof.failure,\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.status === 'failed') {\n return {\n status: 'failed',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_FAILED',\n 'Database reported a definitive protected execution failure.',\n options.proof.failure,\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n\n const issues = [\n ...verifyAuditClosure(options.proof),\n ...verifyTerminalTargets({ identity: options.identity, proof: options.proof }),\n ];\n if (issues.length) {\n return { status: 'failed', issues, account_readback: null, derivative_readback: null };\n }\n const account = await fetchAccountRows({\n context: options.context,\n userId: options.identity.actor.user_id,\n pageSize: options.pageSize,\n });\n issues.push(\n ...verifyFinalAccountRows({\n plan: options.plan,\n planDir: options.planDir,\n rows: account.rows,\n completeness: account.completeness,\n }),\n );\n const derivative = await fetchDerivativeRows({\n context: options.context,\n targets: options.identity.derivative_targets,\n });\n const live = derivative.rows.map(inspectProtectedLiveDerivative);\n if (live.some((row) => row === null)) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_INVALID',\n 'A live derivative row lacks primary JSON, extracted markdown, embedding, or timestamps.',\n ),\n );\n }\n const validLive = live.filter((row): row is ProtectedLiveDerivativeReadback => row !== null);\n const snapshots = await fetchSnapshots({\n context: options.context,\n identity: options.identity,\n });\n if (validLive.length === PROTECTED_EXECUTION_COUNTS.derivative_target_count) {\n const terminalProofs =\n options.proof.derivative_readback.proof_level === 'causal_terminal'\n ? options.proof.derivative_readback.targets\n : [];\n issues.push(\n ...matchLiveTargets({\n proofs: terminalProofs,\n live: validLive,\n snapshots,\n plan: options.plan,\n identity: options.identity,\n }),\n );\n }\n return {\n status: issues.length ? 'failed' : 'passed',\n issues,\n account_readback: {\n rows: account.rows,\n source_urls: account.source_urls,\n completeness: account.completeness,\n },\n derivative_readback: {\n rows: validLive,\n snapshots,\n source_urls: derivative.source_urls,\n },\n };\n}\n\nexport async function verifyProtectedExecution(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n context: DatasetMaintenanceRemoteContext;\n pageSize?: number;\n}): Promise<ProtectedVerificationResult> {\n return verifyProtectedExecutionWithDependencies(options, {\n fetchAccountRows: fetchMaintenanceAccountRows,\n fetchDerivativeRows: fetchMaintenanceDerivativeTargetRows,\n fetchSnapshots: fetchProtectedDerivativeSnapshots,\n });\n}\n\nexport const __testInternals = {\n expectedFinalRows,\n fetchProtectedDerivativeSnapshots,\n inspectProtectedLiveDerivative,\n matchLiveTargets,\n verifyAuditClosure,\n verifyFinalAccountRows,\n verifyStatusStructure,\n verifyTerminalTargets,\n verifyProtectedExecutionWithDependencies,\n};\n"]}