npm - @tiangong-lca/cli - Versions diffs - 0.0.32 → 0.1.0 - Mend

@tiangong-lca/cli 0.0.32 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (101) hide show

package/dist/src/lib/dataset-maintenance-protected-preparation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"dataset-maintenance-protected-preparation.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,GAGf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,EAChC,sCAAsC,EACtC,4BAA4B,EAC5B,sBAAsB,EACtB,oBAAoB,EACpB,oCAAoC,EACpC,sBAAsB,GAKvB,MAAM,6CAA6C,CAAC;AAErD,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,uBAAuB,EAAE,6CAA6C;CAC9D,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAA+B,CAAC;AAEhF,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;CAC1D,CAAC;AAEX,MAAM,MAAM,GAAG,iBAAiB,CAAC;AA4CjC,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,mDAAmD;QACzD,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,QAA2B,EAAE,KAAa;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,IAAI,CAAC,GAAG,KAAK,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAc,EACd,KAAK,GAAG,aAAa;IAErB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,IAAK,0CAAgE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,GAAG,KAAK,sEAAsE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,gCAAgC,EAAE,CAAC;QACpD,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC9D,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,CAAC;QACjD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1D,SAAS,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO;QACL,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;QACvE,WAAW,EAAE,oCAAoC,CAAC,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACxF,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG;QACX,2BAA2B;QAC3B,wBAAwB;QACxB,yBAAyB;QACzB,6BAA6B;QAC7B,6BAA6B;QAC7B,gCAAgC;QAChC,8BAA8B;QAC9B,2BAA2B;KACnB,CAAC;IACX,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CACb,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACrD,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,YAAY,GAAG,eAAe,QAAQ,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG;QACX,oBAAoB;QACpB,YAAY;QACZ,SAAS;QACT,qBAAqB;QACrB,mBAAmB;QACnB,yBAAyB;QACzB,iBAAiB;QACjB,iBAAiB;KACT,CAAC;IACX,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,IACE,KAAK,CAAC,kBAAkB,KAAK,CAAC;QAC9B,KAAK,CAAC,UAAU,KAAK,CAAC;QACtB,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,KAAK,CAAC,mBAAmB,KAAK,CAAC;QAC/B,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAC7B,KAAK,CAAC,uBAAuB,KAAK,CAAC;QACnC,KAAK,CAAC,eAAe,KAAK,CAAC;QAC3B,KAAK,CAAC,eAAe,KAAK,KAAK,EAC/B,CAAC;QACD,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,CAAC;QACrB,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;QACV,mBAAmB,EAAE,CAAC;QACtB,iBAAiB,EAAE,CAAC;QACpB,uBAAuB,EAAE,CAAC;QAC1B,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAI,KAAQ;IACpC,MAAM,iBAAiB,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACvD,OAAO;QACL,KAAK;QACL,mBAAmB,EAAE,iBAAiB;QACtC,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAyC,EACzC,gBAAwB,EACxB,aAAqB;IAErB,oCAAoC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;IACtE,IAAI,gBAAgB,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,cAAc,EAAE,8BAA8B,CAAC,uBAAuB;QACtE,eAAe,EAAE,kBAAkB,CAAC,aAAa,EAAE,iBAAiB,CAAC;QACrE,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,aAAa;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,0BAA0B;QACpC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAkC,EAClC,aAAqB;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC1D,OAAO;QACL,uDAAuD;QACvD,kBAAkB,IAAI,CAAC,cAAc,EAAE;QACvC,mBAAmB,IAAI,CAAC,eAAe,EAAE;QACzC,kBAAkB,WAAW,EAAE;QAC/B,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,iBAAiB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;QACrC,mBAAmB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;QACzC,qBAAqB,IAAI,CAAC,iBAAiB,EAAE;QAC7C,eAAe,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QACtC,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;QACxC,oBAAoB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;QAChD,sBAAsB,IAAI,CAAC,kBAAkB,EAAE;QAC/C,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,6BAA6B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAClE,0BAA0B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAC5D,2BAA2B,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;QAC9D,+BAA+B,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACtE,+BAA+B,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACtE,kCAAkC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE;QAC5E,gCAAgC,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxE,6BAA6B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAClE,gBAAgB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC5C,eAAe,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC1C,kBAAkB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;QAChD,sBAAsB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE;QACxD,4BAA4B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACpE,eAAe,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC1C,sBAAsB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE;QACxD,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;QACxC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE;QAC9C,2BAA2B,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE;QAClE,sBAAsB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;QACtD,cAAc,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;QACtC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QAChC,uBAAuB,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE;QACxD,qBAAqB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;QACpD,2BAA2B,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE;QAChE,mBAAmB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;QAChD,mBAAmB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE;QACxD,kEAAkE;QAClE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACtE,SAAS,CACP,KAAK,EACL;QACE,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,aAAa;QACb,SAAS;QACT,mBAAmB;QACnB,MAAM;QACN,oBAAoB;QACpB,eAAe;QACf,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB;QAChB,eAAe;QACf,sBAAsB;KACvB,EACD,kBAAkB,CACnB,CAAC;IACF,IACE,KAAK,CAAC,cAAc,KAAK,8BAA8B,CAAC,uBAAuB;QAC/E,KAAK,CAAC,WAAW,KAAK,YAAY;QAClC,KAAK,CAAC,iBAAiB,KAAK,aAAa,EACzC,CAAC;QACD,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAiC;QACzC,cAAc,EAAE,8BAA8B,CAAC,uBAAuB;QACtE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC7E,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;QACpD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,iBAAiB,EAAE,aAAa;QAChC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7B,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QACxE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC;QACzD,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QACxC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;KACnC,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACpF,IAAI,UAAU,CAAC,YAAY,CAAC,KAAK,kBAAkB,EAAE,CAAC;QACpD,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,aAAa;QAC7B,aAAa,EAAE,YAAY;QAC3B,oBAAoB,EAAE,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA4B,EAAE,KAAiB;IAC7E,IACE,KAAK,CAAC,cAAc,KAAK,uBAAuB;QAChD,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxC,KAAK,CAAC,iBAAiB,KAAK,aAAa;QACzC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IACE,CAAC,YAAY,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YACtC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YACxC,KAAK,CAAC,iBAAiB,KAAK,aAAa;YACzC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,KAAK,CAAC,EACrC,CAAC;YACD,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,IAA4B,EAC5B,eAAmD;IAEnD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC5D,oCAAoC,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC3E,IACE,IAAI,CAAC,SAAS,KAAK,uBAAuB;QAC1C,IAAI,CAAC,MAAM,KAAK,OAAO;QACvB,IAAI,CAAC,WAAW,KAAK,aAAa;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO;QAChD,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;QAC5C,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAC5C,CAAC;QACD,IAAI,CAAC,yFAAyF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;SACzB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC;SAC5E,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC5C,CAAC;IACJ,IACE,OAAO,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB;QACrE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,MAAM;YACzD,0BAA0B,CAAC,UAAU;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM;YAC7D,0BAA0B,CAAC,aAAa;QAC1C,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,gBAAgB,KAAK,eAAe,CAAC,OAAO,IAAI,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAC1F,EACD,CAAC;QACD,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,KAAK,EAAE,MAAM,CAAC,KAA8B;QAC5C,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,gBAAgB;QAChC,UAAU,EAAE,CAAU;KACvB,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAI1B;IACC,MAAM,OAAO,GAAG,wCAAwC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAY,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IACE,CAAC,YAAY,CAAC,QAAQ,CAAC;YACvB,QAAQ,CAAC,cAAc,KAAK,gCAAgC;YAC5D,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC/B,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE;YACzB,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACnC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACnC,QAAQ,CAAC,UAAU,KAAK,CAAC,EACzB,CAAC;YACD,IAAI,CAAC,uBAAuB,KAAK,uDAAuD,CAAC,CAAC;QAC5F,CAAC;QACD,SAAS,CACP,QAAQ,EACR;YACE,gBAAgB;YAChB,OAAO;YACP,IAAI;YACJ,SAAS;YACT,SAAS;YACT,YAAY;YACZ,aAAa;YACb,aAAa;YACb,qBAAqB;YACrB,uBAAuB;YACvB,qBAAqB;YACrB,qBAAqB;YACrB,iBAAiB;YACjB,iBAAiB;SAClB,EACD,uBAAuB,KAAK,GAAG,CAChC,CAAC;QACF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,uBAAuB,KAAK,eAAe,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,uBAAuB,KAAK,eAAe,CAAC,CAAC;QAC3F,MAAM,iBAAiB,GAAG,IAAI,CAC5B,QAAQ,CAAC,mBAAmB,EAC5B,uBAAuB,KAAK,uBAAuB,CACpD,CAAC;QACF,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACrC,IAAI,CAAC,uBAAuB,KAAK,iDAAiD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,uBAAuB,KAAK,yBAAyB,CAAC,CAAC;QAC5F,IAAI,QAAQ,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,uBAAuB,KAAK,uBAAuB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,uBAAuB,KAAK,uBAAuB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACtC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,uBAAuB,KAAK,mBAAmB,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CACzB,QAAQ,CAAC,eAAe,EACxB,uBAAuB,KAAK,mBAAmB,CAChD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,CAAC;YACb,wBAAwB,EAAE,cAAc;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAQpC;IACC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtE,MAAM,uBAAuB,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;IACjG,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,oCAAoC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACnF,IACE,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,uBAAuB;QAClD,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO;QAC/B,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,aAAa;QAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO;QACxD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;QACpD,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,EAC5D,CAAC;QACD,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC1F,CAAC;IACD,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,OAAO,CAAC,mBAAmB;KACvC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAsC;QACnD,cAAc,EAAE,4BAA4B,CAAC,aAAa;QAC1D,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,mCAAmC,CAAC,OAAO,CAAC,UAAU,CAAC;QACpE,OAAO,EAAE,eAAe;QACxB,iBAAiB,EAAE,aAAa;QAChC,IAAI,EAAE;YACJ,gBAAgB,EAAE,cAAc;YAChC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;SACxC;QACD,IAAI,EAAE;YACJ,GAAG,QAAQ;YACX,yBAAyB,EAAE,sBAAsB;YACjD,8BAA8B,EAAE,oCAAoC,CAAC,OAAO,CAAC;YAC7E,yBAAyB,EAAE,uBAAuB;SACnD;QACD,QAAQ,EAAE,0BAA0B;QACpC,kBAAkB,EAAE,OAAO;QAC3B,MAAM,EAAE;YACN,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,mBAAmB,EAAE,CAAC;YACtB,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,CAAC;YAC1B,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,KAAK;SACvB;QACD,aAAa,EAAE,EAAE;KAClB,CAAC;IACF,SAAS,CAAC,aAAa,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,gCAAgC,CAAC;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc;QACd,sBAAsB;QACtB,MAAM;KACP,CAAC,CAAC;IACH,OAAO;QACL,GAAG,iBAAiB,CAAC,MAAM,CAAC;QAC5B,yBAAyB,EAAE,sBAAsB;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,6BAA6B,CAAC;QAC5C,GAAG,IAAI;QACP,cAAc,EAAE,aAAa;QAC7B,aAAa,EAAE,YAAY;QAC3B,oBAAoB,EAAE,UAAU,CAAC,YAAY,CAAC;KAC/C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OASrC;IACC,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACjF,IACE,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,aAAa;QACnD,oBAAoB,KAAK,OAAO,CAAC,cAAc;QAC/C,iBAAiB,KAAK,OAAO,CAAC,oBAAoB;QAClD,OAAO,CAAC,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK;QACrD,aAAa,KAAK,OAAO,CAAC,eAAe,EACzC,CAAC;QACD,IAAI,CACF,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5F,IAAI,UAAU,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACxD,IAAI,CAAC,uFAAuF,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAwC;QACpD,cAAc,EAAE,4BAA4B,CAAC,eAAe;QAC5D,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,aAAa;QAChC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;QAC9C,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,KAAK;QACtB,wBAAwB,EAAE,EAAE;KAC7B,CAAC;IACF,QAAQ,CAAC,wBAAwB,GAAG,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACrF,OAAO,iBAAiB,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import { CliError } from './errors.js';\nimport {\n computePlanSha256,\n isJsonObject,\n sha256Json,\n sha256Text,\n stableJsonText,\n type DatasetMaintenancePlan,\n type JsonObject,\n} from './dataset-maintenance-contract.js';\nimport {\n PROTECTED_EXECUTION_CONTRACT,\n PROTECTED_EXECUTION_COUNTS,\n assertProtectedFreezeMatchesPlan,\n computeProtectedApprovalIdentitySha256,\n computeProtectedFreezeSha256,\n parseProtectedApproval,\n parseProtectedFreeze,\n protectedDerivativeBaselineSetSha256,\n protectedPlanSetHashes,\n type DatasetMaintenanceProtectedApproval,\n type DatasetMaintenanceProtectedFreeze,\n type ProtectedDerivativeSnapshot,\n type ProtectedDerivativeTarget,\n} from './dataset-maintenance-protected-contract.js';\n\nexport const PROTECTED_PREPARATION_CONTRACT = {\n approval_request_schema: 'dataset-alias-execution-approval-request.v1',\n} as const;\n\nexport const PROTECTED_PRODUCTION_PROJECT_REF = 'qgzvkongdjqiiamzbbts' as const;\n\nexport const PROTECTED_PREPARATION_REJECTED_PLAN_SHA256 = [\n '813a201ded0443c79639cfbdb8f5a2fad8a8781ef6edd3ec7019e9a45f5f33ce',\n '673331422e8dceeb7975984b07276f057b37e8d6de789d7f030ec29f3be29629',\n '7fdf7e2755599d426e31a9955985d54d5b7cef1adeaa7a10dcc7186353a6c3a8',\n] as const;\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\ntype ProtectedApprovalRequestCore = {\n schema_version: typeof PROTECTED_PREPARATION_CONTRACT.approval_request_schema;\n approved_at_utc: string;\n environment: 'production';\n project_ref: string;\n account: { user_id: string; email: string };\n target_visibility: 'owner_draft';\n plan: DatasetMaintenanceProtectedFreeze['plan'];\n freeze_file_sha256: string;\n freeze_sha256: string;\n sets: DatasetMaintenanceProtectedFreeze['sets'];\n expected: typeof PROTECTED_EXECUTION_COUNTS;\n policy: DatasetMaintenanceProtectedFreeze['policy'];\n};\n\nexport type DatasetMaintenanceProtectedApprovalRequest = ProtectedApprovalRequestCore & {\n request_sha256: string;\n approval_text: string;\n approval_text_sha256: string;\n};\n\nexport type CanonicalProtectedArtifact<T> = {\n value: T;\n canonical_file_text: string;\n file_sha256: string;\n};\n\nexport type BuiltProtectedFreeze = CanonicalProtectedArtifact<DatasetMaintenanceProtectedFreeze> & {\n alias_plan_request_sha256: string;\n};\n\nexport type BuiltProtectedApprovalRequest =\n CanonicalProtectedArtifact<DatasetMaintenanceProtectedApprovalRequest>;\n\nexport type BuiltProtectedApproval =\n CanonicalProtectedArtifact<DatasetMaintenanceProtectedApproval>;\n\nexport type ProtectedDerivativeSnapshotTarget = Omit<\n ProtectedDerivativeTarget,\n 'baseline_snapshot_sha256'\n>;\n\nfunction fail(message: string): never {\n throw new CliError(message, {\n code: 'DATASET_MAINTENANCE_PROTECTED_PREPARATION_INVALID',\n exitCode: 2,\n });\n}\n\nfunction exactKeys(value: JsonObject, expected: readonly string[], label: string): void {\n const actual = Object.keys(value).sort();\n const wanted = [...expected].sort();\n if (actual.length !== wanted.length \|\| actual.some((key, index) => key !== wanted[index])) {\n fail(`${label} must contain exactly: ${wanted.join(', ')}.`);\n }\n}\n\nfunction token(value: unknown, label: string): string {\n if (typeof value !== 'string' \|\| !value \|\| value.trim() !== value) {\n fail(`${label} must be a non-empty canonical string.`);\n }\n return value;\n}\n\nfunction exactText(value: unknown, label: string): string {\n if (typeof value !== 'string' \|\| value.length === 0) {\n fail(`${label} must be a non-empty byte-exact string.`);\n }\n return value;\n}\n\nfunction hash(value: unknown, label: string): string {\n const digest = token(value, label);\n if (!SHA256.test(digest)) fail(`${label} must be a lowercase SHA-256 digest.`);\n return digest;\n}\n\nexport function assertProtectedPreparationPlanSha256(\n value: unknown,\n label = 'plan_sha256',\n): string {\n const digest = hash(value, label);\n if ((PROTECTED_PREPARATION_REJECTED_PLAN_SHA256 as readonly string[]).includes(digest)) {\n fail(`${label} is a historical superseded plan and cannot be prepared or approved.`);\n }\n return digest;\n}\n\nexport function assertProtectedProductionProjectRef(value: unknown): string {\n const projectRef = token(value, 'project_ref');\n if (projectRef !== PROTECTED_PRODUCTION_PROJECT_REF) {\n fail('Protected BAFU preparation and commit are restricted to the production project.');\n }\n return projectRef;\n}\n\nfunction canonicalTimestamp(value: unknown, label: string): string {\n const timestamp = token(value, label);\n const parsed = Date.parse(timestamp);\n if (!Number.isFinite(parsed) \|\| new Date(parsed).toISOString() !== timestamp) {\n fail(`${label} must be a canonical ISO timestamp.`);\n }\n return timestamp;\n}\n\nfunction timestamp(value: unknown, label: string): string {\n const result = token(value, label);\n if (!Number.isFinite(Date.parse(result))) fail(`${label} must be an ISO timestamp.`);\n return result;\n}\n\nfunction account(value: unknown, label: string): { user_id: string; email: string } {\n if (!isJsonObject(value)) fail(`${label} must be an object.`);\n exactKeys(value, ['user_id', 'email'], label);\n return {\n user_id: token(value.user_id, `${label}.user_id`),\n email: token(value.email, `${label}.email`),\n };\n}\n\nfunction planBinding(value: unknown): DatasetMaintenanceProtectedFreeze['plan'] {\n if (!isJsonObject(value)) fail('plan must be an object.');\n exactKeys(value, ['plan_file_sha256', 'plan_sha256', 'operation_id'], 'plan');\n return {\n plan_file_sha256: hash(value.plan_file_sha256, 'plan.plan_file_sha256'),\n plan_sha256: assertProtectedPreparationPlanSha256(value.plan_sha256, 'plan.plan_sha256'),\n operation_id: token(value.operation_id, 'plan.operation_id'),\n };\n}\n\nfunction freezeSets(value: unknown): DatasetMaintenanceProtectedFreeze['sets'] {\n if (!isJsonObject(value)) fail('sets must be an object.');\n const keys = [\n 'alias_plan_request_sha256',\n 'before_hash_set_sha256',\n 'desired_hash_set_sha256',\n 'exchange_rewrite_set_sha256',\n 'support_snapshot_set_sha256',\n 'derivative_baseline_set_sha256',\n 'derivative_target_set_sha256',\n 'toolchain_evidence_sha256',\n ] as const;\n exactKeys(value, keys, 'sets');\n return Object.fromEntries(\n keys.map((key) => [key, hash(value[key], `sets.${key}`)]),\n ) as DatasetMaintenanceProtectedFreeze['sets'];\n}\n\nfunction expectedCounts(value: unknown): typeof PROTECTED_EXECUTION_COUNTS {\n if (!isJsonObject(value)) fail('expected must be an object.');\n const keys = Object.keys(PROTECTED_EXECUTION_COUNTS);\n exactKeys(value, keys, 'expected');\n for (const [key, expected] of Object.entries(PROTECTED_EXECUTION_COUNTS)) {\n if (value[key] !== expected) fail(`expected.${key} must equal ${expected}.`);\n }\n return PROTECTED_EXECUTION_COUNTS;\n}\n\nfunction freezePolicy(value: unknown): DatasetMaintenanceProtectedFreeze['policy'] {\n if (!isJsonObject(value)) fail('policy must be an object.');\n const keys = [\n 'state_code_changes',\n 'save_draft',\n 'deletes',\n 'rebuild_derivatives',\n 'unitgroup_actions',\n 'person_distance_actions',\n 'max_admit_posts',\n 'automatic_retry',\n ] as const;\n exactKeys(value, keys, 'policy');\n if (\n value.state_code_changes !== 0 \|\|\n value.save_draft !== 0 \|\|\n value.deletes !== 0 \|\|\n value.rebuild_derivatives !== 0 \|\|\n value.unitgroup_actions !== 0 \|\|\n value.person_distance_actions !== 0 \|\|\n value.max_admit_posts !== 1 \|\|\n value.automatic_retry !== false\n ) {\n fail('policy must preserve the one-shot owner-draft execution boundary.');\n }\n return {\n state_code_changes: 0,\n save_draft: 0,\n deletes: 0,\n rebuild_derivatives: 0,\n unitgroup_actions: 0,\n person_distance_actions: 0,\n max_admit_posts: 1,\n automatic_retry: false,\n };\n}\n\nfunction canonicalArtifact<T>(value: T): CanonicalProtectedArtifact<T> {\n const canonicalFileText = `${stableJsonText(value)}\\n`;\n return {\n value,\n canonical_file_text: canonicalFileText,\n file_sha256: sha256Text(canonicalFileText),\n };\n}\n\nfunction approvalRequestCore(\n freeze: DatasetMaintenanceProtectedFreeze,\n freezeFileSha256: string,\n approvedAtUtc: string,\n): ProtectedApprovalRequestCore {\n assertProtectedPreparationPlanSha256(freeze.plan.plan_sha256, 'freeze.plan.plan_sha256');\n const freezeFileDigest = hash(freezeFileSha256, 'freeze_file_sha256');\n if (freezeFileDigest !== canonicalArtifact(freeze).file_sha256) {\n fail('freeze_file_sha256 does not match the canonical freeze artifact bytes.');\n }\n return {\n schema_version: PROTECTED_PREPARATION_CONTRACT.approval_request_schema,\n approved_at_utc: canonicalTimestamp(approvedAtUtc, 'approved_at_utc'),\n environment: 'production',\n project_ref: assertProtectedProductionProjectRef(freeze.project_ref),\n account: freeze.account,\n target_visibility: 'owner_draft',\n plan: freeze.plan,\n freeze_file_sha256: freezeFileDigest,\n freeze_sha256: freeze.freeze_sha256,\n sets: freeze.sets,\n expected: PROTECTED_EXECUTION_COUNTS,\n policy: freeze.policy,\n };\n}\n\nexport function renderProtectedApprovalText(\n core: ProtectedApprovalRequestCore,\n requestSha256: string,\n): string {\n const requestHash = hash(requestSha256, 'request_sha256');\n return [\n 'BAFU protected owner-draft execution approval request',\n `schema_version=${core.schema_version}`,\n `approved_at_utc=${core.approved_at_utc}`,\n `request_sha256=${requestHash}`,\n `environment=${core.environment}`,\n `project_ref=${core.project_ref}`,\n `account_email=${core.account.email}`,\n `account_user_id=${core.account.user_id}`,\n `target_visibility=${core.target_visibility}`,\n `plan_sha256=${core.plan.plan_sha256}`,\n `operation_id=${core.plan.operation_id}`,\n `plan_file_sha256=${core.plan.plan_file_sha256}`,\n `freeze_file_sha256=${core.freeze_file_sha256}`,\n `freeze_sha256=${core.freeze_sha256}`,\n `alias_plan_request_sha256=${core.sets.alias_plan_request_sha256}`,\n `before_hash_set_sha256=${core.sets.before_hash_set_sha256}`,\n `desired_hash_set_sha256=${core.sets.desired_hash_set_sha256}`,\n `exchange_rewrite_set_sha256=${core.sets.exchange_rewrite_set_sha256}`,\n `support_snapshot_set_sha256=${core.sets.support_snapshot_set_sha256}`,\n `derivative_baseline_set_sha256=${core.sets.derivative_baseline_set_sha256}`,\n `derivative_target_set_sha256=${core.sets.derivative_target_set_sha256}`,\n `toolchain_evidence_sha256=${core.sets.toolchain_evidence_sha256}`,\n `action_count=${core.expected.action_count}`,\n `batch_count=${core.expected.batch_count}`,\n `exchange_count=${core.expected.exchange_count}`,\n `amount_field_count=${core.expected.amount_field_count}`,\n `unrelated_exchange_count=${core.expected.unrelated_exchange_count}`,\n `audit_count=${core.expected.audit_count}`,\n `flowproperty_count=${core.expected.flowproperty_count}`,\n `flow_count=${core.expected.flow_count}`,\n `process_count=${core.expected.process_count}`,\n `derivative_target_count=${core.expected.derivative_target_count}`,\n `state_code_changes=${core.policy.state_code_changes}`,\n `save_draft=${core.policy.save_draft}`,\n `deletes=${core.policy.deletes}`,\n `rebuild_derivatives=${core.policy.rebuild_derivatives}`,\n `unitgroup_actions=${core.policy.unitgroup_actions}`,\n `person_distance_actions=${core.policy.person_distance_actions}`,\n `max_admit_posts=${core.policy.max_admit_posts}`,\n `automatic_retry=${String(core.policy.automatic_retry)}`,\n 'Approve only by returning this text byte-for-byte without edits.',\n '',\n ].join('\\n');\n}\n\nexport function parseProtectedApprovalRequest(\n value: unknown,\n): DatasetMaintenanceProtectedApprovalRequest {\n if (!isJsonObject(value)) fail('Approval request must be an object.');\n exactKeys(\n value,\n [\n 'schema_version',\n 'approved_at_utc',\n 'environment',\n 'project_ref',\n 'account',\n 'target_visibility',\n 'plan',\n 'freeze_file_sha256',\n 'freeze_sha256',\n 'sets',\n 'expected',\n 'policy',\n 'request_sha256',\n 'approval_text',\n 'approval_text_sha256',\n ],\n 'approval_request',\n );\n if (\n value.schema_version !== PROTECTED_PREPARATION_CONTRACT.approval_request_schema \|\|\n value.environment !== 'production' \|\|\n value.target_visibility !== 'owner_draft'\n ) {\n fail('Approval request must be the production owner-draft v1 contract.');\n }\n const core: ProtectedApprovalRequestCore = {\n schema_version: PROTECTED_PREPARATION_CONTRACT.approval_request_schema,\n approved_at_utc: canonicalTimestamp(value.approved_at_utc, 'approved_at_utc'),\n environment: 'production',\n project_ref: token(value.project_ref, 'project_ref'),\n account: account(value.account, 'account'),\n target_visibility: 'owner_draft',\n plan: planBinding(value.plan),\n freeze_file_sha256: hash(value.freeze_file_sha256, 'freeze_file_sha256'),\n freeze_sha256: hash(value.freeze_sha256, 'freeze_sha256'),\n sets: freezeSets(value.sets),\n expected: expectedCounts(value.expected),\n policy: freezePolicy(value.policy),\n };\n const requestSha256 = hash(value.request_sha256, 'request_sha256');\n if (sha256Json(core) !== requestSha256) {\n fail('request_sha256 does not match the canonical approval-request core.');\n }\n const approvalText = exactText(value.approval_text, 'approval_text');\n const expectedText = renderProtectedApprovalText(core, requestSha256);\n if (approvalText !== expectedText) {\n fail('approval_text is not the byte-exact canonical request text.');\n }\n const approvalTextSha256 = hash(value.approval_text_sha256, 'approval_text_sha256');\n if (sha256Text(approvalText) !== approvalTextSha256) {\n fail('approval_text_sha256 does not match the byte-exact approval text.');\n }\n return {\n ...core,\n request_sha256: requestSha256,\n approval_text: approvalText,\n approval_text_sha256: approvalTextSha256,\n };\n}\n\nfunction assertAliasPlanRequest(plan: DatasetMaintenancePlan, value: JsonObject): void {\n if (\n value.schema_version !== 'dataset-alias-plan.v1' \|\|\n value.plan_sha256 !== plan.plan_sha256 \|\|\n value.operation_id !== plan.operation_id \|\|\n value.target_visibility !== 'owner_draft' \|\|\n !Array.isArray(value.batches) \|\|\n value.batches.length !== 2\n ) {\n fail('Alias plan request does not bind the exact owner-draft maintenance plan.');\n }\n const dimensions = ['time', 'length_time'];\n for (const [index, batch] of value.batches.entries()) {\n if (\n !isJsonObject(batch) \|\|\n batch.plan_sha256 !== plan.plan_sha256 \|\|\n batch.operation_id !== plan.operation_id \|\|\n batch.target_visibility !== 'owner_draft' \|\|\n batch.dimension !== dimensions[index]\n ) {\n fail('Alias plan request batches must be exact ordered plan-bound time/length_time batches.');\n }\n }\n}\n\nexport function deriveProtectedDerivativeSnapshotTargets(\n plan: DatasetMaintenancePlan,\n expectedAccount: { user_id: string; email: string },\n): ProtectedDerivativeSnapshotTarget[] {\n const preparedAccount = account(expectedAccount, 'account');\n assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');\n if (\n plan.operation !== 'merge-support-aliases' \|\|\n plan.status !== 'ready' \|\|\n plan.target_mode !== 'owner_draft' \|\|\n plan.blockers.length !== 0 \|\|\n plan.account.user_id !== preparedAccount.user_id \|\|\n plan.account.email !== preparedAccount.email \|\|\n computePlanSha256(plan) !== plan.plan_sha256\n ) {\n fail('Derivative target derivation requires the exact canonical owner-draft plan and account.');\n }\n const actions = plan.actions\n .filter((action) => action.table === 'flows' \|\| action.table === 'processes')\n .sort(\n (left, right) =>\n left.table.localeCompare(right.table) \|\|\n left.id.localeCompare(right.id) \|\|\n left.version.localeCompare(right.version),\n );\n if (\n actions.length !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n actions.filter((action) => action.table === 'flows').length !==\n PROTECTED_EXECUTION_COUNTS.flow_count \|\|\n actions.filter((action) => action.table === 'processes').length !==\n PROTECTED_EXECUTION_COUNTS.process_count \|\|\n actions.some(\n (action) =>\n action.expected_user_id !== preparedAccount.user_id \|\| action.expected_state_code !== 0,\n )\n ) {\n fail('Plan derivative targets must contain exactly 23 owner-draft flows and 27 processes.');\n }\n const targets = actions.map((action) => ({\n table: action.table as 'flows' \| 'processes',\n id: action.id,\n version: action.version,\n user_id: action.expected_user_id,\n state_code: 0 as const,\n }));\n const keys = targets.map((target) => `${target.table}\\u0000${target.id}\\u0000${target.version}`);\n if (new Set(keys).size !== targets.length) {\n fail('Plan derivative targets must not contain duplicate table/id/version identities.');\n }\n return targets;\n}\n\nfunction derivativeTargets(options: {\n plan: DatasetMaintenancePlan;\n account: { user_id: string; email: string };\n snapshots: ProtectedDerivativeSnapshot[];\n}): ProtectedDerivativeTarget[] {\n const actions = deriveProtectedDerivativeSnapshotTargets(options.plan, options.account);\n if (options.snapshots.length !== actions.length) {\n fail('Derivative actions and snapshots must form one exact 50-target set without duplicates.');\n }\n return actions.map((action, index) => {\n const snapshot: unknown = options.snapshots[index];\n if (\n !isJsonObject(snapshot) \|\|\n snapshot.schema_version !== 'dataset-derivative-snapshot.v1' \|\|\n snapshot.table !== action.table \|\|\n snapshot.id !== action.id \|\|\n snapshot.version !== action.version \|\|\n snapshot.user_id !== action.user_id \|\|\n snapshot.state_code !== 0\n ) {\n fail(`Derivative snapshot ${index} does not match the stable target order and identity.`);\n }\n exactKeys(\n snapshot,\n [\n 'schema_version',\n 'table',\n 'id',\n 'version',\n 'user_id',\n 'state_code',\n 'modified_at',\n 'json_sha256',\n 'json_ordered_sha256',\n 'extracted_text_sha256',\n 'extracted_md_sha256',\n 'embedding_ft_sha256',\n 'embedding_ft_at',\n 'snapshot_sha256',\n ],\n `derivativeSnapshots[${index}]`,\n );\n timestamp(snapshot.modified_at, `derivativeSnapshots[${index}].modified_at`);\n const jsonSha256 = hash(snapshot.json_sha256, `derivativeSnapshots[${index}].json_sha256`);\n const jsonOrderedSha256 = hash(\n snapshot.json_ordered_sha256,\n `derivativeSnapshots[${index}].json_ordered_sha256`,\n );\n if (jsonSha256 !== jsonOrderedSha256) {\n fail(`Derivative snapshot ${index} json and json_ordered hashes are inconsistent.`);\n }\n hash(snapshot.extracted_text_sha256, `derivativeSnapshots[${index}].extracted_text_sha256`);\n if (snapshot.extracted_md_sha256 !== null) {\n hash(snapshot.extracted_md_sha256, `derivativeSnapshots[${index}].extracted_md_sha256`);\n }\n if (snapshot.embedding_ft_sha256 !== null) {\n hash(snapshot.embedding_ft_sha256, `derivativeSnapshots[${index}].embedding_ft_sha256`);\n }\n if (snapshot.embedding_ft_at !== null) {\n timestamp(snapshot.embedding_ft_at, `derivativeSnapshots[${index}].embedding_ft_at`);\n }\n const snapshotSha256 = hash(\n snapshot.snapshot_sha256,\n `derivativeSnapshots[${index}].snapshot_sha256`,\n );\n return {\n table: action.table,\n id: action.id,\n version: action.version,\n user_id: action.user_id,\n state_code: 0,\n baseline_snapshot_sha256: snapshotSha256,\n };\n });\n}\n\nexport function buildProtectedFreeze(options: {\n plan: DatasetMaintenancePlan;\n planFileSha256: string;\n aliasPlanRequest: JsonObject;\n projectRef: string;\n account: { user_id: string; email: string };\n toolchainEvidenceSha256: string;\n derivativeSnapshots: ProtectedDerivativeSnapshot[];\n}): BuiltProtectedFreeze {\n const planFileSha256 = hash(options.planFileSha256, 'planFileSha256');\n const toolchainEvidenceSha256 = hash(options.toolchainEvidenceSha256, 'toolchainEvidenceSha256');\n const preparedAccount = account(options.account, 'account');\n assertProtectedPreparationPlanSha256(options.plan.plan_sha256, 'plan.plan_sha256');\n if (\n options.plan.operation !== 'merge-support-aliases' \|\|\n options.plan.status !== 'ready' \|\|\n options.plan.target_mode !== 'owner_draft' \|\|\n options.plan.blockers.length !== 0 \|\|\n options.plan.account.user_id !== preparedAccount.user_id \|\|\n options.plan.account.email !== preparedAccount.email \|\|\n computePlanSha256(options.plan) !== options.plan.plan_sha256\n ) {\n fail('Freeze builder requires the exact canonical ready owner-draft plan and account.');\n }\n assertAliasPlanRequest(options.plan, options.aliasPlanRequest);\n const aliasPlanRequestSha256 = sha256Json(options.aliasPlanRequest);\n const targets = derivativeTargets({\n plan: options.plan,\n account: preparedAccount,\n snapshots: options.derivativeSnapshots,\n });\n const planSets = protectedPlanSetHashes(options.plan);\n const candidate: DatasetMaintenanceProtectedFreeze = {\n schema_version: PROTECTED_EXECUTION_CONTRACT.freeze_schema,\n environment: 'production',\n project_ref: assertProtectedProductionProjectRef(options.projectRef),\n account: preparedAccount,\n target_visibility: 'owner_draft',\n plan: {\n plan_file_sha256: planFileSha256,\n plan_sha256: options.plan.plan_sha256,\n operation_id: options.plan.operation_id,\n },\n sets: {\n ...planSets,\n alias_plan_request_sha256: aliasPlanRequestSha256,\n derivative_baseline_set_sha256: protectedDerivativeBaselineSetSha256(targets),\n toolchain_evidence_sha256: toolchainEvidenceSha256,\n },\n expected: PROTECTED_EXECUTION_COUNTS,\n derivative_targets: targets,\n policy: {\n state_code_changes: 0,\n save_draft: 0,\n deletes: 0,\n rebuild_derivatives: 0,\n unitgroup_actions: 0,\n person_distance_actions: 0,\n max_admit_posts: 1,\n automatic_retry: false,\n },\n freeze_sha256: '',\n };\n candidate.freeze_sha256 = computeProtectedFreezeSha256(candidate);\n const freeze = parseProtectedFreeze(candidate);\n assertProtectedFreezeMatchesPlan({\n plan: options.plan,\n planFileSha256,\n aliasPlanRequestSha256,\n freeze,\n });\n return {\n ...canonicalArtifact(freeze),\n alias_plan_request_sha256: aliasPlanRequestSha256,\n };\n}\n\nexport function buildProtectedApprovalRequest(options: {\n freeze: DatasetMaintenanceProtectedFreeze;\n freezeFileSha256: string;\n approvedAtUtc: string;\n}): BuiltProtectedApprovalRequest {\n const freeze = parseProtectedFreeze(options.freeze);\n const core = approvalRequestCore(freeze, options.freezeFileSha256, options.approvedAtUtc);\n const requestSha256 = sha256Json(core);\n const approvalText = renderProtectedApprovalText(core, requestSha256);\n const request = parseProtectedApprovalRequest({\n ...core,\n request_sha256: requestSha256,\n approval_text: approvalText,\n approval_text_sha256: sha256Text(approvalText),\n });\n return canonicalArtifact(request);\n}\n\nexport function sealProtectedApproval(options: {\n approvalRequest: unknown;\n freeze: DatasetMaintenanceProtectedFreeze;\n freezeFileSha256: string;\n humanApprovalText: string;\n approveRequestSha256: string;\n approveTextSha256: string;\n approvedAtUtc: string;\n confirmAccountEmail: string;\n}): BuiltProtectedApproval {\n const request = parseProtectedApprovalRequest(options.approvalRequest);\n const freeze = parseProtectedFreeze(options.freeze);\n assertProtectedProductionProjectRef(freeze.project_ref);\n const freezeFileSha256 = hash(options.freezeFileSha256, 'freezeFileSha256');\n const approveRequestSha256 = hash(options.approveRequestSha256, 'approveRequestSha256');\n const approveTextSha256 = hash(options.approveTextSha256, 'approveTextSha256');\n const approvedAtUtc = canonicalTimestamp(options.approvedAtUtc, 'approvedAtUtc');\n if (\n options.humanApprovalText !== request.approval_text \|\|\n approveRequestSha256 !== request.request_sha256 \|\|\n approveTextSha256 !== request.approval_text_sha256 \|\|\n options.confirmAccountEmail !== request.account.email \|\|\n approvedAtUtc !== request.approved_at_utc\n ) {\n fail(\n 'Explicit human approval does not match the byte-exact request, hashes, account, or approved timestamp.',\n );\n }\n const expectedCore = approvalRequestCore(freeze, freezeFileSha256, request.approved_at_utc);\n if (sha256Json(expectedCore) !== request.request_sha256) {\n fail('Approval request does not bind the supplied freeze file, plan, account, or toolchain.');\n }\n const approval: DatasetMaintenanceProtectedApproval = {\n schema_version: PROTECTED_EXECUTION_CONTRACT.approval_schema,\n approved_at_utc: request.approved_at_utc,\n environment: 'production',\n project_ref: freeze.project_ref,\n account: freeze.account,\n target_visibility: 'owner_draft',\n plan_sha256: freeze.plan.plan_sha256,\n operation_id: freeze.plan.operation_id,\n plan_file_sha256: freeze.plan.plan_file_sha256,\n freeze_file_sha256: freezeFileSha256,\n freeze_sha256: freeze.freeze_sha256,\n approval_text_sha256: request.approval_text_sha256,\n max_admit_posts: 1,\n automatic_retry: false,\n approval_identity_sha256: '',\n };\n approval.approval_identity_sha256 = computeProtectedApprovalIdentitySha256(approval);\n return canonicalArtifact(parseProtectedApproval(approval));\n}\n"]}
1	+ {"version":3,"file":"dataset-maintenance-protected-preparation.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,GAGf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,EAChC,sCAAsC,EACtC,4BAA4B,EAC5B,sBAAsB,EACtB,oBAAoB,EACpB,oCAAoC,EACpC,sBAAsB,GAKvB,MAAM,6CAA6C,CAAC;AAErD,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,uBAAuB,EAAE,6CAA6C;CAC9D,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG,sBAA+B,CAAC;AAEhF,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;CAC1D,CAAC;AAEX,MAAM,MAAM,GAAG,iBAAiB,CAAC;AA4CjC,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,mDAAmD;QACzD,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,QAA2B,EAAE,KAAa;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,IAAI,CAAC,GAAG,KAAK,0BAA0B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,KAAc,EACd,KAAK,GAAG,aAAa;IAErB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,IAAK,0CAAgE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,GAAG,KAAK,sEAAsE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,gCAAgC,EAAE,CAAC;QACpD,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa;IACvD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC9D,SAAS,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,CAAC;QACjD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1D,SAAS,CAAC,KAAK,EAAE,CAAC,kBAAkB,EAAE,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO;QACL,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;QACvE,WAAW,EAAE,oCAAoC,CAAC,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACxF,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG;QACX,2BAA2B;QAC3B,wBAAwB;QACxB,yBAAyB;QACzB,6BAA6B;QAC7B,6BAA6B;QAC7B,gCAAgC;QAChC,8BAA8B;QAC9B,2BAA2B;KACnB,CAAC;IACX,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CACb,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACrD,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,YAAY,GAAG,eAAe,QAAQ,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG;QACX,oBAAoB;QACpB,YAAY;QACZ,SAAS;QACT,qBAAqB;QACrB,mBAAmB;QACnB,yBAAyB;QACzB,iBAAiB;QACjB,iBAAiB;KACT,CAAC;IACX,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,IACE,KAAK,CAAC,kBAAkB,KAAK,CAAC;QAC9B,KAAK,CAAC,UAAU,KAAK,CAAC;QACtB,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,KAAK,CAAC,mBAAmB,KAAK,CAAC;QAC/B,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAC7B,KAAK,CAAC,uBAAuB,KAAK,CAAC;QACnC,KAAK,CAAC,eAAe,KAAK,CAAC;QAC3B,KAAK,CAAC,eAAe,KAAK,KAAK,EAC/B,CAAC;QACD,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,CAAC;QACrB,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;QACV,mBAAmB,EAAE,CAAC;QACtB,iBAAiB,EAAE,CAAC;QACpB,uBAAuB,EAAE,CAAC;QAC1B,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAI,KAAQ;IACpC,MAAM,iBAAiB,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACvD,OAAO;QACL,KAAK;QACL,mBAAmB,EAAE,iBAAiB;QACtC,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAyC,EACzC,gBAAwB,EACxB,aAAqB;IAErB,oCAAoC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;IACtE,IAAI,gBAAgB,KAAK,iBAAiB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,cAAc,EAAE,8BAA8B,CAAC,uBAAuB;QACtE,eAAe,EAAE,kBAAkB,CAAC,aAAa,EAAE,iBAAiB,CAAC;QACrE,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC;QACpE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,aAAa;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,0BAA0B;QACpC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAkC,EAClC,aAAqB;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC1D,OAAO;QACL,uDAAuD;QACvD,kBAAkB,IAAI,CAAC,cAAc,EAAE;QACvC,mBAAmB,IAAI,CAAC,eAAe,EAAE;QACzC,kBAAkB,WAAW,EAAE;QAC/B,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,eAAe,IAAI,CAAC,WAAW,EAAE;QACjC,iBAAiB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;QACrC,mBAAmB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;QACzC,qBAAqB,IAAI,CAAC,iBAAiB,EAAE;QAC7C,eAAe,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QACtC,gBAAgB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;QACxC,oBAAoB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;QAChD,sBAAsB,IAAI,CAAC,kBAAkB,EAAE;QAC/C,iBAAiB,IAAI,CAAC,aAAa,EAAE;QACrC,6BAA6B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAClE,0BAA0B,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAC5D,2BAA2B,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;QAC9D,+BAA+B,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACtE,+BAA+B,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACtE,kCAAkC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE;QAC5E,gCAAgC,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxE,6BAA6B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE;QAClE,gBAAgB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;QAC5C,eAAe,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC1C,kBAAkB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;QAChD,sBAAsB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE;QACxD,4BAA4B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;QACpE,eAAe,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC1C,sBAAsB,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE;QACxD,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;QACxC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE;QAC9C,2BAA2B,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE;QAClE,sBAAsB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE;QACtD,cAAc,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;QACtC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QAChC,uBAAuB,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE;QACxD,qBAAqB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;QACpD,2BAA2B,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE;QAChE,mBAAmB,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;QAChD,mBAAmB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE;QACxD,kEAAkE;QAClE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACtE,SAAS,CACP,KAAK,EACL;QACE,gBAAgB;QAChB,iBAAiB;QACjB,aAAa;QACb,aAAa;QACb,SAAS;QACT,mBAAmB;QACnB,MAAM;QACN,oBAAoB;QACpB,eAAe;QACf,MAAM;QACN,UAAU;QACV,QAAQ;QACR,gBAAgB;QAChB,eAAe;QACf,sBAAsB;KACvB,EACD,kBAAkB,CACnB,CAAC;IACF,IACE,KAAK,CAAC,cAAc,KAAK,8BAA8B,CAAC,uBAAuB;QAC/E,KAAK,CAAC,WAAW,KAAK,YAAY;QAClC,KAAK,CAAC,iBAAiB,KAAK,aAAa,EACzC,CAAC;QACD,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAiC;QACzC,cAAc,EAAE,8BAA8B,CAAC,uBAAuB;QACtE,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC7E,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;QACpD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;QAC1C,iBAAiB,EAAE,aAAa;QAChC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7B,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QACxE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC;QACzD,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QACxC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;KACnC,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtE,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACpF,IAAI,UAAU,CAAC,YAAY,CAAC,KAAK,kBAAkB,EAAE,CAAC;QACpD,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,aAAa;QAC7B,aAAa,EAAE,YAAY;QAC3B,oBAAoB,EAAE,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA4B,EAAE,KAAiB;IAC7E,IACE,KAAK,CAAC,cAAc,KAAK,uBAAuB;QAChD,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACtC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxC,KAAK,CAAC,iBAAiB,KAAK,aAAa;QACzC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC1B,CAAC;QACD,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IACE,CAAC,YAAY,CAAC,KAAK,CAAC;YACpB,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YACtC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YACxC,KAAK,CAAC,iBAAiB,KAAK,aAAa;YACzC,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC,KAAK,CAAC,EACrC,CAAC;YACD,IAAI,CAAC,uFAAuF,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,IAA4B,EAC5B,eAAmD;IAEnD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC5D,oCAAoC,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC3E,IACE,IAAI,CAAC,SAAS,KAAK,uBAAuB;QAC1C,IAAI,CAAC,MAAM,KAAK,OAAO;QACvB,IAAI,CAAC,WAAW,KAAK,aAAa;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO;QAChD,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;QAC5C,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,EAC5C,CAAC;QACD,IAAI,CAAC,yFAAyF,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;SACzB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC;SAC5E,IAAI,CACH,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC5C,CAAC;IACJ,IACE,OAAO,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB;QACrE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,MAAM;YACzD,0BAA0B,CAAC,UAAU;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM;YAC7D,0BAA0B,CAAC,aAAa;QAC1C,OAAO,CAAC,IAAI,CACV,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,gBAAgB,KAAK,eAAe,CAAC,OAAO,IAAI,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAC1F,EACD,CAAC;QACD,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,KAAK,EAAE,MAAM,CAAC,KAA8B;QAC5C,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,gBAAgB;QAChC,UAAU,EAAE,CAAU;KACvB,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1C,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAI1B;IACC,MAAM,OAAO,GAAG,wCAAwC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAY,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IACE,CAAC,YAAY,CAAC,QAAQ,CAAC;YACvB,QAAQ,CAAC,cAAc,KAAK,gCAAgC;YAC5D,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC/B,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE;YACzB,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACnC,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;YACnC,QAAQ,CAAC,UAAU,KAAK,CAAC,EACzB,CAAC;YACD,IAAI,CAAC,uBAAuB,KAAK,uDAAuD,CAAC,CAAC;QAC5F,CAAC;QACD,SAAS,CACP,QAAQ,EACR;YACE,gBAAgB;YAChB,OAAO;YACP,IAAI;YACJ,SAAS;YACT,SAAS;YACT,YAAY;YACZ,aAAa;YACb,aAAa;YACb,qBAAqB;YACrB,qBAAqB;YACrB,qBAAqB;YACrB,iBAAiB;YACjB,iBAAiB;SAClB,EACD,uBAAuB,KAAK,GAAG,CAChC,CAAC;QACF,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,uBAAuB,KAAK,eAAe,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,uBAAuB,KAAK,eAAe,CAAC,CAAC;QAC3F,MAAM,iBAAiB,GAAG,IAAI,CAC5B,QAAQ,CAAC,mBAAmB,EAC5B,uBAAuB,KAAK,uBAAuB,CACpD,CAAC;QACF,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;YACrC,IAAI,CAAC,uBAAuB,KAAK,iDAAiD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,uBAAuB,KAAK,uBAAuB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,uBAAuB,KAAK,uBAAuB,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACtC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,uBAAuB,KAAK,mBAAmB,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CACzB,QAAQ,CAAC,eAAe,EACxB,uBAAuB,KAAK,mBAAmB,CAChD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,CAAC;YACb,wBAAwB,EAAE,cAAc;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAQpC;IACC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtE,MAAM,uBAAuB,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;IACjG,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,oCAAoC,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IACnF,IACE,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,uBAAuB;QAClD,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO;QAC/B,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,aAAa;QAC1C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO;QACxD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;QACpD,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,EAC5D,CAAC;QACD,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC1F,CAAC;IACD,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,OAAO,CAAC,mBAAmB;KACvC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAsC;QACnD,cAAc,EAAE,4BAA4B,CAAC,aAAa;QAC1D,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,mCAAmC,CAAC,OAAO,CAAC,UAAU,CAAC;QACpE,OAAO,EAAE,eAAe;QACxB,iBAAiB,EAAE,aAAa;QAChC,IAAI,EAAE;YACJ,gBAAgB,EAAE,cAAc;YAChC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;SACxC;QACD,IAAI,EAAE;YACJ,GAAG,QAAQ;YACX,yBAAyB,EAAE,sBAAsB;YACjD,8BAA8B,EAAE,oCAAoC,CAAC,OAAO,CAAC;YAC7E,yBAAyB,EAAE,uBAAuB;SACnD;QACD,QAAQ,EAAE,0BAA0B;QACpC,kBAAkB,EAAE,OAAO;QAC3B,MAAM,EAAE;YACN,kBAAkB,EAAE,CAAC;YACrB,UAAU,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,mBAAmB,EAAE,CAAC;YACtB,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,CAAC;YAC1B,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,KAAK;SACvB;QACD,aAAa,EAAE,EAAE;KAClB,CAAC;IACF,SAAS,CAAC,aAAa,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,gCAAgC,CAAC;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc;QACd,sBAAsB;QACtB,MAAM;KACP,CAAC,CAAC;IACH,OAAO;QACL,GAAG,iBAAiB,CAAC,MAAM,CAAC;QAC5B,yBAAyB,EAAE,sBAAsB;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,2BAA2B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,6BAA6B,CAAC;QAC5C,GAAG,IAAI;QACP,cAAc,EAAE,aAAa;QAC7B,aAAa,EAAE,YAAY;QAC3B,oBAAoB,EAAE,UAAU,CAAC,YAAY,CAAC;KAC/C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OASrC;IACC,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACjF,IACE,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,aAAa;QACnD,oBAAoB,KAAK,OAAO,CAAC,cAAc;QAC/C,iBAAiB,KAAK,OAAO,CAAC,oBAAoB;QAClD,OAAO,CAAC,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK;QACrD,aAAa,KAAK,OAAO,CAAC,eAAe,EACzC,CAAC;QACD,IAAI,CACF,wGAAwG,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5F,IAAI,UAAU,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACxD,IAAI,CAAC,uFAAuF,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAwC;QACpD,cAAc,EAAE,4BAA4B,CAAC,eAAe;QAC5D,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,iBAAiB,EAAE,aAAa;QAChC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;QAC9C,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,KAAK;QACtB,wBAAwB,EAAE,EAAE;KAC7B,CAAC;IACF,QAAQ,CAAC,wBAAwB,GAAG,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACrF,OAAO,iBAAiB,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import { CliError } from './errors.js';\nimport {\n computePlanSha256,\n isJsonObject,\n sha256Json,\n sha256Text,\n stableJsonText,\n type DatasetMaintenancePlan,\n type JsonObject,\n} from './dataset-maintenance-contract.js';\nimport {\n PROTECTED_EXECUTION_CONTRACT,\n PROTECTED_EXECUTION_COUNTS,\n assertProtectedFreezeMatchesPlan,\n computeProtectedApprovalIdentitySha256,\n computeProtectedFreezeSha256,\n parseProtectedApproval,\n parseProtectedFreeze,\n protectedDerivativeBaselineSetSha256,\n protectedPlanSetHashes,\n type DatasetMaintenanceProtectedApproval,\n type DatasetMaintenanceProtectedFreeze,\n type ProtectedDerivativeSnapshot,\n type ProtectedDerivativeTarget,\n} from './dataset-maintenance-protected-contract.js';\n\nexport const PROTECTED_PREPARATION_CONTRACT = {\n approval_request_schema: 'dataset-alias-execution-approval-request.v1',\n} as const;\n\nexport const PROTECTED_PRODUCTION_PROJECT_REF = 'qgzvkongdjqiiamzbbts' as const;\n\nexport const PROTECTED_PREPARATION_REJECTED_PLAN_SHA256 = [\n '813a201ded0443c79639cfbdb8f5a2fad8a8781ef6edd3ec7019e9a45f5f33ce',\n '673331422e8dceeb7975984b07276f057b37e8d6de789d7f030ec29f3be29629',\n '7fdf7e2755599d426e31a9955985d54d5b7cef1adeaa7a10dcc7186353a6c3a8',\n] as const;\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\ntype ProtectedApprovalRequestCore = {\n schema_version: typeof PROTECTED_PREPARATION_CONTRACT.approval_request_schema;\n approved_at_utc: string;\n environment: 'production';\n project_ref: string;\n account: { user_id: string; email: string };\n target_visibility: 'owner_draft';\n plan: DatasetMaintenanceProtectedFreeze['plan'];\n freeze_file_sha256: string;\n freeze_sha256: string;\n sets: DatasetMaintenanceProtectedFreeze['sets'];\n expected: typeof PROTECTED_EXECUTION_COUNTS;\n policy: DatasetMaintenanceProtectedFreeze['policy'];\n};\n\nexport type DatasetMaintenanceProtectedApprovalRequest = ProtectedApprovalRequestCore & {\n request_sha256: string;\n approval_text: string;\n approval_text_sha256: string;\n};\n\nexport type CanonicalProtectedArtifact<T> = {\n value: T;\n canonical_file_text: string;\n file_sha256: string;\n};\n\nexport type BuiltProtectedFreeze = CanonicalProtectedArtifact<DatasetMaintenanceProtectedFreeze> & {\n alias_plan_request_sha256: string;\n};\n\nexport type BuiltProtectedApprovalRequest =\n CanonicalProtectedArtifact<DatasetMaintenanceProtectedApprovalRequest>;\n\nexport type BuiltProtectedApproval =\n CanonicalProtectedArtifact<DatasetMaintenanceProtectedApproval>;\n\nexport type ProtectedDerivativeSnapshotTarget = Omit<\n ProtectedDerivativeTarget,\n 'baseline_snapshot_sha256'\n>;\n\nfunction fail(message: string): never {\n throw new CliError(message, {\n code: 'DATASET_MAINTENANCE_PROTECTED_PREPARATION_INVALID',\n exitCode: 2,\n });\n}\n\nfunction exactKeys(value: JsonObject, expected: readonly string[], label: string): void {\n const actual = Object.keys(value).sort();\n const wanted = [...expected].sort();\n if (actual.length !== wanted.length \|\| actual.some((key, index) => key !== wanted[index])) {\n fail(`${label} must contain exactly: ${wanted.join(', ')}.`);\n }\n}\n\nfunction token(value: unknown, label: string): string {\n if (typeof value !== 'string' \|\| !value \|\| value.trim() !== value) {\n fail(`${label} must be a non-empty canonical string.`);\n }\n return value;\n}\n\nfunction exactText(value: unknown, label: string): string {\n if (typeof value !== 'string' \|\| value.length === 0) {\n fail(`${label} must be a non-empty byte-exact string.`);\n }\n return value;\n}\n\nfunction hash(value: unknown, label: string): string {\n const digest = token(value, label);\n if (!SHA256.test(digest)) fail(`${label} must be a lowercase SHA-256 digest.`);\n return digest;\n}\n\nexport function assertProtectedPreparationPlanSha256(\n value: unknown,\n label = 'plan_sha256',\n): string {\n const digest = hash(value, label);\n if ((PROTECTED_PREPARATION_REJECTED_PLAN_SHA256 as readonly string[]).includes(digest)) {\n fail(`${label} is a historical superseded plan and cannot be prepared or approved.`);\n }\n return digest;\n}\n\nexport function assertProtectedProductionProjectRef(value: unknown): string {\n const projectRef = token(value, 'project_ref');\n if (projectRef !== PROTECTED_PRODUCTION_PROJECT_REF) {\n fail('Protected BAFU preparation and commit are restricted to the production project.');\n }\n return projectRef;\n}\n\nfunction canonicalTimestamp(value: unknown, label: string): string {\n const timestamp = token(value, label);\n const parsed = Date.parse(timestamp);\n if (!Number.isFinite(parsed) \|\| new Date(parsed).toISOString() !== timestamp) {\n fail(`${label} must be a canonical ISO timestamp.`);\n }\n return timestamp;\n}\n\nfunction timestamp(value: unknown, label: string): string {\n const result = token(value, label);\n if (!Number.isFinite(Date.parse(result))) fail(`${label} must be an ISO timestamp.`);\n return result;\n}\n\nfunction account(value: unknown, label: string): { user_id: string; email: string } {\n if (!isJsonObject(value)) fail(`${label} must be an object.`);\n exactKeys(value, ['user_id', 'email'], label);\n return {\n user_id: token(value.user_id, `${label}.user_id`),\n email: token(value.email, `${label}.email`),\n };\n}\n\nfunction planBinding(value: unknown): DatasetMaintenanceProtectedFreeze['plan'] {\n if (!isJsonObject(value)) fail('plan must be an object.');\n exactKeys(value, ['plan_file_sha256', 'plan_sha256', 'operation_id'], 'plan');\n return {\n plan_file_sha256: hash(value.plan_file_sha256, 'plan.plan_file_sha256'),\n plan_sha256: assertProtectedPreparationPlanSha256(value.plan_sha256, 'plan.plan_sha256'),\n operation_id: token(value.operation_id, 'plan.operation_id'),\n };\n}\n\nfunction freezeSets(value: unknown): DatasetMaintenanceProtectedFreeze['sets'] {\n if (!isJsonObject(value)) fail('sets must be an object.');\n const keys = [\n 'alias_plan_request_sha256',\n 'before_hash_set_sha256',\n 'desired_hash_set_sha256',\n 'exchange_rewrite_set_sha256',\n 'support_snapshot_set_sha256',\n 'derivative_baseline_set_sha256',\n 'derivative_target_set_sha256',\n 'toolchain_evidence_sha256',\n ] as const;\n exactKeys(value, keys, 'sets');\n return Object.fromEntries(\n keys.map((key) => [key, hash(value[key], `sets.${key}`)]),\n ) as DatasetMaintenanceProtectedFreeze['sets'];\n}\n\nfunction expectedCounts(value: unknown): typeof PROTECTED_EXECUTION_COUNTS {\n if (!isJsonObject(value)) fail('expected must be an object.');\n const keys = Object.keys(PROTECTED_EXECUTION_COUNTS);\n exactKeys(value, keys, 'expected');\n for (const [key, expected] of Object.entries(PROTECTED_EXECUTION_COUNTS)) {\n if (value[key] !== expected) fail(`expected.${key} must equal ${expected}.`);\n }\n return PROTECTED_EXECUTION_COUNTS;\n}\n\nfunction freezePolicy(value: unknown): DatasetMaintenanceProtectedFreeze['policy'] {\n if (!isJsonObject(value)) fail('policy must be an object.');\n const keys = [\n 'state_code_changes',\n 'save_draft',\n 'deletes',\n 'rebuild_derivatives',\n 'unitgroup_actions',\n 'person_distance_actions',\n 'max_admit_posts',\n 'automatic_retry',\n ] as const;\n exactKeys(value, keys, 'policy');\n if (\n value.state_code_changes !== 0 \|\|\n value.save_draft !== 0 \|\|\n value.deletes !== 0 \|\|\n value.rebuild_derivatives !== 0 \|\|\n value.unitgroup_actions !== 0 \|\|\n value.person_distance_actions !== 0 \|\|\n value.max_admit_posts !== 1 \|\|\n value.automatic_retry !== false\n ) {\n fail('policy must preserve the one-shot owner-draft execution boundary.');\n }\n return {\n state_code_changes: 0,\n save_draft: 0,\n deletes: 0,\n rebuild_derivatives: 0,\n unitgroup_actions: 0,\n person_distance_actions: 0,\n max_admit_posts: 1,\n automatic_retry: false,\n };\n}\n\nfunction canonicalArtifact<T>(value: T): CanonicalProtectedArtifact<T> {\n const canonicalFileText = `${stableJsonText(value)}\\n`;\n return {\n value,\n canonical_file_text: canonicalFileText,\n file_sha256: sha256Text(canonicalFileText),\n };\n}\n\nfunction approvalRequestCore(\n freeze: DatasetMaintenanceProtectedFreeze,\n freezeFileSha256: string,\n approvedAtUtc: string,\n): ProtectedApprovalRequestCore {\n assertProtectedPreparationPlanSha256(freeze.plan.plan_sha256, 'freeze.plan.plan_sha256');\n const freezeFileDigest = hash(freezeFileSha256, 'freeze_file_sha256');\n if (freezeFileDigest !== canonicalArtifact(freeze).file_sha256) {\n fail('freeze_file_sha256 does not match the canonical freeze artifact bytes.');\n }\n return {\n schema_version: PROTECTED_PREPARATION_CONTRACT.approval_request_schema,\n approved_at_utc: canonicalTimestamp(approvedAtUtc, 'approved_at_utc'),\n environment: 'production',\n project_ref: assertProtectedProductionProjectRef(freeze.project_ref),\n account: freeze.account,\n target_visibility: 'owner_draft',\n plan: freeze.plan,\n freeze_file_sha256: freezeFileDigest,\n freeze_sha256: freeze.freeze_sha256,\n sets: freeze.sets,\n expected: PROTECTED_EXECUTION_COUNTS,\n policy: freeze.policy,\n };\n}\n\nexport function renderProtectedApprovalText(\n core: ProtectedApprovalRequestCore,\n requestSha256: string,\n): string {\n const requestHash = hash(requestSha256, 'request_sha256');\n return [\n 'BAFU protected owner-draft execution approval request',\n `schema_version=${core.schema_version}`,\n `approved_at_utc=${core.approved_at_utc}`,\n `request_sha256=${requestHash}`,\n `environment=${core.environment}`,\n `project_ref=${core.project_ref}`,\n `account_email=${core.account.email}`,\n `account_user_id=${core.account.user_id}`,\n `target_visibility=${core.target_visibility}`,\n `plan_sha256=${core.plan.plan_sha256}`,\n `operation_id=${core.plan.operation_id}`,\n `plan_file_sha256=${core.plan.plan_file_sha256}`,\n `freeze_file_sha256=${core.freeze_file_sha256}`,\n `freeze_sha256=${core.freeze_sha256}`,\n `alias_plan_request_sha256=${core.sets.alias_plan_request_sha256}`,\n `before_hash_set_sha256=${core.sets.before_hash_set_sha256}`,\n `desired_hash_set_sha256=${core.sets.desired_hash_set_sha256}`,\n `exchange_rewrite_set_sha256=${core.sets.exchange_rewrite_set_sha256}`,\n `support_snapshot_set_sha256=${core.sets.support_snapshot_set_sha256}`,\n `derivative_baseline_set_sha256=${core.sets.derivative_baseline_set_sha256}`,\n `derivative_target_set_sha256=${core.sets.derivative_target_set_sha256}`,\n `toolchain_evidence_sha256=${core.sets.toolchain_evidence_sha256}`,\n `action_count=${core.expected.action_count}`,\n `batch_count=${core.expected.batch_count}`,\n `exchange_count=${core.expected.exchange_count}`,\n `amount_field_count=${core.expected.amount_field_count}`,\n `unrelated_exchange_count=${core.expected.unrelated_exchange_count}`,\n `audit_count=${core.expected.audit_count}`,\n `flowproperty_count=${core.expected.flowproperty_count}`,\n `flow_count=${core.expected.flow_count}`,\n `process_count=${core.expected.process_count}`,\n `derivative_target_count=${core.expected.derivative_target_count}`,\n `state_code_changes=${core.policy.state_code_changes}`,\n `save_draft=${core.policy.save_draft}`,\n `deletes=${core.policy.deletes}`,\n `rebuild_derivatives=${core.policy.rebuild_derivatives}`,\n `unitgroup_actions=${core.policy.unitgroup_actions}`,\n `person_distance_actions=${core.policy.person_distance_actions}`,\n `max_admit_posts=${core.policy.max_admit_posts}`,\n `automatic_retry=${String(core.policy.automatic_retry)}`,\n 'Approve only by returning this text byte-for-byte without edits.',\n '',\n ].join('\\n');\n}\n\nexport function parseProtectedApprovalRequest(\n value: unknown,\n): DatasetMaintenanceProtectedApprovalRequest {\n if (!isJsonObject(value)) fail('Approval request must be an object.');\n exactKeys(\n value,\n [\n 'schema_version',\n 'approved_at_utc',\n 'environment',\n 'project_ref',\n 'account',\n 'target_visibility',\n 'plan',\n 'freeze_file_sha256',\n 'freeze_sha256',\n 'sets',\n 'expected',\n 'policy',\n 'request_sha256',\n 'approval_text',\n 'approval_text_sha256',\n ],\n 'approval_request',\n );\n if (\n value.schema_version !== PROTECTED_PREPARATION_CONTRACT.approval_request_schema \|\|\n value.environment !== 'production' \|\|\n value.target_visibility !== 'owner_draft'\n ) {\n fail('Approval request must be the production owner-draft v1 contract.');\n }\n const core: ProtectedApprovalRequestCore = {\n schema_version: PROTECTED_PREPARATION_CONTRACT.approval_request_schema,\n approved_at_utc: canonicalTimestamp(value.approved_at_utc, 'approved_at_utc'),\n environment: 'production',\n project_ref: token(value.project_ref, 'project_ref'),\n account: account(value.account, 'account'),\n target_visibility: 'owner_draft',\n plan: planBinding(value.plan),\n freeze_file_sha256: hash(value.freeze_file_sha256, 'freeze_file_sha256'),\n freeze_sha256: hash(value.freeze_sha256, 'freeze_sha256'),\n sets: freezeSets(value.sets),\n expected: expectedCounts(value.expected),\n policy: freezePolicy(value.policy),\n };\n const requestSha256 = hash(value.request_sha256, 'request_sha256');\n if (sha256Json(core) !== requestSha256) {\n fail('request_sha256 does not match the canonical approval-request core.');\n }\n const approvalText = exactText(value.approval_text, 'approval_text');\n const expectedText = renderProtectedApprovalText(core, requestSha256);\n if (approvalText !== expectedText) {\n fail('approval_text is not the byte-exact canonical request text.');\n }\n const approvalTextSha256 = hash(value.approval_text_sha256, 'approval_text_sha256');\n if (sha256Text(approvalText) !== approvalTextSha256) {\n fail('approval_text_sha256 does not match the byte-exact approval text.');\n }\n return {\n ...core,\n request_sha256: requestSha256,\n approval_text: approvalText,\n approval_text_sha256: approvalTextSha256,\n };\n}\n\nfunction assertAliasPlanRequest(plan: DatasetMaintenancePlan, value: JsonObject): void {\n if (\n value.schema_version !== 'dataset-alias-plan.v1' \|\|\n value.plan_sha256 !== plan.plan_sha256 \|\|\n value.operation_id !== plan.operation_id \|\|\n value.target_visibility !== 'owner_draft' \|\|\n !Array.isArray(value.batches) \|\|\n value.batches.length !== 2\n ) {\n fail('Alias plan request does not bind the exact owner-draft maintenance plan.');\n }\n const dimensions = ['time', 'length_time'];\n for (const [index, batch] of value.batches.entries()) {\n if (\n !isJsonObject(batch) \|\|\n batch.plan_sha256 !== plan.plan_sha256 \|\|\n batch.operation_id !== plan.operation_id \|\|\n batch.target_visibility !== 'owner_draft' \|\|\n batch.dimension !== dimensions[index]\n ) {\n fail('Alias plan request batches must be exact ordered plan-bound time/length_time batches.');\n }\n }\n}\n\nexport function deriveProtectedDerivativeSnapshotTargets(\n plan: DatasetMaintenancePlan,\n expectedAccount: { user_id: string; email: string },\n): ProtectedDerivativeSnapshotTarget[] {\n const preparedAccount = account(expectedAccount, 'account');\n assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');\n if (\n plan.operation !== 'merge-support-aliases' \|\|\n plan.status !== 'ready' \|\|\n plan.target_mode !== 'owner_draft' \|\|\n plan.blockers.length !== 0 \|\|\n plan.account.user_id !== preparedAccount.user_id \|\|\n plan.account.email !== preparedAccount.email \|\|\n computePlanSha256(plan) !== plan.plan_sha256\n ) {\n fail('Derivative target derivation requires the exact canonical owner-draft plan and account.');\n }\n const actions = plan.actions\n .filter((action) => action.table === 'flows' \|\| action.table === 'processes')\n .sort(\n (left, right) =>\n left.table.localeCompare(right.table) \|\|\n left.id.localeCompare(right.id) \|\|\n left.version.localeCompare(right.version),\n );\n if (\n actions.length !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n actions.filter((action) => action.table === 'flows').length !==\n PROTECTED_EXECUTION_COUNTS.flow_count \|\|\n actions.filter((action) => action.table === 'processes').length !==\n PROTECTED_EXECUTION_COUNTS.process_count \|\|\n actions.some(\n (action) =>\n action.expected_user_id !== preparedAccount.user_id \|\| action.expected_state_code !== 0,\n )\n ) {\n fail('Plan derivative targets must contain exactly 23 owner-draft flows and 27 processes.');\n }\n const targets = actions.map((action) => ({\n table: action.table as 'flows' \| 'processes',\n id: action.id,\n version: action.version,\n user_id: action.expected_user_id,\n state_code: 0 as const,\n }));\n const keys = targets.map((target) => `${target.table}\\u0000${target.id}\\u0000${target.version}`);\n if (new Set(keys).size !== targets.length) {\n fail('Plan derivative targets must not contain duplicate table/id/version identities.');\n }\n return targets;\n}\n\nfunction derivativeTargets(options: {\n plan: DatasetMaintenancePlan;\n account: { user_id: string; email: string };\n snapshots: ProtectedDerivativeSnapshot[];\n}): ProtectedDerivativeTarget[] {\n const actions = deriveProtectedDerivativeSnapshotTargets(options.plan, options.account);\n if (options.snapshots.length !== actions.length) {\n fail('Derivative actions and snapshots must form one exact 50-target set without duplicates.');\n }\n return actions.map((action, index) => {\n const snapshot: unknown = options.snapshots[index];\n if (\n !isJsonObject(snapshot) \|\|\n snapshot.schema_version !== 'dataset-derivative-snapshot.v1' \|\|\n snapshot.table !== action.table \|\|\n snapshot.id !== action.id \|\|\n snapshot.version !== action.version \|\|\n snapshot.user_id !== action.user_id \|\|\n snapshot.state_code !== 0\n ) {\n fail(`Derivative snapshot ${index} does not match the stable target order and identity.`);\n }\n exactKeys(\n snapshot,\n [\n 'schema_version',\n 'table',\n 'id',\n 'version',\n 'user_id',\n 'state_code',\n 'modified_at',\n 'json_sha256',\n 'json_ordered_sha256',\n 'extracted_md_sha256',\n 'embedding_ft_sha256',\n 'embedding_ft_at',\n 'snapshot_sha256',\n ],\n `derivativeSnapshots[${index}]`,\n );\n timestamp(snapshot.modified_at, `derivativeSnapshots[${index}].modified_at`);\n const jsonSha256 = hash(snapshot.json_sha256, `derivativeSnapshots[${index}].json_sha256`);\n const jsonOrderedSha256 = hash(\n snapshot.json_ordered_sha256,\n `derivativeSnapshots[${index}].json_ordered_sha256`,\n );\n if (jsonSha256 !== jsonOrderedSha256) {\n fail(`Derivative snapshot ${index} json and json_ordered hashes are inconsistent.`);\n }\n if (snapshot.extracted_md_sha256 !== null) {\n hash(snapshot.extracted_md_sha256, `derivativeSnapshots[${index}].extracted_md_sha256`);\n }\n if (snapshot.embedding_ft_sha256 !== null) {\n hash(snapshot.embedding_ft_sha256, `derivativeSnapshots[${index}].embedding_ft_sha256`);\n }\n if (snapshot.embedding_ft_at !== null) {\n timestamp(snapshot.embedding_ft_at, `derivativeSnapshots[${index}].embedding_ft_at`);\n }\n const snapshotSha256 = hash(\n snapshot.snapshot_sha256,\n `derivativeSnapshots[${index}].snapshot_sha256`,\n );\n return {\n table: action.table,\n id: action.id,\n version: action.version,\n user_id: action.user_id,\n state_code: 0,\n baseline_snapshot_sha256: snapshotSha256,\n };\n });\n}\n\nexport function buildProtectedFreeze(options: {\n plan: DatasetMaintenancePlan;\n planFileSha256: string;\n aliasPlanRequest: JsonObject;\n projectRef: string;\n account: { user_id: string; email: string };\n toolchainEvidenceSha256: string;\n derivativeSnapshots: ProtectedDerivativeSnapshot[];\n}): BuiltProtectedFreeze {\n const planFileSha256 = hash(options.planFileSha256, 'planFileSha256');\n const toolchainEvidenceSha256 = hash(options.toolchainEvidenceSha256, 'toolchainEvidenceSha256');\n const preparedAccount = account(options.account, 'account');\n assertProtectedPreparationPlanSha256(options.plan.plan_sha256, 'plan.plan_sha256');\n if (\n options.plan.operation !== 'merge-support-aliases' \|\|\n options.plan.status !== 'ready' \|\|\n options.plan.target_mode !== 'owner_draft' \|\|\n options.plan.blockers.length !== 0 \|\|\n options.plan.account.user_id !== preparedAccount.user_id \|\|\n options.plan.account.email !== preparedAccount.email \|\|\n computePlanSha256(options.plan) !== options.plan.plan_sha256\n ) {\n fail('Freeze builder requires the exact canonical ready owner-draft plan and account.');\n }\n assertAliasPlanRequest(options.plan, options.aliasPlanRequest);\n const aliasPlanRequestSha256 = sha256Json(options.aliasPlanRequest);\n const targets = derivativeTargets({\n plan: options.plan,\n account: preparedAccount,\n snapshots: options.derivativeSnapshots,\n });\n const planSets = protectedPlanSetHashes(options.plan);\n const candidate: DatasetMaintenanceProtectedFreeze = {\n schema_version: PROTECTED_EXECUTION_CONTRACT.freeze_schema,\n environment: 'production',\n project_ref: assertProtectedProductionProjectRef(options.projectRef),\n account: preparedAccount,\n target_visibility: 'owner_draft',\n plan: {\n plan_file_sha256: planFileSha256,\n plan_sha256: options.plan.plan_sha256,\n operation_id: options.plan.operation_id,\n },\n sets: {\n ...planSets,\n alias_plan_request_sha256: aliasPlanRequestSha256,\n derivative_baseline_set_sha256: protectedDerivativeBaselineSetSha256(targets),\n toolchain_evidence_sha256: toolchainEvidenceSha256,\n },\n expected: PROTECTED_EXECUTION_COUNTS,\n derivative_targets: targets,\n policy: {\n state_code_changes: 0,\n save_draft: 0,\n deletes: 0,\n rebuild_derivatives: 0,\n unitgroup_actions: 0,\n person_distance_actions: 0,\n max_admit_posts: 1,\n automatic_retry: false,\n },\n freeze_sha256: '',\n };\n candidate.freeze_sha256 = computeProtectedFreezeSha256(candidate);\n const freeze = parseProtectedFreeze(candidate);\n assertProtectedFreezeMatchesPlan({\n plan: options.plan,\n planFileSha256,\n aliasPlanRequestSha256,\n freeze,\n });\n return {\n ...canonicalArtifact(freeze),\n alias_plan_request_sha256: aliasPlanRequestSha256,\n };\n}\n\nexport function buildProtectedApprovalRequest(options: {\n freeze: DatasetMaintenanceProtectedFreeze;\n freezeFileSha256: string;\n approvedAtUtc: string;\n}): BuiltProtectedApprovalRequest {\n const freeze = parseProtectedFreeze(options.freeze);\n const core = approvalRequestCore(freeze, options.freezeFileSha256, options.approvedAtUtc);\n const requestSha256 = sha256Json(core);\n const approvalText = renderProtectedApprovalText(core, requestSha256);\n const request = parseProtectedApprovalRequest({\n ...core,\n request_sha256: requestSha256,\n approval_text: approvalText,\n approval_text_sha256: sha256Text(approvalText),\n });\n return canonicalArtifact(request);\n}\n\nexport function sealProtectedApproval(options: {\n approvalRequest: unknown;\n freeze: DatasetMaintenanceProtectedFreeze;\n freezeFileSha256: string;\n humanApprovalText: string;\n approveRequestSha256: string;\n approveTextSha256: string;\n approvedAtUtc: string;\n confirmAccountEmail: string;\n}): BuiltProtectedApproval {\n const request = parseProtectedApprovalRequest(options.approvalRequest);\n const freeze = parseProtectedFreeze(options.freeze);\n assertProtectedProductionProjectRef(freeze.project_ref);\n const freezeFileSha256 = hash(options.freezeFileSha256, 'freezeFileSha256');\n const approveRequestSha256 = hash(options.approveRequestSha256, 'approveRequestSha256');\n const approveTextSha256 = hash(options.approveTextSha256, 'approveTextSha256');\n const approvedAtUtc = canonicalTimestamp(options.approvedAtUtc, 'approvedAtUtc');\n if (\n options.humanApprovalText !== request.approval_text \|\|\n approveRequestSha256 !== request.request_sha256 \|\|\n approveTextSha256 !== request.approval_text_sha256 \|\|\n options.confirmAccountEmail !== request.account.email \|\|\n approvedAtUtc !== request.approved_at_utc\n ) {\n fail(\n 'Explicit human approval does not match the byte-exact request, hashes, account, or approved timestamp.',\n );\n }\n const expectedCore = approvalRequestCore(freeze, freezeFileSha256, request.approved_at_utc);\n if (sha256Json(expectedCore) !== request.request_sha256) {\n fail('Approval request does not bind the supplied freeze file, plan, account, or toolchain.');\n }\n const approval: DatasetMaintenanceProtectedApproval = {\n schema_version: PROTECTED_EXECUTION_CONTRACT.approval_schema,\n approved_at_utc: request.approved_at_utc,\n environment: 'production',\n project_ref: freeze.project_ref,\n account: freeze.account,\n target_visibility: 'owner_draft',\n plan_sha256: freeze.plan.plan_sha256,\n operation_id: freeze.plan.operation_id,\n plan_file_sha256: freeze.plan.plan_file_sha256,\n freeze_file_sha256: freezeFileSha256,\n freeze_sha256: freeze.freeze_sha256,\n approval_text_sha256: request.approval_text_sha256,\n max_admit_posts: 1,\n automatic_retry: false,\n approval_identity_sha256: '',\n };\n approval.approval_identity_sha256 = computeProtectedApprovalIdentitySha256(approval);\n return canonicalArtifact(parseProtectedApproval(approval));\n}\n"]}

package/dist/src/lib/dataset-maintenance-protected-seal.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"dataset-maintenance-protected-seal.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-seal.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6CAA6C,EAC7C,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,mBAAmB,EAAE,8BAA8B;IACnD,QAAQ,EAAE,yBAAyB;IACnC,MAAM,EAAE,qCAAqC;CACrC,CAAC;AAsEX,MAAM,yBAAyB,GAA8B;IAC3D,QAAQ,EAAE,yBAAyB;IACnC,QAAQ,EAAE,yBAAyB;IACnC,WAAW,EAAE,oBAAoB;IACjC,oBAAoB,EAAE,6BAA6B;IACnD,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,yBAAyB;IACpC,oBAAoB,EAAE,6CAA6C;CACpE,CAAC;AAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,wCAAwC,EAAE;YACnE,IAAI,EAAE,kDAAkD;YACxD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,sCAAsC,EAAE;YACjE,IAAI,EAAE,kDAAkD;YACxD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,2BAA2B,CAAC,OAIpC;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,iDAAiD,EAAE;YACpF,IAAI,EAAE,iDAAiD;YACvD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACrE,GAAG;QACH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1B,CAAC,CAC2D,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,OAAuD,EACvD,eAA0C,yBAAyB;IAEnE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,mBAAmB,GAAG,aAAa,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC9F,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC;QAC3C,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9D,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,2BAA2B,CAAC;QAC1B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,iBAAiB,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,qEAAqE,EAAE;YACxF,IAAI,EAAE,oDAAoD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC;QAC5C,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzE,2BAA2B,CAAC;QAC1B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC;QACzC,eAAe,EAAE,OAAO;QACxB,MAAM;QACN,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,iBAAiB,EAAE,aAAa,CAAC,IAAI;QACrC,oBAAoB,EAAE,cAAc;QACpC,iBAAiB,EAAE,WAAW;QAC9B,aAAa;QACb,mBAAmB,EAAE,OAAO;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAkD;QAC5D,cAAc,EAAE,iDAAiD;QACjE,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC3D,yBAAyB,EAAE,aAAa;QACxC,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,KAAK;QAC1B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACtC,kBAAkB,EAAE,cAAc,CAAC,WAAW;QAC9C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,4BAA4B,EAAE,eAAe,CAAC,WAAW;QACzD,uBAAuB,EAAE,OAAO,CAAC,cAAc;QAC/C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,oBAAoB,EAAE,QAAQ,CAAC,WAAW;QAC1C,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,wBAAwB;QACjE,UAAU,EAAE;YACV,qBAAqB,EAAE,IAAI;YAC3B,yBAAyB,EAAE,IAAI;YAC/B,qBAAqB,EAAE,IAAI;YAC3B,kBAAkB,EAAE,IAAI;YACxB,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;SACnB;QACD,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE;YACf,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC;YACnD,QAAQ,EAAE,QAAQ,CAAC,WAAW;YAC9B,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IACF,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAChD,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACxE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACvE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,yBAAyB;IACzB,aAAa;IACb,2BAA2B;IAC3B,YAAY;IACZ,aAAa;CACd,CAAC","sourcesContent":["import path from 'node:path';\nimport {\n readProtectedJsonArtifact,\n readProtectedTextArtifact,\n materializePrivateArtifactDirectoryAtomically,\n writePrivateImmutableJson,\n writePrivateImmutableText,\n} from './dataset-maintenance-protected-artifacts.js';\nimport { sha256Text, stableJsonText } from './dataset-maintenance-contract.js';\nimport { parseProtectedFreeze } from './dataset-maintenance-protected-contract.js';\nimport {\n assertProtectedProductionProjectRef,\n parseProtectedApprovalRequest,\n sealProtectedApproval,\n} from './dataset-maintenance-protected-preparation.js';\nimport { CliError } from './errors.js';\n\nexport const PROTECTED_APPROVAL_SEAL_ARTIFACTS = {\n human_approval_text: 'protected-human-approval.txt',\n approval: 'protected-approval.json',\n report: 'protected-approval-seal-report.json',\n} as const;\n\nexport type SealDatasetMaintenanceProtectedApprovalOptions = {\n freezePath: string;\n approvalRequestPath: string;\n humanApprovalPath: string;\n outDir: string;\n approveFreezeFile: string;\n approveRequest: string;\n approveText: string;\n confirm: string;\n approvedAtUtc: string;\n now?: Date;\n};\n\nexport type DatasetMaintenanceProtectedApprovalSealReport = {\n schema_version: 'dataset-alias-protected-approval-seal-report.v1';\n generated_at_utc: string;\n approval_authority_at_utc: string;\n status: 'sealed';\n execution_submitted: false;\n environment: 'production';\n project_ref: string;\n account: { user_id: string; email: string };\n plan_sha256: string;\n operation_id: string;\n freeze_file_sha256: string;\n freeze_sha256: string;\n approval_request_file_sha256: string;\n approval_request_sha256: string;\n approval_text_sha256: string;\n approval_file_sha256: string;\n approval_identity_sha256: string;\n assertions: {\n byte_exact_human_text: true;\n explicit_freeze_file_hash: true;\n explicit_request_hash: true;\n explicit_text_hash: true;\n explicit_account_confirmation: true;\n authentication_calls: 0;\n network_calls: 0;\n database_calls: 0;\n preflight_calls: 0;\n gate_calls: 0;\n admission_calls: 0;\n execution_calls: 0;\n };\n artifacts: {\n human_approval_text: string;\n approval: string;\n report: string;\n };\n artifact_sha256: {\n human_approval_text: string;\n approval: string;\n report: null;\n };\n};\n\ntype SealProtectedDependencies = {\n readJson: typeof readProtectedJsonArtifact;\n readText: typeof readProtectedTextArtifact;\n parseFreeze: typeof parseProtectedFreeze;\n parseApprovalRequest: typeof parseProtectedApprovalRequest;\n sealApproval: typeof sealProtectedApproval;\n writeJson: typeof writePrivateImmutableJson;\n writeText: typeof writePrivateImmutableText;\n materializeArtifacts: typeof materializePrivateArtifactDirectoryAtomically;\n};\n\nconst DEFAULT_SEAL_DEPENDENCIES: SealProtectedDependencies = {\n readJson: readProtectedJsonArtifact,\n readText: readProtectedTextArtifact,\n parseFreeze: parseProtectedFreeze,\n parseApprovalRequest: parseProtectedApprovalRequest,\n sealApproval: sealProtectedApproval,\n writeJson: writePrivateImmutableJson,\n writeText: writePrivateImmutableText,\n materializeArtifacts: materializePrivateArtifactDirectoryAtomically,\n};\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nfunction requiredToken(value: string, label: string): string {\n if (!value \|\| value.trim() !== value) {\n throw new CliError(`${label} must be a non-empty canonical string.`, {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',\n exitCode: 2,\n });\n }\n return value;\n}\n\nfunction requiredHash(value: string, label: string): string {\n const token = requiredToken(value, label);\n if (!SHA256.test(token)) {\n throw new CliError(`${label} must be a lowercase SHA-256 digest.`, {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',\n exitCode: 2,\n });\n }\n return token;\n}\n\nfunction assertCanonicalJsonArtifact(options: {\n label: string;\n text: string;\n value: unknown;\n}): void {\n if (options.text !== `${stableJsonText(options.value)}\\n`) {\n throw new CliError(`${options.label} must be canonical JSON with one final newline.`, {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_NONCANONICAL',\n exitCode: 2,\n });\n }\n}\n\nfunction artifactPaths(outDir: string): DatasetMaintenanceProtectedApprovalSealReport['artifacts'] {\n const resolved = path.resolve(outDir);\n return Object.fromEntries(\n Object.entries(PROTECTED_APPROVAL_SEAL_ARTIFACTS).map(([key, name]) => [\n key,\n path.join(resolved, name),\n ]),\n ) as DatasetMaintenanceProtectedApprovalSealReport['artifacts'];\n}\n\nexport async function sealDatasetMaintenanceProtectedApproval(\n options: SealDatasetMaintenanceProtectedApprovalOptions,\n dependencies: SealProtectedDependencies = DEFAULT_SEAL_DEPENDENCIES,\n): Promise<DatasetMaintenanceProtectedApprovalSealReport> {\n const freezePath = requiredToken(options.freezePath, 'freezePath');\n const approvalRequestPath = requiredToken(options.approvalRequestPath, 'approvalRequestPath');\n const humanApprovalPath = requiredToken(options.humanApprovalPath, 'humanApprovalPath');\n const outDir = requiredToken(options.outDir, 'outDir');\n const approveFreezeFile = requiredHash(options.approveFreezeFile, 'approveFreezeFile');\n const approveRequest = requiredHash(options.approveRequest, 'approveRequest');\n const approveText = requiredHash(options.approveText, 'approveText');\n const confirm = requiredToken(options.confirm, 'confirm');\n const approvedAtUtc = requiredToken(options.approvedAtUtc, 'approvedAtUtc');\n\n const freezeArtifact = dependencies.readJson({\n filePath: freezePath,\n label: 'Protected execution freeze',\n });\n const freeze = dependencies.parseFreeze(freezeArtifact.value);\n assertProtectedProductionProjectRef(freeze.project_ref);\n assertCanonicalJsonArtifact({\n label: 'Protected execution freeze',\n text: freezeArtifact.text,\n value: freeze,\n });\n if (approveFreezeFile !== freezeArtifact.file_sha256) {\n throw new CliError('Explicit freeze file hash does not match the supplied freeze bytes.', {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_FREEZE_MISMATCH',\n exitCode: 1,\n });\n }\n\n const requestArtifact = dependencies.readJson({\n filePath: approvalRequestPath,\n label: 'Protected approval request',\n });\n const request = dependencies.parseApprovalRequest(requestArtifact.value);\n assertCanonicalJsonArtifact({\n label: 'Protected approval request',\n text: requestArtifact.text,\n value: request,\n });\n const humanApproval = dependencies.readText(humanApprovalPath);\n const approval = dependencies.sealApproval({\n approvalRequest: request,\n freeze,\n freezeFileSha256: freezeArtifact.file_sha256,\n humanApprovalText: humanApproval.text,\n approveRequestSha256: approveRequest,\n approveTextSha256: approveText,\n approvedAtUtc,\n confirmAccountEmail: confirm,\n });\n const paths = artifactPaths(outDir);\n const report: DatasetMaintenanceProtectedApprovalSealReport = {\n schema_version: 'dataset-alias-protected-approval-seal-report.v1',\n generated_at_utc: (options.now ?? new Date()).toISOString(),\n approval_authority_at_utc: approvedAtUtc,\n status: 'sealed',\n execution_submitted: false,\n environment: 'production',\n project_ref: freeze.project_ref,\n account: freeze.account,\n plan_sha256: freeze.plan.plan_sha256,\n operation_id: freeze.plan.operation_id,\n freeze_file_sha256: freezeArtifact.file_sha256,\n freeze_sha256: freeze.freeze_sha256,\n approval_request_file_sha256: requestArtifact.file_sha256,\n approval_request_sha256: request.request_sha256,\n approval_text_sha256: request.approval_text_sha256,\n approval_file_sha256: approval.file_sha256,\n approval_identity_sha256: approval.value.approval_identity_sha256,\n assertions: {\n byte_exact_human_text: true,\n explicit_freeze_file_hash: true,\n explicit_request_hash: true,\n explicit_text_hash: true,\n explicit_account_confirmation: true,\n authentication_calls: 0,\n network_calls: 0,\n database_calls: 0,\n preflight_calls: 0,\n gate_calls: 0,\n admission_calls: 0,\n execution_calls: 0,\n },\n artifacts: paths,\n artifact_sha256: {\n human_approval_text: sha256Text(humanApproval.text),\n approval: approval.file_sha256,\n report: null,\n },\n };\n dependencies.materializeArtifacts(outDir, (stagingDirectory) => {\n const staging = artifactPaths(stagingDirectory);\n dependencies.writeText(staging.human_approval_text, humanApproval.text);\n dependencies.writeText(staging.approval, approval.canonical_file_text);\n dependencies.writeJson(staging.report, report);\n });\n return report;\n}\n\nexport const __testInternals = {\n DEFAULT_SEAL_DEPENDENCIES,\n artifactPaths,\n assertCanonicalJsonArtifact,\n requiredHash,\n requiredToken,\n};\n"]}
1	+ {"version":3,"file":"dataset-maintenance-protected-seal.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-seal.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6CAA6C,EAC7C,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EACL,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,gDAAgD,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,mBAAmB,EAAE,8BAA8B;IACnD,QAAQ,EAAE,yBAAyB;IACnC,MAAM,EAAE,qCAAqC;CACrC,CAAC;AAsEX,MAAM,yBAAyB,GAA8B;IAC3D,QAAQ,EAAE,yBAAyB;IACnC,QAAQ,EAAE,yBAAyB;IACnC,WAAW,EAAE,oBAAoB;IACjC,oBAAoB,EAAE,6BAA6B;IACnD,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,yBAAyB;IACpC,oBAAoB,EAAE,6CAA6C;CACpE,CAAC;AAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,wCAAwC,EAAE;YACnE,IAAI,EAAE,kDAAkD;YACxD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,sCAAsC,EAAE;YACjE,IAAI,EAAE,kDAAkD;YACxD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,2BAA2B,CAAC,OAIpC;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,iDAAiD,EAAE;YACpF,IAAI,EAAE,iDAAiD;YACvD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACrE,GAAG;QACH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC1B,CAAC,CAC2D,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,OAAuD,EACvD,YAAY,GAA8B,yBAAyB;IAEnE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,mBAAmB,GAAG,aAAa,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC9F,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAE5E,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC;QAC3C,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9D,mCAAmC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,2BAA2B,CAAC;QAC1B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,iBAAiB,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,qEAAqE,EAAE;YACxF,IAAI,EAAE,oDAAoD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC;QAC5C,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,YAAY,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzE,2BAA2B,CAAC;QAC1B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC;QACzC,eAAe,EAAE,OAAO;QACxB,MAAM;QACN,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,iBAAiB,EAAE,aAAa,CAAC,IAAI;QACrC,oBAAoB,EAAE,cAAc;QACpC,iBAAiB,EAAE,WAAW;QAC9B,aAAa;QACb,mBAAmB,EAAE,OAAO;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAkD;QAC5D,cAAc,EAAE,iDAAiD;QACjE,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC3D,yBAAyB,EAAE,aAAa;QACxC,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,KAAK;QAC1B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;QACtC,kBAAkB,EAAE,cAAc,CAAC,WAAW;QAC9C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,4BAA4B,EAAE,eAAe,CAAC,WAAW;QACzD,uBAAuB,EAAE,OAAO,CAAC,cAAc;QAC/C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,oBAAoB,EAAE,QAAQ,CAAC,WAAW;QAC1C,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,wBAAwB;QACjE,UAAU,EAAE;YACV,qBAAqB,EAAE,IAAI;YAC3B,yBAAyB,EAAE,IAAI;YAC/B,qBAAqB,EAAE,IAAI;YAC3B,kBAAkB,EAAE,IAAI;YACxB,6BAA6B,EAAE,IAAI;YACnC,oBAAoB,EAAE,CAAC;YACvB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;YACjB,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;SACnB;QACD,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE;YACf,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC;YACnD,QAAQ,EAAE,QAAQ,CAAC,WAAW;YAC9B,MAAM,EAAE,IAAI;SACb;KACF,CAAC;IACF,YAAY,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAChD,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QACxE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACvE,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,yBAAyB;IACzB,aAAa;IACb,2BAA2B;IAC3B,YAAY;IACZ,aAAa;CACd,CAAC","sourcesContent":["import path from 'node:path';\nimport {\n readProtectedJsonArtifact,\n readProtectedTextArtifact,\n materializePrivateArtifactDirectoryAtomically,\n writePrivateImmutableJson,\n writePrivateImmutableText,\n} from './dataset-maintenance-protected-artifacts.js';\nimport { sha256Text, stableJsonText } from './dataset-maintenance-contract.js';\nimport { parseProtectedFreeze } from './dataset-maintenance-protected-contract.js';\nimport {\n assertProtectedProductionProjectRef,\n parseProtectedApprovalRequest,\n sealProtectedApproval,\n} from './dataset-maintenance-protected-preparation.js';\nimport { CliError } from './errors.js';\n\nexport const PROTECTED_APPROVAL_SEAL_ARTIFACTS = {\n human_approval_text: 'protected-human-approval.txt',\n approval: 'protected-approval.json',\n report: 'protected-approval-seal-report.json',\n} as const;\n\nexport type SealDatasetMaintenanceProtectedApprovalOptions = {\n freezePath: string;\n approvalRequestPath: string;\n humanApprovalPath: string;\n outDir: string;\n approveFreezeFile: string;\n approveRequest: string;\n approveText: string;\n confirm: string;\n approvedAtUtc: string;\n now?: Date;\n};\n\nexport type DatasetMaintenanceProtectedApprovalSealReport = {\n schema_version: 'dataset-alias-protected-approval-seal-report.v1';\n generated_at_utc: string;\n approval_authority_at_utc: string;\n status: 'sealed';\n execution_submitted: false;\n environment: 'production';\n project_ref: string;\n account: { user_id: string; email: string };\n plan_sha256: string;\n operation_id: string;\n freeze_file_sha256: string;\n freeze_sha256: string;\n approval_request_file_sha256: string;\n approval_request_sha256: string;\n approval_text_sha256: string;\n approval_file_sha256: string;\n approval_identity_sha256: string;\n assertions: {\n byte_exact_human_text: true;\n explicit_freeze_file_hash: true;\n explicit_request_hash: true;\n explicit_text_hash: true;\n explicit_account_confirmation: true;\n authentication_calls: 0;\n network_calls: 0;\n database_calls: 0;\n preflight_calls: 0;\n gate_calls: 0;\n admission_calls: 0;\n execution_calls: 0;\n };\n artifacts: {\n human_approval_text: string;\n approval: string;\n report: string;\n };\n artifact_sha256: {\n human_approval_text: string;\n approval: string;\n report: null;\n };\n};\n\ntype SealProtectedDependencies = {\n readJson: typeof readProtectedJsonArtifact;\n readText: typeof readProtectedTextArtifact;\n parseFreeze: typeof parseProtectedFreeze;\n parseApprovalRequest: typeof parseProtectedApprovalRequest;\n sealApproval: typeof sealProtectedApproval;\n writeJson: typeof writePrivateImmutableJson;\n writeText: typeof writePrivateImmutableText;\n materializeArtifacts: typeof materializePrivateArtifactDirectoryAtomically;\n};\n\nconst DEFAULT_SEAL_DEPENDENCIES: SealProtectedDependencies = {\n readJson: readProtectedJsonArtifact,\n readText: readProtectedTextArtifact,\n parseFreeze: parseProtectedFreeze,\n parseApprovalRequest: parseProtectedApprovalRequest,\n sealApproval: sealProtectedApproval,\n writeJson: writePrivateImmutableJson,\n writeText: writePrivateImmutableText,\n materializeArtifacts: materializePrivateArtifactDirectoryAtomically,\n};\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nfunction requiredToken(value: string, label: string): string {\n if (!value \|\| value.trim() !== value) {\n throw new CliError(`${label} must be a non-empty canonical string.`, {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',\n exitCode: 2,\n });\n }\n return value;\n}\n\nfunction requiredHash(value: string, label: string): string {\n const token = requiredToken(value, label);\n if (!SHA256.test(token)) {\n throw new CliError(`${label} must be a lowercase SHA-256 digest.`, {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_INPUT_INVALID',\n exitCode: 2,\n });\n }\n return token;\n}\n\nfunction assertCanonicalJsonArtifact(options: {\n label: string;\n text: string;\n value: unknown;\n}): void {\n if (options.text !== `${stableJsonText(options.value)}\\n`) {\n throw new CliError(`${options.label} must be canonical JSON with one final newline.`, {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_NONCANONICAL',\n exitCode: 2,\n });\n }\n}\n\nfunction artifactPaths(outDir: string): DatasetMaintenanceProtectedApprovalSealReport['artifacts'] {\n const resolved = path.resolve(outDir);\n return Object.fromEntries(\n Object.entries(PROTECTED_APPROVAL_SEAL_ARTIFACTS).map(([key, name]) => [\n key,\n path.join(resolved, name),\n ]),\n ) as DatasetMaintenanceProtectedApprovalSealReport['artifacts'];\n}\n\nexport async function sealDatasetMaintenanceProtectedApproval(\n options: SealDatasetMaintenanceProtectedApprovalOptions,\n dependencies: SealProtectedDependencies = DEFAULT_SEAL_DEPENDENCIES,\n): Promise<DatasetMaintenanceProtectedApprovalSealReport> {\n const freezePath = requiredToken(options.freezePath, 'freezePath');\n const approvalRequestPath = requiredToken(options.approvalRequestPath, 'approvalRequestPath');\n const humanApprovalPath = requiredToken(options.humanApprovalPath, 'humanApprovalPath');\n const outDir = requiredToken(options.outDir, 'outDir');\n const approveFreezeFile = requiredHash(options.approveFreezeFile, 'approveFreezeFile');\n const approveRequest = requiredHash(options.approveRequest, 'approveRequest');\n const approveText = requiredHash(options.approveText, 'approveText');\n const confirm = requiredToken(options.confirm, 'confirm');\n const approvedAtUtc = requiredToken(options.approvedAtUtc, 'approvedAtUtc');\n\n const freezeArtifact = dependencies.readJson({\n filePath: freezePath,\n label: 'Protected execution freeze',\n });\n const freeze = dependencies.parseFreeze(freezeArtifact.value);\n assertProtectedProductionProjectRef(freeze.project_ref);\n assertCanonicalJsonArtifact({\n label: 'Protected execution freeze',\n text: freezeArtifact.text,\n value: freeze,\n });\n if (approveFreezeFile !== freezeArtifact.file_sha256) {\n throw new CliError('Explicit freeze file hash does not match the supplied freeze bytes.', {\n code: 'DATASET_MAINTENANCE_PROTECTED_SEAL_FREEZE_MISMATCH',\n exitCode: 1,\n });\n }\n\n const requestArtifact = dependencies.readJson({\n filePath: approvalRequestPath,\n label: 'Protected approval request',\n });\n const request = dependencies.parseApprovalRequest(requestArtifact.value);\n assertCanonicalJsonArtifact({\n label: 'Protected approval request',\n text: requestArtifact.text,\n value: request,\n });\n const humanApproval = dependencies.readText(humanApprovalPath);\n const approval = dependencies.sealApproval({\n approvalRequest: request,\n freeze,\n freezeFileSha256: freezeArtifact.file_sha256,\n humanApprovalText: humanApproval.text,\n approveRequestSha256: approveRequest,\n approveTextSha256: approveText,\n approvedAtUtc,\n confirmAccountEmail: confirm,\n });\n const paths = artifactPaths(outDir);\n const report: DatasetMaintenanceProtectedApprovalSealReport = {\n schema_version: 'dataset-alias-protected-approval-seal-report.v1',\n generated_at_utc: (options.now ?? new Date()).toISOString(),\n approval_authority_at_utc: approvedAtUtc,\n status: 'sealed',\n execution_submitted: false,\n environment: 'production',\n project_ref: freeze.project_ref,\n account: freeze.account,\n plan_sha256: freeze.plan.plan_sha256,\n operation_id: freeze.plan.operation_id,\n freeze_file_sha256: freezeArtifact.file_sha256,\n freeze_sha256: freeze.freeze_sha256,\n approval_request_file_sha256: requestArtifact.file_sha256,\n approval_request_sha256: request.request_sha256,\n approval_text_sha256: request.approval_text_sha256,\n approval_file_sha256: approval.file_sha256,\n approval_identity_sha256: approval.value.approval_identity_sha256,\n assertions: {\n byte_exact_human_text: true,\n explicit_freeze_file_hash: true,\n explicit_request_hash: true,\n explicit_text_hash: true,\n explicit_account_confirmation: true,\n authentication_calls: 0,\n network_calls: 0,\n database_calls: 0,\n preflight_calls: 0,\n gate_calls: 0,\n admission_calls: 0,\n execution_calls: 0,\n },\n artifacts: paths,\n artifact_sha256: {\n human_approval_text: sha256Text(humanApproval.text),\n approval: approval.file_sha256,\n report: null,\n },\n };\n dependencies.materializeArtifacts(outDir, (stagingDirectory) => {\n const staging = artifactPaths(stagingDirectory);\n dependencies.writeText(staging.human_approval_text, humanApproval.text);\n dependencies.writeText(staging.approval, approval.canonical_file_text);\n dependencies.writeJson(staging.report, report);\n });\n return report;\n}\n\nexport const __testInternals = {\n DEFAULT_SEAL_DEPENDENCIES,\n artifactPaths,\n assertCanonicalJsonArtifact,\n requiredHash,\n requiredToken,\n};\n"]}

package/dist/src/lib/dataset-maintenance-protected-verify.js CHANGED Viewed

@@ -80,12 +80,10 @@ function indexPrimaryActionEvidence(options) {
 export function inspectProtectedLiveDerivative(row) {
     const raw = row.raw;
     const jsonOrdered = isJsonObject(raw.json_ordered) ? raw.json_ordered : null;
-    const extractedText = requiredString(raw.extracted_text);
     const extractedMd = requiredString(raw.extracted_md);
     const embeddingAt = requiredString(raw.embedding_ft_at);
     if (row.state_code !== 0 ||
         !jsonOrdered ||
-        !extractedText ||
         !extractedMd ||
         raw.embedding_ft === null ||
         raw.embedding_ft === undefined ||
@@ -100,7 +98,6 @@ export function inspectProtectedLiveDerivative(row) {
         user_id: row.user_id,
         state_code: 0,
         json_ordered_sha256: sha256Json(jsonOrdered),
-        extracted_text_present: true,
         extracted_md_present: true,
         embedding_ft_present: true,
         embedding_ft_at: embeddingAt,

package/dist/src/lib/dataset-maintenance-protected-verify.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"dataset-maintenance-protected-verify.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAMjC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,oCAAoC,GAGrC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAoDjC,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB;IAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,wBAAwB,GAAG,cAAc,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnF,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,qBAAqB,GAAG,cAAc,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7E,IACE,CAAC,QAAQ;QACT,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC;QAC5F,CAAC,EAAE;QACH,CAAC,OAAO;QACR,KAAK,CAAC,SAAS,KAAK,IAAI;QACxB,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,KAAK,CAAC,YAAY,KAAK,IAAI;QAC3B,KAAK,CAAC,oBAAoB,KAAK,IAAI;QACnC,CAAC,wBAAwB;QACzB,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;QACtC,CAAC,cAAc;QACf,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;QAC5B,CAAC,qBAAqB;QACtB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACnC,KAAK,CAAC,KAAK,KAAK,IAAI,EACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE;QACF,OAAO;QACP,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,IAAI;QAClB,oBAAoB,EAAE,IAAI;QAC1B,2BAA2B,EAAE,wBAAwB;QACrD,gBAAgB,EAAE,cAAc;QAChC,wBAAwB,EAAE,qBAAqB;QAC/C,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,OAGnC;IACC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,IACE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS,CACjF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA0C;IAE1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,IACE,GAAG,CAAC,UAAU,KAAK,CAAC;QACpB,CAAC,WAAW;QACZ,CAAC,aAAa;QACd,CAAC,WAAW;QACZ,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,YAAY,KAAK,SAAS;QAC9B,CAAC,WAAW;QACZ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,CAAU;QACtB,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC;QAC5C,sBAAsB,EAAE,IAAI;QAC5B,oBAAoB,EAAE,IAAI;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,eAAe,EAAE,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAI1B;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBAClC,GAAG,OAAO;gBACV,YAAY,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC7C,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAG9B;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,KAAK,cAAc,CAAC;IAC9D,MAAM,kBAAkB,GACtB,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC;YACzB,CAAC,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC,CAAC;IACzF,IACE,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACpE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,gFAAgF,EAChF,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAC7E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/F,MAAM,CAAC,IAAI,CACT,KAAK,CACH,uCAAuC,EACvC,+DAA+D,CAChE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,WAAW,CAAC;QACrE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;YACxB,CAAC,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,WAAW,CAAC,CAAC;QAClF,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe;YAC/B,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc,IAAI,KAAK,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC;QAC5F,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CACtE,KAAK,CAAC,gBAAgB,CACvB,CAAC,CAAC;IACP,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,2EAA2E,EAC3E,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CACnE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,MAAM,gBAAgB,GACpB,KAAK,CAAC,UAAU,KAAK,CAAC;YACtB,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACxB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;YAC7B,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CACpF,CAAC;QACJ,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gCAAgC,EAChC,yEAAyE,EACzE,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACtE,OAAO,aAAa,CAAC,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,SAAS,CAAC;QAC/B,OAAO,aAAa,CAAC,cAAc,CAAC;QACpC,OAAO,aAAa,CAAC,yBAAyB,CAAC;QAC/C,kBAAkB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,aAAa,CAAC;IACnE,CAAC;IACD,IACE,CAAC,KAAK;QACN,KAAK,CAAC,SAAS,KAAK,0BAA0B,CAAC,YAAY;QAC3D,KAAK,CAAC,cAAc,KAAK,0BAA0B,CAAC,cAAc;QAClE,KAAK,CAAC,iBAAiB,KAAK,0BAA0B,CAAC,WAAW;QAClE,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,CAAC,YAAY,CAAC,OAAO,CAAC;QACtB,OAAO,CAAC,cAAc,KAAK,kCAAkC;QAC7D,OAAO,CAAC,EAAE,KAAK,IAAI;QACnB,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC7C,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW;QAC9D,OAAO,CAAC,YAAY,KAAK,0BAA0B,CAAC,YAAY;QAChE,OAAO,CAAC,qBAAqB,KAAK,0BAA0B,CAAC,YAAY;QACzE,OAAO,CAAC,kBAAkB,KAAK,0BAA0B,CAAC,kBAAkB;QAC5E,OAAO,CAAC,UAAU,KAAK,0BAA0B,CAAC,UAAU;QAC5D,OAAO,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;QAClE,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,0BAA0B,KAAK,CAAC;QACxC,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,8BAA8B,KAAK,CAAC;QAC5C,OAAO,CAAC,oBAAoB,KAAK,CAAC;QAClC,OAAO,CAAC,qBAAqB,KAAK,CAAC;QACnC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QACvC,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,0BAA0B,CAAC,YAAY;QAC1E,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACxC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QACrC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO,CAAC,SAAS,KAAK,0BAA0B,CAAC,YAAY;QAC7D,OAAO,CAAC,cAAc,KAAK,0BAA0B,CAAC,cAAc;QACpE,OAAO,CAAC,kBAAkB,KAAK,IAAI;QACnC,CAAC,kBAAkB,EACnB,CAAC;QACD,OAAO;YACL,KAAK,CACH,iCAAiC,EACjC,2FAA2F,EAC3F,KAAK,CACN;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsD;IAC/E,OAAO,GAAG,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,OAG9B;IACC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAChD,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC9E,OAAO;YACL,KAAK,CACH,6CAA6C,EAC7C,kEAAkE,CACnE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IACE,KAAK,CAAC,cAAc,KAAK,4CAA4C;QACrE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU;QAC9C,KAAK,CAAC,MAAM,KAAK,WAAW;QAC5B,KAAK,CAAC,IAAI,KAAK,4BAA4B;QAC3C,KAAK,CAAC,qBAAqB,KAAK,IAAI;QACpC,KAAK,CAAC,YAAY,KAAK,0BAA0B,CAAC,uBAAuB;QACzE,KAAK,CAAC,UAAU,KAAK,0BAA0B,CAAC,UAAU;QAC1D,KAAK,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;QAChE,KAAK,CAAC,eAAe,KAAK,0BAA0B,CAAC,uBAAuB;QAC5E,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAC7B,KAAK,CAAC,YAAY,KAAK,CAAC;QACxB,KAAK,CAAC,mBAAmB,KAAK,CAAC;QAC/B,OAAO,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB;QACrE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,uBAAuB;QACzE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACnD,0BAA0B,CAAC,uBAAuB,EACpD,CAAC;QACD,OAAO;YACL,KAAK,CACH,6CAA6C,EAC7C,mEAAmE,CACpE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,OAAO,KAAK,KAAK,GAAG,CAAC;YAC5B,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU;YACjD,MAAM,CAAC,+BAA+B,KAAK,QAAQ,CAAC,wBAAwB,EAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,+CAA+C,EAC/C,iEAAiE,EACjE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,MAAM,CAAC,KAAK;YACb,CAAC,MAAM,CAAC,yBAAyB;YACjC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;YAC7C,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC9C,MAAM,CAAC,yBAAyB,KAAK,MAAM,CAAC,wBAAwB;YACpE,CAAC,MAAM,CAAC,eAAe;YACvB,CAAC,MAAM,CAAC,yBAAyB;YACjC,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,MAAM,CAAC,gBAAgB;YACxB,CAAC,MAAM,CAAC,kBAAkB;YAC1B,CAAC,MAAM,CAAC,sBAAsB;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,CAAC,MAAM,CAAC,qBAAqB,EAC7B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,mGAAmG,EACnG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAK/B;IACC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB;QACnC,CAAC,gCAAgC,CAC/B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,qCAAqC,EACrC,mFAAmF,CACpF,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChE,IACE,YAAY,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QACrC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,gEAAgE,CACjE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,qBAAqB,EAAE,qCAAqC,EAAE,YAAY,CAAC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,gBAAgB;YACvC,GAAG,CAAC,UAAU,KAAK,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC;YACpD,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ;YACxC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAC1D,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oCAAoC,EACpC,+DAA+D,EAC/D,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAChC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IACE,UAAU,CAAC,wCAAwC,CAAC,SAAS,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,0BAA0B,EACvC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,sEAAsE,CACvE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAOzB;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAC1E,CAAC;IACF,MAAM,eAAe,GAAG,0BAA0B,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,cAAc;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IACE,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI;QACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;QAC5C,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI;QACzC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;QAChD,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACtE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,wCAAwC,EACxC,mGAAmG,CACpG,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IACE,CAAC,GAAG;YACJ,CAAC,KAAK;YACN,CAAC,QAAQ;YACT,CAAC,MAAM,EAAE,eAAe;YACxB,CAAC,QAAQ;YACT,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC9C,GAAG,CAAC,UAAU,KAAK,CAAC;YACpB,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YACnD,QAAQ,CAAC,UAAU,KAAK,CAAC;YACzB,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC,eAAe,CAAC,MAAM;YACzD,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,2BAA2B;YAClE,QAAQ,CAAC,wBAAwB,KAAK,QAAQ,CAAC,2BAA2B;YAC1E,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,CAAC,2BAA2B;YACrE,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,yBAAyB;YAC5D,CAAC,QAAQ,CAAC,mBAAmB;YAC7B,CAAC,QAAQ,CAAC,mBAAmB;YAC7B,CAAC,QAAQ,CAAC,eAAe,EACzB,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oCAAoC,EACpC,iFAAiF,EACjF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,OAGhD;IACC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACnB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACzB,gCAAgC,CAC9B,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,EACF;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CACF,CACF,CACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD,KAAK,UAAU,wCAAwC,CACrD,OAOC,EACD,YAA+C;IAE/C,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC/E,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;YAC7E,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE;gBACN,KAAK,CACH,+BAA+B,EAC/B,gGAAgG,CACjG;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE;gBACN,KAAK,CACH,mCAAmC,EACnC,uFAAuF,EACvF,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,KAAK,CACH,4BAA4B,EAC5B,6DAA6D,EAC7D,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAC/E,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,GAAG,sBAAsB,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,yFAAyF,CAC1F,CACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAA0C,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB,EAAE,CAAC;QAC5E,MAAM,cAAc,GAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,WAAW,KAAK,iBAAiB;YACjE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CACT,GAAG,gBAAgB,CAAC;YAClB,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO;YACvD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC3C,MAAM;QACN,gBAAgB,EAAE;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAO9C;IACC,OAAO,wCAAwC,CAAC,OAAO,EAAE;QACvD,gBAAgB,EAAE,2BAA2B;QAC7C,mBAAmB,EAAE,oCAAoC;QACzD,cAAc,EAAE,iCAAiC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,iBAAiB;IACjB,iCAAiC;IACjC,8BAA8B;IAC9B,gBAAgB;IAChB,kBAAkB;IAClB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,wCAAwC;CACzC,CAAC","sourcesContent":["import { loadMaintenanceDesiredPayload } from './dataset-maintenance-alias-request.js';\nimport {\n isJsonObject,\n maintenanceRowKey,\n sha256Json,\n snapshotRemoteRow,\n type DatasetMaintenancePlan,\n type DatasetMaintenanceRemoteRow,\n} from './dataset-maintenance-contract.js';\nimport {\n PROTECTED_EXECUTION_COUNTS,\n parseProtectedDerivativeSnapshot,\n type ProtectedDerivativeSnapshot,\n type ProtectedExecutionIdentity,\n type ProtectedExecutionStatusProof,\n type ProtectedReportStatus,\n type ProtectedTerminalTargetProof,\n} from './dataset-maintenance-protected-contract.js';\nimport { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';\nimport { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';\nimport {\n fetchMaintenanceAccountRows,\n fetchMaintenanceDerivativeSnapshot,\n fetchMaintenanceDerivativeTargetRows,\n type DatasetMaintenanceDerivativeRemoteRow,\n type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nexport type ProtectedVerificationIssue = {\n code: string;\n message: string;\n details?: unknown;\n};\n\nexport type ProtectedLiveDerivativeReadback = {\n table: 'flows' \| 'processes';\n id: string;\n version: string;\n user_id: string;\n state_code: 0;\n json_ordered_sha256: string;\n extracted_text_present: true;\n extracted_md_present: true;\n embedding_ft_present: true;\n embedding_ft_at: string;\n};\n\ntype ProtectedPrimaryActionEvidence = {\n action_id: string;\n table: 'flowproperties' \| 'flows' \| 'processes';\n id: string;\n version: string;\n row_found: true;\n owner_matches: true;\n state_code_matches: true;\n json_matches: true;\n json_ordered_matches: true;\n desired_json_ordered_sha256: string;\n live_json_sha256: string;\n live_json_ordered_sha256: string;\n valid: true;\n};\n\nexport type ProtectedVerificationResult = {\n status: ProtectedReportStatus;\n issues: ProtectedVerificationIssue[];\n account_readback: {\n rows: DatasetMaintenanceRemoteRow[];\n source_urls: string[];\n completeness: unknown;\n } \| null;\n derivative_readback: {\n rows: ProtectedLiveDerivativeReadback[];\n snapshots: ProtectedDerivativeSnapshot[];\n source_urls: string[];\n } \| null;\n};\n\nfunction issue(code: string, message: string, details?: unknown): ProtectedVerificationIssue {\n return { code, message, ...(details === undefined ? {} : { details }) };\n}\n\nfunction requiredString(value: unknown): string \| null {\n return typeof value === 'string' && value.trim() ? value : null;\n}\n\nfunction parsePrimaryActionEvidence(value: unknown): ProtectedPrimaryActionEvidence \| null {\n if (!isJsonObject(value)) return null;\n const actionId = requiredString(value.action_id);\n const id = requiredString(value.id);\n const version = requiredString(value.version);\n const desiredJsonOrderedSha256 = requiredString(value.desired_json_ordered_sha256);\n const liveJsonSha256 = requiredString(value.live_json_sha256);\n const liveJsonOrderedSha256 = requiredString(value.live_json_ordered_sha256);\n if (\n !actionId \|\|\n (value.table !== 'flowproperties' && value.table !== 'flows' && value.table !== 'processes') \|\|\n !id \|\|\n !version \|\|\n value.row_found !== true \|\|\n value.owner_matches !== true \|\|\n value.state_code_matches !== true \|\|\n value.json_matches !== true \|\|\n value.json_ordered_matches !== true \|\|\n !desiredJsonOrderedSha256 \|\|\n !SHA256.test(desiredJsonOrderedSha256) \|\|\n !liveJsonSha256 \|\|\n !SHA256.test(liveJsonSha256) \|\|\n !liveJsonOrderedSha256 \|\|\n !SHA256.test(liveJsonOrderedSha256) \|\|\n value.valid !== true\n ) {\n return null;\n }\n return {\n action_id: actionId,\n table: value.table,\n id,\n version,\n row_found: true,\n owner_matches: true,\n state_code_matches: true,\n json_matches: true,\n json_ordered_matches: true,\n desired_json_ordered_sha256: desiredJsonOrderedSha256,\n live_json_sha256: liveJsonSha256,\n live_json_ordered_sha256: liveJsonOrderedSha256,\n valid: true,\n };\n}\n\nfunction indexPrimaryActionEvidence(options: {\n closure: unknown;\n plan: DatasetMaintenancePlan;\n}): Map<string, ProtectedPrimaryActionEvidence> \| null {\n if (!isJsonObject(options.closure) \|\| !Array.isArray(options.closure.action_evidence)) {\n return null;\n }\n if (options.closure.action_evidence.length !== options.plan.actions.length) return null;\n const byKey = new Map<string, ProtectedPrimaryActionEvidence>();\n const actionIds = new Set<string>();\n for (const raw of options.closure.action_evidence) {\n const evidence = parsePrimaryActionEvidence(raw);\n if (!evidence) return null;\n const key = maintenanceRowKey(evidence);\n if (byKey.has(key) \|\| actionIds.has(evidence.action_id)) return null;\n byKey.set(key, evidence);\n actionIds.add(evidence.action_id);\n }\n if (\n options.plan.actions.some(\n (action) => byKey.get(maintenanceRowKey(action))?.action_id !== action.action_id,\n )\n ) {\n return null;\n }\n return byKey;\n}\n\nexport function inspectProtectedLiveDerivative(\n row: DatasetMaintenanceDerivativeRemoteRow,\n): ProtectedLiveDerivativeReadback \| null {\n const raw = row.raw;\n const jsonOrdered = isJsonObject(raw.json_ordered) ? raw.json_ordered : null;\n const extractedText = requiredString(raw.extracted_text);\n const extractedMd = requiredString(raw.extracted_md);\n const embeddingAt = requiredString(raw.embedding_ft_at);\n if (\n row.state_code !== 0 \|\|\n !jsonOrdered \|\|\n !extractedText \|\|\n !extractedMd \|\|\n raw.embedding_ft === null \|\|\n raw.embedding_ft === undefined \|\|\n !embeddingAt \|\|\n !Number.isFinite(Date.parse(embeddingAt))\n ) {\n return null;\n }\n return {\n table: row.table,\n id: row.id,\n version: row.version,\n user_id: row.user_id,\n state_code: 0 as const,\n json_ordered_sha256: sha256Json(jsonOrdered),\n extracted_text_present: true,\n extracted_md_present: true,\n embedding_ft_present: true,\n embedding_ft_at: embeddingAt,\n };\n}\n\nfunction expectedFinalRows(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n rows: DatasetMaintenanceRemoteRow[];\n}): DatasetMaintenanceRemoteRow[] {\n const rows = new Map(options.rows.map((row) => [maintenanceRowKey(row), { ...row }]));\n for (const action of options.plan.actions) {\n const current = rows.get(maintenanceRowKey(action));\n if (current) {\n rows.set(maintenanceRowKey(action), {\n ...current,\n json_ordered: loadMaintenanceDesiredPayload(options.planDir, action),\n });\n }\n }\n return [...rows.values()].sort((left, right) =>\n maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)),\n );\n}\n\nfunction verifyStatusStructure(options: {\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n}): ProtectedVerificationIssue[] {\n const { identity, proof } = options;\n const issues: ProtectedVerificationIssue[] = [];\n const notAdmitted = proof.execution_status === 'not_admitted';\n const dispatchCountValid =\n proof.dispatch_count === 1 \|\|\n (proof.dispatch_count === 0 &&\n (proof.execution_status === 'failed' \|\| proof.execution_status === 'indeterminate'));\n if (\n (notAdmitted && (proof.attempt_count !== 0 \|\| proof.dispatch_count !== 0)) \|\|\n (!notAdmitted && (proof.attempt_count !== 1 \|\| !dispatchCountValid))\n ) {\n issues.push(\n issue(\n 'PROTECTED_ATTEMPT_DISPATCH_COUNT_INVALID',\n 'Database did not prove the one-attempt, at-most-one-dispatch execution policy.',\n { attempt_count: proof.attempt_count, dispatch_count: proof.dispatch_count },\n ),\n );\n }\n if (proof.plan_sha256 !== identity.plan_sha256 \|\| proof.operation_id !== identity.operation_id) {\n issues.push(\n issue(\n 'PROTECTED_EXECUTION_IDENTITY_MISMATCH',\n 'Database status does not round-trip the sealed plan identity.',\n ),\n );\n }\n const categoryMatches =\n (proof.status === 'passed' && proof.execution_status === 'completed') \|\|\n (proof.status === 'failed' &&\n (proof.execution_status === 'failed' \|\| proof.execution_status === 'completed')) \|\|\n (proof.status === 'indeterminate' &&\n (proof.execution_status === 'not_admitted' \|\| proof.execution_status === 'indeterminate')) \|\|\n (proof.status === 'pending' &&\n ['dispatching', 'dispatched', 'running', 'derivatives_pending'].includes(\n proof.execution_status,\n ));\n if (!categoryMatches) {\n issues.push(\n issue(\n 'PROTECTED_STATUS_CATEGORY_INVALID',\n 'Database status category is inconsistent with its execution ledger state.',\n { status: proof.status, execution_status: proof.execution_status },\n ),\n );\n }\n if (!notAdmitted) {\n const gateNames = proof.gates.map((gate) => gate.gate);\n const receiptHashes = proof.gates.map((gate) => gate.receipt_sha256);\n const gateClosureValid =\n proof.gate_count === 3 &&\n proof.gates.length === 3 &&\n new Set(gateNames).size === 3 &&\n new Set(receiptHashes).size === 3 &&\n proof.gates.every(\n (gate) => gate.observed_sha256 === gate.expected_sha256 && gate.status === 'passed',\n );\n if (!gateClosureValid) {\n issues.push(\n issue(\n 'PROTECTED_GATE_CLOSURE_INVALID',\n 'Database did not round-trip three unique server-captured gate receipts.',\n proof.gates,\n ),\n );\n }\n }\n return issues;\n}\n\nfunction verifyAuditClosure(proof: ProtectedExecutionStatusProof): ProtectedVerificationIssue[] {\n const audit = proof.primary_readback;\n const closure = audit?.closure;\n let closureHashMatches = false;\n if (isJsonObject(closure) && typeof closure.live_closure_proof_sha256 === 'string') {\n const proofMaterial = { ...closure };\n const closureSha256 = String(proofMaterial.live_closure_proof_sha256);\n delete proofMaterial.ok;\n delete proofMaterial.row_count;\n delete proofMaterial.exchange_count;\n delete proofMaterial.live_closure_proof_sha256;\n closureHashMatches = sha256Json(proofMaterial) === closureSha256;\n }\n if (\n !audit \|\|\n audit.row_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n audit.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count \|\|\n audit.alias_audit_count !== PROTECTED_EXECUTION_COUNTS.audit_count \|\|\n audit.live_closure_proof !== true \|\|\n !isJsonObject(closure) \|\|\n closure.schema_version !== 'dataset-alias-primary-closure.v1' \|\|\n closure.ok !== true \|\|\n closure.actor_user_id !== proof.actor_user_id \|\|\n closure.batch_count !== PROTECTED_EXECUTION_COUNTS.batch_count \|\|\n closure.action_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.distinct_action_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.flowproperty_count !== PROTECTED_EXECUTION_COUNTS.flowproperty_count \|\|\n closure.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count \|\|\n closure.process_count !== PROTECTED_EXECUTION_COUNTS.process_count \|\|\n closure.support_reference_count !== 6 \|\|\n closure.flowproperty_support_count !== 2 \|\|\n closure.unitgroup_support_count !== 2 \|\|\n closure.source_unitgroup_support_count !== 2 \|\|\n closure.invalid_action_count !== 0 \|\|\n closure.invalid_support_count !== 0 \|\|\n !Array.isArray(closure.action_evidence) \|\|\n closure.action_evidence.length !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.action_evidence.some((entry) => !isJsonObject(entry)) \|\|\n !Array.isArray(closure.support_evidence) \|\|\n closure.support_evidence.length !== 6 \|\|\n closure.support_evidence.some((entry) => !isJsonObject(entry)) \|\|\n closure.row_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count \|\|\n closure.live_closure_proof !== true \|\|\n !closureHashMatches\n ) {\n return [\n issue(\n 'PROTECTED_AUDIT_CLOSURE_INVALID',\n 'Terminal execution did not prove the exact 52-row, 59-exchange, 55-audit primary closure.',\n audit,\n ),\n ];\n }\n return [];\n}\n\nfunction terminalTargetKey(target: { table: string; id: string; version: string }): string {\n return `${target.table}\\u0000${target.id}\\u0000${target.version}`;\n}\n\nfunction verifyTerminalTargets(options: {\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n}): ProtectedVerificationIssue[] {\n const issues: ProtectedVerificationIssue[] = [];\n const batch = options.proof.derivative_readback;\n if (batch.proof_level !== 'causal_terminal' \|\| batch.proof_deferred !== false) {\n return [\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID',\n 'Terminal proof must use the full causal-terminal evidence level.',\n ),\n ];\n }\n const targets = batch.targets;\n const keys = targets.map(terminalTargetKey);\n if (\n batch.schema_version !== 'dataset-derivative-rebuild-batch-status.v1' \|\|\n batch.batch_id !== options.identity.request_id \|\|\n batch.status !== 'completed' \|\|\n batch.code !== 'DERIVATIVE_BATCH_COMPLETED' \|\|\n batch.causal_terminal_proof !== true \|\|\n batch.target_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n batch.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count \|\|\n batch.process_count !== PROTECTED_EXECUTION_COUNTS.process_count \|\|\n batch.completed_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n batch.nonterminal_count !== 0 \|\|\n batch.failed_count !== 0 \|\|\n batch.invalid_proof_count !== 0 \|\|\n targets.length !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n new Set(keys).size !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n new Set(targets.map((target) => target.ordinal)).size !==\n PROTECTED_EXECUTION_COUNTS.derivative_target_count\n ) {\n return [\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID',\n 'Terminal proof must contain exactly 50 unique derivative targets.',\n ),\n ];\n }\n const frozen = new Map(\n options.identity.derivative_targets.map((target) => [terminalTargetKey(target), target]),\n );\n for (const [index, target] of targets.entries()) {\n const expected = frozen.get(terminalTargetKey(target));\n if (\n !expected \|\|\n target.ordinal !== index + 1 \|\|\n target.request_id === options.identity.request_id \|\|\n target.source_baseline_snapshot_sha256 !== expected.baseline_snapshot_sha256\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_IDENTITY_MISMATCH',\n 'Terminal derivative proof contains a foreign or changed target.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n continue;\n }\n if (\n target.status !== 'completed' \|\|\n !target.phase \|\|\n !target.completed_snapshot_sha256 \|\|\n !SHA256.test(target.expected_snapshot_sha256) \|\|\n !SHA256.test(target.completed_snapshot_sha256) \|\|\n target.completed_snapshot_sha256 === target.expected_snapshot_sha256 \|\|\n !target.primary_matches \|\|\n !target.terminal_snapshot_matches \|\|\n !target.proposals_committed \|\|\n !target.derivative_fresh \|\|\n !target.lifecycle_complete \|\|\n !target.terminal_audit_present \|\|\n Object.values(target.residue).some((count) => count !== 0) \|\|\n !target.causal_terminal_proof\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_NOT_TERMINAL',\n 'Derivative target lacks causal completed/live equality or retains queue, failure, or fence state.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n }\n }\n return issues;\n}\n\nfunction verifyFinalAccountRows(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n rows: DatasetMaintenanceRemoteRow[];\n completeness: unknown;\n}): ProtectedVerificationIssue[] {\n const issues: ProtectedVerificationIssue[] = [];\n if (\n !options.plan.snapshot_completeness \|\|\n !isSnapshotCompletenessCompatible(\n options.completeness,\n options.plan.snapshot_completeness,\n Object.keys(options.plan.snapshot_completeness.entity_counts),\n )\n ) {\n issues.push(\n issue(\n 'PROTECTED_FINAL_SNAPSHOT_INCOMPLETE',\n 'Final RLS account scan does not prove the same complete table census as the plan.',\n ),\n );\n return issues;\n }\n const expectedKeys = new Set([\n ...options.plan.actions.map(maintenanceRowKey),\n ...options.plan.protected_rows.map(maintenanceRowKey),\n ]);\n const actualKeys = new Set(options.rows.map(maintenanceRowKey));\n if (\n expectedKeys.size !== actualKeys.size \|\|\n [...expectedKeys].some((key) => !actualKeys.has(key))\n ) {\n issues.push(\n issue(\n 'PROTECTED_FINAL_ACCOUNT_CENSUS_DRIFT',\n 'Final RLS account rows contain missing or unexpected entities.',\n ),\n );\n }\n const current = new Map(options.rows.map((row) => [maintenanceRowKey(row), row]));\n for (const protectedRow of options.plan.protected_rows) {\n const row = current.get(maintenanceRowKey(protectedRow));\n if (!row \|\| snapshotRemoteRow(row).row_sha256 !== protectedRow.row_sha256) {\n issues.push(\n issue('PROTECTED_ROW_DRIFT', 'A protected non-action row changed.', protectedRow),\n );\n }\n }\n for (const action of options.plan.actions) {\n const row = current.get(maintenanceRowKey(action));\n const desired = loadMaintenanceDesiredPayload(options.planDir, action);\n if (\n !row \|\|\n row.user_id !== action.expected_user_id \|\|\n row.state_code !== 0 \|\|\n sha256Json(row.json_ordered) !== sha256Json(desired) \|\|\n row.model_id !== action.before?.model_id \|\|\n row.rule_verification !== action.before?.rule_verification\n ) {\n issues.push(\n issue(\n 'PROTECTED_ACTION_READBACK_MISMATCH',\n 'An action row does not match the desired owner-draft payload.',\n { action_id: action.action_id },\n ),\n );\n }\n }\n const projected = expectedFinalRows({\n plan: options.plan,\n planDir: options.planDir,\n rows: options.rows,\n });\n if (\n sha256Json(maintenanceProjectedReferenceFingerprint(projected)) !==\n options.plan.projected_reference_sha256\n ) {\n issues.push(\n issue(\n 'PROTECTED_REFERENCE_CLOSURE_MISMATCH',\n 'Final reference closure does not match the frozen projected closure.',\n ),\n );\n }\n return issues;\n}\n\nfunction matchLiveTargets(options: {\n proofs: ProtectedTerminalTargetProof[];\n live: ProtectedLiveDerivativeReadback[];\n snapshots: ProtectedDerivativeSnapshot[];\n primaryClosure: unknown;\n plan: DatasetMaintenancePlan;\n identity: ProtectedExecutionIdentity;\n}): ProtectedVerificationIssue[] {\n const proofs = new Map(options.proofs.map((proof) => [terminalTargetKey(proof), proof]));\n const snapshots = new Map(\n options.snapshots.map((snapshot) => [terminalTargetKey(snapshot), snapshot]),\n );\n const live = new Map(options.live.map((row) => [terminalTargetKey(row), row]));\n const actions = new Map(\n options.plan.actions.map((action) => [maintenanceRowKey(action), action]),\n );\n const primaryEvidence = indexPrimaryActionEvidence({\n closure: options.primaryClosure,\n plan: options.plan,\n });\n const issues: ProtectedVerificationIssue[] = [];\n const expectedKeys = new Set(options.identity.derivative_targets.map(terminalTargetKey));\n const liveKeys = options.live.map(terminalTargetKey);\n const snapshotKeys = options.snapshots.map(terminalTargetKey);\n if (\n liveKeys.length !== expectedKeys.size \|\|\n new Set(liveKeys).size !== expectedKeys.size \|\|\n snapshotKeys.length !== expectedKeys.size \|\|\n new Set(snapshotKeys).size !== expectedKeys.size \|\|\n [...expectedKeys].some((key) => !live.has(key) \|\| !snapshots.has(key))\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_SET_MISMATCH',\n 'Independent derivative rows and snapshots must be unique and exactly match all 50 frozen targets.',\n ),\n );\n }\n for (const target of options.identity.derivative_targets) {\n const key = terminalTargetKey(target);\n const row = live.get(key);\n const proof = proofs.get(key);\n const snapshot = snapshots.get(key);\n const action = actions.get(key);\n const evidence = primaryEvidence?.get(key);\n if (\n !row \|\|\n !proof \|\|\n !snapshot \|\|\n !action?.desired_payload \|\|\n !evidence \|\|\n row.user_id !== options.identity.actor.user_id \|\|\n row.state_code !== 0 \|\|\n snapshot.user_id !== options.identity.actor.user_id \|\|\n snapshot.state_code !== 0 \|\|\n row.json_ordered_sha256 !== action.desired_payload.sha256 \|\|\n evidence.live_json_sha256 !== evidence.desired_json_ordered_sha256 \|\|\n evidence.live_json_ordered_sha256 !== evidence.desired_json_ordered_sha256 \|\|\n snapshot.json_ordered_sha256 !== evidence.desired_json_ordered_sha256 \|\|\n snapshot.snapshot_sha256 !== proof.completed_snapshot_sha256 \|\|\n !snapshot.extracted_md_sha256 \|\|\n !snapshot.embedding_ft_sha256 \|\|\n !snapshot.embedding_ft_at\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_MISMATCH',\n 'Independent RLS derivative readback does not match the terminal database proof.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n }\n }\n return issues;\n}\n\nasync function fetchProtectedDerivativeSnapshots(options: {\n context: DatasetMaintenanceRemoteContext;\n identity: ProtectedExecutionIdentity;\n}): Promise<ProtectedDerivativeSnapshot[]> {\n const snapshots: ProtectedDerivativeSnapshot[] = [];\n const targets = options.identity.derivative_targets;\n for (let offset = 0; offset < targets.length; offset += 5) {\n const chunk = targets.slice(offset, offset + 5);\n snapshots.push(\n ...(await Promise.all(\n chunk.map(async (target) =>\n parseProtectedDerivativeSnapshot(\n await fetchMaintenanceDerivativeSnapshot({\n context: options.context,\n table: target.table,\n id: target.id,\n version: target.version,\n }),\n {\n table: target.table,\n id: target.id,\n version: target.version,\n userId: target.user_id,\n },\n ),\n ),\n )),\n );\n }\n return snapshots;\n}\n\ntype ProtectedVerificationDependencies = {\n fetchAccountRows: typeof fetchMaintenanceAccountRows;\n fetchDerivativeRows: typeof fetchMaintenanceDerivativeTargetRows;\n fetchSnapshots: typeof fetchProtectedDerivativeSnapshots;\n};\n\nasync function verifyProtectedExecutionWithDependencies(\n options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n context: DatasetMaintenanceRemoteContext;\n pageSize?: number;\n },\n dependencies: ProtectedVerificationDependencies,\n): Promise<ProtectedVerificationResult> {\n const { fetchAccountRows, fetchDerivativeRows, fetchSnapshots } = dependencies;\n const structuralIssues = verifyStatusStructure({\n identity: options.identity,\n proof: options.proof,\n });\n if (structuralIssues.length) {\n return {\n status: options.proof.status === 'indeterminate' ? 'indeterminate' : 'failed',\n issues: structuralIssues,\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.execution_status === 'not_admitted') {\n return {\n status: 'indeterminate',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_NOT_FOUND',\n 'The server has a protected preflight but no admitted execution; admission must not be retried.',\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.status === 'pending') {\n return { status: 'pending', issues: [], account_readback: null, derivative_readback: null };\n }\n if (options.proof.status === 'indeterminate') {\n return {\n status: 'indeterminate',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_INDETERMINATE',\n 'Database reported an indeterminate terminal execution; admission must not be retried.',\n options.proof.failure,\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.status === 'failed') {\n return {\n status: 'failed',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_FAILED',\n 'Database reported a definitive protected execution failure.',\n options.proof.failure,\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n\n const issues = [\n ...verifyAuditClosure(options.proof),\n ...verifyTerminalTargets({ identity: options.identity, proof: options.proof }),\n ];\n if (issues.length) {\n return { status: 'failed', issues, account_readback: null, derivative_readback: null };\n }\n const account = await fetchAccountRows({\n context: options.context,\n userId: options.identity.actor.user_id,\n pageSize: options.pageSize,\n });\n issues.push(\n ...verifyFinalAccountRows({\n plan: options.plan,\n planDir: options.planDir,\n rows: account.rows,\n completeness: account.completeness,\n }),\n );\n const derivative = await fetchDerivativeRows({\n context: options.context,\n targets: options.identity.derivative_targets,\n });\n const live = derivative.rows.map(inspectProtectedLiveDerivative);\n if (live.some((row) => row === null)) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_INVALID',\n 'A live derivative row lacks primary JSON, extracted markdown, embedding, or timestamps.',\n ),\n );\n }\n const validLive = live.filter((row): row is ProtectedLiveDerivativeReadback => row !== null);\n const snapshots = await fetchSnapshots({\n context: options.context,\n identity: options.identity,\n });\n if (validLive.length === PROTECTED_EXECUTION_COUNTS.derivative_target_count) {\n const terminalProofs =\n options.proof.derivative_readback.proof_level === 'causal_terminal'\n ? options.proof.derivative_readback.targets\n : [];\n issues.push(\n ...matchLiveTargets({\n proofs: terminalProofs,\n live: validLive,\n snapshots,\n primaryClosure: options.proof.primary_readback?.closure,\n plan: options.plan,\n identity: options.identity,\n }),\n );\n }\n return {\n status: issues.length ? 'failed' : 'passed',\n issues,\n account_readback: {\n rows: account.rows,\n source_urls: account.source_urls,\n completeness: account.completeness,\n },\n derivative_readback: {\n rows: validLive,\n snapshots,\n source_urls: derivative.source_urls,\n },\n };\n}\n\nexport async function verifyProtectedExecution(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n context: DatasetMaintenanceRemoteContext;\n pageSize?: number;\n}): Promise<ProtectedVerificationResult> {\n return verifyProtectedExecutionWithDependencies(options, {\n fetchAccountRows: fetchMaintenanceAccountRows,\n fetchDerivativeRows: fetchMaintenanceDerivativeTargetRows,\n fetchSnapshots: fetchProtectedDerivativeSnapshots,\n });\n}\n\nexport const __testInternals = {\n expectedFinalRows,\n fetchProtectedDerivativeSnapshots,\n inspectProtectedLiveDerivative,\n matchLiveTargets,\n verifyAuditClosure,\n verifyFinalAccountRows,\n verifyStatusStructure,\n verifyTerminalTargets,\n verifyProtectedExecutionWithDependencies,\n};\n"]}
1	+ {"version":3,"file":"dataset-maintenance-protected-verify.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,GAMjC,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EACL,2BAA2B,EAC3B,kCAAkC,EAClC,oCAAoC,GAGrC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAmDjC,SAAS,KAAK,CAAC,IAAY,EAAE,OAAe,EAAE,OAAiB;IAC7D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,wBAAwB,GAAG,cAAc,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnF,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,qBAAqB,GAAG,cAAc,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC7E,IACE,CAAC,QAAQ;QACT,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC;QAC5F,CAAC,EAAE;QACH,CAAC,OAAO;QACR,KAAK,CAAC,SAAS,KAAK,IAAI;QACxB,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,KAAK,CAAC,YAAY,KAAK,IAAI;QAC3B,KAAK,CAAC,oBAAoB,KAAK,IAAI;QACnC,CAAC,wBAAwB;QACzB,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;QACtC,CAAC,cAAc;QACf,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;QAC5B,CAAC,qBAAqB;QACtB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACnC,KAAK,CAAC,KAAK,KAAK,IAAI,EACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE;QACF,OAAO;QACP,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,IAAI;QAClB,oBAAoB,EAAE,IAAI;QAC1B,2BAA2B,EAAE,wBAAwB;QACrD,gBAAgB,EAAE,cAAc;QAChC,wBAAwB,EAAE,qBAAqB;QAC/C,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,OAGnC;IACC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,IACE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC,SAAS,CACjF,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA0C;IAE1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,IACE,GAAG,CAAC,UAAU,KAAK,CAAC;QACpB,CAAC,WAAW;QACZ,CAAC,WAAW;QACZ,GAAG,CAAC,YAAY,KAAK,IAAI;QACzB,GAAG,CAAC,YAAY,KAAK,SAAS;QAC9B,CAAC,WAAW;QACZ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,CAAU;QACtB,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC;QAC5C,oBAAoB,EAAE,IAAI;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,eAAe,EAAE,WAAW;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAI1B;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBAClC,GAAG,OAAO;gBACV,YAAY,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC7C,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAG9B;IACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,KAAK,cAAc,CAAC;IAC9D,MAAM,kBAAkB,GACtB,KAAK,CAAC,cAAc,KAAK,CAAC;QAC1B,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC;YACzB,CAAC,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC,CAAC;IACzF,IACE,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACpE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,gFAAgF,EAChF,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAC7E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/F,MAAM,CAAC,IAAI,CACT,KAAK,CACH,uCAAuC,EACvC,+DAA+D,CAChE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,WAAW,CAAC;QACrE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;YACxB,CAAC,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,WAAW,CAAC,CAAC;QAClF,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe;YAC/B,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc,IAAI,KAAK,CAAC,gBAAgB,KAAK,eAAe,CAAC,CAAC;QAC5F,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CACtE,KAAK,CAAC,gBAAgB,CACvB,CAAC,CAAC;IACP,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,2EAA2E,EAC3E,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CACnE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrE,MAAM,gBAAgB,GACpB,KAAK,CAAC,UAAU,KAAK,CAAC;YACtB,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACxB,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC;YAC7B,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CACpF,CAAC;QACJ,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,KAAK,CACH,gCAAgC,EAChC,yEAAyE,EACzE,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;IAC/B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,yBAAyB,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC;QACtE,OAAO,aAAa,CAAC,EAAE,CAAC;QACxB,OAAO,aAAa,CAAC,SAAS,CAAC;QAC/B,OAAO,aAAa,CAAC,cAAc,CAAC;QACpC,OAAO,aAAa,CAAC,yBAAyB,CAAC;QAC/C,kBAAkB,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,aAAa,CAAC;IACnE,CAAC;IACD,IACE,CAAC,KAAK;QACN,KAAK,CAAC,SAAS,KAAK,0BAA0B,CAAC,YAAY;QAC3D,KAAK,CAAC,cAAc,KAAK,0BAA0B,CAAC,cAAc;QAClE,KAAK,CAAC,iBAAiB,KAAK,0BAA0B,CAAC,WAAW;QAClE,KAAK,CAAC,kBAAkB,KAAK,IAAI;QACjC,CAAC,YAAY,CAAC,OAAO,CAAC;QACtB,OAAO,CAAC,cAAc,KAAK,kCAAkC;QAC7D,OAAO,CAAC,EAAE,KAAK,IAAI;QACnB,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;QAC7C,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,WAAW;QAC9D,OAAO,CAAC,YAAY,KAAK,0BAA0B,CAAC,YAAY;QAChE,OAAO,CAAC,qBAAqB,KAAK,0BAA0B,CAAC,YAAY;QACzE,OAAO,CAAC,kBAAkB,KAAK,0BAA0B,CAAC,kBAAkB;QAC5E,OAAO,CAAC,UAAU,KAAK,0BAA0B,CAAC,UAAU;QAC5D,OAAO,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;QAClE,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,0BAA0B,KAAK,CAAC;QACxC,OAAO,CAAC,uBAAuB,KAAK,CAAC;QACrC,OAAO,CAAC,8BAA8B,KAAK,CAAC;QAC5C,OAAO,CAAC,oBAAoB,KAAK,CAAC;QAClC,OAAO,CAAC,qBAAqB,KAAK,CAAC;QACnC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QACvC,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,0BAA0B,CAAC,YAAY;QAC1E,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACxC,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QACrC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO,CAAC,SAAS,KAAK,0BAA0B,CAAC,YAAY;QAC7D,OAAO,CAAC,cAAc,KAAK,0BAA0B,CAAC,cAAc;QACpE,OAAO,CAAC,kBAAkB,KAAK,IAAI;QACnC,CAAC,kBAAkB,EACnB,CAAC;QACD,OAAO;YACL,KAAK,CACH,iCAAiC,EACjC,2FAA2F,EAC3F,KAAK,CACN;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsD;IAC/E,OAAO,GAAG,MAAM,CAAC,KAAK,SAAS,MAAM,CAAC,EAAE,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,qBAAqB,CAAC,OAG9B;IACC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAChD,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC9E,OAAO;YACL,KAAK,CACH,6CAA6C,EAC7C,kEAAkE,CACnE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IACE,KAAK,CAAC,cAAc,KAAK,4CAA4C;QACrE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU;QAC9C,KAAK,CAAC,MAAM,KAAK,WAAW;QAC5B,KAAK,CAAC,IAAI,KAAK,4BAA4B;QAC3C,KAAK,CAAC,qBAAqB,KAAK,IAAI;QACpC,KAAK,CAAC,YAAY,KAAK,0BAA0B,CAAC,uBAAuB;QACzE,KAAK,CAAC,UAAU,KAAK,0BAA0B,CAAC,UAAU;QAC1D,KAAK,CAAC,aAAa,KAAK,0BAA0B,CAAC,aAAa;QAChE,KAAK,CAAC,eAAe,KAAK,0BAA0B,CAAC,uBAAuB;QAC5E,KAAK,CAAC,iBAAiB,KAAK,CAAC;QAC7B,KAAK,CAAC,YAAY,KAAK,CAAC;QACxB,KAAK,CAAC,mBAAmB,KAAK,CAAC;QAC/B,OAAO,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB;QACrE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,uBAAuB;QACzE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACnD,0BAA0B,CAAC,uBAAuB,EACpD,CAAC;QACD,OAAO;YACL,KAAK,CACH,6CAA6C,EAC7C,mEAAmE,CACpE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IACE,CAAC,QAAQ;YACT,MAAM,CAAC,OAAO,KAAK,KAAK,GAAG,CAAC;YAC5B,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU;YACjD,MAAM,CAAC,+BAA+B,KAAK,QAAQ,CAAC,wBAAwB,EAC5E,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,+CAA+C,EAC/C,iEAAiE,EACjE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,MAAM,CAAC,KAAK;YACb,CAAC,MAAM,CAAC,yBAAyB;YACjC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;YAC7C,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC;YAC9C,MAAM,CAAC,yBAAyB,KAAK,MAAM,CAAC,wBAAwB;YACpE,CAAC,MAAM,CAAC,eAAe;YACvB,CAAC,MAAM,CAAC,yBAAyB;YACjC,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,MAAM,CAAC,gBAAgB;YACxB,CAAC,MAAM,CAAC,kBAAkB;YAC1B,CAAC,MAAM,CAAC,sBAAsB;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YAC1D,CAAC,MAAM,CAAC,qBAAqB,EAC7B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,0CAA0C,EAC1C,mGAAmG,EACnG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAK/B;IACC,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB;QACnC,CAAC,gCAAgC,CAC/B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAClC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAC9D,EACD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,qCAAqC,EACrC,mFAAmF,CACpF,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChE,IACE,YAAY,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QACrC,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACrD,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,gEAAgE,CACjE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,qBAAqB,EAAE,qCAAqC,EAAE,YAAY,CAAC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvE,IACE,CAAC,GAAG;YACJ,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,gBAAgB;YACvC,GAAG,CAAC,UAAU,KAAK,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC;YACpD,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ;YACxC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAC1D,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oCAAoC,EACpC,+DAA+D,EAC/D,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAChC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IACE,UAAU,CAAC,wCAAwC,CAAC,SAAS,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,0BAA0B,EACvC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,sCAAsC,EACtC,sEAAsE,CACvE,CACF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAOzB;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAC1E,CAAC;IACF,MAAM,eAAe,GAAG,0BAA0B,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,cAAc;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,MAAM,GAAiC,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IACE,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI;QACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;QAC5C,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI;QACzC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI;QAChD,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EACtE,CAAC;QACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,wCAAwC,EACxC,mGAAmG,CACpG,CACF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IACE,CAAC,GAAG;YACJ,CAAC,KAAK;YACN,CAAC,QAAQ;YACT,CAAC,MAAM,EAAE,eAAe;YACxB,CAAC,QAAQ;YACT,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YAC9C,GAAG,CAAC,UAAU,KAAK,CAAC;YACpB,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;YACnD,QAAQ,CAAC,UAAU,KAAK,CAAC;YACzB,GAAG,CAAC,mBAAmB,KAAK,MAAM,CAAC,eAAe,CAAC,MAAM;YACzD,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,2BAA2B;YAClE,QAAQ,CAAC,wBAAwB,KAAK,QAAQ,CAAC,2BAA2B;YAC1E,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,CAAC,2BAA2B;YACrE,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,yBAAyB;YAC5D,CAAC,QAAQ,CAAC,mBAAmB;YAC7B,CAAC,QAAQ,CAAC,mBAAmB;YAC7B,CAAC,QAAQ,CAAC,eAAe,EACzB,CAAC;YACD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,oCAAoC,EACpC,iFAAiF,EACjF,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAChE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,OAGhD;IACC,MAAM,SAAS,GAAkC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACpD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACnB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACzB,gCAAgC,CAC9B,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,EACF;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CACF,CACF,CACF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD,KAAK,UAAU,wCAAwC,CACrD,OAOC,EACD,YAA+C;IAE/C,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC/E,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ;YAC7E,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE;gBACN,KAAK,CACH,+BAA+B,EAC/B,gGAAgG,CACjG;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE;gBACN,KAAK,CACH,mCAAmC,EACnC,uFAAuF,EACvF,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,KAAK,CACH,4BAA4B,EAC5B,6DAA6D,EAC7D,OAAO,CAAC,KAAK,CAAC,OAAO,CACtB;aACF;YACD,gBAAgB,EAAE,IAAI;YACtB,mBAAmB,EAAE,IAAI;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;KAC/E,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,GAAG,sBAAsB,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,KAAK,CACH,mCAAmC,EACnC,yFAAyF,CAC1F,CACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAA0C,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,0BAA0B,CAAC,uBAAuB,EAAE,CAAC;QAC5E,MAAM,cAAc,GAClB,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,WAAW,KAAK,iBAAiB;YACjE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO;YAC3C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CACT,GAAG,gBAAgB,CAAC;YAClB,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO;YACvD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC3C,MAAM;QACN,gBAAgB,EAAE;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAO9C;IACC,OAAO,wCAAwC,CAAC,OAAO,EAAE;QACvD,gBAAgB,EAAE,2BAA2B;QAC7C,mBAAmB,EAAE,oCAAoC;QACzD,cAAc,EAAE,iCAAiC;KAClD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,iBAAiB;IACjB,iCAAiC;IACjC,8BAA8B;IAC9B,gBAAgB;IAChB,kBAAkB;IAClB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,wCAAwC;CACzC,CAAC","sourcesContent":["import { loadMaintenanceDesiredPayload } from './dataset-maintenance-alias-request.js';\nimport {\n isJsonObject,\n maintenanceRowKey,\n sha256Json,\n snapshotRemoteRow,\n type DatasetMaintenancePlan,\n type DatasetMaintenanceRemoteRow,\n} from './dataset-maintenance-contract.js';\nimport {\n PROTECTED_EXECUTION_COUNTS,\n parseProtectedDerivativeSnapshot,\n type ProtectedDerivativeSnapshot,\n type ProtectedExecutionIdentity,\n type ProtectedExecutionStatusProof,\n type ProtectedReportStatus,\n type ProtectedTerminalTargetProof,\n} from './dataset-maintenance-protected-contract.js';\nimport { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';\nimport { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';\nimport {\n fetchMaintenanceAccountRows,\n fetchMaintenanceDerivativeSnapshot,\n fetchMaintenanceDerivativeTargetRows,\n type DatasetMaintenanceDerivativeRemoteRow,\n type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\n\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nexport type ProtectedVerificationIssue = {\n code: string;\n message: string;\n details?: unknown;\n};\n\nexport type ProtectedLiveDerivativeReadback = {\n table: 'flows' \| 'processes';\n id: string;\n version: string;\n user_id: string;\n state_code: 0;\n json_ordered_sha256: string;\n extracted_md_present: true;\n embedding_ft_present: true;\n embedding_ft_at: string;\n};\n\ntype ProtectedPrimaryActionEvidence = {\n action_id: string;\n table: 'flowproperties' \| 'flows' \| 'processes';\n id: string;\n version: string;\n row_found: true;\n owner_matches: true;\n state_code_matches: true;\n json_matches: true;\n json_ordered_matches: true;\n desired_json_ordered_sha256: string;\n live_json_sha256: string;\n live_json_ordered_sha256: string;\n valid: true;\n};\n\nexport type ProtectedVerificationResult = {\n status: ProtectedReportStatus;\n issues: ProtectedVerificationIssue[];\n account_readback: {\n rows: DatasetMaintenanceRemoteRow[];\n source_urls: string[];\n completeness: unknown;\n } \| null;\n derivative_readback: {\n rows: ProtectedLiveDerivativeReadback[];\n snapshots: ProtectedDerivativeSnapshot[];\n source_urls: string[];\n } \| null;\n};\n\nfunction issue(code: string, message: string, details?: unknown): ProtectedVerificationIssue {\n return { code, message, ...(details === undefined ? {} : { details }) };\n}\n\nfunction requiredString(value: unknown): string \| null {\n return typeof value === 'string' && value.trim() ? value : null;\n}\n\nfunction parsePrimaryActionEvidence(value: unknown): ProtectedPrimaryActionEvidence \| null {\n if (!isJsonObject(value)) return null;\n const actionId = requiredString(value.action_id);\n const id = requiredString(value.id);\n const version = requiredString(value.version);\n const desiredJsonOrderedSha256 = requiredString(value.desired_json_ordered_sha256);\n const liveJsonSha256 = requiredString(value.live_json_sha256);\n const liveJsonOrderedSha256 = requiredString(value.live_json_ordered_sha256);\n if (\n !actionId \|\|\n (value.table !== 'flowproperties' && value.table !== 'flows' && value.table !== 'processes') \|\|\n !id \|\|\n !version \|\|\n value.row_found !== true \|\|\n value.owner_matches !== true \|\|\n value.state_code_matches !== true \|\|\n value.json_matches !== true \|\|\n value.json_ordered_matches !== true \|\|\n !desiredJsonOrderedSha256 \|\|\n !SHA256.test(desiredJsonOrderedSha256) \|\|\n !liveJsonSha256 \|\|\n !SHA256.test(liveJsonSha256) \|\|\n !liveJsonOrderedSha256 \|\|\n !SHA256.test(liveJsonOrderedSha256) \|\|\n value.valid !== true\n ) {\n return null;\n }\n return {\n action_id: actionId,\n table: value.table,\n id,\n version,\n row_found: true,\n owner_matches: true,\n state_code_matches: true,\n json_matches: true,\n json_ordered_matches: true,\n desired_json_ordered_sha256: desiredJsonOrderedSha256,\n live_json_sha256: liveJsonSha256,\n live_json_ordered_sha256: liveJsonOrderedSha256,\n valid: true,\n };\n}\n\nfunction indexPrimaryActionEvidence(options: {\n closure: unknown;\n plan: DatasetMaintenancePlan;\n}): Map<string, ProtectedPrimaryActionEvidence> \| null {\n if (!isJsonObject(options.closure) \|\| !Array.isArray(options.closure.action_evidence)) {\n return null;\n }\n if (options.closure.action_evidence.length !== options.plan.actions.length) return null;\n const byKey = new Map<string, ProtectedPrimaryActionEvidence>();\n const actionIds = new Set<string>();\n for (const raw of options.closure.action_evidence) {\n const evidence = parsePrimaryActionEvidence(raw);\n if (!evidence) return null;\n const key = maintenanceRowKey(evidence);\n if (byKey.has(key) \|\| actionIds.has(evidence.action_id)) return null;\n byKey.set(key, evidence);\n actionIds.add(evidence.action_id);\n }\n if (\n options.plan.actions.some(\n (action) => byKey.get(maintenanceRowKey(action))?.action_id !== action.action_id,\n )\n ) {\n return null;\n }\n return byKey;\n}\n\nexport function inspectProtectedLiveDerivative(\n row: DatasetMaintenanceDerivativeRemoteRow,\n): ProtectedLiveDerivativeReadback \| null {\n const raw = row.raw;\n const jsonOrdered = isJsonObject(raw.json_ordered) ? raw.json_ordered : null;\n const extractedMd = requiredString(raw.extracted_md);\n const embeddingAt = requiredString(raw.embedding_ft_at);\n if (\n row.state_code !== 0 \|\|\n !jsonOrdered \|\|\n !extractedMd \|\|\n raw.embedding_ft === null \|\|\n raw.embedding_ft === undefined \|\|\n !embeddingAt \|\|\n !Number.isFinite(Date.parse(embeddingAt))\n ) {\n return null;\n }\n return {\n table: row.table,\n id: row.id,\n version: row.version,\n user_id: row.user_id,\n state_code: 0 as const,\n json_ordered_sha256: sha256Json(jsonOrdered),\n extracted_md_present: true,\n embedding_ft_present: true,\n embedding_ft_at: embeddingAt,\n };\n}\n\nfunction expectedFinalRows(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n rows: DatasetMaintenanceRemoteRow[];\n}): DatasetMaintenanceRemoteRow[] {\n const rows = new Map(options.rows.map((row) => [maintenanceRowKey(row), { ...row }]));\n for (const action of options.plan.actions) {\n const current = rows.get(maintenanceRowKey(action));\n if (current) {\n rows.set(maintenanceRowKey(action), {\n ...current,\n json_ordered: loadMaintenanceDesiredPayload(options.planDir, action),\n });\n }\n }\n return [...rows.values()].sort((left, right) =>\n maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)),\n );\n}\n\nfunction verifyStatusStructure(options: {\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n}): ProtectedVerificationIssue[] {\n const { identity, proof } = options;\n const issues: ProtectedVerificationIssue[] = [];\n const notAdmitted = proof.execution_status === 'not_admitted';\n const dispatchCountValid =\n proof.dispatch_count === 1 \|\|\n (proof.dispatch_count === 0 &&\n (proof.execution_status === 'failed' \|\| proof.execution_status === 'indeterminate'));\n if (\n (notAdmitted && (proof.attempt_count !== 0 \|\| proof.dispatch_count !== 0)) \|\|\n (!notAdmitted && (proof.attempt_count !== 1 \|\| !dispatchCountValid))\n ) {\n issues.push(\n issue(\n 'PROTECTED_ATTEMPT_DISPATCH_COUNT_INVALID',\n 'Database did not prove the one-attempt, at-most-one-dispatch execution policy.',\n { attempt_count: proof.attempt_count, dispatch_count: proof.dispatch_count },\n ),\n );\n }\n if (proof.plan_sha256 !== identity.plan_sha256 \|\| proof.operation_id !== identity.operation_id) {\n issues.push(\n issue(\n 'PROTECTED_EXECUTION_IDENTITY_MISMATCH',\n 'Database status does not round-trip the sealed plan identity.',\n ),\n );\n }\n const categoryMatches =\n (proof.status === 'passed' && proof.execution_status === 'completed') \|\|\n (proof.status === 'failed' &&\n (proof.execution_status === 'failed' \|\| proof.execution_status === 'completed')) \|\|\n (proof.status === 'indeterminate' &&\n (proof.execution_status === 'not_admitted' \|\| proof.execution_status === 'indeterminate')) \|\|\n (proof.status === 'pending' &&\n ['dispatching', 'dispatched', 'running', 'derivatives_pending'].includes(\n proof.execution_status,\n ));\n if (!categoryMatches) {\n issues.push(\n issue(\n 'PROTECTED_STATUS_CATEGORY_INVALID',\n 'Database status category is inconsistent with its execution ledger state.',\n { status: proof.status, execution_status: proof.execution_status },\n ),\n );\n }\n if (!notAdmitted) {\n const gateNames = proof.gates.map((gate) => gate.gate);\n const receiptHashes = proof.gates.map((gate) => gate.receipt_sha256);\n const gateClosureValid =\n proof.gate_count === 3 &&\n proof.gates.length === 3 &&\n new Set(gateNames).size === 3 &&\n new Set(receiptHashes).size === 3 &&\n proof.gates.every(\n (gate) => gate.observed_sha256 === gate.expected_sha256 && gate.status === 'passed',\n );\n if (!gateClosureValid) {\n issues.push(\n issue(\n 'PROTECTED_GATE_CLOSURE_INVALID',\n 'Database did not round-trip three unique server-captured gate receipts.',\n proof.gates,\n ),\n );\n }\n }\n return issues;\n}\n\nfunction verifyAuditClosure(proof: ProtectedExecutionStatusProof): ProtectedVerificationIssue[] {\n const audit = proof.primary_readback;\n const closure = audit?.closure;\n let closureHashMatches = false;\n if (isJsonObject(closure) && typeof closure.live_closure_proof_sha256 === 'string') {\n const proofMaterial = { ...closure };\n const closureSha256 = String(proofMaterial.live_closure_proof_sha256);\n delete proofMaterial.ok;\n delete proofMaterial.row_count;\n delete proofMaterial.exchange_count;\n delete proofMaterial.live_closure_proof_sha256;\n closureHashMatches = sha256Json(proofMaterial) === closureSha256;\n }\n if (\n !audit \|\|\n audit.row_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n audit.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count \|\|\n audit.alias_audit_count !== PROTECTED_EXECUTION_COUNTS.audit_count \|\|\n audit.live_closure_proof !== true \|\|\n !isJsonObject(closure) \|\|\n closure.schema_version !== 'dataset-alias-primary-closure.v1' \|\|\n closure.ok !== true \|\|\n closure.actor_user_id !== proof.actor_user_id \|\|\n closure.batch_count !== PROTECTED_EXECUTION_COUNTS.batch_count \|\|\n closure.action_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.distinct_action_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.flowproperty_count !== PROTECTED_EXECUTION_COUNTS.flowproperty_count \|\|\n closure.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count \|\|\n closure.process_count !== PROTECTED_EXECUTION_COUNTS.process_count \|\|\n closure.support_reference_count !== 6 \|\|\n closure.flowproperty_support_count !== 2 \|\|\n closure.unitgroup_support_count !== 2 \|\|\n closure.source_unitgroup_support_count !== 2 \|\|\n closure.invalid_action_count !== 0 \|\|\n closure.invalid_support_count !== 0 \|\|\n !Array.isArray(closure.action_evidence) \|\|\n closure.action_evidence.length !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.action_evidence.some((entry) => !isJsonObject(entry)) \|\|\n !Array.isArray(closure.support_evidence) \|\|\n closure.support_evidence.length !== 6 \|\|\n closure.support_evidence.some((entry) => !isJsonObject(entry)) \|\|\n closure.row_count !== PROTECTED_EXECUTION_COUNTS.action_count \|\|\n closure.exchange_count !== PROTECTED_EXECUTION_COUNTS.exchange_count \|\|\n closure.live_closure_proof !== true \|\|\n !closureHashMatches\n ) {\n return [\n issue(\n 'PROTECTED_AUDIT_CLOSURE_INVALID',\n 'Terminal execution did not prove the exact 52-row, 59-exchange, 55-audit primary closure.',\n audit,\n ),\n ];\n }\n return [];\n}\n\nfunction terminalTargetKey(target: { table: string; id: string; version: string }): string {\n return `${target.table}\\u0000${target.id}\\u0000${target.version}`;\n}\n\nfunction verifyTerminalTargets(options: {\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n}): ProtectedVerificationIssue[] {\n const issues: ProtectedVerificationIssue[] = [];\n const batch = options.proof.derivative_readback;\n if (batch.proof_level !== 'causal_terminal' \|\| batch.proof_deferred !== false) {\n return [\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID',\n 'Terminal proof must use the full causal-terminal evidence level.',\n ),\n ];\n }\n const targets = batch.targets;\n const keys = targets.map(terminalTargetKey);\n if (\n batch.schema_version !== 'dataset-derivative-rebuild-batch-status.v1' \|\|\n batch.batch_id !== options.identity.request_id \|\|\n batch.status !== 'completed' \|\|\n batch.code !== 'DERIVATIVE_BATCH_COMPLETED' \|\|\n batch.causal_terminal_proof !== true \|\|\n batch.target_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n batch.flow_count !== PROTECTED_EXECUTION_COUNTS.flow_count \|\|\n batch.process_count !== PROTECTED_EXECUTION_COUNTS.process_count \|\|\n batch.completed_count !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n batch.nonterminal_count !== 0 \|\|\n batch.failed_count !== 0 \|\|\n batch.invalid_proof_count !== 0 \|\|\n targets.length !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n new Set(keys).size !== PROTECTED_EXECUTION_COUNTS.derivative_target_count \|\|\n new Set(targets.map((target) => target.ordinal)).size !==\n PROTECTED_EXECUTION_COUNTS.derivative_target_count\n ) {\n return [\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_CLOSURE_INVALID',\n 'Terminal proof must contain exactly 50 unique derivative targets.',\n ),\n ];\n }\n const frozen = new Map(\n options.identity.derivative_targets.map((target) => [terminalTargetKey(target), target]),\n );\n for (const [index, target] of targets.entries()) {\n const expected = frozen.get(terminalTargetKey(target));\n if (\n !expected \|\|\n target.ordinal !== index + 1 \|\|\n target.request_id === options.identity.request_id \|\|\n target.source_baseline_snapshot_sha256 !== expected.baseline_snapshot_sha256\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_IDENTITY_MISMATCH',\n 'Terminal derivative proof contains a foreign or changed target.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n continue;\n }\n if (\n target.status !== 'completed' \|\|\n !target.phase \|\|\n !target.completed_snapshot_sha256 \|\|\n !SHA256.test(target.expected_snapshot_sha256) \|\|\n !SHA256.test(target.completed_snapshot_sha256) \|\|\n target.completed_snapshot_sha256 === target.expected_snapshot_sha256 \|\|\n !target.primary_matches \|\|\n !target.terminal_snapshot_matches \|\|\n !target.proposals_committed \|\|\n !target.derivative_fresh \|\|\n !target.lifecycle_complete \|\|\n !target.terminal_audit_present \|\|\n Object.values(target.residue).some((count) => count !== 0) \|\|\n !target.causal_terminal_proof\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_TARGET_NOT_TERMINAL',\n 'Derivative target lacks causal completed/live equality or retains queue, failure, or fence state.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n }\n }\n return issues;\n}\n\nfunction verifyFinalAccountRows(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n rows: DatasetMaintenanceRemoteRow[];\n completeness: unknown;\n}): ProtectedVerificationIssue[] {\n const issues: ProtectedVerificationIssue[] = [];\n if (\n !options.plan.snapshot_completeness \|\|\n !isSnapshotCompletenessCompatible(\n options.completeness,\n options.plan.snapshot_completeness,\n Object.keys(options.plan.snapshot_completeness.entity_counts),\n )\n ) {\n issues.push(\n issue(\n 'PROTECTED_FINAL_SNAPSHOT_INCOMPLETE',\n 'Final RLS account scan does not prove the same complete table census as the plan.',\n ),\n );\n return issues;\n }\n const expectedKeys = new Set([\n ...options.plan.actions.map(maintenanceRowKey),\n ...options.plan.protected_rows.map(maintenanceRowKey),\n ]);\n const actualKeys = new Set(options.rows.map(maintenanceRowKey));\n if (\n expectedKeys.size !== actualKeys.size \|\|\n [...expectedKeys].some((key) => !actualKeys.has(key))\n ) {\n issues.push(\n issue(\n 'PROTECTED_FINAL_ACCOUNT_CENSUS_DRIFT',\n 'Final RLS account rows contain missing or unexpected entities.',\n ),\n );\n }\n const current = new Map(options.rows.map((row) => [maintenanceRowKey(row), row]));\n for (const protectedRow of options.plan.protected_rows) {\n const row = current.get(maintenanceRowKey(protectedRow));\n if (!row \|\| snapshotRemoteRow(row).row_sha256 !== protectedRow.row_sha256) {\n issues.push(\n issue('PROTECTED_ROW_DRIFT', 'A protected non-action row changed.', protectedRow),\n );\n }\n }\n for (const action of options.plan.actions) {\n const row = current.get(maintenanceRowKey(action));\n const desired = loadMaintenanceDesiredPayload(options.planDir, action);\n if (\n !row \|\|\n row.user_id !== action.expected_user_id \|\|\n row.state_code !== 0 \|\|\n sha256Json(row.json_ordered) !== sha256Json(desired) \|\|\n row.model_id !== action.before?.model_id \|\|\n row.rule_verification !== action.before?.rule_verification\n ) {\n issues.push(\n issue(\n 'PROTECTED_ACTION_READBACK_MISMATCH',\n 'An action row does not match the desired owner-draft payload.',\n { action_id: action.action_id },\n ),\n );\n }\n }\n const projected = expectedFinalRows({\n plan: options.plan,\n planDir: options.planDir,\n rows: options.rows,\n });\n if (\n sha256Json(maintenanceProjectedReferenceFingerprint(projected)) !==\n options.plan.projected_reference_sha256\n ) {\n issues.push(\n issue(\n 'PROTECTED_REFERENCE_CLOSURE_MISMATCH',\n 'Final reference closure does not match the frozen projected closure.',\n ),\n );\n }\n return issues;\n}\n\nfunction matchLiveTargets(options: {\n proofs: ProtectedTerminalTargetProof[];\n live: ProtectedLiveDerivativeReadback[];\n snapshots: ProtectedDerivativeSnapshot[];\n primaryClosure: unknown;\n plan: DatasetMaintenancePlan;\n identity: ProtectedExecutionIdentity;\n}): ProtectedVerificationIssue[] {\n const proofs = new Map(options.proofs.map((proof) => [terminalTargetKey(proof), proof]));\n const snapshots = new Map(\n options.snapshots.map((snapshot) => [terminalTargetKey(snapshot), snapshot]),\n );\n const live = new Map(options.live.map((row) => [terminalTargetKey(row), row]));\n const actions = new Map(\n options.plan.actions.map((action) => [maintenanceRowKey(action), action]),\n );\n const primaryEvidence = indexPrimaryActionEvidence({\n closure: options.primaryClosure,\n plan: options.plan,\n });\n const issues: ProtectedVerificationIssue[] = [];\n const expectedKeys = new Set(options.identity.derivative_targets.map(terminalTargetKey));\n const liveKeys = options.live.map(terminalTargetKey);\n const snapshotKeys = options.snapshots.map(terminalTargetKey);\n if (\n liveKeys.length !== expectedKeys.size \|\|\n new Set(liveKeys).size !== expectedKeys.size \|\|\n snapshotKeys.length !== expectedKeys.size \|\|\n new Set(snapshotKeys).size !== expectedKeys.size \|\|\n [...expectedKeys].some((key) => !live.has(key) \|\| !snapshots.has(key))\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_SET_MISMATCH',\n 'Independent derivative rows and snapshots must be unique and exactly match all 50 frozen targets.',\n ),\n );\n }\n for (const target of options.identity.derivative_targets) {\n const key = terminalTargetKey(target);\n const row = live.get(key);\n const proof = proofs.get(key);\n const snapshot = snapshots.get(key);\n const action = actions.get(key);\n const evidence = primaryEvidence?.get(key);\n if (\n !row \|\|\n !proof \|\|\n !snapshot \|\|\n !action?.desired_payload \|\|\n !evidence \|\|\n row.user_id !== options.identity.actor.user_id \|\|\n row.state_code !== 0 \|\|\n snapshot.user_id !== options.identity.actor.user_id \|\|\n snapshot.state_code !== 0 \|\|\n row.json_ordered_sha256 !== action.desired_payload.sha256 \|\|\n evidence.live_json_sha256 !== evidence.desired_json_ordered_sha256 \|\|\n evidence.live_json_ordered_sha256 !== evidence.desired_json_ordered_sha256 \|\|\n snapshot.json_ordered_sha256 !== evidence.desired_json_ordered_sha256 \|\|\n snapshot.snapshot_sha256 !== proof.completed_snapshot_sha256 \|\|\n !snapshot.extracted_md_sha256 \|\|\n !snapshot.embedding_ft_sha256 \|\|\n !snapshot.embedding_ft_at\n ) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_MISMATCH',\n 'Independent RLS derivative readback does not match the terminal database proof.',\n { table: target.table, id: target.id, version: target.version },\n ),\n );\n }\n }\n return issues;\n}\n\nasync function fetchProtectedDerivativeSnapshots(options: {\n context: DatasetMaintenanceRemoteContext;\n identity: ProtectedExecutionIdentity;\n}): Promise<ProtectedDerivativeSnapshot[]> {\n const snapshots: ProtectedDerivativeSnapshot[] = [];\n const targets = options.identity.derivative_targets;\n for (let offset = 0; offset < targets.length; offset += 5) {\n const chunk = targets.slice(offset, offset + 5);\n snapshots.push(\n ...(await Promise.all(\n chunk.map(async (target) =>\n parseProtectedDerivativeSnapshot(\n await fetchMaintenanceDerivativeSnapshot({\n context: options.context,\n table: target.table,\n id: target.id,\n version: target.version,\n }),\n {\n table: target.table,\n id: target.id,\n version: target.version,\n userId: target.user_id,\n },\n ),\n ),\n )),\n );\n }\n return snapshots;\n}\n\ntype ProtectedVerificationDependencies = {\n fetchAccountRows: typeof fetchMaintenanceAccountRows;\n fetchDerivativeRows: typeof fetchMaintenanceDerivativeTargetRows;\n fetchSnapshots: typeof fetchProtectedDerivativeSnapshots;\n};\n\nasync function verifyProtectedExecutionWithDependencies(\n options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n context: DatasetMaintenanceRemoteContext;\n pageSize?: number;\n },\n dependencies: ProtectedVerificationDependencies,\n): Promise<ProtectedVerificationResult> {\n const { fetchAccountRows, fetchDerivativeRows, fetchSnapshots } = dependencies;\n const structuralIssues = verifyStatusStructure({\n identity: options.identity,\n proof: options.proof,\n });\n if (structuralIssues.length) {\n return {\n status: options.proof.status === 'indeterminate' ? 'indeterminate' : 'failed',\n issues: structuralIssues,\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.execution_status === 'not_admitted') {\n return {\n status: 'indeterminate',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_NOT_FOUND',\n 'The server has a protected preflight but no admitted execution; admission must not be retried.',\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.status === 'pending') {\n return { status: 'pending', issues: [], account_readback: null, derivative_readback: null };\n }\n if (options.proof.status === 'indeterminate') {\n return {\n status: 'indeterminate',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_INDETERMINATE',\n 'Database reported an indeterminate terminal execution; admission must not be retried.',\n options.proof.failure,\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n if (options.proof.status === 'failed') {\n return {\n status: 'failed',\n issues: [\n issue(\n 'PROTECTED_EXECUTION_FAILED',\n 'Database reported a definitive protected execution failure.',\n options.proof.failure,\n ),\n ],\n account_readback: null,\n derivative_readback: null,\n };\n }\n\n const issues = [\n ...verifyAuditClosure(options.proof),\n ...verifyTerminalTargets({ identity: options.identity, proof: options.proof }),\n ];\n if (issues.length) {\n return { status: 'failed', issues, account_readback: null, derivative_readback: null };\n }\n const account = await fetchAccountRows({\n context: options.context,\n userId: options.identity.actor.user_id,\n pageSize: options.pageSize,\n });\n issues.push(\n ...verifyFinalAccountRows({\n plan: options.plan,\n planDir: options.planDir,\n rows: account.rows,\n completeness: account.completeness,\n }),\n );\n const derivative = await fetchDerivativeRows({\n context: options.context,\n targets: options.identity.derivative_targets,\n });\n const live = derivative.rows.map(inspectProtectedLiveDerivative);\n if (live.some((row) => row === null)) {\n issues.push(\n issue(\n 'PROTECTED_DERIVATIVE_LIVE_INVALID',\n 'A live derivative row lacks primary JSON, extracted markdown, embedding, or timestamps.',\n ),\n );\n }\n const validLive = live.filter((row): row is ProtectedLiveDerivativeReadback => row !== null);\n const snapshots = await fetchSnapshots({\n context: options.context,\n identity: options.identity,\n });\n if (validLive.length === PROTECTED_EXECUTION_COUNTS.derivative_target_count) {\n const terminalProofs =\n options.proof.derivative_readback.proof_level === 'causal_terminal'\n ? options.proof.derivative_readback.targets\n : [];\n issues.push(\n ...matchLiveTargets({\n proofs: terminalProofs,\n live: validLive,\n snapshots,\n primaryClosure: options.proof.primary_readback?.closure,\n plan: options.plan,\n identity: options.identity,\n }),\n );\n }\n return {\n status: issues.length ? 'failed' : 'passed',\n issues,\n account_readback: {\n rows: account.rows,\n source_urls: account.source_urls,\n completeness: account.completeness,\n },\n derivative_readback: {\n rows: validLive,\n snapshots,\n source_urls: derivative.source_urls,\n },\n };\n}\n\nexport async function verifyProtectedExecution(options: {\n plan: DatasetMaintenancePlan;\n planDir: string;\n identity: ProtectedExecutionIdentity;\n proof: ProtectedExecutionStatusProof;\n context: DatasetMaintenanceRemoteContext;\n pageSize?: number;\n}): Promise<ProtectedVerificationResult> {\n return verifyProtectedExecutionWithDependencies(options, {\n fetchAccountRows: fetchMaintenanceAccountRows,\n fetchDerivativeRows: fetchMaintenanceDerivativeTargetRows,\n fetchSnapshots: fetchProtectedDerivativeSnapshots,\n });\n}\n\nexport const __testInternals = {\n expectedFinalRows,\n fetchProtectedDerivativeSnapshots,\n inspectProtectedLiveDerivative,\n matchLiveTargets,\n verifyAuditClosure,\n verifyFinalAccountRows,\n verifyStatusStructure,\n verifyTerminalTargets,\n verifyProtectedExecutionWithDependencies,\n};\n"]}