@tiangong-lca/pcr 0.3.1 → 0.4.0

package/packages/pcr-core/src/read-context.js

@@ -0,0 +1,421 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants as fsConstants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, } from "node:fs";
+import path from "node:path";
+import { PCR_ID_ALIAS_REGISTRY_PATH, pcrIdAliasValidationDependencies, pcrIdAliasSourcePcrPathStates, readPcrIdAliases, } from "./pcr-id-aliases.js";
+import { parseYaml } from "./yaml-lite.js";
+function record(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function field(value, key) {
+    if (value === null || (typeof value !== 'object' && typeof value !== 'function'))
+        return undefined;
+    const result = Reflect.get(value, key);
+    return result;
+}
+const CATALOG_PATH = "library/catalog.yaml";
+const MANAGED_READ_FLAGS = fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK;
+const contextBindings = new WeakMap();
+const contextAliasDependencyPaths = new WeakMap();
+const contextAliasSourcePathStates = new WeakMap();
+const contextSessions = new WeakMap();
+const contextCatalogs = new WeakMap();
+const contextObservers = new WeakMap();
+export class PcrReadContextStaleError extends Error {
+    code;
+    details;
+    constructor({ root, source, reason }) {
+        super(`PCR read context is stale for ${source}: ${reason}.`);
+        this.name = "PcrReadContextStaleError";
+        this.code = "PCR_READ_CONTEXT_STALE";
+        this.details = { root, source, reason };
+    }
+}
+/**
+ * Bind repeated PCR reads to one validated repository state. The context is
+ * deliberately independent from the process-global catalog cache: callers
+ * may retain it only while all catalog-declared inputs remain byte-identical.
+ */
+export function createPcrReadContext({ root, onAliasValidation = null, beforeAliasValidation = null, onBindingCheck = null, onCatalogSnapshot = null, onPcrArtifactRead = null, beforeBoundSourceOpen = null, }) {
+    const rootPath = canonicalRoot(root);
+    const catalogSource = readRepositoryFile({ root: rootPath, relativePath: CATALOG_PATH });
+    const catalog = parseCatalog(catalogSource.text, rootPath);
+    const dependencyPaths = catalogDependencyPaths(catalog, rootPath);
+    const aliasDependencyPathsBefore = pcrIdAliasValidationDependencies({ root: rootPath });
+    const aliasSourcePathStatesBefore = pcrIdAliasSourcePcrPathStates({ root: rootPath });
+    const boundPaths = [CATALOG_PATH, ...dependencyPaths, ...aliasDependencyPathsBefore];
+    const bindingsBefore = captureBindings({
+        root: rootPath,
+        relativePaths: boundPaths,
+        beforeBoundSourceOpen,
+    });
+    if (bindingsBefore.get(CATALOG_PATH) !== catalogSource.sha256) {
+        throw new PcrReadContextStaleError({
+            root: rootPath,
+            source: CATALOG_PATH,
+            reason: "catalog changed after its dependency declarations were read",
+        });
+    }
+    const aliasFingerprintBefore = aliasInputFingerprint({
+        bindings: bindingsBefore,
+        aliasDependencyPaths: aliasDependencyPathsBefore,
+        aliasSourcePathStates: aliasSourcePathStatesBefore,
+    });
+    // A new context establishes semantic validity once from its bound repository.
+    // Session reuse below keeps that result private and rechecks all dependencies;
+    // no caller or persisted snapshot can manufacture validation authority.
+    beforeAliasValidation?.({ root: rootPath });
+    const aliases = readPcrIdAliases({ root: rootPath });
+    onAliasValidation?.({ root: rootPath, aliases: deepFreeze(structuredClone(aliases)) });
+    const aliasDependencyPathsAfter = pcrIdAliasValidationDependencies({ root: rootPath });
+    const aliasSourcePathStatesAfter = pcrIdAliasSourcePcrPathStates({ root: rootPath });
+    if (!sameStrings(aliasDependencyPathsBefore, aliasDependencyPathsAfter)) {
+        throw new PcrReadContextStaleError({
+            root: rootPath,
+            source: PCR_ID_ALIAS_REGISTRY_PATH,
+            reason: "alias validation dependencies changed while aliases were validated",
+        });
+    }
+    if (!sameRecords(aliasSourcePathStatesBefore, aliasSourcePathStatesAfter)) {
+        throw new PcrReadContextStaleError({
+            root: rootPath,
+            source: PCR_ID_ALIAS_REGISTRY_PATH,
+            reason: "alias source PCR path states changed while aliases were validated",
+        });
+    }
+    const bindingsAfter = captureBindings({
+        root: rootPath,
+        relativePaths: boundPaths,
+        beforeBoundSourceOpen,
+    });
+    assertBindingSnapshotsMatch({ root: rootPath, before: bindingsBefore, after: bindingsAfter });
+    if (aliasInputFingerprint({
+        bindings: bindingsAfter,
+        aliasDependencyPaths: aliasDependencyPathsAfter,
+        aliasSourcePathStates: aliasSourcePathStatesAfter,
+    }) !== aliasFingerprintBefore) {
+        throw new PcrReadContextStaleError({
+            root: rootPath,
+            source: PCR_ID_ALIAS_REGISTRY_PATH,
+            reason: "alias reuse inputs changed while the read context was created",
+        });
+    }
+    const aliasByPcrId = new Map();
+    for (const alias of aliases) {
+        aliasByPcrId.set(String(alias?.source_pcr_id), deepFreeze(structuredClone(alias)));
+    }
+    const immutableAliases = deepFreeze([...aliasByPcrId.values()].map((alias) => structuredClone(alias)));
+    const context = {
+        root: rootPath,
+        aliases: immutableAliases,
+        findPcrIdAlias(pcrId, { root: requestedRoot = rootPath } = {}) {
+            assertPcrReadContextFresh({ context, root: requestedRoot });
+            const alias = aliasByPcrId.get(String(pcrId));
+            return alias ? structuredClone(alias) : null;
+        },
+    };
+    Object.defineProperty(context, "_pcrReadContext", { value: true });
+    contextBindings.set(context, bindingsAfter);
+    contextAliasDependencyPaths.set(context, aliasDependencyPathsAfter);
+    contextAliasSourcePathStates.set(context, aliasSourcePathStatesAfter);
+    contextObservers.set(context, { onBindingCheck, onCatalogSnapshot, onPcrArtifactRead });
+    return Object.freeze(context);
+}
+export function pcrReadContextAliasInputFingerprint({ root }) {
+    const rootPath = canonicalRoot(root);
+    const dependencyPaths = pcrIdAliasValidationDependencies({ root: rootPath });
+    const sourcePathStates = pcrIdAliasSourcePcrPathStates({ root: rootPath });
+    const bindings = captureBindings({
+        root: rootPath,
+        relativePaths: [CATALOG_PATH, ...dependencyPaths],
+    });
+    return aliasInputFingerprint({
+        bindings,
+        aliasDependencyPaths: dependencyPaths,
+        aliasSourcePathStates: sourcePathStates,
+    });
+}
+export function isPcrReadContext(value) {
+    return Boolean(record(value) && value._pcrReadContext === true &&
+        typeof value.root === "string" &&
+        contextBindings.has(value));
+}
+export function assertPcrReadContextFresh({ context, root }) {
+    if (!isPcrReadContext(context)) {
+        throw new TypeError("context must be created by createPcrReadContext");
+    }
+    let canonicalRequestedRoot;
+    try {
+        canonicalRequestedRoot = canonicalRoot(root ?? context.root);
+    }
+    catch {
+        throw new PcrReadContextStaleError({
+            root: context.root,
+            source: CATALOG_PATH,
+            reason: "requested root is unavailable",
+        });
+    }
+    if (canonicalRequestedRoot !== context.root) {
+        throw new PcrReadContextStaleError({
+            root: context.root,
+            source: CATALOG_PATH,
+            reason: "context belongs to another repository root",
+        });
+    }
+    if (contextSessions.get(context)?.root === context.root) {
+        return context;
+    }
+    contextObservers.get(context)?.onBindingCheck?.({ root: context.root });
+    let currentAliasDependencyPaths;
+    try {
+        currentAliasDependencyPaths = pcrIdAliasValidationDependencies({ root: context.root });
+    }
+    catch {
+        throw new PcrReadContextStaleError({
+            root: context.root,
+            source: PCR_ID_ALIAS_REGISTRY_PATH,
+            reason: "alias validation dependencies are unavailable",
+        });
+    }
+    if (!sameStrings(contextAliasDependencyPaths.get(context) ?? [], currentAliasDependencyPaths)) {
+        throw new PcrReadContextStaleError({
+            root: context.root,
+            source: PCR_ID_ALIAS_REGISTRY_PATH,
+            reason: "alias validation dependency set changed",
+        });
+    }
+    const currentAliasSourcePathStates = pcrIdAliasSourcePcrPathStates({ root: context.root });
+    if (!sameRecords(contextAliasSourcePathStates.get(context) ?? [], currentAliasSourcePathStates)) {
+        throw new PcrReadContextStaleError({
+            root: context.root,
+            source: PCR_ID_ALIAS_REGISTRY_PATH,
+            reason: "alias source PCR path state changed",
+        });
+    }
+    for (const [relativePath, expectedSha256] of contextBindings.get(context) ?? []) {
+        let actualSha256;
+        try {
+            actualSha256 = readRepositoryFile({ root: context.root, relativePath }).sha256;
+        }
+        catch {
+            throw new PcrReadContextStaleError({
+                root: context.root,
+                source: relativePath,
+                reason: "bound source is unavailable",
+            });
+        }
+        if (actualSha256 !== expectedSha256) {
+            throw new PcrReadContextStaleError({
+                root: context.root,
+                source: relativePath,
+                reason: "exact-byte fingerprint changed",
+            });
+        }
+    }
+    return context;
+}
+export function withPcrReadContextSession({ context, root, read }) {
+    assertPcrReadContextFresh({ context, root });
+    const active = contextSessions.get(context);
+    if (active) {
+        active.depth += 1;
+        try {
+            return readSynchronously(read);
+        }
+        finally {
+            active.depth -= 1;
+        }
+    }
+    const session = { root: context.root, depth: 1 };
+    contextSessions.set(context, session);
+    try {
+        return readSynchronously(read);
+    }
+    finally {
+        contextSessions.delete(context);
+        assertPcrReadContextFresh({ context, root });
+    }
+}
+export function getPcrReadContextCatalog({ context, root, readCatalog }) {
+    assertPcrReadContextFresh({ context, root });
+    if (!contextCatalogs.has(context)) {
+        const entries = readCatalog(context.root);
+        const entriesById = new Map(entries.map((entry) => [entry.id, structuredClone(entry)]));
+        contextCatalogs.set(context, entriesById);
+        contextObservers.get(context)?.onCatalogSnapshot?.({
+            root: context.root,
+            entryCount: entriesById.size,
+        });
+    }
+    const catalog = contextCatalogs.get(context);
+    if (!catalog)
+        throw new Error("Missing context catalog snapshot");
+    return catalog;
+}
+export function observePcrReadContextArtifactRead({ context, root, relativePath }) {
+    assertPcrReadContextFresh({ context, root });
+    contextObservers.get(context)?.onPcrArtifactRead?.({
+        root: context.root,
+        relative_path: String(relativePath),
+    });
+}
+export function findPcrIdAliasInReadContext({ context, root, pcrId }) {
+    assertPcrReadContextFresh({ context, root });
+    return context.findPcrIdAlias(pcrId);
+}
+function canonicalRoot(root) {
+    const resolved = path.resolve(root);
+    const stats = lstatSync(resolved);
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        throw new Error(`PCR repository root is not a canonical directory: ${resolved}`);
+    }
+    return realpathSync(resolved);
+}
+function parseCatalog(text, root) {
+    let catalog;
+    try {
+        catalog = parseYaml(text);
+    }
+    catch (error) {
+        throw new PcrReadContextStaleError({
+            root,
+            source: CATALOG_PATH,
+            reason: `catalog could not be parsed (${error instanceof Error ? error.message : String(error)})`,
+        });
+    }
+    if (!record(catalog)) {
+        throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: "catalog is not an object" });
+    }
+    return catalog;
+}
+function catalogDependencyPaths(catalog, root) {
+    const paths = [
+        declaredPath(catalog.pcr_index, "pcr_index", root),
+        declaredPath(field(catalog.pcr_id_aliases, "path"), "pcr_id_aliases.path", root),
+        ...declaredPaths(catalog.classification_mappings, "classification_mappings", root),
+        ...declaredPaths(catalog.classification_coverage_indexes ?? [], "classification_coverage_indexes", root),
+    ];
+    if (!paths.includes(PCR_ID_ALIAS_REGISTRY_PATH)) {
+        throw new PcrReadContextStaleError({
+            root,
+            source: CATALOG_PATH,
+            reason: `pcr_id_aliases.path must be ${PCR_ID_ALIAS_REGISTRY_PATH}`,
+        });
+    }
+    return [...new Set(paths)];
+}
+function declaredPaths(value, name, root) {
+    if (!Array.isArray(value)) {
+        throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: `${name} must be an array` });
+    }
+    return value.map((entry) => declaredPath(entry, name, root));
+}
+function declaredPath(value, name, root) {
+    if (typeof value !== "string" || value.trim() !== value || value.length === 0) {
+        throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: `${name} must be a canonical path` });
+    }
+    const normalized = path.posix.normalize(value);
+    if (normalized !== value || normalized.startsWith("../") || path.posix.isAbsolute(normalized)) {
+        throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: `${name} escapes the repository root` });
+    }
+    return normalized;
+}
+function captureBindings({ root, relativePaths, beforeBoundSourceOpen = null }) {
+    return new Map(relativePaths.map((relativePath) => [
+        relativePath,
+        readRepositoryFile({ root, relativePath, beforeBoundSourceOpen }).sha256,
+    ]));
+}
+function assertBindingSnapshotsMatch({ root, before, after }) {
+    for (const [relativePath, beforeSha256] of before) {
+        if (after.get(relativePath) !== beforeSha256) {
+            throw new PcrReadContextStaleError({
+                root,
+                source: relativePath,
+                reason: "bound source changed while aliases were validated",
+            });
+        }
+    }
+}
+function readRepositoryFile({ root, relativePath, beforeBoundSourceOpen = null }) {
+    const filePath = path.join(root, ...relativePath.split("/"));
+    const before = assertContainedRegularFile({ root, relativePath, filePath });
+    beforeBoundSourceOpen?.({ root, relativePath });
+    const descriptor = openSync(filePath, MANAGED_READ_FLAGS);
+    try {
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile()) {
+            throw new Error(`bound source is not a regular file: ${relativePath}`);
+        }
+        const after = assertContainedRegularFile({ root, relativePath, filePath });
+        if (!sameFileIdentity(opened, before.at(-1)) || !sameFileIdentity(opened, after.at(-1)) || !samePathChain(before, after)) {
+            throw new Error(`bound source path changed while it was being opened: ${relativePath}`);
+        }
+        const bytes = readFileSync(descriptor);
+        return {
+            text: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+            sha256: `sha256:${createHash("sha256").update(bytes).digest("hex")}`,
+        };
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function assertContainedRegularFile({ root, relativePath, filePath }) {
+    const segments = relativePath.split("/");
+    let currentPath = root;
+    const chain = [];
+    for (const [index, segment] of segments.entries()) {
+        currentPath = path.join(currentPath, segment);
+        const stats = lstatSync(currentPath);
+        if (stats.isSymbolicLink() || (index === segments.length - 1 ? !stats.isFile() : !stats.isDirectory())) {
+            throw new Error(`bound source is not a canonical file: ${relativePath}`);
+        }
+        chain.push(stats);
+    }
+    const realFile = realpathSync(filePath);
+    if (!isInside(root, realFile)) {
+        throw new Error(`bound source escapes the repository root: ${relativePath}`);
+    }
+    return chain;
+}
+function isInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative !== "" && !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`);
+}
+function deepFreeze(value) {
+    if (!value || typeof value !== "object" || Object.isFrozen(value)) {
+        return value;
+    }
+    for (const child of Object.values(value)) {
+        deepFreeze(child);
+    }
+    return Object.freeze(value);
+}
+function sameStrings(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameFileIdentity(left, right) {
+    return left !== undefined && right !== undefined && left.dev === right.dev && left.ino === right.ino;
+}
+function samePathChain(left, right) {
+    return left.length === right.length && left.every((stats, index) => sameFileIdentity(stats, right[index]));
+}
+function sameRecords(left, right) {
+    return left.length === right.length && left.every((entry, index) => entry.path === right[index]?.path && entry.state === right[index]?.state);
+}
+function aliasInputFingerprint({ bindings, aliasDependencyPaths, aliasSourcePathStates }) {
+    const sources = [CATALOG_PATH, ...aliasDependencyPaths]
+        .filter((value, index, values) => values.indexOf(value) === index)
+        .sort()
+        .map((relativePath) => ({ relative_path: relativePath, sha256: bindings.get(relativePath) }));
+    return `sha256:${createHash("sha256").update(JSON.stringify({
+        sources,
+        source_path_states: aliasSourcePathStates,
+    })).digest("hex")}`;
+}
+function readSynchronously(read) {
+    const result = read();
+    if (result && typeof field(result, "then") === "function") {
+        throw new TypeError("PCR read context sessions require a synchronous callback; use an explicit async API.");
+    }
+    return result;
+}
+//# sourceMappingURL=read-context.js.map

package/packages/pcr-core/src/read-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-context.js","sourceRoot":"pcr://source/","sources":["packages/pcr-core/src/read-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,GAEb,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,gCAAgC,EAChC,6BAA6B,EAC7B,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AA2B3C,SAAS,MAAM,CAAC,KAAc,IAAsC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAClJ,SAAS,KAAK,CAAC,KAAc,EAAE,GAAW;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACnG,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,kBAAkB,GACtB,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;AACzE,MAAM,eAAe,GAAG,IAAI,OAAO,EAA+B,CAAC;AACnE,MAAM,2BAA2B,GAAG,IAAI,OAAO,EAAoB,CAAC;AACpE,MAAM,4BAA4B,GAAG,IAAI,OAAO,EAAqC,CAAC;AACtF,MAAM,eAAe,GAAG,IAAI,OAAO,EAAyC,CAAC;AAC7E,MAAM,eAAe,GAAG,IAAI,OAAO,EAAqC,CAAC;AACzE,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAA4B,CAAC;AAEjE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,OAAO,CAAiD;IACjE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAkD;QAClF,KAAK,CAAC,iCAAiC,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,IAAI,EACJ,iBAAiB,GAAG,IAAI,EACxB,qBAAqB,GAAG,IAAI,EAC5B,cAAc,GAAG,IAAI,EACrB,iBAAiB,GAAG,IAAI,EACxB,iBAAiB,GAAG,IAAI,EACxB,qBAAqB,GAAG,IAAI,GACN;IACtB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,0BAA0B,GAAG,gCAAgC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,MAAM,2BAA2B,GAAG,6BAA6B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,GAAG,eAAe,EAAE,GAAG,0BAA0B,CAAC,CAAC;IACrF,MAAM,cAAc,GAAG,eAAe,CAAC;QACrC,IAAI,EAAE,QAAQ;QACd,aAAa,EAAE,UAAU;QACzB,qBAAqB;KACtB,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,6DAA6D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;QACnD,QAAQ,EAAE,cAAc;QACxB,oBAAoB,EAAE,0BAA0B;QAChD,qBAAqB,EAAE,2BAA2B;KACnD,CAAC,CAAC;IACH,8EAA8E;IAC9E,+EAA+E;IAC/E,wEAAwE;IACxE,qBAAqB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,iBAAiB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,MAAM,yBAAyB,GAAG,gCAAgC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvF,MAAM,0BAA0B,GAAG,6BAA6B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,WAAW,CAAC,0BAA0B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,oEAAoE;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,mEAAmE;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC;QACpC,IAAI,EAAE,QAAQ;QACd,aAAa,EAAE,UAAU;QACzB,qBAAqB;KACtB,CAAC,CAAC;IACH,2BAA2B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9F,IAAI,qBAAqB,CAAC;QACxB,QAAQ,EAAE,aAAa;QACvB,oBAAoB,EAAE,yBAAyB;QAC/C,qBAAqB,EAAE,0BAA0B;KAClD,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAC9B,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,+DAA+D;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,OAAO,GAAmB;QAC9B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,gBAAgB;QACzB,cAAc,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,GAAG,EAAE;YAC3D,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;KACF,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5C,2BAA2B,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACpE,4BAA4B,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACtE,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,EAAE,IAAI,EAAkB;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,gCAAgC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,IAAI,EAAE,QAAQ;QACd,aAAa,EAAE,CAAC,YAAY,EAAE,GAAG,eAAe,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC;QAC3B,QAAQ;QACR,oBAAoB,EAAE,eAAe;QACrC,qBAAqB,EAAE,gBAAgB;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,CACZ,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;QAC7C,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAiD;IACxG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,sBAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,sBAAsB,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,sBAAsB,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,4CAA4C;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACxD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,2BAA2B,CAAC;IAChC,IAAI,CAAC;QACH,2BAA2B,GAAG,gCAAgC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,+CAA+C;SACxD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,yCAAyC;SAClD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,4BAA4B,GAAG,6BAA6B,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,qCAAqC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChF,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,wBAAwB,CAAC;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,6BAA6B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAwB,CAAC;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,gCAAgC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAoC;IACpG,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACjD,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAA6E;IAChJ,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;YACjD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,WAAW,CAAC,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAClE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAA4C;IACzH,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAqC;IACrG,yBAAyB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI;YACJ,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;SAClG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG;QACZ,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC;QAClD,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC;QAChF,GAAG,aAAa,CAAC,OAAO,CAAC,uBAAuB,EAAE,yBAAyB,EAAE,IAAI,CAAC;QAClF,GAAG,aAAa,CAAC,OAAO,CAAC,+BAA+B,IAAI,EAAE,EAAE,iCAAiC,EAAE,IAAI,CAAC;KACzG,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAwB,CAAC;YACjC,IAAI;YACJ,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,+BAA+B,0BAA0B,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,mBAAmB,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,2BAA2B,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,wBAAwB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,8BAA8B,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,qBAAqB,GAAG,IAAI,EAA4H;IACtM,OAAO,IAAI,GAAG,CACZ,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;QAClC,YAAY;QACZ,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM;KACzE,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAA2E;IACnI,KAAK,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,MAAM,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,YAAY,EAAE,CAAC;YAC7C,MAAM,IAAI,wBAAwB,CAAC;gBACjC,IAAI;gBACJ,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,mDAAmD;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,qBAAqB,GAAG,IAAI,EAAoB;IAChG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5E,qBAAqB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,YAAY,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,0BAA0B,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACzH,MAAM,IAAI,KAAK,CAAC,wDAAwD,YAAY,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7D,MAAM,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACrE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAA0D;IAC1H,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,KAAK,CAAC,yCAAyC,YAAY,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,UAAU,CAAI,KAAQ;IAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB,EAAE,KAAwB;IACpE,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,KAAwB;IACzE,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AACvG,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB,EAAE,KAAuB;IACpE,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAC/C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAwC,EAAE,KAAyC;IACtG,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAC/C,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,qBAAqB,EAAyI;IAC7N,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,GAAG,oBAAoB,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;SACjE,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAC1D,OAAO;QACP,kBAAkB,EAAE,qBAAqB;KAC1C,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAI,IAAa;IACzC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;IACtB,IAAI,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,sFAAsF,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  closeSync,\n  constants as fsConstants,\n  fstatSync,\n  lstatSync,\n  openSync,\n  readFileSync,\n  realpathSync,\n  type Stats,\n} from \"node:fs\";\nimport path from \"node:path\";\n\nimport {\n  PCR_ID_ALIAS_REGISTRY_PATH,\n  pcrIdAliasValidationDependencies,\n  pcrIdAliasSourcePcrPathStates,\n  readPcrIdAliases,\n  type PcrIdAlias,\n  type AliasSourcePcrPathState,\n} from \"./pcr-id-aliases.ts\";\nimport { parseYaml } from \"./yaml-lite.ts\";\n\nimport type { CatalogEntry } from './types.ts';\nexport interface PcrReadContext {\n  readonly root: string;\n  readonly aliases: readonly PcrIdAlias[];\n  findPcrIdAlias(pcrId: unknown, options?: {root?: string | undefined}): PcrIdAlias | null;\n}\ninterface RootEvent { root: string }\ninterface ContextObservers {\n  onBindingCheck: ((event: RootEvent) => void) | null;\n  onCatalogSnapshot: ((event: RootEvent & {entryCount: number}) => void) | null;\n  onPcrArtifactRead: ((event: RootEvent & {relative_path: string}) => void) | null;\n}\n/** Retained compatibility input. Persisted hashes and caller-authored aliases are\n * freshness metadata, never proof of prior semantic validation. */\nexport interface ValidatedAliasReuse { readonly fingerprint: string; readonly aliases: readonly PcrIdAlias[] }\nexport interface PcrReadContextOptions {\n  root: string;\n  onAliasValidation?: ((event: RootEvent & {aliases: readonly PcrIdAlias[]}) => void) | null;\n  beforeAliasValidation?: ((event: RootEvent) => void) | null;\n  onBindingCheck?: ContextObservers['onBindingCheck']; onCatalogSnapshot?: ContextObservers['onCatalogSnapshot']; onPcrArtifactRead?: ContextObservers['onPcrArtifactRead'];\n  beforeBoundSourceOpen?: ((event: RootEvent & {relativePath: string}) => void) | null;\n  validatedAliasReuse?: unknown;\n}\ninterface BoundReadOptions { root: string; relativePath: string; beforeBoundSourceOpen?: PcrReadContextOptions['beforeBoundSourceOpen'] }\ninterface ContextOptions { context: PcrReadContext; root?: string | undefined }\nfunction record(value: unknown): value is Record<string, unknown> { return value !== null && typeof value === 'object' && !Array.isArray(value); }\nfunction field(value: unknown, key: string): unknown {\n  if (value === null || (typeof value !== 'object' && typeof value !== 'function')) return undefined;\n  const result: unknown = Reflect.get(value, key);\n  return result;\n}\n\nconst CATALOG_PATH = \"library/catalog.yaml\";\nconst MANAGED_READ_FLAGS =\n  fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK;\nconst contextBindings = new WeakMap<object, Map<string, string>>();\nconst contextAliasDependencyPaths = new WeakMap<object, string[]>();\nconst contextAliasSourcePathStates = new WeakMap<object, AliasSourcePcrPathState[]>();\nconst contextSessions = new WeakMap<object, {root: string; depth: number}>();\nconst contextCatalogs = new WeakMap<object, Map<string, CatalogEntry>>();\nconst contextObservers = new WeakMap<object, ContextObservers>();\n\nexport class PcrReadContextStaleError extends Error {\n  readonly code: string;\n  readonly details: {root: string; source: string; reason: string};\n  constructor({ root, source, reason }: {root: string; source: string; reason: string}) {\n    super(`PCR read context is stale for ${source}: ${reason}.`);\n    this.name = \"PcrReadContextStaleError\";\n    this.code = \"PCR_READ_CONTEXT_STALE\";\n    this.details = { root, source, reason };\n  }\n}\n\n/**\n * Bind repeated PCR reads to one validated repository state. The context is\n * deliberately independent from the process-global catalog cache: callers\n * may retain it only while all catalog-declared inputs remain byte-identical.\n */\nexport function createPcrReadContext({\n  root,\n  onAliasValidation = null,\n  beforeAliasValidation = null,\n  onBindingCheck = null,\n  onCatalogSnapshot = null,\n  onPcrArtifactRead = null,\n  beforeBoundSourceOpen = null,\n}: PcrReadContextOptions): PcrReadContext {\n  const rootPath = canonicalRoot(root);\n  const catalogSource = readRepositoryFile({ root: rootPath, relativePath: CATALOG_PATH });\n  const catalog = parseCatalog(catalogSource.text, rootPath);\n  const dependencyPaths = catalogDependencyPaths(catalog, rootPath);\n  const aliasDependencyPathsBefore = pcrIdAliasValidationDependencies({ root: rootPath });\n  const aliasSourcePathStatesBefore = pcrIdAliasSourcePcrPathStates({ root: rootPath });\n  const boundPaths = [CATALOG_PATH, ...dependencyPaths, ...aliasDependencyPathsBefore];\n  const bindingsBefore = captureBindings({\n    root: rootPath,\n    relativePaths: boundPaths,\n    beforeBoundSourceOpen,\n  });\n  if (bindingsBefore.get(CATALOG_PATH) !== catalogSource.sha256) {\n    throw new PcrReadContextStaleError({\n      root: rootPath,\n      source: CATALOG_PATH,\n      reason: \"catalog changed after its dependency declarations were read\",\n    });\n  }\n  const aliasFingerprintBefore = aliasInputFingerprint({\n    bindings: bindingsBefore,\n    aliasDependencyPaths: aliasDependencyPathsBefore,\n    aliasSourcePathStates: aliasSourcePathStatesBefore,\n  });\n  // A new context establishes semantic validity once from its bound repository.\n  // Session reuse below keeps that result private and rechecks all dependencies;\n  // no caller or persisted snapshot can manufacture validation authority.\n  beforeAliasValidation?.({ root: rootPath });\n  const aliases = readPcrIdAliases({ root: rootPath });\n  onAliasValidation?.({ root: rootPath, aliases: deepFreeze(structuredClone(aliases)) });\n  const aliasDependencyPathsAfter = pcrIdAliasValidationDependencies({ root: rootPath });\n  const aliasSourcePathStatesAfter = pcrIdAliasSourcePcrPathStates({ root: rootPath });\n  if (!sameStrings(aliasDependencyPathsBefore, aliasDependencyPathsAfter)) {\n    throw new PcrReadContextStaleError({\n      root: rootPath,\n      source: PCR_ID_ALIAS_REGISTRY_PATH,\n      reason: \"alias validation dependencies changed while aliases were validated\",\n    });\n  }\n  if (!sameRecords(aliasSourcePathStatesBefore, aliasSourcePathStatesAfter)) {\n    throw new PcrReadContextStaleError({\n      root: rootPath,\n      source: PCR_ID_ALIAS_REGISTRY_PATH,\n      reason: \"alias source PCR path states changed while aliases were validated\",\n    });\n  }\n  const bindingsAfter = captureBindings({\n    root: rootPath,\n    relativePaths: boundPaths,\n    beforeBoundSourceOpen,\n  });\n  assertBindingSnapshotsMatch({ root: rootPath, before: bindingsBefore, after: bindingsAfter });\n  if (aliasInputFingerprint({\n    bindings: bindingsAfter,\n    aliasDependencyPaths: aliasDependencyPathsAfter,\n    aliasSourcePathStates: aliasSourcePathStatesAfter,\n  }) !== aliasFingerprintBefore) {\n    throw new PcrReadContextStaleError({\n      root: rootPath,\n      source: PCR_ID_ALIAS_REGISTRY_PATH,\n      reason: \"alias reuse inputs changed while the read context was created\",\n    });\n  }\n\n  const aliasByPcrId = new Map<string, PcrIdAlias>();\n  for (const alias of aliases) {\n    aliasByPcrId.set(String(alias?.source_pcr_id), deepFreeze(structuredClone(alias)));\n  }\n  const immutableAliases = deepFreeze([...aliasByPcrId.values()].map((alias) => structuredClone(alias)));\n  const context: PcrReadContext = {\n    root: rootPath,\n    aliases: immutableAliases,\n    findPcrIdAlias(pcrId, { root: requestedRoot = rootPath } = {}) {\n      assertPcrReadContextFresh({ context, root: requestedRoot });\n      const alias = aliasByPcrId.get(String(pcrId));\n      return alias ? structuredClone(alias) : null;\n    },\n  };\n  Object.defineProperty(context, \"_pcrReadContext\", { value: true });\n  contextBindings.set(context, bindingsAfter);\n  contextAliasDependencyPaths.set(context, aliasDependencyPathsAfter);\n  contextAliasSourcePathStates.set(context, aliasSourcePathStatesAfter);\n  contextObservers.set(context, { onBindingCheck, onCatalogSnapshot, onPcrArtifactRead });\n  return Object.freeze(context);\n}\n\nexport function pcrReadContextAliasInputFingerprint({ root }: {root: string}): string {\n  const rootPath = canonicalRoot(root);\n  const dependencyPaths = pcrIdAliasValidationDependencies({ root: rootPath });\n  const sourcePathStates = pcrIdAliasSourcePcrPathStates({ root: rootPath });\n  const bindings = captureBindings({\n    root: rootPath,\n    relativePaths: [CATALOG_PATH, ...dependencyPaths],\n  });\n  return aliasInputFingerprint({\n    bindings,\n    aliasDependencyPaths: dependencyPaths,\n    aliasSourcePathStates: sourcePathStates,\n  });\n}\n\nexport function isPcrReadContext(value: unknown): value is PcrReadContext {\n  return Boolean(\n    record(value) && value._pcrReadContext === true &&\n      typeof value.root === \"string\" &&\n      contextBindings.has(value),\n  );\n}\n\nexport function assertPcrReadContextFresh({ context, root }: {context: unknown; root?: string | undefined}): PcrReadContext {\n  if (!isPcrReadContext(context)) {\n    throw new TypeError(\"context must be created by createPcrReadContext\");\n  }\n  let canonicalRequestedRoot;\n  try {\n    canonicalRequestedRoot = canonicalRoot(root ?? context.root);\n  } catch {\n    throw new PcrReadContextStaleError({\n      root: context.root,\n      source: CATALOG_PATH,\n      reason: \"requested root is unavailable\",\n    });\n  }\n  if (canonicalRequestedRoot !== context.root) {\n    throw new PcrReadContextStaleError({\n      root: context.root,\n      source: CATALOG_PATH,\n      reason: \"context belongs to another repository root\",\n    });\n  }\n  if (contextSessions.get(context)?.root === context.root) {\n    return context;\n  }\n  contextObservers.get(context)?.onBindingCheck?.({ root: context.root });\n  let currentAliasDependencyPaths;\n  try {\n    currentAliasDependencyPaths = pcrIdAliasValidationDependencies({ root: context.root });\n  } catch {\n    throw new PcrReadContextStaleError({\n      root: context.root,\n      source: PCR_ID_ALIAS_REGISTRY_PATH,\n      reason: \"alias validation dependencies are unavailable\",\n    });\n  }\n  if (!sameStrings(contextAliasDependencyPaths.get(context) ?? [], currentAliasDependencyPaths)) {\n    throw new PcrReadContextStaleError({\n      root: context.root,\n      source: PCR_ID_ALIAS_REGISTRY_PATH,\n      reason: \"alias validation dependency set changed\",\n    });\n  }\n  const currentAliasSourcePathStates = pcrIdAliasSourcePcrPathStates({ root: context.root });\n  if (!sameRecords(contextAliasSourcePathStates.get(context) ?? [], currentAliasSourcePathStates)) {\n    throw new PcrReadContextStaleError({\n      root: context.root,\n      source: PCR_ID_ALIAS_REGISTRY_PATH,\n      reason: \"alias source PCR path state changed\",\n    });\n  }\n  for (const [relativePath, expectedSha256] of contextBindings.get(context) ?? []) {\n    let actualSha256;\n    try {\n      actualSha256 = readRepositoryFile({ root: context.root, relativePath }).sha256;\n    } catch {\n      throw new PcrReadContextStaleError({\n        root: context.root,\n        source: relativePath,\n        reason: \"bound source is unavailable\",\n      });\n    }\n    if (actualSha256 !== expectedSha256) {\n      throw new PcrReadContextStaleError({\n        root: context.root,\n        source: relativePath,\n        reason: \"exact-byte fingerprint changed\",\n      });\n    }\n  }\n  return context;\n}\n\nexport function withPcrReadContextSession<T>({ context, root, read }: ContextOptions & {read: () => T}): T {\n  assertPcrReadContextFresh({ context, root });\n  const active = contextSessions.get(context);\n  if (active) {\n    active.depth += 1;\n    try {\n      return readSynchronously(read);\n    } finally {\n      active.depth -= 1;\n    }\n  }\n  const session = { root: context.root, depth: 1 };\n  contextSessions.set(context, session);\n  try {\n    return readSynchronously(read);\n  } finally {\n    contextSessions.delete(context);\n    assertPcrReadContextFresh({ context, root });\n  }\n}\n\nexport function getPcrReadContextCatalog({ context, root, readCatalog }: ContextOptions & {readCatalog: (root: string) => readonly CatalogEntry[]}): Map<string, CatalogEntry> {\n  assertPcrReadContextFresh({ context, root });\n  if (!contextCatalogs.has(context)) {\n    const entries = readCatalog(context.root);\n    const entriesById = new Map(entries.map((entry) => [entry.id, structuredClone(entry)]));\n    contextCatalogs.set(context, entriesById);\n    contextObservers.get(context)?.onCatalogSnapshot?.({\n      root: context.root,\n      entryCount: entriesById.size,\n    });\n  }\n  const catalog = contextCatalogs.get(context);\n  if (!catalog) throw new Error(\"Missing context catalog snapshot\");\n  return catalog;\n}\n\nexport function observePcrReadContextArtifactRead({ context, root, relativePath }: ContextOptions & {relativePath: unknown}): void {\n  assertPcrReadContextFresh({ context, root });\n  contextObservers.get(context)?.onPcrArtifactRead?.({\n    root: context.root,\n    relative_path: String(relativePath),\n  });\n}\n\nexport function findPcrIdAliasInReadContext({ context, root, pcrId }: ContextOptions & {pcrId: unknown}): PcrIdAlias | null {\n  assertPcrReadContextFresh({ context, root });\n  return context.findPcrIdAlias(pcrId);\n}\n\nfunction canonicalRoot(root: string): string {\n  const resolved = path.resolve(root);\n  const stats = lstatSync(resolved);\n  if (stats.isSymbolicLink() || !stats.isDirectory()) {\n    throw new Error(`PCR repository root is not a canonical directory: ${resolved}`);\n  }\n  return realpathSync(resolved);\n}\n\nfunction parseCatalog(text: string, root: string): Record<string, unknown> {\n  let catalog: unknown;\n  try {\n    catalog = parseYaml(text);\n  } catch (error) {\n    throw new PcrReadContextStaleError({\n      root,\n      source: CATALOG_PATH,\n      reason: `catalog could not be parsed (${error instanceof Error ? error.message : String(error)})`,\n    });\n  }\n  if (!record(catalog)) {\n    throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: \"catalog is not an object\" });\n  }\n  return catalog;\n}\n\nfunction catalogDependencyPaths(catalog: Record<string, unknown>, root: string): string[] {\n  const paths = [\n    declaredPath(catalog.pcr_index, \"pcr_index\", root),\n    declaredPath(field(catalog.pcr_id_aliases, \"path\"), \"pcr_id_aliases.path\", root),\n    ...declaredPaths(catalog.classification_mappings, \"classification_mappings\", root),\n    ...declaredPaths(catalog.classification_coverage_indexes ?? [], \"classification_coverage_indexes\", root),\n  ];\n  if (!paths.includes(PCR_ID_ALIAS_REGISTRY_PATH)) {\n    throw new PcrReadContextStaleError({\n      root,\n      source: CATALOG_PATH,\n      reason: `pcr_id_aliases.path must be ${PCR_ID_ALIAS_REGISTRY_PATH}`,\n    });\n  }\n  return [...new Set(paths)];\n}\n\nfunction declaredPaths(value: unknown, name: string, root: string): string[] {\n  if (!Array.isArray(value)) {\n    throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: `${name} must be an array` });\n  }\n  return value.map((entry) => declaredPath(entry, name, root));\n}\n\nfunction declaredPath(value: unknown, name: string, root: string): string {\n  if (typeof value !== \"string\" || value.trim() !== value || value.length === 0) {\n    throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: `${name} must be a canonical path` });\n  }\n  const normalized = path.posix.normalize(value);\n  if (normalized !== value || normalized.startsWith(\"../\") || path.posix.isAbsolute(normalized)) {\n    throw new PcrReadContextStaleError({ root, source: CATALOG_PATH, reason: `${name} escapes the repository root` });\n  }\n  return normalized;\n}\n\nfunction captureBindings({ root, relativePaths, beforeBoundSourceOpen = null }: {root: string; relativePaths: readonly string[]; beforeBoundSourceOpen?: PcrReadContextOptions[\"beforeBoundSourceOpen\"]}): Map<string, string> {\n  return new Map(\n    relativePaths.map((relativePath) => [\n      relativePath,\n      readRepositoryFile({ root, relativePath, beforeBoundSourceOpen }).sha256,\n    ]),\n  );\n}\n\nfunction assertBindingSnapshotsMatch({ root, before, after }: {root: string; before: Map<string, string>; after: Map<string, string>}): void {\n  for (const [relativePath, beforeSha256] of before) {\n    if (after.get(relativePath) !== beforeSha256) {\n      throw new PcrReadContextStaleError({\n        root,\n        source: relativePath,\n        reason: \"bound source changed while aliases were validated\",\n      });\n    }\n  }\n}\n\nfunction readRepositoryFile({ root, relativePath, beforeBoundSourceOpen = null }: BoundReadOptions): {text: string; sha256: string} {\n  const filePath = path.join(root, ...relativePath.split(\"/\"));\n  const before = assertContainedRegularFile({ root, relativePath, filePath });\n  beforeBoundSourceOpen?.({ root, relativePath });\n  const descriptor = openSync(filePath, MANAGED_READ_FLAGS);\n  try {\n    const opened = fstatSync(descriptor);\n    if (!opened.isFile()) {\n      throw new Error(`bound source is not a regular file: ${relativePath}`);\n    }\n    const after = assertContainedRegularFile({ root, relativePath, filePath });\n    if (!sameFileIdentity(opened, before.at(-1)) || !sameFileIdentity(opened, after.at(-1)) || !samePathChain(before, after)) {\n      throw new Error(`bound source path changed while it was being opened: ${relativePath}`);\n    }\n    const bytes = readFileSync(descriptor);\n    return {\n      text: new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes),\n      sha256: `sha256:${createHash(\"sha256\").update(bytes).digest(\"hex\")}`,\n    };\n  } finally {\n    closeSync(descriptor);\n  }\n}\n\nfunction assertContainedRegularFile({ root, relativePath, filePath }: {root: string; relativePath: string; filePath: string}): Stats[] {\n  const segments = relativePath.split(\"/\");\n  let currentPath = root;\n  const chain: Stats[] = [];\n  for (const [index, segment] of segments.entries()) {\n    currentPath = path.join(currentPath, segment);\n    const stats = lstatSync(currentPath);\n    if (stats.isSymbolicLink() || (index === segments.length - 1 ? !stats.isFile() : !stats.isDirectory())) {\n      throw new Error(`bound source is not a canonical file: ${relativePath}`);\n    }\n    chain.push(stats);\n  }\n  const realFile = realpathSync(filePath);\n  if (!isInside(root, realFile)) {\n    throw new Error(`bound source escapes the repository root: ${relativePath}`);\n  }\n  return chain;\n}\n\nfunction isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative !== \"\" && !path.isAbsolute(relative) && relative !== \"..\" && !relative.startsWith(`..${path.sep}`);\n}\n\nfunction deepFreeze<T>(value: T): T {\n  if (!value || typeof value !== \"object\" || Object.isFrozen(value)) {\n    return value;\n  }\n  for (const child of Object.values(value)) {\n    deepFreeze(child);\n  }\n  return Object.freeze(value);\n}\n\nfunction sameStrings(left: readonly string[], right: readonly string[]): boolean {\n  return left.length === right.length && left.every((value, index) => value === right[index]);\n}\n\nfunction sameFileIdentity(left: Stats | undefined, right: Stats | undefined): boolean {\n  return left !== undefined && right !== undefined && left.dev === right.dev && left.ino === right.ino;\n}\n\nfunction samePathChain(left: readonly Stats[], right: readonly Stats[]): boolean {\n  return left.length === right.length && left.every(\n    (stats, index) => sameFileIdentity(stats, right[index]),\n  );\n}\n\nfunction sameRecords(left: readonly AliasSourcePcrPathState[], right: readonly AliasSourcePcrPathState[]): boolean {\n  return left.length === right.length && left.every(\n    (entry, index) => entry.path === right[index]?.path && entry.state === right[index]?.state,\n  );\n}\n\nfunction aliasInputFingerprint({ bindings, aliasDependencyPaths, aliasSourcePathStates }: { bindings: Map<string, string>; aliasDependencyPaths: readonly string[]; aliasSourcePathStates: readonly AliasSourcePcrPathState[] }): string {\n  const sources = [CATALOG_PATH, ...aliasDependencyPaths]\n    .filter((value, index, values) => values.indexOf(value) === index)\n    .sort()\n    .map((relativePath) => ({ relative_path: relativePath, sha256: bindings.get(relativePath) }));\n  return `sha256:${createHash(\"sha256\").update(JSON.stringify({\n    sources,\n    source_path_states: aliasSourcePathStates,\n  })).digest(\"hex\")}`;\n}\n\nfunction readSynchronously<T>(read: () => T): T {\n  const result = read();\n  if (result && typeof field(result, \"then\") === \"function\") {\n    throw new TypeError(\"PCR read context sessions require a synchronous callback; use an explicit async API.\");\n  }\n  return result;\n}\n"]}

package/packages/pcr-core/src/read-session.js

@@ -0,0 +1,150 @@
+import { createHash } from 'node:crypto';
+import { OfflineLibrary } from './offline-library.js';
+import { createPcrReadContext, withPcrReadContextSession } from './read-context.js';
+import { withPcrSource, withRepositoryPcrSource } from './source-context.js';
+import { projectionFromVerifiedSnapshot, readVerifiedSnapshotForSession } from './index.js';
+import { buildGuidanceFromProjection } from './compiler/guidance-envelope.js';
+export const MAX_READ_BATCH = 100;
+export class PcrReadSessionError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}) {
+        super(message);
+        this.name = 'PcrReadSessionError';
+        this.code = code;
+        this.details = details;
+    }
+}
+function validateIds(ids) {
+    if (!Array.isArray(ids) || ids.length > MAX_READ_BATCH || ids.some(id => typeof id !== 'string' || !id.trim())) {
+        throw new PcrReadSessionError('PCR_READ_BATCH_INVALID', `Provide at most ${MAX_READ_BATCH} nonempty PCR IDs; no partial batch is returned.`);
+    }
+    return [...ids];
+}
+function fingerprint(snapshot) {
+    const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+    const entries = [['manifest.yaml', digest(snapshot.manifestBytes)]];
+    for (const name of Object.keys(snapshot.artifacts).sort()) {
+        const artifact = snapshot.artifacts[name];
+        const error = artifact?.error;
+        const code = error !== null && typeof error === 'object' ? Reflect.get(error, 'code') : undefined;
+        entries.push([name, artifact?.bytes ? digest(artifact.bytes) : `unavailable:${String(code ?? 'unknown_error')}`]);
+    }
+    return digest(Buffer.from(JSON.stringify(entries)));
+}
+function synchronous(read) {
+    const result = read();
+    if (result !== null && (typeof result === 'object' || typeof result === 'function')) {
+        const then = Reflect.get(result, 'then');
+        if (typeof then === 'function') {
+            void Promise.resolve(result).catch(() => { });
+            throw new PcrReadSessionError('PCR_READ_SESSION_ASYNC', 'PCR read sessions require a synchronous callback.');
+        }
+    }
+    return result;
+}
+/** One owned, synchronous source scope. Each selected repository record is bound
+ * by exact captured bytes and rechecked before return. SQLite already opens one
+ * read-only transaction in OfflineLibrary; this function owns its lifetime. */
+export function withPcrReadSession(source, read) {
+    if (typeof read !== 'function' || !source || (source.kind !== 'repository' && source.kind !== 'library')) {
+        throw new PcrReadSessionError('PCR_READ_SOURCE_INVALID', 'Select a repository root or a fixed SQLite library.');
+    }
+    if (source.kind === 'repository' ? typeof source.root !== 'string' || !source.root : typeof source.filename !== 'string' || !source.filename) {
+        throw new PcrReadSessionError('PCR_READ_SOURCE_INVALID', 'The selected source requires a nonempty path.');
+    }
+    if (source.kind === 'library' && ((source.verify !== undefined && typeof source.verify !== 'boolean')
+        || (source.expectedSha256 !== undefined && (typeof source.expectedSha256 !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(source.expectedSha256))))) {
+        throw new PcrReadSessionError('PCR_READ_SOURCE_INVALID', 'Library verification must be a boolean and its optional pin a sha256 digest.');
+    }
+    let library;
+    const stats = { records_loaded: 0, cache_hits: 0, final_verifications: 0, alias_validations: 0 };
+    let active = true;
+    try {
+        const context = source.kind === 'repository' ? withRepositoryPcrSource(source.root, () => createPcrReadContext({ root: source.root, onAliasValidation: () => { stats.alias_validations += 1; } })) : undefined;
+        if (source.kind === 'library')
+            library = new OfflineLibrary(source.filename, { expectedSha256: source.expectedSha256 ?? null, verify: source.verify ?? true });
+        const selectedRoot = context?.root ?? library?.root;
+        if (!selectedRoot)
+            throw new PcrReadSessionError('PCR_READ_SOURCE_INVALID', 'Source initialization failed.');
+        const root = selectedRoot;
+        const adapter = library;
+        const scope = (operation) => adapter ? withPcrSource(root, adapter, operation) : withRepositoryPcrSource(root, operation);
+        const identity = Object.freeze(adapter ? {
+            kind: 'library', filename: adapter.filename, content_version: adapter.manifest.snapshot.content_version,
+            source_commit: adapter.manifest.snapshot.source_commit, sha256: adapter.manifest.sha256,
+            verified: source.kind === 'library' && ((source.verify ?? true) || source.expectedSha256 !== undefined),
+        } : { kind: 'repository', root });
+        const bindings = new Map();
+        const cache = new Map();
+        function requireActive() { if (!active)
+            throw new PcrReadSessionError('PCR_READ_SESSION_CLOSED', 'PCR read session has ended.'); }
+        function capture(pcrId) {
+            return scope(() => readVerifiedSnapshotForSession({ root, pcrId, ...(context ? { context } : {}) }));
+        }
+        function load(pcrId) {
+            requireActive();
+            validateIds([pcrId]);
+            const cached = cache.get(pcrId);
+            if (cached) {
+                stats.cache_hits += 1;
+                cache.delete(pcrId);
+                cache.set(pcrId, cached);
+                return cached;
+            }
+            const snapshot = capture(pcrId);
+            const binding = fingerprint(snapshot);
+            const previous = bindings.get(pcrId);
+            if (previous !== undefined && previous !== binding)
+                throw new PcrReadSessionError('PCR_READ_SESSION_STALE', 'Selected PCR source changed during the session.', { pcr_id: pcrId });
+            bindings.set(pcrId, binding);
+            const value = projectionFromVerifiedSnapshot(snapshot, root);
+            stats.records_loaded += 1;
+            cache.set(pcrId, value);
+            if (cache.size > MAX_READ_BATCH) {
+                const oldest = cache.keys().next().value;
+                if (oldest !== undefined)
+                    cache.delete(oldest);
+            }
+            return value;
+        }
+        const session = Object.freeze({
+            source: identity,
+            guidance: (pcrId) => structuredClone(buildGuidanceFromProjection(load(pcrId))),
+            projection: (pcrId) => structuredClone(load(pcrId)),
+            guidanceMany: (ids) => { requireActive(); return validateIds(ids).map(id => structuredClone(buildGuidanceFromProjection(load(id)))); },
+            projectionMany: (ids) => { requireActive(); return validateIds(ids).map(id => structuredClone(load(id))); },
+            stats: () => Object.freeze({ ...stats }),
+        });
+        const operation = () => {
+            try {
+                const result = synchronous(() => scope(() => read(session)));
+                if (context) {
+                    for (const [pcrId, expected] of bindings) {
+                        let snapshot;
+                        try {
+                            snapshot = capture(pcrId);
+                        }
+                        catch (error) {
+                            throw new PcrReadSessionError('PCR_READ_SESSION_STALE', 'Selected PCR can no longer be verified.', { pcr_id: pcrId, reason: error instanceof Error ? error.message : String(error) });
+                        }
+                        stats.final_verifications += 1;
+                        if (fingerprint(snapshot) !== expected)
+                            throw new PcrReadSessionError('PCR_READ_SESSION_STALE', 'Selected PCR source changed during the session.', { pcr_id: pcrId });
+                    }
+                }
+                return result;
+            }
+            finally {
+                active = false;
+                cache.clear();
+            }
+        };
+        return context ? withPcrReadContextSession({ context, root, read: operation }) : operation();
+    }
+    finally {
+        active = false;
+        library?.close();
+    }
+}
+//# sourceMappingURL=read-session.js.map