@uns-kit/core 3.0.27 → 3.0.30

package/dist/runtime/process-group-inspection.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-inspection.js","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,IAAI,QAAQ,GACvC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AAUrC,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW,EAAE,IAAY,EAAE,UAAmB;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC,IAAI,CAAC;YACR,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,MAAM,UAAU,gCAAgC,CAC9C,GAAW,EACX,GAAW,EACX,GAAW,EACX,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,EACzD,OAAoG;IAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,kCAAkC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAChE,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAClB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,UAAU,GACd,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,4BAA4B,EAAE,CAAC;QACrE,CAAC,CAAC,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnI,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,SAAS,GAAG,yBAAyB;aACxC,MAAM,CAAC;YACN,YAAY,EAAE,yBAAyB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9E,UAAU,EAAE,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;YAC/D,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;SAC5D,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,SAAS;YACtG,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACvH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACtG,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,SAAS;gBACV,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;gBACrC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAEhF,MAAM,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,+BAA+B,KAAK,CAAC;gBAC7G,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC;QAC/G,IAAI,UAAU,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpG,KAAK,IAAI,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACnG,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC1G,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACxE,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5G,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAiC,CAAC;QACvG,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,IAAI,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,SAAS;gBACrH,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,cAAc,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YACrG,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;YACjI,IACE,CAAC,OAAO;gBACR,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;gBACtD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;gBAClC,OAAO,CAAC,GAAG,IAAI,CAAC;gBAChB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI;gBACrC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBAErC,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,GAAG,CACnB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAC5H,CAAC;gBACF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5G,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC;oBAC7H,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5I,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;YAChF,IACE,CAAC,MAAM;gBACP,MAAM,CAAC,aAAa,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/E,MAAM,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;gBAEzE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7H,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,gCAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3I,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7H,yFAAyF;QACzF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/I,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,EAC1E,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnD,IACE,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;YAErD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa;gBACtH,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpD,OAAO;YACL,WAAW;YACX,qBAAqB,EAAE,QAAQ;YAC/B,kBAAkB;YAClB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACR,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAClB,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzD,OAAO;QACL,WAAW;QACX,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB;QAClB,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;QAC5D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport {\n  assertProcessGroupStateMount,\n  authorizeConfiguredProcessGroupRuntime,\n  configurationAuthorizationHash,\n  hasProcessGroupAuthorization,\n  processGroupManifestSchema as manifest,\n} from \"./process-group-authorization.js\";\nimport {\n  isLocalPilotPath,\n  isProcessGroupJournalPath,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  processGroupJournalContract,\n  processGroupJournalSchema,\n  processGroupSourceIdentity,\n  projectProcessGroupConfiguration,\n  resolvedProcessGroupInputChannel,\n} from \"./process-group-contract.js\";\n\nexport interface ProcessGroupConfigurationEvidence {\n  processName: string;\n  configurationChecksum: string;\n  projectionChecksum: string;\n  mappingSha256: string | null;\n  dataGroup: string | null;\n  contract: { digest: string; processName: string; profiles: { id: string; processName: string; mappingSha256: string; dataGroup: string }[] } | null;\n}\n/** Bound reads to installed package/instance resources, never arbitrary paths or symlinks. */\nfunction resource(pkg: string, dir: string, file: string, relativeTo?: string): Buffer {\n  if (file.length > 512) throw Error(\"Group resource path too long\");\n  const roots = [fs.realpathSync(pkg), fs.realpathSync(dir)];\n  const candidates = relativeTo\n    ? [path.resolve(relativeTo, file)]\n    : path.isAbsolute(file)\n      ? [file]\n      : [path.resolve(dir, file), path.resolve(pkg, file)];\n  for (const candidate of candidates) {\n    if (!fs.existsSync(candidate)) continue;\n    const real = fs.realpathSync(candidate);\n    if (real !== candidate || !roots.some((root) => real.startsWith(root + path.sep)))\n      throw Error(\"Group resource must stay inside installed package or instance\");\n    const fd = fs.openSync(real, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n    try {\n      const s = fs.fstatSync(fd);\n      if (!s.isFile() || s.size > 1048576) throw Error(\"Invalid group resource\");\n      const b = fs.readFileSync(fd);\n      if (b.length > 1048576) throw Error(\"Group resource too large\");\n      return b;\n    } finally {\n      fs.closeSync(fd);\n    }\n  }\n  throw Error(\"Installed group resource is missing\");\n}\nconst sha = (b: Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nexport function inspectProcessGroupConfiguration(\n  pkg: string,\n  dir: string,\n  raw: string,\n  controllerName = process.env[\"UNS_CONTROLLER_NAME\"] ?? \"\",\n  options: { configurationChecksum(raw: string): string | null; excludedUnsFields: readonly string[] },\n): ProcessGroupConfigurationEvidence {\n  const original = JSON.parse(raw);\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Installed package has no supported process-group contract\");\n  const c = normalizeProcessGroupConfiguration(original, descriptor),\n    uns = { ...c.uns },\n    publisher = c.publisher;\n  const production =\n    c.journal && (!isLocalPilotPath(pkg) || hasProcessGroupAuthorization())\n      ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName)\n      : undefined;\n  if (production) assertProcessGroupStateMount(production, process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"] ?? \"\");\n  if (!c.matches || (c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") || !publisher || typeof uns.processName !== \"string\")\n    throw Error(\"This runtime has no supported reviewed group configuration\");\n  if (c.journal !== undefined) {\n    // Readiness requires explicit capacities; their limits come from the shared writer schema.\n    const admission = processGroupJournalSchema\n      .extend({\n        minFreeBytes: processGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),\n        maxRecords: processGroupJournalSchema.shape.maxRecords.unwrap(),\n        maxBytes: processGroupJournalSchema.shape.maxBytes.unwrap(),\n      })\n      .parse(c.journal);\n    if ((!isLocalPilotPath(pkg) && !production) || path.resolve(admission.directory) !== admission.directory)\n      throw Error(\"Durable process-group admission is a same-host local pilot\");\n    const persistent = !isLocalPilotPath(admission.directory);\n    if (production && !persistent) throw Error(\"Authorized process-group journal requires a permanent mounted state root\");\n    if (persistent) {\n      const stateRoot = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n      if (!admission.journalId) throw Error(\"Persistent admission needs its initialized journalId binding\");\n      if (\n        process.platform !== \"linux\" ||\n        !stateRoot ||\n        path.resolve(stateRoot) !== stateRoot ||\n        !isProcessGroupJournalPath(stateRoot, admission.directory, descriptor.namespace)\n      )\n        throw Error(\"Persistent admission needs the reviewed Linux node-local state root\");\n      if (JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupPersistentAdmission !== 1)\n        throw Error(\"Publisher does not support persistent admission ownership\");\n    }\n    const capability = JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupAdmission;\n    if (capability !== 1) throw Error(\"Publisher does not support durable process-group admission\");\n    if (path.isAbsolute(admission.groupManifest) || admission.groupManifest.includes(\"..\"))\n      throw Error(\"Admission manifest must be package-relative\");\n    const admitted = manifest.parse(JSON.parse(resource(pkg, dir, admission.groupManifest).toString()));\n    for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))\n      if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Admission directory cannot use symbolic links\");\n    const databaseFile = path.join(admission.directory, \"admission.sqlite\");\n    if (fs.lstatSync(databaseFile).isSymbolicLink()) throw Error(\"Admission journal cannot use symbolic links\");\n    const { DatabaseSync } = createRequire(import.meta.url)(\"node:sqlite\") as typeof import(\"node:sqlite\");\n    const journal = new DatabaseSync(databaseFile, { readOnly: true });\n    try {\n      journal.exec(\"PRAGMA busy_timeout=1000\");\n      if (persistent && journal.prepare(\"SELECT value FROM metadata WHERE key='id'\").get()?.[\"value\"] !== admission.journalId)\n        throw Error(\"Persistent admission journalId binding differs\");\n      const input = resolvedProcessGroupInputChannel(original);\n      const sourceIdentity = processGroupSourceIdentity(input);\n      const expected = processGroupJournalContract(sourceIdentity, admission, admitted.profiles);\n      const contract = journal.prepare(\"SELECT value FROM metadata WHERE key='contract'\").get()?.[\"value\"];\n      if (contract !== expected) throw Error(\"Durable admission journal contract differs\");\n      const capture = JSON.parse(String(journal.prepare(\"SELECT value FROM metadata WHERE key='capture'\").get()?.[\"value\"] ?? \"null\"));\n      if (\n        !capture ||\n        ![\"ready\", \"capacity-blocked\"].includes(capture.state) ||\n        !Number.isSafeInteger(capture.pid) ||\n        capture.pid <= 0 ||\n        !Number.isSafeInteger(capture.heartbeat) ||\n        Date.now() - capture.heartbeat > 5000 ||\n        capture.heartbeat > Date.now() + 1000\n      )\n        throw Error(\"Durable admission receiver is not ready\");\n      process.kill(capture.pid, 0);\n      if (persistent) {\n        const namespace = sha(\n          Buffer.from(fs.readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim() + \":\" + fs.readlinkSync(\"/proc/self/ns/pid\")),\n        );\n        const stored = journal.prepare(\"SELECT value FROM metadata WHERE key='runtime_namespace'\").get()?.[\"value\"];\n        const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, \"utf8\");\n        const start = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \")[19];\n        if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + \":\" + capture.pid + \":\" + start)))\n          throw Error(\"Admission capture namespace or process identity differs\");\n      }\n    } finally {\n      journal.close();\n    }\n    if (publisher.groupManifest && publisher.groupManifest !== admission.groupManifest) throw Error(\"Admission and publisher manifests differ\");\n    if (!publisher.groupManifest) {\n      const member = admitted.profiles.find((p) => p.processName === uns.processName);\n      if (\n        !member ||\n        member.mappingSha256 !== sha(resource(pkg, dir, String(publisher.mappingFile))) ||\n        member.dataGroup !== (publisher.dataGroup ?? descriptor.defaultDataGroup)\n      )\n        throw Error(\"Original publisher differs from admission contract\");\n    }\n  }\n  const checksum = options.configurationChecksum(raw);\n  if (!checksum) throw Error(\"Invalid group configuration\");\n  const processName = uns.processName;\n  for (const k of [...options.excludedUnsFields, \"processName\", \"instanceMode\", \"handover\", \"handoverProtocol\"]) delete uns[k];\n  const projectionChecksum = configurationAuthorizationHash(projectProcessGroupConfiguration(original, descriptor, uns, production?.sha256));\n  if (typeof publisher.groupManifest === \"string\") {\n    if (Object.keys(publisher).some((k) => k !== \"groupManifest\")) throw Error(\"Group selector cannot override member settings\");\n    // Installed manifests are package-relative; members resolve relative to that exact file.\n    if (path.isAbsolute(publisher.groupManifest) || publisher.groupManifest.includes(\"..\")) throw Error(\"Group manifest must be package-relative\");\n    const bytes = resource(pkg, dir, path.resolve(pkg, publisher.groupManifest)),\n      m = manifest.parse(JSON.parse(bytes.toString()));\n    if (\n      m.processName !== processName ||\n      new Set(m.profiles.map((p) => p.processName)).size !== m.profiles.length ||\n      m.profiles.some((p) => p.processName === processName)\n    )\n      throw Error(\"Manifest process identities overlap\");\n    for (const p of m.profiles)\n      if (sha(resource(pkg, dir, p.mappingFile, path.dirname(path.resolve(pkg, publisher.groupManifest)))) !== p.mappingSha256)\n        throw Error(\"Manifest member checksum changed\");\n    return {\n      processName,\n      configurationChecksum: checksum,\n      projectionChecksum,\n      mappingSha256: null,\n      dataGroup: null,\n      contract: {\n        digest: sha(bytes),\n        processName,\n        profiles: m.profiles.map(({ mappingFile: _, ...p }) => p),\n      },\n    };\n  }\n  if (typeof publisher.mappingFile !== \"string\" || Object.keys(publisher).some((k) => ![\"mappingFile\", \"dataGroup\"].includes(k)))\n    throw Error(\"Explicit original mapping file required\");\n  return {\n    processName,\n    configurationChecksum: checksum,\n    projectionChecksum,\n    mappingSha256: sha(resource(pkg, dir, String(publisher.mappingFile))),\n    dataGroup: z\n      .string()\n      .min(1)\n      .max(100)\n      .parse(publisher.dataGroup ?? descriptor.defaultDataGroup),\n    contract: null,\n  };\n}\n"]}
+{"version":3,"file":"process-group-inspection.js","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,IAAI,QAAQ,GACvC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AAYrC,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW,EAAE,IAAY,EAAE,UAAmB;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC,IAAI,CAAC;YACR,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,MAAM,UAAU,gCAAgC,CAC9C,GAAW,EACX,GAAW,EACX,GAAW,EACX,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,EACzD,OAAoG;IAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,UAAU;QAAE,OAAO,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAC/G,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,kCAAkC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAChE,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAClB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,UAAU,GACd,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,4BAA4B,EAAE,CAAC;QACrE,CAAC,CAAC,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnI,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,SAAS,GAAG,yBAAyB;aACxC,MAAM,CAAC;YACN,YAAY,EAAE,yBAAyB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9E,UAAU,EAAE,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;YAC/D,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;SAC5D,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,SAAS;YACtG,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACvH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACtG,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,SAAS;gBACV,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;gBACrC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAEhF,MAAM,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,+BAA+B,KAAK,CAAC;gBAC7G,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC;QAC/G,IAAI,UAAU,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpG,cAAc,CACZ,SAAS,EACT,UAAU,EACV,2BAA2B,CAAC,0BAA0B,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAClI,CAAC;QACF,IAAI,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5I,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;YAChF,IACE,CAAC,MAAM;gBACP,MAAM,CAAC,aAAa,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/E,MAAM,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;gBAEzE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7H,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,gCAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3I,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7H,yFAAyF;QACzF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/I,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,EAC1E,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnD,IACE,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;YAErD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa;gBACtH,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpD,OAAO;YACL,WAAW;YACX,qBAAqB,EAAE,QAAQ;YAC/B,kBAAkB;YAClB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACR,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAClB,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzD,OAAO;QACL,WAAW;QACX,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB;QAClB,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;QAC5D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,SAAgE,EAAE,UAAmB,EAAE,QAAgB;IAC7H,KAAK,IAAI,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnG,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC1G,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACxE,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE;QAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5G,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAiC,CAAC;IACvG,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,IAAI,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,SAAS;YACrH,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QACrG,IAAI,QAAQ,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;QACjI,IACE,CAAC,OAAO;YACR,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YACtD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,OAAO,CAAC,GAAG,IAAI,CAAC;YAChB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;YACxC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI;YACrC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAErC,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,GAAG,CACnB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAC5H,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5G,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC;gBAC7H,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAW,EACX,GAAW,EACX,GAAW,EACX,QAAiC,EACjC,QAAoE,EACpE,cAAsB,EACtB,OAAoG;IAEpG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC7C,MAAM,GAAG,GAAG,EAAE,GAAI,QAAQ,CAAC,KAAK,CAA6B,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAChE,IAAI,GAAG,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACrG,IACE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC;QACnC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAC1E,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC;QAE5C,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,+BAA+B;SAC5C,MAAM,CAAC;QACN,YAAY,EAAE,+BAA+B,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpF,UAAU,EAAE,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;QACrE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;KAClE,CAAC;SACD,KAAK,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GACd,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC,CAAC,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpJ,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5I,IAAI,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;IACtF,IAAI,QAAQ,EAAE,qBAAqB,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,+BAA+B,KAAK,CAAC,CAAC;QAC1G,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,iCAAiC,CAChD,QAAQ,EACR,0BAA0B,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC,EACtE,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9C,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CACpH,CAAC;IACF,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACjI,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,IAAuB,EAAE,EAAE;QACzC,IAAI,IAAI,GAAG,UAAU,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC5G,IAAI,GAAG,KAAgC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrB,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC1B,IAAI,UAAU;QAAE,UAAU,CAAC,qBAAqB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IACtE,OAAO;QACL,WAAW,EAAE,MAAM,CAAE,QAAQ,CAAC,KAAK,CAA6B,CAAC,aAAa,CAAC,CAAC;QAChF,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB,EAAE,yBAAyB,CAAC,UAAU,CAAC;QACzD,wBAAwB,EAAE,QAAQ,CAAC,MAAM;QACzC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,MAAM,EAAE,cAAc,IAAI,IAAI;QAC7C,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;QACpC,QAAQ,EAAE,MAAM;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;gBACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnF,EAAE;oBACF,WAAW;oBACX,aAAa,EAAE,cAAc;oBAC7B,SAAS;iBACV,CAAC,CAAC;aACJ;KACN,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport {\n  configurationGroupJournalContract,\n  configurationGroupJournalSchema,\n  configurationResourceHash,\n  selectedConfigurationGroup,\n} from \"./configuration-group-contract.js\";\nimport {\n  assertProcessGroupStateMount,\n  authorizeConfiguredProcessGroupRuntime,\n  configurationAuthorizationHash,\n  hasProcessGroupAuthorization,\n  processGroupManifestSchema as manifest,\n} from \"./process-group-authorization.js\";\nimport { readConfigurationSelector } from \"./process-group-contract.js\";\nimport {\n  isLocalPilotPath,\n  isProcessGroupJournalPath,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  processGroupJournalContract,\n  processGroupJournalSchema,\n  processGroupSourceIdentity,\n  projectProcessGroupConfiguration,\n  resolvedProcessGroupInputChannel,\n} from \"./process-group-contract.js\";\n\nexport interface ProcessGroupConfigurationEvidence {\n  configurationGroupSha256?: string;\n  generationId?: string;\n  processName: string;\n  configurationChecksum: string;\n  projectionChecksum: string;\n  mappingSha256: string | null;\n  dataGroup: string | null;\n  contract: { digest: string; processName: string; profiles: { id: string; processName: string; mappingSha256: string; dataGroup: string }[] } | null;\n}\n/** Bound reads to installed package/instance resources, never arbitrary paths or symlinks. */\nfunction resource(pkg: string, dir: string, file: string, relativeTo?: string): Buffer {\n  if (file.length > 512) throw Error(\"Group resource path too long\");\n  const roots = [fs.realpathSync(pkg), fs.realpathSync(dir)];\n  const candidates = relativeTo\n    ? [path.resolve(relativeTo, file)]\n    : path.isAbsolute(file)\n      ? [file]\n      : [path.resolve(dir, file), path.resolve(pkg, file)];\n  for (const candidate of candidates) {\n    if (!fs.existsSync(candidate)) continue;\n    const real = fs.realpathSync(candidate);\n    if (real !== candidate || !roots.some((root) => real.startsWith(root + path.sep)))\n      throw Error(\"Group resource must stay inside installed package or instance\");\n    const fd = fs.openSync(real, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n    try {\n      const s = fs.fstatSync(fd);\n      if (!s.isFile() || s.size > 1048576) throw Error(\"Invalid group resource\");\n      const b = fs.readFileSync(fd);\n      if (b.length > 1048576) throw Error(\"Group resource too large\");\n      return b;\n    } finally {\n      fs.closeSync(fd);\n    }\n  }\n  throw Error(\"Installed group resource is missing\");\n}\nconst sha = (b: Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nexport function inspectProcessGroupConfiguration(\n  pkg: string,\n  dir: string,\n  raw: string,\n  controllerName = process.env[\"UNS_CONTROLLER_NAME\"] ?? \"\",\n  options: { configurationChecksum(raw: string): string | null; excludedUnsFields: readonly string[] },\n): ProcessGroupConfigurationEvidence {\n  const original = JSON.parse(raw);\n  const configured = selectedConfigurationGroup(pkg, original);\n  if (configured) return inspectConfigurationGroup(pkg, dir, raw, original, configured, controllerName, options);\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Installed package has no supported process-group contract\");\n  const c = normalizeProcessGroupConfiguration(original, descriptor),\n    uns = { ...c.uns },\n    publisher = c.publisher;\n  const production =\n    c.journal && (!isLocalPilotPath(pkg) || hasProcessGroupAuthorization())\n      ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName)\n      : undefined;\n  if (production) assertProcessGroupStateMount(production, process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"] ?? \"\");\n  if (!c.matches || (c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") || !publisher || typeof uns.processName !== \"string\")\n    throw Error(\"This runtime has no supported reviewed group configuration\");\n  if (c.journal !== undefined) {\n    // Readiness requires explicit capacities; their limits come from the shared writer schema.\n    const admission = processGroupJournalSchema\n      .extend({\n        minFreeBytes: processGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),\n        maxRecords: processGroupJournalSchema.shape.maxRecords.unwrap(),\n        maxBytes: processGroupJournalSchema.shape.maxBytes.unwrap(),\n      })\n      .parse(c.journal);\n    if ((!isLocalPilotPath(pkg) && !production) || path.resolve(admission.directory) !== admission.directory)\n      throw Error(\"Durable process-group admission is a same-host local pilot\");\n    const persistent = !isLocalPilotPath(admission.directory);\n    if (production && !persistent) throw Error(\"Authorized process-group journal requires a permanent mounted state root\");\n    if (persistent) {\n      const stateRoot = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n      if (!admission.journalId) throw Error(\"Persistent admission needs its initialized journalId binding\");\n      if (\n        process.platform !== \"linux\" ||\n        !stateRoot ||\n        path.resolve(stateRoot) !== stateRoot ||\n        !isProcessGroupJournalPath(stateRoot, admission.directory, descriptor.namespace)\n      )\n        throw Error(\"Persistent admission needs the reviewed Linux node-local state root\");\n      if (JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupPersistentAdmission !== 1)\n        throw Error(\"Publisher does not support persistent admission ownership\");\n    }\n    const capability = JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupAdmission;\n    if (capability !== 1) throw Error(\"Publisher does not support durable process-group admission\");\n    if (path.isAbsolute(admission.groupManifest) || admission.groupManifest.includes(\"..\"))\n      throw Error(\"Admission manifest must be package-relative\");\n    const admitted = manifest.parse(JSON.parse(resource(pkg, dir, admission.groupManifest).toString()));\n    inspectJournal(\n      admission,\n      persistent,\n      processGroupJournalContract(processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)), admission, admitted.profiles),\n    );\n    if (publisher.groupManifest && publisher.groupManifest !== admission.groupManifest) throw Error(\"Admission and publisher manifests differ\");\n    if (!publisher.groupManifest) {\n      const member = admitted.profiles.find((p) => p.processName === uns.processName);\n      if (\n        !member ||\n        member.mappingSha256 !== sha(resource(pkg, dir, String(publisher.mappingFile))) ||\n        member.dataGroup !== (publisher.dataGroup ?? descriptor.defaultDataGroup)\n      )\n        throw Error(\"Original publisher differs from admission contract\");\n    }\n  }\n  const checksum = options.configurationChecksum(raw);\n  if (!checksum) throw Error(\"Invalid group configuration\");\n  const processName = uns.processName;\n  for (const k of [...options.excludedUnsFields, \"processName\", \"instanceMode\", \"handover\", \"handoverProtocol\"]) delete uns[k];\n  const projectionChecksum = configurationAuthorizationHash(projectProcessGroupConfiguration(original, descriptor, uns, production?.sha256));\n  if (typeof publisher.groupManifest === \"string\") {\n    if (Object.keys(publisher).some((k) => k !== \"groupManifest\")) throw Error(\"Group selector cannot override member settings\");\n    // Installed manifests are package-relative; members resolve relative to that exact file.\n    if (path.isAbsolute(publisher.groupManifest) || publisher.groupManifest.includes(\"..\")) throw Error(\"Group manifest must be package-relative\");\n    const bytes = resource(pkg, dir, path.resolve(pkg, publisher.groupManifest)),\n      m = manifest.parse(JSON.parse(bytes.toString()));\n    if (\n      m.processName !== processName ||\n      new Set(m.profiles.map((p) => p.processName)).size !== m.profiles.length ||\n      m.profiles.some((p) => p.processName === processName)\n    )\n      throw Error(\"Manifest process identities overlap\");\n    for (const p of m.profiles)\n      if (sha(resource(pkg, dir, p.mappingFile, path.dirname(path.resolve(pkg, publisher.groupManifest)))) !== p.mappingSha256)\n        throw Error(\"Manifest member checksum changed\");\n    return {\n      processName,\n      configurationChecksum: checksum,\n      projectionChecksum,\n      mappingSha256: null,\n      dataGroup: null,\n      contract: {\n        digest: sha(bytes),\n        processName,\n        profiles: m.profiles.map(({ mappingFile: _, ...p }) => p),\n      },\n    };\n  }\n  if (typeof publisher.mappingFile !== \"string\" || Object.keys(publisher).some((k) => ![\"mappingFile\", \"dataGroup\"].includes(k)))\n    throw Error(\"Explicit original mapping file required\");\n  return {\n    processName,\n    configurationChecksum: checksum,\n    projectionChecksum,\n    mappingSha256: sha(resource(pkg, dir, String(publisher.mappingFile))),\n    dataGroup: z\n      .string()\n      .min(1)\n      .max(100)\n      .parse(publisher.dataGroup ?? descriptor.defaultDataGroup),\n    contract: null,\n  };\n}\n\n/** Shared read-only receiver/journal evidence for both resource protocols. */\nfunction inspectJournal(admission: { directory: string; journalId?: string | undefined }, persistent: boolean, expected: string): void {\n  for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))\n    if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Admission directory cannot use symbolic links\");\n  const databaseFile = path.join(admission.directory, \"admission.sqlite\");\n  if (fs.lstatSync(databaseFile).isSymbolicLink()) throw Error(\"Admission journal cannot use symbolic links\");\n  const { DatabaseSync } = createRequire(import.meta.url)(\"node:sqlite\") as typeof import(\"node:sqlite\");\n  const journal = new DatabaseSync(databaseFile, { readOnly: true });\n  try {\n    journal.exec(\"PRAGMA busy_timeout=1000\");\n    if (persistent && journal.prepare(\"SELECT value FROM metadata WHERE key='id'\").get()?.[\"value\"] !== admission.journalId)\n      throw Error(\"Persistent admission journalId binding differs\");\n    const contract = journal.prepare(\"SELECT value FROM metadata WHERE key='contract'\").get()?.[\"value\"];\n    if (contract !== expected) throw Error(\"Durable admission journal contract differs\");\n    const capture = JSON.parse(String(journal.prepare(\"SELECT value FROM metadata WHERE key='capture'\").get()?.[\"value\"] ?? \"null\"));\n    if (\n      !capture ||\n      ![\"ready\", \"capacity-blocked\"].includes(capture.state) ||\n      !Number.isSafeInteger(capture.pid) ||\n      capture.pid <= 0 ||\n      !Number.isSafeInteger(capture.heartbeat) ||\n      Date.now() - capture.heartbeat > 5000 ||\n      capture.heartbeat > Date.now() + 1000\n    )\n      throw Error(\"Durable admission receiver is not ready\");\n    process.kill(capture.pid, 0);\n    if (persistent) {\n      const namespace = sha(\n        Buffer.from(fs.readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim() + \":\" + fs.readlinkSync(\"/proc/self/ns/pid\")),\n      );\n      const stored = journal.prepare(\"SELECT value FROM metadata WHERE key='runtime_namespace'\").get()?.[\"value\"];\n      const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, \"utf8\");\n      const start = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \")[19];\n      if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + \":\" + capture.pid + \":\" + start)))\n        throw Error(\"Admission capture namespace or process identity differs\");\n    }\n  } finally {\n    journal.close();\n  }\n}\n\nfunction inspectConfigurationGroup(\n  pkg: string,\n  dir: string,\n  raw: string,\n  original: Record<string, unknown>,\n  selected: NonNullable<ReturnType<typeof selectedConfigurationGroup>>,\n  controllerName: string,\n  options: { configurationChecksum(raw: string): string | null; excludedUnsFields: readonly string[] },\n): ProcessGroupConfigurationEvidence {\n  const { descriptor: d, snapshot } = selected;\n  const uns = { ...(original[\"uns\"] as Record<string, unknown>) };\n  const memberId = readConfigurationSelector(original, d.memberPath),\n    role = readConfigurationSelector(original, d.runtimeRolePath);\n  const member = memberId === undefined ? undefined : snapshot.profiles.find((p) => p.id === memberId);\n  if (\n    (memberId !== undefined && !member) ||\n    uns[\"processName\"] !== (member?.processName ?? snapshot.group.processName) ||\n    (role !== undefined && role !== \"publisher\")\n  )\n    throw Error(\"Configured publisher role or identity differs\");\n  const journal = configurationGroupJournalSchema\n    .extend({\n      minFreeBytes: configurationGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),\n      maxRecords: configurationGroupJournalSchema.shape.maxRecords.unwrap(),\n      maxBytes: configurationGroupJournalSchema.shape.maxBytes.unwrap(),\n    })\n    .parse(readConfigurationSelector(original, d.journalPath));\n  const production =\n    !isLocalPilotPath(pkg) || hasProcessGroupAuthorization() ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName) : undefined;\n  const persistent = !isLocalPilotPath(journal.directory);\n  if (production) assertProcessGroupStateMount(production, process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"] ?? \"\");\n  if (path.resolve(journal.directory) !== journal.directory || (production && !persistent)) throw Error(\"Configured journal storage differs\");\n  if (persistent && (!production || !journal.journalId)) throw Error(\"Persistent configured journal requires exact reviewed authority and UUID\");\n  const metadata = JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub;\n  if (metadata?.processGroupAdmission !== 1 || (persistent && metadata?.processGroupPersistentAdmission !== 1))\n    throw Error(\"Required journal capabilities missing\");\n  const expected = configurationGroupJournalContract(\n    snapshot,\n    processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)),\n    configurationGroupJournalSchema.parse(journal),\n    snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })),\n  );\n  inspectJournal(journal, persistent, expected);\n  const checksum = options.configurationChecksum(raw);\n  if (!checksum) throw Error(\"Invalid configured group configuration\");\n  for (const key of [...options.excludedUnsFields, \"processName\", \"instanceMode\", \"handover\", \"handoverProtocol\"]) delete uns[key];\n  const projection = structuredClone(original);\n  projection[\"uns\"] = uns;\n  const remove = (keys: readonly string[]) => {\n    let node = projection;\n    for (const key of keys.slice(0, -1)) {\n      const child = node[key];\n      if (child === undefined) return;\n      if (!child || typeof child !== \"object\" || Array.isArray(child)) throw Error(\"Invalid selector projection\");\n      node = child as Record<string, unknown>;\n    }\n    delete node[keys.at(-1)!];\n  };\n  remove(d.memberPath);\n  remove(d.runtimeRolePath);\n  if (production) projection[\"authorizationSha256\"] = production.sha256;\n  return {\n    processName: String((original[\"uns\"] as Record<string, unknown>)[\"processName\"]),\n    configurationChecksum: checksum,\n    projectionChecksum: configurationResourceHash(projection),\n    configurationGroupSha256: snapshot.sha256,\n    generationId: journal.generationId,\n    mappingSha256: member?.resourceSha256 ?? null,\n    dataGroup: member?.dataGroup ?? null,\n    contract: member\n      ? null\n      : {\n          digest: snapshot.sha256,\n          processName: snapshot.group.processName,\n          profiles: snapshot.profiles.map(({ id, processName, resourceSha256, dataGroup }) => ({\n            id,\n            processName,\n            mappingSha256: resourceSha256,\n            dataGroup,\n          })),\n        },\n  };\n}\n"]}

package/dist/runtime/process-group-resources.d.ts

@@ -1,5 +1,6 @@
 export declare const sha256: (b: string | Buffer) => string;
 export declare const configurationAuthorizationHash: (v: unknown) => string;
+export declare function assertPrivateProcessGroupDirectory(dir: string): void;
 export declare function readProcessGroupResource(file: string, privateFile?: boolean): Buffer;
 /** Pins metadata and compiled JS/JSON modules, not an installed dependency tree. */
 export declare function groupArtifactHash(root: string): string;

package/dist/runtime/process-group-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-resources.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,GAAG,MAAM,WAAiD,CAAC;AAW3F,eAAO,MAAM,8BAA8B,GAAI,GAAG,OAAO,KAAG,MAA8C,CAAC;AAC3G,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,MAAM,CAelF;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+BtD;AACD,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoB7D"}
+{"version":3,"file":"process-group-resources.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,GAAG,MAAM,WAAiD,CAAC;AAW3F,eAAO,MAAM,8BAA8B,GAAI,GAAG,OAAO,KAAG,MAA8C,CAAC;AAC3G,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKpE;AACD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,MAAM,CAelF;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+BtD;AACD,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoB7D"}

package/dist/runtime/process-group-resources.js

@@ -12,6 +12,14 @@ function canonical(v) {
         : v;
 }
 export const configurationAuthorizationHash = (v) => sha256(JSON.stringify(canonical(v)));
+export function assertPrivateProcessGroupDirectory(dir) {
+    for (let p = dir; p !== path.dirname(p); p = path.dirname(p))
+        if (fs.lstatSync(p).isSymbolicLink())
+            throw Error("Linked policy directory");
+    const s = fs.lstatSync(dir);
+    if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)
+        throw Error("Insecure policy directory");
+}
 export function readProcessGroupResource(file, privateFile = false) {
     if (file.length > 512 || path.resolve(file) !== file)
         throw Error("Process-group authorization resource path is not normalized");

package/dist/runtime/process-group-resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-resources.js","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;aACd,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACtC;QACH,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AACD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,WAAW,GAAG,KAAK;IACxE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjI,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/H,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,EACX,OAAO,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC;YACN,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAClC,IAAI,EAAE,OAAO,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;qBACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF,OAAO,8BAA8B,CACnC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAmB;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC5G,OAAO,8BAA8B,CACnC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,QAAQ;YACR,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;YAC3B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI;YACnC,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,IAAI;YACnD,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nexport const sha256 = (b: string | Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nfunction canonical(v: unknown): unknown {\n  if (Array.isArray(v)) return v.map(canonical);\n  return v && typeof v === \"object\"\n    ? Object.fromEntries(\n        Object.entries(v)\n          .sort(([a], [b]) => a.localeCompare(b))\n          .map(([k, x]) => [k, canonical(x)]),\n      )\n    : v;\n}\nexport const configurationAuthorizationHash = (v: unknown): string => sha256(JSON.stringify(canonical(v)));\nexport function readProcessGroupResource(file: string, privateFile = false): Buffer {\n  if (file.length > 512 || path.resolve(file) !== file) throw Error(\"Process-group authorization resource path is not normalized\");\n  for (let p = file; p !== path.dirname(p); p = path.dirname(p))\n    if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Process-group authorization resource cannot contain links\");\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  try {\n    const s = fs.fstatSync(fd);\n    if (!s.isFile() || s.size > 1048576 || s.nlink !== 1 || (privateFile && (s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)))\n      throw Error(\"Process-group authorization resource is not a bounded private regular file\");\n    const b = fs.readFileSync(fd);\n    if (b.length > 1048576) throw Error(\"Process-group authorization resource too large\");\n    return b;\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n/** Pins metadata and compiled JS/JSON modules, not an installed dependency tree. */\nexport function groupArtifactHash(root: string): string {\n  const files = [\"package.json\"];\n  let total = 0,\n    entries = 0;\n  const visit = (dir: string, depth = 0) => {\n    if (depth > 32) throw Error(\"Process-group artifact directory depth exceeded\");\n    const directory = fs.opendirSync(dir);\n    try {\n      let e;\n      while ((e = directory.readSync())) {\n        if (++entries > 4096) throw Error(\"Process-group artifact directory budget exceeded\");\n        const f = path.join(dir, e.name);\n        if (e.isSymbolicLink()) throw Error(\"Process-group artifact cannot contain links\");\n        if (e.isDirectory()) visit(f, depth + 1);\n        else if (e.isFile() && /\\.(?:[cm]?js|json)$/.test(e.name)) files.push(path.relative(root, f));\n        if (files.length > 2048) throw Error(\"Process-group artifact file budget exceeded\");\n      }\n    } finally {\n      directory.closeSync();\n    }\n  };\n  visit(path.join(root, \"dist\"));\n  if (files.length < 2) throw Error(\"Process-group compiled artifact is missing\");\n  return configurationAuthorizationHash(\n    files.sort().map((f) => {\n      const b = readProcessGroupResource(path.join(root, f));\n      total += b.length;\n      if (total > 32 * 1024 * 1024) throw Error(\"Process-group artifact byte budget exceeded\");\n      return [f, sha256(b)];\n    }),\n  );\n}\n/** Endpoint/TLS identity only; credentials never become a policy field or diagnostic. */\nexport function groupChannelsHash(channels: unknown[]): string {\n  if (channels.length !== 3) throw Error(\"Process-group requires infra, input and output channel identities\");\n  return configurationAuthorizationHash(\n    channels.map((value) => {\n      const c = value as Record<string, unknown>;\n      if (typeof c[\"host\"] !== \"string\" || !c[\"host\"]) throw Error(\"Process-group broker host must be resolved\");\n      const protocol = c[\"protocol\"] ?? \"mqtt\";\n      return {\n        host: c[\"host\"],\n        port: c[\"port\"] ?? (protocol === \"mqtts\" ? 8883 : 1883),\n        protocol,\n        hosts: c[\"hosts\"] ?? [],\n        servers: c[\"servers\"] ?? [],\n        servername: c[\"servername\"] ?? null,\n        rejectUnauthorized: c[\"rejectUnauthorized\"] ?? true,\n        ca: c[\"ca\"] === undefined ? null : sha256(String(c[\"ca\"])),\n        cert: c[\"cert\"] === undefined ? null : sha256(String(c[\"cert\"])),\n      };\n    }),\n  );\n}\n"]}
+{"version":3,"file":"process-group-resources.js","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;aACd,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACtC;QACH,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AACD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,MAAM,UAAU,kCAAkC,CAAC,GAAW;IAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC3H,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,WAAW,GAAG,KAAK;IACxE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjI,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/H,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,EACX,OAAO,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC;YACN,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAClC,IAAI,EAAE,OAAO,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;qBACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF,OAAO,8BAA8B,CACnC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAmB;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC5G,OAAO,8BAA8B,CACnC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,QAAQ;YACR,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;YAC3B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI;YACnC,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,IAAI;YACnD,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nexport const sha256 = (b: string | Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nfunction canonical(v: unknown): unknown {\n  if (Array.isArray(v)) return v.map(canonical);\n  return v && typeof v === \"object\"\n    ? Object.fromEntries(\n        Object.entries(v)\n          .sort(([a], [b]) => a.localeCompare(b))\n          .map(([k, x]) => [k, canonical(x)]),\n      )\n    : v;\n}\nexport const configurationAuthorizationHash = (v: unknown): string => sha256(JSON.stringify(canonical(v)));\nexport function assertPrivateProcessGroupDirectory(dir: string): void {\n  for (let p = dir; p !== path.dirname(p); p = path.dirname(p))\n    if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Linked policy directory\");\n  const s = fs.lstatSync(dir);\n  if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0) throw Error(\"Insecure policy directory\");\n}\nexport function readProcessGroupResource(file: string, privateFile = false): Buffer {\n  if (file.length > 512 || path.resolve(file) !== file) throw Error(\"Process-group authorization resource path is not normalized\");\n  for (let p = file; p !== path.dirname(p); p = path.dirname(p))\n    if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Process-group authorization resource cannot contain links\");\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  try {\n    const s = fs.fstatSync(fd);\n    if (!s.isFile() || s.size > 1048576 || s.nlink !== 1 || (privateFile && (s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)))\n      throw Error(\"Process-group authorization resource is not a bounded private regular file\");\n    const b = fs.readFileSync(fd);\n    if (b.length > 1048576) throw Error(\"Process-group authorization resource too large\");\n    return b;\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n/** Pins metadata and compiled JS/JSON modules, not an installed dependency tree. */\nexport function groupArtifactHash(root: string): string {\n  const files = [\"package.json\"];\n  let total = 0,\n    entries = 0;\n  const visit = (dir: string, depth = 0) => {\n    if (depth > 32) throw Error(\"Process-group artifact directory depth exceeded\");\n    const directory = fs.opendirSync(dir);\n    try {\n      let e;\n      while ((e = directory.readSync())) {\n        if (++entries > 4096) throw Error(\"Process-group artifact directory budget exceeded\");\n        const f = path.join(dir, e.name);\n        if (e.isSymbolicLink()) throw Error(\"Process-group artifact cannot contain links\");\n        if (e.isDirectory()) visit(f, depth + 1);\n        else if (e.isFile() && /\\.(?:[cm]?js|json)$/.test(e.name)) files.push(path.relative(root, f));\n        if (files.length > 2048) throw Error(\"Process-group artifact file budget exceeded\");\n      }\n    } finally {\n      directory.closeSync();\n    }\n  };\n  visit(path.join(root, \"dist\"));\n  if (files.length < 2) throw Error(\"Process-group compiled artifact is missing\");\n  return configurationAuthorizationHash(\n    files.sort().map((f) => {\n      const b = readProcessGroupResource(path.join(root, f));\n      total += b.length;\n      if (total > 32 * 1024 * 1024) throw Error(\"Process-group artifact byte budget exceeded\");\n      return [f, sha256(b)];\n    }),\n  );\n}\n/** Endpoint/TLS identity only; credentials never become a policy field or diagnostic. */\nexport function groupChannelsHash(channels: unknown[]): string {\n  if (channels.length !== 3) throw Error(\"Process-group requires infra, input and output channel identities\");\n  return configurationAuthorizationHash(\n    channels.map((value) => {\n      const c = value as Record<string, unknown>;\n      if (typeof c[\"host\"] !== \"string\" || !c[\"host\"]) throw Error(\"Process-group broker host must be resolved\");\n      const protocol = c[\"protocol\"] ?? \"mqtt\";\n      return {\n        host: c[\"host\"],\n        port: c[\"port\"] ?? (protocol === \"mqtts\" ? 8883 : 1883),\n        protocol,\n        hosts: c[\"hosts\"] ?? [],\n        servers: c[\"servers\"] ?? [],\n        servername: c[\"servername\"] ?? null,\n        rejectUnauthorized: c[\"rejectUnauthorized\"] ?? true,\n        ca: c[\"ca\"] === undefined ? null : sha256(String(c[\"ca\"])),\n        cert: c[\"cert\"] === undefined ? null : sha256(String(c[\"cert\"])),\n      };\n    }),\n  );\n}\n"]}

package/dist/runtime/process-group-runtime-selection.d.ts

@@ -0,0 +1,14 @@
+import { type ConfigurationGroupDescriptor } from "./configuration-group-contract.js";
+import { type ProcessGroupRuntimeDescriptor } from "./process-group-contract.js";
+export type RuntimeGroupDescriptor = ProcessGroupRuntimeDescriptor | ConfigurationGroupDescriptor;
+/** Pick configuration resources only when explicitly selected; file consumers stay unchanged. */
+export declare function selectedProcessGroupDescriptor(pkg: string, raw: Record<string, unknown>): RuntimeGroupDescriptor | undefined;
+export declare function normalizeRuntimeProcessGroup(raw: Record<string, unknown>, descriptor: RuntimeGroupDescriptor): {
+    matches: boolean;
+    uns: Record<string, unknown>;
+    publisher: Record<string, unknown>;
+    journal: unknown;
+    runtimeRole: unknown;
+    configurationSnapshot: import("./configuration-group-contract.js").ConfigurationGroupSnapshot;
+};
+//# sourceMappingURL=process-group-runtime-selection.d.ts.map

package/dist/runtime/process-group-runtime-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-runtime-selection.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-runtime-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,4BAA4B,EAA4D,MAAM,mCAAmC,CAAC;AAChJ,OAAO,EACL,KAAK,6BAA6B,EAInC,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,4BAA4B,CAAC;AAElG,iGAAiG;AACjG,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,GAAG,SAAS,CAI5H;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,sBAAsB;;SAW7F,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;eACX,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;EAKlD"}

package/dist/runtime/process-group-runtime-selection.js

@@ -0,0 +1,29 @@
+import { configurationGroupDescriptor, configurationGroupSnapshot } from "./configuration-group-contract.js";
+import { normalizeProcessGroupConfiguration, processGroupDescriptor, readConfigurationSelector, } from "./process-group-contract.js";
+/** Pick configuration resources only when explicitly selected; file consumers stay unchanged. */
+export function selectedProcessGroupDescriptor(pkg, raw) {
+    const configured = configurationGroupDescriptor(pkg);
+    if (configured && readConfigurationSelector(raw, configured.groupPath) !== undefined)
+        return configured;
+    return processGroupDescriptor(pkg);
+}
+export function normalizeRuntimeProcessGroup(raw, descriptor) {
+    if (descriptor.protocolVersion === 1)
+        return { ...normalizeProcessGroupConfiguration(raw, descriptor), configurationSnapshot: undefined };
+    const matches = !descriptor.match || readConfigurationSelector(raw, descriptor.match.path) === descriptor.match.value;
+    const snapshot = configurationGroupSnapshot(readConfigurationSelector(raw, descriptor.groupPath));
+    const runtimeRole = readConfigurationSelector(raw, descriptor.runtimeRolePath);
+    const publisher = readConfigurationSelector(raw, descriptor.publisherPath);
+    const uns = raw["uns"];
+    if (!uns || typeof uns !== "object" || Array.isArray(uns) || !publisher || typeof publisher !== "object" || Array.isArray(publisher))
+        throw Error("Explicit process-group publisher and identity required");
+    return {
+        matches,
+        uns: uns,
+        publisher: publisher,
+        journal: readConfigurationSelector(raw, descriptor.journalPath),
+        runtimeRole: runtimeRole === descriptor.receiverRole ? "admission" : runtimeRole,
+        configurationSnapshot: snapshot,
+    };
+}
+//# sourceMappingURL=process-group-runtime-selection.js.map

package/dist/runtime/process-group-runtime-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-runtime-selection.js","sourceRoot":"","sources":["../../src/runtime/process-group-runtime-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAChJ,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAIrC,iGAAiG;AACjG,MAAM,UAAU,8BAA8B,CAAC,GAAW,EAAE,GAA4B;IACtF,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,UAAU,IAAI,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACxG,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAA4B,EAAE,UAAkC;IAC3G,IAAI,UAAU,CAAC,eAAe,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;IAC1I,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IACtH,MAAM,QAAQ,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAClI,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACxE,OAAO;QACL,OAAO;QACP,GAAG,EAAE,GAA8B;QACnC,SAAS,EAAE,SAAoC;QAC/C,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC;QAC/D,WAAW,EAAE,WAAW,KAAK,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;QAChF,qBAAqB,EAAE,QAAQ;KAChC,CAAC;AACJ,CAAC","sourcesContent":["import { type ConfigurationGroupDescriptor, configurationGroupDescriptor, configurationGroupSnapshot } from \"./configuration-group-contract.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  readConfigurationSelector,\n} from \"./process-group-contract.js\";\n\nexport type RuntimeGroupDescriptor = ProcessGroupRuntimeDescriptor | ConfigurationGroupDescriptor;\n\n/** Pick configuration resources only when explicitly selected; file consumers stay unchanged. */\nexport function selectedProcessGroupDescriptor(pkg: string, raw: Record<string, unknown>): RuntimeGroupDescriptor | undefined {\n  const configured = configurationGroupDescriptor(pkg);\n  if (configured && readConfigurationSelector(raw, configured.groupPath) !== undefined) return configured;\n  return processGroupDescriptor(pkg);\n}\n\nexport function normalizeRuntimeProcessGroup(raw: Record<string, unknown>, descriptor: RuntimeGroupDescriptor) {\n  if (descriptor.protocolVersion === 1) return { ...normalizeProcessGroupConfiguration(raw, descriptor), configurationSnapshot: undefined };\n  const matches = !descriptor.match || readConfigurationSelector(raw, descriptor.match.path) === descriptor.match.value;\n  const snapshot = configurationGroupSnapshot(readConfigurationSelector(raw, descriptor.groupPath));\n  const runtimeRole = readConfigurationSelector(raw, descriptor.runtimeRolePath);\n  const publisher = readConfigurationSelector(raw, descriptor.publisherPath);\n  const uns = raw[\"uns\"];\n  if (!uns || typeof uns !== \"object\" || Array.isArray(uns) || !publisher || typeof publisher !== \"object\" || Array.isArray(publisher))\n    throw Error(\"Explicit process-group publisher and identity required\");\n  return {\n    matches,\n    uns: uns as Record<string, unknown>,\n    publisher: publisher as Record<string, unknown>,\n    journal: readConfigurationSelector(raw, descriptor.journalPath),\n    runtimeRole: runtimeRole === descriptor.receiverRole ? \"admission\" : runtimeRole,\n    configurationSnapshot: snapshot,\n  };\n}\n"]}

package/dist/runtime/process-group-snapshot.mjs

@@ -4,7 +4,16 @@ import fs from "node:fs";
 import path from "node:path";
 import { DatabaseSync, backup } from "node:sqlite";
 
-const [root, output] = process.argv.slice(2);
+const [root, output, suppliedContract] = process.argv.slice(2);
+// The host passes the fixed SDK contract, never request-controlled limits. Legacy
+// two-argument callers retain their historical nine-journal bound.
+const limits = suppliedContract === undefined
+  ? {schemaVersion:1,maximumJournals:9,maximumManifestBytes:262144,maximumSnapshotBytes:536870912,maximumCapsuleBytes:1073741824}
+  : JSON.parse(suppliedContract);
+if (JSON.stringify(Object.keys(limits).sort()) !== JSON.stringify(["schemaVersion","maximumJournals","maximumManifestBytes","maximumSnapshotBytes","maximumCapsuleBytes"].sort()) ||
+    limits.schemaVersion !== 1 || !Number.isSafeInteger(limits.maximumJournals) || limits.maximumJournals < 1 || limits.maximumJournals > 128 ||
+    limits.maximumManifestBytes !== 262144 || limits.maximumSnapshotBytes !== 536870912 || limits.maximumCapsuleBytes !== 1073741824)
+  throw Error("Unsupported fixed snapshot contract");
 const hash = (b) => crypto.createHash("sha256").update(b).digest("hex");
 const fileHash = (p) => {
   const h = crypto.createHash("sha256"),
@@ -83,9 +92,9 @@ for (const namespace of namespaces) {
   }
   check(admittedRoot, true);
   const groups = fs.readdirSync(admittedRoot).sort();
-  if (groups.length > 9) fail();
+  if (groups.length > limits.maximumJournals) fail();
   for (const group of groups) {
-    if (!/^[a-z][a-z0-9-]{0,99}$/.test(group) || capturedGroups.has(group) || capturedGroups.size >= 9) fail();
+    if (!/^[a-z][a-z0-9-]{0,99}$/.test(group) || capturedGroups.has(group) || capturedGroups.size >= limits.maximumJournals) fail();
     capturedGroups.add(group);
     const source = path.join(admittedRoot, group);
     check(source, true);
@@ -102,7 +111,7 @@ for (const namespace of namespaces) {
       }
     }, 0);
     capturedBytes += sourceSize;
-    if (capturedBytes > 512 * 1024 * 1024) fail();
+    if (capturedBytes > limits.maximumSnapshotBytes) fail();
     const space = fs.statfsSync(output, { bigint: true });
     if (space.bavail * space.bsize < BigInt(sourceSize * 2 + 64 * 1024 * 1024)) fail();
     const target = path.join(output, group);
@@ -123,7 +132,7 @@ for (const namespace of namespaces) {
             space = fs.statfsSync(output, { bigint: true });
           if (
             !Number.isSafeInteger(bytes) ||
-            bytes > 512 * 1024 * 1024 - snapshotBytes ||
+            bytes > limits.maximumSnapshotBytes - snapshotBytes ||
             space.bavail * space.bsize < BigInt(bytes + 64 * 1024 * 1024)
           )
             fail();
@@ -148,7 +157,45 @@ for (const namespace of namespaces) {
       if (!/^[0-9a-f-]{36}$/.test(meta.id ?? "")) fail();
       const contract = JSON.parse(meta.contract);
       const profiles = snap.prepare("SELECT name,contract,completed,last_seq FROM profiles ORDER BY name").all();
-      if (profiles.length < 1 || profiles.length > 19 || contract.version !== 1 || contract.profiles.length !== profiles.length) fail();
+      if (
+        profiles.length < 1 ||
+        profiles.length > 19 ||
+        ![1, 2].includes(contract.version) ||
+        !Array.isArray(contract.profiles) ||
+        contract.profiles.length !== profiles.length
+      )
+        fail();
+      if (contract.version === 2) {
+        if (
+          contract.generationId !== group ||
+          !/^[a-f0-9]{64}$/.test(contract.groupSha256 ?? "") ||
+          !/^[a-f0-9]{64}$/.test(contract.sourceIdentity ?? "") ||
+          profiles.length < 2 ||
+          profiles.length > 16 ||
+          new Set(contract.profiles.map((p) => p.processName)).size !== profiles.length ||
+          !Number.isSafeInteger(contract.maxRecords) ||
+          contract.maxRecords < 1 ||
+          contract.maxRecords > 100000 ||
+          !Number.isSafeInteger(contract.maxBytes) ||
+          contract.maxBytes < 1024 ||
+          contract.maxBytes > 256 * 1024 * 1024
+        )
+          fail();
+        for (const row of profiles) {
+          const binding = JSON.parse(row.contract),
+            expected = contract.profiles.find((p) => p.processName === row.name);
+          if (
+            !expected ||
+            !/^[a-z][a-z0-9-]{0,99}$/.test(row.name) ||
+            !/^[a-f0-9]{64}$/.test(expected.resourceSha256 ?? "") ||
+            !/^[a-z][a-z0-9-]{0,99}$/.test(expected.dataGroup ?? "") ||
+            binding.processName !== row.name ||
+            binding.resourceSha256 !== expected.resourceSha256 ||
+            binding.dataGroup !== expected.dataGroup
+          )
+            fail();
+        }
+      }
       const usage = snap.prepare("SELECT records,bytes,admitted FROM usage WHERE id=1").get();
       const actual = snap.prepare("SELECT count(*) records,coalesce(sum(bytes),0) bytes FROM tasks").get();
       if (
@@ -162,6 +209,9 @@ for (const namespace of namespaces) {
       info = {
         group,
         namespace,
+        ...(contract.version === 2
+          ? { journalContractVersion: 2, generationId: contract.generationId, configurationGroupSha256: contract.groupSha256 }
+          : {}),
         journalId: meta.id,
         clientId: namespace + "-admission-" + meta.id,
         contractSha256: hash(meta.contract),
@@ -187,7 +237,7 @@ for (const namespace of namespaces) {
         fs.closeSync(fd);
       }
       snapshotBytes += fs.statSync(p).size;
-      if (snapshotBytes > 512 * 1024 * 1024) fail();
+      if (snapshotBytes > limits.maximumSnapshotBytes) fail();
       info[name === "admission.sqlite" ? "admissionSha256" : "ownershipSha256"] = fileHash(p);
     }
     manifest.groups.push(info);
@@ -195,5 +245,7 @@ for (const namespace of namespaces) {
 }
 const remaining = fs.statfsSync(output, { bigint: true });
 if (remaining.bavail * remaining.bsize < BigInt(snapshotBytes + 64 * 1024 * 1024)) fail();
-fs.writeFileSync(path.join(output, "manifest.json"), JSON.stringify(manifest) + "\n", { mode: 0o600, flag: "wx" });
+const manifestBytes = JSON.stringify(manifest) + "\n";
+if (Buffer.byteLength(manifestBytes) > limits.maximumManifestBytes) fail();
+fs.writeFileSync(path.join(output, "manifest.json"), manifestBytes, { mode: 0o600, flag: "wx" });
 // No source payloads, credentials, paths or process metadata on stdout/stderr.

package/dist/runtime/process-group-staging.d.ts

@@ -1,5 +1,5 @@
-import { type ProcessGroupRuntimeDescriptor } from "./process-group-contract.js";
+import { type RuntimeGroupDescriptor } from "./process-group-runtime-selection.js";
 export declare const stagedJournalFile = "process-group-staged-journal.json";
 /** An explicit, config-bound declaration, not permission to initialize or run. */
-export declare function refreshProcessGroupStagedJournal(instanceDir: string, stopped: boolean, descriptor: ProcessGroupRuntimeDescriptor | undefined): void;
+export declare function refreshProcessGroupStagedJournal(instanceDir: string, stopped: boolean, descriptor: RuntimeGroupDescriptor | undefined): void;
 //# sourceMappingURL=process-group-staging.d.ts.map

package/dist/runtime/process-group-staging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-staging.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-staging.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,6BAA6B,EAAsC,MAAM,6BAA6B,CAAC;AAErH,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AACrE,kFAAkF;AAClF,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,6BAA6B,GAAG,SAAS,GAAG,IAAI,CAmDnJ"}
+{"version":3,"file":"process-group-staging.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-staging.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,sBAAsB,EAAgC,MAAM,sCAAsC,CAAC;AAEjH,eAAO,MAAM,iBAAiB,sCAAsC,CAAC;AACrE,kFAAkF;AAClF,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,sBAAsB,GAAG,SAAS,GAAG,IAAI,CAoD5I"}

package/dist/runtime/process-group-staging.js

@@ -1,7 +1,8 @@
 import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { normalizeProcessGroupConfiguration } from "./process-group-contract.js";
+import { configurationGroupJournalSchema } from "./configuration-group-contract.js";
+import { normalizeRuntimeProcessGroup } from "./process-group-runtime-selection.js";
 export const stagedJournalFile = "process-group-staged-journal.json";
 /** An explicit, config-bound declaration, not permission to initialize or run. */
 export function refreshProcessGroupStagedJournal(instanceDir, stopped, descriptor) {
@@ -14,13 +15,14 @@ export function refreshProcessGroupStagedJournal(instanceDir, stopped, descripto
         throw new Error("Staged configuration must be a bounded regular file.");
     const raw = fs.readFileSync(configFile);
     const config = JSON.parse(raw.toString("utf8"));
-    const journal = descriptor
-        ? normalizeProcessGroupConfiguration(config, descriptor).journal
-        : undefined;
+    const selected = descriptor ? normalizeRuntimeProcessGroup(config, descriptor) : undefined;
+    const journal = selected?.journal;
     if (!stopped || !journal || journal.journalId !== undefined) {
         fs.rmSync(marker, { force: true });
         return;
     }
+    if (selected?.configurationSnapshot && configurationGroupJournalSchema.parse(journal).groupSha256 !== selected.configurationSnapshot.sha256)
+        throw Error("Staged journal differs from its configured resource snapshot");
     if (typeof journal.directory !== "string" || !path.isAbsolute(journal.directory) || path.normalize(journal.directory) !== journal.directory)
         throw new Error("Staged journal requires a normalized absolute directory.");
     // Existing/unknown data must never be declared uninitialized, including links.

package/dist/runtime/process-group-staging.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-staging.js","sourceRoot":"","sources":["../../src/runtime/process-group-staging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAsC,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAErH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AACrE,kFAAkF;AAClF,MAAM,UAAU,gCAAgC,CAAC,WAAmB,EAAE,OAAgB,EAAE,UAAqD;IAC3I,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAChJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAC3E,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAE,kCAAkC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAoE;QAC9H,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5D,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS;QACzI,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,+EAA+E;IAC/E,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,GAAG,KAAK,OAAO,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC9H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IACvD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,EAAE,EACF,IAAI,CAAC,SAAS,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,kCAAkC;YACxC,mBAAmB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport { type ProcessGroupRuntimeDescriptor, normalizeProcessGroupConfiguration } from \"./process-group-contract.js\";\n\nexport const stagedJournalFile = \"process-group-staged-journal.json\";\n/** An explicit, config-bound declaration, not permission to initialize or run. */\nexport function refreshProcessGroupStagedJournal(instanceDir: string, stopped: boolean, descriptor: ProcessGroupRuntimeDescriptor | undefined): void {\n  const marker = path.join(instanceDir, stagedJournalFile);\n  const configFile = path.join(instanceDir, \"config.json\");\n  if (!fs.existsSync(configFile)) return;\n  const stat = fs.lstatSync(configFile);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) throw new Error(\"Staged configuration must be a bounded regular file.\");\n  const raw = fs.readFileSync(configFile);\n  const config = JSON.parse(raw.toString(\"utf8\")) as Record<string, unknown>;\n  const journal = descriptor\n    ? (normalizeProcessGroupConfiguration(config, descriptor).journal as { directory?: unknown; journalId?: unknown } | undefined)\n    : undefined;\n  if (!stopped || !journal || journal.journalId !== undefined) {\n    fs.rmSync(marker, { force: true });\n    return;\n  }\n  if (typeof journal.directory !== \"string\" || !path.isAbsolute(journal.directory) || path.normalize(journal.directory) !== journal.directory)\n    throw new Error(\"Staged journal requires a normalized absolute directory.\");\n  // Existing/unknown data must never be declared uninitialized, including links.\n  for (let dir = journal.directory; dir !== path.dirname(dir); dir = path.dirname(dir)) {\n    try {\n      const stat = fs.lstatSync(dir);\n      if (stat.isSymbolicLink() || dir === journal.directory) throw new Error(\"Existing journal cannot be marked uninitialized.\");\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    }\n  }\n  if (fs.existsSync(path.join(instanceDir, \"handover-source-guard.json.launch\")))\n    throw new Error(\"A previously launched instance requires journal review.\");\n  const temporary = marker + \".\" + randomUUID() + \".tmp\";\n  const fd = fs.openSync(temporary, \"wx\", 0o600);\n  try {\n    fs.writeFileSync(\n      fd,\n      JSON.stringify({\n        schemaVersion: 1,\n        kind: \"uns-process-group-staged-journal\",\n        configurationSha256: createHash(\"sha256\").update(raw).digest(\"hex\"),\n        directory: journal.directory,\n      }) + \"\\n\",\n    );\n    fs.fsyncSync(fd);\n  } finally {\n    fs.closeSync(fd);\n  }\n  fs.renameSync(temporary, marker);\n  const parent = fs.openSync(instanceDir, \"r\");\n  try {\n    fs.fsyncSync(parent);\n  } finally {\n    fs.closeSync(parent);\n  }\n}\n"]}
+{"version":3,"file":"process-group-staging.js","sourceRoot":"","sources":["../../src/runtime/process-group-staging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAA+B,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEjH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AACrE,kFAAkF;AAClF,MAAM,UAAU,gCAAgC,CAAC,WAAmB,EAAE,OAAgB,EAAE,UAA8C;IACpI,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAChJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAmE,CAAC;IAC9F,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5D,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,EAAE,qBAAqB,IAAI,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,qBAAqB,CAAC,MAAM;QACzI,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS;QACzI,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,+EAA+E;IAC/E,KAAK,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,GAAG,KAAK,OAAO,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC9H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IACvD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,EAAE,EACF,IAAI,CAAC,SAAS,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,kCAAkC;YACxC,mBAAmB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,GAAG,IAAI,CACV,CAAC;QACF,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport { configurationGroupJournalSchema } from \"./configuration-group-contract.js\";\nimport { type RuntimeGroupDescriptor, normalizeRuntimeProcessGroup } from \"./process-group-runtime-selection.js\";\n\nexport const stagedJournalFile = \"process-group-staged-journal.json\";\n/** An explicit, config-bound declaration, not permission to initialize or run. */\nexport function refreshProcessGroupStagedJournal(instanceDir: string, stopped: boolean, descriptor: RuntimeGroupDescriptor | undefined): void {\n  const marker = path.join(instanceDir, stagedJournalFile);\n  const configFile = path.join(instanceDir, \"config.json\");\n  if (!fs.existsSync(configFile)) return;\n  const stat = fs.lstatSync(configFile);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024) throw new Error(\"Staged configuration must be a bounded regular file.\");\n  const raw = fs.readFileSync(configFile);\n  const config = JSON.parse(raw.toString(\"utf8\")) as Record<string, unknown>;\n  const selected = descriptor ? normalizeRuntimeProcessGroup(config, descriptor) : undefined;\n  const journal = selected?.journal as { directory?: unknown; journalId?: unknown } | undefined;\n  if (!stopped || !journal || journal.journalId !== undefined) {\n    fs.rmSync(marker, { force: true });\n    return;\n  }\n  if (selected?.configurationSnapshot && configurationGroupJournalSchema.parse(journal).groupSha256 !== selected.configurationSnapshot.sha256)\n    throw Error(\"Staged journal differs from its configured resource snapshot\");\n  if (typeof journal.directory !== \"string\" || !path.isAbsolute(journal.directory) || path.normalize(journal.directory) !== journal.directory)\n    throw new Error(\"Staged journal requires a normalized absolute directory.\");\n  // Existing/unknown data must never be declared uninitialized, including links.\n  for (let dir = journal.directory; dir !== path.dirname(dir); dir = path.dirname(dir)) {\n    try {\n      const stat = fs.lstatSync(dir);\n      if (stat.isSymbolicLink() || dir === journal.directory) throw new Error(\"Existing journal cannot be marked uninitialized.\");\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    }\n  }\n  if (fs.existsSync(path.join(instanceDir, \"handover-source-guard.json.launch\")))\n    throw new Error(\"A previously launched instance requires journal review.\");\n  const temporary = marker + \".\" + randomUUID() + \".tmp\";\n  const fd = fs.openSync(temporary, \"wx\", 0o600);\n  try {\n    fs.writeFileSync(\n      fd,\n      JSON.stringify({\n        schemaVersion: 1,\n        kind: \"uns-process-group-staged-journal\",\n        configurationSha256: createHash(\"sha256\").update(raw).digest(\"hex\"),\n        directory: journal.directory,\n      }) + \"\\n\",\n    );\n    fs.fsyncSync(fd);\n  } finally {\n    fs.closeSync(fd);\n  }\n  fs.renameSync(temporary, marker);\n  const parent = fs.openSync(instanceDir, \"r\");\n  try {\n    fs.fsyncSync(parent);\n  } finally {\n    fs.closeSync(parent);\n  }\n}\n"]}

package/dist/runtime/process-group-supervision.d.ts

@@ -1,6 +1,6 @@
-import { type ProcessGroupRuntimeDescriptor } from "./process-group-contract.js";
+import { type RuntimeGroupDescriptor } from "./process-group-runtime-selection.js";
 /** SDK receiver contract; host launchers translate these neutral settings to PM2/systemd. */
-export declare function processGroupReceiverSupervision(raw: Record<string, unknown>, descriptor: ProcessGroupRuntimeDescriptor | undefined, instanceDirectory: string, capabilities: {
+export declare function processGroupReceiverSupervision(raw: Record<string, unknown>, descriptor: RuntimeGroupDescriptor | undefined, instanceDirectory: string, capabilities: {
     supervised: boolean;
     persistent: boolean;
     authorized: boolean;

package/dist/runtime/process-group-supervision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-supervision.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-supervision.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,6BAA6B,EAAwD,MAAM,6BAA6B,CAAC;AAEvI,6FAA6F;AAC7F,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,UAAU,EAAE,6BAA6B,GAAG,SAAS,EACrD,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,EAC/E,UAAU,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB"}
+{"version":3,"file":"process-group-supervision.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-supervision.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,sBAAsB,EAAgC,MAAM,sCAAsC,CAAC;AAEjH,6FAA6F;AAC7F,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,UAAU,EAAE,sBAAsB,GAAG,SAAS,EAC9C,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,EAC/E,UAAU,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BzB"}

package/dist/runtime/process-group-supervision.js

@@ -1,5 +1,6 @@
 import { isUnsupportedLegacyReceiver } from "./compatibility/energenti-descriptor-v1.js";
-import { isLocalPilotPath, normalizeProcessGroupConfiguration } from "./process-group-contract.js";
+import { isLocalPilotPath } from "./process-group-contract.js";
+import { normalizeRuntimeProcessGroup } from "./process-group-runtime-selection.js";
 /** SDK receiver contract; host launchers translate these neutral settings to PM2/systemd. */
 export function processGroupReceiverSupervision(raw, descriptor, instanceDirectory, capabilities, supervisor) {
     if (!descriptor) {
@@ -7,7 +8,7 @@ export function processGroupReceiverSupervision(raw, descriptor, instanceDirecto
             throw Error("Installed package has no supported receiver contract");
         return {};
     }
-    const c = normalizeProcessGroupConfiguration(raw, descriptor);
+    const c = normalizeRuntimeProcessGroup(raw, descriptor);
     if (c.runtimeRole !== "admission")
         return {};
     if (!c.matches || !c.journal || (!isLocalPilotPath(instanceDirectory) && !capabilities.authorized))
@@ -24,7 +25,8 @@ export function processGroupReceiverSupervision(raw, descriptor, instanceDirecto
         throw Error("Admission supervisor memory limit must be 128–4096 MiB");
     return {
         autorestart: true,
-        stop_exit_codes: [78],
+        // Successful standalone/guarded shutdown and explicit contract refusal are terminal.
+        stop_exit_codes: [0, 78],
         min_uptime: 10000,
         max_restarts: 5,
         exp_backoff_restart_delay: 1000,

package/dist/runtime/process-group-supervision.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-supervision.js","sourceRoot":"","sources":["../../src/runtime/process-group-supervision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAsC,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAC;AAEvI,6FAA6F;AAC7F,MAAM,UAAU,+BAA+B,CAC7C,GAA4B,EAC5B,UAAqD,EACrD,iBAAyB,EACzB,YAA+E,EAC/E,UAAkH;IAElH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1G,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QAChG,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACtF,IAAI,CAAC,YAAY,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAI,CAAC,CAAC,OAAmC,CAAC,WAAW,CAAC,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU;QAC3F,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,kBAAkB;QACnF,MAAM,KAAK,CAAC,+FAA+F,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,IAAI,GAAG,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI;QAAE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnG,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,CAAC,EAAE,CAAC;QACrB,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,CAAC;QACf,yBAAyB,EAAE,IAAI;QAC/B,kBAAkB,EAAE,GAAG,GAAG,GAAG;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import { isUnsupportedLegacyReceiver } from \"./compatibility/energenti-descriptor-v1.js\";\nimport { type ProcessGroupRuntimeDescriptor, isLocalPilotPath, normalizeProcessGroupConfiguration } from \"./process-group-contract.js\";\n\n/** SDK receiver contract; host launchers translate these neutral settings to PM2/systemd. */\nexport function processGroupReceiverSupervision(\n  raw: Record<string, unknown>,\n  descriptor: ProcessGroupRuntimeDescriptor | undefined,\n  instanceDirectory: string,\n  capabilities: { supervised: boolean; persistent: boolean; authorized: boolean },\n  supervisor: { enabled: boolean; restartOnExit: boolean; restartOnUnhealthy: boolean; maxMemoryMb?: number | null },\n): Record<string, unknown> {\n  if (!descriptor) {\n    if (isUnsupportedLegacyReceiver(raw)) throw Error(\"Installed package has no supported receiver contract\");\n    return {};\n  }\n  const c = normalizeProcessGroupConfiguration(raw, descriptor);\n  if (c.runtimeRole !== \"admission\") return {};\n  if (!c.matches || !c.journal || (!isLocalPilotPath(instanceDirectory) && !capabilities.authorized))\n    throw Error(\"Admission supervision requires an explicit reviewed journal instance\");\n  if (!capabilities.supervised) throw Error(\"Installed package does not support the supervised admission role\");\n  const directory = (c.journal as Record<string, unknown>)[\"directory\"];\n  if (typeof directory === \"string\" && !isLocalPilotPath(directory) && !capabilities.persistent)\n    throw Error(\"Installed package does not support persistent admission ownership\");\n  if (!supervisor.enabled || !supervisor.restartOnExit || supervisor.restartOnUnhealthy)\n    throw Error(\"Admission requires restart-on-exit supervision; generic MQTT unhealthy restart is unsupported\");\n  const max = supervisor.maxMemoryMb ?? 256;\n  if (max < 128 || max > 4096) throw Error(\"Admission supervisor memory limit must be 128–4096 MiB\");\n  return {\n    autorestart: true,\n    stop_exit_codes: [78],\n    min_uptime: 10000,\n    max_restarts: 5,\n    exp_backoff_restart_delay: 1000,\n    max_memory_restart: `${max}M`,\n  };\n}\n"]}
+{"version":3,"file":"process-group-supervision.js","sourceRoot":"","sources":["../../src/runtime/process-group-supervision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAA+B,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAEjH,6FAA6F;AAC7F,MAAM,UAAU,+BAA+B,CAC7C,GAA4B,EAC5B,UAA8C,EAC9C,iBAAyB,EACzB,YAA+E,EAC/E,UAAkH;IAElH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,2BAA2B,CAAC,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1G,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,GAAG,4BAA4B,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QAChG,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACtF,IAAI,CAAC,YAAY,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAI,CAAC,CAAC,OAAmC,CAAC,WAAW,CAAC,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU;QAC3F,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,kBAAkB;QACnF,MAAM,KAAK,CAAC,+FAA+F,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,IAAI,GAAG,CAAC;IAC1C,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI;QAAE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACnG,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,qFAAqF;QACrF,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACxB,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,CAAC;QACf,yBAAyB,EAAE,IAAI;QAC/B,kBAAkB,EAAE,GAAG,GAAG,GAAG;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import { isUnsupportedLegacyReceiver } from \"./compatibility/energenti-descriptor-v1.js\";\nimport { isLocalPilotPath } from \"./process-group-contract.js\";\nimport { type RuntimeGroupDescriptor, normalizeRuntimeProcessGroup } from \"./process-group-runtime-selection.js\";\n\n/** SDK receiver contract; host launchers translate these neutral settings to PM2/systemd. */\nexport function processGroupReceiverSupervision(\n  raw: Record<string, unknown>,\n  descriptor: RuntimeGroupDescriptor | undefined,\n  instanceDirectory: string,\n  capabilities: { supervised: boolean; persistent: boolean; authorized: boolean },\n  supervisor: { enabled: boolean; restartOnExit: boolean; restartOnUnhealthy: boolean; maxMemoryMb?: number | null },\n): Record<string, unknown> {\n  if (!descriptor) {\n    if (isUnsupportedLegacyReceiver(raw)) throw Error(\"Installed package has no supported receiver contract\");\n    return {};\n  }\n  const c = normalizeRuntimeProcessGroup(raw, descriptor);\n  if (c.runtimeRole !== \"admission\") return {};\n  if (!c.matches || !c.journal || (!isLocalPilotPath(instanceDirectory) && !capabilities.authorized))\n    throw Error(\"Admission supervision requires an explicit reviewed journal instance\");\n  if (!capabilities.supervised) throw Error(\"Installed package does not support the supervised admission role\");\n  const directory = (c.journal as Record<string, unknown>)[\"directory\"];\n  if (typeof directory === \"string\" && !isLocalPilotPath(directory) && !capabilities.persistent)\n    throw Error(\"Installed package does not support persistent admission ownership\");\n  if (!supervisor.enabled || !supervisor.restartOnExit || supervisor.restartOnUnhealthy)\n    throw Error(\"Admission requires restart-on-exit supervision; generic MQTT unhealthy restart is unsupported\");\n  const max = supervisor.maxMemoryMb ?? 256;\n  if (max < 128 || max > 4096) throw Error(\"Admission supervisor memory limit must be 128–4096 MiB\");\n  return {\n    autorestart: true,\n    // Successful standalone/guarded shutdown and explicit contract refusal are terminal.\n    stop_exit_codes: [0, 78],\n    min_uptime: 10000,\n    max_restarts: 5,\n    exp_backoff_restart_delay: 1000,\n    max_memory_restart: `${max}M`,\n  };\n}\n"]}