@uns-kit/core 3.0.28 → 3.0.30

package/dist/runtime/configuration-group-contract.js

@@ -0,0 +1,233 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { readConfigurationSelector } from "./process-group-contract.js";
+import { readProcessGroupResource } from "./process-group-resources.js";
+const identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const selector = z
+    .array(z
+    .string()
+    .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)
+    .refine((v) => !["__proto__", "prototype", "constructor"].includes(v)))
+    .min(1)
+    .max(8);
+const MAX_BYTES = 1024 * 1024;
+/** Versioned canonical JSON: binary key order, no locale, executable values or accessors. */
+export function configurationResourceJson(value) {
+    let nodes = 0, bytes = 0;
+    const ancestors = new Set();
+    const charge = (size) => {
+        bytes += size;
+        if (bytes > MAX_BYTES)
+            throw Error("Configuration resource exceeds 1 MiB");
+    };
+    function visit(v, depth) {
+        if (++nodes > 65536 || depth > 32)
+            throw Error("Configuration resource exceeds its structural budget");
+        if (v === null || typeof v === "boolean") {
+            charge(v === null ? 4 : v ? 4 : 5);
+            return JSON.stringify(v);
+        }
+        if (typeof v === "string") {
+            if (Buffer.byteLength(v) > MAX_BYTES)
+                throw Error("Configuration resource string exceeds 1 MiB");
+            const encoded = JSON.stringify(v);
+            charge(Buffer.byteLength(encoded));
+            return encoded;
+        }
+        if (typeof v === "number" && Number.isFinite(v)) {
+            const encoded = JSON.stringify(v);
+            charge(encoded.length);
+            return encoded;
+        }
+        if (!v || typeof v !== "object" || ancestors.has(v))
+            throw Error("Configuration resource must contain finite plain JSON only");
+        if (Array.isArray(v)
+            ? Object.getPrototypeOf(v) !== Array.prototype
+            : Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null)
+            throw Error("Configuration resource must contain plain JSON objects");
+        if (Object.getOwnPropertySymbols(v).length)
+            throw Error("Configuration resource cannot contain symbol properties");
+        const descriptors = Object.getOwnPropertyDescriptors(v);
+        for (const [key, d] of Object.entries(descriptors)) {
+            if (Array.isArray(v) && key === "length")
+                continue;
+            if (!d.enumerable || !Object.hasOwn(d, "value"))
+                throw Error("Configuration resource cannot contain hidden properties or accessors");
+        }
+        ancestors.add(v);
+        charge(2); // Container brackets/braces.
+        let result;
+        if (Array.isArray(v)) {
+            if (v.length > 65536 || Object.keys(v).length !== v.length || Object.keys(v).some((k, i) => k !== String(i)))
+                throw Error("Configuration resource arrays must be dense JSON arrays");
+            charge(Math.max(0, v.length - 1));
+            result = "[" + Array.from({ length: v.length }, (_, i) => visit(descriptors[String(i)].value, depth + 1)).join(",") + "]";
+        }
+        else
+            result =
+                "{" +
+                    Object.keys(v)
+                        .sort()
+                        .map((k, i) => {
+                        if (Buffer.byteLength(k) > MAX_BYTES)
+                            throw Error("Configuration resource key exceeds 1 MiB");
+                        charge(Buffer.byteLength(JSON.stringify(k)) + 1 + (i ? 1 : 0));
+                        return JSON.stringify(k) + ":" + visit(descriptors[k].value, depth + 1);
+                    })
+                        .join(",") +
+                    "}";
+        ancestors.delete(v);
+        return result;
+    }
+    const json = visit(value, 0);
+    if (Buffer.byteLength(json) > MAX_BYTES)
+        throw Error("Configuration resource exceeds 1 MiB");
+    return json;
+}
+export function configurationResourceHash(value) {
+    return createHash("sha256").update("uns-configuration-json-v1\n").update(configurationResourceJson(value)).digest("hex");
+}
+export const configurationGroupProfileSchema = z.strictObject({
+    id: identity,
+    processName: identity,
+    dataGroup: identity,
+    resource: z.unknown(),
+});
+export const configurationGroupSchema = z.strictObject({
+    schemaVersion: z.literal(2),
+    id: identity,
+    inputTopic: z
+        .string()
+        .min(1)
+        .max(512)
+        .regex(/^[^#+\0]+$/),
+    processName: identity,
+    receiverProcessName: identity,
+    profiles: z.array(configurationGroupProfileSchema).min(2).max(16),
+});
+export const configurationGroupDescriptorSchema = z
+    .strictObject({
+    protocolVersion: z.literal(2),
+    namespace: identity,
+    publisherPath: selector,
+    groupPath: selector,
+    memberPath: selector,
+    journalPath: selector,
+    runtimeRolePath: selector,
+    receiverRole: identity,
+    match: z.strictObject({ path: selector, value: z.string().min(1).max(100) }).optional(),
+})
+    .superRefine((d, context) => {
+    const independent = [d.publisherPath, d.journalPath, d.runtimeRolePath].map((p) => p.join("."));
+    if (new Set(independent).size !== independent.length || independent.some((p, i) => independent.some((q, j) => i !== j && q.startsWith(p + "."))))
+        context.addIssue({ code: "custom", message: "Independent publisher, journal and role selectors required" });
+    const parent = d.publisherPath.join(".") + ".", group = d.groupPath.join("."), member = d.memberPath.join(".");
+    if (!group.startsWith(parent) ||
+        !member.startsWith(parent) ||
+        group === member ||
+        group.startsWith(member + ".") ||
+        member.startsWith(group + "."))
+        context.addIssue({ code: "custom", message: "Distinct group/member selectors within the publisher required" });
+});
+const snapshots = new WeakSet();
+function freeze(value) {
+    if (value && typeof value === "object") {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+export function configurationGroupSnapshot(value) {
+    // Bound and copy before schema traversal; caller mutation cannot change a running revision.
+    const group = configurationGroupSchema.parse(JSON.parse(configurationResourceJson(value)));
+    const names = [group.processName, group.receiverProcessName, ...group.profiles.map((p) => p.processName)];
+    if (new Set(names).size !== names.length || new Set(group.profiles.map((p) => p.id)).size !== group.profiles.length)
+        throw Error("Configuration group identities overlap");
+    const profiles = group.profiles.map((p) => ({ ...p, resourceSha256: configurationResourceHash(p.resource) }));
+    const result = freeze({ group, sha256: configurationResourceHash(group), profiles });
+    snapshots.add(result);
+    return result;
+}
+export function assertConfigurationGroupSnapshot(value) {
+    if (!snapshots.has(value))
+        throw Error("Exact SDK-issued configuration group snapshot required");
+}
+/** Optional data-only capability; packages without it keep their existing behavior. */
+export function configurationGroupDescriptor(packageRoot) {
+    const file = path.join(packageRoot, "package.json");
+    // Ordinary Node/Python deployments do not opt in by existing on the host.
+    if (!fs.existsSync(file))
+        return undefined;
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+    let bytes;
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_BYTES)
+            throw Error("Invalid installed runtime metadata");
+        bytes = fs.readFileSync(fd);
+        if (bytes.length > MAX_BYTES)
+            throw Error("Installed runtime metadata is too large");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const pkg = JSON.parse(bytes.toString());
+    const value = pkg.unsDatahub?.processGroupConfigurationRuntime;
+    if (value !== undefined && !readProcessGroupResource(file).equals(bytes))
+        throw Error("Installed runtime metadata changed during discovery");
+    return value === undefined ? undefined : configurationGroupDescriptorSchema.parse(value);
+}
+export function selectedConfigurationGroup(packageRoot, raw) {
+    const descriptor = configurationGroupDescriptor(packageRoot);
+    if (!descriptor)
+        return undefined;
+    const value = readConfigurationSelector(raw, descriptor.groupPath);
+    if (value === undefined)
+        return undefined;
+    if (descriptor.match && readConfigurationSelector(raw, descriptor.match.path) !== descriptor.match.value)
+        throw Error("Configuration group capability selector does not match");
+    return { descriptor, snapshot: configurationGroupSnapshot(value) };
+}
+export const configurationGroupJournalSchema = z.strictObject({
+    directory: z.string().startsWith("/").max(512),
+    journalId: z.string().uuid().optional(),
+    generationId: identity,
+    groupSha256: digest,
+    minFreeBytes: z
+        .number()
+        .int()
+        .min(1024 * 1024)
+        .max(1024 * 1024 * 1024)
+        .default(64 * 1024 * 1024),
+    maxRecords: z.number().int().min(1).max(100000).default(20000),
+    maxBytes: z
+        .number()
+        .int()
+        .min(1024)
+        .max(256 * 1024 * 1024)
+        .default(32 * 1024 * 1024),
+});
+export function configurationGroupJournalContract(snapshot, sourceIdentity, config, profiles) {
+    assertConfigurationGroupSnapshot(snapshot);
+    const journal = configurationGroupJournalSchema.parse(config);
+    if (journal.groupSha256 !== snapshot.sha256 || !digest.safeParse(sourceIdentity).success)
+        throw Error("Configuration group journal revision differs");
+    const expected = snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup }));
+    const normalize = (v) => [...v].sort((a, b) => (a.processName < b.processName ? -1 : a.processName > b.processName ? 1 : 0));
+    if (configurationResourceHash(normalize([...profiles])) !== configurationResourceHash(normalize(expected)))
+        throw Error("Configuration group journal profiles differ");
+    return configurationResourceJson({
+        version: 2,
+        generationId: journal.generationId,
+        groupSha256: snapshot.sha256,
+        sourceIdentity,
+        maxRecords: journal.maxRecords,
+        maxBytes: journal.maxBytes,
+        profiles: normalize(expected),
+    });
+}
+//# sourceMappingURL=configuration-group-contract.js.map

package/dist/runtime/configuration-group-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-group-contract.js","sourceRoot":"","sources":["../../src/runtime/configuration-group-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,KAAK,CACJ,CAAC;KACE,MAAM,EAAE;KACR,KAAK,CAAC,+BAA+B,CAAC;KACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,CAAC,CAAC,CAAC;AACV,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9B,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,KAAK,GAAG,CAAC,EACX,KAAK,GAAG,CAAC,CAAC;IACZ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,KAAK,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,SAAS,KAAK,CAAC,CAAU,EAAE,KAAa;QACtC,IAAI,EAAE,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACvG,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS;gBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjG,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC/H,IACE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACd,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS;YAC9C,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,IAAI;YAEtF,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACnH,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACnD,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;gBAAE,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACvI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACxC,IAAI,MAAc,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1G,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC7H,CAAC;;YACC,MAAM;gBACJ,GAAG;oBACH,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;yBACX,IAAI,EAAE;yBACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;wBACZ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS;4BAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;wBAC9F,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC3E,CAAC,CAAC;yBACD,IAAI,CAAC,GAAG,CAAC;oBACZ,GAAG,CAAC;QACR,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS;QAAE,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,EAAE,EAAE,QAAQ;IACZ,WAAW,EAAE,QAAQ;IACrB,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE,EAAE,QAAQ;IACZ,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,QAAQ;IAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAClE,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,YAAY,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,QAAQ;IACvB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,eAAe,EAAE,QAAQ;IACzB,YAAY,EAAE,QAAQ;IACtB,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxF,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;IAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAC5C,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAC7B,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QACzB,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,KAAK,KAAK,MAAM;QAChB,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;QAC9B,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC;QAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;AACnH,CAAC,CAAC,CAAC;AAeL,MAAM,SAAS,GAAG,IAAI,OAAO,EAAU,CAAC;AACxC,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,4FAA4F;IAC5F,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1G,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;QACjH,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,KAAiC;IAChF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;AACnG,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,4BAA4B,CAAC,WAAmB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACpD,0EAA0E;IAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACvF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,gCAAgC,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC7I,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AACD,MAAM,UAAU,0BAA0B,CACxC,WAAmB,EACnB,GAA4B;IAO5B,MAAM,UAAU,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,UAAU,CAAC,KAAK,IAAI,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK;QACtG,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACxE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,QAAQ;IACtB,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;SAChB,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;SACvB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;SACtB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAC/C,QAAoC,EACpC,cAAsB,EACtB,MAAiC,EACjC,QAAuF;IAEvF,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,OAAO;QACtF,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACrI,MAAM,SAAS,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9I,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxG,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7D,OAAO,yBAAyB,CAAC;QAC/B,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,cAAc;QACd,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { readConfigurationSelector } from \"./process-group-contract.js\";\nimport { readProcessGroupResource } from \"./process-group-resources.js\";\n\nconst identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst digest = z.string().regex(/^[a-f0-9]{64}$/);\nconst selector = z\n  .array(\n    z\n      .string()\n      .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)\n      .refine((v) => ![\"__proto__\", \"prototype\", \"constructor\"].includes(v)),\n  )\n  .min(1)\n  .max(8);\nconst MAX_BYTES = 1024 * 1024;\n\n/** Versioned canonical JSON: binary key order, no locale, executable values or accessors. */\nexport function configurationResourceJson(value: unknown): string {\n  let nodes = 0,\n    bytes = 0;\n  const ancestors = new Set<object>();\n  const charge = (size: number) => {\n    bytes += size;\n    if (bytes > MAX_BYTES) throw Error(\"Configuration resource exceeds 1 MiB\");\n  };\n  function visit(v: unknown, depth: number): string {\n    if (++nodes > 65536 || depth > 32) throw Error(\"Configuration resource exceeds its structural budget\");\n    if (v === null || typeof v === \"boolean\") {\n      charge(v === null ? 4 : v ? 4 : 5);\n      return JSON.stringify(v);\n    }\n    if (typeof v === \"string\") {\n      if (Buffer.byteLength(v) > MAX_BYTES) throw Error(\"Configuration resource string exceeds 1 MiB\");\n      const encoded = JSON.stringify(v);\n      charge(Buffer.byteLength(encoded));\n      return encoded;\n    }\n    if (typeof v === \"number\" && Number.isFinite(v)) {\n      const encoded = JSON.stringify(v);\n      charge(encoded.length);\n      return encoded;\n    }\n    if (!v || typeof v !== \"object\" || ancestors.has(v)) throw Error(\"Configuration resource must contain finite plain JSON only\");\n    if (\n      Array.isArray(v)\n        ? Object.getPrototypeOf(v) !== Array.prototype\n        : Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null\n    )\n      throw Error(\"Configuration resource must contain plain JSON objects\");\n    if (Object.getOwnPropertySymbols(v).length) throw Error(\"Configuration resource cannot contain symbol properties\");\n    const descriptors = Object.getOwnPropertyDescriptors(v);\n    for (const [key, d] of Object.entries(descriptors)) {\n      if (Array.isArray(v) && key === \"length\") continue;\n      if (!d.enumerable || !Object.hasOwn(d, \"value\")) throw Error(\"Configuration resource cannot contain hidden properties or accessors\");\n    }\n    ancestors.add(v);\n    charge(2); // Container brackets/braces.\n    let result: string;\n    if (Array.isArray(v)) {\n      if (v.length > 65536 || Object.keys(v).length !== v.length || Object.keys(v).some((k, i) => k !== String(i)))\n        throw Error(\"Configuration resource arrays must be dense JSON arrays\");\n      charge(Math.max(0, v.length - 1));\n      result = \"[\" + Array.from({ length: v.length }, (_, i) => visit(descriptors[String(i)]!.value, depth + 1)).join(\",\") + \"]\";\n    } else\n      result =\n        \"{\" +\n        Object.keys(v)\n          .sort()\n          .map((k, i) => {\n            if (Buffer.byteLength(k) > MAX_BYTES) throw Error(\"Configuration resource key exceeds 1 MiB\");\n            charge(Buffer.byteLength(JSON.stringify(k)) + 1 + (i ? 1 : 0));\n            return JSON.stringify(k) + \":\" + visit(descriptors[k]!.value, depth + 1);\n          })\n          .join(\",\") +\n        \"}\";\n    ancestors.delete(v);\n    return result;\n  }\n  const json = visit(value, 0);\n  if (Buffer.byteLength(json) > MAX_BYTES) throw Error(\"Configuration resource exceeds 1 MiB\");\n  return json;\n}\n\nexport function configurationResourceHash(value: unknown): string {\n  return createHash(\"sha256\").update(\"uns-configuration-json-v1\\n\").update(configurationResourceJson(value)).digest(\"hex\");\n}\n\nexport const configurationGroupProfileSchema = z.strictObject({\n  id: identity,\n  processName: identity,\n  dataGroup: identity,\n  resource: z.unknown(),\n});\nexport const configurationGroupSchema = z.strictObject({\n  schemaVersion: z.literal(2),\n  id: identity,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: identity,\n  receiverProcessName: identity,\n  profiles: z.array(configurationGroupProfileSchema).min(2).max(16),\n});\nexport const configurationGroupDescriptorSchema = z\n  .strictObject({\n    protocolVersion: z.literal(2),\n    namespace: identity,\n    publisherPath: selector,\n    groupPath: selector,\n    memberPath: selector,\n    journalPath: selector,\n    runtimeRolePath: selector,\n    receiverRole: identity,\n    match: z.strictObject({ path: selector, value: z.string().min(1).max(100) }).optional(),\n  })\n  .superRefine((d, context) => {\n    const independent = [d.publisherPath, d.journalPath, d.runtimeRolePath].map((p) => p.join(\".\"));\n    if (new Set(independent).size !== independent.length || independent.some((p, i) => independent.some((q, j) => i !== j && q.startsWith(p + \".\"))))\n      context.addIssue({ code: \"custom\", message: \"Independent publisher, journal and role selectors required\" });\n    const parent = d.publisherPath.join(\".\") + \".\",\n      group = d.groupPath.join(\".\"),\n      member = d.memberPath.join(\".\");\n    if (\n      !group.startsWith(parent) ||\n      !member.startsWith(parent) ||\n      group === member ||\n      group.startsWith(member + \".\") ||\n      member.startsWith(group + \".\")\n    )\n      context.addIssue({ code: \"custom\", message: \"Distinct group/member selectors within the publisher required\" });\n  });\nexport type ConfigurationGroupDescriptor = z.infer<typeof configurationGroupDescriptorSchema>;\nexport type ConfigurationGroup = z.infer<typeof configurationGroupSchema>;\nexport interface ConfigurationGroupProfile {\n  readonly id: string;\n  readonly processName: string;\n  readonly dataGroup: string;\n  readonly resourceSha256: string;\n  readonly resource: unknown;\n}\nexport interface ConfigurationGroupSnapshot {\n  readonly group: Readonly<ConfigurationGroup>;\n  readonly sha256: string;\n  readonly profiles: readonly ConfigurationGroupProfile[];\n}\nconst snapshots = new WeakSet<object>();\nfunction freeze<T>(value: T): T {\n  if (value && typeof value === \"object\") {\n    for (const child of Object.values(value)) freeze(child);\n    Object.freeze(value);\n  }\n  return value;\n}\nexport function configurationGroupSnapshot(value: unknown): ConfigurationGroupSnapshot {\n  // Bound and copy before schema traversal; caller mutation cannot change a running revision.\n  const group = configurationGroupSchema.parse(JSON.parse(configurationResourceJson(value)));\n  const names = [group.processName, group.receiverProcessName, ...group.profiles.map((p) => p.processName)];\n  if (new Set(names).size !== names.length || new Set(group.profiles.map((p) => p.id)).size !== group.profiles.length)\n    throw Error(\"Configuration group identities overlap\");\n  const profiles = group.profiles.map((p) => ({ ...p, resourceSha256: configurationResourceHash(p.resource) }));\n  const result = freeze({ group, sha256: configurationResourceHash(group), profiles });\n  snapshots.add(result);\n  return result;\n}\nexport function assertConfigurationGroupSnapshot(value: ConfigurationGroupSnapshot): void {\n  if (!snapshots.has(value)) throw Error(\"Exact SDK-issued configuration group snapshot required\");\n}\n\n/** Optional data-only capability; packages without it keep their existing behavior. */\nexport function configurationGroupDescriptor(packageRoot: string): ConfigurationGroupDescriptor | undefined {\n  const file = path.join(packageRoot, \"package.json\");\n  // Ordinary Node/Python deployments do not opt in by existing on the host.\n  if (!fs.existsSync(file)) return undefined;\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  let bytes: Buffer;\n  try {\n    const stat = fs.fstatSync(fd);\n    if (!stat.isFile() || stat.size > MAX_BYTES) throw Error(\"Invalid installed runtime metadata\");\n    bytes = fs.readFileSync(fd);\n    if (bytes.length > MAX_BYTES) throw Error(\"Installed runtime metadata is too large\");\n  } finally {\n    fs.closeSync(fd);\n  }\n  const pkg = JSON.parse(bytes.toString());\n  const value = pkg.unsDatahub?.processGroupConfigurationRuntime;\n  if (value !== undefined && !readProcessGroupResource(file).equals(bytes)) throw Error(\"Installed runtime metadata changed during discovery\");\n  return value === undefined ? undefined : configurationGroupDescriptorSchema.parse(value);\n}\nexport function selectedConfigurationGroup(\n  packageRoot: string,\n  raw: Record<string, unknown>,\n):\n  | {\n      descriptor: ConfigurationGroupDescriptor;\n      snapshot: ConfigurationGroupSnapshot;\n    }\n  | undefined {\n  const descriptor = configurationGroupDescriptor(packageRoot);\n  if (!descriptor) return undefined;\n  const value = readConfigurationSelector(raw, descriptor.groupPath);\n  if (value === undefined) return undefined;\n  if (descriptor.match && readConfigurationSelector(raw, descriptor.match.path) !== descriptor.match.value)\n    throw Error(\"Configuration group capability selector does not match\");\n  return { descriptor, snapshot: configurationGroupSnapshot(value) };\n}\n\nexport const configurationGroupJournalSchema = z.strictObject({\n  directory: z.string().startsWith(\"/\").max(512),\n  journalId: z.string().uuid().optional(),\n  generationId: identity,\n  groupSha256: digest,\n  minFreeBytes: z\n    .number()\n    .int()\n    .min(1024 * 1024)\n    .max(1024 * 1024 * 1024)\n    .default(64 * 1024 * 1024),\n  maxRecords: z.number().int().min(1).max(100000).default(20000),\n  maxBytes: z\n    .number()\n    .int()\n    .min(1024)\n    .max(256 * 1024 * 1024)\n    .default(32 * 1024 * 1024),\n});\nexport type ConfigurationGroupJournal = z.infer<typeof configurationGroupJournalSchema>;\nexport function configurationGroupJournalContract(\n  snapshot: ConfigurationGroupSnapshot,\n  sourceIdentity: string,\n  config: ConfigurationGroupJournal,\n  profiles: readonly { processName: string; resourceSha256: string; dataGroup: string }[],\n): string {\n  assertConfigurationGroupSnapshot(snapshot);\n  const journal = configurationGroupJournalSchema.parse(config);\n  if (journal.groupSha256 !== snapshot.sha256 || !digest.safeParse(sourceIdentity).success)\n    throw Error(\"Configuration group journal revision differs\");\n  const expected = snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup }));\n  const normalize = (v: typeof expected) => [...v].sort((a, b) => (a.processName < b.processName ? -1 : a.processName > b.processName ? 1 : 0));\n  if (configurationResourceHash(normalize([...profiles])) !== configurationResourceHash(normalize(expected)))\n    throw Error(\"Configuration group journal profiles differ\");\n  return configurationResourceJson({\n    version: 2,\n    generationId: journal.generationId,\n    groupSha256: snapshot.sha256,\n    sourceIdentity,\n    maxRecords: journal.maxRecords,\n    maxBytes: journal.maxBytes,\n    profiles: normalize(expected),\n  });\n}\n"]}

package/dist/runtime/process-group-authorization.d.ts

@@ -52,6 +52,8 @@ interface GenericAuthorization {
     readonly groupId: string;
     readonly groupProcessName: string;
     readonly namespace: string;
+    readonly generationId?: string;
+    readonly configurationGroupSha256?: string;
 }
 export type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;
 export type HvAuthorization = ProcessGroupAuthorization;

package/dist/runtime/process-group-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AAexE,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,eAAO,MAAM,4BAA4B,4CAAsC,CAAC;AAahF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiB1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC9F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAarC,CAAC;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,eAAe,GAAG,oBAAoB,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACxD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAA+B,CAAC;AAClE,eAAO,MAAM,kBAAkB,8BAA4B,CAAC;AAsC5D;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,GAAG,CAAC,MAAM,CAAC,CAgFzD;AACD,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAuGD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAEjH;AACD,oFAAoF;AACpF,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAElH;AACD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gCAAgC,GAAG,MAAM,CAI/F;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,EAAE,MAAM,EACtB,UAAU,UAAQ,6BAUnB;AACD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAON;AACD,eAAO,MAAM,4BAA4B,+CAAyC,CAAC;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjG;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,IAAI,CAsBN;AACD,eAAO,MAAM,oBAAoB,uCAAiC,CAAC"}
+{"version":3,"file":"process-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AAiBxE,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,eAAO,MAAM,4BAA4B,4CAAsC,CAAC;AAahF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiB1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC9F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAarC,CAAC;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AACD,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,eAAe,GAAG,oBAAoB,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACxD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAA+B,CAAC;AAClE,eAAO,MAAM,kBAAkB,8BAA4B,CAAC;AAiD5D;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,GAAG,CAAC,MAAM,CAAC,CAiFzD;AACD,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA4GD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAEjH;AACD,oFAAoF;AACpF,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAElH;AACD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gCAAgC,GAAG,MAAM,CAI/F;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,EAAE,MAAM,EACtB,UAAU,UAAQ,6BAUnB;AACD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAON;AACD,eAAO,MAAM,4BAA4B,+CAAyC,CAAC;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjG;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,IAAI,CAwBN;AACD,eAAO,MAAM,oBAAoB,uCAAiC,CAAC"}

package/dist/runtime/process-group-authorization.js

@@ -2,8 +2,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { z } from "zod";
 import * as legacy from "./compatibility/energenti-authorization-v1.js";
+import { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from "./configuration-group-authorization.js";
 import { normalizeProcessGroupConfiguration, processGroupDescriptor, resolvedProcessGroupChannels, } from "./process-group-contract.js";
-import { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash, readProcessGroupResource as read, sha256 as sha, } from "./process-group-resources.js";
+import { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash, readProcessGroupResource as read, sha256 as sha, assertPrivateProcessGroupDirectory, } from "./process-group-resources.js";
 export { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from "./process-group-resources.js";
 export const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;
 const digest = z.string().regex(/^[a-f0-9]{64}$/), id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);
@@ -52,14 +53,7 @@ export const processGroupManifestSchema = z.strictObject({
 export const hvAuthorizationSchema = legacy.hvAuthorizationSchema;
 export const productionGroupIds = legacy.productionGroupIds;
 const issued = new WeakSet();
-function privateDirectory(dir) {
-    for (let p = dir; p !== path.dirname(p); p = path.dirname(p))
-        if (fs.lstatSync(p).isSymbolicLink())
-            throw Error("Linked policy directory");
-    const s = fs.lstatSync(dir);
-    if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)
-        throw Error("Insecure policy directory");
-}
+const privateDirectory = assertPrivateProcessGroupDirectory;
 function registryRoot(root, dir) {
     if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir)
         throw Error("Invalid policy registry");
@@ -74,6 +68,24 @@ function registryRoot(root, dir) {
     return relative.split("/")[0];
 }
 function selectedFile(pkg, raw, root, explicit) {
+    const configured = configurationGroupPolicyIdentity(pkg, raw);
+    if (configured) {
+        if (explicit)
+            return explicit;
+        const directory = process.env["UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY"];
+        if (directory) {
+            const selected = registryRoot(root, directory);
+            if (selected !== "*" && selected !== configured.namespace)
+                throw Error("Foreign runtime registry");
+            const registry = selected === "*" ? path.join(root, configured.namespace, "authorizations") : directory;
+            privateDirectory(registry);
+            return path.join(registry, configured.generationId + ".json");
+        }
+        const single = process.env["UNS_PROCESS_GROUP_AUTHORIZATION_FILE"];
+        if (!single)
+            throw Error("No selected policy");
+        return single;
+    }
     const descriptor = processGroupDescriptor(pkg);
     if (!descriptor)
         throw Error("Missing runtime contract");
@@ -175,10 +187,11 @@ export function configuredGroupProcessNames() {
         const result = new Set();
         for (const file of files) {
             const raw = JSON.parse(read(file, true).toString());
-            const p = raw.schemaVersion === 3
+            const p = raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3
                 ? processGroupAuthorizationSchema.parse(raw)
                 : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);
-            const { namespace, group } = p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);
+            const { namespace, group } = p.schemaVersion === 4 ? { namespace: p.namespace, group: p.generationId }
+                : p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);
             if (p.stateRoot !== root ||
                 file !== path.join(root, namespace, "authorizations", group + ".json") ||
                 p.directory !== path.join(root, namespace, "admission", group))
@@ -200,6 +213,12 @@ function verifyRuntimePolicy(context, candidate) {
         if (!root || !context.controllerName)
             throw Error();
         const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file), bytes = candidate ?? read(file, true), unparsed = JSON.parse(bytes.toString());
+        if (unparsed.schemaVersion === 4) {
+            const result = verifyConfigurationGroupPolicy(context, bytes, root, file);
+            if (!candidate)
+                issued.add(result);
+            return result;
+        }
         if (unparsed.schemaVersion !== 3) {
             if (candidate)
                 throw Error("Only generic policies can be staged");
@@ -331,7 +350,7 @@ export function assertProcessGroupStateMount(value, root) {
         return;
     }
     assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);
-    if (process.platform !== "linux" || !("namespace" in value) || value.directory !== path.join(root, value.namespace, "admission", value.groupId))
+    if (process.platform !== "linux" || !("namespace" in value) || value.directory !== path.join(root, value.namespace, "admission", value.generationId ?? value.groupId))
         throw Error("Process group requires its reviewed Linux state mount");
     const mount = fs
         .readFileSync("/proc/self/mountinfo", "utf8")
@@ -361,6 +380,9 @@ export function assertProcessGroupTargetLaunch(value, dir, operationId, launchId
             !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||
             !digest.safeParse(r.configurationChecksum).success)
             throw Error();
+        if ("configurationGroupSha256" in value && value.configurationGroupSha256 !== undefined &&
+            (r.configurationGroupSha256 !== value.configurationGroupSha256 || r.generationId !== value.generationId))
+            throw Error();
     }
     catch {
         throw Error("Target requires its exact reviewed group reservation and launch identity");

package/dist/runtime/process-group-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AACxE,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,IAAI,IAAI,EAChC,MAAM,IAAI,GAAG,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,EAAE,MAAM;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE;IACF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7H,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAcH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,SAAS,gBAAgB,CAAC,GAAW;IACnC,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC3I,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC3H,CAAC;AACD,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/H,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,yDAAyD;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrH,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AACjC,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,GAA4B,EAAE,IAAY,EAAE,QAAiB;IAC9F,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3D,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACrE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAsD,CAAC;YAC3D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrI,UAAU,GAAG,UAAU;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACT,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC7E,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACrF,CAAC,CAAC,CAAC;YACP,CAAC;;gBAAM,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACxE,KAAK,MAAM,KAAK,IAAI,OAAO;oBACzB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;4BAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC5E,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,iFAAiF;oBACjF,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxF,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;4BAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACpF,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;wBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,KAAK,MAAM,KAAK,IAAI,QAAQ;wBAC1B,IACE,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;4BACjC,KAAK,CAAC,cAAc,EAAE;4BACtB,CAAC,KAAK,CAAC,WAAW,EAAE;4BACpB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;4BAE/D,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GACL,GAAG,CAAC,aAAa,KAAK,CAAC;gBACrB,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YACnI,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;gBACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;gBACtE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAE9D,MAAM,KAAK,EAAE,CAAC;YAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB,CAAC,OAAyC,EAAE,SAAkB;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAC1F,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvD,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;YAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAC3B,CAAC,CAAC,gBAAgB,KAAK,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAC5E,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAEpE,MAAM,KAAK,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3I,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,mBAAmB;YAAE,MAAM,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9C,IACE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;YAErF,MAAM,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa;gBAAE,MAAM,KAAK,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YAC5D,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU;YAClC,CAAC,QAAQ,EAAE,UAAU,CAAU;SAChC,CAAC,CAAC;QACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;YACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAEhE,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,GAAG,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EACvE,CAAC,GAAG,CAAC,CAAC,OAA8C,EACpD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAClB,IACE,CAAC,KAAK;YACN,CAAC,CAAC,CAAC,OAAO;YACV,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC5C,KAAK,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtF,CAAC,CAAC;YACF,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;YACxC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YAEpC,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACxE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YACtC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,SAAS;gBACpC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa;YAEhD,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;YAClB,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,WAAW;YAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,OAAyC;IACpF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,OAAyC,EAAE,KAAa;IAC1G,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAyC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,sCAAsC,CACpD,GAAW,EACX,GAAW,EACX,GAA4B,EAC5B,cAAsB,EACtB,UAAU,GAAG,KAAK;IAElB,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,GAAG;QAChB,iBAAiB,EAAE,GAAG;QACtB,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,4BAA4B,CAAC,GAAG,CAAC;QAC3C,cAAc;QACd,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sCAAsC,CACpD,KAA4C,EAC5C,SAAiB,EACjB,SAA6B;IAE7B,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAC1H,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,4BAA4B,CAAC,KAA2C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAgC,EAAE,IAAY;IACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,KAA+B,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;QAC7I,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,GAAW,EACX,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,oBAAoB,CAAC,KAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IACE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO;YACjD,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO;YAC7D,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO;YAElD,MAAM,KAAK,EAAE,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport * as legacy from \"./compatibility/energenti-authorization-v1.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport {\n  configurationAuthorizationHash,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource as read,\n  sha256 as sha,\n} from \"./process-group-resources.js\";\n\nexport { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from \"./process-group-resources.js\";\n\nexport const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nconst placement = z.strictObject({\n  instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n  processName: id,\n  role: z.enum([\"source\", \"target\", \"receiver\"]),\n  configurationSha256: digest,\n});\nexport const processGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(3),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(1),\n  packageName: z.string().min(1).max(214),\n  namespace: id,\n  groupId: id,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupManifestSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z.array(placement).min(4).max(18),\n});\nexport type ProcessGroupAuthorizationPolicy = z.infer<typeof processGroupAuthorizationSchema>;\nexport const processGroupManifestSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  id,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: id,\n  profiles: z\n    .array(z.strictObject({ id, processName: id, mappingFile: z.string().min(1).max(512), mappingSha256: digest, dataGroup: id }))\n    .min(2)\n    .max(16),\n});\ninterface GenericAuthorization {\n  readonly sha256: string;\n  readonly file: string;\n  readonly directory: string;\n  readonly journalId: string | null;\n  readonly role: \"source\" | \"target\" | \"receiver\";\n  readonly groupId: string;\n  readonly groupProcessName: string;\n  readonly namespace: string;\n}\nexport type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;\nexport type HvAuthorization = ProcessGroupAuthorization;\nexport type HvAuthorizationPolicy = legacy.HvAuthorizationPolicy;\nexport const hvAuthorizationSchema = legacy.hvAuthorizationSchema;\nexport const productionGroupIds = legacy.productionGroupIds;\nconst issued = new WeakSet<object>();\nfunction privateDirectory(dir: string): void {\n  for (let p = dir; p !== path.dirname(p); p = path.dirname(p)) if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Linked policy directory\");\n  const s = fs.lstatSync(dir);\n  if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0) throw Error(\"Insecure policy directory\");\n}\nfunction registryRoot(root: string, dir: string): string {\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir) throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  if (dir === root) return \"*\"; // Explicit collection of independently owned namespaces.\n  const relative = path.relative(root, dir);\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || !/^([a-z][a-z0-9-]{0,99})\\/authorizations$/.test(relative))\n    throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  privateDirectory(dir);\n  return relative.split(\"/\")[0]!;\n}\nfunction selectedFile(pkg: string, raw: Record<string, unknown>, root: string, explicit?: string): string {\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Missing runtime contract\");\n  const c = normalizeProcessGroupConfiguration(raw, descriptor),\n    journal = c.journal as Record<string, unknown> | undefined;\n  const manifest = descriptor.manifests.find((m) => m.file === journal?.[\"groupManifest\"]);\n  if (!manifest) throw Error(\"Unregistered group manifest\");\n  const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n  if (explicit) return explicit;\n  if (dir) {\n    const selected = registryRoot(root, dir);\n    if (selected !== \"*\" && selected !== descriptor.namespace) throw Error(\"Foreign runtime registry\");\n    const registry = selected === \"*\" ? path.join(root, descriptor.namespace, \"authorizations\") : dir;\n    privateDirectory(registry);\n    return path.join(registry, manifest.id + \".json\");\n  }\n  const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n  if (!single) throw Error(\"No selected policy\");\n  return single;\n}\n/** Bounded private registry enumeration; retained state without its policy fails closed.\n * New groups are operator-owned data and never a release-time enum in the Controller.\n */\nexport function configuredGroupProcessNames(): Set<string> {\n  if (!hasProcessGroupAuthorization()) return new Set();\n  try {\n    const root = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root) throw Error();\n    const files = new Set<string>();\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (single) files.add(single);\n    const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (dir) {\n      const selected = registryRoot(root, dir);\n      let registries: { namespace: string; directory: string }[];\n      if (selected === \"*\") {\n        const namespaces = fs.readdirSync(root, { withFileTypes: true });\n        if (namespaces.length > 64 || namespaces.some((e) => e.isSymbolicLink())) throw Error(\"Registry namespace budget or link violation\");\n        registries = namespaces\n          .filter((e) => e.isDirectory())\n          .map((e) => {\n            if (!id.safeParse(e.name).success) throw Error(\"Invalid registry namespace\");\n            privateDirectory(path.join(root, e.name));\n            return { namespace: e.name, directory: path.join(root, e.name, \"authorizations\") };\n          });\n      } else registries = [{ namespace: selected, directory: dir }];\n      for (const registry of registries) {\n        let entries: fs.Dirent[] = [];\n        try {\n          privateDirectory(registry.directory);\n          entries = fs.readdirSync(registry.directory, { withFileTypes: true });\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n        if (entries.length > 64) throw Error(\"Policy registry budget exceeded\");\n        for (const entry of entries)\n          if (entry.name.endsWith(\".json\")) {\n            if (!/^[a-z][a-z0-9-]{0,99}\\.json$/.test(entry.name)) throw Error(\"Invalid registry entry\");\n            files.add(path.join(registry.directory, entry.name));\n            if (files.size > 64) throw Error(\"Total policy registry budget exceeded\");\n          }\n        const journals = path.join(root, registry.namespace, \"admission\");\n        try {\n          // Root/registry permissions already protect visibility; retain old parent modes.\n          for (let parent = journals; parent !== path.dirname(parent); parent = path.dirname(parent))\n            if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Linked journal registry\");\n          const retained = fs.readdirSync(journals, { withFileTypes: true });\n          if (retained.length > 64) throw Error(\"Retained journal budget exceeded\");\n          for (const entry of retained)\n            if (\n              !id.safeParse(entry.name).success ||\n              entry.isSymbolicLink() ||\n              !entry.isDirectory() ||\n              !files.has(path.join(registry.directory, entry.name + \".json\"))\n            )\n              throw Error(\"Retained journal has no reviewed policy\");\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n      }\n    }\n    const result = new Set<string>();\n    for (const file of files) {\n      const raw = JSON.parse(read(file, true).toString());\n      const p =\n        raw.schemaVersion === 3\n          ? processGroupAuthorizationSchema.parse(raw)\n          : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);\n      const { namespace, group } = p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);\n      if (\n        p.stateRoot !== root ||\n        file !== path.join(root, namespace, \"authorizations\", group + \".json\") ||\n        p.directory !== path.join(root, namespace, \"admission\", group)\n      )\n        throw Error();\n      privateDirectory(root);\n      privateDirectory(path.dirname(file));\n      for (const role of p.placements) result.add(role.processName);\n    }\n    return result;\n  } catch {\n    throw Error(\"Process-group authorization registry is missing, changed or insecure; review required\");\n  }\n}\nexport interface ProcessGroupAuthorizationContext {\n  packageRoot: string;\n  instanceDirectory: string;\n  rawConfiguration: Record<string, unknown>;\n  channels: unknown[];\n  controllerName: string;\n  file?: string;\n  stateRoot?: string;\n  initialize?: boolean;\n}\nfunction verifyRuntimePolicy(context: ProcessGroupAuthorizationContext, candidate?: Buffer): ProcessGroupAuthorization {\n  try {\n    const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root || !context.controllerName) throw Error();\n    const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file),\n      bytes = candidate ?? read(file, true),\n      unparsed = JSON.parse(bytes.toString());\n    if (unparsed.schemaVersion !== 3) {\n      if (candidate) throw Error(\"Only generic policies can be staged\");\n      return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });\n    }\n    const p = processGroupAuthorizationSchema.parse(unparsed),\n      d = processGroupDescriptor(context.packageRoot);\n    if (!d || d.legacy) throw Error(\"Generic runtime descriptor required\");\n    const pkg = JSON.parse(read(path.join(context.packageRoot, \"package.json\")).toString());\n    const manifest = d.manifests.find((m) => m.id === p.groupId);\n    if (\n      !manifest ||\n      p.packageName !== pkg.name ||\n      p.namespace !== d.namespace ||\n      p.descriptorSha256 !== configurationAuthorizationHash(pkg.unsDatahub.processGroupRuntime) ||\n      p.packageRoot !== context.packageRoot ||\n      p.controllerName !== context.controllerName ||\n      p.stateRoot !== root ||\n      file !== path.join(root, d.namespace, \"authorizations\", p.groupId + \".json\") ||\n      p.directory !== path.join(root, d.namespace, \"admission\", p.groupId)\n    )\n      throw Error();\n    privateDirectory(root);\n    privateDirectory(path.dirname(file));\n    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256) throw Error();\n    const manifestBytes = read(path.join(context.packageRoot, manifest.file));\n    if (sha(manifestBytes) !== p.groupManifestSha256) throw Error();\n    const m = processGroupManifestSchema.parse(JSON.parse(manifestBytes.toString()));\n    if (m.id !== p.groupId) throw Error();\n    const receiver = m.processName + \"-admission\";\n    if (\n      new Set(m.profiles.map((x) => x.id)).size !== m.profiles.length ||\n      new Set(m.profiles.map((x) => x.processName)).size !== m.profiles.length ||\n      m.profiles.some((x) => x.processName === m.processName || x.processName === receiver)\n    )\n      throw Error();\n    for (const member of m.profiles) {\n      const f = path.resolve(context.packageRoot, path.dirname(manifest.file), member.mappingFile);\n      if (!f.startsWith(context.packageRoot + path.sep) || sha(read(f)) !== member.mappingSha256) throw Error();\n    }\n    const expected = new Map([\n      ...m.profiles.map((x) => [x.processName, \"source\"] as const),\n      [m.processName, \"target\"] as const,\n      [receiver, \"receiver\"] as const,\n    ]);\n    if (\n      p.placements.length !== expected.size ||\n      new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n      new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n      p.placements.some((x) => expected.get(x.processName) !== x.role)\n    )\n      throw Error();\n    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n    const c = normalizeProcessGroupConfiguration(context.rawConfiguration, d),\n      j = c.journal as Record<string, unknown> | undefined,\n      k = c.publisher;\n    if (\n      !entry ||\n      !c.matches ||\n      entry.processName !== c.uns?.[\"processName\"] ||\n      entry.configurationSha256 !== configurationAuthorizationHash(context.rawConfiguration) ||\n      !j ||\n      j[\"directory\"] !== p.directory ||\n      (j[\"journalId\"] ?? null) !== p.journalId ||\n      j[\"groupManifest\"] !== manifest.file\n    )\n      throw Error();\n    if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null) throw Error();\n    if (entry.role === \"receiver\" ? c.runtimeRole !== \"admission\" : c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") throw Error();\n    const member = m.profiles.find((x) => x.processName === entry.processName),\n      mapping = path.resolve(context.packageRoot, String(k[\"mappingFile\"]));\n    if (\n      entry.role !== \"source\"\n        ? k[\"groupManifest\"] !== manifest.file\n        : k[\"groupManifest\"] !== undefined ||\n          k[\"dataGroup\"] !== member?.dataGroup ||\n          !mapping.startsWith(context.packageRoot + path.sep) ||\n          sha(read(mapping)) !== member?.mappingSha256\n    )\n      throw Error();\n    const result = Object.freeze({\n      sha256: sha(bytes),\n      file,\n      directory: p.directory,\n      journalId: p.journalId,\n      role: entry.role,\n      groupId: p.groupId,\n      groupProcessName: m.processName,\n      namespace: d.namespace,\n    });\n    if (!candidate) issued.add(result);\n    return result;\n  } catch {\n    throw Error(\"Process-group runtime authorization is missing, changed or does not match this installed placement; review required\");\n  }\n}\n/** Live authority always comes from the current canonical private policy. */\nexport function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization {\n  return verifyRuntimePolicy(context);\n}\n/** Review only: never issues an authorization accepted by runtime/launch checks. */\nexport function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void {\n  verifyRuntimePolicy(context, bytes);\n}\nexport function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string {\n  const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n  if (!root) throw Error(\"Missing process-group state root\");\n  return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);\n}\nexport const authorizeHvRuntime = authorizeProcessGroupRuntime;\nexport function authorizeConfiguredProcessGroupRuntime(\n  pkg: string,\n  dir: string,\n  raw: Record<string, unknown>,\n  controllerName: string,\n  initialize = false,\n) {\n  return authorizeProcessGroupRuntime({\n    packageRoot: pkg,\n    instanceDirectory: dir,\n    rawConfiguration: raw,\n    channels: resolvedProcessGroupChannels(raw),\n    controllerName,\n    initialize,\n  });\n}\nexport function assertProcessGroupJournalAuthorization(\n  value: ProcessGroupAuthorization | undefined,\n  directory: string,\n  journalId: string | undefined,\n): void {\n  if (value && issued.has(value)) {\n    if (value.directory !== directory || value.journalId !== (journalId ?? null) || sha(read(value.file, true)) !== value.sha256)\n      throw Error(\"Exact reviewed process-group authorization required\");\n    return;\n  }\n  legacy.assertHvJournalAuthorization(value as legacy.HvAuthorization | undefined, directory, journalId);\n}\nexport const assertHvJournalAuthorization = assertProcessGroupJournalAuthorization;\nexport function assertProcessGroupStateMount(value: ProcessGroupAuthorization, root: string): void {\n  if (!issued.has(value)) {\n    legacy.assertHvStateMount(value as legacy.HvAuthorization, root);\n    return;\n  }\n  assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n  if (process.platform !== \"linux\" || !(\"namespace\" in value) || value.directory !== path.join(root, value.namespace, \"admission\", value.groupId))\n    throw Error(\"Process group requires its reviewed Linux state mount\");\n  const mount = fs\n    .readFileSync(\"/proc/self/mountinfo\", \"utf8\")\n    .split(\"\\n\")\n    .map((l) => l.split(\" \"))\n    .filter((f) => f[4] === root)\n    .at(-1);\n  if (!mount || !mount[5]?.split(\",\").includes(\"rw\") || ![\"xfs\", \"ext4\", \"btrfs\", \"zfs\"].includes(mount[mount.indexOf(\"-\") + 1] ?? \"\"))\n    throw Error(\"Process-group state root must be an explicit writable local Linux filesystem mount\");\n}\nexport const assertHvStateMount = assertProcessGroupStateMount;\nexport function assertProcessGroupTargetLaunch(\n  value: ProcessGroupAuthorization,\n  dir: string,\n  operationId: string | undefined,\n  launchId: string | undefined,\n): void {\n  if (!issued.has(value)) {\n    legacy.assertHvTargetLaunch(value as legacy.HvAuthorization, dir, operationId, launchId);\n    return;\n  }\n  if (value.role !== \"target\") return;\n  try {\n    assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n    const r = JSON.parse(read(path.join(dir, \"process-group-reservation.json\"), true).toString());\n    if (\n      !z.string().uuid().safeParse(operationId).success ||\n      !z.string().uuid().safeParse(launchId).success ||\n      r.operationId !== operationId ||\n      r.role !== \"target\" ||\n      r.lastLaunch?.launchId !== launchId ||\n      !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||\n      !digest.safeParse(r.configurationChecksum).success\n    )\n      throw Error();\n  } catch {\n    throw Error(\"Target requires its exact reviewed group reservation and launch identity\");\n  }\n}\nexport const assertHvTargetLaunch = assertProcessGroupTargetLaunch;\n"]}
+{"version":3,"file":"process-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AACxE,OAAO,EAAE,qCAAqC,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACjK,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,IAAI,IAAI,EAChC,MAAM,IAAI,GAAG,EACb,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,EAAE,MAAM;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE;IACF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7H,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAgBH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAC5D,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/H,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,yDAAyD;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrH,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AACjC,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,GAA4B,EAAE,IAAY,EAAE,QAAiB;IAC9F,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QAC3E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3D,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACrE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAsD,CAAC;YAC3D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrI,UAAU,GAAG,UAAU;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACT,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC7E,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACrF,CAAC,CAAC,CAAC;YACP,CAAC;;gBAAM,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACxE,KAAK,MAAM,KAAK,IAAI,OAAO;oBACzB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;4BAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC5E,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,iFAAiF;oBACjF,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxF,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;4BAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACpF,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;wBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,KAAK,MAAM,KAAK,IAAI,QAAQ;wBAC1B,IACE,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;4BACjC,KAAK,CAAC,cAAc,EAAE;4BACtB,CAAC,KAAK,CAAC,WAAW,EAAE;4BACpB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;4BAE/D,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GACL,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC;gBAClG,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE;gBACpG,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1G,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;gBACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;gBACtE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAE9D,MAAM,KAAK,EAAE,CAAC;YAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB,CAAC,OAAyC,EAAE,SAAkB;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAC1F,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvD,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;YAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAC3B,CAAC,CAAC,gBAAgB,KAAK,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAC5E,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAEpE,MAAM,KAAK,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3I,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,mBAAmB;YAAE,MAAM,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9C,IACE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;YAErF,MAAM,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa;gBAAE,MAAM,KAAK,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YAC5D,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU;YAClC,CAAC,QAAQ,EAAE,UAAU,CAAU;SAChC,CAAC,CAAC;QACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;YACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAEhE,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,GAAG,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EACvE,CAAC,GAAG,CAAC,CAAC,OAA8C,EACpD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAClB,IACE,CAAC,KAAK;YACN,CAAC,CAAC,CAAC,OAAO;YACV,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC5C,KAAK,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtF,CAAC,CAAC;YACF,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;YACxC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YAEpC,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACxE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YACtC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,SAAS;gBACpC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa;YAEhD,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;YAClB,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,WAAW;YAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,OAAyC;IACpF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,OAAyC,EAAE,KAAa;IAC1G,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAyC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,sCAAsC,CACpD,GAAW,EACX,GAAW,EACX,GAA4B,EAC5B,cAAsB,EACtB,UAAU,GAAG,KAAK;IAElB,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,GAAG;QAChB,iBAAiB,EAAE,GAAG;QACtB,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,4BAA4B,CAAC,GAAG,CAAC;QAC3C,cAAc;QACd,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sCAAsC,CACpD,KAA4C,EAC5C,SAAiB,EACjB,SAA6B;IAE7B,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAC1H,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,4BAA4B,CAAC,KAA2C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAgC,EAAE,IAAY;IACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,KAA+B,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC;QACnK,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,GAAW,EACX,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,oBAAoB,CAAC,KAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IACE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO;YACjD,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO;YAC7D,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO;YAElD,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS;YACrF,CAAC,CAAC,CAAC,wBAAwB,KAAK,KAAK,CAAC,wBAAwB,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport * as legacy from \"./compatibility/energenti-authorization-v1.js\";\nimport { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from \"./configuration-group-authorization.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport {\n  configurationAuthorizationHash,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource as read,\n  sha256 as sha,\n  assertPrivateProcessGroupDirectory,\n} from \"./process-group-resources.js\";\n\nexport { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from \"./process-group-resources.js\";\n\nexport const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nconst placement = z.strictObject({\n  instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n  processName: id,\n  role: z.enum([\"source\", \"target\", \"receiver\"]),\n  configurationSha256: digest,\n});\nexport const processGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(3),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(1),\n  packageName: z.string().min(1).max(214),\n  namespace: id,\n  groupId: id,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupManifestSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z.array(placement).min(4).max(18),\n});\nexport type ProcessGroupAuthorizationPolicy = z.infer<typeof processGroupAuthorizationSchema>;\nexport const processGroupManifestSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  id,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: id,\n  profiles: z\n    .array(z.strictObject({ id, processName: id, mappingFile: z.string().min(1).max(512), mappingSha256: digest, dataGroup: id }))\n    .min(2)\n    .max(16),\n});\ninterface GenericAuthorization {\n  readonly sha256: string;\n  readonly file: string;\n  readonly directory: string;\n  readonly journalId: string | null;\n  readonly role: \"source\" | \"target\" | \"receiver\";\n  readonly groupId: string;\n  readonly groupProcessName: string;\n  readonly namespace: string;\n  readonly generationId?: string;\n  readonly configurationGroupSha256?: string;\n}\nexport type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;\nexport type HvAuthorization = ProcessGroupAuthorization;\nexport type HvAuthorizationPolicy = legacy.HvAuthorizationPolicy;\nexport const hvAuthorizationSchema = legacy.hvAuthorizationSchema;\nexport const productionGroupIds = legacy.productionGroupIds;\nconst issued = new WeakSet<object>();\nconst privateDirectory = assertPrivateProcessGroupDirectory;\nfunction registryRoot(root: string, dir: string): string {\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir) throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  if (dir === root) return \"*\"; // Explicit collection of independently owned namespaces.\n  const relative = path.relative(root, dir);\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || !/^([a-z][a-z0-9-]{0,99})\\/authorizations$/.test(relative))\n    throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  privateDirectory(dir);\n  return relative.split(\"/\")[0]!;\n}\nfunction selectedFile(pkg: string, raw: Record<string, unknown>, root: string, explicit?: string): string {\n  const configured = configurationGroupPolicyIdentity(pkg, raw);\n  if (configured) {\n    if (explicit) return explicit;\n    const directory = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (directory) {\n      const selected = registryRoot(root, directory);\n      if (selected !== \"*\" && selected !== configured.namespace) throw Error(\"Foreign runtime registry\");\n      const registry = selected === \"*\" ? path.join(root, configured.namespace, \"authorizations\") : directory;\n      privateDirectory(registry);\n      return path.join(registry, configured.generationId + \".json\");\n    }\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (!single) throw Error(\"No selected policy\");\n    return single;\n  }\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Missing runtime contract\");\n  const c = normalizeProcessGroupConfiguration(raw, descriptor),\n    journal = c.journal as Record<string, unknown> | undefined;\n  const manifest = descriptor.manifests.find((m) => m.file === journal?.[\"groupManifest\"]);\n  if (!manifest) throw Error(\"Unregistered group manifest\");\n  const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n  if (explicit) return explicit;\n  if (dir) {\n    const selected = registryRoot(root, dir);\n    if (selected !== \"*\" && selected !== descriptor.namespace) throw Error(\"Foreign runtime registry\");\n    const registry = selected === \"*\" ? path.join(root, descriptor.namespace, \"authorizations\") : dir;\n    privateDirectory(registry);\n    return path.join(registry, manifest.id + \".json\");\n  }\n  const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n  if (!single) throw Error(\"No selected policy\");\n  return single;\n}\n/** Bounded private registry enumeration; retained state without its policy fails closed.\n * New groups are operator-owned data and never a release-time enum in the Controller.\n */\nexport function configuredGroupProcessNames(): Set<string> {\n  if (!hasProcessGroupAuthorization()) return new Set();\n  try {\n    const root = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root) throw Error();\n    const files = new Set<string>();\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (single) files.add(single);\n    const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (dir) {\n      const selected = registryRoot(root, dir);\n      let registries: { namespace: string; directory: string }[];\n      if (selected === \"*\") {\n        const namespaces = fs.readdirSync(root, { withFileTypes: true });\n        if (namespaces.length > 64 || namespaces.some((e) => e.isSymbolicLink())) throw Error(\"Registry namespace budget or link violation\");\n        registries = namespaces\n          .filter((e) => e.isDirectory())\n          .map((e) => {\n            if (!id.safeParse(e.name).success) throw Error(\"Invalid registry namespace\");\n            privateDirectory(path.join(root, e.name));\n            return { namespace: e.name, directory: path.join(root, e.name, \"authorizations\") };\n          });\n      } else registries = [{ namespace: selected, directory: dir }];\n      for (const registry of registries) {\n        let entries: fs.Dirent[] = [];\n        try {\n          privateDirectory(registry.directory);\n          entries = fs.readdirSync(registry.directory, { withFileTypes: true });\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n        if (entries.length > 64) throw Error(\"Policy registry budget exceeded\");\n        for (const entry of entries)\n          if (entry.name.endsWith(\".json\")) {\n            if (!/^[a-z][a-z0-9-]{0,99}\\.json$/.test(entry.name)) throw Error(\"Invalid registry entry\");\n            files.add(path.join(registry.directory, entry.name));\n            if (files.size > 64) throw Error(\"Total policy registry budget exceeded\");\n          }\n        const journals = path.join(root, registry.namespace, \"admission\");\n        try {\n          // Root/registry permissions already protect visibility; retain old parent modes.\n          for (let parent = journals; parent !== path.dirname(parent); parent = path.dirname(parent))\n            if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Linked journal registry\");\n          const retained = fs.readdirSync(journals, { withFileTypes: true });\n          if (retained.length > 64) throw Error(\"Retained journal budget exceeded\");\n          for (const entry of retained)\n            if (\n              !id.safeParse(entry.name).success ||\n              entry.isSymbolicLink() ||\n              !entry.isDirectory() ||\n              !files.has(path.join(registry.directory, entry.name + \".json\"))\n            )\n              throw Error(\"Retained journal has no reviewed policy\");\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n      }\n    }\n    const result = new Set<string>();\n    for (const file of files) {\n      const raw = JSON.parse(read(file, true).toString());\n      const p =\n        raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3\n          ? processGroupAuthorizationSchema.parse(raw)\n          : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);\n      const { namespace, group } = p.schemaVersion === 4 ? { namespace: p.namespace, group: p.generationId }\n        : p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);\n      if (\n        p.stateRoot !== root ||\n        file !== path.join(root, namespace, \"authorizations\", group + \".json\") ||\n        p.directory !== path.join(root, namespace, \"admission\", group)\n      )\n        throw Error();\n      privateDirectory(root);\n      privateDirectory(path.dirname(file));\n      for (const role of p.placements) result.add(role.processName);\n    }\n    return result;\n  } catch {\n    throw Error(\"Process-group authorization registry is missing, changed or insecure; review required\");\n  }\n}\nexport interface ProcessGroupAuthorizationContext {\n  packageRoot: string;\n  instanceDirectory: string;\n  rawConfiguration: Record<string, unknown>;\n  channels: unknown[];\n  controllerName: string;\n  file?: string;\n  stateRoot?: string;\n  initialize?: boolean;\n}\nfunction verifyRuntimePolicy(context: ProcessGroupAuthorizationContext, candidate?: Buffer): ProcessGroupAuthorization {\n  try {\n    const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root || !context.controllerName) throw Error();\n    const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file),\n      bytes = candidate ?? read(file, true),\n      unparsed = JSON.parse(bytes.toString());\n    if (unparsed.schemaVersion === 4) {\n      const result = verifyConfigurationGroupPolicy(context, bytes, root, file);\n      if (!candidate) issued.add(result);\n      return result;\n    }\n    if (unparsed.schemaVersion !== 3) {\n      if (candidate) throw Error(\"Only generic policies can be staged\");\n      return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });\n    }\n    const p = processGroupAuthorizationSchema.parse(unparsed),\n      d = processGroupDescriptor(context.packageRoot);\n    if (!d || d.legacy) throw Error(\"Generic runtime descriptor required\");\n    const pkg = JSON.parse(read(path.join(context.packageRoot, \"package.json\")).toString());\n    const manifest = d.manifests.find((m) => m.id === p.groupId);\n    if (\n      !manifest ||\n      p.packageName !== pkg.name ||\n      p.namespace !== d.namespace ||\n      p.descriptorSha256 !== configurationAuthorizationHash(pkg.unsDatahub.processGroupRuntime) ||\n      p.packageRoot !== context.packageRoot ||\n      p.controllerName !== context.controllerName ||\n      p.stateRoot !== root ||\n      file !== path.join(root, d.namespace, \"authorizations\", p.groupId + \".json\") ||\n      p.directory !== path.join(root, d.namespace, \"admission\", p.groupId)\n    )\n      throw Error();\n    privateDirectory(root);\n    privateDirectory(path.dirname(file));\n    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256) throw Error();\n    const manifestBytes = read(path.join(context.packageRoot, manifest.file));\n    if (sha(manifestBytes) !== p.groupManifestSha256) throw Error();\n    const m = processGroupManifestSchema.parse(JSON.parse(manifestBytes.toString()));\n    if (m.id !== p.groupId) throw Error();\n    const receiver = m.processName + \"-admission\";\n    if (\n      new Set(m.profiles.map((x) => x.id)).size !== m.profiles.length ||\n      new Set(m.profiles.map((x) => x.processName)).size !== m.profiles.length ||\n      m.profiles.some((x) => x.processName === m.processName || x.processName === receiver)\n    )\n      throw Error();\n    for (const member of m.profiles) {\n      const f = path.resolve(context.packageRoot, path.dirname(manifest.file), member.mappingFile);\n      if (!f.startsWith(context.packageRoot + path.sep) || sha(read(f)) !== member.mappingSha256) throw Error();\n    }\n    const expected = new Map([\n      ...m.profiles.map((x) => [x.processName, \"source\"] as const),\n      [m.processName, \"target\"] as const,\n      [receiver, \"receiver\"] as const,\n    ]);\n    if (\n      p.placements.length !== expected.size ||\n      new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n      new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n      p.placements.some((x) => expected.get(x.processName) !== x.role)\n    )\n      throw Error();\n    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n    const c = normalizeProcessGroupConfiguration(context.rawConfiguration, d),\n      j = c.journal as Record<string, unknown> | undefined,\n      k = c.publisher;\n    if (\n      !entry ||\n      !c.matches ||\n      entry.processName !== c.uns?.[\"processName\"] ||\n      entry.configurationSha256 !== configurationAuthorizationHash(context.rawConfiguration) ||\n      !j ||\n      j[\"directory\"] !== p.directory ||\n      (j[\"journalId\"] ?? null) !== p.journalId ||\n      j[\"groupManifest\"] !== manifest.file\n    )\n      throw Error();\n    if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null) throw Error();\n    if (entry.role === \"receiver\" ? c.runtimeRole !== \"admission\" : c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") throw Error();\n    const member = m.profiles.find((x) => x.processName === entry.processName),\n      mapping = path.resolve(context.packageRoot, String(k[\"mappingFile\"]));\n    if (\n      entry.role !== \"source\"\n        ? k[\"groupManifest\"] !== manifest.file\n        : k[\"groupManifest\"] !== undefined ||\n          k[\"dataGroup\"] !== member?.dataGroup ||\n          !mapping.startsWith(context.packageRoot + path.sep) ||\n          sha(read(mapping)) !== member?.mappingSha256\n    )\n      throw Error();\n    const result = Object.freeze({\n      sha256: sha(bytes),\n      file,\n      directory: p.directory,\n      journalId: p.journalId,\n      role: entry.role,\n      groupId: p.groupId,\n      groupProcessName: m.processName,\n      namespace: d.namespace,\n    });\n    if (!candidate) issued.add(result);\n    return result;\n  } catch {\n    throw Error(\"Process-group runtime authorization is missing, changed or does not match this installed placement; review required\");\n  }\n}\n/** Live authority always comes from the current canonical private policy. */\nexport function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization {\n  return verifyRuntimePolicy(context);\n}\n/** Review only: never issues an authorization accepted by runtime/launch checks. */\nexport function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void {\n  verifyRuntimePolicy(context, bytes);\n}\nexport function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string {\n  const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n  if (!root) throw Error(\"Missing process-group state root\");\n  return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);\n}\nexport const authorizeHvRuntime = authorizeProcessGroupRuntime;\nexport function authorizeConfiguredProcessGroupRuntime(\n  pkg: string,\n  dir: string,\n  raw: Record<string, unknown>,\n  controllerName: string,\n  initialize = false,\n) {\n  return authorizeProcessGroupRuntime({\n    packageRoot: pkg,\n    instanceDirectory: dir,\n    rawConfiguration: raw,\n    channels: resolvedProcessGroupChannels(raw),\n    controllerName,\n    initialize,\n  });\n}\nexport function assertProcessGroupJournalAuthorization(\n  value: ProcessGroupAuthorization | undefined,\n  directory: string,\n  journalId: string | undefined,\n): void {\n  if (value && issued.has(value)) {\n    if (value.directory !== directory || value.journalId !== (journalId ?? null) || sha(read(value.file, true)) !== value.sha256)\n      throw Error(\"Exact reviewed process-group authorization required\");\n    return;\n  }\n  legacy.assertHvJournalAuthorization(value as legacy.HvAuthorization | undefined, directory, journalId);\n}\nexport const assertHvJournalAuthorization = assertProcessGroupJournalAuthorization;\nexport function assertProcessGroupStateMount(value: ProcessGroupAuthorization, root: string): void {\n  if (!issued.has(value)) {\n    legacy.assertHvStateMount(value as legacy.HvAuthorization, root);\n    return;\n  }\n  assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n  if (process.platform !== \"linux\" || !(\"namespace\" in value) || value.directory !== path.join(root, value.namespace, \"admission\", value.generationId ?? value.groupId))\n    throw Error(\"Process group requires its reviewed Linux state mount\");\n  const mount = fs\n    .readFileSync(\"/proc/self/mountinfo\", \"utf8\")\n    .split(\"\\n\")\n    .map((l) => l.split(\" \"))\n    .filter((f) => f[4] === root)\n    .at(-1);\n  if (!mount || !mount[5]?.split(\",\").includes(\"rw\") || ![\"xfs\", \"ext4\", \"btrfs\", \"zfs\"].includes(mount[mount.indexOf(\"-\") + 1] ?? \"\"))\n    throw Error(\"Process-group state root must be an explicit writable local Linux filesystem mount\");\n}\nexport const assertHvStateMount = assertProcessGroupStateMount;\nexport function assertProcessGroupTargetLaunch(\n  value: ProcessGroupAuthorization,\n  dir: string,\n  operationId: string | undefined,\n  launchId: string | undefined,\n): void {\n  if (!issued.has(value)) {\n    legacy.assertHvTargetLaunch(value as legacy.HvAuthorization, dir, operationId, launchId);\n    return;\n  }\n  if (value.role !== \"target\") return;\n  try {\n    assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n    const r = JSON.parse(read(path.join(dir, \"process-group-reservation.json\"), true).toString());\n    if (\n      !z.string().uuid().safeParse(operationId).success ||\n      !z.string().uuid().safeParse(launchId).success ||\n      r.operationId !== operationId ||\n      r.role !== \"target\" ||\n      r.lastLaunch?.launchId !== launchId ||\n      !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||\n      !digest.safeParse(r.configurationChecksum).success\n    )\n      throw Error();\n    if (\"configurationGroupSha256\" in value && value.configurationGroupSha256 !== undefined &&\n      (r.configurationGroupSha256 !== value.configurationGroupSha256 || r.generationId !== value.generationId)) throw Error();\n  } catch {\n    throw Error(\"Target requires its exact reviewed group reservation and launch identity\");\n  }\n}\nexport const assertHvTargetLaunch = assertProcessGroupTargetLaunch;\n"]}

package/dist/runtime/process-group-backup-contract.d.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+/** SDK-owned fixed resource budget; hosts never accept it from an operation request. */
+export declare const processGroupBackupLimits: Readonly<{
+    schemaVersion: 1;
+    maximumJournals: number;
+    maximumManifestBytes: 262144;
+    maximumSnapshotBytes: 536870912;
+    maximumCapsuleBytes: 1073741824;
+}>;
+/** Public coverage only; identities, checkpoints and payloads remain encrypted. */
+export declare const processGroupStateBackupSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    state: z.ZodEnum<{
+        included: "included";
+        empty: "empty";
+    }>;
+    rootSha256: z.ZodString;
+    journals: z.ZodNumber;
+    bytes: z.ZodNumber;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+//# sourceMappingURL=process-group-backup-contract.d.ts.map

package/dist/runtime/process-group-backup-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-backup-contract.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-backup-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,wFAAwF;AACxF,eAAO,MAAM,wBAAwB;;;;;;EAMlB,CAAC;AAEpB,mFAAmF;AACnF,eAAO,MAAM,6BAA6B;;;;;;;;;;kBAOgC,CAAC"}