@uns-kit/core 3.0.28 → 3.0.30

package/dist/runtime/process-group-backup-contract.js

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import contract from "./process-group-backup-contract.json" with { type: "json" };
+/** SDK-owned fixed resource budget; hosts never accept it from an operation request. */
+export const processGroupBackupLimits = Object.freeze(z.strictObject({
+    schemaVersion: z.literal(1),
+    maximumJournals: z.number().int().min(1).max(128),
+    maximumManifestBytes: z.literal(262144),
+    maximumSnapshotBytes: z.literal(536870912),
+    maximumCapsuleBytes: z.literal(1073741824),
+}).parse(contract));
+/** Public coverage only; identities, checkpoints and payloads remain encrypted. */
+export const processGroupStateBackupSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    state: z.enum(["included", "empty"]),
+    rootSha256: z.string().regex(/^[a-f0-9]{64}$/),
+    journals: z.number().int().min(0).max(processGroupBackupLimits.maximumJournals),
+    bytes: z.number().int().positive().max(processGroupBackupLimits.maximumCapsuleBytes),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/),
+}).refine(v => v.state === "included" ? v.journals > 0 : v.journals === 0);
+//# sourceMappingURL=process-group-backup-contract.js.map

package/dist/runtime/process-group-backup-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-backup-contract.js","sourceRoot":"","sources":["../../src/runtime/process-group-backup-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,QAAQ,MAAM,sCAAsC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAElF,wFAAwF;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IACnE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAC3C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEpB,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,eAAe,CAAC;IAC/E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC;IACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CAC3C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport contract from \"./process-group-backup-contract.json\" with { type: \"json\" };\n\n/** SDK-owned fixed resource budget; hosts never accept it from an operation request. */\nexport const processGroupBackupLimits = Object.freeze(z.strictObject({\n  schemaVersion: z.literal(1),\n  maximumJournals: z.number().int().min(1).max(128),\n  maximumManifestBytes: z.literal(262144),\n  maximumSnapshotBytes: z.literal(536870912),\n  maximumCapsuleBytes: z.literal(1073741824),\n}).parse(contract));\n\n/** Public coverage only; identities, checkpoints and payloads remain encrypted. */\nexport const processGroupStateBackupSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  state: z.enum([\"included\", \"empty\"]),\n  rootSha256: z.string().regex(/^[a-f0-9]{64}$/),\n  journals: z.number().int().min(0).max(processGroupBackupLimits.maximumJournals),\n  bytes: z.number().int().positive().max(processGroupBackupLimits.maximumCapsuleBytes),\n  sha256: z.string().regex(/^[a-f0-9]{64}$/),\n}).refine(v => v.state === \"included\" ? v.journals > 0 : v.journals === 0);\n"]}

package/dist/runtime/process-group-backup-contract.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "maximumJournals": 32,
+  "maximumManifestBytes": 262144,
+  "maximumSnapshotBytes": 536870912,
+  "maximumCapsuleBytes": 1073741824
+}

package/dist/runtime/process-group-configured-upgrade.d.ts

@@ -0,0 +1,4 @@
+import type { PreparedGroupUpgrade, UpgradeConfigurations } from "./process-group-upgrade.js";
+/** Same generation, different paired artifacts. Never initializes or rewrites the journal. */
+export declare function reviewInstalledConfigurationGroupUpgrade(configs: UpgradeConfigurations, controllerName: string, stateRoot: string, excludedUnsFields?: readonly string[]): PreparedGroupUpgrade;
+//# sourceMappingURL=process-group-configured-upgrade.d.ts.map

package/dist/runtime/process-group-configured-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-configured-upgrade.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-configured-upgrade.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAA6B,oBAAoB,EAAwB,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE/I,8FAA8F;AAC9F,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,oBAAoB,CAyGtB"}

package/dist/runtime/process-group-configured-upgrade.js

@@ -0,0 +1,107 @@
+import path from "node:path";
+import { configurationGroupAuthorizationSchema } from "./configuration-group-authorization.js";
+import { configurationResourceHash } from "./configuration-group-contract.js";
+import { authorizeProcessGroupRuntime, processGroupAuthorizationFile, validateProcessGroupPolicyCandidate } from "./process-group-authorization.js";
+import { resolvedProcessGroupChannels } from "./process-group-contract.js";
+import { describeInstalledProcessGroupGeneration, inspectGenerationJournal } from "./process-group-generation.js";
+import { groupArtifactHash, groupChannelsHash, configurationAuthorizationHash as hash, readProcessGroupResource as read, sha256, } from "./process-group-resources.js";
+/** Same generation, different paired artifacts. Never initializes or rewrites the journal. */
+export function reviewInstalledConfigurationGroupUpgrade(configs, controllerName, stateRoot, excludedUnsFields = []) {
+    const context = (c) => ({
+        packageRoot: c.packageRoot,
+        instanceDirectory: c.instanceDirectory,
+        rawConfiguration: c.raw,
+        channels: resolvedProcessGroupChannels(c.resolved),
+        controllerName,
+        stateRoot,
+    });
+    const source = configs.source.publisher, target = configs.target.publisher, a = describeInstalledProcessGroupGeneration(source), b = describeInstalledProcessGroupGeneration(target);
+    if (a.d.protocolVersion !== 2 || b.d.protocolVersion !== 2 || a.d.namespace !== b.d.namespace || hash(a.reference) !== hash(b.reference))
+        throw Error("Unchanged configuration generation required; review resource changes as a separate generation");
+    const pkg = (c) => JSON.parse(read(path.join(c.packageRoot, "package.json")).toString()), sourcePackage = pkg(source), targetPackage = pkg(target);
+    if (!sourcePackage.version || !targetPackage.version || sourcePackage.version === targetPackage.version)
+        throw Error("Two different installed paired versions required");
+    const old = authorizeProcessGroupRuntime(context(source));
+    const sourcePolicy = read(old.file, true), previous = configurationGroupAuthorizationSchema.parse(JSON.parse(sourcePolicy.toString()));
+    const portable = (raw) => {
+        const copy = structuredClone(raw), uns = { ...copy["uns"] };
+        for (const key of excludedUnsFields)
+            delete uns[key];
+        copy["uns"] = uns;
+        return hash(copy);
+    };
+    const members = [];
+    const directories = new Set();
+    for (const side of ["source", "target"])
+        for (const role of ["publisher", "receiver"]) {
+            const c = configs[side][role], g = describeInstalledProcessGroupGeneration(c), installed = pkg(c);
+            if (g.d.protocolVersion !== 2 ||
+                g.d.namespace !== a.d.namespace ||
+                installed.name !== sourcePackage.name ||
+                installed.version !== (side === "source" ? sourcePackage.version : targetPackage.version) ||
+                c.packageRoot !== configs[side].publisher.packageRoot ||
+                directories.has(c.instanceDirectory) ||
+                hash(g.reference) !== hash(a.reference) ||
+                g.normalized.uns["processName"] !== (role === "publisher" ? a.processName : a.receiverProcessName) ||
+                (role === "receiver"
+                    ? g.normalized.runtimeRole !== "admission"
+                    : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== "publisher") ||
+                portable(c.raw) !== portable(configs.source[role].raw) ||
+                groupChannelsHash(g.channels) !== groupChannelsHash(a.channels) ||
+                processGroupAuthorizationFile(context(c)) !== old.file)
+                throw Error("Exact paired configuration, resources, broker identity and retained journal required");
+            directories.add(c.instanceDirectory);
+            if (side === "source") {
+                const proof = authorizeProcessGroupRuntime(context(c));
+                if (proof.role !== (role === "publisher" ? "target" : "receiver") || proof.sha256 !== sha256(sourcePolicy))
+                    throw Error("Exact authorized source pair required");
+            }
+            members.push({
+                side,
+                role,
+                processName: String(g.normalized.uns["processName"]),
+                configurationSha256: hash(c.raw),
+                artifactSha256: groupArtifactHash(c.packageRoot),
+            });
+        }
+    const policy = configurationGroupAuthorizationSchema.parse({
+        ...previous,
+        packageRoot: target.packageRoot,
+        descriptorSha256: configurationResourceHash(targetPackage.unsDatahub.processGroupConfigurationRuntime),
+        artifactSha256: groupArtifactHash(target.packageRoot),
+        placements: [
+            ...previous.placements.filter((p) => p.role === "source"),
+            ...["publisher", "receiver"].map((role) => ({
+                instanceId: path.basename(configs.target[role].instanceDirectory),
+                processName: members.find((m) => m.side === "target" && m.role === role).processName,
+                role: role === "publisher" ? "target" : "receiver",
+                configurationSha256: configurationResourceHash(configs.target[role].raw),
+            })),
+        ],
+    });
+    const targetPolicy = Buffer.from(JSON.stringify(policy));
+    for (const role of ["publisher", "receiver"])
+        validateProcessGroupPolicyCandidate(context(configs.target[role]), targetPolicy);
+    inspectGenerationJournal(a.reference); // Pending, previously completed work is valid and must remain bound.
+    if (sha256(read(old.file, true)) !== sha256(sourcePolicy))
+        throw Error("Source policy changed during review");
+    return {
+        review: {
+            protocolVersion: 1,
+            namespace: a.d.namespace,
+            groupId: a.id,
+            policyFile: old.file,
+            sourcePolicySha256: sha256(sourcePolicy),
+            targetPolicySha256: sha256(targetPolicy),
+            journalId: a.reference.journalId,
+            directory: a.reference.directory,
+            journalContractSha256: a.reference.journalContractSha256,
+            profiles: a.reference.profiles,
+            retainedJournal: a.reference,
+            members,
+        },
+        sourcePolicy,
+        targetPolicy,
+    };
+}
+//# sourceMappingURL=process-group-configured-upgrade.js.map

package/dist/runtime/process-group-configured-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-configured-upgrade.js","sourceRoot":"","sources":["../../src/runtime/process-group-configured-upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACpJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,uCAAuC,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAClH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,8BAA8B,IAAI,IAAI,EACtC,wBAAwB,IAAI,IAAI,EAChC,MAAM,GACP,MAAM,8BAA8B,CAAC;AAGtC,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA8B,EAC9B,cAAsB,EACtB,SAAiB,EACjB,oBAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,gBAAgB,EAAE,CAAC,CAAC,GAAG;QACvB,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,cAAc;QACd,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EACrC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EACjC,CAAC,GAAG,uCAAuC,CAAC,MAAM,CAAC,EACnD,CAAC,GAAG,uCAAuC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACtI,MAAM,KAAK,CAAC,+FAA+F,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAC5G,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAC3B,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QACrG,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EACvC,QAAQ,GAAG,qCAAqC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,CAAC,GAA4B,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,EAC/B,GAAG,GAAG,EAAE,GAAI,IAAI,CAAC,KAAK,CAA6B,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,iBAAiB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAU,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAC3B,CAAC,GAAG,uCAAuC,CAAC,CAAC,CAAC,EAC9C,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IACE,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC;gBACzB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/B,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI;gBACrC,SAAS,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;gBACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW;gBACrD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACpC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;gBAClG,CAAC,IAAI,KAAK,UAAU;oBAClB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW;oBAC1C,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC;gBACvF,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBACtD,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC/D,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI;gBAEtD,MAAM,KAAK,CAAC,sFAAsF,CAAC,CAAC;YACtG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC;oBACxG,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,IAAI;gBACJ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACpD,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAChC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC,KAAK,CAAC;QACzD,GAAG,QAAQ;QACX,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,yBAAyB,CAAC,aAAa,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACtG,cAAc,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;QACrD,UAAU,EAAE;YACV,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;YACzD,GAAI,CAAC,WAAW,EAAE,UAAU,CAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrD,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC;gBACjE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC,WAAW;gBACrF,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;gBAClD,mBAAmB,EAAE,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;aACzE,CAAC,CAAC;SACJ;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAU;QAAE,mCAAmC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACxI,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qEAAqE;IAC5G,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC9G,OAAO;QACL,MAAM,EAAE;YACN,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YACxB,OAAO,EAAE,CAAC,CAAC,EAAE;YACb,UAAU,EAAE,GAAG,CAAC,IAAI;YACpB,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC;YACxC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC;YACxC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;YAChC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB;YACxD,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ;YAC9B,eAAe,EAAE,CAAC,CAAC,SAAS;YAC5B,OAAO;SACR;QACD,YAAY;QACZ,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["import path from \"node:path\";\n\nimport { configurationGroupAuthorizationSchema } from \"./configuration-group-authorization.js\";\nimport { configurationResourceHash } from \"./configuration-group-contract.js\";\nimport { authorizeProcessGroupRuntime, processGroupAuthorizationFile, validateProcessGroupPolicyCandidate } from \"./process-group-authorization.js\";\nimport { resolvedProcessGroupChannels } from \"./process-group-contract.js\";\nimport { describeInstalledProcessGroupGeneration, inspectGenerationJournal } from \"./process-group-generation.js\";\nimport {\n  groupArtifactHash,\n  groupChannelsHash,\n  configurationAuthorizationHash as hash,\n  readProcessGroupResource as read,\n  sha256,\n} from \"./process-group-resources.js\";\nimport type { GroupVersionUpgradeReview, PreparedGroupUpgrade, UpgradeConfiguration, UpgradeConfigurations } from \"./process-group-upgrade.js\";\n\n/** Same generation, different paired artifacts. Never initializes or rewrites the journal. */\nexport function reviewInstalledConfigurationGroupUpgrade(\n  configs: UpgradeConfigurations,\n  controllerName: string,\n  stateRoot: string,\n  excludedUnsFields: readonly string[] = [],\n): PreparedGroupUpgrade {\n  const context = (c: UpgradeConfiguration) => ({\n    packageRoot: c.packageRoot,\n    instanceDirectory: c.instanceDirectory,\n    rawConfiguration: c.raw,\n    channels: resolvedProcessGroupChannels(c.resolved),\n    controllerName,\n    stateRoot,\n  });\n  const source = configs.source.publisher,\n    target = configs.target.publisher,\n    a = describeInstalledProcessGroupGeneration(source),\n    b = describeInstalledProcessGroupGeneration(target);\n  if (a.d.protocolVersion !== 2 || b.d.protocolVersion !== 2 || a.d.namespace !== b.d.namespace || hash(a.reference) !== hash(b.reference))\n    throw Error(\"Unchanged configuration generation required; review resource changes as a separate generation\");\n  const pkg = (c: UpgradeConfiguration) => JSON.parse(read(path.join(c.packageRoot, \"package.json\")).toString()),\n    sourcePackage = pkg(source),\n    targetPackage = pkg(target);\n  if (!sourcePackage.version || !targetPackage.version || sourcePackage.version === targetPackage.version)\n    throw Error(\"Two different installed paired versions required\");\n  const old = authorizeProcessGroupRuntime(context(source));\n  const sourcePolicy = read(old.file, true),\n    previous = configurationGroupAuthorizationSchema.parse(JSON.parse(sourcePolicy.toString()));\n  const portable = (raw: Record<string, unknown>) => {\n    const copy = structuredClone(raw),\n      uns = { ...(copy[\"uns\"] as Record<string, unknown>) };\n    for (const key of excludedUnsFields) delete uns[key];\n    copy[\"uns\"] = uns;\n    return hash(copy);\n  };\n  const members: GroupVersionUpgradeReview[\"members\"] = [];\n  const directories = new Set<string>();\n  for (const side of [\"source\", \"target\"] as const)\n    for (const role of [\"publisher\", \"receiver\"] as const) {\n      const c = configs[side][role],\n        g = describeInstalledProcessGroupGeneration(c),\n        installed = pkg(c);\n      if (\n        g.d.protocolVersion !== 2 ||\n        g.d.namespace !== a.d.namespace ||\n        installed.name !== sourcePackage.name ||\n        installed.version !== (side === \"source\" ? sourcePackage.version : targetPackage.version) ||\n        c.packageRoot !== configs[side].publisher.packageRoot ||\n        directories.has(c.instanceDirectory) ||\n        hash(g.reference) !== hash(a.reference) ||\n        g.normalized.uns[\"processName\"] !== (role === \"publisher\" ? a.processName : a.receiverProcessName) ||\n        (role === \"receiver\"\n          ? g.normalized.runtimeRole !== \"admission\"\n          : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== \"publisher\") ||\n        portable(c.raw) !== portable(configs.source[role].raw) ||\n        groupChannelsHash(g.channels) !== groupChannelsHash(a.channels) ||\n        processGroupAuthorizationFile(context(c)) !== old.file\n      )\n        throw Error(\"Exact paired configuration, resources, broker identity and retained journal required\");\n      directories.add(c.instanceDirectory);\n      if (side === \"source\") {\n        const proof = authorizeProcessGroupRuntime(context(c));\n        if (proof.role !== (role === \"publisher\" ? \"target\" : \"receiver\") || proof.sha256 !== sha256(sourcePolicy))\n          throw Error(\"Exact authorized source pair required\");\n      }\n      members.push({\n        side,\n        role,\n        processName: String(g.normalized.uns[\"processName\"]),\n        configurationSha256: hash(c.raw),\n        artifactSha256: groupArtifactHash(c.packageRoot),\n      });\n    }\n  const policy = configurationGroupAuthorizationSchema.parse({\n    ...previous,\n    packageRoot: target.packageRoot,\n    descriptorSha256: configurationResourceHash(targetPackage.unsDatahub.processGroupConfigurationRuntime),\n    artifactSha256: groupArtifactHash(target.packageRoot),\n    placements: [\n      ...previous.placements.filter((p) => p.role === \"source\"),\n      ...([\"publisher\", \"receiver\"] as const).map((role) => ({\n        instanceId: path.basename(configs.target[role].instanceDirectory),\n        processName: members.find((m) => m.side === \"target\" && m.role === role)!.processName,\n        role: role === \"publisher\" ? \"target\" : \"receiver\",\n        configurationSha256: configurationResourceHash(configs.target[role].raw),\n      })),\n    ],\n  });\n  const targetPolicy = Buffer.from(JSON.stringify(policy));\n  for (const role of [\"publisher\", \"receiver\"] as const) validateProcessGroupPolicyCandidate(context(configs.target[role]), targetPolicy);\n  inspectGenerationJournal(a.reference); // Pending, previously completed work is valid and must remain bound.\n  if (sha256(read(old.file, true)) !== sha256(sourcePolicy)) throw Error(\"Source policy changed during review\");\n  return {\n    review: {\n      protocolVersion: 1,\n      namespace: a.d.namespace,\n      groupId: a.id,\n      policyFile: old.file,\n      sourcePolicySha256: sha256(sourcePolicy),\n      targetPolicySha256: sha256(targetPolicy),\n      journalId: a.reference.journalId,\n      directory: a.reference.directory,\n      journalContractSha256: a.reference.journalContractSha256,\n      profiles: a.reference.profiles,\n      retainedJournal: a.reference,\n      members,\n    },\n    sourcePolicy,\n    targetPolicy,\n  };\n}\n"]}

package/dist/runtime/process-group-generation.d.ts

@@ -0,0 +1,166 @@
+import { z } from "zod";
+import type { GroupVersionUpgradeReview, PreparedGroupUpgrade, UpgradeConfiguration, UpgradeConfigurations } from "./process-group-upgrade.js";
+export declare const processGroupGenerationInputSchema: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<2>;
+    source: z.ZodObject<{
+        publisher: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+        receiver: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    target: z.ZodObject<{
+        publisher: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+        receiver: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    acknowledgeInputPause: z.ZodLiteral<true>;
+    acknowledgeResourceReview: z.ZodLiteral<true>;
+    acknowledgePossibleReplay: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type ProcessGroupGenerationInput = z.infer<typeof processGroupGenerationInputSchema>;
+export type GenerationJournalReference = {
+    directory: string;
+    journalId: string;
+    journalContractSha256: string;
+    generationId: string;
+    groupSha256?: string;
+    contractVersion: 1 | 2;
+    maxRecords: number;
+    maxBytes: number;
+    minFreeBytes: number;
+    profiles: Array<{
+        processName: string;
+        mappingSha256: string;
+        dataGroup: string;
+    }>;
+};
+export type GroupGenerationReview = Omit<GroupVersionUpgradeReview, "protocolVersion"> & {
+    protocolVersion: 2;
+    sourcePolicyFile: string;
+    sourceJournal: GenerationJournalReference;
+    targetJournal: GenerationJournalReference;
+    delivery: {
+        inputPausePossible: true;
+        retainedBrokerSessionMayReplay: true;
+        exactlyOnceOutput: false;
+    };
+    resourceChanges: Array<{
+        processName: string;
+        beforeSha256: string;
+        afterSha256: string;
+        dataGroup: string;
+    }>;
+};
+/** Bounded read-only storage evidence; no initializer, rewriting or replay. */
+export declare function inspectGenerationJournal(reference: GenerationJournalReference): {
+    records: number;
+    bytes: number;
+    admitted: number;
+    completed: number;
+    lastSequence: number;
+};
+/** Recheck immediately before the first launch; initialization is never silently reused. */
+export declare function inspectPristineGenerationJournal(reference: GenerationJournalReference): {
+    records: number;
+    bytes: number;
+    admitted: number;
+    completed: number;
+    lastSequence: number;
+};
+/** Data-only normalized revision and immutable journal contract shared by reviewed transitions. */
+export declare function describeInstalledProcessGroupGeneration(c: UpgradeConfiguration): {
+    d: {
+        protocolVersion: 2;
+        namespace: string;
+        publisherPath: string[];
+        groupPath: string[];
+        memberPath: string[];
+        journalPath: string[];
+        runtimeRolePath: string[];
+        receiverRole: string;
+        match?: {
+            path: string[];
+            value: string;
+        };
+    };
+    normalized: {
+        matches: boolean;
+        uns: Record<string, unknown>;
+        publisher: Record<string, unknown>;
+        journal: unknown;
+        runtimeRole: unknown;
+        configurationSnapshot: import("./configuration-group-contract.js").ConfigurationGroupSnapshot;
+    };
+    channels: import("../index.js").ResolvedMqttChannel[];
+    id: string;
+    processName: string;
+    receiverProcessName: string;
+    inputTopic: string;
+    reference: {
+        directory: string;
+        journalId: string;
+        generationId: string;
+        groupSha256: string;
+        contractVersion: 2;
+        journalContractSha256: string;
+        maxRecords: number;
+        maxBytes: number;
+        minFreeBytes: number;
+        profiles: {
+            processName: string;
+            mappingSha256: string;
+            dataGroup: string;
+        }[];
+    };
+} | {
+    d: import("./process-group-contract.js").ProcessGroupRuntimeDescriptor;
+    normalized: {
+        matches: boolean;
+        uns: Record<string, unknown>;
+        publisher: Record<string, unknown>;
+        journal: unknown;
+        runtimeRole: unknown;
+        configurationSnapshot: import("./configuration-group-contract.js").ConfigurationGroupSnapshot;
+    };
+    channels: import("../index.js").ResolvedMqttChannel[];
+    id: string;
+    processName: string;
+    receiverProcessName: string;
+    inputTopic: string;
+    reference: {
+        directory: string;
+        journalId: string;
+        generationId: string;
+        contractVersion: 1;
+        journalContractSha256: string;
+        maxRecords: number;
+        maxBytes: number;
+        minFreeBytes: number;
+        profiles: {
+            processName: string;
+            mappingSha256: string;
+            dataGroup: string;
+        }[];
+        groupSha256?: undefined;
+    };
+};
+/** Operator reviews opaque before/after digests; business equivalence is application-owned. */
+export declare function reviewInstalledProcessGroupGeneration(configs: UpgradeConfigurations, controllerName: string, stateRoot: string, excludedUnsFields?: readonly string[]): PreparedGroupUpgrade;
+//# sourceMappingURL=process-group-generation.d.ts.map

package/dist/runtime/process-group-generation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-generation.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-generation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAG/I,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkB1C,CAAC;AACL,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,GAAG;IACvF,eAAe,EAAE,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,0BAA0B,CAAC;IAC1C,aAAa,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,EAAE;QAAE,kBAAkB,EAAE,IAAI,CAAC;QAAC,8BAA8B,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,KAAK,CAAA;KAAE,CAAC;IACvG,eAAe,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/G,CAAC;AAEF,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,0BAA0B;;;;;;EAyE7E;AAED,4FAA4F;AAC5F,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,0BAA0B;;;;;;EAKrF;AAED,mGAAmG;AACnG,wBAAgB,uCAAuC,CAAC,CAAC,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D9E;AAED,+FAA+F;AAC/F,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,oBAAoB,CAyHtB"}

package/dist/runtime/process-group-generation.js

@@ -0,0 +1,278 @@
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { z } from "zod";
+import { configurationGroupJournalContract, configurationGroupJournalSchema } from "./configuration-group-contract.js";
+import { authorizeProcessGroupRuntime } from "./process-group-authorization.js";
+import { processGroupManifestSchema } from "./process-group-authorization.js";
+import { processGroupJournalContract, processGroupJournalSchema, processGroupSourceIdentity, resolvedProcessGroupChannels, } from "./process-group-contract.js";
+import { groupPlacementSchema, placementKey } from "./process-group-control-contract.js";
+import { groupArtifactHash, groupChannelsHash, configurationAuthorizationHash as hash, readProcessGroupResource as read, sha256, } from "./process-group-resources.js";
+import { normalizeRuntimeProcessGroup, selectedProcessGroupDescriptor } from "./process-group-runtime-selection.js";
+const pair = z.strictObject({ publisher: groupPlacementSchema, receiver: groupPlacementSchema });
+export const processGroupGenerationInputSchema = z
+    .strictObject({
+    protocolVersion: z.literal(2),
+    source: pair,
+    target: pair,
+    acknowledgeInputPause: z.literal(true),
+    acknowledgeResourceReview: z.literal(true),
+    acknowledgePossibleReplay: z.literal(true),
+})
+    .superRefine((v, c) => {
+    const all = [v.source.publisher, v.source.receiver, v.target.publisher, v.target.receiver];
+    if (new Set(all.map(placementKey)).size !== 4 ||
+        all.some((p) => p.controller !== all[0].controller || p.rttNode !== all[0].rttNode) ||
+        v.source.publisher.version !== v.source.receiver.version ||
+        v.target.publisher.version !== v.target.receiver.version)
+        c.addIssue({ code: "custom", message: "Four distinct paired placements on one package/controller required" });
+});
+/** Bounded read-only storage evidence; no initializer, rewriting or replay. */
+export function inspectGenerationJournal(reference) {
+    const file = path.join(reference.directory, "admission.sqlite"), stat = fs.lstatSync(file);
+    if (fs.realpathSync(file) !== file ||
+        !stat.isFile() ||
+        stat.nlink !== 1 ||
+        stat.uid !== process.getuid?.() ||
+        (stat.mode & 0o077) !== 0 ||
+        stat.size > 512 * 1024 * 1024)
+        throw Error("Private retained generation journal required");
+    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    const db = new DatabaseSync(file, { readOnly: true });
+    try {
+        db.exec("PRAGMA query_only=ON; PRAGMA busy_timeout=1000; BEGIN");
+        const meta = Object.fromEntries(db
+            .prepare("SELECT key,value FROM metadata WHERE key IN ('id','contract')")
+            .all()
+            .map((r) => [r["key"], r["value"]]));
+        if (meta["id"] !== reference.journalId ||
+            typeof meta["contract"] !== "string" ||
+            meta["contract"].length > 1048576 ||
+            sha256(meta["contract"]) !== reference.journalContractSha256)
+            throw Error("Reviewed journal generation changed");
+        const rows = db.prepare("SELECT name,contract,completed,last_seq FROM profiles ORDER BY name").all();
+        if (rows.length !== reference.profiles.length)
+            throw Error("Journal profile set differs");
+        for (const profile of reference.profiles) {
+            const row = rows.find((r) => r["name"] === profile.processName), binding = row ? JSON.parse(String(row["contract"])) : null;
+            if (!binding ||
+                binding.processName !== profile.processName ||
+                binding.dataGroup !== profile.dataGroup ||
+                binding[reference.contractVersion === 1 ? "mappingSha256" : "resourceSha256"] !== profile.mappingSha256)
+                throw Error("Journal resource binding differs");
+        }
+        const usage = db.prepare("SELECT records,bytes,admitted FROM usage WHERE id=1").get();
+        const actual = db.prepare("SELECT count(*) records,coalesce(sum(bytes),0) bytes FROM tasks").get();
+        const numbers = [usage?.["records"], usage?.["bytes"], usage?.["admitted"], ...rows.flatMap((r) => [r["completed"], r["last_seq"]])];
+        const completed = rows.reduce((n, r) => n + Number(r["completed"]), 0);
+        if (!usage ||
+            !actual ||
+            numbers.some((n) => typeof n !== "number" || !Number.isSafeInteger(n) || n < 0) ||
+            usage["records"] !== actual["records"] ||
+            usage["bytes"] !== actual["bytes"] ||
+            !Number.isSafeInteger(completed) ||
+            Number(usage["admitted"]) !== completed + Number(usage["records"]) ||
+            rows.some((r) => (r["completed"] === 0) !== (r["last_seq"] === 0)) ||
+            Number(usage["records"]) > reference.maxRecords ||
+            Number(usage["bytes"]) > reference.maxBytes)
+            throw Error("Journal usage is unconfirmed");
+        return {
+            records: Number(usage["records"]),
+            bytes: Number(usage["bytes"]),
+            admitted: Number(usage["admitted"]),
+            completed,
+            lastSequence: rows.reduce((n, r) => Math.max(n, Number(r["last_seq"])), 0),
+        };
+    }
+    finally {
+        try {
+            db.exec("ROLLBACK");
+        }
+        finally {
+            db.close();
+        }
+    }
+}
+/** Recheck immediately before the first launch; initialization is never silently reused. */
+export function inspectPristineGenerationJournal(reference) {
+    const status = inspectGenerationJournal(reference);
+    if (status.records || status.bytes || status.admitted || status.completed || status.lastSequence)
+        throw Error("Target generation is not pristine; inspect the existing initialization outcome");
+    return status;
+}
+/** Data-only normalized revision and immutable journal contract shared by reviewed transitions. */
+export function describeInstalledProcessGroupGeneration(c) {
+    const d = selectedProcessGroupDescriptor(c.packageRoot, c.raw);
+    if (!d)
+        throw Error("Declared process group required");
+    const normalized = normalizeRuntimeProcessGroup(c.raw, d);
+    if (!normalized.matches)
+        throw Error("Runtime selector differs");
+    const channels = resolvedProcessGroupChannels(c.resolved), sourceIdentity = processGroupSourceIdentity(channels[1]);
+    if (d.protocolVersion === 2) {
+        const snapshot = normalized.configurationSnapshot;
+        const journal = configurationGroupJournalSchema.parse(normalized.journal);
+        const contract = configurationGroupJournalContract(snapshot, sourceIdentity, journal, snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })));
+        return {
+            d,
+            normalized,
+            channels,
+            id: snapshot.group.id,
+            processName: snapshot.group.processName,
+            receiverProcessName: snapshot.group.receiverProcessName,
+            inputTopic: snapshot.group.inputTopic,
+            reference: {
+                directory: journal.directory,
+                journalId: journal.journalId,
+                generationId: journal.generationId,
+                groupSha256: snapshot.sha256,
+                contractVersion: 2,
+                journalContractSha256: sha256(contract),
+                maxRecords: journal.maxRecords,
+                maxBytes: journal.maxBytes,
+                minFreeBytes: journal.minFreeBytes,
+                profiles: snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, mappingSha256: resourceSha256, dataGroup })),
+            },
+        };
+    }
+    const journal = processGroupJournalSchema.parse(normalized.journal);
+    if (!d.manifests.some((m) => m.file === journal.groupManifest))
+        throw Error("Registered file group required");
+    const group = processGroupManifestSchema.parse(JSON.parse(read(path.resolve(c.packageRoot, journal.groupManifest)).toString()));
+    const contract = processGroupJournalContract(sourceIdentity, journal, group.profiles);
+    return {
+        d,
+        normalized,
+        channels,
+        id: group.id,
+        processName: group.processName,
+        receiverProcessName: group.processName + "-admission",
+        inputTopic: group.inputTopic,
+        reference: {
+            directory: journal.directory,
+            journalId: journal.journalId,
+            generationId: group.id,
+            contractVersion: 1,
+            journalContractSha256: sha256(contract),
+            maxRecords: journal.maxRecords,
+            maxBytes: journal.maxBytes,
+            minFreeBytes: journal.minFreeBytes,
+            profiles: group.profiles.map(({ processName, mappingSha256, dataGroup }) => ({ processName, mappingSha256, dataGroup })),
+        },
+    };
+}
+/** Operator reviews opaque before/after digests; business equivalence is application-owned. */
+export function reviewInstalledProcessGroupGeneration(configs, controllerName, stateRoot, excludedUnsFields = []) {
+    const context = (c) => ({
+        packageRoot: c.packageRoot,
+        instanceDirectory: c.instanceDirectory,
+        rawConfiguration: c.raw,
+        channels: resolvedProcessGroupChannels(c.resolved),
+        controllerName,
+        stateRoot,
+    });
+    const a = describeInstalledProcessGroupGeneration(configs.source.publisher), b = describeInstalledProcessGroupGeneration(configs.target.publisher);
+    if (b.d.protocolVersion !== 2 ||
+        a.d.namespace !== b.d.namespace ||
+        a.id !== b.id ||
+        a.processName !== b.processName ||
+        a.receiverProcessName !== b.receiverProcessName ||
+        a.inputTopic !== b.inputTopic ||
+        a.reference.directory === b.reference.directory ||
+        !a.reference.journalId ||
+        !b.reference.journalId ||
+        a.reference.journalId === b.reference.journalId ||
+        a.reference.maxRecords !== b.reference.maxRecords ||
+        a.reference.maxBytes !== b.reference.maxBytes ||
+        a.reference.minFreeBytes !== b.reference.minFreeBytes)
+        throw Error("Distinct bounded generations with the same process/input identity required");
+    const policyFiles = {}, policies = {};
+    const members = [];
+    const portable = (raw, d) => {
+        const copy = structuredClone(raw), uns = { ...copy["uns"] };
+        for (const key of excludedUnsFields)
+            delete uns[key];
+        copy["uns"] = uns;
+        for (const keys of [d.publisherPath, d.journalPath, d.runtimeRolePath]) {
+            let node = copy;
+            let present = true;
+            for (const key of keys.slice(0, -1)) {
+                const child = node[key];
+                if (child === undefined) {
+                    present = false;
+                    break;
+                }
+                if (!child || typeof child !== "object" || Array.isArray(child))
+                    throw Error("Invalid resource selector parent");
+                node = child;
+            }
+            if (present)
+                delete node[keys.at(-1)];
+        }
+        return hash(copy);
+    };
+    for (const side of ["source", "target"])
+        for (const role of ["publisher", "receiver"]) {
+            const c = configs[side][role], g = describeInstalledProcessGroupGeneration(c), expected = side === "source" ? a : b, proof = authorizeProcessGroupRuntime(context(c));
+            if (proof.role !== (role === "publisher" ? "target" : "receiver") ||
+                proof.directory !== expected.reference.directory ||
+                proof.journalId !== expected.reference.journalId ||
+                hash(g.reference) !== hash(expected.reference) ||
+                g.normalized.uns["processName"] !== (role === "publisher" ? g.processName : g.receiverProcessName) ||
+                (role === "receiver"
+                    ? g.normalized.runtimeRole !== "admission"
+                    : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== "publisher"))
+                throw Error("Exact reviewed generation pair required");
+            const pkg = JSON.parse(read(path.join(c.packageRoot, "package.json")).toString());
+            if (pkg.name !== JSON.parse(read(path.join(configs.source.publisher.packageRoot, "package.json")).toString()).name ||
+                portable(c.raw, g.d) !== portable(configs.source[role].raw, a.d) ||
+                groupChannelsHash(g.channels) !== groupChannelsHash(a.channels))
+                throw Error("Configuration or broker identity changed outside the reviewed resources");
+            if (policyFiles[side] && policyFiles[side] !== proof.file)
+                throw Error("Pair policies differ");
+            policyFiles[side] = proof.file;
+            policies[side] = read(proof.file, true);
+            members.push({
+                side,
+                role,
+                processName: String(g.normalized.uns["processName"]),
+                configurationSha256: hash(c.raw),
+                artifactSha256: groupArtifactHash(c.packageRoot),
+            });
+        }
+    if (policyFiles.source === policyFiles.target)
+        throw Error("Each generation requires its own retained policy");
+    const profiles = a.reference.profiles;
+    if (profiles.length !== b.reference.profiles.length ||
+        profiles.some((p) => !b.reference.profiles.some((q) => q.processName === p.processName && q.dataGroup === p.dataGroup)))
+        throw Error("Logical profile identities or data groups changed");
+    inspectGenerationJournal(a.reference);
+    inspectPristineGenerationJournal(b.reference);
+    if (sha256(read(policyFiles.source, true)) !== sha256(policies.source) || sha256(read(policyFiles.target, true)) !== sha256(policies.target))
+        throw Error("Reviewed policies changed");
+    const review = {
+        protocolVersion: 2,
+        namespace: b.d.namespace,
+        groupId: b.id,
+        policyFile: policyFiles.target,
+        sourcePolicyFile: policyFiles.source,
+        sourcePolicySha256: sha256(policies.source),
+        targetPolicySha256: sha256(policies.target),
+        journalId: b.reference.journalId,
+        directory: b.reference.directory,
+        journalContractSha256: b.reference.journalContractSha256,
+        profiles: b.reference.profiles,
+        members,
+        sourceJournal: a.reference,
+        targetJournal: b.reference,
+        delivery: { inputPausePossible: true, retainedBrokerSessionMayReplay: true, exactlyOnceOutput: false },
+        resourceChanges: profiles.map((p) => ({
+            processName: p.processName,
+            beforeSha256: p.mappingSha256,
+            afterSha256: b.reference.profiles.find((q) => q.processName === p.processName).mappingSha256,
+            dataGroup: p.dataGroup,
+        })),
+    };
+    return { review, sourcePolicy: policies.source, targetPolicy: policies.target };
+}
+//# sourceMappingURL=process-group-generation.js.map