@uns-kit/core 3.0.28 → 3.0.30

package/dist/runtime/process-group-generation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-generation.js","sourceRoot":"","sources":["../../src/runtime/process-group-generation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iCAAiC,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACvH,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,8BAA8B,IAAI,IAAI,EACtC,wBAAwB,IAAI,IAAI,EAChC,MAAM,GACP,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAGpH,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,YAAY,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACpB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3F,IACE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAE,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACrF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;QACxD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;QAExD,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC,CAAC;AAClH,CAAC,CAAC,CAAC;AAuBL,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB,CAAC,SAAqC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAC7D,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IACE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;QAC9B,CAAC,IAAI,CAAC,MAAM,EAAE;QACd,IAAI,CAAC,KAAK,KAAK,CAAC;QAChB,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QAC/B,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;QAE7B,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAiC,CAAC;IACvG,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,EAAE;aACC,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,IACE,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,SAAS;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ;YACpC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,CAAC,qBAAqB;YAE5D,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,EAAE,CAAC;QACrG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1F,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,EAC7D,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,IACE,CAAC,OAAO;gBACR,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;gBAC3C,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACvC,OAAO,CAAC,SAAS,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,aAAa;gBAEvG,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,EAAE,CAAC;QACnG,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,IACE,CAAC,KAAK;YACN,CAAC,MAAM;YACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC;YACtC,KAAK,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;YAClC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU;YAC/C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ;YAE3C,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,SAAS;YACT,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC3E,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gCAAgC,CAAC,SAAqC;IACpF,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY;QAC9F,MAAM,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uCAAuC,CAAC,CAAuB;IAC7E,MAAM,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC,EACvD,cAAc,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,qBAAsB,CAAC;QACnD,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,iCAAiC,CAChD,QAAQ,EACR,cAAc,EACd,OAAO,EACP,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CACpH,CAAC;QACF,OAAO;YACL,CAAC;YACD,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;YACrB,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;YACvC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;YACvD,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;YACrC,SAAS,EAAE;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAU;gBAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,QAAQ,CAAC,MAAM;gBAC5B,eAAe,EAAE,CAAU;gBAC3B,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACvC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;aAC7I;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC;QAAE,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,QAAQ,GAAG,2BAA2B,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtF,OAAO;QACL,CAAC;QACD,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,WAAW,GAAG,YAAY;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAU;YAC7B,YAAY,EAAE,KAAK,CAAC,EAAE;YACtB,eAAe,EAAE,CAAU;YAC3B,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;SACzH;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,qCAAqC,CACnD,OAA8B,EAC9B,cAAsB,EACtB,SAAiB,EACjB,oBAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,gBAAgB,EAAE,CAAC,CAAC,GAAG;QACvB,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,cAAc;QACd,SAAS;KACV,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,uCAAuC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EACzE,CAAC,GAAG,uCAAuC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,IACE,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC;QACzB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/B,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;QACb,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAC/B,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,mBAAmB;QAC/C,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC7B,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS;QAC/C,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;QACtB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;QACtB,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS;QAC/C,CAAC,CAAC,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU;QACjD,CAAC,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,YAAY,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY;QAErD,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,EAAyC,EAC3D,QAAQ,GAAG,EAAyC,CAAC;IACvD,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,GAA4B,EAAE,CAAa,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,EAC/B,GAAG,GAAG,EAAE,GAAI,IAAI,CAAC,KAAK,CAA6B,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,iBAAiB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACjH,IAAI,GAAG,KAAgC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAU,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAC3B,CAAC,GAAG,uCAAuC,CAAC,CAAC,CAAC,EAC9C,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpC,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IACE,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC7D,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,SAAS;gBAChD,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,SAAS;gBAChD,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;gBAClG,CAAC,IAAI,KAAK,UAAU;oBAClB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW;oBAC1C,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC;gBAEvF,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClF,IACE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI;gBAC9G,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAE/D,MAAM,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACzF,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI;gBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC/F,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,IAAI;gBACJ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACpD,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAChC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;IACtC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC/C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QAEvH,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACnE,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtC,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1I,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3C,MAAM,MAAM,GAA0B;QACpC,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACxB,OAAO,EAAE,CAAC,CAAC,EAAE;QACb,UAAU,EAAE,WAAW,CAAC,MAAM;QAC9B,gBAAgB,EAAE,WAAW,CAAC,MAAM;QACpC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;QAChC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB;QACxD,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ;QAC9B,OAAO;QACP,aAAa,EAAE,CAAC,CAAC,SAAS;QAC1B,aAAa,EAAE,CAAC,CAAC,SAAS;QAC1B,QAAQ,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE;QACtG,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAE,CAAC,aAAa;YAC7F,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClF,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { configurationGroupJournalContract, configurationGroupJournalSchema } from \"./configuration-group-contract.js\";\nimport { authorizeProcessGroupRuntime } from \"./process-group-authorization.js\";\nimport { processGroupManifestSchema } from \"./process-group-authorization.js\";\nimport {\n  processGroupJournalContract,\n  processGroupJournalSchema,\n  processGroupSourceIdentity,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport { groupPlacementSchema, placementKey } from \"./process-group-control-contract.js\";\nimport {\n  groupArtifactHash,\n  groupChannelsHash,\n  configurationAuthorizationHash as hash,\n  readProcessGroupResource as read,\n  sha256,\n} from \"./process-group-resources.js\";\nimport { normalizeRuntimeProcessGroup, selectedProcessGroupDescriptor } from \"./process-group-runtime-selection.js\";\nimport type { GroupVersionUpgradeReview, PreparedGroupUpgrade, UpgradeConfiguration, UpgradeConfigurations } from \"./process-group-upgrade.js\";\n\nconst pair = z.strictObject({ publisher: groupPlacementSchema, receiver: groupPlacementSchema });\nexport const processGroupGenerationInputSchema = z\n  .strictObject({\n    protocolVersion: z.literal(2),\n    source: pair,\n    target: pair,\n    acknowledgeInputPause: z.literal(true),\n    acknowledgeResourceReview: z.literal(true),\n    acknowledgePossibleReplay: z.literal(true),\n  })\n  .superRefine((v, c) => {\n    const all = [v.source.publisher, v.source.receiver, v.target.publisher, v.target.receiver];\n    if (\n      new Set(all.map(placementKey)).size !== 4 ||\n      all.some((p) => p.controller !== all[0]!.controller || p.rttNode !== all[0]!.rttNode) ||\n      v.source.publisher.version !== v.source.receiver.version ||\n      v.target.publisher.version !== v.target.receiver.version\n    )\n      c.addIssue({ code: \"custom\", message: \"Four distinct paired placements on one package/controller required\" });\n  });\nexport type ProcessGroupGenerationInput = z.infer<typeof processGroupGenerationInputSchema>;\nexport type GenerationJournalReference = {\n  directory: string;\n  journalId: string;\n  journalContractSha256: string;\n  generationId: string;\n  groupSha256?: string;\n  contractVersion: 1 | 2;\n  maxRecords: number;\n  maxBytes: number;\n  minFreeBytes: number;\n  profiles: Array<{ processName: string; mappingSha256: string; dataGroup: string }>;\n};\nexport type GroupGenerationReview = Omit<GroupVersionUpgradeReview, \"protocolVersion\"> & {\n  protocolVersion: 2;\n  sourcePolicyFile: string;\n  sourceJournal: GenerationJournalReference;\n  targetJournal: GenerationJournalReference;\n  delivery: { inputPausePossible: true; retainedBrokerSessionMayReplay: true; exactlyOnceOutput: false };\n  resourceChanges: Array<{ processName: string; beforeSha256: string; afterSha256: string; dataGroup: string }>;\n};\n\n/** Bounded read-only storage evidence; no initializer, rewriting or replay. */\nexport function inspectGenerationJournal(reference: GenerationJournalReference) {\n  const file = path.join(reference.directory, \"admission.sqlite\"),\n    stat = fs.lstatSync(file);\n  if (\n    fs.realpathSync(file) !== file ||\n    !stat.isFile() ||\n    stat.nlink !== 1 ||\n    stat.uid !== process.getuid?.() ||\n    (stat.mode & 0o077) !== 0 ||\n    stat.size > 512 * 1024 * 1024\n  )\n    throw Error(\"Private retained generation journal required\");\n  const { DatabaseSync } = createRequire(import.meta.url)(\"node:sqlite\") as typeof import(\"node:sqlite\");\n  const db = new DatabaseSync(file, { readOnly: true });\n  try {\n    db.exec(\"PRAGMA query_only=ON; PRAGMA busy_timeout=1000; BEGIN\");\n    const meta = Object.fromEntries(\n      db\n        .prepare(\"SELECT key,value FROM metadata WHERE key IN ('id','contract')\")\n        .all()\n        .map((r) => [r[\"key\"], r[\"value\"]]),\n    );\n    if (\n      meta[\"id\"] !== reference.journalId ||\n      typeof meta[\"contract\"] !== \"string\" ||\n      meta[\"contract\"].length > 1048576 ||\n      sha256(meta[\"contract\"]) !== reference.journalContractSha256\n    )\n      throw Error(\"Reviewed journal generation changed\");\n    const rows = db.prepare(\"SELECT name,contract,completed,last_seq FROM profiles ORDER BY name\").all();\n    if (rows.length !== reference.profiles.length) throw Error(\"Journal profile set differs\");\n    for (const profile of reference.profiles) {\n      const row = rows.find((r) => r[\"name\"] === profile.processName),\n        binding = row ? JSON.parse(String(row[\"contract\"])) : null;\n      if (\n        !binding ||\n        binding.processName !== profile.processName ||\n        binding.dataGroup !== profile.dataGroup ||\n        binding[reference.contractVersion === 1 ? \"mappingSha256\" : \"resourceSha256\"] !== profile.mappingSha256\n      )\n        throw Error(\"Journal resource binding differs\");\n    }\n    const usage = db.prepare(\"SELECT records,bytes,admitted FROM usage WHERE id=1\").get();\n    const actual = db.prepare(\"SELECT count(*) records,coalesce(sum(bytes),0) bytes FROM tasks\").get();\n    const numbers = [usage?.[\"records\"], usage?.[\"bytes\"], usage?.[\"admitted\"], ...rows.flatMap((r) => [r[\"completed\"], r[\"last_seq\"]])];\n    const completed = rows.reduce((n, r) => n + Number(r[\"completed\"]), 0);\n    if (\n      !usage ||\n      !actual ||\n      numbers.some((n) => typeof n !== \"number\" || !Number.isSafeInteger(n) || n < 0) ||\n      usage[\"records\"] !== actual[\"records\"] ||\n      usage[\"bytes\"] !== actual[\"bytes\"] ||\n      !Number.isSafeInteger(completed) ||\n      Number(usage[\"admitted\"]) !== completed + Number(usage[\"records\"]) ||\n      rows.some((r) => (r[\"completed\"] === 0) !== (r[\"last_seq\"] === 0)) ||\n      Number(usage[\"records\"]) > reference.maxRecords ||\n      Number(usage[\"bytes\"]) > reference.maxBytes\n    )\n      throw Error(\"Journal usage is unconfirmed\");\n    return {\n      records: Number(usage[\"records\"]),\n      bytes: Number(usage[\"bytes\"]),\n      admitted: Number(usage[\"admitted\"]),\n      completed,\n      lastSequence: rows.reduce((n, r) => Math.max(n, Number(r[\"last_seq\"])), 0),\n    };\n  } finally {\n    try {\n      db.exec(\"ROLLBACK\");\n    } finally {\n      db.close();\n    }\n  }\n}\n\n/** Recheck immediately before the first launch; initialization is never silently reused. */\nexport function inspectPristineGenerationJournal(reference: GenerationJournalReference) {\n  const status = inspectGenerationJournal(reference);\n  if (status.records || status.bytes || status.admitted || status.completed || status.lastSequence)\n    throw Error(\"Target generation is not pristine; inspect the existing initialization outcome\");\n  return status;\n}\n\n/** Data-only normalized revision and immutable journal contract shared by reviewed transitions. */\nexport function describeInstalledProcessGroupGeneration(c: UpgradeConfiguration) {\n  const d = selectedProcessGroupDescriptor(c.packageRoot, c.raw);\n  if (!d) throw Error(\"Declared process group required\");\n  const normalized = normalizeRuntimeProcessGroup(c.raw, d);\n  if (!normalized.matches) throw Error(\"Runtime selector differs\");\n  const channels = resolvedProcessGroupChannels(c.resolved),\n    sourceIdentity = processGroupSourceIdentity(channels[1]!);\n  if (d.protocolVersion === 2) {\n    const snapshot = normalized.configurationSnapshot!;\n    const journal = configurationGroupJournalSchema.parse(normalized.journal);\n    const contract = configurationGroupJournalContract(\n      snapshot,\n      sourceIdentity,\n      journal,\n      snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })),\n    );\n    return {\n      d,\n      normalized,\n      channels,\n      id: snapshot.group.id,\n      processName: snapshot.group.processName,\n      receiverProcessName: snapshot.group.receiverProcessName,\n      inputTopic: snapshot.group.inputTopic,\n      reference: {\n        directory: journal.directory,\n        journalId: journal.journalId!,\n        generationId: journal.generationId,\n        groupSha256: snapshot.sha256,\n        contractVersion: 2 as const,\n        journalContractSha256: sha256(contract),\n        maxRecords: journal.maxRecords,\n        maxBytes: journal.maxBytes,\n        minFreeBytes: journal.minFreeBytes,\n        profiles: snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, mappingSha256: resourceSha256, dataGroup })),\n      },\n    };\n  }\n  const journal = processGroupJournalSchema.parse(normalized.journal);\n  if (!d.manifests.some((m) => m.file === journal.groupManifest)) throw Error(\"Registered file group required\");\n  const group = processGroupManifestSchema.parse(JSON.parse(read(path.resolve(c.packageRoot, journal.groupManifest)).toString()));\n  const contract = processGroupJournalContract(sourceIdentity, journal, group.profiles);\n  return {\n    d,\n    normalized,\n    channels,\n    id: group.id,\n    processName: group.processName,\n    receiverProcessName: group.processName + \"-admission\",\n    inputTopic: group.inputTopic,\n    reference: {\n      directory: journal.directory,\n      journalId: journal.journalId!,\n      generationId: group.id,\n      contractVersion: 1 as const,\n      journalContractSha256: sha256(contract),\n      maxRecords: journal.maxRecords,\n      maxBytes: journal.maxBytes,\n      minFreeBytes: journal.minFreeBytes,\n      profiles: group.profiles.map(({ processName, mappingSha256, dataGroup }) => ({ processName, mappingSha256, dataGroup })),\n    },\n  };\n}\n\n/** Operator reviews opaque before/after digests; business equivalence is application-owned. */\nexport function reviewInstalledProcessGroupGeneration(\n  configs: UpgradeConfigurations,\n  controllerName: string,\n  stateRoot: string,\n  excludedUnsFields: readonly string[] = [],\n): PreparedGroupUpgrade {\n  const context = (c: UpgradeConfiguration) => ({\n    packageRoot: c.packageRoot,\n    instanceDirectory: c.instanceDirectory,\n    rawConfiguration: c.raw,\n    channels: resolvedProcessGroupChannels(c.resolved),\n    controllerName,\n    stateRoot,\n  });\n  const a = describeInstalledProcessGroupGeneration(configs.source.publisher),\n    b = describeInstalledProcessGroupGeneration(configs.target.publisher);\n  if (\n    b.d.protocolVersion !== 2 ||\n    a.d.namespace !== b.d.namespace ||\n    a.id !== b.id ||\n    a.processName !== b.processName ||\n    a.receiverProcessName !== b.receiverProcessName ||\n    a.inputTopic !== b.inputTopic ||\n    a.reference.directory === b.reference.directory ||\n    !a.reference.journalId ||\n    !b.reference.journalId ||\n    a.reference.journalId === b.reference.journalId ||\n    a.reference.maxRecords !== b.reference.maxRecords ||\n    a.reference.maxBytes !== b.reference.maxBytes ||\n    a.reference.minFreeBytes !== b.reference.minFreeBytes\n  )\n    throw Error(\"Distinct bounded generations with the same process/input identity required\");\n  const policyFiles = {} as Record<\"source\" | \"target\", string>,\n    policies = {} as Record<\"source\" | \"target\", Buffer>;\n  const members: GroupVersionUpgradeReview[\"members\"] = [];\n  const portable = (raw: Record<string, unknown>, d: typeof a.d) => {\n    const copy = structuredClone(raw),\n      uns = { ...(copy[\"uns\"] as Record<string, unknown>) };\n    for (const key of excludedUnsFields) delete uns[key];\n    copy[\"uns\"] = uns;\n    for (const keys of [d.publisherPath, d.journalPath, d.runtimeRolePath]) {\n      let node = copy;\n      let present = true;\n      for (const key of keys.slice(0, -1)) {\n        const child = node[key];\n        if (child === undefined) {\n          present = false;\n          break;\n        }\n        if (!child || typeof child !== \"object\" || Array.isArray(child)) throw Error(\"Invalid resource selector parent\");\n        node = child as Record<string, unknown>;\n      }\n      if (present) delete node[keys.at(-1)!];\n    }\n    return hash(copy);\n  };\n  for (const side of [\"source\", \"target\"] as const)\n    for (const role of [\"publisher\", \"receiver\"] as const) {\n      const c = configs[side][role],\n        g = describeInstalledProcessGroupGeneration(c),\n        expected = side === \"source\" ? a : b,\n        proof = authorizeProcessGroupRuntime(context(c));\n      if (\n        proof.role !== (role === \"publisher\" ? \"target\" : \"receiver\") ||\n        proof.directory !== expected.reference.directory ||\n        proof.journalId !== expected.reference.journalId ||\n        hash(g.reference) !== hash(expected.reference) ||\n        g.normalized.uns[\"processName\"] !== (role === \"publisher\" ? g.processName : g.receiverProcessName) ||\n        (role === \"receiver\"\n          ? g.normalized.runtimeRole !== \"admission\"\n          : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== \"publisher\")\n      )\n        throw Error(\"Exact reviewed generation pair required\");\n      const pkg = JSON.parse(read(path.join(c.packageRoot, \"package.json\")).toString());\n      if (\n        pkg.name !== JSON.parse(read(path.join(configs.source.publisher.packageRoot, \"package.json\")).toString()).name ||\n        portable(c.raw, g.d) !== portable(configs.source[role].raw, a.d) ||\n        groupChannelsHash(g.channels) !== groupChannelsHash(a.channels)\n      )\n        throw Error(\"Configuration or broker identity changed outside the reviewed resources\");\n      if (policyFiles[side] && policyFiles[side] !== proof.file) throw Error(\"Pair policies differ\");\n      policyFiles[side] = proof.file;\n      policies[side] = read(proof.file, true);\n      members.push({\n        side,\n        role,\n        processName: String(g.normalized.uns[\"processName\"]),\n        configurationSha256: hash(c.raw),\n        artifactSha256: groupArtifactHash(c.packageRoot),\n      });\n    }\n  if (policyFiles.source === policyFiles.target) throw Error(\"Each generation requires its own retained policy\");\n  const profiles = a.reference.profiles;\n  if (\n    profiles.length !== b.reference.profiles.length ||\n    profiles.some((p) => !b.reference.profiles.some((q) => q.processName === p.processName && q.dataGroup === p.dataGroup))\n  )\n    throw Error(\"Logical profile identities or data groups changed\");\n  inspectGenerationJournal(a.reference);\n  inspectPristineGenerationJournal(b.reference);\n  if (sha256(read(policyFiles.source, true)) !== sha256(policies.source) || sha256(read(policyFiles.target, true)) !== sha256(policies.target))\n    throw Error(\"Reviewed policies changed\");\n  const review: GroupGenerationReview = {\n    protocolVersion: 2,\n    namespace: b.d.namespace,\n    groupId: b.id,\n    policyFile: policyFiles.target,\n    sourcePolicyFile: policyFiles.source,\n    sourcePolicySha256: sha256(policies.source),\n    targetPolicySha256: sha256(policies.target),\n    journalId: b.reference.journalId,\n    directory: b.reference.directory,\n    journalContractSha256: b.reference.journalContractSha256,\n    profiles: b.reference.profiles,\n    members,\n    sourceJournal: a.reference,\n    targetJournal: b.reference,\n    delivery: { inputPausePossible: true, retainedBrokerSessionMayReplay: true, exactlyOnceOutput: false },\n    resourceChanges: profiles.map((p) => ({\n      processName: p.processName,\n      beforeSha256: p.mappingSha256,\n      afterSha256: b.reference.profiles.find((q) => q.processName === p.processName)!.mappingSha256,\n      dataGroup: p.dataGroup,\n    })),\n  };\n  return { review, sourcePolicy: policies.source, targetPolicy: policies.target };\n}\n"]}

package/dist/runtime/process-group-inspection.d.ts

@@ -1,4 +1,6 @@
 export interface ProcessGroupConfigurationEvidence {
+    configurationGroupSha256?: string;
+    generationId?: string;
     processName: string;
     configurationChecksum: string;
     projectionChecksum: string;

package/dist/runtime/process-group-inspection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-inspection.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACrJ;AA6BD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,cAAc,QAA2C,EACzD,OAAO,EAAE;IAAE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnG,iCAAiC,CA+InC"}
+{"version":3,"file":"process-group-inspection.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,iCAAiC;IAChD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACrJ;AA6BD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,cAAc,QAA2C,EACzD,OAAO,EAAE;IAAE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnG,iCAAiC,CA8GnC"}

package/dist/runtime/process-group-inspection.js

@@ -3,7 +3,9 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { z } from "zod";
+import { configurationGroupJournalContract, configurationGroupJournalSchema, configurationResourceHash, selectedConfigurationGroup, } from "./configuration-group-contract.js";
 import { assertProcessGroupStateMount, authorizeConfiguredProcessGroupRuntime, configurationAuthorizationHash, hasProcessGroupAuthorization, processGroupManifestSchema as manifest, } from "./process-group-authorization.js";
+import { readConfigurationSelector } from "./process-group-contract.js";
 import { isLocalPilotPath, isProcessGroupJournalPath, normalizeProcessGroupConfiguration, processGroupDescriptor, processGroupJournalContract, processGroupJournalSchema, processGroupSourceIdentity, projectProcessGroupConfiguration, resolvedProcessGroupInputChannel, } from "./process-group-contract.js";
 /** Bound reads to installed package/instance resources, never arbitrary paths or symlinks. */
 function resource(pkg, dir, file, relativeTo) {
@@ -40,6 +42,9 @@ function resource(pkg, dir, file, relativeTo) {
 const sha = (b) => createHash("sha256").update(b).digest("hex");
 export function inspectProcessGroupConfiguration(pkg, dir, raw, controllerName = process.env["UNS_CONTROLLER_NAME"] ?? "", options) {
     const original = JSON.parse(raw);
+    const configured = selectedConfigurationGroup(pkg, original);
+    if (configured)
+        return inspectConfigurationGroup(pkg, dir, raw, original, configured, controllerName, options);
     const descriptor = processGroupDescriptor(pkg);
     if (!descriptor)
         throw Error("Installed package has no supported process-group contract");
@@ -83,46 +88,7 @@ export function inspectProcessGroupConfiguration(pkg, dir, raw, controllerName =
         if (path.isAbsolute(admission.groupManifest) || admission.groupManifest.includes(".."))
             throw Error("Admission manifest must be package-relative");
         const admitted = manifest.parse(JSON.parse(resource(pkg, dir, admission.groupManifest).toString()));
-        for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))
-            if (fs.lstatSync(parent).isSymbolicLink())
-                throw Error("Admission directory cannot use symbolic links");
-        const databaseFile = path.join(admission.directory, "admission.sqlite");
-        if (fs.lstatSync(databaseFile).isSymbolicLink())
-            throw Error("Admission journal cannot use symbolic links");
-        const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
-        const journal = new DatabaseSync(databaseFile, { readOnly: true });
-        try {
-            journal.exec("PRAGMA busy_timeout=1000");
-            if (persistent && journal.prepare("SELECT value FROM metadata WHERE key='id'").get()?.["value"] !== admission.journalId)
-                throw Error("Persistent admission journalId binding differs");
-            const input = resolvedProcessGroupInputChannel(original);
-            const sourceIdentity = processGroupSourceIdentity(input);
-            const expected = processGroupJournalContract(sourceIdentity, admission, admitted.profiles);
-            const contract = journal.prepare("SELECT value FROM metadata WHERE key='contract'").get()?.["value"];
-            if (contract !== expected)
-                throw Error("Durable admission journal contract differs");
-            const capture = JSON.parse(String(journal.prepare("SELECT value FROM metadata WHERE key='capture'").get()?.["value"] ?? "null"));
-            if (!capture ||
-                !["ready", "capacity-blocked"].includes(capture.state) ||
-                !Number.isSafeInteger(capture.pid) ||
-                capture.pid <= 0 ||
-                !Number.isSafeInteger(capture.heartbeat) ||
-                Date.now() - capture.heartbeat > 5000 ||
-                capture.heartbeat > Date.now() + 1000)
-                throw Error("Durable admission receiver is not ready");
-            process.kill(capture.pid, 0);
-            if (persistent) {
-                const namespace = sha(Buffer.from(fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fs.readlinkSync("/proc/self/ns/pid")));
-                const stored = journal.prepare("SELECT value FROM metadata WHERE key='runtime_namespace'").get()?.["value"];
-                const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, "utf8");
-                const start = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
-                if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + ":" + capture.pid + ":" + start)))
-                    throw Error("Admission capture namespace or process identity differs");
-            }
-        }
-        finally {
-            journal.close();
-        }
+        inspectJournal(admission, persistent, processGroupJournalContract(processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)), admission, admitted.profiles));
         if (publisher.groupManifest && publisher.groupManifest !== admission.groupManifest)
             throw Error("Admission and publisher manifests differ");
         if (!publisher.groupManifest) {
@@ -182,4 +148,118 @@ export function inspectProcessGroupConfiguration(pkg, dir, raw, controllerName =
         contract: null,
     };
 }
+/** Shared read-only receiver/journal evidence for both resource protocols. */
+function inspectJournal(admission, persistent, expected) {
+    for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))
+        if (fs.lstatSync(parent).isSymbolicLink())
+            throw Error("Admission directory cannot use symbolic links");
+    const databaseFile = path.join(admission.directory, "admission.sqlite");
+    if (fs.lstatSync(databaseFile).isSymbolicLink())
+        throw Error("Admission journal cannot use symbolic links");
+    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    const journal = new DatabaseSync(databaseFile, { readOnly: true });
+    try {
+        journal.exec("PRAGMA busy_timeout=1000");
+        if (persistent && journal.prepare("SELECT value FROM metadata WHERE key='id'").get()?.["value"] !== admission.journalId)
+            throw Error("Persistent admission journalId binding differs");
+        const contract = journal.prepare("SELECT value FROM metadata WHERE key='contract'").get()?.["value"];
+        if (contract !== expected)
+            throw Error("Durable admission journal contract differs");
+        const capture = JSON.parse(String(journal.prepare("SELECT value FROM metadata WHERE key='capture'").get()?.["value"] ?? "null"));
+        if (!capture ||
+            !["ready", "capacity-blocked"].includes(capture.state) ||
+            !Number.isSafeInteger(capture.pid) ||
+            capture.pid <= 0 ||
+            !Number.isSafeInteger(capture.heartbeat) ||
+            Date.now() - capture.heartbeat > 5000 ||
+            capture.heartbeat > Date.now() + 1000)
+            throw Error("Durable admission receiver is not ready");
+        process.kill(capture.pid, 0);
+        if (persistent) {
+            const namespace = sha(Buffer.from(fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fs.readlinkSync("/proc/self/ns/pid")));
+            const stored = journal.prepare("SELECT value FROM metadata WHERE key='runtime_namespace'").get()?.["value"];
+            const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, "utf8");
+            const start = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+            if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + ":" + capture.pid + ":" + start)))
+                throw Error("Admission capture namespace or process identity differs");
+        }
+    }
+    finally {
+        journal.close();
+    }
+}
+function inspectConfigurationGroup(pkg, dir, raw, original, selected, controllerName, options) {
+    const { descriptor: d, snapshot } = selected;
+    const uns = { ...original["uns"] };
+    const memberId = readConfigurationSelector(original, d.memberPath), role = readConfigurationSelector(original, d.runtimeRolePath);
+    const member = memberId === undefined ? undefined : snapshot.profiles.find((p) => p.id === memberId);
+    if ((memberId !== undefined && !member) ||
+        uns["processName"] !== (member?.processName ?? snapshot.group.processName) ||
+        (role !== undefined && role !== "publisher"))
+        throw Error("Configured publisher role or identity differs");
+    const journal = configurationGroupJournalSchema
+        .extend({
+        minFreeBytes: configurationGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),
+        maxRecords: configurationGroupJournalSchema.shape.maxRecords.unwrap(),
+        maxBytes: configurationGroupJournalSchema.shape.maxBytes.unwrap(),
+    })
+        .parse(readConfigurationSelector(original, d.journalPath));
+    const production = !isLocalPilotPath(pkg) || hasProcessGroupAuthorization() ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName) : undefined;
+    const persistent = !isLocalPilotPath(journal.directory);
+    if (production)
+        assertProcessGroupStateMount(production, process.env["UNS_PROCESS_GROUP_STATE_ROOT"] ?? "");
+    if (path.resolve(journal.directory) !== journal.directory || (production && !persistent))
+        throw Error("Configured journal storage differs");
+    if (persistent && (!production || !journal.journalId))
+        throw Error("Persistent configured journal requires exact reviewed authority and UUID");
+    const metadata = JSON.parse(resource(pkg, dir, "package.json").toString()).unsDatahub;
+    if (metadata?.processGroupAdmission !== 1 || (persistent && metadata?.processGroupPersistentAdmission !== 1))
+        throw Error("Required journal capabilities missing");
+    const expected = configurationGroupJournalContract(snapshot, processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)), configurationGroupJournalSchema.parse(journal), snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })));
+    inspectJournal(journal, persistent, expected);
+    const checksum = options.configurationChecksum(raw);
+    if (!checksum)
+        throw Error("Invalid configured group configuration");
+    for (const key of [...options.excludedUnsFields, "processName", "instanceMode", "handover", "handoverProtocol"])
+        delete uns[key];
+    const projection = structuredClone(original);
+    projection["uns"] = uns;
+    const remove = (keys) => {
+        let node = projection;
+        for (const key of keys.slice(0, -1)) {
+            const child = node[key];
+            if (child === undefined)
+                return;
+            if (!child || typeof child !== "object" || Array.isArray(child))
+                throw Error("Invalid selector projection");
+            node = child;
+        }
+        delete node[keys.at(-1)];
+    };
+    remove(d.memberPath);
+    remove(d.runtimeRolePath);
+    if (production)
+        projection["authorizationSha256"] = production.sha256;
+    return {
+        processName: String(original["uns"]["processName"]),
+        configurationChecksum: checksum,
+        projectionChecksum: configurationResourceHash(projection),
+        configurationGroupSha256: snapshot.sha256,
+        generationId: journal.generationId,
+        mappingSha256: member?.resourceSha256 ?? null,
+        dataGroup: member?.dataGroup ?? null,
+        contract: member
+            ? null
+            : {
+                digest: snapshot.sha256,
+                processName: snapshot.group.processName,
+                profiles: snapshot.profiles.map(({ id, processName, resourceSha256, dataGroup }) => ({
+                    id,
+                    processName,
+                    mappingSha256: resourceSha256,
+                    dataGroup,
+                })),
+            },
+    };
+}
 //# sourceMappingURL=process-group-inspection.js.map

package/dist/runtime/process-group-inspection.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-inspection.js","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,IAAI,QAAQ,GACvC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AAUrC,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW,EAAE,IAAY,EAAE,UAAmB;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC,IAAI,CAAC;YACR,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,MAAM,UAAU,gCAAgC,CAC9C,GAAW,EACX,GAAW,EACX,GAAW,EACX,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,EACzD,OAAoG;IAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,kCAAkC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAChE,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAClB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,UAAU,GACd,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,4BAA4B,EAAE,CAAC;QACrE,CAAC,CAAC,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnI,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,SAAS,GAAG,yBAAyB;aACxC,MAAM,CAAC;YACN,YAAY,EAAE,yBAAyB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9E,UAAU,EAAE,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;YAC/D,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;SAC5D,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,SAAS;YACtG,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACvH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACtG,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,SAAS;gBACV,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;gBACrC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAEhF,MAAM,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,+BAA+B,KAAK,CAAC;gBAC7G,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC;QAC/G,IAAI,UAAU,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpG,KAAK,IAAI,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACnG,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC1G,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACxE,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5G,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAiC,CAAC;QACvG,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,IAAI,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,SAAS;gBACrH,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;YACzD,MAAM,cAAc,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YACrG,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;YACjI,IACE,CAAC,OAAO;gBACR,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;gBACtD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;gBAClC,OAAO,CAAC,GAAG,IAAI,CAAC;gBAChB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI;gBACrC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBAErC,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,GAAG,CACnB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAC5H,CAAC;gBACF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5G,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC;oBAC7H,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5I,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;YAChF,IACE,CAAC,MAAM;gBACP,MAAM,CAAC,aAAa,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/E,MAAM,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;gBAEzE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7H,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,gCAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3I,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7H,yFAAyF;QACzF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/I,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,EAC1E,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnD,IACE,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;YAErD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa;gBACtH,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpD,OAAO;YACL,WAAW;YACX,qBAAqB,EAAE,QAAQ;YAC/B,kBAAkB;YAClB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACR,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAClB,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzD,OAAO;QACL,WAAW;QACX,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB;QAClB,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;QAC5D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport {\n  assertProcessGroupStateMount,\n  authorizeConfiguredProcessGroupRuntime,\n  configurationAuthorizationHash,\n  hasProcessGroupAuthorization,\n  processGroupManifestSchema as manifest,\n} from \"./process-group-authorization.js\";\nimport {\n  isLocalPilotPath,\n  isProcessGroupJournalPath,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  processGroupJournalContract,\n  processGroupJournalSchema,\n  processGroupSourceIdentity,\n  projectProcessGroupConfiguration,\n  resolvedProcessGroupInputChannel,\n} from \"./process-group-contract.js\";\n\nexport interface ProcessGroupConfigurationEvidence {\n  processName: string;\n  configurationChecksum: string;\n  projectionChecksum: string;\n  mappingSha256: string | null;\n  dataGroup: string | null;\n  contract: { digest: string; processName: string; profiles: { id: string; processName: string; mappingSha256: string; dataGroup: string }[] } | null;\n}\n/** Bound reads to installed package/instance resources, never arbitrary paths or symlinks. */\nfunction resource(pkg: string, dir: string, file: string, relativeTo?: string): Buffer {\n  if (file.length > 512) throw Error(\"Group resource path too long\");\n  const roots = [fs.realpathSync(pkg), fs.realpathSync(dir)];\n  const candidates = relativeTo\n    ? [path.resolve(relativeTo, file)]\n    : path.isAbsolute(file)\n      ? [file]\n      : [path.resolve(dir, file), path.resolve(pkg, file)];\n  for (const candidate of candidates) {\n    if (!fs.existsSync(candidate)) continue;\n    const real = fs.realpathSync(candidate);\n    if (real !== candidate || !roots.some((root) => real.startsWith(root + path.sep)))\n      throw Error(\"Group resource must stay inside installed package or instance\");\n    const fd = fs.openSync(real, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n    try {\n      const s = fs.fstatSync(fd);\n      if (!s.isFile() || s.size > 1048576) throw Error(\"Invalid group resource\");\n      const b = fs.readFileSync(fd);\n      if (b.length > 1048576) throw Error(\"Group resource too large\");\n      return b;\n    } finally {\n      fs.closeSync(fd);\n    }\n  }\n  throw Error(\"Installed group resource is missing\");\n}\nconst sha = (b: Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nexport function inspectProcessGroupConfiguration(\n  pkg: string,\n  dir: string,\n  raw: string,\n  controllerName = process.env[\"UNS_CONTROLLER_NAME\"] ?? \"\",\n  options: { configurationChecksum(raw: string): string | null; excludedUnsFields: readonly string[] },\n): ProcessGroupConfigurationEvidence {\n  const original = JSON.parse(raw);\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Installed package has no supported process-group contract\");\n  const c = normalizeProcessGroupConfiguration(original, descriptor),\n    uns = { ...c.uns },\n    publisher = c.publisher;\n  const production =\n    c.journal && (!isLocalPilotPath(pkg) || hasProcessGroupAuthorization())\n      ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName)\n      : undefined;\n  if (production) assertProcessGroupStateMount(production, process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"] ?? \"\");\n  if (!c.matches || (c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") || !publisher || typeof uns.processName !== \"string\")\n    throw Error(\"This runtime has no supported reviewed group configuration\");\n  if (c.journal !== undefined) {\n    // Readiness requires explicit capacities; their limits come from the shared writer schema.\n    const admission = processGroupJournalSchema\n      .extend({\n        minFreeBytes: processGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),\n        maxRecords: processGroupJournalSchema.shape.maxRecords.unwrap(),\n        maxBytes: processGroupJournalSchema.shape.maxBytes.unwrap(),\n      })\n      .parse(c.journal);\n    if ((!isLocalPilotPath(pkg) && !production) || path.resolve(admission.directory) !== admission.directory)\n      throw Error(\"Durable process-group admission is a same-host local pilot\");\n    const persistent = !isLocalPilotPath(admission.directory);\n    if (production && !persistent) throw Error(\"Authorized process-group journal requires a permanent mounted state root\");\n    if (persistent) {\n      const stateRoot = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n      if (!admission.journalId) throw Error(\"Persistent admission needs its initialized journalId binding\");\n      if (\n        process.platform !== \"linux\" ||\n        !stateRoot ||\n        path.resolve(stateRoot) !== stateRoot ||\n        !isProcessGroupJournalPath(stateRoot, admission.directory, descriptor.namespace)\n      )\n        throw Error(\"Persistent admission needs the reviewed Linux node-local state root\");\n      if (JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupPersistentAdmission !== 1)\n        throw Error(\"Publisher does not support persistent admission ownership\");\n    }\n    const capability = JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupAdmission;\n    if (capability !== 1) throw Error(\"Publisher does not support durable process-group admission\");\n    if (path.isAbsolute(admission.groupManifest) || admission.groupManifest.includes(\"..\"))\n      throw Error(\"Admission manifest must be package-relative\");\n    const admitted = manifest.parse(JSON.parse(resource(pkg, dir, admission.groupManifest).toString()));\n    for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))\n      if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Admission directory cannot use symbolic links\");\n    const databaseFile = path.join(admission.directory, \"admission.sqlite\");\n    if (fs.lstatSync(databaseFile).isSymbolicLink()) throw Error(\"Admission journal cannot use symbolic links\");\n    const { DatabaseSync } = createRequire(import.meta.url)(\"node:sqlite\") as typeof import(\"node:sqlite\");\n    const journal = new DatabaseSync(databaseFile, { readOnly: true });\n    try {\n      journal.exec(\"PRAGMA busy_timeout=1000\");\n      if (persistent && journal.prepare(\"SELECT value FROM metadata WHERE key='id'\").get()?.[\"value\"] !== admission.journalId)\n        throw Error(\"Persistent admission journalId binding differs\");\n      const input = resolvedProcessGroupInputChannel(original);\n      const sourceIdentity = processGroupSourceIdentity(input);\n      const expected = processGroupJournalContract(sourceIdentity, admission, admitted.profiles);\n      const contract = journal.prepare(\"SELECT value FROM metadata WHERE key='contract'\").get()?.[\"value\"];\n      if (contract !== expected) throw Error(\"Durable admission journal contract differs\");\n      const capture = JSON.parse(String(journal.prepare(\"SELECT value FROM metadata WHERE key='capture'\").get()?.[\"value\"] ?? \"null\"));\n      if (\n        !capture ||\n        ![\"ready\", \"capacity-blocked\"].includes(capture.state) ||\n        !Number.isSafeInteger(capture.pid) ||\n        capture.pid <= 0 ||\n        !Number.isSafeInteger(capture.heartbeat) ||\n        Date.now() - capture.heartbeat > 5000 ||\n        capture.heartbeat > Date.now() + 1000\n      )\n        throw Error(\"Durable admission receiver is not ready\");\n      process.kill(capture.pid, 0);\n      if (persistent) {\n        const namespace = sha(\n          Buffer.from(fs.readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim() + \":\" + fs.readlinkSync(\"/proc/self/ns/pid\")),\n        );\n        const stored = journal.prepare(\"SELECT value FROM metadata WHERE key='runtime_namespace'\").get()?.[\"value\"];\n        const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, \"utf8\");\n        const start = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \")[19];\n        if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + \":\" + capture.pid + \":\" + start)))\n          throw Error(\"Admission capture namespace or process identity differs\");\n      }\n    } finally {\n      journal.close();\n    }\n    if (publisher.groupManifest && publisher.groupManifest !== admission.groupManifest) throw Error(\"Admission and publisher manifests differ\");\n    if (!publisher.groupManifest) {\n      const member = admitted.profiles.find((p) => p.processName === uns.processName);\n      if (\n        !member ||\n        member.mappingSha256 !== sha(resource(pkg, dir, String(publisher.mappingFile))) ||\n        member.dataGroup !== (publisher.dataGroup ?? descriptor.defaultDataGroup)\n      )\n        throw Error(\"Original publisher differs from admission contract\");\n    }\n  }\n  const checksum = options.configurationChecksum(raw);\n  if (!checksum) throw Error(\"Invalid group configuration\");\n  const processName = uns.processName;\n  for (const k of [...options.excludedUnsFields, \"processName\", \"instanceMode\", \"handover\", \"handoverProtocol\"]) delete uns[k];\n  const projectionChecksum = configurationAuthorizationHash(projectProcessGroupConfiguration(original, descriptor, uns, production?.sha256));\n  if (typeof publisher.groupManifest === \"string\") {\n    if (Object.keys(publisher).some((k) => k !== \"groupManifest\")) throw Error(\"Group selector cannot override member settings\");\n    // Installed manifests are package-relative; members resolve relative to that exact file.\n    if (path.isAbsolute(publisher.groupManifest) || publisher.groupManifest.includes(\"..\")) throw Error(\"Group manifest must be package-relative\");\n    const bytes = resource(pkg, dir, path.resolve(pkg, publisher.groupManifest)),\n      m = manifest.parse(JSON.parse(bytes.toString()));\n    if (\n      m.processName !== processName ||\n      new Set(m.profiles.map((p) => p.processName)).size !== m.profiles.length ||\n      m.profiles.some((p) => p.processName === processName)\n    )\n      throw Error(\"Manifest process identities overlap\");\n    for (const p of m.profiles)\n      if (sha(resource(pkg, dir, p.mappingFile, path.dirname(path.resolve(pkg, publisher.groupManifest)))) !== p.mappingSha256)\n        throw Error(\"Manifest member checksum changed\");\n    return {\n      processName,\n      configurationChecksum: checksum,\n      projectionChecksum,\n      mappingSha256: null,\n      dataGroup: null,\n      contract: {\n        digest: sha(bytes),\n        processName,\n        profiles: m.profiles.map(({ mappingFile: _, ...p }) => p),\n      },\n    };\n  }\n  if (typeof publisher.mappingFile !== \"string\" || Object.keys(publisher).some((k) => ![\"mappingFile\", \"dataGroup\"].includes(k)))\n    throw Error(\"Explicit original mapping file required\");\n  return {\n    processName,\n    configurationChecksum: checksum,\n    projectionChecksum,\n    mappingSha256: sha(resource(pkg, dir, String(publisher.mappingFile))),\n    dataGroup: z\n      .string()\n      .min(1)\n      .max(100)\n      .parse(publisher.dataGroup ?? descriptor.defaultDataGroup),\n    contract: null,\n  };\n}\n"]}
+{"version":3,"file":"process-group-inspection.js","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,sCAAsC,EACtC,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,IAAI,QAAQ,GACvC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,kCAAkC,EAClC,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,6BAA6B,CAAC;AAYrC,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW,EAAE,IAAY,EAAE,UAAmB;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC,IAAI,CAAC;YACR,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC;QACX,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACrD,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,MAAM,UAAU,gCAAgC,CAC9C,GAAW,EACX,GAAW,EACX,GAAW,EACX,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,EACzD,OAAoG;IAEpG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,UAAU;QAAE,OAAO,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAC/G,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,kCAAkC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAChE,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,EAClB,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,UAAU,GACd,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,4BAA4B,EAAE,CAAC;QACrE,CAAC,CAAC,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,UAAU;QAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnI,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,2FAA2F;QAC3F,MAAM,SAAS,GAAG,yBAAyB;aACxC,MAAM,CAAC;YACN,YAAY,EAAE,yBAAyB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9E,UAAU,EAAE,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;YAC/D,QAAQ,EAAE,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;SAC5D,CAAC;aACD,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,SAAS;YACtG,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,UAAU,IAAI,CAAC,UAAU;YAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACvH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACtG,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,SAAS;gBACV,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS;gBACrC,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAEhF,MAAM,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,+BAA+B,KAAK,CAAC;gBAC7G,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,qBAAqB,CAAC;QAC/G,IAAI,UAAU,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpF,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpG,cAAc,CACZ,SAAS,EACT,UAAU,EACV,2BAA2B,CAAC,0BAA0B,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAClI,CAAC;QACF,IAAI,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5I,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC;YAChF,IACE,CAAC,MAAM;gBACP,MAAM,CAAC,aAAa,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/E,MAAM,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;gBAEzE,MAAM,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7H,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,gCAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3I,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC7H,yFAAyF;QACzF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC/I,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,EAC1E,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnD,IACE,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC;YAErD,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa;gBACtH,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpD,OAAO;YACL,WAAW;YACX,qBAAqB,EAAE,QAAQ;YAC/B,kBAAkB;YAClB,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACR,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAClB,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzD,OAAO;QACL,WAAW;QACX,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB;QAClB,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,UAAU,CAAC,gBAAgB,CAAC;QAC5D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,SAAgE,EAAE,UAAmB,EAAE,QAAgB;IAC7H,KAAK,IAAI,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACnG,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC1G,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACxE,IAAI,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE;QAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5G,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAiC,CAAC;IACvG,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,IAAI,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,SAAS;YACrH,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QACrG,IAAI,QAAQ,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;QACjI,IACE,CAAC,OAAO;YACR,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YACtD,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YAClC,OAAO,CAAC,GAAG,IAAI,CAAC;YAChB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;YACxC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI;YACrC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAErC,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,GAAG,CACnB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,CAC5H,CAAC;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5G,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC;gBAC7H,MAAM,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAW,EACX,GAAW,EACX,GAAW,EACX,QAAiC,EACjC,QAAoE,EACpE,cAAsB,EACtB,OAAoG;IAEpG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC7C,MAAM,GAAG,GAAG,EAAE,GAAI,QAAQ,CAAC,KAAK,CAA6B,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAChE,IAAI,GAAG,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACrG,IACE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC;QACnC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAC1E,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC;QAE5C,MAAM,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,+BAA+B;SAC5C,MAAM,CAAC;QACN,YAAY,EAAE,+BAA+B,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACpF,UAAU,EAAE,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE;QACrE,QAAQ,EAAE,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE;KAClE,CAAC;SACD,KAAK,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GACd,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,4BAA4B,EAAE,CAAC,CAAC,CAAC,sCAAsC,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpJ,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,UAAU;QAAE,4BAA4B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5I,IAAI,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;IACtF,IAAI,QAAQ,EAAE,qBAAqB,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,+BAA+B,KAAK,CAAC,CAAC;QAC1G,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,iCAAiC,CAChD,QAAQ,EACR,0BAA0B,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC,EACtE,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9C,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CACpH,CAAC;IACF,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,kBAAkB,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACjI,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,IAAuB,EAAE,EAAE;QACzC,IAAI,IAAI,GAAG,UAAU,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC5G,IAAI,GAAG,KAAgC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACrB,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC1B,IAAI,UAAU;QAAE,UAAU,CAAC,qBAAqB,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC;IACtE,OAAO;QACL,WAAW,EAAE,MAAM,CAAE,QAAQ,CAAC,KAAK,CAA6B,CAAC,aAAa,CAAC,CAAC;QAChF,qBAAqB,EAAE,QAAQ;QAC/B,kBAAkB,EAAE,yBAAyB,CAAC,UAAU,CAAC;QACzD,wBAAwB,EAAE,QAAQ,CAAC,MAAM;QACzC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,MAAM,EAAE,cAAc,IAAI,IAAI;QAC7C,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;QACpC,QAAQ,EAAE,MAAM;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;gBACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnF,EAAE;oBACF,WAAW;oBACX,aAAa,EAAE,cAAc;oBAC7B,SAAS;iBACV,CAAC,CAAC;aACJ;KACN,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport {\n  configurationGroupJournalContract,\n  configurationGroupJournalSchema,\n  configurationResourceHash,\n  selectedConfigurationGroup,\n} from \"./configuration-group-contract.js\";\nimport {\n  assertProcessGroupStateMount,\n  authorizeConfiguredProcessGroupRuntime,\n  configurationAuthorizationHash,\n  hasProcessGroupAuthorization,\n  processGroupManifestSchema as manifest,\n} from \"./process-group-authorization.js\";\nimport { readConfigurationSelector } from \"./process-group-contract.js\";\nimport {\n  isLocalPilotPath,\n  isProcessGroupJournalPath,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  processGroupJournalContract,\n  processGroupJournalSchema,\n  processGroupSourceIdentity,\n  projectProcessGroupConfiguration,\n  resolvedProcessGroupInputChannel,\n} from \"./process-group-contract.js\";\n\nexport interface ProcessGroupConfigurationEvidence {\n  configurationGroupSha256?: string;\n  generationId?: string;\n  processName: string;\n  configurationChecksum: string;\n  projectionChecksum: string;\n  mappingSha256: string | null;\n  dataGroup: string | null;\n  contract: { digest: string; processName: string; profiles: { id: string; processName: string; mappingSha256: string; dataGroup: string }[] } | null;\n}\n/** Bound reads to installed package/instance resources, never arbitrary paths or symlinks. */\nfunction resource(pkg: string, dir: string, file: string, relativeTo?: string): Buffer {\n  if (file.length > 512) throw Error(\"Group resource path too long\");\n  const roots = [fs.realpathSync(pkg), fs.realpathSync(dir)];\n  const candidates = relativeTo\n    ? [path.resolve(relativeTo, file)]\n    : path.isAbsolute(file)\n      ? [file]\n      : [path.resolve(dir, file), path.resolve(pkg, file)];\n  for (const candidate of candidates) {\n    if (!fs.existsSync(candidate)) continue;\n    const real = fs.realpathSync(candidate);\n    if (real !== candidate || !roots.some((root) => real.startsWith(root + path.sep)))\n      throw Error(\"Group resource must stay inside installed package or instance\");\n    const fd = fs.openSync(real, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n    try {\n      const s = fs.fstatSync(fd);\n      if (!s.isFile() || s.size > 1048576) throw Error(\"Invalid group resource\");\n      const b = fs.readFileSync(fd);\n      if (b.length > 1048576) throw Error(\"Group resource too large\");\n      return b;\n    } finally {\n      fs.closeSync(fd);\n    }\n  }\n  throw Error(\"Installed group resource is missing\");\n}\nconst sha = (b: Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nexport function inspectProcessGroupConfiguration(\n  pkg: string,\n  dir: string,\n  raw: string,\n  controllerName = process.env[\"UNS_CONTROLLER_NAME\"] ?? \"\",\n  options: { configurationChecksum(raw: string): string | null; excludedUnsFields: readonly string[] },\n): ProcessGroupConfigurationEvidence {\n  const original = JSON.parse(raw);\n  const configured = selectedConfigurationGroup(pkg, original);\n  if (configured) return inspectConfigurationGroup(pkg, dir, raw, original, configured, controllerName, options);\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Installed package has no supported process-group contract\");\n  const c = normalizeProcessGroupConfiguration(original, descriptor),\n    uns = { ...c.uns },\n    publisher = c.publisher;\n  const production =\n    c.journal && (!isLocalPilotPath(pkg) || hasProcessGroupAuthorization())\n      ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName)\n      : undefined;\n  if (production) assertProcessGroupStateMount(production, process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"] ?? \"\");\n  if (!c.matches || (c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") || !publisher || typeof uns.processName !== \"string\")\n    throw Error(\"This runtime has no supported reviewed group configuration\");\n  if (c.journal !== undefined) {\n    // Readiness requires explicit capacities; their limits come from the shared writer schema.\n    const admission = processGroupJournalSchema\n      .extend({\n        minFreeBytes: processGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),\n        maxRecords: processGroupJournalSchema.shape.maxRecords.unwrap(),\n        maxBytes: processGroupJournalSchema.shape.maxBytes.unwrap(),\n      })\n      .parse(c.journal);\n    if ((!isLocalPilotPath(pkg) && !production) || path.resolve(admission.directory) !== admission.directory)\n      throw Error(\"Durable process-group admission is a same-host local pilot\");\n    const persistent = !isLocalPilotPath(admission.directory);\n    if (production && !persistent) throw Error(\"Authorized process-group journal requires a permanent mounted state root\");\n    if (persistent) {\n      const stateRoot = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n      if (!admission.journalId) throw Error(\"Persistent admission needs its initialized journalId binding\");\n      if (\n        process.platform !== \"linux\" ||\n        !stateRoot ||\n        path.resolve(stateRoot) !== stateRoot ||\n        !isProcessGroupJournalPath(stateRoot, admission.directory, descriptor.namespace)\n      )\n        throw Error(\"Persistent admission needs the reviewed Linux node-local state root\");\n      if (JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupPersistentAdmission !== 1)\n        throw Error(\"Publisher does not support persistent admission ownership\");\n    }\n    const capability = JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub?.processGroupAdmission;\n    if (capability !== 1) throw Error(\"Publisher does not support durable process-group admission\");\n    if (path.isAbsolute(admission.groupManifest) || admission.groupManifest.includes(\"..\"))\n      throw Error(\"Admission manifest must be package-relative\");\n    const admitted = manifest.parse(JSON.parse(resource(pkg, dir, admission.groupManifest).toString()));\n    inspectJournal(\n      admission,\n      persistent,\n      processGroupJournalContract(processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)), admission, admitted.profiles),\n    );\n    if (publisher.groupManifest && publisher.groupManifest !== admission.groupManifest) throw Error(\"Admission and publisher manifests differ\");\n    if (!publisher.groupManifest) {\n      const member = admitted.profiles.find((p) => p.processName === uns.processName);\n      if (\n        !member ||\n        member.mappingSha256 !== sha(resource(pkg, dir, String(publisher.mappingFile))) ||\n        member.dataGroup !== (publisher.dataGroup ?? descriptor.defaultDataGroup)\n      )\n        throw Error(\"Original publisher differs from admission contract\");\n    }\n  }\n  const checksum = options.configurationChecksum(raw);\n  if (!checksum) throw Error(\"Invalid group configuration\");\n  const processName = uns.processName;\n  for (const k of [...options.excludedUnsFields, \"processName\", \"instanceMode\", \"handover\", \"handoverProtocol\"]) delete uns[k];\n  const projectionChecksum = configurationAuthorizationHash(projectProcessGroupConfiguration(original, descriptor, uns, production?.sha256));\n  if (typeof publisher.groupManifest === \"string\") {\n    if (Object.keys(publisher).some((k) => k !== \"groupManifest\")) throw Error(\"Group selector cannot override member settings\");\n    // Installed manifests are package-relative; members resolve relative to that exact file.\n    if (path.isAbsolute(publisher.groupManifest) || publisher.groupManifest.includes(\"..\")) throw Error(\"Group manifest must be package-relative\");\n    const bytes = resource(pkg, dir, path.resolve(pkg, publisher.groupManifest)),\n      m = manifest.parse(JSON.parse(bytes.toString()));\n    if (\n      m.processName !== processName ||\n      new Set(m.profiles.map((p) => p.processName)).size !== m.profiles.length ||\n      m.profiles.some((p) => p.processName === processName)\n    )\n      throw Error(\"Manifest process identities overlap\");\n    for (const p of m.profiles)\n      if (sha(resource(pkg, dir, p.mappingFile, path.dirname(path.resolve(pkg, publisher.groupManifest)))) !== p.mappingSha256)\n        throw Error(\"Manifest member checksum changed\");\n    return {\n      processName,\n      configurationChecksum: checksum,\n      projectionChecksum,\n      mappingSha256: null,\n      dataGroup: null,\n      contract: {\n        digest: sha(bytes),\n        processName,\n        profiles: m.profiles.map(({ mappingFile: _, ...p }) => p),\n      },\n    };\n  }\n  if (typeof publisher.mappingFile !== \"string\" || Object.keys(publisher).some((k) => ![\"mappingFile\", \"dataGroup\"].includes(k)))\n    throw Error(\"Explicit original mapping file required\");\n  return {\n    processName,\n    configurationChecksum: checksum,\n    projectionChecksum,\n    mappingSha256: sha(resource(pkg, dir, String(publisher.mappingFile))),\n    dataGroup: z\n      .string()\n      .min(1)\n      .max(100)\n      .parse(publisher.dataGroup ?? descriptor.defaultDataGroup),\n    contract: null,\n  };\n}\n\n/** Shared read-only receiver/journal evidence for both resource protocols. */\nfunction inspectJournal(admission: { directory: string; journalId?: string | undefined }, persistent: boolean, expected: string): void {\n  for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))\n    if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Admission directory cannot use symbolic links\");\n  const databaseFile = path.join(admission.directory, \"admission.sqlite\");\n  if (fs.lstatSync(databaseFile).isSymbolicLink()) throw Error(\"Admission journal cannot use symbolic links\");\n  const { DatabaseSync } = createRequire(import.meta.url)(\"node:sqlite\") as typeof import(\"node:sqlite\");\n  const journal = new DatabaseSync(databaseFile, { readOnly: true });\n  try {\n    journal.exec(\"PRAGMA busy_timeout=1000\");\n    if (persistent && journal.prepare(\"SELECT value FROM metadata WHERE key='id'\").get()?.[\"value\"] !== admission.journalId)\n      throw Error(\"Persistent admission journalId binding differs\");\n    const contract = journal.prepare(\"SELECT value FROM metadata WHERE key='contract'\").get()?.[\"value\"];\n    if (contract !== expected) throw Error(\"Durable admission journal contract differs\");\n    const capture = JSON.parse(String(journal.prepare(\"SELECT value FROM metadata WHERE key='capture'\").get()?.[\"value\"] ?? \"null\"));\n    if (\n      !capture ||\n      ![\"ready\", \"capacity-blocked\"].includes(capture.state) ||\n      !Number.isSafeInteger(capture.pid) ||\n      capture.pid <= 0 ||\n      !Number.isSafeInteger(capture.heartbeat) ||\n      Date.now() - capture.heartbeat > 5000 ||\n      capture.heartbeat > Date.now() + 1000\n    )\n      throw Error(\"Durable admission receiver is not ready\");\n    process.kill(capture.pid, 0);\n    if (persistent) {\n      const namespace = sha(\n        Buffer.from(fs.readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim() + \":\" + fs.readlinkSync(\"/proc/self/ns/pid\")),\n      );\n      const stored = journal.prepare(\"SELECT value FROM metadata WHERE key='runtime_namespace'\").get()?.[\"value\"];\n      const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, \"utf8\");\n      const start = stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \")[19];\n      if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + \":\" + capture.pid + \":\" + start)))\n        throw Error(\"Admission capture namespace or process identity differs\");\n    }\n  } finally {\n    journal.close();\n  }\n}\n\nfunction inspectConfigurationGroup(\n  pkg: string,\n  dir: string,\n  raw: string,\n  original: Record<string, unknown>,\n  selected: NonNullable<ReturnType<typeof selectedConfigurationGroup>>,\n  controllerName: string,\n  options: { configurationChecksum(raw: string): string | null; excludedUnsFields: readonly string[] },\n): ProcessGroupConfigurationEvidence {\n  const { descriptor: d, snapshot } = selected;\n  const uns = { ...(original[\"uns\"] as Record<string, unknown>) };\n  const memberId = readConfigurationSelector(original, d.memberPath),\n    role = readConfigurationSelector(original, d.runtimeRolePath);\n  const member = memberId === undefined ? undefined : snapshot.profiles.find((p) => p.id === memberId);\n  if (\n    (memberId !== undefined && !member) ||\n    uns[\"processName\"] !== (member?.processName ?? snapshot.group.processName) ||\n    (role !== undefined && role !== \"publisher\")\n  )\n    throw Error(\"Configured publisher role or identity differs\");\n  const journal = configurationGroupJournalSchema\n    .extend({\n      minFreeBytes: configurationGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),\n      maxRecords: configurationGroupJournalSchema.shape.maxRecords.unwrap(),\n      maxBytes: configurationGroupJournalSchema.shape.maxBytes.unwrap(),\n    })\n    .parse(readConfigurationSelector(original, d.journalPath));\n  const production =\n    !isLocalPilotPath(pkg) || hasProcessGroupAuthorization() ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName) : undefined;\n  const persistent = !isLocalPilotPath(journal.directory);\n  if (production) assertProcessGroupStateMount(production, process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"] ?? \"\");\n  if (path.resolve(journal.directory) !== journal.directory || (production && !persistent)) throw Error(\"Configured journal storage differs\");\n  if (persistent && (!production || !journal.journalId)) throw Error(\"Persistent configured journal requires exact reviewed authority and UUID\");\n  const metadata = JSON.parse(resource(pkg, dir, \"package.json\").toString()).unsDatahub;\n  if (metadata?.processGroupAdmission !== 1 || (persistent && metadata?.processGroupPersistentAdmission !== 1))\n    throw Error(\"Required journal capabilities missing\");\n  const expected = configurationGroupJournalContract(\n    snapshot,\n    processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)),\n    configurationGroupJournalSchema.parse(journal),\n    snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })),\n  );\n  inspectJournal(journal, persistent, expected);\n  const checksum = options.configurationChecksum(raw);\n  if (!checksum) throw Error(\"Invalid configured group configuration\");\n  for (const key of [...options.excludedUnsFields, \"processName\", \"instanceMode\", \"handover\", \"handoverProtocol\"]) delete uns[key];\n  const projection = structuredClone(original);\n  projection[\"uns\"] = uns;\n  const remove = (keys: readonly string[]) => {\n    let node = projection;\n    for (const key of keys.slice(0, -1)) {\n      const child = node[key];\n      if (child === undefined) return;\n      if (!child || typeof child !== \"object\" || Array.isArray(child)) throw Error(\"Invalid selector projection\");\n      node = child as Record<string, unknown>;\n    }\n    delete node[keys.at(-1)!];\n  };\n  remove(d.memberPath);\n  remove(d.runtimeRolePath);\n  if (production) projection[\"authorizationSha256\"] = production.sha256;\n  return {\n    processName: String((original[\"uns\"] as Record<string, unknown>)[\"processName\"]),\n    configurationChecksum: checksum,\n    projectionChecksum: configurationResourceHash(projection),\n    configurationGroupSha256: snapshot.sha256,\n    generationId: journal.generationId,\n    mappingSha256: member?.resourceSha256 ?? null,\n    dataGroup: member?.dataGroup ?? null,\n    contract: member\n      ? null\n      : {\n          digest: snapshot.sha256,\n          processName: snapshot.group.processName,\n          profiles: snapshot.profiles.map(({ id, processName, resourceSha256, dataGroup }) => ({\n            id,\n            processName,\n            mappingSha256: resourceSha256,\n            dataGroup,\n          })),\n        },\n  };\n}\n"]}

package/dist/runtime/process-group-resources.d.ts

@@ -1,5 +1,6 @@
 export declare const sha256: (b: string | Buffer) => string;
 export declare const configurationAuthorizationHash: (v: unknown) => string;
+export declare function assertPrivateProcessGroupDirectory(dir: string): void;
 export declare function readProcessGroupResource(file: string, privateFile?: boolean): Buffer;
 /** Pins metadata and compiled JS/JSON modules, not an installed dependency tree. */
 export declare function groupArtifactHash(root: string): string;

package/dist/runtime/process-group-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-resources.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,GAAG,MAAM,WAAiD,CAAC;AAW3F,eAAO,MAAM,8BAA8B,GAAI,GAAG,OAAO,KAAG,MAA8C,CAAC;AAC3G,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,MAAM,CAelF;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+BtD;AACD,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoB7D"}
+{"version":3,"file":"process-group-resources.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,GAAG,MAAM,WAAiD,CAAC;AAW3F,eAAO,MAAM,8BAA8B,GAAI,GAAG,OAAO,KAAG,MAA8C,CAAC;AAC3G,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKpE;AACD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,UAAQ,GAAG,MAAM,CAelF;AACD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA+BtD;AACD,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAoB7D"}

package/dist/runtime/process-group-resources.js

@@ -12,6 +12,14 @@ function canonical(v) {
         : v;
 }
 export const configurationAuthorizationHash = (v) => sha256(JSON.stringify(canonical(v)));
+export function assertPrivateProcessGroupDirectory(dir) {
+    for (let p = dir; p !== path.dirname(p); p = path.dirname(p))
+        if (fs.lstatSync(p).isSymbolicLink())
+            throw Error("Linked policy directory");
+    const s = fs.lstatSync(dir);
+    if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)
+        throw Error("Insecure policy directory");
+}
 export function readProcessGroupResource(file, privateFile = false) {
     if (file.length > 512 || path.resolve(file) !== file)
         throw Error("Process-group authorization resource path is not normalized");

package/dist/runtime/process-group-resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-resources.js","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;aACd,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACtC;QACH,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AACD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,WAAW,GAAG,KAAK;IACxE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjI,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/H,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,EACX,OAAO,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC;YACN,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAClC,IAAI,EAAE,OAAO,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;qBACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF,OAAO,8BAA8B,CACnC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAmB;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC5G,OAAO,8BAA8B,CACnC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,QAAQ;YACR,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;YAC3B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI;YACnC,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,IAAI;YACnD,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nexport const sha256 = (b: string | Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nfunction canonical(v: unknown): unknown {\n  if (Array.isArray(v)) return v.map(canonical);\n  return v && typeof v === \"object\"\n    ? Object.fromEntries(\n        Object.entries(v)\n          .sort(([a], [b]) => a.localeCompare(b))\n          .map(([k, x]) => [k, canonical(x)]),\n      )\n    : v;\n}\nexport const configurationAuthorizationHash = (v: unknown): string => sha256(JSON.stringify(canonical(v)));\nexport function readProcessGroupResource(file: string, privateFile = false): Buffer {\n  if (file.length > 512 || path.resolve(file) !== file) throw Error(\"Process-group authorization resource path is not normalized\");\n  for (let p = file; p !== path.dirname(p); p = path.dirname(p))\n    if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Process-group authorization resource cannot contain links\");\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  try {\n    const s = fs.fstatSync(fd);\n    if (!s.isFile() || s.size > 1048576 || s.nlink !== 1 || (privateFile && (s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)))\n      throw Error(\"Process-group authorization resource is not a bounded private regular file\");\n    const b = fs.readFileSync(fd);\n    if (b.length > 1048576) throw Error(\"Process-group authorization resource too large\");\n    return b;\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n/** Pins metadata and compiled JS/JSON modules, not an installed dependency tree. */\nexport function groupArtifactHash(root: string): string {\n  const files = [\"package.json\"];\n  let total = 0,\n    entries = 0;\n  const visit = (dir: string, depth = 0) => {\n    if (depth > 32) throw Error(\"Process-group artifact directory depth exceeded\");\n    const directory = fs.opendirSync(dir);\n    try {\n      let e;\n      while ((e = directory.readSync())) {\n        if (++entries > 4096) throw Error(\"Process-group artifact directory budget exceeded\");\n        const f = path.join(dir, e.name);\n        if (e.isSymbolicLink()) throw Error(\"Process-group artifact cannot contain links\");\n        if (e.isDirectory()) visit(f, depth + 1);\n        else if (e.isFile() && /\\.(?:[cm]?js|json)$/.test(e.name)) files.push(path.relative(root, f));\n        if (files.length > 2048) throw Error(\"Process-group artifact file budget exceeded\");\n      }\n    } finally {\n      directory.closeSync();\n    }\n  };\n  visit(path.join(root, \"dist\"));\n  if (files.length < 2) throw Error(\"Process-group compiled artifact is missing\");\n  return configurationAuthorizationHash(\n    files.sort().map((f) => {\n      const b = readProcessGroupResource(path.join(root, f));\n      total += b.length;\n      if (total > 32 * 1024 * 1024) throw Error(\"Process-group artifact byte budget exceeded\");\n      return [f, sha256(b)];\n    }),\n  );\n}\n/** Endpoint/TLS identity only; credentials never become a policy field or diagnostic. */\nexport function groupChannelsHash(channels: unknown[]): string {\n  if (channels.length !== 3) throw Error(\"Process-group requires infra, input and output channel identities\");\n  return configurationAuthorizationHash(\n    channels.map((value) => {\n      const c = value as Record<string, unknown>;\n      if (typeof c[\"host\"] !== \"string\" || !c[\"host\"]) throw Error(\"Process-group broker host must be resolved\");\n      const protocol = c[\"protocol\"] ?? \"mqtt\";\n      return {\n        host: c[\"host\"],\n        port: c[\"port\"] ?? (protocol === \"mqtts\" ? 8883 : 1883),\n        protocol,\n        hosts: c[\"hosts\"] ?? [],\n        servers: c[\"servers\"] ?? [],\n        servername: c[\"servername\"] ?? null,\n        rejectUnauthorized: c[\"rejectUnauthorized\"] ?? true,\n        ca: c[\"ca\"] === undefined ? null : sha256(String(c[\"ca\"])),\n        cert: c[\"cert\"] === undefined ? null : sha256(String(c[\"cert\"])),\n      };\n    }),\n  );\n}\n"]}
+{"version":3,"file":"process-group-resources.js","sourceRoot":"","sources":["../../src/runtime/process-group-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3F,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;aACd,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CACtC;QACH,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AACD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3G,MAAM,UAAU,kCAAkC,CAAC,GAAW;IAC5D,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC3H,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,WAAW,GAAG,KAAK;IACxE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjI,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/H,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,EACX,OAAO,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE;QACvC,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC;YACN,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAClC,IAAI,EAAE,OAAO,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtF,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,CAAC,cAAc,EAAE;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACnF,IAAI,CAAC,CAAC,WAAW,EAAE;oBAAE,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;qBACpC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,SAAS,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChF,OAAO,8BAA8B,CACnC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAClB,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AACD,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAmB;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC5G,OAAO,8BAA8B,CACnC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3G,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,QAAQ;YACR,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;YAC3B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI;YACnC,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,IAAI;YACnD,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nexport const sha256 = (b: string | Buffer) => createHash(\"sha256\").update(b).digest(\"hex\");\nfunction canonical(v: unknown): unknown {\n  if (Array.isArray(v)) return v.map(canonical);\n  return v && typeof v === \"object\"\n    ? Object.fromEntries(\n        Object.entries(v)\n          .sort(([a], [b]) => a.localeCompare(b))\n          .map(([k, x]) => [k, canonical(x)]),\n      )\n    : v;\n}\nexport const configurationAuthorizationHash = (v: unknown): string => sha256(JSON.stringify(canonical(v)));\nexport function assertPrivateProcessGroupDirectory(dir: string): void {\n  for (let p = dir; p !== path.dirname(p); p = path.dirname(p))\n    if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Linked policy directory\");\n  const s = fs.lstatSync(dir);\n  if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0) throw Error(\"Insecure policy directory\");\n}\nexport function readProcessGroupResource(file: string, privateFile = false): Buffer {\n  if (file.length > 512 || path.resolve(file) !== file) throw Error(\"Process-group authorization resource path is not normalized\");\n  for (let p = file; p !== path.dirname(p); p = path.dirname(p))\n    if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Process-group authorization resource cannot contain links\");\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  try {\n    const s = fs.fstatSync(fd);\n    if (!s.isFile() || s.size > 1048576 || s.nlink !== 1 || (privateFile && (s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)))\n      throw Error(\"Process-group authorization resource is not a bounded private regular file\");\n    const b = fs.readFileSync(fd);\n    if (b.length > 1048576) throw Error(\"Process-group authorization resource too large\");\n    return b;\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n/** Pins metadata and compiled JS/JSON modules, not an installed dependency tree. */\nexport function groupArtifactHash(root: string): string {\n  const files = [\"package.json\"];\n  let total = 0,\n    entries = 0;\n  const visit = (dir: string, depth = 0) => {\n    if (depth > 32) throw Error(\"Process-group artifact directory depth exceeded\");\n    const directory = fs.opendirSync(dir);\n    try {\n      let e;\n      while ((e = directory.readSync())) {\n        if (++entries > 4096) throw Error(\"Process-group artifact directory budget exceeded\");\n        const f = path.join(dir, e.name);\n        if (e.isSymbolicLink()) throw Error(\"Process-group artifact cannot contain links\");\n        if (e.isDirectory()) visit(f, depth + 1);\n        else if (e.isFile() && /\\.(?:[cm]?js|json)$/.test(e.name)) files.push(path.relative(root, f));\n        if (files.length > 2048) throw Error(\"Process-group artifact file budget exceeded\");\n      }\n    } finally {\n      directory.closeSync();\n    }\n  };\n  visit(path.join(root, \"dist\"));\n  if (files.length < 2) throw Error(\"Process-group compiled artifact is missing\");\n  return configurationAuthorizationHash(\n    files.sort().map((f) => {\n      const b = readProcessGroupResource(path.join(root, f));\n      total += b.length;\n      if (total > 32 * 1024 * 1024) throw Error(\"Process-group artifact byte budget exceeded\");\n      return [f, sha256(b)];\n    }),\n  );\n}\n/** Endpoint/TLS identity only; credentials never become a policy field or diagnostic. */\nexport function groupChannelsHash(channels: unknown[]): string {\n  if (channels.length !== 3) throw Error(\"Process-group requires infra, input and output channel identities\");\n  return configurationAuthorizationHash(\n    channels.map((value) => {\n      const c = value as Record<string, unknown>;\n      if (typeof c[\"host\"] !== \"string\" || !c[\"host\"]) throw Error(\"Process-group broker host must be resolved\");\n      const protocol = c[\"protocol\"] ?? \"mqtt\";\n      return {\n        host: c[\"host\"],\n        port: c[\"port\"] ?? (protocol === \"mqtts\" ? 8883 : 1883),\n        protocol,\n        hosts: c[\"hosts\"] ?? [],\n        servers: c[\"servers\"] ?? [],\n        servername: c[\"servername\"] ?? null,\n        rejectUnauthorized: c[\"rejectUnauthorized\"] ?? true,\n        ca: c[\"ca\"] === undefined ? null : sha256(String(c[\"ca\"])),\n        cert: c[\"cert\"] === undefined ? null : sha256(String(c[\"cert\"])),\n      };\n    }),\n  );\n}\n"]}

package/dist/runtime/process-group-runtime-selection.d.ts

@@ -0,0 +1,14 @@
+import { type ConfigurationGroupDescriptor } from "./configuration-group-contract.js";
+import { type ProcessGroupRuntimeDescriptor } from "./process-group-contract.js";
+export type RuntimeGroupDescriptor = ProcessGroupRuntimeDescriptor | ConfigurationGroupDescriptor;
+/** Pick configuration resources only when explicitly selected; file consumers stay unchanged. */
+export declare function selectedProcessGroupDescriptor(pkg: string, raw: Record<string, unknown>): RuntimeGroupDescriptor | undefined;
+export declare function normalizeRuntimeProcessGroup(raw: Record<string, unknown>, descriptor: RuntimeGroupDescriptor): {
+    matches: boolean;
+    uns: Record<string, unknown>;
+    publisher: Record<string, unknown>;
+    journal: unknown;
+    runtimeRole: unknown;
+    configurationSnapshot: import("./configuration-group-contract.js").ConfigurationGroupSnapshot;
+};
+//# sourceMappingURL=process-group-runtime-selection.d.ts.map

package/dist/runtime/process-group-runtime-selection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-runtime-selection.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-runtime-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,4BAA4B,EAA4D,MAAM,mCAAmC,CAAC;AAChJ,OAAO,EACL,KAAK,6BAA6B,EAInC,MAAM,6BAA6B,CAAC;AAErC,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,4BAA4B,CAAC;AAElG,iGAAiG;AACjG,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,GAAG,SAAS,CAI5H;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,sBAAsB;;SAW7F,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;eACX,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;EAKlD"}

package/dist/runtime/process-group-runtime-selection.js

@@ -0,0 +1,29 @@
+import { configurationGroupDescriptor, configurationGroupSnapshot } from "./configuration-group-contract.js";
+import { normalizeProcessGroupConfiguration, processGroupDescriptor, readConfigurationSelector, } from "./process-group-contract.js";
+/** Pick configuration resources only when explicitly selected; file consumers stay unchanged. */
+export function selectedProcessGroupDescriptor(pkg, raw) {
+    const configured = configurationGroupDescriptor(pkg);
+    if (configured && readConfigurationSelector(raw, configured.groupPath) !== undefined)
+        return configured;
+    return processGroupDescriptor(pkg);
+}
+export function normalizeRuntimeProcessGroup(raw, descriptor) {
+    if (descriptor.protocolVersion === 1)
+        return { ...normalizeProcessGroupConfiguration(raw, descriptor), configurationSnapshot: undefined };
+    const matches = !descriptor.match || readConfigurationSelector(raw, descriptor.match.path) === descriptor.match.value;
+    const snapshot = configurationGroupSnapshot(readConfigurationSelector(raw, descriptor.groupPath));
+    const runtimeRole = readConfigurationSelector(raw, descriptor.runtimeRolePath);
+    const publisher = readConfigurationSelector(raw, descriptor.publisherPath);
+    const uns = raw["uns"];
+    if (!uns || typeof uns !== "object" || Array.isArray(uns) || !publisher || typeof publisher !== "object" || Array.isArray(publisher))
+        throw Error("Explicit process-group publisher and identity required");
+    return {
+        matches,
+        uns: uns,
+        publisher: publisher,
+        journal: readConfigurationSelector(raw, descriptor.journalPath),
+        runtimeRole: runtimeRole === descriptor.receiverRole ? "admission" : runtimeRole,
+        configurationSnapshot: snapshot,
+    };
+}
+//# sourceMappingURL=process-group-runtime-selection.js.map

package/dist/runtime/process-group-runtime-selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-runtime-selection.js","sourceRoot":"","sources":["../../src/runtime/process-group-runtime-selection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAChJ,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,6BAA6B,CAAC;AAIrC,iGAAiG;AACjG,MAAM,UAAU,8BAA8B,CAAC,GAAW,EAAE,GAA4B;IACtF,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,UAAU,IAAI,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACxG,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAA4B,EAAE,UAAkC;IAC3G,IAAI,UAAU,CAAC,eAAe,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;IAC1I,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IACtH,MAAM,QAAQ,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAClI,MAAM,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACxE,OAAO;QACL,OAAO;QACP,GAAG,EAAE,GAA8B;QACnC,SAAS,EAAE,SAAoC;QAC/C,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC;QAC/D,WAAW,EAAE,WAAW,KAAK,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;QAChF,qBAAqB,EAAE,QAAQ;KAChC,CAAC;AACJ,CAAC","sourcesContent":["import { type ConfigurationGroupDescriptor, configurationGroupDescriptor, configurationGroupSnapshot } from \"./configuration-group-contract.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  readConfigurationSelector,\n} from \"./process-group-contract.js\";\n\nexport type RuntimeGroupDescriptor = ProcessGroupRuntimeDescriptor | ConfigurationGroupDescriptor;\n\n/** Pick configuration resources only when explicitly selected; file consumers stay unchanged. */\nexport function selectedProcessGroupDescriptor(pkg: string, raw: Record<string, unknown>): RuntimeGroupDescriptor | undefined {\n  const configured = configurationGroupDescriptor(pkg);\n  if (configured && readConfigurationSelector(raw, configured.groupPath) !== undefined) return configured;\n  return processGroupDescriptor(pkg);\n}\n\nexport function normalizeRuntimeProcessGroup(raw: Record<string, unknown>, descriptor: RuntimeGroupDescriptor) {\n  if (descriptor.protocolVersion === 1) return { ...normalizeProcessGroupConfiguration(raw, descriptor), configurationSnapshot: undefined };\n  const matches = !descriptor.match || readConfigurationSelector(raw, descriptor.match.path) === descriptor.match.value;\n  const snapshot = configurationGroupSnapshot(readConfigurationSelector(raw, descriptor.groupPath));\n  const runtimeRole = readConfigurationSelector(raw, descriptor.runtimeRolePath);\n  const publisher = readConfigurationSelector(raw, descriptor.publisherPath);\n  const uns = raw[\"uns\"];\n  if (!uns || typeof uns !== \"object\" || Array.isArray(uns) || !publisher || typeof publisher !== \"object\" || Array.isArray(publisher))\n    throw Error(\"Explicit process-group publisher and identity required\");\n  return {\n    matches,\n    uns: uns as Record<string, unknown>,\n    publisher: publisher as Record<string, unknown>,\n    journal: readConfigurationSelector(raw, descriptor.journalPath),\n    runtimeRole: runtimeRole === descriptor.receiverRole ? \"admission\" : runtimeRole,\n    configurationSnapshot: snapshot,\n  };\n}\n"]}