@uns-kit/core 3.0.28 → 3.0.31

package/dist/runtime/process-group-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AACxE,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,IAAI,IAAI,EAChC,MAAM,IAAI,GAAG,GACd,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,EAAE,MAAM;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE;IACF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7H,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAcH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,SAAS,gBAAgB,CAAC,GAAW;IACnC,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC3I,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC3H,CAAC;AACD,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/H,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,yDAAyD;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrH,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AACjC,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,GAA4B,EAAE,IAAY,EAAE,QAAiB;IAC9F,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3D,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACrE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAsD,CAAC;YAC3D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrI,UAAU,GAAG,UAAU;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACT,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC7E,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACrF,CAAC,CAAC,CAAC;YACP,CAAC;;gBAAM,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACxE,KAAK,MAAM,KAAK,IAAI,OAAO;oBACzB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;4BAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC5E,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,iFAAiF;oBACjF,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxF,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;4BAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACpF,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;wBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,KAAK,MAAM,KAAK,IAAI,QAAQ;wBAC1B,IACE,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;4BACjC,KAAK,CAAC,cAAc,EAAE;4BACtB,CAAC,KAAK,CAAC,WAAW,EAAE;4BACpB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;4BAE/D,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GACL,GAAG,CAAC,aAAa,KAAK,CAAC;gBACrB,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YACnI,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;gBACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;gBACtE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAE9D,MAAM,KAAK,EAAE,CAAC;YAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB,CAAC,OAAyC,EAAE,SAAkB;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAC1F,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvD,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;YAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAC3B,CAAC,CAAC,gBAAgB,KAAK,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAC5E,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAEpE,MAAM,KAAK,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3I,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,mBAAmB;YAAE,MAAM,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9C,IACE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;YAErF,MAAM,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa;gBAAE,MAAM,KAAK,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YAC5D,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU;YAClC,CAAC,QAAQ,EAAE,UAAU,CAAU;SAChC,CAAC,CAAC;QACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;YACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAEhE,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,GAAG,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EACvE,CAAC,GAAG,CAAC,CAAC,OAA8C,EACpD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAClB,IACE,CAAC,KAAK;YACN,CAAC,CAAC,CAAC,OAAO;YACV,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC5C,KAAK,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtF,CAAC,CAAC;YACF,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;YACxC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YAEpC,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACxE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YACtC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,SAAS;gBACpC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa;YAEhD,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;YAClB,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,WAAW;YAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,OAAyC;IACpF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,OAAyC,EAAE,KAAa;IAC1G,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAyC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,sCAAsC,CACpD,GAAW,EACX,GAAW,EACX,GAA4B,EAC5B,cAAsB,EACtB,UAAU,GAAG,KAAK;IAElB,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,GAAG;QAChB,iBAAiB,EAAE,GAAG;QACtB,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,4BAA4B,CAAC,GAAG,CAAC;QAC3C,cAAc;QACd,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sCAAsC,CACpD,KAA4C,EAC5C,SAAiB,EACjB,SAA6B;IAE7B,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAC1H,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,4BAA4B,CAAC,KAA2C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAgC,EAAE,IAAY;IACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,KAA+B,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;QAC7I,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,GAAW,EACX,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,oBAAoB,CAAC,KAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IACE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO;YACjD,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO;YAC7D,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO;YAElD,MAAM,KAAK,EAAE,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport * as legacy from \"./compatibility/energenti-authorization-v1.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport {\n  configurationAuthorizationHash,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource as read,\n  sha256 as sha,\n} from \"./process-group-resources.js\";\n\nexport { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from \"./process-group-resources.js\";\n\nexport const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nconst placement = z.strictObject({\n  instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n  processName: id,\n  role: z.enum([\"source\", \"target\", \"receiver\"]),\n  configurationSha256: digest,\n});\nexport const processGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(3),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(1),\n  packageName: z.string().min(1).max(214),\n  namespace: id,\n  groupId: id,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupManifestSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z.array(placement).min(4).max(18),\n});\nexport type ProcessGroupAuthorizationPolicy = z.infer<typeof processGroupAuthorizationSchema>;\nexport const processGroupManifestSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  id,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: id,\n  profiles: z\n    .array(z.strictObject({ id, processName: id, mappingFile: z.string().min(1).max(512), mappingSha256: digest, dataGroup: id }))\n    .min(2)\n    .max(16),\n});\ninterface GenericAuthorization {\n  readonly sha256: string;\n  readonly file: string;\n  readonly directory: string;\n  readonly journalId: string | null;\n  readonly role: \"source\" | \"target\" | \"receiver\";\n  readonly groupId: string;\n  readonly groupProcessName: string;\n  readonly namespace: string;\n}\nexport type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;\nexport type HvAuthorization = ProcessGroupAuthorization;\nexport type HvAuthorizationPolicy = legacy.HvAuthorizationPolicy;\nexport const hvAuthorizationSchema = legacy.hvAuthorizationSchema;\nexport const productionGroupIds = legacy.productionGroupIds;\nconst issued = new WeakSet<object>();\nfunction privateDirectory(dir: string): void {\n  for (let p = dir; p !== path.dirname(p); p = path.dirname(p)) if (fs.lstatSync(p).isSymbolicLink()) throw Error(\"Linked policy directory\");\n  const s = fs.lstatSync(dir);\n  if (!s.isDirectory() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0) throw Error(\"Insecure policy directory\");\n}\nfunction registryRoot(root: string, dir: string): string {\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir) throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  if (dir === root) return \"*\"; // Explicit collection of independently owned namespaces.\n  const relative = path.relative(root, dir);\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || !/^([a-z][a-z0-9-]{0,99})\\/authorizations$/.test(relative))\n    throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  privateDirectory(dir);\n  return relative.split(\"/\")[0]!;\n}\nfunction selectedFile(pkg: string, raw: Record<string, unknown>, root: string, explicit?: string): string {\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Missing runtime contract\");\n  const c = normalizeProcessGroupConfiguration(raw, descriptor),\n    journal = c.journal as Record<string, unknown> | undefined;\n  const manifest = descriptor.manifests.find((m) => m.file === journal?.[\"groupManifest\"]);\n  if (!manifest) throw Error(\"Unregistered group manifest\");\n  const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n  if (explicit) return explicit;\n  if (dir) {\n    const selected = registryRoot(root, dir);\n    if (selected !== \"*\" && selected !== descriptor.namespace) throw Error(\"Foreign runtime registry\");\n    const registry = selected === \"*\" ? path.join(root, descriptor.namespace, \"authorizations\") : dir;\n    privateDirectory(registry);\n    return path.join(registry, manifest.id + \".json\");\n  }\n  const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n  if (!single) throw Error(\"No selected policy\");\n  return single;\n}\n/** Bounded private registry enumeration; retained state without its policy fails closed.\n * New groups are operator-owned data and never a release-time enum in the Controller.\n */\nexport function configuredGroupProcessNames(): Set<string> {\n  if (!hasProcessGroupAuthorization()) return new Set();\n  try {\n    const root = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root) throw Error();\n    const files = new Set<string>();\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (single) files.add(single);\n    const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (dir) {\n      const selected = registryRoot(root, dir);\n      let registries: { namespace: string; directory: string }[];\n      if (selected === \"*\") {\n        const namespaces = fs.readdirSync(root, { withFileTypes: true });\n        if (namespaces.length > 64 || namespaces.some((e) => e.isSymbolicLink())) throw Error(\"Registry namespace budget or link violation\");\n        registries = namespaces\n          .filter((e) => e.isDirectory())\n          .map((e) => {\n            if (!id.safeParse(e.name).success) throw Error(\"Invalid registry namespace\");\n            privateDirectory(path.join(root, e.name));\n            return { namespace: e.name, directory: path.join(root, e.name, \"authorizations\") };\n          });\n      } else registries = [{ namespace: selected, directory: dir }];\n      for (const registry of registries) {\n        let entries: fs.Dirent[] = [];\n        try {\n          privateDirectory(registry.directory);\n          entries = fs.readdirSync(registry.directory, { withFileTypes: true });\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n        if (entries.length > 64) throw Error(\"Policy registry budget exceeded\");\n        for (const entry of entries)\n          if (entry.name.endsWith(\".json\")) {\n            if (!/^[a-z][a-z0-9-]{0,99}\\.json$/.test(entry.name)) throw Error(\"Invalid registry entry\");\n            files.add(path.join(registry.directory, entry.name));\n            if (files.size > 64) throw Error(\"Total policy registry budget exceeded\");\n          }\n        const journals = path.join(root, registry.namespace, \"admission\");\n        try {\n          // Root/registry permissions already protect visibility; retain old parent modes.\n          for (let parent = journals; parent !== path.dirname(parent); parent = path.dirname(parent))\n            if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Linked journal registry\");\n          const retained = fs.readdirSync(journals, { withFileTypes: true });\n          if (retained.length > 64) throw Error(\"Retained journal budget exceeded\");\n          for (const entry of retained)\n            if (\n              !id.safeParse(entry.name).success ||\n              entry.isSymbolicLink() ||\n              !entry.isDirectory() ||\n              !files.has(path.join(registry.directory, entry.name + \".json\"))\n            )\n              throw Error(\"Retained journal has no reviewed policy\");\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n      }\n    }\n    const result = new Set<string>();\n    for (const file of files) {\n      const raw = JSON.parse(read(file, true).toString());\n      const p =\n        raw.schemaVersion === 3\n          ? processGroupAuthorizationSchema.parse(raw)\n          : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);\n      const { namespace, group } = p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);\n      if (\n        p.stateRoot !== root ||\n        file !== path.join(root, namespace, \"authorizations\", group + \".json\") ||\n        p.directory !== path.join(root, namespace, \"admission\", group)\n      )\n        throw Error();\n      privateDirectory(root);\n      privateDirectory(path.dirname(file));\n      for (const role of p.placements) result.add(role.processName);\n    }\n    return result;\n  } catch {\n    throw Error(\"Process-group authorization registry is missing, changed or insecure; review required\");\n  }\n}\nexport interface ProcessGroupAuthorizationContext {\n  packageRoot: string;\n  instanceDirectory: string;\n  rawConfiguration: Record<string, unknown>;\n  channels: unknown[];\n  controllerName: string;\n  file?: string;\n  stateRoot?: string;\n  initialize?: boolean;\n}\nfunction verifyRuntimePolicy(context: ProcessGroupAuthorizationContext, candidate?: Buffer): ProcessGroupAuthorization {\n  try {\n    const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root || !context.controllerName) throw Error();\n    const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file),\n      bytes = candidate ?? read(file, true),\n      unparsed = JSON.parse(bytes.toString());\n    if (unparsed.schemaVersion !== 3) {\n      if (candidate) throw Error(\"Only generic policies can be staged\");\n      return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });\n    }\n    const p = processGroupAuthorizationSchema.parse(unparsed),\n      d = processGroupDescriptor(context.packageRoot);\n    if (!d || d.legacy) throw Error(\"Generic runtime descriptor required\");\n    const pkg = JSON.parse(read(path.join(context.packageRoot, \"package.json\")).toString());\n    const manifest = d.manifests.find((m) => m.id === p.groupId);\n    if (\n      !manifest ||\n      p.packageName !== pkg.name ||\n      p.namespace !== d.namespace ||\n      p.descriptorSha256 !== configurationAuthorizationHash(pkg.unsDatahub.processGroupRuntime) ||\n      p.packageRoot !== context.packageRoot ||\n      p.controllerName !== context.controllerName ||\n      p.stateRoot !== root ||\n      file !== path.join(root, d.namespace, \"authorizations\", p.groupId + \".json\") ||\n      p.directory !== path.join(root, d.namespace, \"admission\", p.groupId)\n    )\n      throw Error();\n    privateDirectory(root);\n    privateDirectory(path.dirname(file));\n    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256) throw Error();\n    const manifestBytes = read(path.join(context.packageRoot, manifest.file));\n    if (sha(manifestBytes) !== p.groupManifestSha256) throw Error();\n    const m = processGroupManifestSchema.parse(JSON.parse(manifestBytes.toString()));\n    if (m.id !== p.groupId) throw Error();\n    const receiver = m.processName + \"-admission\";\n    if (\n      new Set(m.profiles.map((x) => x.id)).size !== m.profiles.length ||\n      new Set(m.profiles.map((x) => x.processName)).size !== m.profiles.length ||\n      m.profiles.some((x) => x.processName === m.processName || x.processName === receiver)\n    )\n      throw Error();\n    for (const member of m.profiles) {\n      const f = path.resolve(context.packageRoot, path.dirname(manifest.file), member.mappingFile);\n      if (!f.startsWith(context.packageRoot + path.sep) || sha(read(f)) !== member.mappingSha256) throw Error();\n    }\n    const expected = new Map([\n      ...m.profiles.map((x) => [x.processName, \"source\"] as const),\n      [m.processName, \"target\"] as const,\n      [receiver, \"receiver\"] as const,\n    ]);\n    if (\n      p.placements.length !== expected.size ||\n      new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n      new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n      p.placements.some((x) => expected.get(x.processName) !== x.role)\n    )\n      throw Error();\n    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n    const c = normalizeProcessGroupConfiguration(context.rawConfiguration, d),\n      j = c.journal as Record<string, unknown> | undefined,\n      k = c.publisher;\n    if (\n      !entry ||\n      !c.matches ||\n      entry.processName !== c.uns?.[\"processName\"] ||\n      entry.configurationSha256 !== configurationAuthorizationHash(context.rawConfiguration) ||\n      !j ||\n      j[\"directory\"] !== p.directory ||\n      (j[\"journalId\"] ?? null) !== p.journalId ||\n      j[\"groupManifest\"] !== manifest.file\n    )\n      throw Error();\n    if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null) throw Error();\n    if (entry.role === \"receiver\" ? c.runtimeRole !== \"admission\" : c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") throw Error();\n    const member = m.profiles.find((x) => x.processName === entry.processName),\n      mapping = path.resolve(context.packageRoot, String(k[\"mappingFile\"]));\n    if (\n      entry.role !== \"source\"\n        ? k[\"groupManifest\"] !== manifest.file\n        : k[\"groupManifest\"] !== undefined ||\n          k[\"dataGroup\"] !== member?.dataGroup ||\n          !mapping.startsWith(context.packageRoot + path.sep) ||\n          sha(read(mapping)) !== member?.mappingSha256\n    )\n      throw Error();\n    const result = Object.freeze({\n      sha256: sha(bytes),\n      file,\n      directory: p.directory,\n      journalId: p.journalId,\n      role: entry.role,\n      groupId: p.groupId,\n      groupProcessName: m.processName,\n      namespace: d.namespace,\n    });\n    if (!candidate) issued.add(result);\n    return result;\n  } catch {\n    throw Error(\"Process-group runtime authorization is missing, changed or does not match this installed placement; review required\");\n  }\n}\n/** Live authority always comes from the current canonical private policy. */\nexport function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization {\n  return verifyRuntimePolicy(context);\n}\n/** Review only: never issues an authorization accepted by runtime/launch checks. */\nexport function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void {\n  verifyRuntimePolicy(context, bytes);\n}\nexport function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string {\n  const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n  if (!root) throw Error(\"Missing process-group state root\");\n  return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);\n}\nexport const authorizeHvRuntime = authorizeProcessGroupRuntime;\nexport function authorizeConfiguredProcessGroupRuntime(\n  pkg: string,\n  dir: string,\n  raw: Record<string, unknown>,\n  controllerName: string,\n  initialize = false,\n) {\n  return authorizeProcessGroupRuntime({\n    packageRoot: pkg,\n    instanceDirectory: dir,\n    rawConfiguration: raw,\n    channels: resolvedProcessGroupChannels(raw),\n    controllerName,\n    initialize,\n  });\n}\nexport function assertProcessGroupJournalAuthorization(\n  value: ProcessGroupAuthorization | undefined,\n  directory: string,\n  journalId: string | undefined,\n): void {\n  if (value && issued.has(value)) {\n    if (value.directory !== directory || value.journalId !== (journalId ?? null) || sha(read(value.file, true)) !== value.sha256)\n      throw Error(\"Exact reviewed process-group authorization required\");\n    return;\n  }\n  legacy.assertHvJournalAuthorization(value as legacy.HvAuthorization | undefined, directory, journalId);\n}\nexport const assertHvJournalAuthorization = assertProcessGroupJournalAuthorization;\nexport function assertProcessGroupStateMount(value: ProcessGroupAuthorization, root: string): void {\n  if (!issued.has(value)) {\n    legacy.assertHvStateMount(value as legacy.HvAuthorization, root);\n    return;\n  }\n  assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n  if (process.platform !== \"linux\" || !(\"namespace\" in value) || value.directory !== path.join(root, value.namespace, \"admission\", value.groupId))\n    throw Error(\"Process group requires its reviewed Linux state mount\");\n  const mount = fs\n    .readFileSync(\"/proc/self/mountinfo\", \"utf8\")\n    .split(\"\\n\")\n    .map((l) => l.split(\" \"))\n    .filter((f) => f[4] === root)\n    .at(-1);\n  if (!mount || !mount[5]?.split(\",\").includes(\"rw\") || ![\"xfs\", \"ext4\", \"btrfs\", \"zfs\"].includes(mount[mount.indexOf(\"-\") + 1] ?? \"\"))\n    throw Error(\"Process-group state root must be an explicit writable local Linux filesystem mount\");\n}\nexport const assertHvStateMount = assertProcessGroupStateMount;\nexport function assertProcessGroupTargetLaunch(\n  value: ProcessGroupAuthorization,\n  dir: string,\n  operationId: string | undefined,\n  launchId: string | undefined,\n): void {\n  if (!issued.has(value)) {\n    legacy.assertHvTargetLaunch(value as legacy.HvAuthorization, dir, operationId, launchId);\n    return;\n  }\n  if (value.role !== \"target\") return;\n  try {\n    assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n    const r = JSON.parse(read(path.join(dir, \"process-group-reservation.json\"), true).toString());\n    if (\n      !z.string().uuid().safeParse(operationId).success ||\n      !z.string().uuid().safeParse(launchId).success ||\n      r.operationId !== operationId ||\n      r.role !== \"target\" ||\n      r.lastLaunch?.launchId !== launchId ||\n      !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||\n      !digest.safeParse(r.configurationChecksum).success\n    )\n      throw Error();\n  } catch {\n    throw Error(\"Target requires its exact reviewed group reservation and launch identity\");\n  }\n}\nexport const assertHvTargetLaunch = assertProcessGroupTargetLaunch;\n"]}
+{"version":3,"file":"process-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AACxE,OAAO,EAAE,qCAAqC,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACjK,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,IAAI,IAAI,EAChC,MAAM,IAAI,GAAG,EACb,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,EAAE,MAAM;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE;IACF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7H,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAgBH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAC5D,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/H,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,yDAAyD;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrH,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AACjC,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,GAA4B,EAAE,IAAY,EAAE,QAAiB;IAC9F,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QAC3E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3D,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACrE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAsD,CAAC;YAC3D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrI,UAAU,GAAG,UAAU;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACT,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC7E,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACrF,CAAC,CAAC,CAAC;YACP,CAAC;;gBAAM,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACxE,KAAK,MAAM,KAAK,IAAI,OAAO;oBACzB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;4BAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC5E,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,iFAAiF;oBACjF,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxF,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;4BAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACpF,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;wBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,KAAK,MAAM,KAAK,IAAI,QAAQ;wBAC1B,IACE,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;4BACjC,KAAK,CAAC,cAAc,EAAE;4BACtB,CAAC,KAAK,CAAC,WAAW,EAAE;4BACpB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;4BAE/D,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GACL,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC;gBAClG,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE;gBACpG,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1G,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;gBACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;gBACtE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAE9D,MAAM,KAAK,EAAE,CAAC;YAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB,CAAC,OAAyC,EAAE,SAAkB;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAC1F,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvD,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;YAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAC3B,CAAC,CAAC,gBAAgB,KAAK,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAC5E,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAEpE,MAAM,KAAK,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3I,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,mBAAmB;YAAE,MAAM,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9C,IACE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;YAErF,MAAM,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa;gBAAE,MAAM,KAAK,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YAC5D,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU;YAClC,CAAC,QAAQ,EAAE,UAAU,CAAU;SAChC,CAAC,CAAC;QACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;YACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAEhE,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,GAAG,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EACvE,CAAC,GAAG,CAAC,CAAC,OAA8C,EACpD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAClB,IACE,CAAC,KAAK;YACN,CAAC,CAAC,CAAC,OAAO;YACV,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC5C,KAAK,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtF,CAAC,CAAC;YACF,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;YACxC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YAEpC,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACxE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YACtC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,SAAS;gBACpC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa;YAEhD,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;YAClB,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,WAAW;YAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,OAAyC;IACpF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,OAAyC,EAAE,KAAa;IAC1G,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAyC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,sCAAsC,CACpD,GAAW,EACX,GAAW,EACX,GAA4B,EAC5B,cAAsB,EACtB,UAAU,GAAG,KAAK;IAElB,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,GAAG;QAChB,iBAAiB,EAAE,GAAG;QACtB,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,4BAA4B,CAAC,GAAG,CAAC;QAC3C,cAAc;QACd,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sCAAsC,CACpD,KAA4C,EAC5C,SAAiB,EACjB,SAA6B;IAE7B,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAC1H,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,4BAA4B,CAAC,KAA2C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAgC,EAAE,IAAY;IACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,KAA+B,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC;QACnK,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,GAAW,EACX,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,oBAAoB,CAAC,KAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IACE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO;YACjD,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO;YAC7D,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO;YAElD,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS;YACrF,CAAC,CAAC,CAAC,wBAAwB,KAAK,KAAK,CAAC,wBAAwB,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport * as legacy from \"./compatibility/energenti-authorization-v1.js\";\nimport { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from \"./configuration-group-authorization.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport {\n  configurationAuthorizationHash,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource as read,\n  sha256 as sha,\n  assertPrivateProcessGroupDirectory,\n} from \"./process-group-resources.js\";\n\nexport { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from \"./process-group-resources.js\";\n\nexport const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nconst placement = z.strictObject({\n  instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n  processName: id,\n  role: z.enum([\"source\", \"target\", \"receiver\"]),\n  configurationSha256: digest,\n});\nexport const processGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(3),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(1),\n  packageName: z.string().min(1).max(214),\n  namespace: id,\n  groupId: id,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupManifestSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z.array(placement).min(4).max(18),\n});\nexport type ProcessGroupAuthorizationPolicy = z.infer<typeof processGroupAuthorizationSchema>;\nexport const processGroupManifestSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  id,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: id,\n  profiles: z\n    .array(z.strictObject({ id, processName: id, mappingFile: z.string().min(1).max(512), mappingSha256: digest, dataGroup: id }))\n    .min(2)\n    .max(16),\n});\ninterface GenericAuthorization {\n  readonly sha256: string;\n  readonly file: string;\n  readonly directory: string;\n  readonly journalId: string | null;\n  readonly role: \"source\" | \"target\" | \"receiver\";\n  readonly groupId: string;\n  readonly groupProcessName: string;\n  readonly namespace: string;\n  readonly generationId?: string;\n  readonly configurationGroupSha256?: string;\n}\nexport type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;\nexport type HvAuthorization = ProcessGroupAuthorization;\nexport type HvAuthorizationPolicy = legacy.HvAuthorizationPolicy;\nexport const hvAuthorizationSchema = legacy.hvAuthorizationSchema;\nexport const productionGroupIds = legacy.productionGroupIds;\nconst issued = new WeakSet<object>();\nconst privateDirectory = assertPrivateProcessGroupDirectory;\nfunction registryRoot(root: string, dir: string): string {\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir) throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  if (dir === root) return \"*\"; // Explicit collection of independently owned namespaces.\n  const relative = path.relative(root, dir);\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || !/^([a-z][a-z0-9-]{0,99})\\/authorizations$/.test(relative))\n    throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  privateDirectory(dir);\n  return relative.split(\"/\")[0]!;\n}\nfunction selectedFile(pkg: string, raw: Record<string, unknown>, root: string, explicit?: string): string {\n  const configured = configurationGroupPolicyIdentity(pkg, raw);\n  if (configured) {\n    if (explicit) return explicit;\n    const directory = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (directory) {\n      const selected = registryRoot(root, directory);\n      if (selected !== \"*\" && selected !== configured.namespace) throw Error(\"Foreign runtime registry\");\n      const registry = selected === \"*\" ? path.join(root, configured.namespace, \"authorizations\") : directory;\n      privateDirectory(registry);\n      return path.join(registry, configured.generationId + \".json\");\n    }\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (!single) throw Error(\"No selected policy\");\n    return single;\n  }\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Missing runtime contract\");\n  const c = normalizeProcessGroupConfiguration(raw, descriptor),\n    journal = c.journal as Record<string, unknown> | undefined;\n  const manifest = descriptor.manifests.find((m) => m.file === journal?.[\"groupManifest\"]);\n  if (!manifest) throw Error(\"Unregistered group manifest\");\n  const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n  if (explicit) return explicit;\n  if (dir) {\n    const selected = registryRoot(root, dir);\n    if (selected !== \"*\" && selected !== descriptor.namespace) throw Error(\"Foreign runtime registry\");\n    const registry = selected === \"*\" ? path.join(root, descriptor.namespace, \"authorizations\") : dir;\n    privateDirectory(registry);\n    return path.join(registry, manifest.id + \".json\");\n  }\n  const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n  if (!single) throw Error(\"No selected policy\");\n  return single;\n}\n/** Bounded private registry enumeration; retained state without its policy fails closed.\n * New groups are operator-owned data and never a release-time enum in the Controller.\n */\nexport function configuredGroupProcessNames(): Set<string> {\n  if (!hasProcessGroupAuthorization()) return new Set();\n  try {\n    const root = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root) throw Error();\n    const files = new Set<string>();\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (single) files.add(single);\n    const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (dir) {\n      const selected = registryRoot(root, dir);\n      let registries: { namespace: string; directory: string }[];\n      if (selected === \"*\") {\n        const namespaces = fs.readdirSync(root, { withFileTypes: true });\n        if (namespaces.length > 64 || namespaces.some((e) => e.isSymbolicLink())) throw Error(\"Registry namespace budget or link violation\");\n        registries = namespaces\n          .filter((e) => e.isDirectory())\n          .map((e) => {\n            if (!id.safeParse(e.name).success) throw Error(\"Invalid registry namespace\");\n            privateDirectory(path.join(root, e.name));\n            return { namespace: e.name, directory: path.join(root, e.name, \"authorizations\") };\n          });\n      } else registries = [{ namespace: selected, directory: dir }];\n      for (const registry of registries) {\n        let entries: fs.Dirent[] = [];\n        try {\n          privateDirectory(registry.directory);\n          entries = fs.readdirSync(registry.directory, { withFileTypes: true });\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n        if (entries.length > 64) throw Error(\"Policy registry budget exceeded\");\n        for (const entry of entries)\n          if (entry.name.endsWith(\".json\")) {\n            if (!/^[a-z][a-z0-9-]{0,99}\\.json$/.test(entry.name)) throw Error(\"Invalid registry entry\");\n            files.add(path.join(registry.directory, entry.name));\n            if (files.size > 64) throw Error(\"Total policy registry budget exceeded\");\n          }\n        const journals = path.join(root, registry.namespace, \"admission\");\n        try {\n          // Root/registry permissions already protect visibility; retain old parent modes.\n          for (let parent = journals; parent !== path.dirname(parent); parent = path.dirname(parent))\n            if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Linked journal registry\");\n          const retained = fs.readdirSync(journals, { withFileTypes: true });\n          if (retained.length > 64) throw Error(\"Retained journal budget exceeded\");\n          for (const entry of retained)\n            if (\n              !id.safeParse(entry.name).success ||\n              entry.isSymbolicLink() ||\n              !entry.isDirectory() ||\n              !files.has(path.join(registry.directory, entry.name + \".json\"))\n            )\n              throw Error(\"Retained journal has no reviewed policy\");\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n      }\n    }\n    const result = new Set<string>();\n    for (const file of files) {\n      const raw = JSON.parse(read(file, true).toString());\n      const p =\n        raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3\n          ? processGroupAuthorizationSchema.parse(raw)\n          : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);\n      const { namespace, group } = p.schemaVersion === 4 ? { namespace: p.namespace, group: p.generationId }\n        : p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);\n      if (\n        p.stateRoot !== root ||\n        file !== path.join(root, namespace, \"authorizations\", group + \".json\") ||\n        p.directory !== path.join(root, namespace, \"admission\", group)\n      )\n        throw Error();\n      privateDirectory(root);\n      privateDirectory(path.dirname(file));\n      for (const role of p.placements) result.add(role.processName);\n    }\n    return result;\n  } catch {\n    throw Error(\"Process-group authorization registry is missing, changed or insecure; review required\");\n  }\n}\nexport interface ProcessGroupAuthorizationContext {\n  packageRoot: string;\n  instanceDirectory: string;\n  rawConfiguration: Record<string, unknown>;\n  channels: unknown[];\n  controllerName: string;\n  file?: string;\n  stateRoot?: string;\n  initialize?: boolean;\n}\nfunction verifyRuntimePolicy(context: ProcessGroupAuthorizationContext, candidate?: Buffer): ProcessGroupAuthorization {\n  try {\n    const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root || !context.controllerName) throw Error();\n    const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file),\n      bytes = candidate ?? read(file, true),\n      unparsed = JSON.parse(bytes.toString());\n    if (unparsed.schemaVersion === 4) {\n      const result = verifyConfigurationGroupPolicy(context, bytes, root, file);\n      if (!candidate) issued.add(result);\n      return result;\n    }\n    if (unparsed.schemaVersion !== 3) {\n      if (candidate) throw Error(\"Only generic policies can be staged\");\n      return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });\n    }\n    const p = processGroupAuthorizationSchema.parse(unparsed),\n      d = processGroupDescriptor(context.packageRoot);\n    if (!d || d.legacy) throw Error(\"Generic runtime descriptor required\");\n    const pkg = JSON.parse(read(path.join(context.packageRoot, \"package.json\")).toString());\n    const manifest = d.manifests.find((m) => m.id === p.groupId);\n    if (\n      !manifest ||\n      p.packageName !== pkg.name ||\n      p.namespace !== d.namespace ||\n      p.descriptorSha256 !== configurationAuthorizationHash(pkg.unsDatahub.processGroupRuntime) ||\n      p.packageRoot !== context.packageRoot ||\n      p.controllerName !== context.controllerName ||\n      p.stateRoot !== root ||\n      file !== path.join(root, d.namespace, \"authorizations\", p.groupId + \".json\") ||\n      p.directory !== path.join(root, d.namespace, \"admission\", p.groupId)\n    )\n      throw Error();\n    privateDirectory(root);\n    privateDirectory(path.dirname(file));\n    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256) throw Error();\n    const manifestBytes = read(path.join(context.packageRoot, manifest.file));\n    if (sha(manifestBytes) !== p.groupManifestSha256) throw Error();\n    const m = processGroupManifestSchema.parse(JSON.parse(manifestBytes.toString()));\n    if (m.id !== p.groupId) throw Error();\n    const receiver = m.processName + \"-admission\";\n    if (\n      new Set(m.profiles.map((x) => x.id)).size !== m.profiles.length ||\n      new Set(m.profiles.map((x) => x.processName)).size !== m.profiles.length ||\n      m.profiles.some((x) => x.processName === m.processName || x.processName === receiver)\n    )\n      throw Error();\n    for (const member of m.profiles) {\n      const f = path.resolve(context.packageRoot, path.dirname(manifest.file), member.mappingFile);\n      if (!f.startsWith(context.packageRoot + path.sep) || sha(read(f)) !== member.mappingSha256) throw Error();\n    }\n    const expected = new Map([\n      ...m.profiles.map((x) => [x.processName, \"source\"] as const),\n      [m.processName, \"target\"] as const,\n      [receiver, \"receiver\"] as const,\n    ]);\n    if (\n      p.placements.length !== expected.size ||\n      new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n      new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n      p.placements.some((x) => expected.get(x.processName) !== x.role)\n    )\n      throw Error();\n    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n    const c = normalizeProcessGroupConfiguration(context.rawConfiguration, d),\n      j = c.journal as Record<string, unknown> | undefined,\n      k = c.publisher;\n    if (\n      !entry ||\n      !c.matches ||\n      entry.processName !== c.uns?.[\"processName\"] ||\n      entry.configurationSha256 !== configurationAuthorizationHash(context.rawConfiguration) ||\n      !j ||\n      j[\"directory\"] !== p.directory ||\n      (j[\"journalId\"] ?? null) !== p.journalId ||\n      j[\"groupManifest\"] !== manifest.file\n    )\n      throw Error();\n    if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null) throw Error();\n    if (entry.role === \"receiver\" ? c.runtimeRole !== \"admission\" : c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") throw Error();\n    const member = m.profiles.find((x) => x.processName === entry.processName),\n      mapping = path.resolve(context.packageRoot, String(k[\"mappingFile\"]));\n    if (\n      entry.role !== \"source\"\n        ? k[\"groupManifest\"] !== manifest.file\n        : k[\"groupManifest\"] !== undefined ||\n          k[\"dataGroup\"] !== member?.dataGroup ||\n          !mapping.startsWith(context.packageRoot + path.sep) ||\n          sha(read(mapping)) !== member?.mappingSha256\n    )\n      throw Error();\n    const result = Object.freeze({\n      sha256: sha(bytes),\n      file,\n      directory: p.directory,\n      journalId: p.journalId,\n      role: entry.role,\n      groupId: p.groupId,\n      groupProcessName: m.processName,\n      namespace: d.namespace,\n    });\n    if (!candidate) issued.add(result);\n    return result;\n  } catch {\n    throw Error(\"Process-group runtime authorization is missing, changed or does not match this installed placement; review required\");\n  }\n}\n/** Live authority always comes from the current canonical private policy. */\nexport function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization {\n  return verifyRuntimePolicy(context);\n}\n/** Review only: never issues an authorization accepted by runtime/launch checks. */\nexport function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void {\n  verifyRuntimePolicy(context, bytes);\n}\nexport function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string {\n  const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n  if (!root) throw Error(\"Missing process-group state root\");\n  return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);\n}\nexport const authorizeHvRuntime = authorizeProcessGroupRuntime;\nexport function authorizeConfiguredProcessGroupRuntime(\n  pkg: string,\n  dir: string,\n  raw: Record<string, unknown>,\n  controllerName: string,\n  initialize = false,\n) {\n  return authorizeProcessGroupRuntime({\n    packageRoot: pkg,\n    instanceDirectory: dir,\n    rawConfiguration: raw,\n    channels: resolvedProcessGroupChannels(raw),\n    controllerName,\n    initialize,\n  });\n}\nexport function assertProcessGroupJournalAuthorization(\n  value: ProcessGroupAuthorization | undefined,\n  directory: string,\n  journalId: string | undefined,\n): void {\n  if (value && issued.has(value)) {\n    if (value.directory !== directory || value.journalId !== (journalId ?? null) || sha(read(value.file, true)) !== value.sha256)\n      throw Error(\"Exact reviewed process-group authorization required\");\n    return;\n  }\n  legacy.assertHvJournalAuthorization(value as legacy.HvAuthorization | undefined, directory, journalId);\n}\nexport const assertHvJournalAuthorization = assertProcessGroupJournalAuthorization;\nexport function assertProcessGroupStateMount(value: ProcessGroupAuthorization, root: string): void {\n  if (!issued.has(value)) {\n    legacy.assertHvStateMount(value as legacy.HvAuthorization, root);\n    return;\n  }\n  assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n  if (process.platform !== \"linux\" || !(\"namespace\" in value) || value.directory !== path.join(root, value.namespace, \"admission\", value.generationId ?? value.groupId))\n    throw Error(\"Process group requires its reviewed Linux state mount\");\n  const mount = fs\n    .readFileSync(\"/proc/self/mountinfo\", \"utf8\")\n    .split(\"\\n\")\n    .map((l) => l.split(\" \"))\n    .filter((f) => f[4] === root)\n    .at(-1);\n  if (!mount || !mount[5]?.split(\",\").includes(\"rw\") || ![\"xfs\", \"ext4\", \"btrfs\", \"zfs\"].includes(mount[mount.indexOf(\"-\") + 1] ?? \"\"))\n    throw Error(\"Process-group state root must be an explicit writable local Linux filesystem mount\");\n}\nexport const assertHvStateMount = assertProcessGroupStateMount;\nexport function assertProcessGroupTargetLaunch(\n  value: ProcessGroupAuthorization,\n  dir: string,\n  operationId: string | undefined,\n  launchId: string | undefined,\n): void {\n  if (!issued.has(value)) {\n    legacy.assertHvTargetLaunch(value as legacy.HvAuthorization, dir, operationId, launchId);\n    return;\n  }\n  if (value.role !== \"target\") return;\n  try {\n    assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n    const r = JSON.parse(read(path.join(dir, \"process-group-reservation.json\"), true).toString());\n    if (\n      !z.string().uuid().safeParse(operationId).success ||\n      !z.string().uuid().safeParse(launchId).success ||\n      r.operationId !== operationId ||\n      r.role !== \"target\" ||\n      r.lastLaunch?.launchId !== launchId ||\n      !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||\n      !digest.safeParse(r.configurationChecksum).success\n    )\n      throw Error();\n    if (\"configurationGroupSha256\" in value && value.configurationGroupSha256 !== undefined &&\n      (r.configurationGroupSha256 !== value.configurationGroupSha256 || r.generationId !== value.generationId)) throw Error();\n  } catch {\n    throw Error(\"Target requires its exact reviewed group reservation and launch identity\");\n  }\n}\nexport const assertHvTargetLaunch = assertProcessGroupTargetLaunch;\n"]}

package/dist/runtime/process-group-backup-contract.d.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+/** SDK-owned fixed resource budget; hosts never accept it from an operation request. */
+export declare const processGroupBackupLimits: Readonly<{
+    schemaVersion: 1;
+    maximumJournals: number;
+    maximumManifestBytes: 262144;
+    maximumSnapshotBytes: 536870912;
+    maximumCapsuleBytes: 1073741824;
+}>;
+/** Public coverage only; identities, checkpoints and payloads remain encrypted. */
+export declare const processGroupStateBackupSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    state: z.ZodEnum<{
+        included: "included";
+        empty: "empty";
+    }>;
+    rootSha256: z.ZodString;
+    journals: z.ZodNumber;
+    bytes: z.ZodNumber;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+//# sourceMappingURL=process-group-backup-contract.d.ts.map

package/dist/runtime/process-group-backup-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-backup-contract.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-backup-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,wFAAwF;AACxF,eAAO,MAAM,wBAAwB;;;;;;EAMlB,CAAC;AAEpB,mFAAmF;AACnF,eAAO,MAAM,6BAA6B;;;;;;;;;;kBAOgC,CAAC"}

package/dist/runtime/process-group-backup-contract.js

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import contract from "./process-group-backup-contract.json" with { type: "json" };
+/** SDK-owned fixed resource budget; hosts never accept it from an operation request. */
+export const processGroupBackupLimits = Object.freeze(z.strictObject({
+    schemaVersion: z.literal(1),
+    maximumJournals: z.number().int().min(1).max(128),
+    maximumManifestBytes: z.literal(262144),
+    maximumSnapshotBytes: z.literal(536870912),
+    maximumCapsuleBytes: z.literal(1073741824),
+}).parse(contract));
+/** Public coverage only; identities, checkpoints and payloads remain encrypted. */
+export const processGroupStateBackupSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    state: z.enum(["included", "empty"]),
+    rootSha256: z.string().regex(/^[a-f0-9]{64}$/),
+    journals: z.number().int().min(0).max(processGroupBackupLimits.maximumJournals),
+    bytes: z.number().int().positive().max(processGroupBackupLimits.maximumCapsuleBytes),
+    sha256: z.string().regex(/^[a-f0-9]{64}$/),
+}).refine(v => v.state === "included" ? v.journals > 0 : v.journals === 0);
+//# sourceMappingURL=process-group-backup-contract.js.map

package/dist/runtime/process-group-backup-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-backup-contract.js","sourceRoot":"","sources":["../../src/runtime/process-group-backup-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,QAAQ,MAAM,sCAAsC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAElF,wFAAwF;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IACnE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CAC3C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAEpB,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,eAAe,CAAC;IAC/E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC;IACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CAC3C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport contract from \"./process-group-backup-contract.json\" with { type: \"json\" };\n\n/** SDK-owned fixed resource budget; hosts never accept it from an operation request. */\nexport const processGroupBackupLimits = Object.freeze(z.strictObject({\n  schemaVersion: z.literal(1),\n  maximumJournals: z.number().int().min(1).max(128),\n  maximumManifestBytes: z.literal(262144),\n  maximumSnapshotBytes: z.literal(536870912),\n  maximumCapsuleBytes: z.literal(1073741824),\n}).parse(contract));\n\n/** Public coverage only; identities, checkpoints and payloads remain encrypted. */\nexport const processGroupStateBackupSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  state: z.enum([\"included\", \"empty\"]),\n  rootSha256: z.string().regex(/^[a-f0-9]{64}$/),\n  journals: z.number().int().min(0).max(processGroupBackupLimits.maximumJournals),\n  bytes: z.number().int().positive().max(processGroupBackupLimits.maximumCapsuleBytes),\n  sha256: z.string().regex(/^[a-f0-9]{64}$/),\n}).refine(v => v.state === \"included\" ? v.journals > 0 : v.journals === 0);\n"]}

package/dist/runtime/process-group-backup-contract.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": 1,
+  "maximumJournals": 32,
+  "maximumManifestBytes": 262144,
+  "maximumSnapshotBytes": 536870912,
+  "maximumCapsuleBytes": 1073741824
+}

package/dist/runtime/process-group-configured-upgrade.d.ts

@@ -0,0 +1,4 @@
+import type { PreparedGroupUpgrade, UpgradeConfigurations } from "./process-group-upgrade.js";
+/** Same generation, different paired artifacts. Never initializes or rewrites the journal. */
+export declare function reviewInstalledConfigurationGroupUpgrade(configs: UpgradeConfigurations, controllerName: string, stateRoot: string, excludedUnsFields?: readonly string[]): PreparedGroupUpgrade;
+//# sourceMappingURL=process-group-configured-upgrade.d.ts.map

package/dist/runtime/process-group-configured-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-configured-upgrade.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-configured-upgrade.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAA6B,oBAAoB,EAAwB,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE/I,8FAA8F;AAC9F,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,oBAAoB,CAyGtB"}

package/dist/runtime/process-group-configured-upgrade.js

@@ -0,0 +1,107 @@
+import path from "node:path";
+import { configurationGroupAuthorizationSchema } from "./configuration-group-authorization.js";
+import { configurationResourceHash } from "./configuration-group-contract.js";
+import { authorizeProcessGroupRuntime, processGroupAuthorizationFile, validateProcessGroupPolicyCandidate } from "./process-group-authorization.js";
+import { resolvedProcessGroupChannels } from "./process-group-contract.js";
+import { describeInstalledProcessGroupGeneration, inspectGenerationJournal } from "./process-group-generation.js";
+import { groupArtifactHash, groupChannelsHash, configurationAuthorizationHash as hash, readProcessGroupResource as read, sha256, } from "./process-group-resources.js";
+/** Same generation, different paired artifacts. Never initializes or rewrites the journal. */
+export function reviewInstalledConfigurationGroupUpgrade(configs, controllerName, stateRoot, excludedUnsFields = []) {
+    const context = (c) => ({
+        packageRoot: c.packageRoot,
+        instanceDirectory: c.instanceDirectory,
+        rawConfiguration: c.raw,
+        channels: resolvedProcessGroupChannels(c.resolved),
+        controllerName,
+        stateRoot,
+    });
+    const source = configs.source.publisher, target = configs.target.publisher, a = describeInstalledProcessGroupGeneration(source), b = describeInstalledProcessGroupGeneration(target);
+    if (a.d.protocolVersion !== 2 || b.d.protocolVersion !== 2 || a.d.namespace !== b.d.namespace || hash(a.reference) !== hash(b.reference))
+        throw Error("Unchanged configuration generation required; review resource changes as a separate generation");
+    const pkg = (c) => JSON.parse(read(path.join(c.packageRoot, "package.json")).toString()), sourcePackage = pkg(source), targetPackage = pkg(target);
+    if (!sourcePackage.version || !targetPackage.version || sourcePackage.version === targetPackage.version)
+        throw Error("Two different installed paired versions required");
+    const old = authorizeProcessGroupRuntime(context(source));
+    const sourcePolicy = read(old.file, true), previous = configurationGroupAuthorizationSchema.parse(JSON.parse(sourcePolicy.toString()));
+    const portable = (raw) => {
+        const copy = structuredClone(raw), uns = { ...copy["uns"] };
+        for (const key of excludedUnsFields)
+            delete uns[key];
+        copy["uns"] = uns;
+        return hash(copy);
+    };
+    const members = [];
+    const directories = new Set();
+    for (const side of ["source", "target"])
+        for (const role of ["publisher", "receiver"]) {
+            const c = configs[side][role], g = describeInstalledProcessGroupGeneration(c), installed = pkg(c);
+            if (g.d.protocolVersion !== 2 ||
+                g.d.namespace !== a.d.namespace ||
+                installed.name !== sourcePackage.name ||
+                installed.version !== (side === "source" ? sourcePackage.version : targetPackage.version) ||
+                c.packageRoot !== configs[side].publisher.packageRoot ||
+                directories.has(c.instanceDirectory) ||
+                hash(g.reference) !== hash(a.reference) ||
+                g.normalized.uns["processName"] !== (role === "publisher" ? a.processName : a.receiverProcessName) ||
+                (role === "receiver"
+                    ? g.normalized.runtimeRole !== "admission"
+                    : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== "publisher") ||
+                portable(c.raw) !== portable(configs.source[role].raw) ||
+                groupChannelsHash(g.channels) !== groupChannelsHash(a.channels) ||
+                processGroupAuthorizationFile(context(c)) !== old.file)
+                throw Error("Exact paired configuration, resources, broker identity and retained journal required");
+            directories.add(c.instanceDirectory);
+            if (side === "source") {
+                const proof = authorizeProcessGroupRuntime(context(c));
+                if (proof.role !== (role === "publisher" ? "target" : "receiver") || proof.sha256 !== sha256(sourcePolicy))
+                    throw Error("Exact authorized source pair required");
+            }
+            members.push({
+                side,
+                role,
+                processName: String(g.normalized.uns["processName"]),
+                configurationSha256: hash(c.raw),
+                artifactSha256: groupArtifactHash(c.packageRoot),
+            });
+        }
+    const policy = configurationGroupAuthorizationSchema.parse({
+        ...previous,
+        packageRoot: target.packageRoot,
+        descriptorSha256: configurationResourceHash(targetPackage.unsDatahub.processGroupConfigurationRuntime),
+        artifactSha256: groupArtifactHash(target.packageRoot),
+        placements: [
+            ...previous.placements.filter((p) => p.role === "source"),
+            ...["publisher", "receiver"].map((role) => ({
+                instanceId: path.basename(configs.target[role].instanceDirectory),
+                processName: members.find((m) => m.side === "target" && m.role === role).processName,
+                role: role === "publisher" ? "target" : "receiver",
+                configurationSha256: configurationResourceHash(configs.target[role].raw),
+            })),
+        ],
+    });
+    const targetPolicy = Buffer.from(JSON.stringify(policy));
+    for (const role of ["publisher", "receiver"])
+        validateProcessGroupPolicyCandidate(context(configs.target[role]), targetPolicy);
+    inspectGenerationJournal(a.reference); // Pending, previously completed work is valid and must remain bound.
+    if (sha256(read(old.file, true)) !== sha256(sourcePolicy))
+        throw Error("Source policy changed during review");
+    return {
+        review: {
+            protocolVersion: 1,
+            namespace: a.d.namespace,
+            groupId: a.id,
+            policyFile: old.file,
+            sourcePolicySha256: sha256(sourcePolicy),
+            targetPolicySha256: sha256(targetPolicy),
+            journalId: a.reference.journalId,
+            directory: a.reference.directory,
+            journalContractSha256: a.reference.journalContractSha256,
+            profiles: a.reference.profiles,
+            retainedJournal: a.reference,
+            members,
+        },
+        sourcePolicy,
+        targetPolicy,
+    };
+}
+//# sourceMappingURL=process-group-configured-upgrade.js.map

package/dist/runtime/process-group-configured-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-configured-upgrade.js","sourceRoot":"","sources":["../../src/runtime/process-group-configured-upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AACpJ,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,uCAAuC,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAClH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,8BAA8B,IAAI,IAAI,EACtC,wBAAwB,IAAI,IAAI,EAChC,MAAM,GACP,MAAM,8BAA8B,CAAC;AAGtC,8FAA8F;AAC9F,MAAM,UAAU,wCAAwC,CACtD,OAA8B,EAC9B,cAAsB,EACtB,SAAiB,EACjB,oBAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,gBAAgB,EAAE,CAAC,CAAC,GAAG;QACvB,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,cAAc;QACd,SAAS;KACV,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EACrC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EACjC,CAAC,GAAG,uCAAuC,CAAC,MAAM,CAAC,EACnD,CAAC,GAAG,uCAAuC,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACtI,MAAM,KAAK,CAAC,+FAA+F,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAC5G,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAC3B,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO,KAAK,aAAa,CAAC,OAAO;QACrG,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EACvC,QAAQ,GAAG,qCAAqC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,CAAC,GAA4B,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,EAC/B,GAAG,GAAG,EAAE,GAAI,IAAI,CAAC,KAAK,CAA6B,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,iBAAiB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAU,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAC3B,CAAC,GAAG,uCAAuC,CAAC,CAAC,CAAC,EAC9C,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IACE,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC;gBACzB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC/B,SAAS,CAAC,IAAI,KAAK,aAAa,CAAC,IAAI;gBACrC,SAAS,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;gBACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW;gBACrD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACpC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;gBAClG,CAAC,IAAI,KAAK,UAAU;oBAClB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW;oBAC1C,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC;gBACvF,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBACtD,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC/D,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI;gBAEtD,MAAM,KAAK,CAAC,sFAAsF,CAAC,CAAC;YACtG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC;oBACxG,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,IAAI;gBACJ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACpD,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAChC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,MAAM,MAAM,GAAG,qCAAqC,CAAC,KAAK,CAAC;QACzD,GAAG,QAAQ;QACX,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,yBAAyB,CAAC,aAAa,CAAC,UAAU,CAAC,gCAAgC,CAAC;QACtG,cAAc,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;QACrD,UAAU,EAAE;YACV,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;YACzD,GAAI,CAAC,WAAW,EAAE,UAAU,CAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrD,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC;gBACjE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC,WAAW;gBACrF,IAAI,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;gBAClD,mBAAmB,EAAE,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;aACzE,CAAC,CAAC;SACJ;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAU;QAAE,mCAAmC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACxI,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qEAAqE;IAC5G,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC9G,OAAO;QACL,MAAM,EAAE;YACN,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YACxB,OAAO,EAAE,CAAC,CAAC,EAAE;YACb,UAAU,EAAE,GAAG,CAAC,IAAI;YACpB,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC;YACxC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC;YACxC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;YAChC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB;YACxD,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ;YAC9B,eAAe,EAAE,CAAC,CAAC,SAAS;YAC5B,OAAO;SACR;QACD,YAAY;QACZ,YAAY;KACb,CAAC;AACJ,CAAC","sourcesContent":["import path from \"node:path\";\n\nimport { configurationGroupAuthorizationSchema } from \"./configuration-group-authorization.js\";\nimport { configurationResourceHash } from \"./configuration-group-contract.js\";\nimport { authorizeProcessGroupRuntime, processGroupAuthorizationFile, validateProcessGroupPolicyCandidate } from \"./process-group-authorization.js\";\nimport { resolvedProcessGroupChannels } from \"./process-group-contract.js\";\nimport { describeInstalledProcessGroupGeneration, inspectGenerationJournal } from \"./process-group-generation.js\";\nimport {\n  groupArtifactHash,\n  groupChannelsHash,\n  configurationAuthorizationHash as hash,\n  readProcessGroupResource as read,\n  sha256,\n} from \"./process-group-resources.js\";\nimport type { GroupVersionUpgradeReview, PreparedGroupUpgrade, UpgradeConfiguration, UpgradeConfigurations } from \"./process-group-upgrade.js\";\n\n/** Same generation, different paired artifacts. Never initializes or rewrites the journal. */\nexport function reviewInstalledConfigurationGroupUpgrade(\n  configs: UpgradeConfigurations,\n  controllerName: string,\n  stateRoot: string,\n  excludedUnsFields: readonly string[] = [],\n): PreparedGroupUpgrade {\n  const context = (c: UpgradeConfiguration) => ({\n    packageRoot: c.packageRoot,\n    instanceDirectory: c.instanceDirectory,\n    rawConfiguration: c.raw,\n    channels: resolvedProcessGroupChannels(c.resolved),\n    controllerName,\n    stateRoot,\n  });\n  const source = configs.source.publisher,\n    target = configs.target.publisher,\n    a = describeInstalledProcessGroupGeneration(source),\n    b = describeInstalledProcessGroupGeneration(target);\n  if (a.d.protocolVersion !== 2 || b.d.protocolVersion !== 2 || a.d.namespace !== b.d.namespace || hash(a.reference) !== hash(b.reference))\n    throw Error(\"Unchanged configuration generation required; review resource changes as a separate generation\");\n  const pkg = (c: UpgradeConfiguration) => JSON.parse(read(path.join(c.packageRoot, \"package.json\")).toString()),\n    sourcePackage = pkg(source),\n    targetPackage = pkg(target);\n  if (!sourcePackage.version || !targetPackage.version || sourcePackage.version === targetPackage.version)\n    throw Error(\"Two different installed paired versions required\");\n  const old = authorizeProcessGroupRuntime(context(source));\n  const sourcePolicy = read(old.file, true),\n    previous = configurationGroupAuthorizationSchema.parse(JSON.parse(sourcePolicy.toString()));\n  const portable = (raw: Record<string, unknown>) => {\n    const copy = structuredClone(raw),\n      uns = { ...(copy[\"uns\"] as Record<string, unknown>) };\n    for (const key of excludedUnsFields) delete uns[key];\n    copy[\"uns\"] = uns;\n    return hash(copy);\n  };\n  const members: GroupVersionUpgradeReview[\"members\"] = [];\n  const directories = new Set<string>();\n  for (const side of [\"source\", \"target\"] as const)\n    for (const role of [\"publisher\", \"receiver\"] as const) {\n      const c = configs[side][role],\n        g = describeInstalledProcessGroupGeneration(c),\n        installed = pkg(c);\n      if (\n        g.d.protocolVersion !== 2 ||\n        g.d.namespace !== a.d.namespace ||\n        installed.name !== sourcePackage.name ||\n        installed.version !== (side === \"source\" ? sourcePackage.version : targetPackage.version) ||\n        c.packageRoot !== configs[side].publisher.packageRoot ||\n        directories.has(c.instanceDirectory) ||\n        hash(g.reference) !== hash(a.reference) ||\n        g.normalized.uns[\"processName\"] !== (role === \"publisher\" ? a.processName : a.receiverProcessName) ||\n        (role === \"receiver\"\n          ? g.normalized.runtimeRole !== \"admission\"\n          : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== \"publisher\") ||\n        portable(c.raw) !== portable(configs.source[role].raw) ||\n        groupChannelsHash(g.channels) !== groupChannelsHash(a.channels) ||\n        processGroupAuthorizationFile(context(c)) !== old.file\n      )\n        throw Error(\"Exact paired configuration, resources, broker identity and retained journal required\");\n      directories.add(c.instanceDirectory);\n      if (side === \"source\") {\n        const proof = authorizeProcessGroupRuntime(context(c));\n        if (proof.role !== (role === \"publisher\" ? \"target\" : \"receiver\") || proof.sha256 !== sha256(sourcePolicy))\n          throw Error(\"Exact authorized source pair required\");\n      }\n      members.push({\n        side,\n        role,\n        processName: String(g.normalized.uns[\"processName\"]),\n        configurationSha256: hash(c.raw),\n        artifactSha256: groupArtifactHash(c.packageRoot),\n      });\n    }\n  const policy = configurationGroupAuthorizationSchema.parse({\n    ...previous,\n    packageRoot: target.packageRoot,\n    descriptorSha256: configurationResourceHash(targetPackage.unsDatahub.processGroupConfigurationRuntime),\n    artifactSha256: groupArtifactHash(target.packageRoot),\n    placements: [\n      ...previous.placements.filter((p) => p.role === \"source\"),\n      ...([\"publisher\", \"receiver\"] as const).map((role) => ({\n        instanceId: path.basename(configs.target[role].instanceDirectory),\n        processName: members.find((m) => m.side === \"target\" && m.role === role)!.processName,\n        role: role === \"publisher\" ? \"target\" : \"receiver\",\n        configurationSha256: configurationResourceHash(configs.target[role].raw),\n      })),\n    ],\n  });\n  const targetPolicy = Buffer.from(JSON.stringify(policy));\n  for (const role of [\"publisher\", \"receiver\"] as const) validateProcessGroupPolicyCandidate(context(configs.target[role]), targetPolicy);\n  inspectGenerationJournal(a.reference); // Pending, previously completed work is valid and must remain bound.\n  if (sha256(read(old.file, true)) !== sha256(sourcePolicy)) throw Error(\"Source policy changed during review\");\n  return {\n    review: {\n      protocolVersion: 1,\n      namespace: a.d.namespace,\n      groupId: a.id,\n      policyFile: old.file,\n      sourcePolicySha256: sha256(sourcePolicy),\n      targetPolicySha256: sha256(targetPolicy),\n      journalId: a.reference.journalId,\n      directory: a.reference.directory,\n      journalContractSha256: a.reference.journalContractSha256,\n      profiles: a.reference.profiles,\n      retainedJournal: a.reference,\n      members,\n    },\n    sourcePolicy,\n    targetPolicy,\n  };\n}\n"]}

package/dist/runtime/process-group-generation.d.ts

@@ -0,0 +1,166 @@
+import { z } from "zod";
+import type { GroupVersionUpgradeReview, PreparedGroupUpgrade, UpgradeConfiguration, UpgradeConfigurations } from "./process-group-upgrade.js";
+export declare const processGroupGenerationInputSchema: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<2>;
+    source: z.ZodObject<{
+        publisher: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+        receiver: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    target: z.ZodObject<{
+        publisher: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+        receiver: z.ZodObject<{
+            controller: z.ZodString;
+            rttNode: z.ZodString;
+            version: z.ZodString;
+            instanceId: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    acknowledgeInputPause: z.ZodLiteral<true>;
+    acknowledgeResourceReview: z.ZodLiteral<true>;
+    acknowledgePossibleReplay: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type ProcessGroupGenerationInput = z.infer<typeof processGroupGenerationInputSchema>;
+export type GenerationJournalReference = {
+    directory: string;
+    journalId: string;
+    journalContractSha256: string;
+    generationId: string;
+    groupSha256?: string;
+    contractVersion: 1 | 2;
+    maxRecords: number;
+    maxBytes: number;
+    minFreeBytes: number;
+    profiles: Array<{
+        processName: string;
+        mappingSha256: string;
+        dataGroup: string;
+    }>;
+};
+export type GroupGenerationReview = Omit<GroupVersionUpgradeReview, "protocolVersion"> & {
+    protocolVersion: 2;
+    sourcePolicyFile: string;
+    sourceJournal: GenerationJournalReference;
+    targetJournal: GenerationJournalReference;
+    delivery: {
+        inputPausePossible: true;
+        retainedBrokerSessionMayReplay: true;
+        exactlyOnceOutput: false;
+    };
+    resourceChanges: Array<{
+        processName: string;
+        beforeSha256: string;
+        afterSha256: string;
+        dataGroup: string;
+    }>;
+};
+/** Bounded read-only storage evidence; no initializer, rewriting or replay. */
+export declare function inspectGenerationJournal(reference: GenerationJournalReference): {
+    records: number;
+    bytes: number;
+    admitted: number;
+    completed: number;
+    lastSequence: number;
+};
+/** Recheck immediately before the first launch; initialization is never silently reused. */
+export declare function inspectPristineGenerationJournal(reference: GenerationJournalReference): {
+    records: number;
+    bytes: number;
+    admitted: number;
+    completed: number;
+    lastSequence: number;
+};
+/** Data-only normalized revision and immutable journal contract shared by reviewed transitions. */
+export declare function describeInstalledProcessGroupGeneration(c: UpgradeConfiguration): {
+    d: {
+        protocolVersion: 2;
+        namespace: string;
+        publisherPath: string[];
+        groupPath: string[];
+        memberPath: string[];
+        journalPath: string[];
+        runtimeRolePath: string[];
+        receiverRole: string;
+        match?: {
+            path: string[];
+            value: string;
+        };
+    };
+    normalized: {
+        matches: boolean;
+        uns: Record<string, unknown>;
+        publisher: Record<string, unknown>;
+        journal: unknown;
+        runtimeRole: unknown;
+        configurationSnapshot: import("./configuration-group-contract.js").ConfigurationGroupSnapshot;
+    };
+    channels: import("../index.js").ResolvedMqttChannel[];
+    id: string;
+    processName: string;
+    receiverProcessName: string;
+    inputTopic: string;
+    reference: {
+        directory: string;
+        journalId: string;
+        generationId: string;
+        groupSha256: string;
+        contractVersion: 2;
+        journalContractSha256: string;
+        maxRecords: number;
+        maxBytes: number;
+        minFreeBytes: number;
+        profiles: {
+            processName: string;
+            mappingSha256: string;
+            dataGroup: string;
+        }[];
+    };
+} | {
+    d: import("./process-group-contract.js").ProcessGroupRuntimeDescriptor;
+    normalized: {
+        matches: boolean;
+        uns: Record<string, unknown>;
+        publisher: Record<string, unknown>;
+        journal: unknown;
+        runtimeRole: unknown;
+        configurationSnapshot: import("./configuration-group-contract.js").ConfigurationGroupSnapshot;
+    };
+    channels: import("../index.js").ResolvedMqttChannel[];
+    id: string;
+    processName: string;
+    receiverProcessName: string;
+    inputTopic: string;
+    reference: {
+        directory: string;
+        journalId: string;
+        generationId: string;
+        contractVersion: 1;
+        journalContractSha256: string;
+        maxRecords: number;
+        maxBytes: number;
+        minFreeBytes: number;
+        profiles: {
+            processName: string;
+            mappingSha256: string;
+            dataGroup: string;
+        }[];
+        groupSha256?: undefined;
+    };
+};
+/** Operator reviews opaque before/after digests; business equivalence is application-owned. */
+export declare function reviewInstalledProcessGroupGeneration(configs: UpgradeConfigurations, controllerName: string, stateRoot: string, excludedUnsFields?: readonly string[]): PreparedGroupUpgrade;
+//# sourceMappingURL=process-group-generation.d.ts.map

package/dist/runtime/process-group-generation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-generation.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-generation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAG/I,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkB1C,CAAC;AACL,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpF,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,GAAG;IACvF,eAAe,EAAE,CAAC,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,0BAA0B,CAAC;IAC1C,aAAa,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,EAAE;QAAE,kBAAkB,EAAE,IAAI,CAAC;QAAC,8BAA8B,EAAE,IAAI,CAAC;QAAC,iBAAiB,EAAE,KAAK,CAAA;KAAE,CAAC;IACvG,eAAe,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/G,CAAC;AAEF,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,0BAA0B;;;;;;EAyE7E;AAED,4FAA4F;AAC5F,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,0BAA0B;;;;;;EAKrF;AAED,mGAAmG;AACnG,wBAAgB,uCAAuC,CAAC,CAAC,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D9E;AAED,+FAA+F;AAC/F,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,qBAAqB,EAC9B,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,oBAAoB,CAyHtB"}