@uns-kit/core 3.0.28 → 3.0.31

package/dist/runtime/process-group-generation.js

@@ -0,0 +1,278 @@
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { z } from "zod";
+import { configurationGroupJournalContract, configurationGroupJournalSchema } from "./configuration-group-contract.js";
+import { authorizeProcessGroupRuntime } from "./process-group-authorization.js";
+import { processGroupManifestSchema } from "./process-group-authorization.js";
+import { processGroupJournalContract, processGroupJournalSchema, processGroupSourceIdentity, resolvedProcessGroupChannels, } from "./process-group-contract.js";
+import { groupPlacementSchema, placementKey } from "./process-group-control-contract.js";
+import { groupArtifactHash, groupChannelsHash, configurationAuthorizationHash as hash, readProcessGroupResource as read, sha256, } from "./process-group-resources.js";
+import { normalizeRuntimeProcessGroup, selectedProcessGroupDescriptor } from "./process-group-runtime-selection.js";
+const pair = z.strictObject({ publisher: groupPlacementSchema, receiver: groupPlacementSchema });
+export const processGroupGenerationInputSchema = z
+    .strictObject({
+    protocolVersion: z.literal(2),
+    source: pair,
+    target: pair,
+    acknowledgeInputPause: z.literal(true),
+    acknowledgeResourceReview: z.literal(true),
+    acknowledgePossibleReplay: z.literal(true),
+})
+    .superRefine((v, c) => {
+    const all = [v.source.publisher, v.source.receiver, v.target.publisher, v.target.receiver];
+    if (new Set(all.map(placementKey)).size !== 4 ||
+        all.some((p) => p.controller !== all[0].controller || p.rttNode !== all[0].rttNode) ||
+        v.source.publisher.version !== v.source.receiver.version ||
+        v.target.publisher.version !== v.target.receiver.version)
+        c.addIssue({ code: "custom", message: "Four distinct paired placements on one package/controller required" });
+});
+/** Bounded read-only storage evidence; no initializer, rewriting or replay. */
+export function inspectGenerationJournal(reference) {
+    const file = path.join(reference.directory, "admission.sqlite"), stat = fs.lstatSync(file);
+    if (fs.realpathSync(file) !== file ||
+        !stat.isFile() ||
+        stat.nlink !== 1 ||
+        stat.uid !== process.getuid?.() ||
+        (stat.mode & 0o077) !== 0 ||
+        stat.size > 512 * 1024 * 1024)
+        throw Error("Private retained generation journal required");
+    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    const db = new DatabaseSync(file, { readOnly: true });
+    try {
+        db.exec("PRAGMA query_only=ON; PRAGMA busy_timeout=1000; BEGIN");
+        const meta = Object.fromEntries(db
+            .prepare("SELECT key,value FROM metadata WHERE key IN ('id','contract')")
+            .all()
+            .map((r) => [r["key"], r["value"]]));
+        if (meta["id"] !== reference.journalId ||
+            typeof meta["contract"] !== "string" ||
+            meta["contract"].length > 1048576 ||
+            sha256(meta["contract"]) !== reference.journalContractSha256)
+            throw Error("Reviewed journal generation changed");
+        const rows = db.prepare("SELECT name,contract,completed,last_seq FROM profiles ORDER BY name").all();
+        if (rows.length !== reference.profiles.length)
+            throw Error("Journal profile set differs");
+        for (const profile of reference.profiles) {
+            const row = rows.find((r) => r["name"] === profile.processName), binding = row ? JSON.parse(String(row["contract"])) : null;
+            if (!binding ||
+                binding.processName !== profile.processName ||
+                binding.dataGroup !== profile.dataGroup ||
+                binding[reference.contractVersion === 1 ? "mappingSha256" : "resourceSha256"] !== profile.mappingSha256)
+                throw Error("Journal resource binding differs");
+        }
+        const usage = db.prepare("SELECT records,bytes,admitted FROM usage WHERE id=1").get();
+        const actual = db.prepare("SELECT count(*) records,coalesce(sum(bytes),0) bytes FROM tasks").get();
+        const numbers = [usage?.["records"], usage?.["bytes"], usage?.["admitted"], ...rows.flatMap((r) => [r["completed"], r["last_seq"]])];
+        const completed = rows.reduce((n, r) => n + Number(r["completed"]), 0);
+        if (!usage ||
+            !actual ||
+            numbers.some((n) => typeof n !== "number" || !Number.isSafeInteger(n) || n < 0) ||
+            usage["records"] !== actual["records"] ||
+            usage["bytes"] !== actual["bytes"] ||
+            !Number.isSafeInteger(completed) ||
+            Number(usage["admitted"]) !== completed + Number(usage["records"]) ||
+            rows.some((r) => (r["completed"] === 0) !== (r["last_seq"] === 0)) ||
+            Number(usage["records"]) > reference.maxRecords ||
+            Number(usage["bytes"]) > reference.maxBytes)
+            throw Error("Journal usage is unconfirmed");
+        return {
+            records: Number(usage["records"]),
+            bytes: Number(usage["bytes"]),
+            admitted: Number(usage["admitted"]),
+            completed,
+            lastSequence: rows.reduce((n, r) => Math.max(n, Number(r["last_seq"])), 0),
+        };
+    }
+    finally {
+        try {
+            db.exec("ROLLBACK");
+        }
+        finally {
+            db.close();
+        }
+    }
+}
+/** Recheck immediately before the first launch; initialization is never silently reused. */
+export function inspectPristineGenerationJournal(reference) {
+    const status = inspectGenerationJournal(reference);
+    if (status.records || status.bytes || status.admitted || status.completed || status.lastSequence)
+        throw Error("Target generation is not pristine; inspect the existing initialization outcome");
+    return status;
+}
+/** Data-only normalized revision and immutable journal contract shared by reviewed transitions. */
+export function describeInstalledProcessGroupGeneration(c) {
+    const d = selectedProcessGroupDescriptor(c.packageRoot, c.raw);
+    if (!d)
+        throw Error("Declared process group required");
+    const normalized = normalizeRuntimeProcessGroup(c.raw, d);
+    if (!normalized.matches)
+        throw Error("Runtime selector differs");
+    const channels = resolvedProcessGroupChannels(c.resolved), sourceIdentity = processGroupSourceIdentity(channels[1]);
+    if (d.protocolVersion === 2) {
+        const snapshot = normalized.configurationSnapshot;
+        const journal = configurationGroupJournalSchema.parse(normalized.journal);
+        const contract = configurationGroupJournalContract(snapshot, sourceIdentity, journal, snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })));
+        return {
+            d,
+            normalized,
+            channels,
+            id: snapshot.group.id,
+            processName: snapshot.group.processName,
+            receiverProcessName: snapshot.group.receiverProcessName,
+            inputTopic: snapshot.group.inputTopic,
+            reference: {
+                directory: journal.directory,
+                journalId: journal.journalId,
+                generationId: journal.generationId,
+                groupSha256: snapshot.sha256,
+                contractVersion: 2,
+                journalContractSha256: sha256(contract),
+                maxRecords: journal.maxRecords,
+                maxBytes: journal.maxBytes,
+                minFreeBytes: journal.minFreeBytes,
+                profiles: snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, mappingSha256: resourceSha256, dataGroup })),
+            },
+        };
+    }
+    const journal = processGroupJournalSchema.parse(normalized.journal);
+    if (!d.manifests.some((m) => m.file === journal.groupManifest))
+        throw Error("Registered file group required");
+    const group = processGroupManifestSchema.parse(JSON.parse(read(path.resolve(c.packageRoot, journal.groupManifest)).toString()));
+    const contract = processGroupJournalContract(sourceIdentity, journal, group.profiles);
+    return {
+        d,
+        normalized,
+        channels,
+        id: group.id,
+        processName: group.processName,
+        receiverProcessName: group.processName + "-admission",
+        inputTopic: group.inputTopic,
+        reference: {
+            directory: journal.directory,
+            journalId: journal.journalId,
+            generationId: group.id,
+            contractVersion: 1,
+            journalContractSha256: sha256(contract),
+            maxRecords: journal.maxRecords,
+            maxBytes: journal.maxBytes,
+            minFreeBytes: journal.minFreeBytes,
+            profiles: group.profiles.map(({ processName, mappingSha256, dataGroup }) => ({ processName, mappingSha256, dataGroup })),
+        },
+    };
+}
+/** Operator reviews opaque before/after digests; business equivalence is application-owned. */
+export function reviewInstalledProcessGroupGeneration(configs, controllerName, stateRoot, excludedUnsFields = []) {
+    const context = (c) => ({
+        packageRoot: c.packageRoot,
+        instanceDirectory: c.instanceDirectory,
+        rawConfiguration: c.raw,
+        channels: resolvedProcessGroupChannels(c.resolved),
+        controllerName,
+        stateRoot,
+    });
+    const a = describeInstalledProcessGroupGeneration(configs.source.publisher), b = describeInstalledProcessGroupGeneration(configs.target.publisher);
+    if (b.d.protocolVersion !== 2 ||
+        a.d.namespace !== b.d.namespace ||
+        a.id !== b.id ||
+        a.processName !== b.processName ||
+        a.receiverProcessName !== b.receiverProcessName ||
+        a.inputTopic !== b.inputTopic ||
+        a.reference.directory === b.reference.directory ||
+        !a.reference.journalId ||
+        !b.reference.journalId ||
+        a.reference.journalId === b.reference.journalId ||
+        a.reference.maxRecords !== b.reference.maxRecords ||
+        a.reference.maxBytes !== b.reference.maxBytes ||
+        a.reference.minFreeBytes !== b.reference.minFreeBytes)
+        throw Error("Distinct bounded generations with the same process/input identity required");
+    const policyFiles = {}, policies = {};
+    const members = [];
+    const portable = (raw, d) => {
+        const copy = structuredClone(raw), uns = { ...copy["uns"] };
+        for (const key of excludedUnsFields)
+            delete uns[key];
+        copy["uns"] = uns;
+        for (const keys of [d.publisherPath, d.journalPath, d.runtimeRolePath]) {
+            let node = copy;
+            let present = true;
+            for (const key of keys.slice(0, -1)) {
+                const child = node[key];
+                if (child === undefined) {
+                    present = false;
+                    break;
+                }
+                if (!child || typeof child !== "object" || Array.isArray(child))
+                    throw Error("Invalid resource selector parent");
+                node = child;
+            }
+            if (present)
+                delete node[keys.at(-1)];
+        }
+        return hash(copy);
+    };
+    for (const side of ["source", "target"])
+        for (const role of ["publisher", "receiver"]) {
+            const c = configs[side][role], g = describeInstalledProcessGroupGeneration(c), expected = side === "source" ? a : b, proof = authorizeProcessGroupRuntime(context(c));
+            if (proof.role !== (role === "publisher" ? "target" : "receiver") ||
+                proof.directory !== expected.reference.directory ||
+                proof.journalId !== expected.reference.journalId ||
+                hash(g.reference) !== hash(expected.reference) ||
+                g.normalized.uns["processName"] !== (role === "publisher" ? g.processName : g.receiverProcessName) ||
+                (role === "receiver"
+                    ? g.normalized.runtimeRole !== "admission"
+                    : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== "publisher"))
+                throw Error("Exact reviewed generation pair required");
+            const pkg = JSON.parse(read(path.join(c.packageRoot, "package.json")).toString());
+            if (pkg.name !== JSON.parse(read(path.join(configs.source.publisher.packageRoot, "package.json")).toString()).name ||
+                portable(c.raw, g.d) !== portable(configs.source[role].raw, a.d) ||
+                groupChannelsHash(g.channels) !== groupChannelsHash(a.channels))
+                throw Error("Configuration or broker identity changed outside the reviewed resources");
+            if (policyFiles[side] && policyFiles[side] !== proof.file)
+                throw Error("Pair policies differ");
+            policyFiles[side] = proof.file;
+            policies[side] = read(proof.file, true);
+            members.push({
+                side,
+                role,
+                processName: String(g.normalized.uns["processName"]),
+                configurationSha256: hash(c.raw),
+                artifactSha256: groupArtifactHash(c.packageRoot),
+            });
+        }
+    if (policyFiles.source === policyFiles.target)
+        throw Error("Each generation requires its own retained policy");
+    const profiles = a.reference.profiles;
+    if (profiles.length !== b.reference.profiles.length ||
+        profiles.some((p) => !b.reference.profiles.some((q) => q.processName === p.processName && q.dataGroup === p.dataGroup)))
+        throw Error("Logical profile identities or data groups changed");
+    inspectGenerationJournal(a.reference);
+    inspectPristineGenerationJournal(b.reference);
+    if (sha256(read(policyFiles.source, true)) !== sha256(policies.source) || sha256(read(policyFiles.target, true)) !== sha256(policies.target))
+        throw Error("Reviewed policies changed");
+    const review = {
+        protocolVersion: 2,
+        namespace: b.d.namespace,
+        groupId: b.id,
+        policyFile: policyFiles.target,
+        sourcePolicyFile: policyFiles.source,
+        sourcePolicySha256: sha256(policies.source),
+        targetPolicySha256: sha256(policies.target),
+        journalId: b.reference.journalId,
+        directory: b.reference.directory,
+        journalContractSha256: b.reference.journalContractSha256,
+        profiles: b.reference.profiles,
+        members,
+        sourceJournal: a.reference,
+        targetJournal: b.reference,
+        delivery: { inputPausePossible: true, retainedBrokerSessionMayReplay: true, exactlyOnceOutput: false },
+        resourceChanges: profiles.map((p) => ({
+            processName: p.processName,
+            beforeSha256: p.mappingSha256,
+            afterSha256: b.reference.profiles.find((q) => q.processName === p.processName).mappingSha256,
+            dataGroup: p.dataGroup,
+        })),
+    };
+    return { review, sourcePolicy: policies.source, targetPolicy: policies.target };
+}
+//# sourceMappingURL=process-group-generation.js.map

package/dist/runtime/process-group-generation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-group-generation.js","sourceRoot":"","sources":["../../src/runtime/process-group-generation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iCAAiC,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACvH,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,8BAA8B,IAAI,IAAI,EACtC,wBAAwB,IAAI,IAAI,EAChC,MAAM,GACP,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAGpH,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACjG,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,YAAY,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yBAAyB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACpB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3F,IACE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAE,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC;QACrF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;QACxD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;QAExD,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC,CAAC;AAClH,CAAC,CAAC,CAAC;AAuBL,+EAA+E;AAC/E,MAAM,UAAU,wBAAwB,CAAC,SAAqC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAC7D,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IACE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;QAC9B,CAAC,IAAI,CAAC,MAAM,EAAE;QACd,IAAI,CAAC,KAAK,KAAK,CAAC;QAChB,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE;QAC/B,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;QAE7B,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAiC,CAAC;IACvG,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,EAAE;aACC,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CACtC,CAAC;QACF,IACE,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,SAAS;YAClC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ;YACpC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,CAAC,qBAAqB;YAE5D,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAC,GAAG,EAAE,CAAC;QACrG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1F,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,EAC7D,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,IACE,CAAC,OAAO;gBACR,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;gBAC3C,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBACvC,OAAO,CAAC,SAAS,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,aAAa;gBAEvG,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,EAAE,CAAC;QACnG,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,IACE,CAAC,KAAK;YACN,CAAC,MAAM;YACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/E,KAAK,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC;YACtC,KAAK,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;YAClC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU;YAC/C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ;YAE3C,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,SAAS;YACT,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC3E,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gCAAgC,CAAC,SAAqC;IACpF,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY;QAC9F,MAAM,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uCAAuC,CAAC,CAAuB;IAC7E,MAAM,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC;QAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC,EACvD,cAAc,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,qBAAsB,CAAC;QACnD,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,iCAAiC,CAChD,QAAQ,EACR,cAAc,EACd,OAAO,EACP,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CACpH,CAAC;QACF,OAAO;YACL,CAAC;YACD,UAAU;YACV,QAAQ;YACR,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;YACrB,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;YACvC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;YACvD,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;YACrC,SAAS,EAAE;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAU;gBAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,QAAQ,CAAC,MAAM;gBAC5B,eAAe,EAAE,CAAU;gBAC3B,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACvC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;aAC7I;SACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC;QAAE,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,QAAQ,GAAG,2BAA2B,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtF,OAAO;QACL,CAAC;QACD,UAAU;QACV,QAAQ;QACR,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,WAAW,GAAG,YAAY;QACrD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAU;YAC7B,YAAY,EAAE,KAAK,CAAC,EAAE;YACtB,eAAe,EAAE,CAAU;YAC3B,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;SACzH;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,qCAAqC,CACnD,OAA8B,EAC9B,cAAsB,EACtB,SAAiB,EACjB,oBAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,gBAAgB,EAAE,CAAC,CAAC,GAAG;QACvB,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClD,cAAc;QACd,SAAS;KACV,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,uCAAuC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EACzE,CAAC,GAAG,uCAAuC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,IACE,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC;QACzB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC/B,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;QACb,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QAC/B,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,mBAAmB;QAC/C,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAC7B,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS;QAC/C,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;QACtB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;QACtB,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS;QAC/C,CAAC,CAAC,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU;QACjD,CAAC,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ;QAC7C,CAAC,CAAC,SAAS,CAAC,YAAY,KAAK,CAAC,CAAC,SAAS,CAAC,YAAY;QAErD,MAAM,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,EAAyC,EAC3D,QAAQ,GAAG,EAAyC,CAAC;IACvD,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,GAA4B,EAAE,CAAa,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,EAC/B,GAAG,GAAG,EAAE,GAAI,IAAI,CAAC,KAAK,CAA6B,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,iBAAiB;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM;gBACR,CAAC;gBACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACjH,IAAI,GAAG,KAAgC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAU,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAC3B,CAAC,GAAG,uCAAuC,CAAC,CAAC,CAAC,EAC9C,QAAQ,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACpC,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IACE,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC7D,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,SAAS;gBAChD,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC,SAAS;gBAChD,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;gBAClG,CAAC,IAAI,KAAK,UAAU;oBAClB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW;oBAC1C,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC;gBAEvF,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClF,IACE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI;gBAC9G,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBAChE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAE/D,MAAM,KAAK,CAAC,yEAAyE,CAAC,CAAC;YACzF,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI;gBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC/F,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,IAAI;gBACJ,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBACpD,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAChC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC;IACtC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM;QAC/C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;QAEvH,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACnE,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtC,gCAAgC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1I,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3C,MAAM,MAAM,GAA0B;QACpC,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACxB,OAAO,EAAE,CAAC,CAAC,EAAE;QACb,UAAU,EAAE,WAAW,CAAC,MAAM;QAC9B,gBAAgB,EAAE,WAAW,CAAC,MAAM;QACpC,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS;QAChC,qBAAqB,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB;QACxD,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ;QAC9B,OAAO;QACP,aAAa,EAAE,CAAC,CAAC,SAAS;QAC1B,aAAa,EAAE,CAAC,CAAC,SAAS;QAC1B,QAAQ,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE;QACtG,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAE,CAAC,aAAa;YAC7F,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClF,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { configurationGroupJournalContract, configurationGroupJournalSchema } from \"./configuration-group-contract.js\";\nimport { authorizeProcessGroupRuntime } from \"./process-group-authorization.js\";\nimport { processGroupManifestSchema } from \"./process-group-authorization.js\";\nimport {\n  processGroupJournalContract,\n  processGroupJournalSchema,\n  processGroupSourceIdentity,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport { groupPlacementSchema, placementKey } from \"./process-group-control-contract.js\";\nimport {\n  groupArtifactHash,\n  groupChannelsHash,\n  configurationAuthorizationHash as hash,\n  readProcessGroupResource as read,\n  sha256,\n} from \"./process-group-resources.js\";\nimport { normalizeRuntimeProcessGroup, selectedProcessGroupDescriptor } from \"./process-group-runtime-selection.js\";\nimport type { GroupVersionUpgradeReview, PreparedGroupUpgrade, UpgradeConfiguration, UpgradeConfigurations } from \"./process-group-upgrade.js\";\n\nconst pair = z.strictObject({ publisher: groupPlacementSchema, receiver: groupPlacementSchema });\nexport const processGroupGenerationInputSchema = z\n  .strictObject({\n    protocolVersion: z.literal(2),\n    source: pair,\n    target: pair,\n    acknowledgeInputPause: z.literal(true),\n    acknowledgeResourceReview: z.literal(true),\n    acknowledgePossibleReplay: z.literal(true),\n  })\n  .superRefine((v, c) => {\n    const all = [v.source.publisher, v.source.receiver, v.target.publisher, v.target.receiver];\n    if (\n      new Set(all.map(placementKey)).size !== 4 ||\n      all.some((p) => p.controller !== all[0]!.controller || p.rttNode !== all[0]!.rttNode) ||\n      v.source.publisher.version !== v.source.receiver.version ||\n      v.target.publisher.version !== v.target.receiver.version\n    )\n      c.addIssue({ code: \"custom\", message: \"Four distinct paired placements on one package/controller required\" });\n  });\nexport type ProcessGroupGenerationInput = z.infer<typeof processGroupGenerationInputSchema>;\nexport type GenerationJournalReference = {\n  directory: string;\n  journalId: string;\n  journalContractSha256: string;\n  generationId: string;\n  groupSha256?: string;\n  contractVersion: 1 | 2;\n  maxRecords: number;\n  maxBytes: number;\n  minFreeBytes: number;\n  profiles: Array<{ processName: string; mappingSha256: string; dataGroup: string }>;\n};\nexport type GroupGenerationReview = Omit<GroupVersionUpgradeReview, \"protocolVersion\"> & {\n  protocolVersion: 2;\n  sourcePolicyFile: string;\n  sourceJournal: GenerationJournalReference;\n  targetJournal: GenerationJournalReference;\n  delivery: { inputPausePossible: true; retainedBrokerSessionMayReplay: true; exactlyOnceOutput: false };\n  resourceChanges: Array<{ processName: string; beforeSha256: string; afterSha256: string; dataGroup: string }>;\n};\n\n/** Bounded read-only storage evidence; no initializer, rewriting or replay. */\nexport function inspectGenerationJournal(reference: GenerationJournalReference) {\n  const file = path.join(reference.directory, \"admission.sqlite\"),\n    stat = fs.lstatSync(file);\n  if (\n    fs.realpathSync(file) !== file ||\n    !stat.isFile() ||\n    stat.nlink !== 1 ||\n    stat.uid !== process.getuid?.() ||\n    (stat.mode & 0o077) !== 0 ||\n    stat.size > 512 * 1024 * 1024\n  )\n    throw Error(\"Private retained generation journal required\");\n  const { DatabaseSync } = createRequire(import.meta.url)(\"node:sqlite\") as typeof import(\"node:sqlite\");\n  const db = new DatabaseSync(file, { readOnly: true });\n  try {\n    db.exec(\"PRAGMA query_only=ON; PRAGMA busy_timeout=1000; BEGIN\");\n    const meta = Object.fromEntries(\n      db\n        .prepare(\"SELECT key,value FROM metadata WHERE key IN ('id','contract')\")\n        .all()\n        .map((r) => [r[\"key\"], r[\"value\"]]),\n    );\n    if (\n      meta[\"id\"] !== reference.journalId ||\n      typeof meta[\"contract\"] !== \"string\" ||\n      meta[\"contract\"].length > 1048576 ||\n      sha256(meta[\"contract\"]) !== reference.journalContractSha256\n    )\n      throw Error(\"Reviewed journal generation changed\");\n    const rows = db.prepare(\"SELECT name,contract,completed,last_seq FROM profiles ORDER BY name\").all();\n    if (rows.length !== reference.profiles.length) throw Error(\"Journal profile set differs\");\n    for (const profile of reference.profiles) {\n      const row = rows.find((r) => r[\"name\"] === profile.processName),\n        binding = row ? JSON.parse(String(row[\"contract\"])) : null;\n      if (\n        !binding ||\n        binding.processName !== profile.processName ||\n        binding.dataGroup !== profile.dataGroup ||\n        binding[reference.contractVersion === 1 ? \"mappingSha256\" : \"resourceSha256\"] !== profile.mappingSha256\n      )\n        throw Error(\"Journal resource binding differs\");\n    }\n    const usage = db.prepare(\"SELECT records,bytes,admitted FROM usage WHERE id=1\").get();\n    const actual = db.prepare(\"SELECT count(*) records,coalesce(sum(bytes),0) bytes FROM tasks\").get();\n    const numbers = [usage?.[\"records\"], usage?.[\"bytes\"], usage?.[\"admitted\"], ...rows.flatMap((r) => [r[\"completed\"], r[\"last_seq\"]])];\n    const completed = rows.reduce((n, r) => n + Number(r[\"completed\"]), 0);\n    if (\n      !usage ||\n      !actual ||\n      numbers.some((n) => typeof n !== \"number\" || !Number.isSafeInteger(n) || n < 0) ||\n      usage[\"records\"] !== actual[\"records\"] ||\n      usage[\"bytes\"] !== actual[\"bytes\"] ||\n      !Number.isSafeInteger(completed) ||\n      Number(usage[\"admitted\"]) !== completed + Number(usage[\"records\"]) ||\n      rows.some((r) => (r[\"completed\"] === 0) !== (r[\"last_seq\"] === 0)) ||\n      Number(usage[\"records\"]) > reference.maxRecords ||\n      Number(usage[\"bytes\"]) > reference.maxBytes\n    )\n      throw Error(\"Journal usage is unconfirmed\");\n    return {\n      records: Number(usage[\"records\"]),\n      bytes: Number(usage[\"bytes\"]),\n      admitted: Number(usage[\"admitted\"]),\n      completed,\n      lastSequence: rows.reduce((n, r) => Math.max(n, Number(r[\"last_seq\"])), 0),\n    };\n  } finally {\n    try {\n      db.exec(\"ROLLBACK\");\n    } finally {\n      db.close();\n    }\n  }\n}\n\n/** Recheck immediately before the first launch; initialization is never silently reused. */\nexport function inspectPristineGenerationJournal(reference: GenerationJournalReference) {\n  const status = inspectGenerationJournal(reference);\n  if (status.records || status.bytes || status.admitted || status.completed || status.lastSequence)\n    throw Error(\"Target generation is not pristine; inspect the existing initialization outcome\");\n  return status;\n}\n\n/** Data-only normalized revision and immutable journal contract shared by reviewed transitions. */\nexport function describeInstalledProcessGroupGeneration(c: UpgradeConfiguration) {\n  const d = selectedProcessGroupDescriptor(c.packageRoot, c.raw);\n  if (!d) throw Error(\"Declared process group required\");\n  const normalized = normalizeRuntimeProcessGroup(c.raw, d);\n  if (!normalized.matches) throw Error(\"Runtime selector differs\");\n  const channels = resolvedProcessGroupChannels(c.resolved),\n    sourceIdentity = processGroupSourceIdentity(channels[1]!);\n  if (d.protocolVersion === 2) {\n    const snapshot = normalized.configurationSnapshot!;\n    const journal = configurationGroupJournalSchema.parse(normalized.journal);\n    const contract = configurationGroupJournalContract(\n      snapshot,\n      sourceIdentity,\n      journal,\n      snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })),\n    );\n    return {\n      d,\n      normalized,\n      channels,\n      id: snapshot.group.id,\n      processName: snapshot.group.processName,\n      receiverProcessName: snapshot.group.receiverProcessName,\n      inputTopic: snapshot.group.inputTopic,\n      reference: {\n        directory: journal.directory,\n        journalId: journal.journalId!,\n        generationId: journal.generationId,\n        groupSha256: snapshot.sha256,\n        contractVersion: 2 as const,\n        journalContractSha256: sha256(contract),\n        maxRecords: journal.maxRecords,\n        maxBytes: journal.maxBytes,\n        minFreeBytes: journal.minFreeBytes,\n        profiles: snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, mappingSha256: resourceSha256, dataGroup })),\n      },\n    };\n  }\n  const journal = processGroupJournalSchema.parse(normalized.journal);\n  if (!d.manifests.some((m) => m.file === journal.groupManifest)) throw Error(\"Registered file group required\");\n  const group = processGroupManifestSchema.parse(JSON.parse(read(path.resolve(c.packageRoot, journal.groupManifest)).toString()));\n  const contract = processGroupJournalContract(sourceIdentity, journal, group.profiles);\n  return {\n    d,\n    normalized,\n    channels,\n    id: group.id,\n    processName: group.processName,\n    receiverProcessName: group.processName + \"-admission\",\n    inputTopic: group.inputTopic,\n    reference: {\n      directory: journal.directory,\n      journalId: journal.journalId!,\n      generationId: group.id,\n      contractVersion: 1 as const,\n      journalContractSha256: sha256(contract),\n      maxRecords: journal.maxRecords,\n      maxBytes: journal.maxBytes,\n      minFreeBytes: journal.minFreeBytes,\n      profiles: group.profiles.map(({ processName, mappingSha256, dataGroup }) => ({ processName, mappingSha256, dataGroup })),\n    },\n  };\n}\n\n/** Operator reviews opaque before/after digests; business equivalence is application-owned. */\nexport function reviewInstalledProcessGroupGeneration(\n  configs: UpgradeConfigurations,\n  controllerName: string,\n  stateRoot: string,\n  excludedUnsFields: readonly string[] = [],\n): PreparedGroupUpgrade {\n  const context = (c: UpgradeConfiguration) => ({\n    packageRoot: c.packageRoot,\n    instanceDirectory: c.instanceDirectory,\n    rawConfiguration: c.raw,\n    channels: resolvedProcessGroupChannels(c.resolved),\n    controllerName,\n    stateRoot,\n  });\n  const a = describeInstalledProcessGroupGeneration(configs.source.publisher),\n    b = describeInstalledProcessGroupGeneration(configs.target.publisher);\n  if (\n    b.d.protocolVersion !== 2 ||\n    a.d.namespace !== b.d.namespace ||\n    a.id !== b.id ||\n    a.processName !== b.processName ||\n    a.receiverProcessName !== b.receiverProcessName ||\n    a.inputTopic !== b.inputTopic ||\n    a.reference.directory === b.reference.directory ||\n    !a.reference.journalId ||\n    !b.reference.journalId ||\n    a.reference.journalId === b.reference.journalId ||\n    a.reference.maxRecords !== b.reference.maxRecords ||\n    a.reference.maxBytes !== b.reference.maxBytes ||\n    a.reference.minFreeBytes !== b.reference.minFreeBytes\n  )\n    throw Error(\"Distinct bounded generations with the same process/input identity required\");\n  const policyFiles = {} as Record<\"source\" | \"target\", string>,\n    policies = {} as Record<\"source\" | \"target\", Buffer>;\n  const members: GroupVersionUpgradeReview[\"members\"] = [];\n  const portable = (raw: Record<string, unknown>, d: typeof a.d) => {\n    const copy = structuredClone(raw),\n      uns = { ...(copy[\"uns\"] as Record<string, unknown>) };\n    for (const key of excludedUnsFields) delete uns[key];\n    copy[\"uns\"] = uns;\n    for (const keys of [d.publisherPath, d.journalPath, d.runtimeRolePath]) {\n      let node = copy;\n      let present = true;\n      for (const key of keys.slice(0, -1)) {\n        const child = node[key];\n        if (child === undefined) {\n          present = false;\n          break;\n        }\n        if (!child || typeof child !== \"object\" || Array.isArray(child)) throw Error(\"Invalid resource selector parent\");\n        node = child as Record<string, unknown>;\n      }\n      if (present) delete node[keys.at(-1)!];\n    }\n    return hash(copy);\n  };\n  for (const side of [\"source\", \"target\"] as const)\n    for (const role of [\"publisher\", \"receiver\"] as const) {\n      const c = configs[side][role],\n        g = describeInstalledProcessGroupGeneration(c),\n        expected = side === \"source\" ? a : b,\n        proof = authorizeProcessGroupRuntime(context(c));\n      if (\n        proof.role !== (role === \"publisher\" ? \"target\" : \"receiver\") ||\n        proof.directory !== expected.reference.directory ||\n        proof.journalId !== expected.reference.journalId ||\n        hash(g.reference) !== hash(expected.reference) ||\n        g.normalized.uns[\"processName\"] !== (role === \"publisher\" ? g.processName : g.receiverProcessName) ||\n        (role === \"receiver\"\n          ? g.normalized.runtimeRole !== \"admission\"\n          : g.normalized.runtimeRole !== undefined && g.normalized.runtimeRole !== \"publisher\")\n      )\n        throw Error(\"Exact reviewed generation pair required\");\n      const pkg = JSON.parse(read(path.join(c.packageRoot, \"package.json\")).toString());\n      if (\n        pkg.name !== JSON.parse(read(path.join(configs.source.publisher.packageRoot, \"package.json\")).toString()).name ||\n        portable(c.raw, g.d) !== portable(configs.source[role].raw, a.d) ||\n        groupChannelsHash(g.channels) !== groupChannelsHash(a.channels)\n      )\n        throw Error(\"Configuration or broker identity changed outside the reviewed resources\");\n      if (policyFiles[side] && policyFiles[side] !== proof.file) throw Error(\"Pair policies differ\");\n      policyFiles[side] = proof.file;\n      policies[side] = read(proof.file, true);\n      members.push({\n        side,\n        role,\n        processName: String(g.normalized.uns[\"processName\"]),\n        configurationSha256: hash(c.raw),\n        artifactSha256: groupArtifactHash(c.packageRoot),\n      });\n    }\n  if (policyFiles.source === policyFiles.target) throw Error(\"Each generation requires its own retained policy\");\n  const profiles = a.reference.profiles;\n  if (\n    profiles.length !== b.reference.profiles.length ||\n    profiles.some((p) => !b.reference.profiles.some((q) => q.processName === p.processName && q.dataGroup === p.dataGroup))\n  )\n    throw Error(\"Logical profile identities or data groups changed\");\n  inspectGenerationJournal(a.reference);\n  inspectPristineGenerationJournal(b.reference);\n  if (sha256(read(policyFiles.source, true)) !== sha256(policies.source) || sha256(read(policyFiles.target, true)) !== sha256(policies.target))\n    throw Error(\"Reviewed policies changed\");\n  const review: GroupGenerationReview = {\n    protocolVersion: 2,\n    namespace: b.d.namespace,\n    groupId: b.id,\n    policyFile: policyFiles.target,\n    sourcePolicyFile: policyFiles.source,\n    sourcePolicySha256: sha256(policies.source),\n    targetPolicySha256: sha256(policies.target),\n    journalId: b.reference.journalId,\n    directory: b.reference.directory,\n    journalContractSha256: b.reference.journalContractSha256,\n    profiles: b.reference.profiles,\n    members,\n    sourceJournal: a.reference,\n    targetJournal: b.reference,\n    delivery: { inputPausePossible: true, retainedBrokerSessionMayReplay: true, exactlyOnceOutput: false },\n    resourceChanges: profiles.map((p) => ({\n      processName: p.processName,\n      beforeSha256: p.mappingSha256,\n      afterSha256: b.reference.profiles.find((q) => q.processName === p.processName)!.mappingSha256,\n      dataGroup: p.dataGroup,\n    })),\n  };\n  return { review, sourcePolicy: policies.source, targetPolicy: policies.target };\n}\n"]}

package/dist/runtime/process-group-inspection.d.ts

@@ -1,4 +1,6 @@
 export interface ProcessGroupConfigurationEvidence {
+    configurationGroupSha256?: string;
+    generationId?: string;
     processName: string;
     configurationChecksum: string;
     projectionChecksum: string;

package/dist/runtime/process-group-inspection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-inspection.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACrJ;AA6BD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,cAAc,QAA2C,EACzD,OAAO,EAAE;IAAE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnG,iCAAiC,CA+InC"}
+{"version":3,"file":"process-group-inspection.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-inspection.ts"],"names":[],"mappings":"AAgCA,MAAM,WAAW,iCAAiC;IAChD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACrJ;AA6BD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,cAAc,QAA2C,EACzD,OAAO,EAAE;IAAE,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACnG,iCAAiC,CA8GnC"}

package/dist/runtime/process-group-inspection.js

@@ -3,7 +3,9 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { z } from "zod";
+import { configurationGroupJournalContract, configurationGroupJournalSchema, configurationResourceHash, selectedConfigurationGroup, } from "./configuration-group-contract.js";
 import { assertProcessGroupStateMount, authorizeConfiguredProcessGroupRuntime, configurationAuthorizationHash, hasProcessGroupAuthorization, processGroupManifestSchema as manifest, } from "./process-group-authorization.js";
+import { readConfigurationSelector } from "./process-group-contract.js";
 import { isLocalPilotPath, isProcessGroupJournalPath, normalizeProcessGroupConfiguration, processGroupDescriptor, processGroupJournalContract, processGroupJournalSchema, processGroupSourceIdentity, projectProcessGroupConfiguration, resolvedProcessGroupInputChannel, } from "./process-group-contract.js";
 /** Bound reads to installed package/instance resources, never arbitrary paths or symlinks. */
 function resource(pkg, dir, file, relativeTo) {
@@ -40,6 +42,9 @@ function resource(pkg, dir, file, relativeTo) {
 const sha = (b) => createHash("sha256").update(b).digest("hex");
 export function inspectProcessGroupConfiguration(pkg, dir, raw, controllerName = process.env["UNS_CONTROLLER_NAME"] ?? "", options) {
     const original = JSON.parse(raw);
+    const configured = selectedConfigurationGroup(pkg, original);
+    if (configured)
+        return inspectConfigurationGroup(pkg, dir, raw, original, configured, controllerName, options);
     const descriptor = processGroupDescriptor(pkg);
     if (!descriptor)
         throw Error("Installed package has no supported process-group contract");
@@ -83,46 +88,7 @@ export function inspectProcessGroupConfiguration(pkg, dir, raw, controllerName =
         if (path.isAbsolute(admission.groupManifest) || admission.groupManifest.includes(".."))
             throw Error("Admission manifest must be package-relative");
         const admitted = manifest.parse(JSON.parse(resource(pkg, dir, admission.groupManifest).toString()));
-        for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))
-            if (fs.lstatSync(parent).isSymbolicLink())
-                throw Error("Admission directory cannot use symbolic links");
-        const databaseFile = path.join(admission.directory, "admission.sqlite");
-        if (fs.lstatSync(databaseFile).isSymbolicLink())
-            throw Error("Admission journal cannot use symbolic links");
-        const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
-        const journal = new DatabaseSync(databaseFile, { readOnly: true });
-        try {
-            journal.exec("PRAGMA busy_timeout=1000");
-            if (persistent && journal.prepare("SELECT value FROM metadata WHERE key='id'").get()?.["value"] !== admission.journalId)
-                throw Error("Persistent admission journalId binding differs");
-            const input = resolvedProcessGroupInputChannel(original);
-            const sourceIdentity = processGroupSourceIdentity(input);
-            const expected = processGroupJournalContract(sourceIdentity, admission, admitted.profiles);
-            const contract = journal.prepare("SELECT value FROM metadata WHERE key='contract'").get()?.["value"];
-            if (contract !== expected)
-                throw Error("Durable admission journal contract differs");
-            const capture = JSON.parse(String(journal.prepare("SELECT value FROM metadata WHERE key='capture'").get()?.["value"] ?? "null"));
-            if (!capture ||
-                !["ready", "capacity-blocked"].includes(capture.state) ||
-                !Number.isSafeInteger(capture.pid) ||
-                capture.pid <= 0 ||
-                !Number.isSafeInteger(capture.heartbeat) ||
-                Date.now() - capture.heartbeat > 5000 ||
-                capture.heartbeat > Date.now() + 1000)
-                throw Error("Durable admission receiver is not ready");
-            process.kill(capture.pid, 0);
-            if (persistent) {
-                const namespace = sha(Buffer.from(fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fs.readlinkSync("/proc/self/ns/pid")));
-                const stored = journal.prepare("SELECT value FROM metadata WHERE key='runtime_namespace'").get()?.["value"];
-                const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, "utf8");
-                const start = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
-                if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + ":" + capture.pid + ":" + start)))
-                    throw Error("Admission capture namespace or process identity differs");
-            }
-        }
-        finally {
-            journal.close();
-        }
+        inspectJournal(admission, persistent, processGroupJournalContract(processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)), admission, admitted.profiles));
         if (publisher.groupManifest && publisher.groupManifest !== admission.groupManifest)
             throw Error("Admission and publisher manifests differ");
         if (!publisher.groupManifest) {
@@ -182,4 +148,118 @@ export function inspectProcessGroupConfiguration(pkg, dir, raw, controllerName =
         contract: null,
     };
 }
+/** Shared read-only receiver/journal evidence for both resource protocols. */
+function inspectJournal(admission, persistent, expected) {
+    for (let parent = admission.directory; parent !== path.dirname(parent); parent = path.dirname(parent))
+        if (fs.lstatSync(parent).isSymbolicLink())
+            throw Error("Admission directory cannot use symbolic links");
+    const databaseFile = path.join(admission.directory, "admission.sqlite");
+    if (fs.lstatSync(databaseFile).isSymbolicLink())
+        throw Error("Admission journal cannot use symbolic links");
+    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    const journal = new DatabaseSync(databaseFile, { readOnly: true });
+    try {
+        journal.exec("PRAGMA busy_timeout=1000");
+        if (persistent && journal.prepare("SELECT value FROM metadata WHERE key='id'").get()?.["value"] !== admission.journalId)
+            throw Error("Persistent admission journalId binding differs");
+        const contract = journal.prepare("SELECT value FROM metadata WHERE key='contract'").get()?.["value"];
+        if (contract !== expected)
+            throw Error("Durable admission journal contract differs");
+        const capture = JSON.parse(String(journal.prepare("SELECT value FROM metadata WHERE key='capture'").get()?.["value"] ?? "null"));
+        if (!capture ||
+            !["ready", "capacity-blocked"].includes(capture.state) ||
+            !Number.isSafeInteger(capture.pid) ||
+            capture.pid <= 0 ||
+            !Number.isSafeInteger(capture.heartbeat) ||
+            Date.now() - capture.heartbeat > 5000 ||
+            capture.heartbeat > Date.now() + 1000)
+            throw Error("Durable admission receiver is not ready");
+        process.kill(capture.pid, 0);
+        if (persistent) {
+            const namespace = sha(Buffer.from(fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() + ":" + fs.readlinkSync("/proc/self/ns/pid")));
+            const stored = journal.prepare("SELECT value FROM metadata WHERE key='runtime_namespace'").get()?.["value"];
+            const stat = fs.readFileSync(`/proc/${capture.pid}/stat`, "utf8");
+            const start = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+            if (stored !== namespace || !start || capture.runtimeIdentity !== sha(Buffer.from(namespace + ":" + capture.pid + ":" + start)))
+                throw Error("Admission capture namespace or process identity differs");
+        }
+    }
+    finally {
+        journal.close();
+    }
+}
+function inspectConfigurationGroup(pkg, dir, raw, original, selected, controllerName, options) {
+    const { descriptor: d, snapshot } = selected;
+    const uns = { ...original["uns"] };
+    const memberId = readConfigurationSelector(original, d.memberPath), role = readConfigurationSelector(original, d.runtimeRolePath);
+    const member = memberId === undefined ? undefined : snapshot.profiles.find((p) => p.id === memberId);
+    if ((memberId !== undefined && !member) ||
+        uns["processName"] !== (member?.processName ?? snapshot.group.processName) ||
+        (role !== undefined && role !== "publisher"))
+        throw Error("Configured publisher role or identity differs");
+    const journal = configurationGroupJournalSchema
+        .extend({
+        minFreeBytes: configurationGroupJournalSchema.shape.minFreeBytes.unwrap().optional(),
+        maxRecords: configurationGroupJournalSchema.shape.maxRecords.unwrap(),
+        maxBytes: configurationGroupJournalSchema.shape.maxBytes.unwrap(),
+    })
+        .parse(readConfigurationSelector(original, d.journalPath));
+    const production = !isLocalPilotPath(pkg) || hasProcessGroupAuthorization() ? authorizeConfiguredProcessGroupRuntime(pkg, dir, original, controllerName) : undefined;
+    const persistent = !isLocalPilotPath(journal.directory);
+    if (production)
+        assertProcessGroupStateMount(production, process.env["UNS_PROCESS_GROUP_STATE_ROOT"] ?? "");
+    if (path.resolve(journal.directory) !== journal.directory || (production && !persistent))
+        throw Error("Configured journal storage differs");
+    if (persistent && (!production || !journal.journalId))
+        throw Error("Persistent configured journal requires exact reviewed authority and UUID");
+    const metadata = JSON.parse(resource(pkg, dir, "package.json").toString()).unsDatahub;
+    if (metadata?.processGroupAdmission !== 1 || (persistent && metadata?.processGroupPersistentAdmission !== 1))
+        throw Error("Required journal capabilities missing");
+    const expected = configurationGroupJournalContract(snapshot, processGroupSourceIdentity(resolvedProcessGroupInputChannel(original)), configurationGroupJournalSchema.parse(journal), snapshot.profiles.map(({ processName, resourceSha256, dataGroup }) => ({ processName, resourceSha256, dataGroup })));
+    inspectJournal(journal, persistent, expected);
+    const checksum = options.configurationChecksum(raw);
+    if (!checksum)
+        throw Error("Invalid configured group configuration");
+    for (const key of [...options.excludedUnsFields, "processName", "instanceMode", "handover", "handoverProtocol"])
+        delete uns[key];
+    const projection = structuredClone(original);
+    projection["uns"] = uns;
+    const remove = (keys) => {
+        let node = projection;
+        for (const key of keys.slice(0, -1)) {
+            const child = node[key];
+            if (child === undefined)
+                return;
+            if (!child || typeof child !== "object" || Array.isArray(child))
+                throw Error("Invalid selector projection");
+            node = child;
+        }
+        delete node[keys.at(-1)];
+    };
+    remove(d.memberPath);
+    remove(d.runtimeRolePath);
+    if (production)
+        projection["authorizationSha256"] = production.sha256;
+    return {
+        processName: String(original["uns"]["processName"]),
+        configurationChecksum: checksum,
+        projectionChecksum: configurationResourceHash(projection),
+        configurationGroupSha256: snapshot.sha256,
+        generationId: journal.generationId,
+        mappingSha256: member?.resourceSha256 ?? null,
+        dataGroup: member?.dataGroup ?? null,
+        contract: member
+            ? null
+            : {
+                digest: snapshot.sha256,
+                processName: snapshot.group.processName,
+                profiles: snapshot.profiles.map(({ id, processName, resourceSha256, dataGroup }) => ({
+                    id,
+                    processName,
+                    mappingSha256: resourceSha256,
+                    dataGroup,
+                })),
+            },
+    };
+}
 //# sourceMappingURL=process-group-inspection.js.map