@uns-kit/core 3.0.33 → 3.0.34

package/MIGRATIONS.md

@@ -9,6 +9,31 @@ Agents must inspect the application's existing ownership and shutdown flow
 before editing it. The examples below describe the intended behavior, not a
 mechanical search-and-replace operation.
 
+## 3.0.34 - Optional paired-input retirement to one direct process
+
+When crossing `<3.0.34` to `>=3.0.34`, ordinary applications require no change.
+Packages opting into `unsDatahub.processGroupDirectRuntime` use shared declaration,
+resource review and startup/readiness helpers under `runtime/process-group-direct-*`.
+The authenticated host must stop receiver first, drain the same input journal,
+prove both original exits and persist one launch intent before starting one direct
+successor. Preserve business profiles, paths, units, journal UUID and original policy.
+
+Schema5 retirement evidence fences old journal owners and original profiles.
+Open recovery pins exact direct configuration/artifact/placement/launch; explicit
+closure releases ordinary direct management but retains the old journal and fences.
+Unknown outcomes stay blocked in the same operation. Never remove policy/journal
+files, rename an owner or force a second launch to bypass review.
+
+`UnsMqttProxy.getInputReadiness()` exposes current SUBACK evidence. Register normal
+signal/drain handlers and confirm output before declaring direct readiness; perform
+confirmation asynchronously when the configured queue must accept during outages.
+No Controller heartbeat is required for normal application cleanup.
+
+Backup snapshots with retirement evidence use internal manifest2 and include exact
+retirement/original-policy bytes. Update the transport helper from the same SDK
+asset before activation; older transports fail closed. Restore remains offline
+review only. See [declaration, API example and limits](https://github.com/uns-openhub/uns-kit/blob/master/docs/process-group-direct-retirement.md).
+
 ## 3.0.33 - Explicit queue disablement and generic clean MQTT migration
 
 When crossing `<3.0.33` to `>=3.0.33`, existing applications require no change.

package/dist/runtime/process-group-authorization.d.ts

@@ -83,6 +83,78 @@ export declare const hvAuthorizationSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const productionGroupIds: readonly ["hv", "vv", "jek"];
+/** A retirement keeps the original journal/policy bound; older readers fail closed on schema5. */
+export declare function parseProcessGroupRetirementPolicy(value: unknown): {
+    schemaVersion: 5;
+    kind: "uns-process-group-direct-retirement";
+    protocolVersion: 1;
+    operationId: string;
+    packageName: string;
+    namespace: string;
+    groupId: string;
+    controllerName: string;
+    stateRoot: string;
+    recovery: "closed" | "open";
+    journal: {
+        directory: string;
+        journalId: string;
+        journalContractSha256: string;
+        generationId: string;
+        maxRecords: number;
+        maxBytes: number;
+        minFreeBytes: number;
+        profiles: {
+            processName: string;
+            mappingSha256: string;
+            dataGroup: string;
+        }[];
+        groupSha256?: string;
+        contractVersion?: 1 | 2;
+    };
+    sourcePolicyJson: string;
+    sourcePolicySha256: string;
+    source: {
+        publisher: {
+            placement: {
+                controller: string;
+                rttNode: string;
+                version: string;
+                instanceId: string;
+            };
+            processName: string;
+            configurationSha256: string;
+            artifactSha256: string;
+            policyConfigurationSha256: string;
+        };
+        receiver: {
+            placement: {
+                controller: string;
+                rttNode: string;
+                version: string;
+                instanceId: string;
+            };
+            processName: string;
+            configurationSha256: string;
+            artifactSha256: string;
+            policyConfigurationSha256: string;
+        };
+    };
+    target: {
+        placement: {
+            controller: string;
+            rttNode: string;
+            version: string;
+            instanceId: string;
+        };
+        processName: string;
+        configurationSha256: string;
+        artifactSha256: string;
+        packageRoot: string;
+        descriptorSha256: string;
+        resourceSha256: string;
+        channelsSha256: string;
+    };
+};
 /** Bounded private registry enumeration; retained state without its policy fails closed.
  * New groups are operator-owned data and never a release-time enum in the Controller.
  */

package/dist/runtime/process-group-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AAiBxE,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,eAAO,MAAM,4BAA4B,4CAAsC,CAAC;AAahF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiB1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC9F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAarC,CAAC;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AACD,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,eAAe,GAAG,oBAAoB,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACxD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAA+B,CAAC;AAClE,eAAO,MAAM,kBAAkB,8BAA4B,CAAC;AAiD5D;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,GAAG,CAAC,MAAM,CAAC,CAiFzD;AACD,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA4GD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAEjH;AACD,oFAAoF;AACpF,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAElH;AACD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gCAAgC,GAAG,MAAM,CAI/F;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,EAAE,MAAM,EACtB,UAAU,UAAQ,6BAUnB;AACD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAON;AACD,eAAO,MAAM,4BAA4B,+CAAyC,CAAC;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjG;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,IAAI,CAwBN;AACD,eAAO,MAAM,oBAAoB,uCAAiC,CAAC"}
+{"version":3,"file":"process-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AAkBxE,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,eAAO,MAAM,4BAA4B,4CAAsC,CAAC;AAahF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAiB1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC9F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAarC,CAAC;AACH,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AACD,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,eAAe,GAAG,oBAAoB,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,yBAAyB,CAAC;AACxD,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;kBAA+B,CAAC;AAClE,eAAO,MAAM,kBAAkB,8BAA4B,CAAC;AAG5D,kGAAkG;AAClG,wBAAgB,iCAAiC,CAAC,KAAK,EAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB9D;AA+CD;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,GAAG,CAAC,MAAM,CAAC,CAwFzD;AACD,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AA4GD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAEjH;AACD,oFAAoF;AACpF,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAElH;AACD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gCAAgC,GAAG,MAAM,CAI/F;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,cAAc,EAAE,MAAM,EACtB,UAAU,UAAQ,6BAUnB;AACD,wBAAgB,sCAAsC,CACpD,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAON;AACD,eAAO,MAAM,4BAA4B,+CAAyC,CAAC;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBjG;AACD,eAAO,MAAM,kBAAkB,qCAA+B,CAAC;AAC/D,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,yBAAyB,EAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,IAAI,CAwBN;AACD,eAAO,MAAM,oBAAoB,uCAAiC,CAAC"}

package/dist/runtime/process-group-authorization.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { z } from "zod";
 import * as legacy from "./compatibility/energenti-authorization-v1.js";
 import { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from "./configuration-group-authorization.js";
+import { processGroupRetirementPolicySchema } from "./process-group-direct-contract.js";
 import { normalizeProcessGroupConfiguration, processGroupDescriptor, resolvedProcessGroupChannels, } from "./process-group-contract.js";
 import { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash, readProcessGroupResource as read, sha256 as sha, assertPrivateProcessGroupDirectory, } from "./process-group-resources.js";
 export { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from "./process-group-resources.js";
@@ -54,6 +55,26 @@ export const hvAuthorizationSchema = legacy.hvAuthorizationSchema;
 export const productionGroupIds = legacy.productionGroupIds;
 const issued = new WeakSet();
 const privateDirectory = assertPrivateProcessGroupDirectory;
+/** A retirement keeps the original journal/policy bound; older readers fail closed on schema5. */
+export function parseProcessGroupRetirementPolicy(value) {
+    const p = processGroupRetirementPolicySchema.parse(value);
+    if (sha(p.sourcePolicyJson) !== p.sourcePolicySha256)
+        throw Error("Original retirement policy bytes changed");
+    const raw = JSON.parse(p.sourcePolicyJson), original = raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : processGroupAuthorizationSchema.parse(raw);
+    const policyId = original.schemaVersion === 4 ? original.generationId : original.groupId;
+    if (original.packageName !== p.packageName || original.namespace !== p.namespace || original.groupId !== p.groupId || original.controllerName !== p.controllerName || original.stateRoot !== p.stateRoot || original.directory !== p.journal.directory || original.journalId !== p.journal.journalId || policyId !== p.journal.generationId || original.directory !== path.join(p.stateRoot, p.namespace, "admission", policyId) || original.channelsSha256 !== p.target.channelsSha256)
+        throw Error("Retirement journal or authority differs from original policy");
+    if ((original.schemaVersion === 4 ? original.groupSha256 : original.groupManifestSha256) !== p.target.resourceSha256)
+        throw Error("Retirement resource differs from original policy");
+    for (const role of ["publisher", "receiver"]) {
+        const m = p.source[role], before = original.placements.find(x => x.role === (role === "publisher" ? "target" : "receiver"));
+        if (!before || before.instanceId !== m.placement.instanceId || before.processName !== m.processName || before.configurationSha256 !== m.policyConfigurationSha256 || original.artifactSha256 !== m.artifactSha256 || m.placement.rttNode !== p.packageName)
+            throw Error("Retirement source placement differs from original policy");
+    }
+    if (p.target.placement.rttNode !== p.packageName || p.journal.profiles.some(x => !original.placements.some(y => y.role === "source" && y.processName === x.processName)))
+        throw Error("Retirement profile ownership differs");
+    return p;
+}
 function registryRoot(root, dir) {
     if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir)
         throw Error("Invalid policy registry");
@@ -187,6 +208,16 @@ export function configuredGroupProcessNames() {
         const result = new Set();
         for (const file of files) {
             const raw = JSON.parse(read(file, true).toString());
+            if (raw.schemaVersion === 5) {
+                const p = parseProcessGroupRetirementPolicy(raw);
+                if (p.stateRoot !== root || file !== path.join(root, p.namespace, "authorizations", p.journal.generationId + ".json"))
+                    throw Error("Retirement registry binding differs");
+                privateDirectory(root);
+                privateDirectory(path.dirname(file));
+                for (const member of [...p.journal.profiles, p.source.publisher, p.source.receiver])
+                    result.add(member.processName);
+                continue;
+            }
             const p = raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3
                 ? processGroupAuthorizationSchema.parse(raw)
                 : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);

package/dist/runtime/process-group-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AACxE,OAAO,EAAE,qCAAqC,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACjK,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,IAAI,IAAI,EAChC,MAAM,IAAI,GAAG,EACb,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,EAAE,MAAM;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE;IACF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7H,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAgBH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAC5D,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/H,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,yDAAyD;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrH,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AACjC,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,GAA4B,EAAE,IAAY,EAAE,QAAiB;IAC9F,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QAC3E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3D,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACrE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAsD,CAAC;YAC3D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrI,UAAU,GAAG,UAAU;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACT,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC7E,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACrF,CAAC,CAAC,CAAC;YACP,CAAC;;gBAAM,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACxE,KAAK,MAAM,KAAK,IAAI,OAAO;oBACzB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;4BAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC5E,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,iFAAiF;oBACjF,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxF,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;4BAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACpF,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;wBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,KAAK,MAAM,KAAK,IAAI,QAAQ;wBAC1B,IACE,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;4BACjC,KAAK,CAAC,cAAc,EAAE;4BACtB,CAAC,KAAK,CAAC,WAAW,EAAE;4BACpB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;4BAE/D,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,GACL,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC;gBAClG,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE;gBACpG,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1G,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;gBACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;gBACtE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAE9D,MAAM,KAAK,EAAE,CAAC;YAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB,CAAC,OAAyC,EAAE,SAAkB;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAC1F,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvD,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;YAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAC3B,CAAC,CAAC,gBAAgB,KAAK,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAC5E,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAEpE,MAAM,KAAK,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3I,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,mBAAmB;YAAE,MAAM,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9C,IACE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;YAErF,MAAM,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa;gBAAE,MAAM,KAAK,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YAC5D,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU;YAClC,CAAC,QAAQ,EAAE,UAAU,CAAU;SAChC,CAAC,CAAC;QACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;YACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAEhE,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,GAAG,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EACvE,CAAC,GAAG,CAAC,CAAC,OAA8C,EACpD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAClB,IACE,CAAC,KAAK;YACN,CAAC,CAAC,CAAC,OAAO;YACV,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC5C,KAAK,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtF,CAAC,CAAC;YACF,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;YACxC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YAEpC,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACxE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YACtC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,SAAS;gBACpC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa;YAEhD,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;YAClB,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,WAAW;YAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,OAAyC;IACpF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,OAAyC,EAAE,KAAa;IAC1G,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAyC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,sCAAsC,CACpD,GAAW,EACX,GAAW,EACX,GAA4B,EAC5B,cAAsB,EACtB,UAAU,GAAG,KAAK;IAElB,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,GAAG;QAChB,iBAAiB,EAAE,GAAG;QACtB,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,4BAA4B,CAAC,GAAG,CAAC;QAC3C,cAAc;QACd,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sCAAsC,CACpD,KAA4C,EAC5C,SAAiB,EACjB,SAA6B;IAE7B,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAC1H,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,4BAA4B,CAAC,KAA2C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAgC,EAAE,IAAY;IACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,KAA+B,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC;QACnK,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,GAAW,EACX,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,oBAAoB,CAAC,KAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IACE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO;YACjD,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO;YAC7D,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO;YAElD,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS;YACrF,CAAC,CAAC,CAAC,wBAAwB,KAAK,KAAK,CAAC,wBAAwB,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport * as legacy from \"./compatibility/energenti-authorization-v1.js\";\nimport { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from \"./configuration-group-authorization.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport {\n  configurationAuthorizationHash,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource as read,\n  sha256 as sha,\n  assertPrivateProcessGroupDirectory,\n} from \"./process-group-resources.js\";\n\nexport { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from \"./process-group-resources.js\";\n\nexport const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nconst placement = z.strictObject({\n  instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n  processName: id,\n  role: z.enum([\"source\", \"target\", \"receiver\"]),\n  configurationSha256: digest,\n});\nexport const processGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(3),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(1),\n  packageName: z.string().min(1).max(214),\n  namespace: id,\n  groupId: id,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupManifestSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z.array(placement).min(4).max(18),\n});\nexport type ProcessGroupAuthorizationPolicy = z.infer<typeof processGroupAuthorizationSchema>;\nexport const processGroupManifestSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  id,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: id,\n  profiles: z\n    .array(z.strictObject({ id, processName: id, mappingFile: z.string().min(1).max(512), mappingSha256: digest, dataGroup: id }))\n    .min(2)\n    .max(16),\n});\ninterface GenericAuthorization {\n  readonly sha256: string;\n  readonly file: string;\n  readonly directory: string;\n  readonly journalId: string | null;\n  readonly role: \"source\" | \"target\" | \"receiver\";\n  readonly groupId: string;\n  readonly groupProcessName: string;\n  readonly namespace: string;\n  readonly generationId?: string;\n  readonly configurationGroupSha256?: string;\n}\nexport type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;\nexport type HvAuthorization = ProcessGroupAuthorization;\nexport type HvAuthorizationPolicy = legacy.HvAuthorizationPolicy;\nexport const hvAuthorizationSchema = legacy.hvAuthorizationSchema;\nexport const productionGroupIds = legacy.productionGroupIds;\nconst issued = new WeakSet<object>();\nconst privateDirectory = assertPrivateProcessGroupDirectory;\nfunction registryRoot(root: string, dir: string): string {\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir) throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  if (dir === root) return \"*\"; // Explicit collection of independently owned namespaces.\n  const relative = path.relative(root, dir);\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || !/^([a-z][a-z0-9-]{0,99})\\/authorizations$/.test(relative))\n    throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  privateDirectory(dir);\n  return relative.split(\"/\")[0]!;\n}\nfunction selectedFile(pkg: string, raw: Record<string, unknown>, root: string, explicit?: string): string {\n  const configured = configurationGroupPolicyIdentity(pkg, raw);\n  if (configured) {\n    if (explicit) return explicit;\n    const directory = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (directory) {\n      const selected = registryRoot(root, directory);\n      if (selected !== \"*\" && selected !== configured.namespace) throw Error(\"Foreign runtime registry\");\n      const registry = selected === \"*\" ? path.join(root, configured.namespace, \"authorizations\") : directory;\n      privateDirectory(registry);\n      return path.join(registry, configured.generationId + \".json\");\n    }\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (!single) throw Error(\"No selected policy\");\n    return single;\n  }\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Missing runtime contract\");\n  const c = normalizeProcessGroupConfiguration(raw, descriptor),\n    journal = c.journal as Record<string, unknown> | undefined;\n  const manifest = descriptor.manifests.find((m) => m.file === journal?.[\"groupManifest\"]);\n  if (!manifest) throw Error(\"Unregistered group manifest\");\n  const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n  if (explicit) return explicit;\n  if (dir) {\n    const selected = registryRoot(root, dir);\n    if (selected !== \"*\" && selected !== descriptor.namespace) throw Error(\"Foreign runtime registry\");\n    const registry = selected === \"*\" ? path.join(root, descriptor.namespace, \"authorizations\") : dir;\n    privateDirectory(registry);\n    return path.join(registry, manifest.id + \".json\");\n  }\n  const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n  if (!single) throw Error(\"No selected policy\");\n  return single;\n}\n/** Bounded private registry enumeration; retained state without its policy fails closed.\n * New groups are operator-owned data and never a release-time enum in the Controller.\n */\nexport function configuredGroupProcessNames(): Set<string> {\n  if (!hasProcessGroupAuthorization()) return new Set();\n  try {\n    const root = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root) throw Error();\n    const files = new Set<string>();\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (single) files.add(single);\n    const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (dir) {\n      const selected = registryRoot(root, dir);\n      let registries: { namespace: string; directory: string }[];\n      if (selected === \"*\") {\n        const namespaces = fs.readdirSync(root, { withFileTypes: true });\n        if (namespaces.length > 64 || namespaces.some((e) => e.isSymbolicLink())) throw Error(\"Registry namespace budget or link violation\");\n        registries = namespaces\n          .filter((e) => e.isDirectory())\n          .map((e) => {\n            if (!id.safeParse(e.name).success) throw Error(\"Invalid registry namespace\");\n            privateDirectory(path.join(root, e.name));\n            return { namespace: e.name, directory: path.join(root, e.name, \"authorizations\") };\n          });\n      } else registries = [{ namespace: selected, directory: dir }];\n      for (const registry of registries) {\n        let entries: fs.Dirent[] = [];\n        try {\n          privateDirectory(registry.directory);\n          entries = fs.readdirSync(registry.directory, { withFileTypes: true });\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n        if (entries.length > 64) throw Error(\"Policy registry budget exceeded\");\n        for (const entry of entries)\n          if (entry.name.endsWith(\".json\")) {\n            if (!/^[a-z][a-z0-9-]{0,99}\\.json$/.test(entry.name)) throw Error(\"Invalid registry entry\");\n            files.add(path.join(registry.directory, entry.name));\n            if (files.size > 64) throw Error(\"Total policy registry budget exceeded\");\n          }\n        const journals = path.join(root, registry.namespace, \"admission\");\n        try {\n          // Root/registry permissions already protect visibility; retain old parent modes.\n          for (let parent = journals; parent !== path.dirname(parent); parent = path.dirname(parent))\n            if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Linked journal registry\");\n          const retained = fs.readdirSync(journals, { withFileTypes: true });\n          if (retained.length > 64) throw Error(\"Retained journal budget exceeded\");\n          for (const entry of retained)\n            if (\n              !id.safeParse(entry.name).success ||\n              entry.isSymbolicLink() ||\n              !entry.isDirectory() ||\n              !files.has(path.join(registry.directory, entry.name + \".json\"))\n            )\n              throw Error(\"Retained journal has no reviewed policy\");\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n      }\n    }\n    const result = new Set<string>();\n    for (const file of files) {\n      const raw = JSON.parse(read(file, true).toString());\n      const p =\n        raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3\n          ? processGroupAuthorizationSchema.parse(raw)\n          : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);\n      const { namespace, group } = p.schemaVersion === 4 ? { namespace: p.namespace, group: p.generationId }\n        : p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);\n      if (\n        p.stateRoot !== root ||\n        file !== path.join(root, namespace, \"authorizations\", group + \".json\") ||\n        p.directory !== path.join(root, namespace, \"admission\", group)\n      )\n        throw Error();\n      privateDirectory(root);\n      privateDirectory(path.dirname(file));\n      for (const role of p.placements) result.add(role.processName);\n    }\n    return result;\n  } catch {\n    throw Error(\"Process-group authorization registry is missing, changed or insecure; review required\");\n  }\n}\nexport interface ProcessGroupAuthorizationContext {\n  packageRoot: string;\n  instanceDirectory: string;\n  rawConfiguration: Record<string, unknown>;\n  channels: unknown[];\n  controllerName: string;\n  file?: string;\n  stateRoot?: string;\n  initialize?: boolean;\n}\nfunction verifyRuntimePolicy(context: ProcessGroupAuthorizationContext, candidate?: Buffer): ProcessGroupAuthorization {\n  try {\n    const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root || !context.controllerName) throw Error();\n    const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file),\n      bytes = candidate ?? read(file, true),\n      unparsed = JSON.parse(bytes.toString());\n    if (unparsed.schemaVersion === 4) {\n      const result = verifyConfigurationGroupPolicy(context, bytes, root, file);\n      if (!candidate) issued.add(result);\n      return result;\n    }\n    if (unparsed.schemaVersion !== 3) {\n      if (candidate) throw Error(\"Only generic policies can be staged\");\n      return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });\n    }\n    const p = processGroupAuthorizationSchema.parse(unparsed),\n      d = processGroupDescriptor(context.packageRoot);\n    if (!d || d.legacy) throw Error(\"Generic runtime descriptor required\");\n    const pkg = JSON.parse(read(path.join(context.packageRoot, \"package.json\")).toString());\n    const manifest = d.manifests.find((m) => m.id === p.groupId);\n    if (\n      !manifest ||\n      p.packageName !== pkg.name ||\n      p.namespace !== d.namespace ||\n      p.descriptorSha256 !== configurationAuthorizationHash(pkg.unsDatahub.processGroupRuntime) ||\n      p.packageRoot !== context.packageRoot ||\n      p.controllerName !== context.controllerName ||\n      p.stateRoot !== root ||\n      file !== path.join(root, d.namespace, \"authorizations\", p.groupId + \".json\") ||\n      p.directory !== path.join(root, d.namespace, \"admission\", p.groupId)\n    )\n      throw Error();\n    privateDirectory(root);\n    privateDirectory(path.dirname(file));\n    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256) throw Error();\n    const manifestBytes = read(path.join(context.packageRoot, manifest.file));\n    if (sha(manifestBytes) !== p.groupManifestSha256) throw Error();\n    const m = processGroupManifestSchema.parse(JSON.parse(manifestBytes.toString()));\n    if (m.id !== p.groupId) throw Error();\n    const receiver = m.processName + \"-admission\";\n    if (\n      new Set(m.profiles.map((x) => x.id)).size !== m.profiles.length ||\n      new Set(m.profiles.map((x) => x.processName)).size !== m.profiles.length ||\n      m.profiles.some((x) => x.processName === m.processName || x.processName === receiver)\n    )\n      throw Error();\n    for (const member of m.profiles) {\n      const f = path.resolve(context.packageRoot, path.dirname(manifest.file), member.mappingFile);\n      if (!f.startsWith(context.packageRoot + path.sep) || sha(read(f)) !== member.mappingSha256) throw Error();\n    }\n    const expected = new Map([\n      ...m.profiles.map((x) => [x.processName, \"source\"] as const),\n      [m.processName, \"target\"] as const,\n      [receiver, \"receiver\"] as const,\n    ]);\n    if (\n      p.placements.length !== expected.size ||\n      new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n      new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n      p.placements.some((x) => expected.get(x.processName) !== x.role)\n    )\n      throw Error();\n    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n    const c = normalizeProcessGroupConfiguration(context.rawConfiguration, d),\n      j = c.journal as Record<string, unknown> | undefined,\n      k = c.publisher;\n    if (\n      !entry ||\n      !c.matches ||\n      entry.processName !== c.uns?.[\"processName\"] ||\n      entry.configurationSha256 !== configurationAuthorizationHash(context.rawConfiguration) ||\n      !j ||\n      j[\"directory\"] !== p.directory ||\n      (j[\"journalId\"] ?? null) !== p.journalId ||\n      j[\"groupManifest\"] !== manifest.file\n    )\n      throw Error();\n    if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null) throw Error();\n    if (entry.role === \"receiver\" ? c.runtimeRole !== \"admission\" : c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") throw Error();\n    const member = m.profiles.find((x) => x.processName === entry.processName),\n      mapping = path.resolve(context.packageRoot, String(k[\"mappingFile\"]));\n    if (\n      entry.role !== \"source\"\n        ? k[\"groupManifest\"] !== manifest.file\n        : k[\"groupManifest\"] !== undefined ||\n          k[\"dataGroup\"] !== member?.dataGroup ||\n          !mapping.startsWith(context.packageRoot + path.sep) ||\n          sha(read(mapping)) !== member?.mappingSha256\n    )\n      throw Error();\n    const result = Object.freeze({\n      sha256: sha(bytes),\n      file,\n      directory: p.directory,\n      journalId: p.journalId,\n      role: entry.role,\n      groupId: p.groupId,\n      groupProcessName: m.processName,\n      namespace: d.namespace,\n    });\n    if (!candidate) issued.add(result);\n    return result;\n  } catch {\n    throw Error(\"Process-group runtime authorization is missing, changed or does not match this installed placement; review required\");\n  }\n}\n/** Live authority always comes from the current canonical private policy. */\nexport function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization {\n  return verifyRuntimePolicy(context);\n}\n/** Review only: never issues an authorization accepted by runtime/launch checks. */\nexport function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void {\n  verifyRuntimePolicy(context, bytes);\n}\nexport function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string {\n  const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n  if (!root) throw Error(\"Missing process-group state root\");\n  return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);\n}\nexport const authorizeHvRuntime = authorizeProcessGroupRuntime;\nexport function authorizeConfiguredProcessGroupRuntime(\n  pkg: string,\n  dir: string,\n  raw: Record<string, unknown>,\n  controllerName: string,\n  initialize = false,\n) {\n  return authorizeProcessGroupRuntime({\n    packageRoot: pkg,\n    instanceDirectory: dir,\n    rawConfiguration: raw,\n    channels: resolvedProcessGroupChannels(raw),\n    controllerName,\n    initialize,\n  });\n}\nexport function assertProcessGroupJournalAuthorization(\n  value: ProcessGroupAuthorization | undefined,\n  directory: string,\n  journalId: string | undefined,\n): void {\n  if (value && issued.has(value)) {\n    if (value.directory !== directory || value.journalId !== (journalId ?? null) || sha(read(value.file, true)) !== value.sha256)\n      throw Error(\"Exact reviewed process-group authorization required\");\n    return;\n  }\n  legacy.assertHvJournalAuthorization(value as legacy.HvAuthorization | undefined, directory, journalId);\n}\nexport const assertHvJournalAuthorization = assertProcessGroupJournalAuthorization;\nexport function assertProcessGroupStateMount(value: ProcessGroupAuthorization, root: string): void {\n  if (!issued.has(value)) {\n    legacy.assertHvStateMount(value as legacy.HvAuthorization, root);\n    return;\n  }\n  assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n  if (process.platform !== \"linux\" || !(\"namespace\" in value) || value.directory !== path.join(root, value.namespace, \"admission\", value.generationId ?? value.groupId))\n    throw Error(\"Process group requires its reviewed Linux state mount\");\n  const mount = fs\n    .readFileSync(\"/proc/self/mountinfo\", \"utf8\")\n    .split(\"\\n\")\n    .map((l) => l.split(\" \"))\n    .filter((f) => f[4] === root)\n    .at(-1);\n  if (!mount || !mount[5]?.split(\",\").includes(\"rw\") || ![\"xfs\", \"ext4\", \"btrfs\", \"zfs\"].includes(mount[mount.indexOf(\"-\") + 1] ?? \"\"))\n    throw Error(\"Process-group state root must be an explicit writable local Linux filesystem mount\");\n}\nexport const assertHvStateMount = assertProcessGroupStateMount;\nexport function assertProcessGroupTargetLaunch(\n  value: ProcessGroupAuthorization,\n  dir: string,\n  operationId: string | undefined,\n  launchId: string | undefined,\n): void {\n  if (!issued.has(value)) {\n    legacy.assertHvTargetLaunch(value as legacy.HvAuthorization, dir, operationId, launchId);\n    return;\n  }\n  if (value.role !== \"target\") return;\n  try {\n    assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n    const r = JSON.parse(read(path.join(dir, \"process-group-reservation.json\"), true).toString());\n    if (\n      !z.string().uuid().safeParse(operationId).success ||\n      !z.string().uuid().safeParse(launchId).success ||\n      r.operationId !== operationId ||\n      r.role !== \"target\" ||\n      r.lastLaunch?.launchId !== launchId ||\n      !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||\n      !digest.safeParse(r.configurationChecksum).success\n    )\n      throw Error();\n    if (\"configurationGroupSha256\" in value && value.configurationGroupSha256 !== undefined &&\n      (r.configurationGroupSha256 !== value.configurationGroupSha256 || r.generationId !== value.generationId)) throw Error();\n  } catch {\n    throw Error(\"Target requires its exact reviewed group reservation and launch identity\");\n  }\n}\nexport const assertHvTargetLaunch = assertProcessGroupTargetLaunch;\n"]}
+{"version":3,"file":"process-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/process-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,MAAM,MAAM,+CAA+C,CAAC;AACxE,OAAO,EAAE,qCAAqC,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACjK,OAAO,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AACxF,OAAO,EAEL,kCAAkC,EAClC,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,IAAI,IAAI,EAChC,MAAM,IAAI,GAAG,EACb,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,4BAA4B,CAAC;AAChF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAClD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACrD,WAAW,EAAE,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,mBAAmB,EAAE,MAAM;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,MAAM;IAC3B,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,EAAE;IACF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,YAAY,CAAC;IACtB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7H,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAgBH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AACrC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAC5D,kGAAkG;AAClG,MAAM,UAAU,iCAAiC,CAAC,KAAa;IAC7D,MAAM,CAAC,GAAC,kCAAkC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,IAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAG,CAAC,CAAC,kBAAkB;QAAC,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,GAAC,GAAG,CAAC,aAAa,KAAG,CAAC,CAAA,CAAC,CAAA,qCAAqC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA,CAAC,CAAA,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrK,MAAM,QAAQ,GAAC,QAAQ,CAAC,aAAa,KAAG,CAAC,CAAA,CAAC,CAAA,QAAQ,CAAC,YAAY,CAAA,CAAC,CAAA,QAAQ,CAAC,OAAO,CAAC;IACjF,IAAG,QAAQ,CAAC,WAAW,KAAG,CAAC,CAAC,WAAW,IAAE,QAAQ,CAAC,SAAS,KAAG,CAAC,CAAC,SAAS,IAAE,QAAQ,CAAC,OAAO,KAAG,CAAC,CAAC,OAAO,IAAE,QAAQ,CAAC,cAAc,KAAG,CAAC,CAAC,cAAc,IAAE,QAAQ,CAAC,SAAS,KAAG,CAAC,CAAC,SAAS,IAAE,QAAQ,CAAC,SAAS,KAAG,CAAC,CAAC,OAAO,CAAC,SAAS,IAAE,QAAQ,CAAC,SAAS,KAAG,CAAC,CAAC,OAAO,CAAC,SAAS,IAAE,QAAQ,KAAG,CAAC,CAAC,OAAO,CAAC,YAAY,IAAE,QAAQ,CAAC,SAAS,KAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAC,CAAC,CAAC,SAAS,EAAC,WAAW,EAAC,QAAQ,CAAC,IAAE,QAAQ,CAAC,cAAc,KAAG,CAAC,CAAC,MAAM,CAAC,cAAc;QAC3a,MAAM,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9E,IAAG,CAAC,QAAQ,CAAC,aAAa,KAAG,CAAC,CAAA,CAAC,CAAA,QAAQ,CAAC,WAAW,CAAA,CAAC,CAAA,QAAQ,CAAC,mBAAmB,CAAC,KAAG,CAAC,CAAC,MAAM,CAAC,cAAc;QACzG,MAAM,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClE,KAAI,MAAM,IAAI,IAAI,CAAC,WAAW,EAAC,UAAU,CAAU,EAAC,CAAC;QACnD,MAAM,CAAC,GAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,GAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,CAAC,IAAI,KAAG,WAAW,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,UAAU,CAAC,CAAC,CAAC;QAC9G,IAAG,CAAC,MAAM,IAAE,MAAM,CAAC,UAAU,KAAG,CAAC,CAAC,SAAS,CAAC,UAAU,IAAE,MAAM,CAAC,WAAW,KAAG,CAAC,CAAC,WAAW,IAAE,MAAM,CAAC,mBAAmB,KAAG,CAAC,CAAC,yBAAyB,IAAE,QAAQ,CAAC,cAAc,KAAG,CAAC,CAAC,cAAc,IAAE,CAAC,CAAC,SAAS,CAAC,OAAO,KAAG,CAAC,CAAC,WAAW;YACnO,MAAM,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IACD,IAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,KAAG,CAAC,CAAC,WAAW,IAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,CAAC,WAAW,KAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QACvJ,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW;IAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/H,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,yDAAyD;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrH,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;AACjC,CAAC;AACD,SAAS,YAAY,CAAC,GAAW,EAAE,GAA4B,EAAE,IAAY,EAAE,QAAiB;IAC9F,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QAC3E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,kCAAkC,CAAC,GAAG,EAAE,UAAU,CAAC,EAC3D,OAAO,GAAG,CAAC,CAAC,OAA8C,CAAC;IAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACrE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,UAAU,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AACD;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,4BAA4B,EAAE;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,UAAsD,CAAC;YAC3D,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;oBAAE,MAAM,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrI,UAAU,GAAG,UAAU;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACT,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBAC7E,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1C,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACrF,CAAC,CAAC,CAAC;YACP,CAAC;;gBAAM,UAAU,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,IAAI,OAAO,GAAgB,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBACrC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;oBAAE,MAAM,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACxE,KAAK,MAAM,KAAK,IAAI,OAAO;oBACzB,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjC,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAC5F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;wBACrD,IAAI,KAAK,CAAC,IAAI,GAAG,EAAE;4BAAE,MAAM,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC5E,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC;oBACH,iFAAiF;oBACjF,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxF,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;4BAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACpF,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;wBAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC1E,KAAK,MAAM,KAAK,IAAI,QAAQ;wBAC1B,IACE,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO;4BACjC,KAAK,CAAC,cAAc,EAAE;4BACtB,CAAC,KAAK,CAAC,WAAW,EAAE;4BACpB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC;4BAE/D,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpD,IAAG,GAAG,CAAC,aAAa,KAAG,CAAC,EAAC,CAAC;gBACxB,MAAM,CAAC,GAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAC/C,IAAG,CAAC,CAAC,SAAS,KAAG,IAAI,IAAE,IAAI,KAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,CAAC,CAAC,SAAS,EAAC,gBAAgB,EAAC,CAAC,CAAC,OAAO,CAAC,YAAY,GAAC,OAAO,CAAC;oBAAC,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC7J,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAAA,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5D,KAAI,MAAM,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAChH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GACL,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC;gBAClG,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC5C,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE;gBACpG,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1G,IACE,CAAC,CAAC,SAAS,KAAK,IAAI;gBACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC;gBACtE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC;gBAE9D,MAAM,KAAK,EAAE,CAAC;YAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAWD,SAAS,mBAAmB,CAAC,OAAyC,EAAE,SAAkB;IACxF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAC1F,KAAK,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvD,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7D,IACE,CAAC,QAAQ;YACT,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;YAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;YAC3B,CAAC,CAAC,gBAAgB,KAAK,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;YACzF,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;YACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;YAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;YACpB,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAC5E,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC;YAEpE,MAAM,KAAK,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;YAAE,MAAM,KAAK,EAAE,CAAC;QAC3I,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,mBAAmB;YAAE,MAAM,KAAK,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO;YAAE,MAAM,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,GAAG,YAAY,CAAC;QAC9C,IACE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YAC/D,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM;YACxE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;YAErF,MAAM,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,aAAa;gBAAE,MAAM,KAAK,EAAE,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;YACvB,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;YAC5D,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAU;YAClC,CAAC,QAAQ,EAAE,UAAU,CAAU;SAChC,CAAC,CAAC;QACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;YACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAEhE,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,GAAG,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EACvE,CAAC,GAAG,CAAC,CAAC,OAA8C,EACpD,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAClB,IACE,CAAC,KAAK;YACN,CAAC,CAAC,CAAC,OAAO;YACV,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC;YAC5C,KAAK,CAAC,mBAAmB,KAAK,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtF,CAAC,CAAC;YACF,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS;YAC9B,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;YACxC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YAEpC,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,MAAM,KAAK,EAAE,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,KAAK,EAAE,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,EACxE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,IAAI;YACtC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,SAAS;gBAChC,CAAC,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,SAAS;gBACpC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,EAAE,aAAa;YAEhD,MAAM,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;YAClB,IAAI;YACJ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,WAAW;YAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AACD,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,OAAyC;IACpF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,OAAyC,EAAE,KAAa;IAC1G,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,MAAM,UAAU,6BAA6B,CAAC,OAAyC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,sCAAsC,CACpD,GAAW,EACX,GAAW,EACX,GAA4B,EAC5B,cAAsB,EACtB,UAAU,GAAG,KAAK;IAElB,OAAO,4BAA4B,CAAC;QAClC,WAAW,EAAE,GAAG;QAChB,iBAAiB,EAAE,GAAG;QACtB,gBAAgB,EAAE,GAAG;QACrB,QAAQ,EAAE,4BAA4B,CAAC,GAAG,CAAC;QAC3C,cAAc;QACd,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,sCAAsC,CACpD,KAA4C,EAC5C,SAAiB,EACjB,SAA6B;IAE7B,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;YAC1H,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,4BAA4B,CAAC,KAA2C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AACzG,CAAC;AACD,MAAM,CAAC,MAAM,4BAA4B,GAAG,sCAAsC,CAAC;AACnF,MAAM,UAAU,4BAA4B,CAAC,KAAgC,EAAE,IAAY;IACzF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,kBAAkB,CAAC,KAA+B,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC;QACnK,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,EAAE;SACb,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC;SAC5C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACV,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAC/D,MAAM,UAAU,8BAA8B,CAC5C,KAAgC,EAChC,GAAW,EACX,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,oBAAoB,CAAC,KAA+B,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC;QACH,sCAAsC,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9F,IACE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO;YACjD,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO;YAC9C,CAAC,CAAC,WAAW,KAAK,WAAW;YAC7B,CAAC,CAAC,IAAI,KAAK,QAAQ;YACnB,CAAC,CAAC,UAAU,EAAE,QAAQ,KAAK,QAAQ;YACnC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO;YAC7D,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO;YAElD,MAAM,KAAK,EAAE,CAAC;QAChB,IAAI,0BAA0B,IAAI,KAAK,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS;YACrF,CAAC,CAAC,CAAC,wBAAwB,KAAK,KAAK,CAAC,wBAAwB,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,KAAK,EAAE,CAAC;IAC5H,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport * as legacy from \"./compatibility/energenti-authorization-v1.js\";\nimport { configurationGroupAuthorizationSchema, configurationGroupPolicyIdentity, verifyConfigurationGroupPolicy } from \"./configuration-group-authorization.js\";\nimport { processGroupRetirementPolicySchema } from \"./process-group-direct-contract.js\";\nimport {\n  type ProcessGroupRuntimeDescriptor,\n  normalizeProcessGroupConfiguration,\n  processGroupDescriptor,\n  resolvedProcessGroupChannels,\n} from \"./process-group-contract.js\";\nimport {\n  configurationAuthorizationHash,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource as read,\n  sha256 as sha,\n  assertPrivateProcessGroupDirectory,\n} from \"./process-group-resources.js\";\n\nexport { configurationAuthorizationHash, groupArtifactHash, groupChannelsHash } from \"./process-group-resources.js\";\n\nexport const hasProcessGroupAuthorization = legacy.hasProcessGroupAuthorization;\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  id = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nconst placement = z.strictObject({\n  instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n  processName: id,\n  role: z.enum([\"source\", \"target\", \"receiver\"]),\n  configurationSha256: digest,\n});\nexport const processGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(3),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(1),\n  packageName: z.string().min(1).max(214),\n  namespace: id,\n  groupId: id,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupManifestSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z.array(placement).min(4).max(18),\n});\nexport type ProcessGroupAuthorizationPolicy = z.infer<typeof processGroupAuthorizationSchema>;\nexport const processGroupManifestSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  id,\n  inputTopic: z\n    .string()\n    .min(1)\n    .max(512)\n    .regex(/^[^#+\\0]+$/),\n  processName: id,\n  profiles: z\n    .array(z.strictObject({ id, processName: id, mappingFile: z.string().min(1).max(512), mappingSha256: digest, dataGroup: id }))\n    .min(2)\n    .max(16),\n});\ninterface GenericAuthorization {\n  readonly sha256: string;\n  readonly file: string;\n  readonly directory: string;\n  readonly journalId: string | null;\n  readonly role: \"source\" | \"target\" | \"receiver\";\n  readonly groupId: string;\n  readonly groupProcessName: string;\n  readonly namespace: string;\n  readonly generationId?: string;\n  readonly configurationGroupSha256?: string;\n}\nexport type ProcessGroupAuthorization = legacy.HvAuthorization | GenericAuthorization;\nexport type HvAuthorization = ProcessGroupAuthorization;\nexport type HvAuthorizationPolicy = legacy.HvAuthorizationPolicy;\nexport const hvAuthorizationSchema = legacy.hvAuthorizationSchema;\nexport const productionGroupIds = legacy.productionGroupIds;\nconst issued = new WeakSet<object>();\nconst privateDirectory = assertPrivateProcessGroupDirectory;\n/** A retirement keeps the original journal/policy bound; older readers fail closed on schema5. */\nexport function parseProcessGroupRetirementPolicy(value:unknown) {\n  const p=processGroupRetirementPolicySchema.parse(value);\n  if(sha(p.sourcePolicyJson)!==p.sourcePolicySha256)throw Error(\"Original retirement policy bytes changed\");\n  const raw=JSON.parse(p.sourcePolicyJson), original=raw.schemaVersion===4?configurationGroupAuthorizationSchema.parse(raw):processGroupAuthorizationSchema.parse(raw);\n  const policyId=original.schemaVersion===4?original.generationId:original.groupId;\n  if(original.packageName!==p.packageName||original.namespace!==p.namespace||original.groupId!==p.groupId||original.controllerName!==p.controllerName||original.stateRoot!==p.stateRoot||original.directory!==p.journal.directory||original.journalId!==p.journal.journalId||policyId!==p.journal.generationId||original.directory!==path.join(p.stateRoot,p.namespace,\"admission\",policyId)||original.channelsSha256!==p.target.channelsSha256)\n    throw Error(\"Retirement journal or authority differs from original policy\");\n  if((original.schemaVersion===4?original.groupSha256:original.groupManifestSha256)!==p.target.resourceSha256)\n    throw Error(\"Retirement resource differs from original policy\");\n  for(const role of [\"publisher\",\"receiver\"] as const){\n    const m=p.source[role], before=original.placements.find(x=>x.role===(role===\"publisher\"?\"target\":\"receiver\"));\n    if(!before||before.instanceId!==m.placement.instanceId||before.processName!==m.processName||before.configurationSha256!==m.policyConfigurationSha256||original.artifactSha256!==m.artifactSha256||m.placement.rttNode!==p.packageName)\n      throw Error(\"Retirement source placement differs from original policy\");\n  }\n  if(p.target.placement.rttNode!==p.packageName||p.journal.profiles.some(x=>!original.placements.some(y=>y.role===\"source\"&&y.processName===x.processName)))\n    throw Error(\"Retirement profile ownership differs\");\n  return p;\n}\nfunction registryRoot(root: string, dir: string): string {\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || path.resolve(dir) !== dir) throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  if (dir === root) return \"*\"; // Explicit collection of independently owned namespaces.\n  const relative = path.relative(root, dir);\n  if (!path.isAbsolute(root) || path.resolve(root) !== root || !/^([a-z][a-z0-9-]{0,99})\\/authorizations$/.test(relative))\n    throw Error(\"Invalid policy registry\");\n  privateDirectory(root);\n  privateDirectory(dir);\n  return relative.split(\"/\")[0]!;\n}\nfunction selectedFile(pkg: string, raw: Record<string, unknown>, root: string, explicit?: string): string {\n  const configured = configurationGroupPolicyIdentity(pkg, raw);\n  if (configured) {\n    if (explicit) return explicit;\n    const directory = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (directory) {\n      const selected = registryRoot(root, directory);\n      if (selected !== \"*\" && selected !== configured.namespace) throw Error(\"Foreign runtime registry\");\n      const registry = selected === \"*\" ? path.join(root, configured.namespace, \"authorizations\") : directory;\n      privateDirectory(registry);\n      return path.join(registry, configured.generationId + \".json\");\n    }\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (!single) throw Error(\"No selected policy\");\n    return single;\n  }\n  const descriptor = processGroupDescriptor(pkg);\n  if (!descriptor) throw Error(\"Missing runtime contract\");\n  const c = normalizeProcessGroupConfiguration(raw, descriptor),\n    journal = c.journal as Record<string, unknown> | undefined;\n  const manifest = descriptor.manifests.find((m) => m.file === journal?.[\"groupManifest\"]);\n  if (!manifest) throw Error(\"Unregistered group manifest\");\n  const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n  if (explicit) return explicit;\n  if (dir) {\n    const selected = registryRoot(root, dir);\n    if (selected !== \"*\" && selected !== descriptor.namespace) throw Error(\"Foreign runtime registry\");\n    const registry = selected === \"*\" ? path.join(root, descriptor.namespace, \"authorizations\") : dir;\n    privateDirectory(registry);\n    return path.join(registry, manifest.id + \".json\");\n  }\n  const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n  if (!single) throw Error(\"No selected policy\");\n  return single;\n}\n/** Bounded private registry enumeration; retained state without its policy fails closed.\n * New groups are operator-owned data and never a release-time enum in the Controller.\n */\nexport function configuredGroupProcessNames(): Set<string> {\n  if (!hasProcessGroupAuthorization()) return new Set();\n  try {\n    const root = process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root) throw Error();\n    const files = new Set<string>();\n    const single = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_FILE\"];\n    if (single) files.add(single);\n    const dir = process.env[\"UNS_PROCESS_GROUP_AUTHORIZATION_DIRECTORY\"];\n    if (dir) {\n      const selected = registryRoot(root, dir);\n      let registries: { namespace: string; directory: string }[];\n      if (selected === \"*\") {\n        const namespaces = fs.readdirSync(root, { withFileTypes: true });\n        if (namespaces.length > 64 || namespaces.some((e) => e.isSymbolicLink())) throw Error(\"Registry namespace budget or link violation\");\n        registries = namespaces\n          .filter((e) => e.isDirectory())\n          .map((e) => {\n            if (!id.safeParse(e.name).success) throw Error(\"Invalid registry namespace\");\n            privateDirectory(path.join(root, e.name));\n            return { namespace: e.name, directory: path.join(root, e.name, \"authorizations\") };\n          });\n      } else registries = [{ namespace: selected, directory: dir }];\n      for (const registry of registries) {\n        let entries: fs.Dirent[] = [];\n        try {\n          privateDirectory(registry.directory);\n          entries = fs.readdirSync(registry.directory, { withFileTypes: true });\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n        if (entries.length > 64) throw Error(\"Policy registry budget exceeded\");\n        for (const entry of entries)\n          if (entry.name.endsWith(\".json\")) {\n            if (!/^[a-z][a-z0-9-]{0,99}\\.json$/.test(entry.name)) throw Error(\"Invalid registry entry\");\n            files.add(path.join(registry.directory, entry.name));\n            if (files.size > 64) throw Error(\"Total policy registry budget exceeded\");\n          }\n        const journals = path.join(root, registry.namespace, \"admission\");\n        try {\n          // Root/registry permissions already protect visibility; retain old parent modes.\n          for (let parent = journals; parent !== path.dirname(parent); parent = path.dirname(parent))\n            if (fs.lstatSync(parent).isSymbolicLink()) throw Error(\"Linked journal registry\");\n          const retained = fs.readdirSync(journals, { withFileTypes: true });\n          if (retained.length > 64) throw Error(\"Retained journal budget exceeded\");\n          for (const entry of retained)\n            if (\n              !id.safeParse(entry.name).success ||\n              entry.isSymbolicLink() ||\n              !entry.isDirectory() ||\n              !files.has(path.join(registry.directory, entry.name + \".json\"))\n            )\n              throw Error(\"Retained journal has no reviewed policy\");\n        } catch (e) {\n          if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e;\n        }\n      }\n    }\n    const result = new Set<string>();\n    for (const file of files) {\n      const raw = JSON.parse(read(file, true).toString());\n      if(raw.schemaVersion===5){\n        const p=parseProcessGroupRetirementPolicy(raw);\n        if(p.stateRoot!==root||file!==path.join(root,p.namespace,\"authorizations\",p.journal.generationId+\".json\"))throw Error(\"Retirement registry binding differs\");\n        privateDirectory(root);privateDirectory(path.dirname(file));\n        for(const member of [...p.journal.profiles,p.source.publisher,p.source.receiver])result.add(member.processName);\n        continue;\n      }\n      const p =\n        raw.schemaVersion === 4 ? configurationGroupAuthorizationSchema.parse(raw) : raw.schemaVersion === 3\n          ? processGroupAuthorizationSchema.parse(raw)\n          : z.union([legacy.hvAuthorizationSchema, legacy.processGroupAuthorizationSchema]).parse(raw);\n      const { namespace, group } = p.schemaVersion === 4 ? { namespace: p.namespace, group: p.generationId }\n        : p.schemaVersion === 3 ? { namespace: p.namespace, group: p.groupId } : legacy.legacyPolicyIdentity(p);\n      if (\n        p.stateRoot !== root ||\n        file !== path.join(root, namespace, \"authorizations\", group + \".json\") ||\n        p.directory !== path.join(root, namespace, \"admission\", group)\n      )\n        throw Error();\n      privateDirectory(root);\n      privateDirectory(path.dirname(file));\n      for (const role of p.placements) result.add(role.processName);\n    }\n    return result;\n  } catch {\n    throw Error(\"Process-group authorization registry is missing, changed or insecure; review required\");\n  }\n}\nexport interface ProcessGroupAuthorizationContext {\n  packageRoot: string;\n  instanceDirectory: string;\n  rawConfiguration: Record<string, unknown>;\n  channels: unknown[];\n  controllerName: string;\n  file?: string;\n  stateRoot?: string;\n  initialize?: boolean;\n}\nfunction verifyRuntimePolicy(context: ProcessGroupAuthorizationContext, candidate?: Buffer): ProcessGroupAuthorization {\n  try {\n    const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n    if (!root || !context.controllerName) throw Error();\n    const file = selectedFile(context.packageRoot, context.rawConfiguration, root, context.file),\n      bytes = candidate ?? read(file, true),\n      unparsed = JSON.parse(bytes.toString());\n    if (unparsed.schemaVersion === 4) {\n      const result = verifyConfigurationGroupPolicy(context, bytes, root, file);\n      if (!candidate) issued.add(result);\n      return result;\n    }\n    if (unparsed.schemaVersion !== 3) {\n      if (candidate) throw Error(\"Only generic policies can be staged\");\n      return legacy.authorizeHvRuntime({ ...context, file, stateRoot: root });\n    }\n    const p = processGroupAuthorizationSchema.parse(unparsed),\n      d = processGroupDescriptor(context.packageRoot);\n    if (!d || d.legacy) throw Error(\"Generic runtime descriptor required\");\n    const pkg = JSON.parse(read(path.join(context.packageRoot, \"package.json\")).toString());\n    const manifest = d.manifests.find((m) => m.id === p.groupId);\n    if (\n      !manifest ||\n      p.packageName !== pkg.name ||\n      p.namespace !== d.namespace ||\n      p.descriptorSha256 !== configurationAuthorizationHash(pkg.unsDatahub.processGroupRuntime) ||\n      p.packageRoot !== context.packageRoot ||\n      p.controllerName !== context.controllerName ||\n      p.stateRoot !== root ||\n      file !== path.join(root, d.namespace, \"authorizations\", p.groupId + \".json\") ||\n      p.directory !== path.join(root, d.namespace, \"admission\", p.groupId)\n    )\n      throw Error();\n    privateDirectory(root);\n    privateDirectory(path.dirname(file));\n    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256) throw Error();\n    const manifestBytes = read(path.join(context.packageRoot, manifest.file));\n    if (sha(manifestBytes) !== p.groupManifestSha256) throw Error();\n    const m = processGroupManifestSchema.parse(JSON.parse(manifestBytes.toString()));\n    if (m.id !== p.groupId) throw Error();\n    const receiver = m.processName + \"-admission\";\n    if (\n      new Set(m.profiles.map((x) => x.id)).size !== m.profiles.length ||\n      new Set(m.profiles.map((x) => x.processName)).size !== m.profiles.length ||\n      m.profiles.some((x) => x.processName === m.processName || x.processName === receiver)\n    )\n      throw Error();\n    for (const member of m.profiles) {\n      const f = path.resolve(context.packageRoot, path.dirname(manifest.file), member.mappingFile);\n      if (!f.startsWith(context.packageRoot + path.sep) || sha(read(f)) !== member.mappingSha256) throw Error();\n    }\n    const expected = new Map([\n      ...m.profiles.map((x) => [x.processName, \"source\"] as const),\n      [m.processName, \"target\"] as const,\n      [receiver, \"receiver\"] as const,\n    ]);\n    if (\n      p.placements.length !== expected.size ||\n      new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n      new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n      p.placements.some((x) => expected.get(x.processName) !== x.role)\n    )\n      throw Error();\n    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n    const c = normalizeProcessGroupConfiguration(context.rawConfiguration, d),\n      j = c.journal as Record<string, unknown> | undefined,\n      k = c.publisher;\n    if (\n      !entry ||\n      !c.matches ||\n      entry.processName !== c.uns?.[\"processName\"] ||\n      entry.configurationSha256 !== configurationAuthorizationHash(context.rawConfiguration) ||\n      !j ||\n      j[\"directory\"] !== p.directory ||\n      (j[\"journalId\"] ?? null) !== p.journalId ||\n      j[\"groupManifest\"] !== manifest.file\n    )\n      throw Error();\n    if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null) throw Error();\n    if (entry.role === \"receiver\" ? c.runtimeRole !== \"admission\" : c.runtimeRole !== undefined && c.runtimeRole !== \"publisher\") throw Error();\n    const member = m.profiles.find((x) => x.processName === entry.processName),\n      mapping = path.resolve(context.packageRoot, String(k[\"mappingFile\"]));\n    if (\n      entry.role !== \"source\"\n        ? k[\"groupManifest\"] !== manifest.file\n        : k[\"groupManifest\"] !== undefined ||\n          k[\"dataGroup\"] !== member?.dataGroup ||\n          !mapping.startsWith(context.packageRoot + path.sep) ||\n          sha(read(mapping)) !== member?.mappingSha256\n    )\n      throw Error();\n    const result = Object.freeze({\n      sha256: sha(bytes),\n      file,\n      directory: p.directory,\n      journalId: p.journalId,\n      role: entry.role,\n      groupId: p.groupId,\n      groupProcessName: m.processName,\n      namespace: d.namespace,\n    });\n    if (!candidate) issued.add(result);\n    return result;\n  } catch {\n    throw Error(\"Process-group runtime authorization is missing, changed or does not match this installed placement; review required\");\n  }\n}\n/** Live authority always comes from the current canonical private policy. */\nexport function authorizeProcessGroupRuntime(context: ProcessGroupAuthorizationContext): ProcessGroupAuthorization {\n  return verifyRuntimePolicy(context);\n}\n/** Review only: never issues an authorization accepted by runtime/launch checks. */\nexport function validateProcessGroupPolicyCandidate(context: ProcessGroupAuthorizationContext, bytes: Buffer): void {\n  verifyRuntimePolicy(context, bytes);\n}\nexport function processGroupAuthorizationFile(context: ProcessGroupAuthorizationContext): string {\n  const root = context.stateRoot ?? process.env[\"UNS_PROCESS_GROUP_STATE_ROOT\"];\n  if (!root) throw Error(\"Missing process-group state root\");\n  return selectedFile(context.packageRoot, context.rawConfiguration, root, context.file);\n}\nexport const authorizeHvRuntime = authorizeProcessGroupRuntime;\nexport function authorizeConfiguredProcessGroupRuntime(\n  pkg: string,\n  dir: string,\n  raw: Record<string, unknown>,\n  controllerName: string,\n  initialize = false,\n) {\n  return authorizeProcessGroupRuntime({\n    packageRoot: pkg,\n    instanceDirectory: dir,\n    rawConfiguration: raw,\n    channels: resolvedProcessGroupChannels(raw),\n    controllerName,\n    initialize,\n  });\n}\nexport function assertProcessGroupJournalAuthorization(\n  value: ProcessGroupAuthorization | undefined,\n  directory: string,\n  journalId: string | undefined,\n): void {\n  if (value && issued.has(value)) {\n    if (value.directory !== directory || value.journalId !== (journalId ?? null) || sha(read(value.file, true)) !== value.sha256)\n      throw Error(\"Exact reviewed process-group authorization required\");\n    return;\n  }\n  legacy.assertHvJournalAuthorization(value as legacy.HvAuthorization | undefined, directory, journalId);\n}\nexport const assertHvJournalAuthorization = assertProcessGroupJournalAuthorization;\nexport function assertProcessGroupStateMount(value: ProcessGroupAuthorization, root: string): void {\n  if (!issued.has(value)) {\n    legacy.assertHvStateMount(value as legacy.HvAuthorization, root);\n    return;\n  }\n  assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n  if (process.platform !== \"linux\" || !(\"namespace\" in value) || value.directory !== path.join(root, value.namespace, \"admission\", value.generationId ?? value.groupId))\n    throw Error(\"Process group requires its reviewed Linux state mount\");\n  const mount = fs\n    .readFileSync(\"/proc/self/mountinfo\", \"utf8\")\n    .split(\"\\n\")\n    .map((l) => l.split(\" \"))\n    .filter((f) => f[4] === root)\n    .at(-1);\n  if (!mount || !mount[5]?.split(\",\").includes(\"rw\") || ![\"xfs\", \"ext4\", \"btrfs\", \"zfs\"].includes(mount[mount.indexOf(\"-\") + 1] ?? \"\"))\n    throw Error(\"Process-group state root must be an explicit writable local Linux filesystem mount\");\n}\nexport const assertHvStateMount = assertProcessGroupStateMount;\nexport function assertProcessGroupTargetLaunch(\n  value: ProcessGroupAuthorization,\n  dir: string,\n  operationId: string | undefined,\n  launchId: string | undefined,\n): void {\n  if (!issued.has(value)) {\n    legacy.assertHvTargetLaunch(value as legacy.HvAuthorization, dir, operationId, launchId);\n    return;\n  }\n  if (value.role !== \"target\") return;\n  try {\n    assertProcessGroupJournalAuthorization(value, value.directory, value.journalId ?? undefined);\n    const r = JSON.parse(read(path.join(dir, \"process-group-reservation.json\"), true).toString());\n    if (\n      !z.string().uuid().safeParse(operationId).success ||\n      !z.string().uuid().safeParse(launchId).success ||\n      r.operationId !== operationId ||\n      r.role !== \"target\" ||\n      r.lastLaunch?.launchId !== launchId ||\n      !z.string().uuid().safeParse(r.lastLaunch?.requestId).success ||\n      !digest.safeParse(r.configurationChecksum).success\n    )\n      throw Error();\n    if (\"configurationGroupSha256\" in value && value.configurationGroupSha256 !== undefined &&\n      (r.configurationGroupSha256 !== value.configurationGroupSha256 || r.generationId !== value.generationId)) throw Error();\n  } catch {\n    throw Error(\"Target requires its exact reviewed group reservation and launch identity\");\n  }\n}\nexport const assertHvTargetLaunch = assertProcessGroupTargetLaunch;\n"]}

package/dist/runtime/process-group-contract.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 export { legacyDescriptorForPackage, legacyEnergentiDescriptor } from "./compatibility/energenti-descriptor-v1.js";
 export declare const processGroupProtocolVersion: 1;
+export declare const processGroupConfigurationSelectorSchema: z.ZodArray<z.ZodString>;
 export declare const processGroupRuntimeDescriptorSchema: z.ZodObject<{
     protocolVersion: z.ZodLiteral<1>;
     namespace: z.ZodString;

package/dist/runtime/process-group-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-contract.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-contract.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAEnH,eAAO,MAAM,2BAA2B,EAAG,CAAU,CAAC;AAgBtD,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;kBAqB5C,CAAC;AACL,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACpH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAOxF;AACD,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,6BAA6B,GAAG,SAAS,CAyBrG;AACD,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,6BAA6B;SAK1F,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;EAM7C;AACD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,CAAC,EAAE,6BAA6B,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,mBAAmB,CAAC,EAAE,MAAM,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB;AACD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,6BAA6B,iEAO5G;AACD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,kBAAmB,GAAG,OAAO,CAEpF;AACD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAMrG;AACD,eAAO,MAAM,yBAAyB;;;;;;;kBAiBpC,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACzF,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,+DAE5E;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;CACjC,GAAG,MAAM,CAUT;AACD,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,IAAI,CAAC,gCAAgC,EAAE,YAAY,GAAG,UAAU,CAAC,EACzE,QAAQ,EAAE,0BAA0B,EAAE,GACrC,MAAM,CAUR"}
+{"version":3,"file":"process-group-contract.d.ts","sourceRoot":"","sources":["../../src/runtime/process-group-contract.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAEnH,eAAO,MAAM,2BAA2B,EAAG,CAAU,CAAC;AAEtD,eAAO,MAAM,uCAAuC,yBAQ3C,CAAC;AAOV,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;kBAqB5C,CAAC;AACL,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,GAAG;IAAE,MAAM,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACpH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAOxF;AACD,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,6BAA6B,GAAG,SAAS,CAyBrG;AACD,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,6BAA6B;SAK1F,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;EAM7C;AACD,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,CAAC,EAAE,6BAA6B,EAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,mBAAmB,CAAC,EAAE,MAAM,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB;AACD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,6BAA6B,iEAO5G;AACD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,kBAAmB,GAAG,OAAO,CAEpF;AACD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAMrG;AACD,eAAO,MAAM,yBAAyB;;;;;;;kBAiBpC,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACzF,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,+DAE5E;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;CACjC,GAAG,MAAM,CAUT;AACD,wBAAgB,2BAA2B,CACzC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,IAAI,CAAC,gCAAgC,EAAE,YAAY,GAAG,UAAU,CAAC,EACzE,QAAQ,EAAE,0BAA0B,EAAE,GACrC,MAAM,CAUR"}

package/dist/runtime/process-group-contract.js

@@ -10,13 +10,14 @@ import { readProcessGroupResource, sha256 } from "./process-group-resources.js";
 export { legacyDescriptorForPackage, legacyEnergentiDescriptor } from "./compatibility/energenti-descriptor-v1.js";
 export const processGroupProtocolVersion = 1;
 const identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);
-const selector = z
+export const processGroupConfigurationSelectorSchema = z
     .array(z
     .string()
     .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)
     .refine((v) => !["__proto__", "constructor", "prototype"].includes(v)))
     .min(1)
     .max(8);
+const selector = processGroupConfigurationSelectorSchema;
 const relative = z
     .string()
     .min(1)

package/dist/runtime/process-group-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-group-contract.js","sourceRoot":"","sources":["../../src/runtime/process-group-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA0B,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAA6B,MAAM,4CAA4C,CAAC;AACnH;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEhF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAEnH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAU,CAAC;AACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5D,MAAM,QAAQ,GAAG,CAAC;KACf,KAAK,CACJ,CAAC;KACE,MAAM,EAAE;KACR,KAAK,CAAC,+BAA+B,CAAC;KACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,CAAC,CAAC,CAAC;AACV,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAChJ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,QAAQ;IACrB,eAAe,EAAE,QAAQ;IACzB,YAAY,EAAE,QAAQ;IACtB,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvF,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM;QAC1I,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9H,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,IAAuB;IAC7E,IAAI,KAAK,GAAY,GAAG,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAChH,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,kFAAkF;IAClF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjG,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACrD,MAAM,UAAU,GACd,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,mCAAmC,CAAC;YACvE,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;IAClB,oFAAoF;IACpF,IAAI,UAAU,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpI,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,kCAAkC,CAAC,GAA4B,EAAE,CAAgC;IAC/G,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,aAAa,CAAwC,CAAC;IACzG,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,GAAG;QACN,GAAG,EAAE,GAAG,CAAC,KAAK,CAA4B;QAC1C,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;QACtD,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzD,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK;KACpF,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,gCAAgC,CAC9C,GAA4B,EAC5B,CAAgC,EAChC,GAA4B,EAC5B,mBAA4B;IAE5B,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;IACxB,IAAI,KAAK,GAAG,UAAU,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7G,KAAK,GAAG,KAAgC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACtC,IAAI,mBAAmB;QAAE,UAAU,CAAC,qBAAqB,CAAC,GAAG,mBAAmB,CAAC;IACjF,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,GAA4B,EAAE,EAAkC;IAC3G,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC;IACxD,OAAO;QACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,kBAAkB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC;QACpE,kBAAkB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;KACtE,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACzE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrI,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB;IAC1F,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAC3B,IAAI,MAAM,CAAC,IAAI,SAAS,kCAAkC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACjG,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;SAChB,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;SACvB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;SACtB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;CAC7B,CAAC,CAAC;AAYH,MAAM,UAAU,gCAAgC,CAAC,GAA4B;IAC3E,OAAO,kBAAkB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAM1C;IACC,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;KAC7B,CAAC,CACH,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,2BAA2B,CACzC,cAAsB,EACtB,MAAyE,EACzE,QAAsC;IAEtC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,CAAC;QACV,cAAc;QACd,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,QAAQ;aACf,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;aAC/F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { type MqttChannelConfig, resolveMqttChannel } from \"../uns-config/mqtt-channel.js\";\nimport { legacyDescriptorForPackage, legacyEnergentiDescriptor } from \"./compatibility/energenti-descriptor-v1.js\";\n/** Versioned, data-only contract for same-host MQTT journal process groups.\n * Package declarations describe resources; only private operator policies grant authority.\n */\nimport { readProcessGroupResource, sha256 } from \"./process-group-resources.js\";\n\nexport { legacyDescriptorForPackage, legacyEnergentiDescriptor } from \"./compatibility/energenti-descriptor-v1.js\";\n\nexport const processGroupProtocolVersion = 1 as const;\nconst identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst selector = z\n  .array(\n    z\n      .string()\n      .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)\n      .refine((v) => ![\"__proto__\", \"constructor\", \"prototype\"].includes(v)),\n  )\n  .min(1)\n  .max(8);\nconst relative = z\n  .string()\n  .min(1)\n  .max(512)\n  .refine((v) => !path.isAbsolute(v) && path.normalize(v) === v && !v.split(/[\\\\/]/).some((x) => x === \"..\" || x === \".\") && !v.includes(\"\\0\"));\nexport const processGroupRuntimeDescriptorSchema = z\n  .strictObject({\n    protocolVersion: z.literal(1),\n    namespace: identity,\n    publisherPath: selector,\n    journalPath: selector,\n    runtimeRolePath: selector,\n    receiverRole: identity,\n    defaultDataGroup: identity.optional(),\n    match: z.strictObject({ path: selector, value: z.string().min(1).max(100) }).optional(),\n    manifests: z\n      .array(z.strictObject({ id: identity, file: relative }))\n      .min(1)\n      .max(64),\n  })\n  .superRefine((d, c) => {\n    if (new Set(d.manifests.map((v) => v.id)).size !== d.manifests.length || new Set(d.manifests.map((v) => v.file)).size !== d.manifests.length)\n      c.addIssue({ code: \"custom\", message: \"Distinct group manifests required\" });\n    const paths = [d.publisherPath, d.journalPath, d.runtimeRolePath].map((v) => v.join(\".\"));\n    if (new Set(paths).size !== paths.length || paths.some((p, i) => paths.some((other, j) => i !== j && other.startsWith(p + \".\"))))\n      c.addIssue({ code: \"custom\", message: \"Distinct configuration selectors required\" });\n  });\nexport type ProcessGroupRuntimeDescriptor = z.infer<typeof processGroupRuntimeDescriptorSchema> & { legacy?: true };\nexport function readConfigurationSelector(raw: unknown, keys: readonly string[]): unknown {\n  let value: unknown = raw;\n  for (const key of keys) {\n    if (!value || typeof value !== \"object\" || Array.isArray(value) || !Object.hasOwn(value, key)) return undefined;\n    value = (value as Record<string, unknown>)[key];\n  }\n  return value;\n}\n/** Strictly bounded package metadata, no executable application adapter in the Controller. */\nexport function processGroupDescriptor(packageRoot: string): ProcessGroupRuntimeDescriptor | undefined {\n  const file = path.join(packageRoot, \"package.json\");\n  if (!fs.existsSync(file)) return undefined;\n  // Discovery must not impose journal path rules on unrelated Node/Python packages.\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  let bytes: Buffer;\n  try {\n    const stat = fs.fstatSync(fd);\n    if (!stat.isFile() || stat.size > 1024 * 1024) throw Error(\"Invalid installed runtime metadata\");\n    bytes = fs.readFileSync(fd);\n    if (bytes.length > 1024 * 1024) throw Error(\"Installed runtime metadata is too large\");\n  } finally {\n    fs.closeSync(fd);\n  }\n  const pkg = JSON.parse(bytes.toString());\n  const declared = pkg.unsDatahub?.processGroupRuntime;\n  const descriptor =\n    declared !== undefined\n      ? processGroupRuntimeDescriptorSchema.parse(declared)\n      : [1, 2, 3].includes(pkg.unsDatahub?.processGroupProductionAuthorization)\n        ? legacyDescriptorForPackage(String(pkg.name))\n        : undefined;\n  // Opted-in groups still require canonical, unchanged, unlinked installed resources.\n  if (descriptor && !readProcessGroupResource(file).equals(bytes)) throw Error(\"Installed runtime metadata changed during discovery\");\n  return descriptor;\n}\nexport function normalizeProcessGroupConfiguration(raw: Record<string, unknown>, d: ProcessGroupRuntimeDescriptor) {\n  const publisher = readConfigurationSelector(raw, d.publisherPath) as Record<string, unknown> | undefined;\n  const role = readConfigurationSelector(raw, d.runtimeRolePath);\n  return {\n    ...raw,\n    uns: raw[\"uns\"] as Record<string, unknown>,\n    publisher: publisher ?? {},\n    journal: readConfigurationSelector(raw, d.journalPath),\n    runtimeRole: role === d.receiverRole ? \"admission\" : role,\n    matches: !d.match || readConfigurationSelector(raw, d.match.path) === d.match.value,\n  };\n}\nexport function projectProcessGroupConfiguration(\n  raw: Record<string, unknown>,\n  d: ProcessGroupRuntimeDescriptor,\n  uns: Record<string, unknown>,\n  authorizationSha256?: string,\n): Record<string, unknown> {\n  const projection = structuredClone(raw);\n  projection[\"uns\"] = uns;\n  let value = projection;\n  for (const key of d.publisherPath.slice(0, -1)) {\n    const child = value[key];\n    if (!child || typeof child !== \"object\" || Array.isArray(child)) throw Error(\"Invalid publisher projection\");\n    value = child as Record<string, unknown>;\n  }\n  delete value[d.publisherPath.at(-1)!];\n  if (authorizationSha256) projection[\"authorizationSha256\"] = authorizationSha256;\n  return projection;\n}\nexport function resolvedProcessGroupChannels(raw: Record<string, unknown>, _d?: ProcessGroupRuntimeDescriptor) {\n  const infra = (raw[\"infra\"] ?? {}) as MqttChannelConfig;\n  return [\n    resolveMqttChannel(infra),\n    resolveMqttChannel(infra, (raw[\"input\"] ?? {}) as MqttChannelConfig),\n    resolveMqttChannel(infra, (raw[\"output\"] ?? {}) as MqttChannelConfig),\n  ];\n}\nexport function isLocalPilotPath(value: string, platform = process.platform): boolean {\n  return path.resolve(value) === value && (value.startsWith(\"/private/tmp/\") || (platform === \"linux\" && value.startsWith(\"/tmp/\")));\n}\nexport function isProcessGroupJournalPath(root: string, directory: string, namespace: string): boolean {\n  return (\n    path.isAbsolute(root) &&\n    path.resolve(root) === root &&\n    new RegExp(`^${namespace}/admission/[a-z][a-z0-9-]{0,99}$`).test(path.relative(root, directory))\n  );\n}\nexport const processGroupJournalSchema = z.strictObject({\n  directory: z.string().startsWith(\"/\").max(512),\n  journalId: z.string().uuid().optional(),\n  minFreeBytes: z\n    .number()\n    .int()\n    .min(1024 * 1024)\n    .max(1024 * 1024 * 1024)\n    .default(64 * 1024 * 1024),\n  groupManifest: z.string().min(1).max(512),\n  maxRecords: z.number().int().min(1).max(100000).default(20000),\n  maxBytes: z\n    .number()\n    .int()\n    .min(1024)\n    .max(256 * 1024 * 1024)\n    .default(32 * 1024 * 1024),\n});\nexport type ProcessGroupJournalConfiguration = z.infer<typeof processGroupJournalSchema>;\nexport interface ProcessGroupJournalProfile {\n  processName: string;\n  mappingSha256: string;\n  dataGroup: string;\n}\nexport interface ProcessGroupJournalTask {\n  profile: string;\n  payload: string;\n}\n\nexport function resolvedProcessGroupInputChannel(raw: Record<string, unknown>) {\n  return resolveMqttChannel((raw[\"infra\"] ?? {}) as MqttChannelConfig, (raw[\"input\"] ?? {}) as MqttChannelConfig);\n}\n\nexport function processGroupSourceIdentity(input: {\n  host: string;\n  port?: number | undefined;\n  protocol?: string | undefined;\n  hosts?: string[] | undefined;\n  servers?: unknown[] | undefined;\n}): string {\n  return sha256(\n    JSON.stringify({\n      host: input.host,\n      port: input.port ?? 1883,\n      protocol: input.protocol ?? \"mqtt\",\n      hosts: input.hosts ?? [],\n      servers: input.servers ?? [],\n    }),\n  );\n}\nexport function processGroupJournalContract(\n  sourceIdentity: string,\n  config: Pick<ProcessGroupJournalConfiguration, \"maxRecords\" | \"maxBytes\">,\n  profiles: ProcessGroupJournalProfile[],\n): string {\n  return JSON.stringify({\n    version: 1,\n    sourceIdentity,\n    maxRecords: config.maxRecords,\n    maxBytes: config.maxBytes,\n    profiles: profiles\n      .map(({ processName, mappingSha256, dataGroup }) => ({ processName, mappingSha256, dataGroup }))\n      .sort((a, b) => a.processName.localeCompare(b.processName)),\n  });\n}\n"]}
+{"version":3,"file":"process-group-contract.js","sourceRoot":"","sources":["../../src/runtime/process-group-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA0B,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAA6B,MAAM,4CAA4C,CAAC;AACnH;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAEhF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAEnH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAU,CAAC;AACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,KAAK,CACJ,CAAC;KACE,MAAM,EAAE;KACR,KAAK,CAAC,+BAA+B,CAAC;KACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACzE;KACA,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,CAAC,CAAC,CAAC;AACV,MAAM,QAAQ,GAAG,uCAAuC,CAAC;AACzD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAChJ,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,QAAQ;IACrB,eAAe,EAAE,QAAQ;IACzB,YAAY,EAAE,QAAQ;IACtB,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvF,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM;QAC1I,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9H,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,yBAAyB,CAAC,GAAY,EAAE,IAAuB;IAC7E,IAAI,KAAK,GAAY,GAAG,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAChH,KAAK,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,kFAAkF;IAClF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjG,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACrD,MAAM,UAAU,GACd,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,mCAAmC,CAAC;YACvE,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAC;IAClB,oFAAoF;IACpF,IAAI,UAAU,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpI,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,kCAAkC,CAAC,GAA4B,EAAE,CAAgC;IAC/G,MAAM,SAAS,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,aAAa,CAAwC,CAAC;IACzG,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,GAAG;QACN,GAAG,EAAE,GAAG,CAAC,KAAK,CAA4B;QAC1C,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,OAAO,EAAE,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;QACtD,WAAW,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACzD,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK;KACpF,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,gCAAgC,CAC9C,GAA4B,EAC5B,CAAgC,EAChC,GAA4B,EAC5B,mBAA4B;IAE5B,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;IACxB,IAAI,KAAK,GAAG,UAAU,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7G,KAAK,GAAG,KAAgC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACtC,IAAI,mBAAmB;QAAE,UAAU,CAAC,qBAAqB,CAAC,GAAG,mBAAmB,CAAC;IACjF,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,GAA4B,EAAE,EAAkC;IAC3G,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC;IACxD,OAAO;QACL,kBAAkB,CAAC,KAAK,CAAC;QACzB,kBAAkB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC;QACpE,kBAAkB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;KACtE,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACzE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrI,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB;IAC1F,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;QAC3B,IAAI,MAAM,CAAC,IAAI,SAAS,kCAAkC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CACjG,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;SAChB,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;SACvB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;SACtB,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;CAC7B,CAAC,CAAC;AAYH,MAAM,UAAU,gCAAgC,CAAC,GAA4B;IAC3E,OAAO,kBAAkB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAsB,CAAC,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAM1C;IACC,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;KAC7B,CAAC,CACH,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,2BAA2B,CACzC,cAAsB,EACtB,MAAyE,EACzE,QAAsC;IAEtC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,CAAC;QACV,cAAc;QACd,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,QAAQ;aACf,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;aAC/F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { type MqttChannelConfig, resolveMqttChannel } from \"../uns-config/mqtt-channel.js\";\nimport { legacyDescriptorForPackage, legacyEnergentiDescriptor } from \"./compatibility/energenti-descriptor-v1.js\";\n/** Versioned, data-only contract for same-host MQTT journal process groups.\n * Package declarations describe resources; only private operator policies grant authority.\n */\nimport { readProcessGroupResource, sha256 } from \"./process-group-resources.js\";\n\nexport { legacyDescriptorForPackage, legacyEnergentiDescriptor } from \"./compatibility/energenti-descriptor-v1.js\";\n\nexport const processGroupProtocolVersion = 1 as const;\nconst identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nexport const processGroupConfigurationSelectorSchema = z\n  .array(\n    z\n      .string()\n      .regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,99}$/)\n      .refine((v) => ![\"__proto__\", \"constructor\", \"prototype\"].includes(v)),\n  )\n  .min(1)\n  .max(8);\nconst selector = processGroupConfigurationSelectorSchema;\nconst relative = z\n  .string()\n  .min(1)\n  .max(512)\n  .refine((v) => !path.isAbsolute(v) && path.normalize(v) === v && !v.split(/[\\\\/]/).some((x) => x === \"..\" || x === \".\") && !v.includes(\"\\0\"));\nexport const processGroupRuntimeDescriptorSchema = z\n  .strictObject({\n    protocolVersion: z.literal(1),\n    namespace: identity,\n    publisherPath: selector,\n    journalPath: selector,\n    runtimeRolePath: selector,\n    receiverRole: identity,\n    defaultDataGroup: identity.optional(),\n    match: z.strictObject({ path: selector, value: z.string().min(1).max(100) }).optional(),\n    manifests: z\n      .array(z.strictObject({ id: identity, file: relative }))\n      .min(1)\n      .max(64),\n  })\n  .superRefine((d, c) => {\n    if (new Set(d.manifests.map((v) => v.id)).size !== d.manifests.length || new Set(d.manifests.map((v) => v.file)).size !== d.manifests.length)\n      c.addIssue({ code: \"custom\", message: \"Distinct group manifests required\" });\n    const paths = [d.publisherPath, d.journalPath, d.runtimeRolePath].map((v) => v.join(\".\"));\n    if (new Set(paths).size !== paths.length || paths.some((p, i) => paths.some((other, j) => i !== j && other.startsWith(p + \".\"))))\n      c.addIssue({ code: \"custom\", message: \"Distinct configuration selectors required\" });\n  });\nexport type ProcessGroupRuntimeDescriptor = z.infer<typeof processGroupRuntimeDescriptorSchema> & { legacy?: true };\nexport function readConfigurationSelector(raw: unknown, keys: readonly string[]): unknown {\n  let value: unknown = raw;\n  for (const key of keys) {\n    if (!value || typeof value !== \"object\" || Array.isArray(value) || !Object.hasOwn(value, key)) return undefined;\n    value = (value as Record<string, unknown>)[key];\n  }\n  return value;\n}\n/** Strictly bounded package metadata, no executable application adapter in the Controller. */\nexport function processGroupDescriptor(packageRoot: string): ProcessGroupRuntimeDescriptor | undefined {\n  const file = path.join(packageRoot, \"package.json\");\n  if (!fs.existsSync(file)) return undefined;\n  // Discovery must not impose journal path rules on unrelated Node/Python packages.\n  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);\n  let bytes: Buffer;\n  try {\n    const stat = fs.fstatSync(fd);\n    if (!stat.isFile() || stat.size > 1024 * 1024) throw Error(\"Invalid installed runtime metadata\");\n    bytes = fs.readFileSync(fd);\n    if (bytes.length > 1024 * 1024) throw Error(\"Installed runtime metadata is too large\");\n  } finally {\n    fs.closeSync(fd);\n  }\n  const pkg = JSON.parse(bytes.toString());\n  const declared = pkg.unsDatahub?.processGroupRuntime;\n  const descriptor =\n    declared !== undefined\n      ? processGroupRuntimeDescriptorSchema.parse(declared)\n      : [1, 2, 3].includes(pkg.unsDatahub?.processGroupProductionAuthorization)\n        ? legacyDescriptorForPackage(String(pkg.name))\n        : undefined;\n  // Opted-in groups still require canonical, unchanged, unlinked installed resources.\n  if (descriptor && !readProcessGroupResource(file).equals(bytes)) throw Error(\"Installed runtime metadata changed during discovery\");\n  return descriptor;\n}\nexport function normalizeProcessGroupConfiguration(raw: Record<string, unknown>, d: ProcessGroupRuntimeDescriptor) {\n  const publisher = readConfigurationSelector(raw, d.publisherPath) as Record<string, unknown> | undefined;\n  const role = readConfigurationSelector(raw, d.runtimeRolePath);\n  return {\n    ...raw,\n    uns: raw[\"uns\"] as Record<string, unknown>,\n    publisher: publisher ?? {},\n    journal: readConfigurationSelector(raw, d.journalPath),\n    runtimeRole: role === d.receiverRole ? \"admission\" : role,\n    matches: !d.match || readConfigurationSelector(raw, d.match.path) === d.match.value,\n  };\n}\nexport function projectProcessGroupConfiguration(\n  raw: Record<string, unknown>,\n  d: ProcessGroupRuntimeDescriptor,\n  uns: Record<string, unknown>,\n  authorizationSha256?: string,\n): Record<string, unknown> {\n  const projection = structuredClone(raw);\n  projection[\"uns\"] = uns;\n  let value = projection;\n  for (const key of d.publisherPath.slice(0, -1)) {\n    const child = value[key];\n    if (!child || typeof child !== \"object\" || Array.isArray(child)) throw Error(\"Invalid publisher projection\");\n    value = child as Record<string, unknown>;\n  }\n  delete value[d.publisherPath.at(-1)!];\n  if (authorizationSha256) projection[\"authorizationSha256\"] = authorizationSha256;\n  return projection;\n}\nexport function resolvedProcessGroupChannels(raw: Record<string, unknown>, _d?: ProcessGroupRuntimeDescriptor) {\n  const infra = (raw[\"infra\"] ?? {}) as MqttChannelConfig;\n  return [\n    resolveMqttChannel(infra),\n    resolveMqttChannel(infra, (raw[\"input\"] ?? {}) as MqttChannelConfig),\n    resolveMqttChannel(infra, (raw[\"output\"] ?? {}) as MqttChannelConfig),\n  ];\n}\nexport function isLocalPilotPath(value: string, platform = process.platform): boolean {\n  return path.resolve(value) === value && (value.startsWith(\"/private/tmp/\") || (platform === \"linux\" && value.startsWith(\"/tmp/\")));\n}\nexport function isProcessGroupJournalPath(root: string, directory: string, namespace: string): boolean {\n  return (\n    path.isAbsolute(root) &&\n    path.resolve(root) === root &&\n    new RegExp(`^${namespace}/admission/[a-z][a-z0-9-]{0,99}$`).test(path.relative(root, directory))\n  );\n}\nexport const processGroupJournalSchema = z.strictObject({\n  directory: z.string().startsWith(\"/\").max(512),\n  journalId: z.string().uuid().optional(),\n  minFreeBytes: z\n    .number()\n    .int()\n    .min(1024 * 1024)\n    .max(1024 * 1024 * 1024)\n    .default(64 * 1024 * 1024),\n  groupManifest: z.string().min(1).max(512),\n  maxRecords: z.number().int().min(1).max(100000).default(20000),\n  maxBytes: z\n    .number()\n    .int()\n    .min(1024)\n    .max(256 * 1024 * 1024)\n    .default(32 * 1024 * 1024),\n});\nexport type ProcessGroupJournalConfiguration = z.infer<typeof processGroupJournalSchema>;\nexport interface ProcessGroupJournalProfile {\n  processName: string;\n  mappingSha256: string;\n  dataGroup: string;\n}\nexport interface ProcessGroupJournalTask {\n  profile: string;\n  payload: string;\n}\n\nexport function resolvedProcessGroupInputChannel(raw: Record<string, unknown>) {\n  return resolveMqttChannel((raw[\"infra\"] ?? {}) as MqttChannelConfig, (raw[\"input\"] ?? {}) as MqttChannelConfig);\n}\n\nexport function processGroupSourceIdentity(input: {\n  host: string;\n  port?: number | undefined;\n  protocol?: string | undefined;\n  hosts?: string[] | undefined;\n  servers?: unknown[] | undefined;\n}): string {\n  return sha256(\n    JSON.stringify({\n      host: input.host,\n      port: input.port ?? 1883,\n      protocol: input.protocol ?? \"mqtt\",\n      hosts: input.hosts ?? [],\n      servers: input.servers ?? [],\n    }),\n  );\n}\nexport function processGroupJournalContract(\n  sourceIdentity: string,\n  config: Pick<ProcessGroupJournalConfiguration, \"maxRecords\" | \"maxBytes\">,\n  profiles: ProcessGroupJournalProfile[],\n): string {\n  return JSON.stringify({\n    version: 1,\n    sourceIdentity,\n    maxRecords: config.maxRecords,\n    maxBytes: config.maxBytes,\n    profiles: profiles\n      .map(({ processName, mappingSha256, dataGroup }) => ({ processName, mappingSha256, dataGroup }))\n      .sort((a, b) => a.processName.localeCompare(b.processName)),\n  });\n}\n"]}