agent-hitch 0.2.13 → 0.2.14

package/dist/src/resources/api.js

@@ -0,0 +1,207 @@
+import { lstat, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { DockerRegistryResolver } from "../images/index.js";
+import { durableWriteJSON as atomicWriteJSON } from "../foundation/index.js";
+import { auditResources } from "./gc.js";
+import { materializeResourceTask, finishResourceWorkspace } from "./materialize.js";
+import { DockerResourceImageProvider } from "./oci-provider.js";
+import { localRegistry } from "./oci-registry-bundle.js";
+import { identity, object, parseStrictJson, resourceId } from "./protocol.js";
+import { limits } from "./object-store.js";
+import { ResourceStore } from "./store.js";
+import { exportResourceBundle, importResourceBundle } from "./bundle.js";
+import { resourceStorageStats } from "./stats.js";
+import { parseResourceDataset, preflightResourceTask, readResourceInput, sealResourceTask, selectResources, RESOURCE_EXECUTION_CAPABILITIES } from "./tasks.js";
+export async function configuredResourceStore(root) {
+    let config = { protocol: "hitch-resource-host@1", transport: {}, imagePolicy: "cache-first", platform: "linux/amd64", workspace: {} };
+    try {
+        config = parseHostConfig(parseStrictJson(await readFile(path.join(root, "resource-config.json"), "utf8")));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return { store: new ResourceStore(root, { ...(config.limits ? { limits: config.limits } : {}), images: new DockerResourceImageProvider(root, config.transport, new DockerRegistryResolver({ policy: config.imagePolicy }), config.offline, config.imagePolicy, limits(config.limits)) }), config };
+}
+export async function preflightResourceInput(store, ref, options) {
+    return store.admission(() => preflightInput(store, ref, options));
+}
+async function preflightInput(store, ref, options) {
+    const source = await readResourceInput(ref);
+    if (!source)
+        return undefined;
+    const execution = "schema_version" in source ? source.execution : source.manifest.execution;
+    if (execution.platform !== options.platform)
+        throw new Error("resource execution platform differs from the frozen plan");
+    const capabilities = "schema_version" in source ? source.required_capabilities : source.manifest.required_capabilities;
+    for (const c of capabilities)
+        if (!RESOURCE_EXECUTION_CAPABILITIES.includes(c))
+            throw new Error(`unsupported required resource capability: ${c}`);
+    const isDirectory = (await lstat(ref)).isDirectory(), plans = [];
+    for (const task of source.tasks) {
+        if (isDirectory) {
+            const actual = await store.import(path.join(ref, task.task_id), "tree", `${options.owner}:source-check`, options.signal);
+            await store.finishLease(actual.leaseId, "ended");
+            if (identity("hitch-source-task@1", actual.resource) !== task.source_task_digest)
+                throw new Error("local task descriptor changed since sealing");
+        }
+        plans.push((await preflightResourceTask(store, task, { ...options, owner: `${options.owner}:${task.task_id}` })).plan);
+    }
+    const inputDigest = "schema_version" in source ? source.dataset_digest : source.digest;
+    return { protocol: "hitch-resource-preflight@1", inputDigest, plans, planDigest: identity("hitch-resource-preflight@1", { inputDigest, plans: plans.map(p => ({ taskId: p.task.task_id, digest: p.digest })) }) };
+}
+export async function resourceRequest(root, operation, value) {
+    if (operation === "capabilities")
+        return { protocol: "hitch-resources-api@1", capabilities: RESOURCE_EXECUTION_CAPABILITIES, selections: "hitch-resource-selection@1" };
+    if (operation === "configure") {
+        const config = parseHostConfig(value);
+        await atomicWriteJSON(path.join(root, "resource-config.json"), config);
+        return config;
+    }
+    const { store, config } = await configuredResourceStore(root);
+    switch (operation) {
+        case "inspect": {
+            object(value, []);
+            return resourceStorageStats(store);
+        }
+        case "import": {
+            const input = object(value, ["source", "kind", "owner"]);
+            if (typeof input.source !== "string" || typeof input.owner !== "string" || input.kind !== "blob" && input.kind !== "tree")
+                throw new TypeError("invalid resource import request");
+            return store.import(path.resolve(input.source), input.kind, input.owner);
+        }
+        case "pin": {
+            const input = object(value, ["owner", "generation", "purpose", "lock"]);
+            return store.pin(input);
+        }
+        case "release": {
+            const input = object(value, ["owner", "generation"]);
+            await store.release(input.owner, input.generation);
+            return { released: true };
+        }
+        case "lease-end": {
+            const input = object(value, ["leaseId", "confirmation"]);
+            if (typeof input.leaseId !== "string" || !["ended", "unknown"].includes(String(input.confirmation)))
+                throw new TypeError("invalid lease confirmation");
+            await store.finishLease(input.leaseId, input.confirmation);
+            return { acknowledged: true };
+        }
+        case "audit": {
+            const input = object(value, ["apply", "graceMs"]);
+            if (input.apply !== undefined && typeof input.apply !== "boolean")
+                throw new TypeError("apply must be explicit boolean");
+            return auditResources(store, input);
+        }
+        case "bundle-export": {
+            const input = object(value, ["ref", "output", "owner"]);
+            if (typeof input.ref !== "string" || typeof input.output !== "string" || typeof input.owner !== "string")
+                throw new TypeError("invalid bundle export request");
+            const source = await readResourceInput(input.ref);
+            if (!source)
+                throw new Error("resource input required");
+            const selection = "schema_version" in source ? selectResources(source, source.tasks.map(t => t.task_id)) : source;
+            return exportResourceBundle(store, selection, input.output, input.owner);
+        }
+        case "bundle-import": {
+            const input = object(value, ["directory", "owner", "output"]);
+            if (typeof input.directory !== "string" || typeof input.owner !== "string" || typeof input.output !== "string")
+                throw new TypeError("invalid bundle import request");
+            if (config.imagePolicy !== "cache-only")
+                throw new Error("offline bundle import requires cache-only image policy");
+            const result = await importResourceBundle(store, input.directory, input.owner);
+            await writeFile(input.output, JSON.stringify(result.selection), { flag: "wx", mode: 0o600 });
+            return result;
+        }
+        case "seal-dataset": {
+            const input = object(value, ["directory", "owner", "manifest", "taskIds"]);
+            if (typeof input.directory !== "string" || typeof input.owner !== "string" || !Array.isArray(input.taskIds) || input.taskIds.some(id => typeof id !== "string"))
+                throw new TypeError("invalid dataset seal request");
+            const directory = input.directory, owner = input.owner, taskIds = input.taskIds;
+            return store.admission(async () => {
+                const metadata = object(input.manifest, ["benchmark", "adapter", "scoring", "raw_metrics", "required_capabilities", "execution"]);
+                const tasks = [];
+                for (const id of [...taskIds].sort()) {
+                    resourceId(id);
+                    tasks.push(await sealResourceTask(store, path.join(directory, id), id, `${owner}:${id}`));
+                }
+                const body = { schema_version: "2", kind: "gear-harbor-benchmark", resource_protocol: "hitch-resource-lock@1", ...metadata, tasks };
+                const manifest = parseResourceDataset({ ...body, dataset_digest: identity("hitch-resource-dataset@2", body) });
+                if (manifest.execution.platform !== config.platform)
+                    throw new Error("resource execution platform differs from host");
+                for (const capability of manifest.required_capabilities)
+                    if (!RESOURCE_EXECUTION_CAPABILITIES.includes(capability))
+                        throw new Error(`unsupported required resource capability: ${capability}`);
+                for (const task of tasks)
+                    await preflightResourceTask(store, task, { owner: `${owner}:admission:${task.task_id}`, generation: 1, platform: config.platform });
+                await writeFile(path.join(directory, "benchmark.adapter.json"), `${JSON.stringify(manifest, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+                return manifest;
+            });
+        }
+        case "seal-task": {
+            const input = object(value, ["directory", "taskId", "owner"]);
+            if ([input.directory, input.taskId, input.owner].some(v => typeof v !== "string"))
+                throw new TypeError("invalid task seal request");
+            return sealResourceTask(store, input.directory, input.taskId, input.owner);
+        }
+        case "preflight": {
+            const input = object(value, ["ref", "owner", "generation", "platform"]);
+            if (typeof input.ref !== "string" || typeof input.owner !== "string")
+                throw new TypeError("invalid preflight request");
+            return preflightResourceInput(store, input.ref, { owner: input.owner, generation: input.generation, platform: input.platform ?? config.platform });
+        }
+        case "selection": {
+            const input = object(value, ["manifest", "taskIds", "output"]), selection = selectResources(parseResourceDataset(input.manifest), input.taskIds);
+            if (input.output !== undefined) {
+                if (typeof input.output !== "string")
+                    throw new TypeError("invalid selection output");
+                await writeFile(input.output, `${JSON.stringify(selection)}\n`, { flag: "wx" });
+            }
+            return selection;
+        }
+        case "materialize": {
+            const input = object(value, ["plan", "owner", "generation"]);
+            return materializeResourceTask(store, input.plan, { owner: input.owner, generation: input.generation, policy: config.workspace });
+        }
+        case "workspace-end": {
+            const input = object(value, ["id", "executionEnded", "resultSealed"]);
+            await finishResourceWorkspace(store, input.id, input);
+            return { removed: true };
+        }
+        default: throw new TypeError(`unsupported resource API operation: ${operation}`);
+    }
+}
+export async function resourceFileRequest(root, operation, file) {
+    if ((await lstat(file)).size > 16 * 1024 ** 2)
+        throw new Error("resource request size limit exceeded");
+    return resourceRequest(root, operation, parseStrictJson(await readFile(file, "utf8")));
+}
+function parseHostConfig(value) {
+    const raw = object(value, ["protocol", "transport", "imagePolicy", "platform", "workspace", "limits", "offline"]);
+    if (raw.protocol !== "hitch-resource-host@1" || !["registry", "cache-first", "cache-only"].includes(String(raw.imagePolicy)) || typeof raw.platform !== "string" || !/^linux\/(amd64|arm64)(\/v[0-9]+)?$/.test(raw.platform))
+        throw new TypeError("invalid resource host configuration");
+    if (!raw.transport || typeof raw.transport !== "object" || Array.isArray(raw.transport))
+        throw new TypeError("resource transport must be a map");
+    for (const [key, ref] of Object.entries(raw.transport))
+        if (!/^sha256:[a-f0-9]{64}$/.test(key) || typeof ref !== "string" || !ref.endsWith(`@${key}`) || /[\s\0]/.test(ref))
+            throw new TypeError("invalid immutable image transport");
+    if (raw.limits !== undefined)
+        limits(raw.limits);
+    if (raw.offline !== undefined) {
+        const offline = object(raw.offline, ["exportFormat", "registry"]);
+        if (offline.exportFormat !== undefined && !["docker-archive", "registry-bundle"].includes(String(offline.exportFormat)))
+            throw new Error("invalid offline image format");
+        if (offline.registry !== undefined) {
+            if (typeof offline.registry !== "string")
+                throw new Error("invalid offline registry");
+            localRegistry(offline.registry);
+        }
+    }
+    const policy = object(raw.workspace, ["mode", "maxCopyBytes", "maxWorkspaces"]);
+    if (policy.mode !== undefined && !["auto", "copy", "require-clone"].includes(String(policy.mode)))
+        throw new TypeError("invalid workspace mode");
+    for (const key of ["maxCopyBytes", "maxWorkspaces"])
+        if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || policy[key] < (key === "maxWorkspaces" ? 1 : 0)))
+            throw new TypeError("invalid workspace budget");
+    return raw;
+}
+//# sourceMappingURL=api.js.map

package/dist/src/resources/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/resources/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAwB,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAA4B,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAiB,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAuB,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,EAAE,+BAA+B,EAAqB,MAAM,YAAY,CAAC;AAWnL,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,IAAI,MAAM,GAAuB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC1J,IAAI,CAAC;QAAC,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACnH,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AACrS,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAoB,EAAE,GAAW,EAAE,OAAsF;IACpK,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AACD,KAAK,UAAU,cAAc,CAAC,KAAoB,EAAE,GAAW,EAAE,OAAsF;IACrJ,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC3E,MAAM,SAAS,GAAG,gBAAgB,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC5F,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,gBAAgB,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACvH,KAAK,MAAM,CAAC,IAAI,YAAY;QAAE,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IAClJ,MAAM,WAAW,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,GAAmB,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACzH,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,4BAA4B,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpN,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAc;IACnF,IAAI,SAAS,KAAK,cAAc;QAAE,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,YAAY,EAAE,+BAA+B,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAAC;IACxK,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IAAC,CAAC;IAChK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAAC,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC1E,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YACzD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAClL,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAuD,CAAC,CAAC;QAAC,CAAC;QACnK,KAAK,SAAS,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAe,EAAE,KAAK,CAAC,UAAoB,CAAC,CAAC;YAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QAC5K,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;YACjN,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAmC,CAAC,CAAC;YAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACnH,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAAC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;YAAC,OAAO,cAAc,CAAC,KAAK,EAAE,KAA6C,CAAC,CAAC;QAAC,CAAC;QAC3Q,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;YAC/J,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC3G,MAAM,SAAS,GAAG,gBAAgB,IAAI,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClH,OAAO,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;YACrK,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACnH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/E,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAC9G,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3E,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;YACrN,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,OAAmB,CAAC;YAC5F,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAAC,CAAC;gBAClI,MAAM,KAAK,GAAmD,EAAE,CAAC;gBACjE,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAAC,CAAC;gBACpJ,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC;gBACpI,MAAM,QAAQ,GAAG,oBAAoB,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,0BAA0B,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/G,IAAI,QAAQ,CAAC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACtH,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,qBAAqB;oBAAE,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,UAAU,EAAE,CAAC,CAAC;gBAC/L,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,cAAc,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9J,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvI,OAAO,QAAQ,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;YACpI,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAmB,EAAE,KAAK,CAAC,MAAgB,EAAE,KAAK,CAAC,KAAe,CAAC,CAAC;QAC3G,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;YACxE,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;YACvH,OAAO,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAkB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzK,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,OAAmB,CAAC,CAAC;YAC7J,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;gBAAC,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAC3M,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAC7D,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAe,EAAE,UAAU,EAAE,KAAK,CAAC,UAAoB,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACxK,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACtE,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,EAAY,EAAE,KAAgE,CAAC,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvJ,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY;IACrF,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACvG,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAClH,IAAI,GAAG,CAAC,QAAQ,KAAK,uBAAuB,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACzR,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACjJ,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IACtO,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,MAAiC,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACzK,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAAC,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;IACjK,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACjJ,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC;QAAE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAK,MAAM,CAAC,GAAG,CAAY,GAAG,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC3O,OAAO,GAAoC,CAAC;AAC9C,CAAC"}

package/dist/src/resources/bundle.js

@@ -0,0 +1,117 @@
+import { createReadStream } from "node:fs";
+import { copyFile, lstat, mkdir, readFile, readdir, rename, rm, statfs } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON } from "../foundation/index.js";
+import { canonical, identity, natural, object, parseStrictJson, sha } from "./protocol.js";
+import { createResourceDelivery, parseResourceDelivery, receiveResourceDelivery } from "./transfer.js";
+import { parseResourceSelection } from "./tasks.js";
+export async function exportResourceBundle(store, selection, destination, owner, signal) {
+    destination = path.resolve(destination);
+    if (await lstat(destination).catch(e => { if (e.code !== "ENOENT")
+        throw e; return undefined; }))
+        throw new Error("bundle output already exists");
+    const delivery = await createResourceDelivery(store, selection, owner, 1, signal), temp = `${destination}.${randomUUID()}.tmp`, archives = [];
+    await mkdir(path.join(temp, "objects"), { recursive: true, mode: 0o700 });
+    await mkdir(path.join(temp, "oci"));
+    try {
+        let total = 0;
+        for (const item of delivery.objects) {
+            signal?.throwIfAborted();
+            total += item.size;
+            if (total > store.objects.budget.maxTotalBytes)
+                throw new Error("bundle export budget exceeded");
+            await store.objects.verify(item.digest, item.size);
+            const file = path.join(temp, "objects", item.digest.slice(7));
+            const space = await statfs(temp, { bigint: true });
+            if (space.bavail * space.bsize < BigInt(item.size) + BigInt(store.objects.budget.minFreeBytes))
+                throw new Error("bundle export free-space reserve exceeded");
+            await copyFile(store.objects.objectPath(item.digest), file);
+            await store.objects.verify(item.digest, item.size, file);
+        }
+        for (const image of delivery.images) {
+            if (!store.options.images?.exportArchive)
+                throw new Error("OCI provider does not support offline export");
+            const file = path.join(temp, "oci", image.resource.manifestDigest.slice(7));
+            await store.options.images.exportArchive(image.resource, file, signal, { maxBytes: Math.min(store.objects.budget.maxObjectBytes, store.objects.budget.maxTotalBytes - total), minFreeBytes: store.objects.budget.minFreeBytes });
+            const info = await lstat(file);
+            if (!info.isFile() || info.size > store.objects.budget.maxObjectBytes)
+                throw new Error("OCI archive object budget exceeded");
+            const hash = createHash("sha256");
+            let size = 0;
+            for await (const chunk of createReadStream(file)) {
+                signal?.throwIfAborted();
+                size += chunk.length;
+                if (size > store.objects.budget.maxObjectBytes)
+                    throw new Error("OCI archive object budget exceeded");
+                hash.update(chunk);
+            }
+            const digest = sha(`sha256:${hash.digest("hex")}`);
+            await store.objects.verify(digest, size, file);
+            total += size;
+            if (total > store.objects.budget.maxTotalBytes)
+                throw new Error("bundle export budget exceeded");
+            archives.push({ manifestDigest: image.resource.manifestDigest, digest, size });
+        }
+        const body = { protocol: "hitch-resource-bundle@1", delivery, archives }, index = { ...body, digest: identity(body.protocol, body) };
+        await atomicWriteJSON(path.join(temp, "index.json"), index);
+        signal?.throwIfAborted();
+        await rename(temp, destination);
+        return index;
+    }
+    finally {
+        await rm(temp, { recursive: true, force: true });
+    }
+}
+/** A directory bundle has no archive paths to extract. OCI archives go only to the OCI provider. */
+export async function importResourceBundle(store, directory, owner, signal) {
+    const indexFile = path.join(directory, "index.json");
+    if (!(await lstat(directory)).isDirectory() || !(await lstat(indexFile)).isFile() || (await lstat(indexFile)).size > 16 * 1024 ** 2)
+        throw new Error("invalid resource bundle");
+    const raw = object(parseStrictJson(await readFile(indexFile, "utf8")), ["protocol", "delivery", "archives", "digest"]), { digest, ...body } = raw;
+    if (raw.protocol !== "hitch-resource-bundle@1" || digest !== identity(raw.protocol, body) || !Array.isArray(raw.archives))
+        throw new Error("invalid resource bundle index");
+    const delivery = parseResourceDelivery(raw.delivery), archives = raw.archives.map(a => {
+        const entry = object(a, ["manifestDigest", "digest", "size"]);
+        sha(entry.manifestDigest);
+        sha(entry.digest);
+        if (!Number.isSafeInteger(entry.size) || entry.size < 0)
+            throw new TypeError("invalid OCI archive size");
+        return entry;
+    });
+    if (canonical(archives.map(a => a.manifestDigest).sort()) !== canonical(delivery.images.map(i => i.resource.manifestDigest).sort()))
+        throw new Error("offline image archives are incomplete or duplicate");
+    for (const sub of ["objects", "oci"])
+        if (!(await lstat(path.join(directory, sub))).isDirectory())
+            throw new Error("bundle paths must be directories without links");
+    if (canonical((await readdir(path.join(directory, "objects"))).sort()) !== canonical(delivery.objects.map(o => o.digest.slice(7)).sort()) || canonical((await readdir(path.join(directory, "oci"))).sort()) !== canonical(archives.map(a => a.manifestDigest.slice(7)).sort()))
+        throw new Error("bundle object inventory mismatch");
+    const total = delivery.objects.reduce((n, o) => n + o.size, 0) + archives.reduce((n, a) => n + a.size, 0);
+    if (total > store.objects.budget.maxTotalBytes)
+        throw new Error("offline bundle total byte budget exceeded");
+    // Verify the entire bundle before any provider mutation.
+    for (const item of delivery.objects)
+        await store.objects.verify(item.digest, item.size, path.join(directory, "objects", item.digest.slice(7)));
+    for (const item of archives)
+        await store.objects.verify(item.digest, item.size, path.join(directory, "oci", item.manifestDigest.slice(7)));
+    let expandedBytes = 0, imageFiles = 0;
+    for (const archive of archives) {
+        if (!store.options.images?.validateArchive)
+            throw new Error("OCI provider does not support bounded offline validation");
+        const usage = await store.options.images.validateArchive(delivery.images.find(i => i.resource.manifestDigest === archive.manifestDigest).resource, path.join(directory, "oci", archive.manifestDigest.slice(7)), signal, { maxExpandedBytes: store.objects.budget.maxTotalBytes - expandedBytes, maxFiles: store.objects.budget.maxFiles - imageFiles });
+        expandedBytes += natural(usage.expandedBytes);
+        imageFiles += natural(usage.files);
+        if (expandedBytes > store.objects.budget.maxTotalBytes || imageFiles > store.objects.budget.maxFiles)
+            throw new Error("offline OCI expanded budget exceeded");
+    }
+    const lease = await store.locked(() => store.beginLease(owner, "import"));
+    for (const archive of archives) {
+        if (!store.options.images?.importArchive)
+            throw new Error("OCI provider does not support cache-only offline import");
+        await store.importImageArchive(lease, delivery.images.find(i => i.resource.manifestDigest === archive.manifestDigest).resource, path.join(directory, "oci", archive.manifestDigest.slice(7)), signal);
+    }
+    const result = await receiveResourceDelivery(store, delivery, async (item) => createReadStream(path.join(directory, "objects", item.digest.slice(7))), owner, 1, signal);
+    await store.finishLease(lease.id, "ended");
+    return { selection: parseResourceSelection(delivery.selection), transferredBytes: result.transferredBytes, missingObjects: result.missingObjects };
+}
+//# sourceMappingURL=bundle.js.map

package/dist/src/resources/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../../src/resources/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAE3F,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,uBAAuB,EAAyB,MAAM,eAAe,CAAC;AAC9H,OAAO,EAAE,sBAAsB,EAA0B,MAAM,YAAY,CAAC;AAQ5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAoB,EAAE,SAA4B,EAAE,WAAmB,EAAE,KAAa,EAAE,MAAoB;IACrJ,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,GAAG,WAAW,IAAI,UAAU,EAAE,MAAM,EAAE,QAAQ,GAA4B,EAAE,CAAC;IACvK,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/G,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;YAC7C,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC7J,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YACjO,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC7J,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAChD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,IAAI,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAChO,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACnG,KAAK,IAAI,IAAI,CAAC;YAAC,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAChH,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,yBAAkC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9I,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IACvI,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACjE,CAAC;AACD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAoB,EAAE,SAAiB,EAAE,KAAa,EAAE,MAAoB;IACrH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChL,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAClJ,IAAI,GAAG,CAAC,QAAQ,KAAK,yBAAyB,IAAI,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5K,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACpF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5G,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAK,KAAK,CAAC,IAAe,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrH,OAAO,KAAmD,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC3M,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACrK,IAAI,SAAS,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACpU,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1G,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7G,yDAAyD;IACzD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/I,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,IAAI,aAAa,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACxH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EACtN,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC,CAAC;QAClI,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChK,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACrH,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACzM,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACvK,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;AACjM,CAAC"}

package/dist/src/resources/evidence.js

@@ -0,0 +1,93 @@
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON, runCommand } from "../foundation/index.js";
+import { canonical, identity, parseStrictJson, sha } from "./protocol.js";
+import { finishResourceWorkspace } from "./materialize.js";
+import { parseResourceTask, taskClosureLock } from "./tasks.js";
+import { exportResourceResultProof } from "./result-retention.js";
+export async function readResourceEvidence(file) {
+    const info = await lstat(file).catch(e => { if (e.code !== "ENOENT")
+        throw e; return undefined; });
+    if (!info)
+        return undefined;
+    if (!info.isFile() || info.size > 16 * 1024 ** 2)
+        throw new Error("invalid resource execution evidence");
+    const evidence = parseStrictJson(await readFile(file, "utf8"));
+    const { digest, ...body } = evidence.plan;
+    parseResourceTask(evidence.plan.task);
+    if (evidence.protocol !== "hitch-resource-workspace@1" || digest !== identity("hitch-resource-plan@1", body) || !/^[a-f0-9-]{36}$/.test(evidence.id) || typeof evidence.executionEnded !== "boolean")
+        throw new Error("resource execution evidence identity mismatch");
+    sha(evidence.materialized_task_digest);
+    if (!evidence.materializedTree || identity("hitch-materialized-task@1", evidence.materializedTree) !== evidence.materialized_task_digest)
+        throw new Error("materialized tree proof missing");
+    return evidence;
+}
+/** Run evidence is sealed before the execution lease can be released. */
+export async function sealResourceEvidence(input) {
+    const evidence = await readResourceEvidence(input.file);
+    if (!evidence)
+        return;
+    if (evidence.plan.task.task_id !== input.taskId)
+        throw new Error("resource execution task mismatch");
+    const observed = [];
+    const docker = process.env.HITCH_DOCKER_PATH || "docker", cache = new Map();
+    const inspect = async (digest) => {
+        sha(digest);
+        let value = cache.get(digest);
+        if (value)
+            return value;
+        value = JSON.parse((await runCommand(docker, ["image", "inspect", "--format", "{{json .}}", digest], { timeoutMs: 30_000 })).stdout);
+        if (value.Id !== digest || !Array.isArray(value.RootFS?.Layers))
+            throw new Error("observed OCI config identity mismatch");
+        cache.set(digest, value);
+        return value;
+    };
+    for (const container of input.execution?.observed.containers ?? []) {
+        if (!container.image_config_digest)
+            continue;
+        const image = await inspect(container.image_config_digest), labels = image.Config?.Labels ?? {};
+        if (labels["dev.hitch.resource.plan"] !== evidence.plan.digest)
+            continue;
+        const role = labels["dev.hitch.resource.consumer"], consumer = parseStrictJson(role);
+        const bindings = evidence.plan.task.lock.bindings.filter(b => canonical(b.consumer) === canonical(consumer) && b.use === "environment-image");
+        if (!bindings.length)
+            throw new Error("observed resource consumer is undeclared");
+        const platform = `${image.Os}/${image.Architecture}${image.Variant ? `/${image.Variant}` : ""}`;
+        if (platform !== evidence.plan.platform)
+            throw new Error("observed resource platform changed");
+        const baseConfigs = [];
+        for (const binding of bindings) {
+            const expected = evidence.images.find(i => i.resource === binding.resource);
+            if (!expected)
+                throw new Error("OCI base evidence missing");
+            const base = await inspect(expected.configDigest);
+            if (canonical(image.RootFS.Layers.slice(0, base.RootFS.Layers.length)) !== canonical(base.RootFS.Layers))
+                throw new Error("observed image does not descend from declared resource base");
+            baseConfigs.push(expected.configDigest);
+        }
+        observed.push({ consumer, configDigest: container.image_config_digest, platform, baseConfigs });
+    }
+    if (input.requireObserved)
+        for (const binding of evidence.plan.task.lock.bindings.filter(b => b.use === "environment-image"))
+            if (!observed.some(i => canonical(i.consumer) === canonical(binding.consumer)))
+                throw new Error("successful resource trial lacks observed role/image evidence");
+    const lock = taskClosureLock(evidence.plan.task);
+    if ("hitch-materialized-task" in lock.resources)
+        throw new Error("reserved materialization resource ID");
+    const root = await input.store.pin({ owner: input.owner, generation: 1, purpose: "sealed-run", lock: { ...lock, resources: { ...lock.resources, "hitch-materialized-task": evidence.materializedTree } } });
+    const proofObjects = await exportResourceResultProof(input.store, evidence.plan, root.closure.objectDigests, input.runDirectory);
+    await atomicWriteJSON(path.join(input.runDirectory, "resource.execution.json"), { protocol: "hitch-resource-execution@1", plan: evidence.plan, materialized_task_digest: evidence.materialized_task_digest, materializedTree: evidence.materializedTree, images: evidence.images, observed, proofObjects, materialization: { clonedBytes: evidence.clonedBytes, copiedBytes: evidence.copiedBytes, fallbackReasons: evidence.fallbackReasons } });
+}
+export async function confirmResourceResultSealed(file) {
+    const evidence = await readResourceEvidence(file);
+    if (evidence)
+        await atomicWriteJSON(file, { ...evidence, resultSealed: true });
+}
+export async function reclaimResourceExecution(store, file, cleanupConfirmed) {
+    const evidence = await readResourceEvidence(file);
+    if (!evidence || !cleanupConfirmed || !evidence.executionEnded || !evidence.resultSealed)
+        return false;
+    await finishResourceWorkspace(store, evidence.id, { executionEnded: true, resultSealed: true });
+    return true;
+}
+//# sourceMappingURL=evidence.js.map

package/dist/src/resources/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/resources/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kBAAkB,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAChI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;IAC5F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;IAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,QAAQ,KAAK,4BAA4B,IAAI,MAAM,KAAK,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACvQ,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,wBAAwB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7L,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAA6J;IACtM,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ;QAAE,OAAO;IAC/E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAgG,EAAE,CAAC;IACjH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,EAAE,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACvC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACpE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrI,IAAI,KAAM,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAM,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAM,CAAC,CAAC;QAAC,OAAO,KAAM,CAAC;IACxK,CAAC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,mBAAmB;YAAE,SAAS;QAC7C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;QAChG,IAAI,MAAM,CAAC,yBAAyB,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,6BAA6B,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QAC9I,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAChG,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACzI,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACzL,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,eAAe;QAAE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9R,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,yBAAyB,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,EAAE,QAAQ,CAAC,gBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7M,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACjI,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AACpb,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,QAAQ;QAAE,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACpI,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAoB,EAAE,IAAY,EAAE,gBAAyB;IAC1G,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC1J,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,IAAI,CAAC;AAC/G,CAAC"}

package/dist/src/resources/gc.js

@@ -0,0 +1,123 @@
+import { mkdir, readdir, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON, readJSON } from "../foundation/index.js";
+import { canonical, natural, object } from "./protocol.js";
+import { validateLease, validateRoot } from "./store.js";
+import { planViewGc } from "./views.js";
+export async function auditResources(store, options = {}) {
+    const graceMs = options.graceMs ?? 24 * 60 * 60 * 1000;
+    natural(graceMs);
+    return store.locked(async () => {
+        const roots = await store.records("roots"), leases = await store.records("leases"), marked = new Map();
+        const mark = (digest, reason) => { const reasons = marked.get(digest) ?? new Set(); reasons.add(reason); marked.set(digest, reasons); };
+        for (const root of roots) {
+            validateRoot(root);
+            if (root.state !== "active")
+                continue;
+            const actual = await fileClosure(store, Object.values(root.lock.resources));
+            if (canonical(actual) !== canonical(root.closure.objectDigests))
+                throw new Error("durable resource closure is incomplete; GC stopped");
+            for (const digest of actual)
+                mark(digest, `owner:${root.owner}:${root.generation}`);
+        }
+        for (const lease of leases) {
+            validateLease(lease);
+            if (lease.state === "released")
+                continue;
+            // No PID or expiry test: unknown remote execution keeps its protection.
+            for (const digest of lease.objectDigests)
+                mark(digest, `${lease.state}-lease:${lease.id}`);
+        }
+        const report = { protocol: "hitch-resource-gc@1", dryRun: !options.apply, objects: 0, logicalBytes: 0, retained: [], eligible: [], quarantined: [], deleted: [] };
+        const directory = path.join(store.directory, "objects", "sha256"), quarantine = path.join(store.directory, "quarantine");
+        const names = async (dir) => readdir(dir).catch((e) => { if (e.code !== "ENOENT")
+            throw e; return []; });
+        // Verify every present object before any mutation. A partial producer may
+        // protect its next not-yet-published digest; active roots may never do so.
+        const files = await names(directory), quarantined = await names(quarantine);
+        for (const name of [...files, ...quarantined])
+            if (!/^[a-f0-9]{64}$/.test(name))
+                throw new Error("unknown object store entry; GC stopped");
+        const quarantineTimes = new Map();
+        for (const name of quarantined) {
+            const digest = `sha256:${name}`;
+            if (files.includes(name) || marked.has(digest))
+                throw new Error("duplicate or referenced quarantine object; GC stopped");
+            const index = object(await readJSON(path.join(store.directory, "quarantine-index", `${name}.json`)), ["protocol", "digest", "quarantinedAt"]);
+            if (index.protocol !== "hitch-resource-quarantine@1" || index.digest !== digest || !Number.isSafeInteger(index.quarantinedAt) || index.quarantinedAt < 0)
+                throw new Error("invalid quarantine record; GC stopped");
+            await store.objects.verify(digest, undefined, path.join(quarantine, name));
+            quarantineTimes.set(name, index.quarantinedAt);
+        }
+        for (const lease of leases)
+            if (lease.state !== "released" && lease.purpose !== "import") {
+                for (const digest of lease.objectDigests)
+                    if (!files.includes(digest.slice(7)))
+                        throw new Error("active resource lease has missing content; GC stopped");
+            }
+        for (const name of files) {
+            options.signal?.throwIfAborted();
+            report.logicalBytes += await store.objects.verify(`sha256:${name}`);
+            report.objects++;
+        }
+        const collectViews = await planViewGc(store, marked, graceMs);
+        if (options.apply)
+            await collectViews();
+        for (const name of files) {
+            const digest = `sha256:${name}`, reasons = marked.get(digest);
+            if (reasons) {
+                report.retained.push({ digest, reasons: [...reasons].sort() });
+                continue;
+            }
+            report.eligible.push(digest);
+            if (!options.apply)
+                continue;
+            options.signal?.throwIfAborted();
+            await mkdir(quarantine, { recursive: true });
+            await atomicWriteJSON(path.join(store.directory, "quarantine-index", `${name}.json`), { protocol: "hitch-resource-quarantine@1", digest, quarantinedAt: Date.now() });
+            await rename(path.join(directory, name), path.join(quarantine, name));
+            report.quarantined.push(digest);
+        }
+        for (const name of quarantined) {
+            const digest = `sha256:${name}`;
+            if (marked.has(digest))
+                throw new Error("referenced object is quarantined; acquire must restore it before GC");
+            if (!options.apply || Date.now() - quarantineTimes.get(name) < graceMs)
+                continue;
+            options.signal?.throwIfAborted();
+            await rm(path.join(quarantine, name));
+            await rm(path.join(store.directory, "quarantine-index", `${name}.json`));
+            report.deleted.push(digest);
+        }
+        return report;
+    }, options.signal);
+}
+export async function fileClosure(store, resources) {
+    const found = new Set();
+    let bytes = 0, files = 0;
+    for (const resource of resources) {
+        if (resource.kind === "oci-image")
+            continue;
+        const digest = resource.kind === "blob" ? resource.digest : resource.manifestDigest;
+        await store.objects.verify(digest, resource.kind === "blob" ? resource.size : undefined);
+        found.add(digest);
+        if (resource.kind === "tree") {
+            const tree = await store.objects.readTree(digest);
+            files += tree.entries.length;
+            for (const entry of tree.entries)
+                if (entry.kind === "file") {
+                    await store.objects.verify(entry.digest, entry.size);
+                    found.add(entry.digest);
+                    bytes += entry.size;
+                }
+        }
+        else {
+            bytes += resource.size;
+            files++;
+        }
+        if (bytes > store.objects.budget.maxTotalBytes || files > store.objects.budget.maxFiles)
+            throw new Error("resource closure budget exceeded");
+    }
+    return [...found].sort();
+}
+//# sourceMappingURL=gc.js.map

package/dist/src/resources/gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.js","sourceRoot":"","sources":["../../../src/resources/gc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAiB,aAAa,EAAE,YAAY,EAAyC,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAYxC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAoB,EAAE,UAAuE,EAAE;IAClI,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAe,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAgB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QACzJ,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE,GAAG,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAChK,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5E,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACvI,KAAK,MAAM,MAAM,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,SAAS;YAC/D,wEAAwE;YACxE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa;gBAAE,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACpL,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzH,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAqB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3J,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC;YAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC3I,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,UAAU,IAAI,EAAY,CAAC;YAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACzH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;YAC9I,IAAI,KAAK,CAAC,QAAQ,KAAK,6BAA6B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAK,KAAK,CAAC,aAAwB,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC/N,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,aAAuB,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzF,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa;oBAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3J,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,CAAC,YAAY,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACtJ,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,YAAY,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,UAAU,IAAI,EAAY,EAAE,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,SAAS;YAC3D,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,UAAU,IAAI,EAAY,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC/G,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAE,GAAG,OAAO;gBAAE,SAAS;YAClF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB,EAAE,SAAqB;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpF,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5G,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAChF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAC,CAAC;QACtK,CAAC;aAAM,CAAC;YAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC"}