cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/src/launcher/managed-source-authority.js

@@ -0,0 +1,346 @@
+import { HttpNativeCallingContextUnavailableError, } from './plugin-http-native-account-diagnostics.js';
+import { createHash, createPrivateKey, createPublicKey, randomBytes, sign, verify } from 'node:crypto';
+import { managedSourceBinding, managedSourceBytes, managedSourceChallenge } from '@cordisx/protocol/managed-source/v1';
+export const MANAGED_SOURCE_KEYCHAIN_SERVICE = 'cordisx/managed-source/v1';
+export class ManagedSourceCredentialUnavailableError extends Error {
+}
+export class ManagedSourceTrustUnavailableError extends Error {
+}
+const object = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('invalid managed source response');
+    return value;
+};
+function signature(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{86}$/u.test(value))
+        throw new Error('invalid signature');
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.length !== 64 || bytes.toString('base64url') !== value)
+        throw new Error('noncanonical signature');
+    return bytes;
+}
+/** Host-private canonical PKCS8 DER, encoded on one line for the normal Secret Store. */
+function signingKey(value) {
+    if (!/^[A-Za-z0-9+/]{64}$/u.test(value))
+        throw new Error('invalid managed signing key');
+    const bytes = Buffer.from(value, 'base64');
+    if (bytes.length !== 48 || bytes.toString('base64') !== value)
+        throw new Error('noncanonical managed signing key');
+    const key = createPrivateKey({ key: bytes, type: 'pkcs8', format: 'der' });
+    if (key.asymmetricKeyType !== 'ed25519'
+        || !key.export({ type: 'pkcs8', format: 'der' }).equals(bytes))
+        throw new Error('invalid managed signing key type or encoding');
+    return key;
+}
+/** Trust entries come exclusively from Launcher provisioning, never renderer configuration or RPC. */
+export class ManagedSourceAuthority {
+    options;
+    disposed = false;
+    queues = new Map();
+    operations = new Set();
+    operationEpochs = new WeakMap();
+    leases = new Map();
+    accounts = new Map();
+    accountEpochs = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    lifetime(principal, work, run) {
+        const abort = new AbortController();
+        this.operationEpochs.set(abort, this.accountEpochs.get(JSON.stringify(principal)) ?? 0);
+        let reject;
+        const expired = new Promise((_, fail) => {
+            reject = fail;
+        });
+        const retire = () => {
+            const reason = abort.signal.reason;
+            if (work)
+                this.closeCurrentOperation(principal, abort, reason);
+            reject(reason instanceof HttpNativeCallingContextUnavailableError ? reason : new Error('managed source retired'));
+        };
+        abort.signal.addEventListener('abort', retire, { once: true });
+        const timeout = setTimeout(() => abort.abort(), 15_000);
+        this.operations.add(abort);
+        const operation = Promise.resolve().then(() => run(abort, expired));
+        return Promise.race([operation, expired]).finally(() => {
+            clearTimeout(timeout);
+            abort.signal.removeEventListener('abort', retire);
+            this.operations.delete(abort);
+        });
+    }
+    async execute(principal, abort, raw, readAccount, work, previousBearer, active = () => true) {
+        const input = object(raw);
+        if (abort.signal.aborted || this.disposed || !active() || !this.options.live(principal)) {
+            throw new Error('managed source retired');
+        }
+        if (Object.keys(input).some(key => !['origin', 'sourceId', 'instanceId', 'audience', work ? 'baseline' : 'displayName'].includes(key))) {
+            throw new Error('invalid managed source input');
+        }
+        if (work && input.baseline !== undefined && input.baseline !== true)
+            throw new Error('invalid baseline');
+        const binding = managedSourceBinding(input);
+        if (binding.audience !== (work ? 'work-income' : 'source-account')) {
+            throw new Error('invalid managed source audience');
+        }
+        const trusts = this.options.getTrusts ? await this.options.getTrusts() : this.options.trusts;
+        if (abort.signal.aborted || this.disposed || !active() || !this.options.live(principal)) {
+            throw new Error('managed source retired');
+        }
+        const trust = trusts.find(entry => entry.owner.pluginId === principal.identity.pluginId && entry.owner.source === principal.identity.source
+            && Object.keys(binding).every(key => binding[key] === entry.binding[key]));
+        if (!trust)
+            throw new ManagedSourceTrustUnavailableError('managed source not provisioned for owner');
+        const account = await readAccount();
+        if (abort.signal.aborted || this.disposed || !active() || !this.options.live(principal)) {
+            throw new Error('managed source retired');
+        }
+        if (account instanceof HttpNativeCallingContextUnavailableError)
+            throw account;
+        if (!account)
+            throw new ManagedSourceCredentialUnavailableError('native account unavailable');
+        this.observeAccount(principal, account);
+        const ownerKey = JSON.stringify(principal), accountEpoch = this.accountEpochs.get(ownerKey) ?? 0;
+        this.operationEpochs.set(abort, accountEpoch);
+        let workSnapshot;
+        const synchronousFence = () => {
+            if (workSnapshot && this.options.workAllowed && !this.options.workAllowed(workSnapshot)) {
+                throw new Error('durable settlement policy conflict');
+            }
+            if (abort.signal.aborted || this.disposed || !active() || !this.options.live(principal)
+                || (this.accountEpochs.get(ownerKey) ?? 0) !== accountEpoch)
+                throw new Error('managed source retired');
+            if (this.options.trustedNow && !this.options.trustedNow(trust))
+                throw new Error('managed source trust retired');
+        };
+        const fence = async () => {
+            synchronousFence();
+            if (this.options.trusted) {
+                const trusted = await this.options.trusted(trust);
+                synchronousFence();
+                if (!trusted)
+                    throw new Error('managed source trust retired');
+            }
+            // Native identity is the final asynchronous authority read before a send or acceptance.
+            const currentAccount = await readAccount();
+            synchronousFence();
+            if (currentAccount instanceof HttpNativeCallingContextUnavailableError)
+                throw currentAccount;
+            this.observeAccount(principal, currentAccount);
+            synchronousFence();
+            if (currentAccount !== account)
+                throw new Error('native account retired');
+        };
+        const request = async (path, body, bearer) => {
+            await fence();
+            synchronousFence();
+            const response = await this.options.fetch(binding.origin + path, {
+                method: body === undefined ? 'GET' : 'POST',
+                redirect: 'manual',
+                credentials: 'omit',
+                signal: abort.signal,
+                headers: {
+                    'content-type': 'application/json',
+                    accept: 'application/json',
+                    ...(bearer === undefined ? {} : { authorization: `Bearer ${bearer}` }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+            if (response.status < 200 || response.status >= 300) {
+                await response.body?.cancel();
+                throw new Error('managed source request rejected');
+            }
+            const reader = response.body?.getReader(), chunks = [];
+            let bytes = 0;
+            if (reader) {
+                while (true) {
+                    const chunk = await reader.read();
+                    if (chunk.done)
+                        break;
+                    bytes += chunk.value.byteLength;
+                    if (bytes > 1_048_576) {
+                        await reader.cancel();
+                        throw new Error('managed source response too large');
+                    }
+                    chunks.push(chunk.value);
+                }
+            }
+            await fence();
+            return { body: object(JSON.parse(Buffer.concat(chunks).toString('utf8'))), statusCode: response.status };
+        };
+        let checking = false;
+        const retirement = setInterval(() => {
+            if (checking)
+                return;
+            checking = true;
+            void fence().catch(error => {
+                abort.abort(error instanceof HttpNativeCallingContextUnavailableError ? error : undefined);
+            }).finally(() => {
+                checking = false;
+            });
+        }, 1000);
+        const stopRetirement = () => clearInterval(retirement);
+        abort.signal.addEventListener('abort', stopRetirement, { once: true });
+        let leaseKey, installedLease;
+        try {
+            await fence();
+            const query = new URLSearchParams({
+                sourceId: binding.sourceId,
+                instanceId: binding.instanceId,
+                audience: binding.audience,
+            });
+            const challengeResponse = await request('/v1/auth/host/challenge?' + query.toString());
+            const envelope = challengeResponse.body;
+            if (Object.keys(envelope).some(key => !['payload', 'signature'].includes(key))) {
+                throw new Error('invalid challenge envelope');
+            }
+            const challenge = managedSourceChallenge(envelope.payload, binding);
+            if (!verify(null, managedSourceBytes(challenge), createPublicKey(trust.serverPublicKey), signature(envelope.signature))) {
+                throw new Error('managed source challenge signature invalid');
+            }
+            let payload = {
+                ...binding,
+                nonce: challenge.nonce,
+                expiresAt: challenge.expiresAt,
+                subject: 'codex:' + createHash('sha256').update(account).digest('base64url'),
+                contract: 'cordisx.managed-source-assertion/v1',
+            };
+            if (work) {
+                leaseKey = JSON.stringify([principal, binding]);
+                if (!this.options.readWork)
+                    throw new Error('classified work usage unavailable');
+                const snapshot = await this.options.readWork(principal);
+                await fence();
+                if (snapshot.status !== 'ready')
+                    throw new Error('classified work usage unavailable');
+                await this.options.claimWork?.(snapshot, synchronousFence);
+                workSnapshot = snapshot;
+                synchronousFence();
+                const prior = this.leases.get(leaseKey), now = Date.now();
+                const baseline = input.baseline === true || !prior || prior.account !== account || now - prior.observed > 15_000;
+                const lease = baseline
+                    ? { id: randomBytes(32).toString('base64url'), observed: now, account, owner: JSON.stringify(principal) }
+                    : prior;
+                if (this.leases.size >= 128 && !this.leases.has(leaseKey))
+                    throw new Error('managed work lease limit');
+                payload = {
+                    ...payload,
+                    contract: 'cordisx.managed-work-observation/v1',
+                    leaseId: lease.id,
+                    continuity: baseline ? 'baseline' : 'continuous',
+                    snapshot,
+                };
+                // Commit observation continuity before send: uncertain sends must never create catch-up income.
+                lease.observed = now;
+                this.leases.set(leaseKey, lease);
+                installedLease = lease;
+            }
+            else if (input.displayName !== undefined) {
+                if (typeof input.displayName !== 'string' || !input.displayName.trim() || input.displayName.length > 120
+                    || /[\u0000-\u001f\u007f]/u.test(input.displayName))
+                    throw new Error('invalid display name');
+                payload.displayName = input.displayName.trim();
+            }
+            const privateKey = await this.options.keychain.read(MANAGED_SOURCE_KEYCHAIN_SERVICE, trust.signingKeyRef);
+            await fence();
+            managedSourceChallenge(challenge, binding);
+            const signed = {
+                payload,
+                signature: sign(null, managedSourceBytes(payload), signingKey(privateKey)).toString('base64url'),
+            };
+            synchronousFence();
+            const response = await request(work ? '/v1/income/work' : '/v1/auth/host/session', signed, previousBearer);
+            const resultEnvelope = response.body, resultPayload = object(resultEnvelope.payload);
+            if (Object.keys(resultEnvelope).some(key => !['payload', 'signature'].includes(key))
+                || Object.keys(resultPayload).some(key => !['contract', 'origin', 'sourceId', 'instanceId', 'audience', 'nonce', 'subject', 'result'].includes(key))
+                || resultPayload.contract !== 'cordisx.managed-source-result/v1' || resultPayload.nonce !== challenge.nonce
+                || resultPayload.subject !== payload.subject
+                || Object.keys(binding).some(key => resultPayload[key] !== binding[key])
+                || !verify(null, managedSourceBytes(resultPayload), trust.serverPublicKey, signature(resultEnvelope.signature))) {
+                throw new Error('managed source result signature invalid');
+            }
+            synchronousFence();
+            return { body: object(resultPayload.result), statusCode: response.statusCode, account, accountEpoch };
+        }
+        catch (error) {
+            if (leaseKey && installedLease && this.leases.get(leaseKey) === installedLease)
+                this.leases.delete(leaseKey);
+            throw error;
+        }
+        finally {
+            clearInterval(retirement);
+            abort.signal.removeEventListener('abort', stopRetirement);
+        }
+    }
+    async serial(key, run) {
+        if (this.queues.size >= 128 && !this.queues.has(key))
+            throw new Error('managed source request limit');
+        const prior = this.queues.get(key) ?? Promise.resolve();
+        const current = prior.catch(() => { }).then(run);
+        this.queues.set(key, current);
+        try {
+            return await current;
+        }
+        finally {
+            if (this.queues.get(key) === current)
+                this.queues.delete(key);
+        }
+    }
+    connect(principal, input, account, previousBearer, active) {
+        return this.lifetime(principal, false, (abort, expired) => this.serial(JSON.stringify([principal, input]), () => Promise.race([this.execute(principal, abort, input, account, false, previousBearer, active), expired])));
+    }
+    submit(principal, input, account, active) {
+        let binding;
+        try {
+            binding = managedSourceBinding(input);
+        }
+        catch (error) {
+            this.closeOwner(principal);
+            throw error;
+        }
+        return this.lifetime(principal, true, (abort, expired) => this.serial(JSON.stringify([principal, binding]), async () => {
+            try {
+                return await Promise.race([
+                    this.execute(principal, abort, input, account, true, undefined, active),
+                    expired,
+                ]);
+            }
+            catch (error) {
+                this.closeCurrentOperation(principal, abort, error);
+                throw error;
+            }
+        }));
+    }
+    closeCurrentOperation(principal, abort, error) {
+        if (error instanceof HttpNativeCallingContextUnavailableError)
+            return;
+        if ((this.accountEpochs.get(JSON.stringify(principal)) ?? 0) === this.operationEpochs.get(abort)) {
+            this.closeOwner(principal);
+        }
+    }
+    epoch(principal) {
+        return this.accountEpochs.get(JSON.stringify(principal)) ?? 0;
+    }
+    observeAccount(principal, account) {
+        const owner = JSON.stringify(principal);
+        if (!this.accounts.has(owner) || this.accounts.get(owner) !== account)
+            this.closeOwner(principal);
+        this.accounts.set(owner, account);
+    }
+    closeOwner(principal) {
+        const owner = JSON.stringify(principal);
+        for (const [key, lease] of this.leases)
+            if (lease.owner === owner)
+                this.leases.delete(key);
+        this.accounts.delete(owner);
+        this.accountEpochs.set(owner, (this.accountEpochs.get(owner) ?? 0) + 1);
+    }
+    dispose() {
+        this.disposed = true;
+        for (const operation of this.operations)
+            operation.abort();
+        this.leases.clear();
+        this.accounts.clear();
+        this.accountEpochs.clear();
+    }
+}
+//# sourceMappingURL=managed-source-authority.js.map

package/dist/src/launcher/managed-source-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-source-authority.js","sourceRoot":"","sources":["../../../src/launcher/managed-source-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wCAAwC,GACzC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACtG,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAYtH,MAAM,CAAC,MAAM,+BAA+B,GAAG,2BAA2B,CAAA;AAC1E,MAAM,OAAO,uCAAwC,SAAQ,KAAK;CAAG;AACrE,MAAM,OAAO,kCAAmC,SAAQ,KAAK;CAAG;AAChE,MAAM,MAAM,GAAG,CAAC,KAAc,EAA2B,EAAE;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACnH,OAAO,KAAgC,CAAA;AACzC,CAAC,CAAA;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAC1G,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3G,OAAO,KAAK,CAAA;AACd,CAAC;AACD,yFAAyF;AACzF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAClH,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IACE,GAAG,CAAC,iBAAiB,KAAK,SAAS;WAChC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,OAAO,GAAG,CAAA;AACZ,CAAC;AACD,sGAAsG;AACtG,MAAM,OAAO,sBAAsB;IASd;IARX,QAAQ,GAAG,KAAK,CAAA;IACP,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC5C,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAA;IACvC,eAAe,GAAG,IAAI,OAAO,EAA2B,CAAA;IACxD,MAAM,GAAG,IAAI,GAAG,EAA4E,CAAA;IAC5F,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC3C,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC1D,YACmB,OAchB;QAdgB,YAAO,GAAP,OAAO,CAcvB;IACA,CAAC;IACI,QAAQ,CACd,SAAiC,EACjC,IAAa,EACb,GAAoE;QAEpE,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;QACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QACvF,IAAI,MAA+B,CAAA;QACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YAC7C,MAAM,GAAG,IAAI,CAAA;QACf,CAAC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,MAAM,MAAM,GAAY,KAAK,CAAC,MAAM,CAAC,MAAM,CAAA;YAC3C,IAAI,IAAI;gBAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YAC9D,MAAM,CAAC,MAAM,YAAY,wCAAwC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QACnH,CAAC,CAAA;QACD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACrD,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;IACJ,CAAC;IACO,KAAK,CAAC,OAAO,CACnB,SAAiC,EACjC,KAAsB,EACtB,GAAY,EACZ,WAAkD,EAClD,IAAa,EACb,cAAuB,EACvB,SAAwB,GAAG,EAAE,CAAC,IAAI;QAElC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3C,CAAC;QACD,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5B,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnG,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QACD,IAAI,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;QACxG,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QAC5F,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAChC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM;eACrG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAClC,OAAO,CAAC,GAAmC,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,GAAmC,CAAC,CACpG,CACF,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kCAAkC,CAAC,0CAA0C,CAAC,CAAA;QACpG,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAA;QACnC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3C,CAAC;QACD,IAAI,OAAO,YAAY,wCAAwC;YAAE,MAAM,OAAO,CAAA;QAC9E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uCAAuC,CAAC,4BAA4B,CAAC,CAAA;QAC7F,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC7C,IAAI,YAA2E,CAAA;QAC/E,MAAM,gBAAgB,GAAG,GAAG,EAAE;YAC5B,IAAI,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACvD,CAAC;YACD,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;mBAChF,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,YAAY;gBAC3D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;YAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjH,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;YACvB,gBAAgB,EAAE,CAAA;YAClB,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBACjD,gBAAgB,EAAE,CAAA;gBAClB,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;YAC/D,CAAC;YACD,wFAAwF;YACxF,MAAM,cAAc,GAAG,MAAM,WAAW,EAAE,CAAA;YAC1C,gBAAgB,EAAE,CAAA;YAClB,IAAI,cAAc,YAAY,wCAAwC;gBAAE,MAAM,cAAc,CAAA;YAC5F,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;YAC9C,gBAAgB,EAAE,CAAA;YAClB,IAAI,cAAc,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QAC3E,CAAC,CAAA;QACD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAAc,EAAE,MAAe,EAAE,EAAE;YACtE,MAAM,KAAK,EAAE,CAAA;YACb,gBAAgB,EAAE,CAAA;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE;gBAC/D,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;gBAC3C,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;oBAC1B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;iBACvE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;YACF,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;gBAC7B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,GAAiB,EAAE,CAAA;YACpE,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;oBACjC,IAAI,KAAK,CAAC,IAAI;wBAAE,MAAK;oBACrB,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAA;oBAC/B,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;wBACtB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;wBACrB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;oBACtD,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC1B,CAAC;YACH,CAAC;YACD,MAAM,KAAK,EAAE,CAAA;YACb,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC1G,CAAC,CAAA;QACD,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,KAAK,KAAK,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;gBACzB,KAAK,CAAC,KAAK,CAAC,KAAK,YAAY,wCAAwC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC5F,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACd,QAAQ,GAAG,KAAK,CAAA;YAClB,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,IAAI,CAAC,CAAA;QACR,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QACtD,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACtE,IAAI,QAA4B,EAC9B,cAA4F,CAAA;QAC9F,IAAI,CAAC;YACH,MAAM,KAAK,EAAE,CAAA;YACb,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAA;YACF,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,0BAA0B,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAA;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;YAC/C,CAAC;YACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACnE,IACE,CAAC,MAAM,CACL,IAAI,EACJ,kBAAkB,CAAC,SAAS,CAAC,EAC7B,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,EACtC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9B,EACD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC/D,CAAC;YACD,IAAI,OAAO,GAA4B;gBACrC,GAAG,OAAO;gBACV,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,OAAO,EAAE,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC5E,QAAQ,EAAE,qCAAqC;aAChD,CAAA;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;gBAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;gBACvD,MAAM,KAAK,EAAE,CAAA;gBACb,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACrF,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;gBAC1D,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,EAAE,CAAA;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAA;gBAChH,MAAM,KAAK,GAAG,QAAQ;oBACpB,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;oBACzG,CAAC,CAAC,KAAK,CAAA;gBACT,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBACtG,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,QAAQ,EAAE,qCAAqC;oBAC/C,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;oBAChD,QAAQ;iBACT,CAAA;gBACD,gGAAgG;gBAChG,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAA;gBACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAChC,cAAc,GAAG,KAAK,CAAA;YACxB,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC3C,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG;uBACjG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;gBACzC,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;YAChD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;YACzG,MAAM,KAAK,EAAE,CAAA;YACb,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG;gBACb,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;aACjG,CAAA;YACD,gBAAgB,EAAE,CAAA;YAClB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,EAAE,MAAM,EAAE,cAAc,CAAC,CAAA;YAC1G,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;YACpF,IACE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;mBAC7E,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACvC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC1G;mBACE,aAAa,CAAC,QAAQ,KAAK,kCAAkC,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;mBACxG,aAAa,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;mBACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAmC,CAAC,CAAC;mBACrG,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,EAC/G,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;YAC5D,CAAC;YACD,gBAAgB,EAAE,CAAA;YAClB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;QACvG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,IAAI,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC5G,MAAM,KAAK,CAAA;QACb,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,UAAU,CAAC,CAAA;YACzB,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IACO,KAAK,CAAC,MAAM,CAAI,GAAW,EAAE,GAAqB;QACxD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC7B,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAA;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,CACL,SAAiC,EACjC,KAAc,EACd,OAA8C,EAC9C,cAAuB,EACvB,MAAsB;QAEtB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACxD,IAAI,CAAC,MAAM,CACT,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAClC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAC7G,CAAC,CAAA;IACN,CAAC;IACD,MAAM,CACJ,SAAiC,EACjC,KAAc,EACd,OAA8C,EAC9C,MAAsB;QAEtB,IAAI,OAA+B,CAAA;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAC1B,MAAM,KAAK,CAAA;QACb,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAClB,SAAS,EACT,IAAI,EACJ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;YAC3D,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;oBACvE,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBACnD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CACL,CAAA;IACH,CAAC;IACO,qBAAqB,CAAC,SAAiC,EAAE,KAAsB,EAAE,KAAe;QACtG,IAAI,KAAK,YAAY,wCAAwC;YAAE,OAAM;QACrE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,SAAiC;QACrC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC;IACD,cAAc,CAAC,SAAiC,EAAE,OAAsB;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;QACjG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IACD,UAAU,CAAC,SAAiC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC1F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;YAAE,SAAS,CAAC,KAAK,EAAE,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACrB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAA;IAC5B,CAAC;CACF"}

package/dist/src/launcher/managed-source-trust.d.ts

@@ -0,0 +1,37 @@
+import { type ManagedSourceTrust } from './managed-source-authority.js';
+import { type LauncherKeychainBackend } from './secret-store.js';
+export declare function loadManagedSourceTrust(homeDir: string, profileId: string): Promise<readonly ManagedSourceTrust[]>;
+/** Final local dispatch fence: no asynchronous registry read may race a held Native read. */
+export declare function loadManagedSourceTrustNow(homeDir: string, profileId: string): readonly ManagedSourceTrust[];
+/** Explicit provisioning is a trust grant, not a scan or automatic loopback registration. */
+export declare function provisionManagedSource(input: {
+    readonly homeDir: string;
+    readonly profileId: string;
+    readonly binding: ManagedSourceTrust['binding'];
+    readonly owner: ManagedSourceTrust['owner'];
+    readonly serverDirectory: string;
+    readonly keychain?: LauncherKeychainBackend;
+}): Promise<{
+    registry: string;
+    serverTrust: string;
+}>;
+export declare function revokeManagedSource(input: {
+    readonly homeDir: string;
+    readonly profileId: string;
+    readonly binding: ManagedSourceTrust['binding'];
+    readonly owner: ManagedSourceTrust['owner'];
+    readonly keychain?: LauncherKeychainBackend;
+}): Promise<{
+    registry: string;
+}>;
+/** Explicitly authorize an additional owner using an existing exact-binding server pin and signer. */
+export declare function registerManagedSourceOwner(input: {
+    readonly homeDir: string;
+    readonly profileId: string;
+    readonly binding: ManagedSourceTrust['binding'];
+    readonly existingOwner: ManagedSourceTrust['owner'];
+    readonly owner: ManagedSourceTrust['owner'];
+}): Promise<{
+    registry: string;
+}>;
+//# sourceMappingURL=managed-source-trust.d.ts.map

package/dist/src/launcher/managed-source-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-source-trust.d.ts","sourceRoot":"","sources":["../../../src/launcher/managed-source-trust.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmC,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AACxG,OAAO,EAA8B,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAQ5F,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAexC;AA8BD,6FAA6F;AAC7F,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,kBAAkB,EAAE,CAY3G;AA8BD,6FAA6F;AAC7F,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CAC5C;;;GAkDA;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CAC5C;;GAoBA;AAED,sGAAsG;AACtG,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC/C,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACnD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;CAC5C;;GAuBA"}

package/dist/src/launcher/managed-source-trust.js

@@ -0,0 +1,180 @@
+import { lstatSync, readFileSync } from 'node:fs';
+import { createPublicKey, generateKeyPairSync, randomBytes } from 'node:crypto';
+import { lstat, mkdir, readFile, rename, rmdir, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { managedSourceBinding } from '@cordisx/protocol/managed-source/v1';
+import { MANAGED_SOURCE_KEYCHAIN_SERVICE } from './managed-source-authority.js';
+import { createMacOSKeychainBackend } from './secret-store.js';
+function location(homeDir, profileId) {
+    if (!/^[A-Za-z0-9._-]{1,120}$/u.test(profileId) || profileId === '.' || profileId === '..') {
+        throw new Error('invalid profile');
+    }
+    return path.join(homeDir, 'state', 'profiles', profileId, 'managed-source-trust.json');
+}
+export async function loadManagedSourceTrust(homeDir, profileId) {
+    const file = location(homeDir, profileId);
+    try {
+        const stat = await lstat(file);
+        if (!stat.isFile() || stat.size > 262_144 || (stat.mode & 0o022) !== 0
+            || (process.getuid && stat.uid !== process.getuid()))
+            throw new Error('unsafe managed source registry');
+        const entries = JSON.parse(await readFile(file, 'utf8'));
+        if (!Array.isArray(entries) || entries.length > 64)
+            throw new Error('invalid managed source registry');
+        return parseEntries(entries);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+function parseEntries(entries) {
+    if (!Array.isArray(entries) || entries.length > 64)
+        throw new Error('invalid managed source registry');
+    return entries.map(entry => {
+        if (!entry
+            || Object.keys(entry).some(key => !['binding', 'owner', 'serverPublicKey', 'signingKeyRef'].includes(key))) {
+            throw new Error('invalid managed source trust');
+        }
+        const binding = managedSourceBinding(entry.binding);
+        if (!entry.owner || Object.keys(entry.owner).some(key => !['pluginId', 'source'].includes(key))
+            || typeof entry.owner.pluginId !== 'string' || !/^[A-Za-z0-9._-]{1,120}$/u.test(entry.owner.pluginId)
+            || typeof entry.owner.source !== 'string' || entry.owner.source.length > 4096
+            || !['file:', 'https:'].includes(new URL(entry.owner.source).protocol)
+            || typeof entry.signingKeyRef !== 'string' || !/^[A-Za-z0-9_-]{43}$/u.test(entry.signingKeyRef)
+            || typeof entry.serverPublicKey !== 'string'
+            || createPublicKey(entry.serverPublicKey).asymmetricKeyType !== 'ed25519') {
+            throw new Error('invalid managed source trust principal or key');
+        }
+        return {
+            binding,
+            owner: { ...entry.owner },
+            signingKeyRef: entry.signingKeyRef,
+            serverPublicKey: entry.serverPublicKey,
+        };
+    });
+}
+/** Final local dispatch fence: no asynchronous registry read may race a held Native read. */
+export function loadManagedSourceTrustNow(homeDir, profileId) {
+    try {
+        const file = location(homeDir, profileId), stat = lstatSync(file);
+        if (!stat.isFile() || stat.size > 262_144 || (stat.mode & 0o022) !== 0
+            || (process.getuid && stat.uid !== process.getuid()))
+            throw new Error('unsafe managed source registry');
+        return parseEntries(JSON.parse(readFileSync(file, 'utf8')));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    }
+}
+function validateOwner(owner) {
+    if (!owner || Object.keys(owner).some(key => !['pluginId', 'source'].includes(key))
+        || typeof owner.pluginId !== 'string' || !/^[A-Za-z0-9._-]{1,120}$/u.test(owner.pluginId)
+        || typeof owner.source !== 'string' || owner.source.length > 4096
+        || !['file:', 'https:'].includes(new URL(owner.source).protocol))
+        throw new Error('invalid managed source owner');
+}
+async function registryMutation(homeDir, profileId, action) {
+    const file = location(homeDir, profileId), lock = file + '.lock';
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    // Cross-process provisioning must not overwrite another explicit owner grant.
+    await mkdir(lock, { mode: 0o700 });
+    try {
+        return await action();
+    }
+    finally {
+        await rmdir(lock);
+    }
+}
+async function writeRegistry(file, entries) {
+    const temporary = file + '.' + randomBytes(32).toString('base64url');
+    try {
+        await writeFile(temporary, JSON.stringify(entries, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+        await rename(temporary, file);
+    }
+    finally {
+        await unlink(temporary).catch(() => { });
+    }
+}
+/** Explicit provisioning is a trust grant, not a scan or automatic loopback registration. */
+export async function provisionManagedSource(input) {
+    return registryMutation(input.homeDir, input.profileId, async () => {
+        const binding = managedSourceBinding(input.binding), file = location(input.homeDir, input.profileId);
+        const prior = await loadManagedSourceTrust(input.homeDir, input.profileId);
+        if (prior.length >= 64 || prior.some(entry => JSON.stringify(entry.binding) === JSON.stringify(binding)
+            && entry.owner.pluginId === input.owner.pluginId && entry.owner.source === input.owner.source)) {
+            throw new Error('managed source already provisioned or registry full');
+        }
+        validateOwner(input.owner);
+        const host = generateKeyPairSync('ed25519'), server = generateKeyPairSync('ed25519');
+        const pem = (key) => key.export({ type: 'spki', format: 'pem' }).toString();
+        const ref = randomBytes(32).toString('base64url'), keychain = input.keychain ?? createMacOSKeychainBackend();
+        const trust = {
+            binding,
+            owner: input.owner,
+            signingKeyRef: ref,
+            serverPublicKey: pem(server.publicKey),
+        };
+        const serverFile = path.join(path.resolve(input.serverDirectory), 'managed-source-server.json');
+        await mkdir(path.dirname(serverFile), { recursive: true, mode: 0o700 });
+        await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        await keychain.upsert(MANAGED_SOURCE_KEYCHAIN_SERVICE, ref, host.privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'));
+        let createdServerFile = false;
+        try {
+            await writeFile(serverFile, JSON.stringify({
+                binding,
+                hostPublicKey: pem(host.publicKey),
+                serverPrivateKey: server.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+            }) + '\n', { mode: 0o600, flag: 'wx' });
+            createdServerFile = true;
+            await writeRegistry(file, [...prior, trust]);
+        }
+        catch (error) {
+            if (createdServerFile)
+                await unlink(serverFile).catch(() => { });
+            await keychain.remove(MANAGED_SOURCE_KEYCHAIN_SERVICE, ref).catch(() => { });
+            throw error;
+        }
+        return { registry: file, serverTrust: serverFile };
+    });
+}
+export async function revokeManagedSource(input) {
+    return registryMutation(input.homeDir, input.profileId, async () => {
+        const binding = managedSourceBinding(input.binding), file = location(input.homeDir, input.profileId);
+        const prior = await loadManagedSourceTrust(input.homeDir, input.profileId);
+        const removed = prior.filter(entry => JSON.stringify(entry.binding) === JSON.stringify(binding)
+            && entry.owner.pluginId === input.owner.pluginId && entry.owner.source === input.owner.source);
+        if (!removed.length)
+            return { registry: file };
+        const remaining = prior.filter(entry => !removed.includes(entry));
+        await writeRegistry(file, remaining);
+        const keychain = input.keychain ?? createMacOSKeychainBackend();
+        const retiredRefs = new Set(removed.filter(entry => !remaining.some(other => other.signingKeyRef === entry.signingKeyRef)).map(entry => entry.signingKeyRef));
+        await Promise.all([...retiredRefs].map(ref => keychain.remove(MANAGED_SOURCE_KEYCHAIN_SERVICE, ref)));
+        return { registry: file };
+    });
+}
+/** Explicitly authorize an additional owner using an existing exact-binding server pin and signer. */
+export async function registerManagedSourceOwner(input) {
+    validateOwner(input.owner);
+    validateOwner(input.existingOwner);
+    const binding = managedSourceBinding(input.binding), file = location(input.homeDir, input.profileId);
+    return registryMutation(input.homeDir, input.profileId, async () => {
+        const prior = await loadManagedSourceTrust(input.homeDir, input.profileId);
+        const sameBinding = (entry) => JSON.stringify(entry.binding) === JSON.stringify(binding);
+        const existing = prior.find(entry => sameBinding(entry)
+            && entry.owner.pluginId === input.existingOwner.pluginId && entry.owner.source === input.existingOwner.source);
+        if (!existing)
+            throw new Error('existing managed source owner is not provisioned');
+        if (prior.length >= 64 || prior.some(entry => sameBinding(entry)
+            && entry.owner.pluginId === input.owner.pluginId && entry.owner.source === input.owner.source)) {
+            throw new Error('managed source already provisioned or registry full');
+        }
+        await writeRegistry(file, [...prior, { ...existing, owner: { ...input.owner } }]);
+        return { registry: file };
+    });
+}
+//# sourceMappingURL=managed-source-trust.js.map

package/dist/src/launcher/managed-source-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-source-trust.js","sourceRoot":"","sources":["../../../src/launcher/managed-source-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC3F,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,+BAA+B,EAA2B,MAAM,+BAA+B,CAAA;AACxG,OAAO,EAAE,0BAA0B,EAAgC,MAAM,mBAAmB,CAAA;AAE5F,SAAS,QAAQ,CAAC,OAAe,EAAE,SAAiB;IAClD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAA;AACxF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,SAAiB;IAEjB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IACE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eAC/D,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACtG,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QACjE,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AACD,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACtG,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACzB,IACE,CAAC,KAAK;eACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC1G,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnD,IACE,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eACxF,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;eAClG,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;eAC1E,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;eACnE,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;eAC5F,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;eACzC,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,iBAAiB,KAAK,SAAS,EACzE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,OAAO;YACL,OAAO;YACP,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE;YACzB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AACD,6FAA6F;AAC7F,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,SAAiB;IAC1E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QACjE,IACE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eAC/D,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QACjE,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAkC;IACvD,IACE,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAC5E,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;WACtF,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;WAC9D,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;AACnD,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAI,OAAe,EAAE,SAAiB,EAAE,MAAwB;IAC7F,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAA;IAChE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,8EAA8E;IAC9E,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAA;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAsC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACpE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAChG,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACzC,CAAC;AACH,CAAC;AACD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAO5C;IACC,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QACpG,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1E,IACE,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACvC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;eACtD,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAC9F,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QACD,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAA;QACpF,MAAM,GAAG,GAAG,CAAC,GAA0B,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClG,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,0BAA0B,EAAE,CAAA;QAC5G,MAAM,KAAK,GAAuB;YAChC,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,GAAG;YAClB,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;SACvC,CAAA;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,4BAA4B,CAAC,CAAA;QAC/F,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACvE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjE,MAAM,QAAQ,CAAC,MAAM,CACnB,+BAA+B,EAC/B,GAAG,EACH,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC5E,CAAA;QACD,IAAI,iBAAiB,GAAG,KAAK,CAAA;QAC7B,IAAI,CAAC;YACH,MAAM,SAAS,CACb,UAAU,EACV,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO;gBACP,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;aACxF,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5B,CAAA;YACD,iBAAiB,GAAG,IAAI,CAAA;YACxB,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB;gBAAE,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC/D,MAAM,QAAQ,CAAC,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC3E,MAAM,KAAK,CAAA;QACb,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QACpG,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;eACtD,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAC9F,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACjE,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,0BAA0B,EAAE,CAAA;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACzG,KAAK,CAAC,aAAa,CACpB,CACF,CAAA;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QACrG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IACpG,OAAO,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,WAAW,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC5G,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAClC,WAAW,CAAC,KAAK,CAAC;eACf,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,CAC9G,CAAA;QACD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QAClF,IACE,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACvC,WAAW,CAAC,KAAK,CAAC;eACf,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAC9F,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACjF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/launcher/management-cdp-binding.d.ts

@@ -0,0 +1,11 @@
+import type { CdpLifecycleRequestGate } from './production-graph-admission.js';
+import type { CdpSession } from './cdp-session.js';
+import { type PluginManagementBridgeHandler } from './management-rpc.js';
+export interface ManagementCdpBinding {
+    readonly controller?: AbortController;
+    readonly installed: boolean;
+    readonly removeBindingListener: () => void;
+    readonly unsubscribe: () => void;
+}
+export declare function installManagementCdpBinding(session: CdpSession, management: PluginManagementBridgeHandler | undefined, lifecycleRequests: CdpLifecycleRequestGate): Promise<ManagementCdpBinding>;
+//# sourceMappingURL=management-cdp-binding.d.ts.map

package/dist/src/launcher/management-cdp-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-cdp-binding.d.ts","sourceRoot":"","sources":["../../../src/launcher/management-cdp-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAKL,KAAK,6BAA6B,EACnC,MAAM,qBAAqB,CAAA;AAG5B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,IAAI,CAAA;CACjC;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,6BAA6B,GAAG,SAAS,EACrD,iBAAiB,EAAE,uBAAuB,GACzC,OAAO,CAAC,oBAAoB,CAAC,CA8C/B"}