
    j                       U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZ  G d d	e      Z G d
 dee      Z e       Zedgdf   Zded<    eddd       G d d             Z ed       G d d             Z e
d6d       Z!d7dZ"d8dZ#d9dZ$d:dZ%d;dZ&ddd<dZ'd=dZ(d>dZ)	 	 	 	 	 	 	 	 d?d Z*d@d!Z+dAd"Z,dd#dBd$Z-dCd%Z.dDd&Z/dEd'Z0dEd(Z1d)d*	 	 	 	 	 dFd+Z2dGd,Z3dHd-Z4d.Z5 e6h d/      Z7 e6h d0      Z8 ejr                  d1      Z:dId2Z;dJd3Z<	 	 	 	 	 	 dKd4Z=g d5Z>y)L    )annotationsN)contextmanager)	dataclass)EnumPath)CallableIteratorMappingSequence	TypeAliasc                      e Zd ZdZy)DiagnosticEvidenceErrorz>Raised when bounded diagnostic evidence cannot be read safely.N)__name__
__module____qualname____doc__     p/home/cube/projects/richard/.worktrees/nutricoach-v140-impl/dualcoach/profile/checkin_cli/diagnostic_evidence.pyr   r      s    Hr   r   c                  (    e Zd ZdZdZdZdZdZdZdZ	y)	DiagnosticEvidenceSourcez<The fixed writer-lock domains that can be used for evidence.wizard_draftcanonical_event_sequenceadaptive_journalsoverlayscheduleprofile_authorityN)
r   r   r   r   WIZARD_DRAFTCANONICAL_EVENT_SEQUENCEADAPTIVE_JOURNALSOVERLAYSCHEDULEPROFILE_AUTHORITYr   r   r   r   r      s&    F!L9+GH+r   r   DiagnosticSourceDescriptorr   _DESCRIPTOR_VALIDATORTF)frozenslotsinitc                      e Zd ZU dZded<   ded<   ded<   ded<   ded	<   d
ed<   ded<   dd	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 ddZe	 	 	 	 	 	 	 	 	 	 	 	 dd       Zy)r%   a  Sealed description of one profile-owned evidence source.

    ``data_paths`` and ``lock_path`` are derived by :func:`diagnostic_source`.
    The private constructor token prevents callers from manufacturing a
    descriptor with an unrelated lock inode.
    r   kindtuple[Path, ...]
data_pathsr   	lock_pathrootprofile_rootr&   	validatorobject_sealN_tokenc                  |t         urt        d      t        |t              st        d      t        |t              rt        d |D              st        d      t        |t              r t        |t              rt        |t              st        d      t        |      st        d      t        j                  | d|       t        j                  | d|       t        j                  | d	|       t        j                  | d
|       t        j                  | d|       t        j                  | d|       t        j                  | dt                y )Nz1diagnostic source descriptors are factory-created!diagnostic source kind is invalidc              3  <   K   | ]  }t        |t                y wN)
isinstancer   .0items     r   	<genexpr>z6DiagnosticSourceDescriptor.__init__.<locals>.<genexpr>G   s     7f[eSW
48N[e   #diagnostic source paths are invalidz#diagnostic source roots are invalidz&diagnostic source validator is invalidr+   r-   r.   r/   r0   r1   r3   )
_DESCRIPTOR_TOKEN	TypeErrorr:   r   tupleallr   callabler2   __setattr__)selfr+   r-   r.   r/   r0   r1   r5   s           r   __init__z#DiagnosticSourceDescriptor.__init__8   s    **OPP$ 89?@@*e,C7f[e7f4fABB)T**T42HPZ[gimPnABB	"DEE4.4z:4i84.4>4i84*;<r   c           	     0     | |||||t         t              S )Nr4   )_validate_descriptorrA   )clsr+   r-   r.   r/   r0   s         r   _createz"DiagnosticSourceDescriptor._createU   s&      $
 	
r   )r+   r   r-   r,   r.   r   r/   r   r0   r   r1   r&   r5   object | NonereturnNone)r+   r   r-   r,   r.   r   r/   r   r0   r   rN   z'DiagnosticSourceDescriptor')r   r   r   r   __annotations__rH   classmethodrL   r   r   r   r%   r%   '   s     #"  O
J$$M !%=&= %= 	=
 = = )= = 
=: 
&
 %
 	

 
 
 
&
 
r   )r'   c                  Z    e Zd ZU ded<   ded<   ded<   ded<   ded<   edd	       Zdd
Zy)ReadOnlySnapshotstrschema_versionzDiagnosticEvidenceSource | strr+   int	row_countcontent_digestrevision_tokenc                    t        | j                  t              r| j                  j                  S t	        | j                        S )z;Compatibility spelling for older bounded fixture consumers.)r:   r+   r   valuerT   rG   s    r   source_kindzReadOnlySnapshot.source_kindq   s2     #-TYY8P"QtyyeWZ[_[d[dWeer   c                v    | j                   | j                  | j                  | j                  | j                  dS )NrU   r+   rW   rX   rY   )rU   r]   rW   rX   rY   r\   s    r   to_dictzReadOnlySnapshot.to_dictv   s7    "11$$"11"11
 	
r   N)rN   rT   )rN   dict[str, object])r   r   r   rP   propertyr]   r`   r   r   r   rS   rS   i   s8    
((Nf f
r   rS   c              #    K   t        |       }t        j                  t        t        dd      z  t        t        dd      z  }d}	 |j	                         }t        j
                  ||      }t        j                  |      }|j	                         }t        j                  |j                        rt        j                  |j                        dk7  s|j                  dk7  s|j                  t        j                         k7  sb|j                  |j                  f|j                  |j                  fk7  s1|j                  |j                  f|j                  |j                  fk7  rt!        d      t#        j$                  |t"        j&                         |j	                         }|j                  |j                  f|j                  |j                  fk7  rt!        d      | 	 |;	 t#        j$                  |t"        j,                         t        j.                  |       yy# t         $ r  t(        t*        f$ r}t!        d      |d}~ww xY w# t        j.                  |       w xY w# |U	 t#        j$                  |t"        j,                         t        j.                  |       w # t        j.                  |       w xY ww xY ww)	z@Acquire ``LOCK_SH`` on an existing writer lock without mutation.
O_NOFOLLOWr   	O_CLOEXECN     corrupt_statesnapshot_unstable)r   osO_RDONLYgetattrlstatopenfstatstatS_ISREGst_modeS_IMODEst_nlinkst_uidgeteuidst_devst_inor   fcntlflockLOCK_SHFileNotFoundErrorOSErrorLOCK_UNclose)	r.   pathflags
descriptorbeforeopenedaftercurrentexcs	            r   existing_read_lockr      s     	?DKK'"lA66[RS9TTE!J%WWT5)
*%

V^^,||FNN+u4!#}}

,v}}-&--1OOv}}-%,,1MM)/::J.**,MM6==)gnngnn-MM)*=>> !%J6$	 " # w' D%&9:CD $	 !%J6$$	 "sg   AKFH! #K&$I 
K!I
9II

I' I$$K'K +$J%K %J<<K  Kc                T    t        j                  | dddd      j                  d      S )NT),:F)	sort_keys
separatorsensure_ascii	allow_nanutf-8)jsondumpsencoder[   s    r   
_canonicalr      s-    :: fWor   c                H    t        j                  |       j                         S r9   )hashlibsha256	hexdigest)raws    r   _sha256r      s    >>#((**r   c                    h d}i }| j                         D ]a  \  }}||v r!t        |t        t        t        f      r|||<   +|j                  d      s=t        |t              sNt        |      dk(  s]|||<   c |S )N>   countepochstatus
event_typereason_coderU   _digest@   )itemsr:   rT   rV   boolendswithlen)rowallowedboundedkeyr[   s        r   _bounded_rowr      sq    YG!#Giik
U'>jc40@A GCL\\)$E3)?CJRTDT GCL	 "
 Nr   c                F   t        |       }	 |j                         s |j                         r|j                         st	        | d      |j                  d      }|j                         rt	        | d      |S # t        t        f$ r}t	        | d      |d }~ww xY w)Nz is unavailableTstrictz
 is unsafe)r   
is_symlinkexistsis_dirr   resolver}   RuntimeError)r   label	candidateresolvedr   s        r   _resolve_directoryr      s    T
IJ!)9)9);9CSCSCU)UG?*CDD$$D$1 %z&:;;O	 \" J%&?@cIJs   AA= =B BB c                   |}	 | j                  |      }|j                  D ]"  }||z  }|j	                         st        d       y# t        $ r}t        d      |d}~ww xY w)z8Reject symlink components between ``stop`` and ``path``.source path escapes its rootNz"source path symlink is not allowed)relative_to
ValueErrorr   partsr   )r   stopr   relativer   parts         r   _reject_symlink_componentsr      sp    GO##D) D.)*NOO   O%&DE3NOs   A 	A!AA!allow_missingc               >   	 | j                  |      }|j                  rt	        d |j                  D              rt        d      t        | |       | j                         s|s| j                         st        d      y y # t        $ r}t        d      |d }~ww xY w)Nr   c              3  $   K   | ]  }|d v  
 yw)>    ...Nr   r<   r   s     r   r>   z%_require_contained.<locals>.<genexpr>   s      T^T!8^s   z'source path is not relative to its root)r   z(source path symlink or absence is unsafe)r   r   r   r   anyr   r   r   )r   r/   r   r   r   s        r   _require_containedr      s    O##D) >>S TX^^ TT%&OPPt$/t{{}%&PQQ 8E  O%&DE3NOs   B 	BBBc                |   | dz  dz  | dz  f}|D ]}  }|j                         s|j                         s$|j                         rt        d      	 |j                  d      }t        || d       |j                         st        d      |c S  t        d      # t        t
        f$ r}t        d      |d }~ww xY w)	N	customersregistry.jsonz3registered customer registry symlink is not allowedTr   z+registered customer registry is unavailableFr   )r   r   r   r   r}   r   r   is_file)profile
candidatesr   r   r   s        r   _registry_pathr      s    K'/97_;TUJ	!)*>*>*@!)*_``	b (((5H 	8WEB!)*WXX   ""O
PP & 	b)*WX^aa	bs   BB;*B66B;c                \   ddl m}mm}m}m} t        |      urt        d      	 |j                  |j                  }|j                  }t              |ust        |      |urt        d      t        |t              st        d      	 |j!                         }	|j#                         r||	k7  rt        d      |j%                         rt        d      t'        |d      }
t)        |
| d	       | d
z  dz  j*                  z  j!                         }|
|k7  rt        d      t-        |       }	 |j/                         } |||       }t5        fd|j6                  D              }t9        |      dk7  rt        d      |d   }	 |j                  }|j:                  |j<                  |j>                  |j@                  |jB                  |jD                  |jF                  f}tI        tK        |j:                  |j<                  |j>                  |j@                  |jB                  |jD                  d            }|j                  |j                  k7  s|
|jL                  k7  s||k7  stO        d |D              r|j<                  tI        tQ        |
      jS                  d            k7  sT|j:                  tI        tK        dj*                  i            k7  s'|j>                  tI        |      k7  s|jF                  |k7  rt        d      |
S # t        |t        t        f$ r}t        d      |d }~ww xY w# t        t        f$ r}t        d      |d }~ww xY w# |t        t        t0        t2        f$ r}t        d      |d }~ww xY w# t        t0        t2        f$ r}t        d      |d }~ww xY w)Nr   )CustomerRegistryErrorCustomerRuntimeCustomerSpecRegisteredCustomerBindingload_customer_registryz'registered customer runtime is requiredz&registered customer runtime is invalidz#customer data root is not canonicalz)customer data root symlink is not allowedzcustomer data rootFr   datar   z6customer data root does not match the profile registryz'registered customer registry is invalidc              3     K   | ]6  }t        |      u r'|j                  j                  j                  k(  r| 8 y wr9   )typespeccustomer_key)r<   runtimer   r   s     r   r>   z!_customer_root.<locals>.<genexpr>!  s<      )G=O+0I0ITM^M^0^ 	)s   <?rg   z:registered customer runtime is not in the profile registry)customer_key_digestdata_root_digestregistry_digestregistry_versionactivation_digestmodez&registered customer binding is invalidc              3  <   K   | ]  }t        |t                y wr9   )r:   rT   r<   r[   s     r   r>   z!_customer_root.<locals>.<genexpr>F  s     F~e:eS)~r?   r   r   z?registered customer binding does not match the profile registry)*checkin_cli.customer_coachingr   r   r   r   r   r   r   r   	data_rootregistered_bindingAttributeErrorr}   r   r:   r   r   is_absoluter   r   r   r   r   
read_bytesrB   r   rC   r   r   r   r   r   r   r   r   binding_digestr   r   customer_rootrD   rT   r   )r   customer_runtimer   r   r   r   raw_rootbindingr   canonical_rootr/   expected_rootregistry_pathregistry_bytesregistrymatches
registeredr   binding_valuesexpected_binding_digestr   r   s                       @@r   _customer_rootr      s     _4%&OPPY$$#--"55 Dz%g>W)W%&NOOh%%&KLLV!))+ !X%?%&KLL%&QRRh(<=DtWE:v%3d6G6GGPPRM}%&^__"7+MZ&113)-A  )) G
 7|q%&bccJY'::''$$##$$%%LL""
 #*+2+F+F(/(@(@'.'>'>(/(@(@)0)B)B#LL	#
 	0:+++((F~FF##ws4y/?/?/H'II&&:~t/@/@ABCD""gn&==!!%<<%&ghhKO 17LI Y%&NOUXXY \" V%&KLRUUV  "7L)ZP Z%&OPVYYZB Iz2 Y%&NOUXXYs`   $L L5 3M 
B2N L2!L--L25MMMN2M>>NN+N&&N+c                6   t        |t              st        d      t        t	        |       d      }|t        j
                  t        j                  t        j                  t        j                  hv rt        ||      }|dz  }|dz  |t        j
                  u r|dz  f}|dz  }n|t        j                  u r|dz  dz  f}|d	z  }n|t        j                  u rt        fd
dD              }dz  }n_dz  f}dz  }nS|t        j                  u r|}|dz  }|dz  |dz  |dz  f}|dz  }n&|}t        |      }	|	|dz  dz  |dz  dz  f}|dz  dz  }t        j                  |t        d |D              t	        |      t	        |      |      }
t        |
       |
S )z<Derive a sealed descriptor for one fixed writer-lock domain.z,source_kind must be DiagnosticEvidenceSourcezprofile rootwizardnutrition-plansdrafts.wizard.lockevents.jsonlcanonical-sequence.jsonl.events.lockc              3  (   K   | ]	  }|z    y wr9   r   )r<   nameadaptives     r   r>   z$diagnostic_source.<locals>.<genexpr>k  s!      	D 4s   r  zsource-days.jsonlzsource-day-intents.jsonlzauthority-mirror-intents.jsonlzconfig-epoch-journal.jsonl.adaptive.lockadaptive-overlays.jsonl.authority-transition.lockr   scheduled-deliveries.jsonlscheduled-deliveries-fence.jsoncustomer-schedule-claims.scheduled-deliveries.lock customer-activation-journal.jsoncustomer-activation-audit.jsonl.adaptive-authority.lockc              3  2   K   | ]  }t        |        y wr9   r   )r<   r   s     r   r>   z$diagnostic_source.<locals>.<genexpr>  s     0ZTd4jZ   )r:   r   rB   r   r   r   r    r!   r"   r   rC   r#   r   r%   rL   rJ   )r0   r   r]   r   r/   r   r-   r.   r   r   r   r  s              @r   diagnostic_sourcer  Q  s    k#;<FGG l!3^DG -- 99 22 ((	  g'78++2??? 8+-J/I4MMM >18>X3XYJ/I4FFF 		 	J !#33I"%>>@J #??I	099	9//44--


 77	!'*fAAf@@


 f$'AA	+330Z00YT
J $r   c                   t        |       t        urt        d      	 | j                  }| j                  }t        | j                        }t        | j                        }| j                  }| j                  }|t        us|t        urt        d      t        | j                   t"              st        d      |j%                         rC||j'                         k7  s0|j)                         s |j+                         r|j-                         st        d      |j%                         r||j'                         k7  rt        d      |j)                         s |j+                         r|j-                         st        d      t        |t.              r t1        t3        |            t1        |      k7  rt        d      |D ]9  }t        |t
              r|j%                         st        d      t5        ||       ; t        |t
              r#|j%                         r||j'                         k7  rt        d	      t5        ||       | j                   }	t"        j6                  t"        j8                  t"        j:                  t"        j<                  h}
|	t"        j6                  u r|d
z  dz  }|d
z  dz  h}n|	t"        j8                  u r|d
z  dz  }|d
z  dz  |dz  dz  h}n|	t"        j:                  u r|dz  dz  }dD ch c]
  }|dz  |z   }}ny|	t"        j<                  u r|dz  dz  }|dz  dz  h}nU|	t"        j>                  u r |dz  dz  }|dz  dz  |dz  dz  |dz  dz  h}n#|dz  dz  }|dz  dz  |dz  |dz  dz  |dz  dz  h}|	|
v r"	 |j@                  |dz  dz  k7  rt        d      n||k7  rt        d       ||k7  rt        d!      t3        |      jG                  |      st        d"      y # t        t        t        f$ r}t        d      |d }~ww xY wc c}w # tB        tD        f$ r}t        d      |d }~ww xY w)#N'diagnostic source descriptor is invalidz*diagnostic source descriptor is not sealedr7   z-diagnostic source profile root is unavailablez'diagnostic source root is not canonicalz%diagnostic source root is unavailabler@   z'diagnostic source path is not canonicalz'diagnostic source lock is not canonicalr   r   r   r  r  r   r  r  r  r
  r	  r   r  r  r  r  r  r   r   r  r  z.customer source root is not registry-containedz$profile source root is not canonicalz#diagnostic source lock is unrelatedz,diagnostic source contains an unrelated path)$r   r%   r   r3   r1   r   r0   r/   r-   r.   r   rB   r   rA   rJ   r:   r+   r   r   r   r   r   r   rC   r   setr   r   r    r!   r"   r#   parentr}   r   issubset)r   sealr1   r0   r/   r-   r.   r   r   r+   customer_kindsexpected_lockallowed_pathsr  s                 r   rJ   rJ     su   J99%&OPPZ((	J334JOO$**
((	 $$	9M(M%&RSSjoo'?@%&IJJ$$&<//11""$""$""$%&UVV!7%&OPPT[[]%&MNNj%(CJ,@C
O,S%&KLL$%T-=-=-?)*STT4&  i&i.C.C.EV_VgVgViIi%&OPPy$'??D 	!-- 99 22 ((	N '444x.8834	)BB	Bx.8>94BS;SVp;pq	);;	;003CC	
 $$t+ 	 	
 
)11	1003OO 114MMN	)22	2v(DD6M886M==6M66
 v(BB;0?"6M>>6M==	
 ~	e{{lV3kAA-.^__ B 
	%&LMMM!%&KLLz?##M2%&TUU 3g Iz2 Z%&OPVYYZZ	
@ & 	e)*Z[add	es6   AO0 9P	 P 0PPPP=,P88P=c                  | j                         sy| j                         s| j                         st        d      g }	 |t        j
                  u rt        | j                         d       D ]^  }|j                         s0|j                         r t        j                  d|j                        t        d      |j                  |       ` nRt        | j                         d       D ]2  }|j                         s0|j                         r t        j                  d|j                        t        d	      t        |j                         d
       D ]  }|j                         s0|j                         r t        j                  d|j                        t        d	      t        |j                         d       D ]Y  }|j                         s+|j                         r|j                  j                  d      rt        d	      |j                  |       [  5 t        |      dkD  rt        d      t!        |      S # t        $ r}t        d      |d }~ww xY w)Nr   z%diagnostic source directory is unsafec                    | j                   S r9   r  r   s    r   <lambda>z&_inventory_directory.<locals>.<lambda>   s    r   )r   z[a-f0-9]{32}\.jsonz wizard draft inventory is unsafec                    | j                   S r9   r   r   s    r   r!  z&_inventory_directory.<locals>.<lambda>  s    UZZr   z[a-z0-9][a-z0-9_-]{2,63}z"schedule claim inventory is unsafec                    | j                   S r9   r   r   s    r   r!  z&_inventory_directory.<locals>.<lambda>
      

r   z\d{4}-\d{2}-\d{2}c                    | j                   S r9   r   r   s    r   r!  z&_inventory_directory.<locals>.<lambda>  r$  r   r   z'diagnostic source inventory unavailablei   z(diagnostic source inventory is too large)r   r   r   r   r   r   sortediterdirr   re	fullmatchr  append
startswithr}   r   rC   )r   r+   resultr=   customerdayr   s          r   _inventory_directoryr/    s   ;;=%&MNNFZ+888t||~3KL??$DLLNbllK`bfbkbk>l>t12TUUd# M #4<<>7OPP&&(0AR\\Rmowo|o|E}  FF12VWW!("2"2"4:RSC~~'szz|r||L`bebjbj?k?s56Z[[ &s{{}:R S??,DLLNdiiFZFZ[^F_"9:^"__d+ !T T Q 6{T%&PQQ=	  Z%&OPVYYZs    G#I 	I!II!require_privatec                  | j                         rt        d      t        j                  t	        t        dd      z  t	        t        dd      z  }d }	 t        j
                  | |      }t        j                  |      }t        j                  | d      }t        j                  |j                        r|j                  dk7  s|j                  t        j                         k7  sd|r"t        j                  |j                        dk7  s@|j                  |j                  f|j                  |j                  fk7  s|j                   d	kD  rt        d
      g }d	}|r;t        j"                  ||      }|sn"|j%                  |       |t'        |      z  }|r;t        j                  |      }	|	j                  |	j                  |	j                   f|j                  |j                  |j                   fk7  rt        d      dj)                  |      |t        j*                  |       S S # t        $ r  t,        t.        f$ r}
t        d      |
d }
~
ww xY w# |t        j*                  |       w w xY w)Nz-diagnostic source file symlink is not allowedrd   r   re   F)follow_symlinksrg   rf   i   rh   ri   r   )r   r   rj   rk   rl   rn   ro   rp   rq   rr   rt   ru   rv   rs   rw   rx   st_sizereadr*  r   joinr   r|   r}   )r   r1  r   r   r   namedchunks	remainingchunkr   r   s              r   _read_regular_bytesr;    s   %&UVVKK'"lA66[RS9TTE!J!WWT5)
*%e4V^^,!#}}

,DLL$@E$Iv}}-%,,1MM~~/)/:: #	GGJ	2EMM% U#I  $LL%,,66==&--Y_YgYg:hh)*=>>xx !HHZ  " # w' D%&9:CD !HHZ  "s,   E H$ A7H$ $I<III I*c                n   g }| j                   D ]  }t        || j                         |j                  dv r'|j	                  t        || j                               N|j                         s_|j                         s|j                         st        d      |j                  |        t        |      S )N>   r   r  )r+   z diagnostic source file is unsafe)r-   r   r/   r  extendr/  r+   r   r   r   r   r*  rC   )r   r,  r   s      r   _expand_descriptor_pathsr>  ?  s    F%%4199>>MM.t*//JK[[] -.PQQMM$ & =r   c                X   | sdg fS |j                   dk(  s|j                  j                  d      rg }| j                         D ]m  }|j	                         s	 t        j                  |j                  d            }t        |t              st        d      |j                  t        |             o t        |      |fS 	 t        j                  | j                  d            }t        |t              rdt        |      gfS t        |t               r6|D cg c]  }t        |t              st        |        }}t        |      |fS t        d      # t        t
        j                  f$ r}t        d      |d }~ww xY w# t        t
        j                  f$ r
 dddigfcY S w xY wc c}w )Nr   z.jsonlr   rh   rg   rU   opaque_document)suffixr  r   
splitlinesstripr   loadsdecodeUnicodeDecodeErrorJSONDecodeErrorr   r:   r   r*  r   r   list)r   r   rowsliner[   r   r=   r   s           r   _bounded_payloadrK  L  s   "u{{h$))"4"4X">(*NN$D::<H

4;;w#78 eW--o>>KKU+, % 4y$:

3::g./ %!<&'''%27U%$:dG;T<%%U7|W$$
!/
22% '(<(<= H-o>CGH  4 45 : $&78999	: Vs6   $E$F F'-F'E>-E99E> F$#F$c           
        ddl m}m} ddlm} 	  || j
                        5 \  }}} ||||      }d d d        j                         }	|	d   |	d   |	d   |	d   |	d	   |	d
   d}
t        d| j                  |j                  t        t!        |
            |j"                        S # 1 sw Y   txY w# t        $ r  |$ r}t        d      |d }~wt        t        t        t        f$ r}t        d      |d }~ww xY w)Nr   )0_validate_schedule_delivery_read_snapshot_lockedschedule_delivery_read_lock)CustomerScheduleErrorrh   rU   rW   tombstone_countledger_digesttombstone_inventory_digestfence_digest)rU   rW   rP  rQ  rR  rS  diagnostic_snapshot_v1r_   )checkin_cli.customer_schedulerM  rN  5checkin_cli.weekly_operations_schedule_host_models_r4rO  r/   r   r}   r   rB   r   r`   rS   r+   rW   r   r   rY   )sourcerM  rN  rO  ledgerfenceclaims_rootr   r   r   contents              r   _snapshot_schedule_sourcer\  i  s    \@(59U&%GH 6  G!"23[)"#45 1&-.J&K/G /[[$$z'23.. - 65 #   @%o6C?\9j9 @%o6C?@s9   B0 B$B0 $B-)B0 0C7>C

C7&C22C7c                J   t        |       t        urt        d      	 t        |        | j                  t        j                  u rt        |       S t        |       }t               }g }d}t        | j                         5  t        |       }|D ]m  }t#        |      }|j%                  t'        |      j)                  dd             |j%                  |       t+        ||      \  }}	||z  }|j-                  |	       o t        |       }
||
k7  rt	        d      	 ddd       t/        d| j                  |t1        t3        |            t1        t5        |            	      S # t        $ r  t
        t        t        t        t        f$ r}t	        d      |d}~ww xY w# 1 sw Y   xY w)
z<Read one typed source under its existing shared writer lock.z,snapshot requires DiagnosticSourceDescriptorr  Nr      bigri   rT  r_   )r   r%   rB   rJ   r   r   r}   r   r   r+   r   r#   r\  r>  	bytearrayr   r.   r;  r=  r   to_bytesrK  r*  rS   r   r   bytes)rW  r   expandedtotal_bytesbounded_documentsrW   r   r   r   r   r   s              r   snapshot_diagnostic_sourcerf    s   F|55FGGZV$
 {{.777(00'/H+K&(I	F,,	- ,F3D%d+Cs3x00E:;s#-c48NE7I$$W-  )0u)*=>>  
. /[[z*;<=u[12 1 # G\9jI Z%&OPVYYZ 
.	-s$   E >BF'FFFF"   )max_attemptsc               L   |dk  s|dkD  rt        d      t        d | D              st        d      t        |       }t	        |      D ]O  }t        d |D              }t        d |D              }t        d |D              t        d	 |D              k(  sM|c S  t        d
      )zERead typed domains separately and fence the complete revision vector.rg      zmax_attempts must be 1..5c              3  >   K   | ]  }t        |      t        u   y wr9   )r   r%   r<   rW  s     r   r>   z/coherent_diagnostic_snapshot.<locals>.<genexpr>  s     PftF|99s   z3coherent snapshots require typed source descriptorsc              3  2   K   | ]  }t        |        y wr9   rf  rl  s     r   r>   z/coherent_diagnostic_snapshot.<locals>.<genexpr>  s     Nf1&9r  c              3  2   K   | ]  }t        |        y wr9   rn  rl  s     r   r>   z/coherent_diagnostic_snapshot.<locals>.<genexpr>  s     MuV08ur  c              3  4   K   | ]  }|j                     y wr9   rY   r;   s     r   r>   z/coherent_diagnostic_snapshot.<locals>.<genexpr>  s     8$$   c              3  4   K   | ]  }|j                     y wr9   rq  r;   s     r   r>   z/coherent_diagnostic_snapshot.<locals>.<genexpr>  s     AhbgZ^$BUBUbgrr  ri   )r   rD   rB   rC   ranger   )sourcesrh  typed_r   r   s         r   coherent_diagnostic_snapshotrx    s     a<!+455PPPMNN'NE< NNNMuMM888EAhbgAh<hhL	 !
 ""5
66r   c           
         dd| D cg c]  }|j                    c}| D cg c]  }d|j                  |j                  d c}dS c c}w c c}w )Ndiagnostic_synthetic_replay_v1synthetic_diagnostic_onlyT)	syntheticr+   r   )rU   
provenancesource_digestsrI  )rX   r]   rW   )	snapshotssnapshots     r   synthetic_replay_fixturer    sm    :1CLM9x8229M &
 &	 " ,,!++
 &
	  N
s
   A!A
c                j    | j                  d      dk7  s| j                  d      dk7  rt        d      y )NrU   rz  r}  r{  z%production replay provenance rejected)getr   r   s    r   require_synthetic_provenancer    sB    yy!"&FF%))T`Ja  fA  KA%&MNN KAr    diagnostic_promotion_manifest_v1>   r+   r   relative_pathrU   >   .env.gitauthr   distbuildtokenrX  replaysecretr   sessionr-  r  	generated
capability
credentialz^[0-9a-f]{64}$c                   t        | t              rt        |       ddhk7  rt        d      i }dD ]  \  }}| |   }t        |t              st        d      t        || d      }|j                  |      }t        |t              r|st        d      |D ]  }t        |t              r*|r(|j                  d      sd	|v sd
|j                  d      v rt        d      ||z  }	t        |	|d       |j                  d      r|	j                         r}t        d      |	j                         rt        d       |||<    |S )Nr   hermesz#approved promotion roots are closed))r   profile_markers)r  hermes_markersz,approved promotion roots must be Path valuesz promotion rootz$promotion policy markers are invalid/\r   z!promotion policy marker is unsafeFr   z(promotion root marker is not a directoryz+promotion root marker is not a regular file)r:   r   r  r   r   rB   r   r  rH  rT   r+  splitr   r   r   r   )
approved_rootspolicyr,  r  marker_fieldr[   r/   markersmarkermarker_paths
             r   _manifest_rootsr    sT   ng.#n2E)U]I^2^%&KLL F\lt$%&JKK!%D6)AB**\*'4()*PQQFfc*&F<M<Mc<RVZ^dVdhlpvp|p|  ~A  qB  iB-.QRR-K{DFs#"))+12\]] ((*-.[\\  t% ]& Mr   c                   t        |t              r,|r*|j                  d      s|j                  d      sd|v sd|v rt	        d      |j                  d      }t        d |D              rt	        d       | j                  | }t        || d       |j                         s|j                         st	        d	      	 |j                         j                  d
k7  rt	        d      	 |S # t        $ r}t	        d      |d }~ww xY w)Nr  r   zpromotion path is not relativec              3  .   K   | ]  }| xs |d v   yw)>   r   r   Nr   r   s     r   r>   z&_manifest_candidate.<locals>.<genexpr>  s      
=utt8*t{**us   z!promotion path traversal rejectedFr   z5promotion artifact must be a regular non-symlink filerg   z'promotion artifact link count is unsafez!promotion artifact is unavailable)r:   rT   r+  r   r   r  r   joinpathr   r   r   rp   rt   r}   )r/   r  r   r   r   s        r   _manifest_candidater    s   }c*##C(!!#&= ]"%&FGG$E

=u
==%&IJJu%Iy$e<Y%6%6%8%&]^^T>>$$))*STT *   T%&IJPSSTs   ?(C* *	D3C??Dc               8   	 ddl m}m}  |       }t        ||      }|j                  d      }|j                  d      }|j                  d      }	|j                  d      }
|j                  d	      }t        d
 |||	|
|fD              st        d      g }t               }| D ]  }t        |t              rt        |      t        k7  rt        d      |d   t        k7  rt        d      |d   }|d   }|d   }t        |t              r||vs||v rt        d      t        |t              rd|vrt        d      |j!                  dd      \  }}||vs|st        d      ||f}||v rt        d      |j#                  |       t        |t              rt$        j'                  |      t        d      |j!                  d      }t)        d |D              rt        d      |	D ch c]  }t        |t              s| }}t+        |      j,                  |vrt        d      |dk(  r||
vrt        d      |dk(  r |j/                  d      sd |v st        d!      |d"k(  r"t+        |      j,                  d#vrt        d$      |d%k(  r"t+        |      j,                  d&vrt        d'      |d(k(  r"t+        |      j,                  d)vrt        d*      t1        ||   |      }	 t3        |d+,      }t$        j'                  t5        |            rt7        j8                  t5        |      |      st        d-      |j;                  |||t        d.        t=        |      S # t        t        t
        f$ r}t        d      |d}~ww xY wc c}w # t        $ r  w xY w)/a  Validate a read-only promotion manifest against packaged policy.

    The caller supplies only the two already-approved source roots.  Policy
    bytes and every allowlist are loaded from the installed package itself;
    callers cannot replace them with a permissive mapping.
    r   )PromotionPolicyErrorload_policyzpromotion policy unavailableNallowed_artifact_kindsforbidden_artifact_kindsallowed_suffixesmigration_allowlistconfig_allowlistc              3  <   K   | ]  }t        |t                y wr9   )r:   rH  r   s     r   r>   z6build_diagnostic_promotion_manifest.<locals>.<genexpr>D  s     }4|5z%&4|r?   z'promotion policy allowlists are invalidz promotion entry schema is closedrU   z-promotion entry schema version is unsupportedr+   r  r   z!promotion artifact kind forbiddenr  z-promotion path must identify an approved rootrg   z promotion root prefix is invalidz,promotion manifest contains a duplicate pathz$promotion artifact digest is invalidc              3  n   K   | ]-  }|j                         t        v xs |j                  d        / yw)r   N)lower_BANNED_PATH_PARTSr+  r   s     r   r>   z6build_diagnostic_promotion_manifest.<locals>.<genexpr>_  s0     \V[dtzz|11IT__S5IIV[s   35z!promotion path names runtime dataz,promotion artifact suffix is not allowlisted	migrationz&promotion migration is not allowlistedtestztests/z/tests/z&promotion test path is not under testsdocumentation>   .md.htmlz)promotion documentation suffix is invalidconfig_schema>   .py.pyiz)promotion config schema must be code-sidecode>   .tomlr  r  z promotion code suffix is invalidFr0  z"promotion artifact digest mismatch)r+   r  r   rU   )checkin_cli.policiesr  r  ImportErrorr}   r   r   r  r  rD   r  r:   r   _MANIFEST_KEYS_MANIFEST_SCHEMA_VERSIONrT   r  add_HEX_DIGESTr)  r   r   rA  r+  r  r;  r   hmaccompare_digestr*  rC   )entriesr  r  r  r  r   rootsallowed_kindsforbidden_kindssuffixes
migrationsr  r,  seenentryr+   r   digest	root_nameroot_relativer   r   rA  r  r   r   s                             r   #build_diagnostic_promotion_manifestr  -  s   OJ NF3EJJ78Mjj!;<Ozz,-H12Jzz"45}]OU]_ik{4|}}%&OPP&(F!$D%)SZ>-I)*LMM!"&>>)*YZZV})x$$M(AT_E\)*MNN(C(Cx,?)*YZZ#+>>#q#9 	=E!)*LMM-($;)*XYY&#&+*?*?*G*O)*PQQ##C(\V[\\)*MNN19UvZPS=TFU%%-==)*XYY;=
#B)*RSS6>=#;#;H#EVcIc)*RSS?"tM':'A'AIY'Y)*UVV?"tM':'A'A'X)*UVV 6>d=188@XX)*LMM'i(8-H		%iGC $$WS\2$:M:MgVYl\b:c)*NOO!) ":		
_ n =I -w
C O%&DE3NOJ V& ' 		s/   M  'N	=N	#N N5NNN)r   r   r%   rS   r  rx  r  r   r  rf  r  )r.   r   rN   zIterator[int])r[   r2   rN   rb  )r   rb  rN   rT   )r   Mapping[str, object]rN   ra   )r   r   r   rT   rN   r   )r   r   r   r   rN   rO   )r   r   r/   r   r   r   rN   rO   )r   r   rN   r   )r   r   r   r2   rN   r   )r0   r   r   rM   r]   r   rN   r%   )r   r%   rN   rO   )r   r   r+   r   rN   r,   )r   r   r1  r   rN   rb  )r   r%   rN   r,   )r   rb  r   r   rN   ztuple[int, object])rW  r%   rN   rS   )ru  z$Sequence[DiagnosticSourceDescriptor]rh  rV   rN   ztuple[ReadOnlySnapshot, ...])r  zSequence[ReadOnlySnapshot]rN   ra   )r[   r  rN   rO   )r  Mapping[str, Path]r  r  rN   zdict[str, Path])r/   r   r  rT   rN   r   )r  zSequence[Mapping[str, object]]r  r  rN   ztuple[dict[str, object], ...])?
__future__r   ry   r   r  r   rj   r(  rp   
contextlibr   dataclassesr   enumr   pathlibr   typingr	   r
   r   r   r   r   r   rT   r   r2   rA   r&   rP   r%   rS   r   r   r   r   r   r   r   r   r   r  rJ   r/  r;  r>  rK  r\  rf  rx  r  r  r  	frozensetr  r  compiler  r  r  r  __all__r   r   r   <module>r     s   "     	 	  % !   C CIl I,sD , H #+-I,JD,P#Q y Q $d/>
 >
 0>
B $
 
 
, !% !%H+

P IM 	RQ$XvCC#C *C  	CL^VB@ @D $!N
3:$N$T 717 7 "	7( O
 > PQ * bjj*+42S+S 'S #	Snr   