@goliapkg/sentori-cli 1.5.0 → 1.6.0

package/lib/workflow.js

@@ -0,0 +1,289 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { gunzipSync } from 'node:zlib';
+import { parseArgs } from 'node:util';
+import { fetchArtifacts } from './artifacts.js';
+import { checkCompatibility } from './compatibility.js';
+import { dwarfBinariesIn } from './native-artifacts.js';
+import { inspectSourceArchive, packSources } from './srcbundle.js';
+import { expandSourcemapPaths, uploadArtifact } from './upload.js';
+import { isStrict, lenientFail, stripStrict } from './lenient.js';
+const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
+const commonOptions = {
+    config: { type: 'string' }, release: { type: 'string' }, 'api-url': { type: 'string' },
+    'git-tag': { type: 'string' }, 'dry-run': { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+};
+export const WORKFLOW_HELP = `Release uploads:
+  sentori init --api-url <url> [--release <r>] [--sourcemap <path>] [--dsym <path>]
+               [--mapping <path>] [--sources <dir>] [--git-tag <tag>] [--config <file>]
+  sentori config validate [--config sentori.config.json] [--release <r>]
+  sentori doctor [--config sentori.config.json] [--api-url <url>]
+  sentori upload all [--config sentori.config.json] [--release <r>] [--git-tag <tag>]
+                    [--dry-run] [--strict]
+  sentori verify [--config sentori.config.json] [--release <r>] [--git-tag <tag>]
+  sentori sources pack --release <r> --output sources.zip [--root .] [--git-tag <tag>]
+                       [--exclude <path>] <source-dir-or-file...>
+  sentori upload srcbundle --release <r> [--root .] [--git-tag <tag>] <sources.zip|source-dir...>
+
+Paths in config are relative to that config. Sources keep paths relative to sources.root.
+Set the API-scope token in SENTORI_TOKEN (or the configured tokenEnv); init never stores it.
+Release must match the SDK exactly, including its build number. SENTORI_RELEASE is supported.
+Git mode reads the specified tag's commit, never the working tree or a guessed latest tag.
+Verification checks every planned file's bytes and server validation; it does not claim event matching.
+`;
+function object(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
+function strings(value, label) {
+    if (!Array.isArray(value) || value.some(x => typeof x !== 'string' || !x.trim()))
+        throw new Error(`${label} must be an array of paths`);
+    return value;
+}
+export function loadUploadConfig(path) {
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    if (!object(value) || value.version !== 1 || typeof value.apiUrl !== 'string' || !object(value.artifacts))
+        throw new Error('config requires version: 1, apiUrl, and artifacts; run sentori init');
+    if (Object.hasOwn(value, 'token'))
+        throw new Error('store the API token in the environment and set tokenEnv, not token in the config');
+    const allowed = new Set(['version', 'apiUrl', 'tokenEnv', 'release', 'artifacts', 'sources', 'sourceArchive']);
+    for (const key of Object.keys(value))
+        if (!allowed.has(key))
+            throw new Error(`unknown config field: ${key}`);
+    for (const [kind, paths] of Object.entries(value.artifacts)) {
+        if (!['sourcemap', 'dsym', 'mapping'].includes(kind))
+            throw new Error(`unknown artifact kind ${kind}; use sourcemap, dsym, or mapping`);
+        strings(paths, `artifacts.${kind}`);
+    }
+    if (value.release !== undefined && (typeof value.release !== 'string' || !value.release.trim()))
+        throw new Error('release must be a non-empty string');
+    if (value.sourceArchive !== undefined && typeof value.sourceArchive !== 'string')
+        throw new Error('sourceArchive must be a ZIP path');
+    if (value.sources !== undefined) {
+        if (!object(value.sources))
+            throw new Error('sources must declare include paths');
+        for (const key of Object.keys(value.sources))
+            if (!['root', 'include', 'exclude', 'gitTag'].includes(key))
+                throw new Error(`unknown sources field: ${key}`);
+        strings(value.sources.include, 'sources.include');
+        if (value.sources.exclude !== undefined)
+            strings(value.sources.exclude, 'sources.exclude');
+        for (const key of ['root', 'gitTag'])
+            if (value.sources[key] !== undefined && typeof value.sources[key] !== 'string')
+                throw new Error(`sources.${key} must be a string`);
+    }
+    if (value.sources && value.sourceArchive)
+        throw new Error('choose sources or sourceArchive, not both');
+    const tokenEnv = value.tokenEnv ?? 'SENTORI_TOKEN';
+    if (typeof tokenEnv !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(tokenEnv))
+        throw new Error('tokenEnv must name an environment variable');
+    return { ...value, tokenEnv };
+}
+function apiUrl(raw) {
+    const url = new URL(raw);
+    if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+        throw new Error('apiUrl must be an HTTP(S) instance URL without credentials, query, or fragment');
+    return url.toString().replace(/\/+$/, '');
+}
+function validateArtifact(kind, bytes, name) {
+    if (!bytes.length)
+        throw new Error(`empty artifact: ${name}`);
+    if (kind === 'sourcemap') {
+        const map = JSON.parse(bytes.toString('utf8'));
+        if (map?.version !== 3 || !(Array.isArray(map.sections) || Array.isArray(map.sources) && typeof map.mappings === 'string'))
+            throw new Error(`not a version 3 source map: ${name}`);
+    }
+    if (kind === 'proguard' && !/^\S.* -> \S+:\s*$/m.test(bytes.toString('utf8')))
+        throw new Error(`no ProGuard/R8 class mappings in ${name}`);
+    if (kind === 'dsym' && !['feedface', 'cefaedfe', 'feedfacf', 'cffaedfe', 'cafebabe', 'bebafeca', 'cafebabf', 'bfbafeca'].includes(bytes.subarray(0, 4).toString('hex')))
+        throw new Error(`not a Mach-O DWARF binary: ${name}`);
+}
+export function prepareUploadPlan(configPath, overrides = {}) {
+    const config = loadUploadConfig(configPath);
+    const base = dirname(resolve(configPath));
+    const release = overrides.release ?? process.env.SENTORI_RELEASE ?? config.release;
+    if (!release?.trim())
+        throw new Error('set --release, SENTORI_RELEASE, or config.release to the exact SDK release');
+    const plan = { release, apiUrl: apiUrl(overrides.apiUrl ?? process.env.SENTORI_API_URL ?? config.apiUrl), tokenEnv: config.tokenEnv, files: [] };
+    const add = (kind, path, name = basename(path)) => {
+        let bytes = readFileSync(path);
+        if (bytes[0] === 0x1f && bytes[1] === 0x8b) {
+            bytes = gunzipSync(bytes, { maxOutputLength: 512 * 1024 * 1024 });
+            name = name.replace(/\.gz$/, '');
+        }
+        validateArtifact(kind, bytes, name);
+        const digest = hash(bytes);
+        const collision = plan.files.find(file => file.kind === kind && file.name === name);
+        if (collision) {
+            if (collision.hash !== digest)
+                throw new Error(`two different ${kind} files would overwrite ${name}; choose distinct upload paths`);
+            return;
+        }
+        plan.files.push({ kind, path, name, hash: digest, bytes: bytes.length });
+    };
+    for (const path of config.artifacts.sourcemap ?? []) {
+        const maps = expandSourcemapPaths(resolve(base, path));
+        if (!maps.length)
+            throw new Error(`no source maps under ${path}`);
+        for (const file of maps)
+            add('sourcemap', file.path, file.name);
+    }
+    for (const path of config.artifacts.dsym ?? []) {
+        const full = resolve(base, path);
+        const files = dwarfBinariesIn(full);
+        if (!files.length)
+            throw new Error(`no dSYM binaries under ${path}`);
+        for (const file of files)
+            add('dsym', file, lstatSync(full).isDirectory() ? `${basename(full)}-${basename(file)}` : basename(file));
+    }
+    for (const path of config.artifacts.mapping ?? [])
+        add('proguard', resolve(base, path));
+    if (config.sources) {
+        const packed = packSources(config.sources.include, release, {
+            root: resolve(base, config.sources.root ?? '.'), exclude: config.sources.exclude,
+            gitTag: overrides.gitTag ?? config.sources.gitTag,
+        });
+        const dir = resolve(base, '.sentori');
+        mkdirSync(dir, { recursive: true });
+        const archive = resolve(dir, `sources-${hash(packed.bytes)}.zip`);
+        writeFileSync(archive, packed.bytes);
+        add('srcbundle', archive, 'sources.zip');
+        plan.source = { files: packed.manifest.files.map(file => file.path), tag: packed.manifest.source.tag, commit: packed.manifest.source.commit };
+    }
+    else if (overrides.gitTag)
+        throw new Error('--git-tag requires sources in the config');
+    if (config.sourceArchive) {
+        const archive = resolve(base, config.sourceArchive);
+        const source = inspectSourceArchive(readFileSync(archive), release);
+        add('srcbundle', archive);
+        plan.source = { files: source.files, tag: source.manifest?.source.tag, commit: source.manifest?.source.commit };
+    }
+    if (!plan.files.length)
+        throw new Error('config selects no files; declare artifacts or sources');
+    return plan;
+}
+export async function verifyUploadPlan(plan, token) {
+    const result = await fetchArtifacts({ ...plan, token });
+    if (!result.known || result.release !== plan.release)
+        return [`release not found: ${plan.release}`];
+    const problems = [];
+    for (const file of plan.files) {
+        const matches = result.artifacts.filter(row => row.kind === file.kind && row.contentHash === file.hash
+            && (file.kind === 'dsym' || row.name === file.name));
+        if (!matches.length)
+            problems.push(`missing exact bytes: ${file.kind} ${file.name}`);
+        else if (!matches.some(row => row.usable === true))
+            problems.push(`${matches.some(row => row.usable === false) ? 'unreadable' : 'not verified by server'}: ${file.kind} ${file.name}`);
+    }
+    return problems;
+}
+export async function runWorkflow(command, argv) {
+    const strict = isStrict(argv);
+    try {
+        const parsed = parseArgs({ args: stripStrict(argv), options: { ...commonOptions,
+                ...(command === 'init' ? { sourcemap: { type: 'string', multiple: true }, dsym: { type: 'string', multiple: true }, mapping: { type: 'string', multiple: true }, sources: { type: 'string', multiple: true } } : {}),
+            } });
+        if (parsed.values.help) {
+            console.log(WORKFLOW_HELP);
+            return 0;
+        }
+        if (parsed.values['dry-run'] && command !== 'upload')
+            throw new Error('--dry-run is only supported by upload all; doctor and verify must contact the server');
+        const configPath = resolve(parsed.values.config ?? 'sentori.config.json');
+        if (command === 'init') {
+            const v = parsed.values;
+            const base = dirname(configPath);
+            const config = {
+                version: 1, apiUrl: apiUrl(parsed.values['api-url'] ?? process.env.SENTORI_API_URL ?? 'https://sentori.golia.jp'),
+                tokenEnv: 'SENTORI_TOKEN', ...(parsed.values.release ? { release: parsed.values.release } : {}),
+                artifacts: { sourcemap: v.sourcemap ?? [], dsym: v.dsym ?? [], mapping: v.mapping ?? [] },
+            };
+            const include = v.sources ?? ['src', 'Sources', 'ios', 'android/app/src'].filter(path => existsSync(resolve(base, path)));
+            if (include.length)
+                config.sources = { root: '.', include, exclude: [], ...(parsed.values['git-tag'] ? { gitTag: parsed.values['git-tag'] } : {}) };
+            else if (parsed.values['git-tag'])
+                throw new Error('--git-tag requires --sources paths');
+            writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', { flag: 'wx' });
+            console.log(`Created ${configPath}. Review source paths and build artifact paths. Keep .sentori/ out of version control.\nSet SENTORI_TOKEN and the exact SDK release, then run sentori config validate and sentori upload all.`);
+            return 0;
+        }
+        if (command === 'doctor') {
+            const config = loadUploadConfig(configPath);
+            const token = process.env[config.tokenEnv];
+            if (!token)
+                throw new Error(`set ${config.tokenEnv} to an API-scope token`);
+            const result = await fetchArtifacts({
+                apiUrl: apiUrl(parsed.values['api-url'] ?? process.env.SENTORI_API_URL ?? config.apiUrl), token,
+                release: parsed.values.release ?? process.env.SENTORI_RELEASE ?? config.release ?? '__sentori_compatibility_check__',
+            });
+            console.log(checkCompatibility(result, !!(config.sources || config.sourceArchive)));
+            console.log(`Node ${process.versions.node}; API token accepted. No files uploaded. Build artifacts and event/build matching were not checked.`);
+            return 0;
+        }
+        const plan = prepareUploadPlan(configPath, { release: parsed.values.release, apiUrl: parsed.values['api-url'], gitTag: parsed.values['git-tag'] });
+        console.log(JSON.stringify(plan, null, 2));
+        if (command === 'validate' || parsed.values['dry-run']) {
+            console.log('Local files checked; no upload or server verification performed.');
+            return 0;
+        }
+        const token = process.env[plan.tokenEnv];
+        if (!token)
+            throw new Error(`set ${plan.tokenEnv} to an API-scope token`);
+        // Check credentials before the first write. An unknown release is allowed.
+        console.log(checkCompatibility(await fetchArtifacts({ ...plan, token }), plan.files.some(file => file.kind === 'srcbundle')));
+        const failures = [];
+        if (command === 'upload') {
+            for (const file of plan.files) {
+                try {
+                    // Prevent edits between planning and upload from invalidating the receipt.
+                    let body = readFileSync(file.path);
+                    if (body[0] === 0x1f && body[1] === 0x8b)
+                        body = gunzipSync(body, { maxOutputLength: 512 * 1024 * 1024 });
+                    if (hash(body) !== file.hash)
+                        throw new Error('file changed after local validation');
+                    const verdict = await uploadArtifact({ ...plan, token, ...file });
+                    if (verdict.usable !== true)
+                        failures.push(`${file.name}: ${verdict.usable === false ? 'unreadable' : 'not verified by server'}`);
+                }
+                catch (error) {
+                    failures.push(`${file.name}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+        }
+        failures.push(...await verifyUploadPlan(plan, token));
+        if (failures.length)
+            throw new Error(failures.join('\n'));
+        console.log(`Verified ${plan.files.length} exact file(s) for ${plan.release}: stored bytes match and format checks passed. Event/build matching is not asserted.`);
+        return 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (command === 'upload')
+            return lenientFail(strict, { failure: message, impact: 'some planned debug files are missing or unverified', retry: 'sentori upload all --config sentori.config.json; sentori verify --config sentori.config.json' });
+        console.error(`[sentori] ${message}`);
+        return 1;
+    }
+}
+export async function runSourcesPack(argv) {
+    try {
+        const parsed = parseArgs({ args: argv, allowPositionals: true, options: {
+                release: { type: 'string' }, root: { type: 'string' }, output: { type: 'string' },
+                'git-tag': { type: 'string' }, exclude: { type: 'string', multiple: true }, help: { type: 'boolean', short: 'h' },
+            } });
+        if (parsed.values.help) {
+            console.log(WORKFLOW_HELP);
+            return 0;
+        }
+        const release = parsed.values.release ?? process.env.SENTORI_RELEASE ?? '';
+        if (!parsed.values.output)
+            throw new Error('--output <sources.zip> is required');
+        const options = { root: parsed.values.root, gitTag: parsed.values['git-tag'], exclude: parsed.values.exclude };
+        const packed = packSources(parsed.positionals, release, options);
+        writeFileSync(parsed.values.output, packed.bytes, { flag: 'wx' });
+        console.log(JSON.stringify({ output: parsed.values.output, ...packed.manifest, stats: packed.stats }, null, 2));
+        return 0;
+    }
+    catch (error) {
+        console.error(`[sentori] ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+}
+//# sourceMappingURL=workflow.js.map

package/lib/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAsB,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAmB,MAAM,aAAa,CAAA;AACnF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAkBjE,MAAM,IAAI,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC5F,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtF,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;CAC5F,CAAA;AACV,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;CAiB5B,CAAA;AACD,SAAS,MAAM,CAAC,KAAc,IAAsC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAC1I,SAAS,OAAO,CAAC,KAAc,EAAE,KAAa;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAA;IACvI,OAAO,KAAiB,CAAA;AAC1B,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACjM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;IACtI,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;IAC9G,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAA;IAC5G,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,mCAAmC,CAAC,CAAA;QACvI,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACtJ,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrI,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACjF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;QAC3J,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAC1F,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,mBAAmB,CAAC,CAAA;IAC1K,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IACtG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,eAAe,CAAA;IAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC7I,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAkB,CAAA;AAC/C,CAAC;AACD,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IAC5M,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAC3C,CAAC;AACD,SAAS,gBAAgB,CAAC,IAAwB,EAAE,KAAa,EAAE,IAAY;IAC7E,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAA;IAC7D,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9C,IAAI,GAAG,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAA;IACpL,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAA;IAC1I,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;AAChO,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,UAAkB,EAAE,SAAS,GAA2D,EAAE;IAC1H,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,CAAA;IAClF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;IACnH,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAC5J,MAAM,GAAG,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAQ,EAAE;QAClF,IAAI,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAAC,CAAC;QACnJ,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,0BAA0B,IAAI,gCAAgC,CAAC,CAAA;YACnI,OAAM;QACR,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAA;QACjE,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;QACpE,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACrI,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE;QAAE,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACvF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;YAChF,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM;SAClD,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QACrC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC/I,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACxF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;QACnE,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;IACjH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAChG,OAAO,IAAI,CAAA;AACb,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAgB,EAAE,KAAa;IACpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACnG,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI;eACjG,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;aAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACxL,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA6D,EAAE,IAAc;IAC7G,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,aAAa;gBAC7E,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAW,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9N,EAAE,CAAC,CAAA;QACJ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAA;QAC7J,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAA;QACzE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,MAAiE,CAAA;YAClF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;YAChC,MAAM,MAAM,GAAiB;gBAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,0BAA0B,CAAC;gBACjH,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/F,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAqB,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAgB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAmB,IAAI,EAAE,EAAE;aAC9H,CAAA;YACD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAmB,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;YACrI,IAAI,OAAO,CAAC,MAAM;gBAAE,MAAM,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;iBAC9I,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YACxF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACjF,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,+LAA+L,CAAC,CAAA;YACjO,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC1C,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,QAAQ,wBAAwB,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAClC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK;gBAC/F,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,IAAI,iCAAiC;aACrH,CAAC,CAAA;YACF,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YACnF,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,qGAAqG,CAAC,CAAA;YAC/I,OAAO,CAAC,CAAA;QACV,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAClJ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1C,IAAI,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;YAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QACrJ,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ,wBAAwB,CAAC,CAAA;QACzE,2EAA2E;QAC3E,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAA;QAC7H,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,2EAA2E;oBAC3E,IAAI,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAClC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;wBAAE,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;oBACzG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;oBACpF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAA;oBACjE,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;wBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAA;gBACnI,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAAC,CAAC;YAC9G,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QACrD,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACzD,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,sBAAsB,IAAI,CAAC,OAAO,sFAAsF,CAAC,CAAA;QAClK,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,IAAI,OAAO,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,oDAAoD,EAAE,KAAK,EAAE,8FAA8F,EAAE,CAAC,CAAA;QAC/O,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAA;QACrC,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAc;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE;gBACtE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACjF,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;aAClH,EAAE,CAAC,CAAA;QACJ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAAC,OAAO,CAAC,CAAA;QAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAC1E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAChF,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;QAC7H,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAChE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACjE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC/G,OAAO,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,aAAa,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,CAAA;IAAC,CAAC;AACpH,CAAC"}

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@goliapkg/sentori-cli",
-  "version": "1.5.0",
-  "description": "Sentori CLI \u2014 upload source maps so dashboard stack traces resolve to your original source.",
+  "version": "1.6.0",
+  "description": "Sentori CLI \u2014 configure, upload and verify release debug files and source archives.",
   "license": "Apache-2.0 OR MIT",
   "author": "GOLIA K.K. <takagi@golia.jp> (https://golia.jp)",
   "homepage": "https://sentori.golia.jp",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/goliajp/sentori.git",
+    "url": "git+https://github.com/goliajp/sentori-selfhosted.git",
     "directory": "sdk/cli"
   },
   "bugs": {
-    "url": "https://github.com/goliajp/sentori/issues"
+    "url": "https://github.com/goliajp/sentori-selfhosted/issues"
   },
   "keywords": [
     "sentori",
@@ -21,6 +21,7 @@
   ],
   "type": "module",
   "bin": {
+    "sentori": "./lib/index.js",
     "sentori-cli": "./lib/index.js"
   },
   "main": "./lib/index.js",
@@ -31,10 +32,10 @@
     "README.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=18.17"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "rm -rf lib && tsc -p tsconfig.json",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
     "prepack": "bun run build"
@@ -46,5 +47,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "fflate": "^0.8.2"
   }
 }

package/src/__tests__/artifacts.test.ts

@@ -65,7 +65,7 @@ describe('artifacts read', () => {
 
   test('the release name is escaped — @ and + are ordinary in one', async () => {
     seen.length = 0
-    const restore = serve(200, full)
+    const restore = serve(200, { ...full, release: 'focus-ai-app@5.4.26080601+382' })
     try {
       await fetchArtifacts({
         apiUrl: 'https://x.test/',

package/src/__tests__/compatibility.test.ts

@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { checkCompatibility, CLI_VERSION } from '../compatibility.js'
+import { fetchArtifacts, type ArtifactsResponse } from '../artifacts.js'
+import { runWorkflow } from '../workflow.js'
+
+const legacy: ArtifactsResponse = { release: 'app@1+7', known: false, artifacts: [], kinds: {}, missing: [] }
+const modern = { ...legacy, compatibility: { serverVersion: '5.1.12', artifactProtocol: 1, sourceBundleFormats: ['zip', 'json'], verification: ['sha256', 'format'] } }
+let root: string
+const originalFetch = globalThis.fetch
+const oldToken = process.env.SENTORI_TEST_UPLOAD_TOKEN
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'sentori-compatibility-'))
+  process.env.SENTORI_TEST_UPLOAD_TOKEN = 'api-test'
+})
+afterEach(() => {
+  globalThis.fetch = originalFetch
+  rmSync(root, { recursive: true, force: true })
+  if (oldToken === undefined) delete process.env.SENTORI_TEST_UPLOAD_TOKEN
+  else process.env.SENTORI_TEST_UPLOAD_TOKEN = oldToken
+})
+function config(sources = true): string {
+  const path = join(root, 'sentori.config.json')
+  writeFileSync(path, JSON.stringify({ version: 1, apiUrl: 'https://upload.test', tokenEnv: 'SENTORI_TEST_UPLOAD_TOKEN', release: legacy.release,
+    artifacts: sources ? {} : { mapping: ['mapping.txt'] }, ...(sources ? { sources: { include: ['src'] } } : {}) }))
+  return path
+}
+
+describe('CLI/server compatibility', () => {
+  test('installed package determines --version, independently of server and app releases', () => {
+    expect(CLI_VERSION).toBe(JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version)
+    expect(checkCompatibility(modern, true)).toContain('server 5.1.12')
+    expect(checkCompatibility(legacy, false)).toContain('Legacy artifact API')
+    expect(() => checkCompatibility(legacy, true)).toThrow('does not advertise source ZIP')
+    expect(() => checkCompatibility({ ...modern, compatibility: { ...modern.compatibility, artifactProtocol: 2 } }, false)).toThrow('Unsupported server artifact protocol')
+    expect(() => checkCompatibility({ ...modern, compatibility: { ...modern.compatibility, sourceBundleFormats: ['json'] } }, true)).toThrow('does not support source ZIPs')
+    expect(() => checkCompatibility({ ...modern, compatibility: { ...modern.compatibility, verification: ['sha256'] } }, false)).toThrow('verification capabilities')
+  })
+  test('doctor works before build files exist and never sends a write request', async () => {
+    let requests = 0
+    globalThis.fetch = (async (_url, init) => {
+      expect(init?.method ?? 'GET').toBe('GET'); requests++
+      return Response.json(modern)
+    }) as typeof fetch
+    const path = config()
+    expect(await runWorkflow('doctor', ['--config', path])).toBe(0)
+    expect(requests).toBe(1)
+    expect(await runWorkflow('doctor', ['--config', path, '--dry-run'])).toBe(1)
+    expect(await runWorkflow('verify', ['--config', path, '--dry-run'])).toBe(1)
+    expect(requests).toBe(1)
+  })
+  test('old servers reject ZIP plans before uploading even the other artifact kinds', async () => {
+    mkdirSync(join(root, 'src')); writeFileSync(join(root, 'src/main.ts'), 'export const x = 1')
+    writeFileSync(join(root, 'mapping.txt'), 'A -> a:\n')
+    const path = config()
+    const value = JSON.parse(readFileSync(path, 'utf8')); value.artifacts.mapping = ['mapping.txt']; writeFileSync(path, JSON.stringify(value))
+    const methods: string[] = []
+    globalThis.fetch = (async (_url, init) => { methods.push(init?.method ?? 'GET'); return Response.json(legacy) }) as typeof fetch
+    expect(await runWorkflow('doctor', ['--config', path])).toBe(1)
+    expect(await runWorkflow('upload', ['--config', path, '--strict'])).toBe(1)
+    expect(await runWorkflow('upload', ['--config', path])).toBe(0)
+    expect(methods).toEqual(['GET', 'GET', 'GET'])
+  })
+  test('a legacy server remains usable for builds without source ZIPs', async () => {
+    const path = config(false)
+    globalThis.fetch = (async () => Response.json(legacy)) as typeof fetch
+    expect(await runWorkflow('doctor', ['--config', path])).toBe(0)
+  })
+  test('wrong inventory shapes and unauthorised tokens never become compatibility success', async () => {
+    const opts = { apiUrl: 'https://upload.test', token: 't', release: legacy.release }
+    for (const body of [{}, { ...legacy, release: 'another-app' }, { ...legacy, artifacts: null }]) {
+      globalThis.fetch = (async () => Response.json(body)) as typeof fetch
+      await expect(fetchArtifacts(opts)).rejects.toThrow('Unsupported artifact inventory response')
+    }
+    globalThis.fetch = (async () => Response.json({ error: 'admin_token_required' }, { status: 403 })) as typeof fetch
+    expect(await runWorkflow('doctor', ['--config', config()])).toBe(1)
+  })
+})

package/src/__tests__/expand-sourcemaps.test.ts

@@ -0,0 +1,56 @@
+// A directory of maps keeps its shape on the way to the server.
+//
+// The server matches a frame to a map by how many trailing path
+// segments they share, because a mini program names every page's entry
+// `index.js` and a web build names every chunk after its route. The
+// CLI sent only the basename, so that matching never saw more than a
+// filename however carefully it was written — and passing a directory,
+// which the web getting-started page tells people to do, threw EISDIR.
+
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { describe, expect, it } from 'bun:test'
+
+import { expandSourcemapPaths } from '../upload.js'
+
+const tree = (): string => {
+  const root = mkdtempSync(join(tmpdir(), 'sentori-maps-'))
+  mkdirSync(join(root, 'pages/cart'), { recursive: true })
+  mkdirSync(join(root, 'pages/home'), { recursive: true })
+  writeFileSync(join(root, 'pages/cart/index.js.map'), '{}')
+  writeFileSync(join(root, 'pages/home/index.js.map'), '{}')
+  writeFileSync(join(root, 'pages/cart/index.js'), '//')
+  writeFileSync(join(root, 'main.js.map'), '{}')
+  return root
+}
+
+describe('expandSourcemapPaths', () => {
+  it('keeps the path under the directory, so two index.js.map stay distinct', () => {
+    const names = expandSourcemapPaths(tree())
+      .map((t) => t.name)
+      .sort()
+    expect(names).toEqual(['main.js.map', 'pages/cart/index.js.map', 'pages/home/index.js.map'])
+  })
+
+  it('takes only maps, not the bundles beside them', () => {
+    // A bundle uploaded as a sourcemap is stored, unparseable, and
+    // lights the release row amber — which happened in production for
+    // months on a real release.
+    expect(expandSourcemapPaths(tree()).every((t) => t.name.endsWith('.map'))).toBe(true)
+  })
+
+  it('leaves a single file as its basename', () => {
+    const root = tree()
+    const out = expandSourcemapPaths(join(root, 'pages/cart/index.js.map'))
+    expect(out).toHaveLength(1)
+    expect(out[0]!.name).toBe('index.js.map')
+  })
+
+  it('does not throw on a path that does not exist', () => {
+    // The caller's read produces the real error with the real path in
+    // it; this must not pre-empt it with a worse one.
+    expect(() => expandSourcemapPaths('/nope/missing.map')).not.toThrow()
+  })
+})

package/src/__tests__/rn-upload-hook.test.ts

@@ -0,0 +1,35 @@
+import { afterEach, beforeEach, expect, test } from 'bun:test'
+import { spawnSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const hook = fileURLToPath(new URL('../../../react-native/bin/sentori-rn-upload-source-bundle.cjs', import.meta.url))
+let root: string
+beforeEach(() => {
+  root = realpathSync(mkdtempSync(join(tmpdir(), 'sentori-hook-test-')))
+  mkdirSync(join(root, 'node_modules/.bin'), { recursive: true })
+  writeFileSync(join(root, 'node_modules/.bin/sentori'), `#!/usr/bin/env node
+require('node:fs').writeFileSync('invocation.json', JSON.stringify({args:process.argv.slice(2),token:process.env.BUILD_TOKEN}));process.exit(Number(process.env.STUB_EXIT || 0));`, { mode: 0o755 })
+})
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+function run(args: string[], extra: Record<string,string> = {}) {
+  const env = { ...process.env, ...extra }; delete env.SENTORI_RELEASE
+  return spawnSync('node', [hook, ...args], { cwd: root, env, encoding: 'utf8' })
+}
+test('RN hook delegates the entire configured upload to sentori and keeps credentials out of argv', () => {
+  writeFileSync(join(root, 'sentori.config.json'), JSON.stringify({ version: 1, tokenEnv: 'BUILD_TOKEN' }))
+  expect(run(['--release', 'app@1+7', '--git-tag', 'v1', '--token', 'secret', '--strict']).status).toBe(0)
+  const invocation = JSON.parse(readFileSync(join(root, 'invocation.json'), 'utf8'))
+  expect(invocation.args).toEqual(['upload', 'all', '--config', join(root, 'sentori.config.json'), '--release', 'app@1+7', '--git-tag', 'v1', '--strict'])
+  expect(invocation.token).toBe('secret')
+  expect(run([], { STUB_EXIT: '1' }).status).toBe(0)
+  expect(run(['--strict'], { STUB_EXIT: '1' }).status).toBe(1)
+})
+test('legacy hook requires exact release identity instead of guessing package version', () => {
+  writeFileSync(join(root, 'package.json'), JSON.stringify({ version: '1.0.0' }))
+  expect(run(['--platform', 'ios', '--strict']).status).toBe(1)
+  expect(run(['--platform', 'ios', '--release', 'app@1+7', '--strict']).status).toBe(0)
+  expect(JSON.parse(readFileSync(join(root, 'invocation.json'), 'utf8')).args).toEqual(['upload', 'srcbundle', '--release', 'app@1+7', '--root', root, 'ios', '--strict'])
+})

package/src/__tests__/srcbundle.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { unzipSync, zipSync } from 'fflate'
+import { collectSources, inspectSourceArchive, packSources, SOURCE_MANIFEST } from '../srcbundle.js'
+
+let root: string
+beforeEach(() => { root = mkdtempSync(join(tmpdir(), 'sentori-sources-test-')) })
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+function file(path: string, body: string) { const full = join(root, path); mkdirSync(join(full, '..'), { recursive: true }); writeFileSync(full, body) }
+function git(...args: string[]) { return execFileSync('git', ['-C', root, '-c', 'user.name=Test', '-c', 'user.email=test@example.test', '-c', 'commit.gpgsign=false', ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim() }
+
+describe('source archive collection', () => {
+  test('works without Git, preserves selected roots and excludes dependencies and secrets', () => {
+    file('ios/Pay.swift', 'ios code'); file('shared/Pay.swift', 'shared code')
+    file('ios/.env', 'secret'); file('ios/Pods/P.swift', 'dependency')
+    file('shared/tests/Test.swift', 'test code'); file('shared/index.ts', 'export {}')
+    const result = packSources(['ios', 'shared'], 'app@1+7', { root, exclude: ['shared/tests'] })
+    expect(result.manifest.files.map(x => x.path)).toEqual(['ios/Pay.swift', 'shared/Pay.swift', 'shared/index.ts'])
+    expect(inspectSourceArchive(result.bytes, 'app@1+7').files).toEqual(result.manifest.files.map(x => x.path))
+    expect(unzipSync(result.bytes)['shared/Pay.swift']).toEqual(Buffer.from('shared code'))
+    expect(packSources(['shared', 'ios'], 'app@1+7', { root, exclude: ['shared/tests'] }).bytes).toEqual(result.bytes)
+  })
+  test('explicitly selected generated sources are included without sweeping build output', () => {
+    file('src/a.kt', 'app'); file('build/generated/Bindings.kt', 'generated'); file('build/cache/Other.kt', 'cache')
+    expect(Object.keys(collectSources(['.'], { root }).bundle)).toEqual(['src/a.kt'])
+    expect(Object.keys(collectSources(['src', 'build/generated'], { root }).bundle)).toEqual(['src/a.kt', 'build/generated/Bindings.kt'])
+  })
+  test('an exact annotated tag ignores later commits and uncommitted files without checkout', () => {
+    git('init'); file('src/a.kt', 'tagged code'); git('add', '.'); git('commit', '-m', 'tagged')
+    git('-c', 'tag.gpgsign=false', 'tag', '-a', 'v1', '-m', 'release')
+    const commit = git('rev-parse', 'HEAD')
+    file('src/a.kt', 'later code'); git('add', '.'); git('commit', '-m', 'later')
+    file('src/a.kt', 'uncommitted'); file('src/new.kt', 'untracked')
+    const head = git('rev-parse', 'HEAD')
+    const packed = packSources(['src'], 'app@1+7', { root, gitTag: 'v1' })
+    expect(packed.manifest.source).toEqual({ type: 'git-tag', tag: 'v1', commit })
+    expect(unzipSync(packed.bytes)['src/a.kt']).toEqual(Buffer.from('tagged code'))
+    expect(packed.manifest.files).toHaveLength(1)
+    expect(readFileSync(join(root, 'src/a.kt'), 'utf8')).toBe('uncommitted')
+    expect(git('rev-parse', 'HEAD')).toBe(head)
+    expect(() => packSources(['src'], 'r', { root, gitTag: 'master' })).toThrow()
+  })
+  test('skips symbolic links and rejects selections escaping the declared root', () => {
+    file('src/a.kt', 'ok'); symlinkSync('/etc/passwd', join(root, 'src/secret.kt'))
+    expect(Object.keys(collectSources(['src'], { root }).bundle)).toEqual(['src/a.kt'])
+    expect(() => collectSources(['../'], { root })).toThrow('outside')
+  })
+  test('does not silently truncate oversized selected sources', () => {
+    file('src/huge.kt', 'x'.repeat(512 * 1024 + 1))
+    expect(() => packSources(['src'], 'r', { root })).toThrow('512 KiB')
+  })
+  test('validates external ZIP paths, release and manifest hashes', () => {
+    file('src/a.kt', 'code')
+    const packed = packSources(['src'], 'r1', { root })
+    expect(() => inspectSourceArchive(packed.bytes, 'r2')).toThrow('does not match')
+    const files = unzipSync(packed.bytes); files['src/a.kt'] = Buffer.from('tampered')
+    expect(() => inspectSourceArchive(zipSync(files), 'r1')).toThrow('checksum')
+    expect(() => inspectSourceArchive(zipSync({ '../bad.kt': Buffer.from('bad') }))).toThrow('unsafe')
+    expect(() => inspectSourceArchive(zipSync({}))).toThrow('empty')
+    expect(inspectSourceArchive(zipSync({ 'Sources/App.swift': Buffer.from('plain zip') })).files).toEqual(['Sources/App.swift'])
+    expect(unzipSync(packed.bytes)[SOURCE_MANIFEST]).toBeDefined()
+  })
+})