@hsuite/smart-engines-cli 1.5.0 → 1.5.2

package/dist/_lib/docker.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":";;AAmEA,4BAEC;AAQD,kCAWC;AAaD,0CAIC;AAcD,4CAiBC;AAUD,gDAYC;AAaD,gCAqBC;AAhMD;;;;;;;;;;;;;;GAcG;AACH,iDAAsC;AAatC;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAK,CAAC;IACxC,OAAO,IAAI,OAAO,CAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CACxC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpD,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAuB,EAAE,GAAW;IAC3D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAuB,EACvB,OAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACvE,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,mEAAmE;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAAC,MAAc,EAAE,QAAuB;IACtE,IAAI,WAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAa,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;IAChE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,SAAS,EAAE,UAAU,EAAE,uBAAuB,EAAE,GAAG,CAAC,EACrD,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,UAAU,CAC9B,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,wDAAwD;QACnE,wEAAwE;QACxE,kEAAkE,CACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/_lib/docker.ts"],"names":[],"mappings":";;AAmEA,4BAEC;AAQD,kCAWC;AAaD,0CAIC;AAkBD,sDAQC;AAYD,sDAYC;AAmBD,gCA2BC;AAzMD;;;;;;;;;;;;;;GAcG;AACH,iDAAsC;AAatC;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CACtB,IAAc,EACd,OAA2D,EAAE;IAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAK,CAAC;IACxC,OAAO,IAAI,OAAO,CAAY,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE,CACxC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpD,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,QAAuB,EAAE,GAAW;IAC3D,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,QAAuB,EACvB,OAAsB;IAEtB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CACtC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACvE,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAC9C,CAAC;IACF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,mEAAmE;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,qBAAqB,CAAC,MAAc;IAClD,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,qBAAqB,CACzC,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAC9C,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,EACxC,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,qBAAqB,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,UAAU,CAC9B,QAAuB,EACvB,GAAW,EACX,OAAsB;IAEtB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,0DAA0D;YACrE,mFAAmF;YACnF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;IACzD,IAAI,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,2BAA2B,QAAQ,oBAAoB;YAC/E,UAAU,YAAY,2DAA2D;YACjF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/_lib/frontend-guard.d.ts

@@ -1,3 +1,4 @@
+import type { RunFn } from './baas';
 /**
  * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
  * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
@@ -10,4 +11,62 @@
  * false-positive on the guard's own comparison literal (`REPLACE_BEFORE_DEPLOY:"`).
  */
 export declare function assertNoDeploySentinels(dir: string): Promise<void>;
+/**
+ * #2793: `resolveFrontendBundle` (`deploy.ts` / `redeploy.ts`) `mkdir -p`s the
+ * frontend `dir` BEFORE spawning the optional `frontend.build` hook — required
+ * (#2790, load-bearing): `execFileSync(..., { cwd: dir })` throws `ENOENT` on a
+ * missing cwd, verified empirically. Side effect: the sibling `existsSync(dir)`
+ * guard that used to catch a build that never produced its output dir can now
+ * NEVER fire once a hook is configured — `dir` always exists post-`mkdir`,
+ * whether or not the hook actually wrote into it.
+ *
+ * Nothing downstream catches an empty dir either: `assertNoDeploySentinels`'s
+ * `readdir` walk is a no-op on zero files, `tarFrontend` happily tars nothing
+ * into a syntactically valid tar, and the host only logs `size=<n>B` with no
+ * minimum. Net effect without this guard: a `frontend.build` hook that exits 0
+ * without populating `dir` ships an empty SPA bundle, silently, with no error
+ * at any layer.
+ *
+ * Assert `dir` is plausibly a built SPA: non-empty, and containing
+ * `index.html` at its root — the shape the browser-build output this CLI
+ * targets always has (`ng build`'s legacy `browser` builder — the one every
+ * shipped manifest uses — writes `index.html` directly under `outputPath`,
+ * not nested). Call this AFTER the build hook runs, so the hook remains what
+ * is allowed to populate `dir` (mirrors the existsSync timing already moved
+ * post-hook by #2788) — the failure then names the hook that ran, not the
+ * upload step three calls later that would otherwise be blamed.
+ *
+ * #2795: `frontend.build` is OPTIONAL (`ManifestFrontend.build?`), and a bare
+ * `frontend.dir` — "a pre-built/checked-in SPA dir" — is a first-class
+ * documented manifest shape. That branch has the SAME empty-bundle failure
+ * mode for a different reason: `existsSync(dir)` never checked
+ * empty-vs-populated, so an EXISTING but EMPTY dir (wiped, mis-`.gitignore`'d,
+ * stale checkout, a typo'd `dir` that resolves to an existing folder) shipped
+ * silently too. So `buildHook` is optional: pass `f.build` straight through
+ * and the remedy names whatever was actually responsible for populating `dir`
+ * on this branch — never a hook that was never configured.
+ */
+export declare function assertPlausibleSpaBundle(dir: string, buildHook?: string): Promise<void>;
+/**
+ * #2798 / #2791: the `frontend.bundlePath` branch of `resolveFrontendBundle`
+ * (deploy.ts / redeploy.ts) — "a pre-built tarball; takes precedence over
+ * `dir` when set" (deploy-manifest.ts) — returned BEFORE both dir-shaped
+ * guards, so an empty/truncated tarball, or one still carrying unfilled
+ * `REPLACE_BEFORE_DEPLOY:*` placeholders, uploaded unvalidated. Same silent
+ * broken-bundle symptom #2793/#2795 closed for `dir`, plus the sentinel
+ * exposure #2788 exists to prevent.
+ *
+ * The artifact here is a TAR, not a directory, so `fs.readdir` does not
+ * apply. Plausibility is checked from the archive LISTING (`tar -tf`): the
+ * bundle the host mounts must contain `index.html` at its root (`tarFrontend
+ * `-C <dir> .` puts it there; any pre-built bundle missing it has the same
+ * wrong-shape failure `assertPlausibleSpaBundle` rejects) and must be
+ * non-empty. A zero-byte file — the "build created the file then died" shape
+ * — fails both the size floor and the listing, and is named as such.
+ *
+ * Sentinels (#2791): `assertNoDeploySentinels` walks a directory tree, so the
+ * tarball is unpacked to a throwaway temp dir and the EXISTING guard runs
+ * unchanged against it — one sentinel matcher, not two that can drift.
+ */
+export declare function assertPlausibleSpaTarball(tarPath: string, runFn?: RunFn): Promise<void>;
 //# sourceMappingURL=frontend-guard.d.ts.map

package/dist/_lib/frontend-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-guard.d.ts","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxE"}
+{"version":3,"file":"frontend-guard.d.ts","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C7F"}

package/dist/_lib/frontend-guard.js

@@ -1,8 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assertNoDeploySentinels = assertNoDeploySentinels;
+exports.assertPlausibleSpaBundle = assertPlausibleSpaBundle;
+exports.assertPlausibleSpaTarball = assertPlausibleSpaTarball;
 const fs_1 = require("fs");
 const path_1 = require("path");
+const os_1 = require("os");
 /**
  * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
  * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
@@ -38,4 +74,116 @@ async function assertNoDeploySentinels(dir) {
             (hits.length > 5 ? `, +${hits.length - 5} more` : ''));
     }
 }
+/**
+ * #2793: `resolveFrontendBundle` (`deploy.ts` / `redeploy.ts`) `mkdir -p`s the
+ * frontend `dir` BEFORE spawning the optional `frontend.build` hook — required
+ * (#2790, load-bearing): `execFileSync(..., { cwd: dir })` throws `ENOENT` on a
+ * missing cwd, verified empirically. Side effect: the sibling `existsSync(dir)`
+ * guard that used to catch a build that never produced its output dir can now
+ * NEVER fire once a hook is configured — `dir` always exists post-`mkdir`,
+ * whether or not the hook actually wrote into it.
+ *
+ * Nothing downstream catches an empty dir either: `assertNoDeploySentinels`'s
+ * `readdir` walk is a no-op on zero files, `tarFrontend` happily tars nothing
+ * into a syntactically valid tar, and the host only logs `size=<n>B` with no
+ * minimum. Net effect without this guard: a `frontend.build` hook that exits 0
+ * without populating `dir` ships an empty SPA bundle, silently, with no error
+ * at any layer.
+ *
+ * Assert `dir` is plausibly a built SPA: non-empty, and containing
+ * `index.html` at its root — the shape the browser-build output this CLI
+ * targets always has (`ng build`'s legacy `browser` builder — the one every
+ * shipped manifest uses — writes `index.html` directly under `outputPath`,
+ * not nested). Call this AFTER the build hook runs, so the hook remains what
+ * is allowed to populate `dir` (mirrors the existsSync timing already moved
+ * post-hook by #2788) — the failure then names the hook that ran, not the
+ * upload step three calls later that would otherwise be blamed.
+ *
+ * #2795: `frontend.build` is OPTIONAL (`ManifestFrontend.build?`), and a bare
+ * `frontend.dir` — "a pre-built/checked-in SPA dir" — is a first-class
+ * documented manifest shape. That branch has the SAME empty-bundle failure
+ * mode for a different reason: `existsSync(dir)` never checked
+ * empty-vs-populated, so an EXISTING but EMPTY dir (wiped, mis-`.gitignore`'d,
+ * stale checkout, a typo'd `dir` that resolves to an existing folder) shipped
+ * silently too. So `buildHook` is optional: pass `f.build` straight through
+ * and the remedy names whatever was actually responsible for populating `dir`
+ * on this branch — never a hook that was never configured.
+ */
+async function assertPlausibleSpaBundle(dir, buildHook) {
+    const entries = await fs_1.promises.readdir(dir, { withFileTypes: true });
+    const hasIndexHtml = entries.some((e) => e.isFile() && e.name === 'index.html');
+    if (entries.length > 0 && hasIndexHtml)
+        return;
+    const reason = entries.length === 0 ? 'is empty' : 'has no index.html at its root';
+    throw new Error(buildHook
+        ? `frontend build produced no usable SPA bundle: ${dir} ${reason}. The ` +
+            `frontend.build hook (\`${buildHook}\`) exited 0 without writing a bundle ` +
+            `into its own output dir — verify it actually builds INTO ${dir} ` +
+            `(a mismatched --output-path / missing \`cd\` is the usual cause).`
+        : `frontend build produced no usable SPA bundle: ${dir} ${reason}, and ` +
+            `no \`frontend.build\` hook is configured — a bare frontend.dir must ` +
+            `ALREADY contain a built SPA. Build it before deploying (or add a ` +
+            `\`frontend.build\` hook to the manifest), and check frontend.dir points ` +
+            `at the real build output.`);
+}
+/**
+ * #2798 / #2791: the `frontend.bundlePath` branch of `resolveFrontendBundle`
+ * (deploy.ts / redeploy.ts) — "a pre-built tarball; takes precedence over
+ * `dir` when set" (deploy-manifest.ts) — returned BEFORE both dir-shaped
+ * guards, so an empty/truncated tarball, or one still carrying unfilled
+ * `REPLACE_BEFORE_DEPLOY:*` placeholders, uploaded unvalidated. Same silent
+ * broken-bundle symptom #2793/#2795 closed for `dir`, plus the sentinel
+ * exposure #2788 exists to prevent.
+ *
+ * The artifact here is a TAR, not a directory, so `fs.readdir` does not
+ * apply. Plausibility is checked from the archive LISTING (`tar -tf`): the
+ * bundle the host mounts must contain `index.html` at its root (`tarFrontend
+ * `-C <dir> .` puts it there; any pre-built bundle missing it has the same
+ * wrong-shape failure `assertPlausibleSpaBundle` rejects) and must be
+ * non-empty. A zero-byte file — the "build created the file then died" shape
+ * — fails both the size floor and the listing, and is named as such.
+ *
+ * Sentinels (#2791): `assertNoDeploySentinels` walks a directory tree, so the
+ * tarball is unpacked to a throwaway temp dir and the EXISTING guard runs
+ * unchanged against it — one sentinel matcher, not two that can drift.
+ */
+async function assertPlausibleSpaTarball(tarPath, runFn) {
+    const st = await fs_1.promises.stat(tarPath).catch(() => {
+        throw new Error(`frontend bundle not found: ${tarPath}`);
+    });
+    if (st.size === 0) {
+        throw new Error(`frontend bundle is a ZERO-BYTE file: ${tarPath}. A build that created ` +
+            `the tarball then died before writing it — rebuild it before deploying.`);
+    }
+    const run = runFn ?? (await Promise.resolve().then(() => __importStar(require('child_process')))).execFileSync;
+    let listing;
+    try {
+        listing = run('tar', ['-tf', tarPath], { encoding: 'utf8' });
+    }
+    catch {
+        throw new Error(`frontend bundle is not a readable tar archive: ${tarPath}. Rebuild it ` +
+            `before deploying (a truncated or partially-uploaded tar fails here).`);
+    }
+    const entries = listing
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    const hasRootIndex = entries.some((e) => e === './index.html' || e === 'index.html');
+    if (!hasRootIndex) {
+        throw new Error(`frontend bundle has no index.html at its root: ${tarPath} (entries: ` +
+            `${entries.slice(0, 5).join(', ')}${entries.length > 5 ? `, +${entries.length - 5} more` : ''}). ` +
+            `The bundle root must contain the built SPA — the same shape ` +
+            `assertPlausibleSpaBundle enforces for frontend.dir.`);
+    }
+    // #2791: run the UNCHANGED dir-shaped sentinel walk over the unpacked
+    // bundle. Temp dir is under os.tmpdir() and best-effort removed after.
+    const probe = await fs_1.promises.mkdtemp((0, path_1.join)((0, os_1.tmpdir)(), 'hsuite-bundlepath-'));
+    try {
+        run('tar', ['-xf', tarPath, '-C', probe], {});
+        await assertNoDeploySentinels(probe);
+    }
+    finally {
+        await fs_1.promises.rm(probe, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
 //# sourceMappingURL=frontend-guard.js.map

package/dist/_lib/frontend-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-guard.js","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":";;AAcA,0DAuBC;AArCD,2BAAoC;AACpC,+BAAsC;AAEtC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,iFAAiF;YACjF,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"frontend-guard.js","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,0DAuBC;AAqCD,4DAiBC;AAuBD,8DA0CC;AA9JD,2BAAoC;AACpC,+BAAsC;AACtC,2BAA4B;AAG5B;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,iFAAiF;YACjF,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,wBAAwB,CAAC,GAAW,EAAE,SAAkB;IAC5E,MAAM,OAAO,GAAG,MAAM,aAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY;QAAE,OAAO;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,+BAA+B,CAAC;IACnF,MAAM,IAAI,KAAK,CACb,SAAS;QACP,CAAC,CAAC,iDAAiD,GAAG,IAAI,MAAM,QAAQ;YACtE,0BAA0B,SAAS,wCAAwC;YAC3E,4DAA4D,GAAG,GAAG;YAClE,mEAAmE;QACrE,CAAC,CAAC,iDAAiD,GAAG,IAAI,MAAM,QAAQ;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,0EAA0E;YAC1E,2BAA2B,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAAa;IAC5E,MAAM,EAAE,GAAG,MAAM,aAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,yBAAyB;YACtE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,IAAK,CAAC,wDAAa,eAAe,GAAC,CAAC,CAAC,YAAiC,CAAC;IACxF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAsB,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,eAAe;YACtE,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC;IACrF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,aAAa;YACpE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK;YAClG,8DAA8D;YAC9D,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,aAAE,CAAC,OAAO,CAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,aAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/_lib/registry-fanout.d.ts

@@ -2,7 +2,7 @@ import { Buffer } from 'buffer';
 /** A request against one cluster's Harbor Registry-v2 API. `path` is always `/v2/...` (or `/token...`). */
 export type RegistryRequest = {
     ip: string;
-    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH';
+    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
     path: string;
     headers?: Record<string, string>;
     body?: Buffer;
@@ -45,6 +45,17 @@ export type EnsureImageOpts = {
     /** Test seam — defaults to {@link defaultTransport} bound to `host`. */
     transport?: RegistryTransport;
 };
+/** Default per-request wall-clock budget for registry / cluster probes. */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 10000;
+/**
+ * Reject after `ms` instead of waiting on a request that may never settle.
+ *
+ * {@link defaultTransport} builds a bare `https.request` with no socket timeout,
+ * so a peer that completes the TCP handshake and then black-holes the response
+ * hangs its promise forever. Every probe that fans out across the cluster set
+ * wraps its requests in this.
+ */
+export declare function withRequestTimeout<T>(p: Promise<T>, ms: number, what: string): Promise<T>;
 /** A parsed `WWW-Authenticate: Bearer ...` token challenge. `realm` is mandatory. */
 export type AuthChallenge = {
     realm: string;
@@ -91,6 +102,16 @@ export type ResolveRegistryDigestOpts = {
     transport?: RegistryTransport;
     /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
     resolve4?: (h: string) => Promise<string[]>;
+    /**
+     * Per-request wall-clock budget for the manifest probe. Default 10s.
+     *
+     * Load-bearing since {@link probeServedDigests} must visit EVERY endpoint (the
+     * agreement logic needs all the answers) and so can no longer skip past a
+     * black-holing cluster the way the old first-responder read did. A node that
+     * completes the TCP handshake and then never answers would otherwise wedge the
+     * deploy indefinitely — `defaultTransport` sets no socket timeout.
+     */
+    requestTimeoutMs?: number;
 };
 /**
  * Resolve the CANONICAL manifest digest the registry serves for `<repo>:<tag>`
@@ -117,6 +138,31 @@ export type ResolveRegistryDigestOpts = {
  * deployer still re-verifies).
  */
 export declare function resolveRegistryDigest(opts: ResolveRegistryDigestOpts): Promise<string | null>;
+/** What ONE cluster endpoint serves for a tag. `digest: null` ⇒ 404 / unreachable. */
+export type ServedDigestAnswer = {
+    ip: string;
+    digest: string | null;
+};
+/**
+ * Ask EVERY cluster endpoint what it serves for `<repo>:<tag>` and return all
+ * the answers, in endpoint order.
+ *
+ * The federated registry name is round-robin over N INDEPENDENT Harbors, so
+ * "what does the registry serve for this tag" is a set of answers, not one
+ * answer. In the window between a `docker push` (which lands on exactly ONE
+ * cluster) and the fan-out, a re-used tag legitimately resolves to the NEW
+ * artifact on the origin and the PREVIOUS artifact on its peers. Collapsing
+ * that set to "whoever answered first" is what signed a stale digest in #2787.
+ */
+export declare function probeServedDigests(opts: ResolveRegistryDigestOpts): Promise<ServedDigestAnswer[]>;
+/**
+ * Normalise a `registry.server` into the bare DNS name the endpoint resolvers
+ * and the push probe work with: scheme stripped, port stripped. One definition —
+ * this pair of regexes had accumulated four copies across three files, and a
+ * drift between them would silently change which host the fan-out resolves
+ * versus which one the push is pinned to.
+ */
+export declare function registryHostOf(server: string): string;
 /** Registry coordinates a push produced (shape of `BaasInitResponse.registry`). */
 export type FanOutRegistry = {
     server: string;
@@ -127,8 +173,29 @@ export type FanOutRegistry = {
 export type ResolveAttestationDigestOpts = {
     registry: FanOutRegistry;
     tag: string;
-    /** The `sha256:<64hex>` digest the local `docker push` reported. */
+    /**
+     * The `sha256:<64hex>` digest the push produced.
+     *
+     * On the build+push path this is NOT a local-daemon value: `buildAndPush`
+     * resolves it from the ORIGIN registry (`docker buildx imagetools inspect`
+     * against the pinned single-origin target) and hard-errors if the `docker
+     * push` summary disagrees with it. On `--skip-push` it is the round-robin
+     * registry's answer for a tag nobody is currently writing.
+     */
     pushDigest: string;
+    /**
+     * SINGLE-ORIGIN registry hostname the push was pinned to (`resolvePushOrigin`,
+     * #1679) — the one cluster that actually received the bytes this run.
+     *
+     * When set, the resolver returns {@link pushDigest} and nothing else: the
+     * origin's own live answer is a CROSS-CHECK (disagreement ⇒ throw), and a
+     * peer's differing answer is pre-fan-out divergence to converge, never a value
+     * to adopt (#2787). Omit it on `--skip-push` / an unpinned push: then no
+     * endpoint is privileged and the endpoints that answer must AGREE.
+     */
+    originHost?: string;
+    /** Per-request probe timeout (ms). Default {@link DEFAULT_PROBE_TIMEOUT_MS}. */
+    requestTimeoutMs?: number;
     /** Optional progress log sink (defaults to no-op). */
     log?: (msg: string) => void;
     /** Test seam — the registry transport. */
@@ -138,16 +205,100 @@ export type ResolveAttestationDigestOpts = {
 };
 /**
  * Decide the digest to ATTEST (and to feed the fan-out): the digest Harbor
- * SERVES for `<repo>:<tag>`, resolved the same way the deployer does. Falls back
- * to the local `docker push` summary digest ONLY if the registry can't be probed
- * (offline / dev registry / transient) — a fail-SOFT, never a fail-open, because
- * the deployer independently re-verifies the served digest against the attested
- * one before it pins the pod.
+ * SERVES for `<repo>:<tag>`, resolved the same way the deployer does.
+ *
+ * ## Which Harbor, though (#2787)
+ *
+ * `harbor.<domain>` is round-robin over N INDEPENDENT Harbors and a `docker
+ * push` lands on exactly ONE of them. Between the push and the fan-out, a
+ * re-used tag therefore resolves to the NEW artifact on the push origin and to
+ * the PREVIOUS artifact on its peers — both are "the registry-served digest".
+ * This function used to take whichever endpoint answered first, which on
+ * testnet signed `d889ff2a…` (a peer's stale `v12`) for a run that had just
+ * pushed `d6ae4a80…`. The deployer that received that attestation refused the
+ * image — correctly, it cannot tell a stale attestation from a swapped one —
+ * and stayed pinned to the old release while its two peers moved on.
+ *
+ * So:
+ *   - **`originHost` set** (a pinned push landed there) → the result is ALWAYS
+ *     {@link ResolveAttestationDigestOpts.pushDigest}, the digest `buildAndPush`
+ *     read back from the origin registry after the upload. The origin's live
+ *     answer is only a cross-check: if it answers something else we THROW (the
+ *     tag moved underneath us and either value would be a guess), and if it does
+ *     not answer at all we still attest `pushDigest` rather than fall through to
+ *     the peers — the silent-origin case is exactly when the peers unanimously
+ *     serve the PREVIOUS artifact. Peers serving something else are logged and
+ *     left to the fan-out, which copies this manifest to them and re-verifies
+ *     (throwing if it can't).
+ *   - **no `originHost`** (`--skip-push` / unpinned push) → no endpoint is
+ *     privileged, so the endpoints that answer MUST agree. A split mesh THROWS,
+ *     naming every endpoint and its digest — #2766 is a live condition here and
+ *     a coin flip is not an attestation. A served digest may only OVERRIDE
+ *     `pushDigest` when the WHOLE endpoint set answered; a lone answer from a
+ *     partially-reachable mesh also THROWS, because the fan-out would then copy
+ *     that one endpoint's bytes everywhere and make it mesh truth.
  *
- * See {@link resolveRegistryDigest} for why the served digest — not the push
- * summary — is authoritative for the #1445 strict-equality gate (issue #1589).
+ * Falls back to `pushDigest` without complaint when NO endpoint can be probed
+ * (offline / dev registry / transient) — a fail-SOFT, never a fail-open: the
+ * deployer independently re-verifies the served digest against the attested one
+ * before it pins the pod.
+ *
+ * See {@link resolveRegistryDigest} for why a registry-served digest — not the
+ * `docker push` summary — is authoritative for the #1445 strict-equality gate
+ * (issue #1589).
  */
 export declare function resolveAttestationDigest(opts: ResolveAttestationDigestOpts): Promise<string>;
+/**
+ * Result of {@link assertTagFreeOnMesh}: what each cluster Harbor serves for
+ * the candidate tag, or `null` when the registry is not a federated mesh
+ * (nothing was checked — identical semantics to `fanOutPushedImage`'s null).
+ */
+export type MeshTagOccupancy = {
+    host: string;
+    tag: string;
+    /** One entry per cluster ingress: the digest it serves, or `null` when the tag is absent there. */
+    perEndpoint: Array<{
+        ip: string;
+        digest: string | null;
+    }>;
+};
+/** Options for {@link assertTagFreeOnMesh}. */
+export type AssertTagFreeOnMeshOpts = {
+    registry: FanOutRegistry;
+    /** The candidate tag the deploy is about to `docker push` under. */
+    tag: string;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /** Test seam — the registry transport. */
+    transport?: RegistryTransport;
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+};
+/**
+ * #2766 — BEFORE a `docker push`, prove the candidate tag is unoccupied on
+ * EVERY cluster Harbor of the mesh. Tag immutability is enforced per-cluster,
+ * so it cannot prevent divergence BETWEEN registries: a tag that already
+ * exists on any one of them (at any digest — the about-to-be-pushed build has
+ * a fresh, unknowable digest) makes the deploy 412 mid-fan-out at best, and at
+ * worst leaves the tag permanently inconsistent across the mesh (sn1/sn2 at
+ * one digest, sn3 at another, all immutable — unrecoverable without operator
+ * action). This check moves that failure BEFORE the build/push, where the
+ * operator just picks a fresh tag, and lists the divergence it found.
+ *
+ * Semantics:
+ *   - 0/1 endpoint, or DNS that does not fan out → `null` (single-target
+ *     registry; a single origin's own immutability already protects it).
+ *   - tag absent EVERYWHERE → the occupancy (all `digest: null`) — free to push.
+ *   - tag present on ANY endpoint at ANY digest → THROWS, one line per cluster
+ *     (`ip → sha256:… | absent`). A single-origin pre-check must never be
+ *     treated as authoritative anywhere in this path — the exact check that
+ *     produced the v10 incident.
+ *
+ * Fail-open is deliberate on TRANSPORT errors per endpoint? NO — a cluster we
+ * cannot interrogate is a cluster we cannot vouch for, so a non-404/200 answer
+ * is fatal too. Only the not-a-mesh case (above) returns `null`.
+ */
+export declare function assertTagFreeOnMesh(opts: AssertTagFreeOnMeshOpts): Promise<MeshTagOccupancy | null>;
 export type FanOutPushedImageOpts = {
     registry: FanOutRegistry;
     tag: string;
@@ -175,4 +326,143 @@ export type FanOutPushedImageOpts = {
  * resolves, so a failure here means a dev/local registry where fan-out is moot.
  */
 export declare function fanOutPushedImage(opts: FanOutPushedImageOpts): Promise<FanOutReport | null>;
+/** Options for {@link resolvePushOrigin}. */
+export type ResolvePushOriginOpts = {
+    /** Federated (round-robin) Harbor host, e.g. `harbor.testnet.hsuite.network`. */
+    host: string;
+    /** Repository path the push will target, e.g. `hsuite-customers-<appId>/app`. */
+    repository: string;
+    username: string;
+    password: string;
+    /** Test seam — the registry transport (defaults to {@link defaultTransport}). */
+    transport?: RegistryTransport;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /**
+     * Already-resolved cluster ingress IPs for {@link ResolvePushOriginOpts.host}.
+     * Supplied by {@link requirePushOrigin} so ONE DNS answer decides both "is
+     * this registry federated?" and "which origins do we probe?" — two
+     * independent lookups can disagree, and the whole point of this function is
+     * that a single answer set is authoritative for one push.
+     */
+    endpoints?: string[];
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+};
+/**
+ * Resolve the SINGLE-ORIGIN hostname a `docker push` must be aimed at, by
+ * asking the mesh which name it wants upload traffic on. Returns `null` when
+ * there is nothing to pin (single-target registry, no server-side pin, or a pin
+ * that fails validation) — the caller then pushes at the round-robin name, i.e.
+ * exactly today's behaviour.
+ *
+ * ## Why the push must be pinned at all (#1679)
+ *
+ * `harbor.<domain>` is public-DNS round-robin over three INDEPENDENT Harbors.
+ * A chunked blob upload (`POST` init → `PATCH` → `PUT` finalize) is stateful:
+ * the `_state` token is HMAC'd by the serving registry and the uploaded bytes
+ * sit on that cluster's own ReadWriteOnce PVC. When the client reconnects
+ * between requests and round-robin lands the next hop on a different cluster,
+ * the upload dies (`blob upload invalid` / `invalid secret`). Sharing
+ * `REGISTRY_HTTP_SECRET` and the token CA across the mesh (PR #2763) fixes the
+ * HMAC and the bearer token, but NOT the blob bytes — those are still local to
+ * one cluster. The push has to stay on one origin end to end; the fan-out then
+ * distributes the finished artifact ({@link fanOutPushedImage}).
+ *
+ * ## Why we ASK instead of deriving the name
+ *
+ * Each cluster's registry is already pinned server-side (`REGISTRY_HTTP_HOST`)
+ * and advertises that name in the `Location` of an upload-init. The server
+ * honours it; docker 29.5.2 does not — it keeps the host it DIALLED and reuses
+ * only the path+query of the `Location`, so the server-side pin never reaches
+ * the wire. Reading the advertised host and dialling it ourselves is therefore
+ * the client-side half of a pin the server already publishes. Deriving
+ * `harbor-sn1` from `harbor` by string surgery would instead bake a testnet DNS
+ * convention into a customer-facing CLI, and silently mis-aim any other mesh.
+ *
+ * ## Validation
+ *
+ * The advertised value is server-controlled, and the CLI hands it to
+ * `docker login` / `docker push` — so it gates the robot credential and the
+ * customer's image. Three guards, all fail-CLOSED (return `null`, never throw;
+ * the caller then pushes unpinned, exactly as it would have anyway):
+ *
+ *   1. Not an IP literal — no cert covers one here, and "does this address
+ *      resolve to itself" is not an identity check.
+ *   2. Inside `host`'s own parent DNS zone. A registry may only nominate a name
+ *      the OPERATOR already controls, never an arbitrary internet name.
+ *   3. Resolves to exactly ONE address, and that address is the very cluster
+ *      that advertised it.
+ *
+ * RESIDUAL RISK (accepted, documented): validation and use are two different
+ * DNS lookups — ours via `dns.resolve4`, then docker's own, moments later. A
+ * DNS rebind between them is not detectable from here, because docker resolves
+ * the hostname itself and takes no IP pin. Guard 2 is what makes that
+ * uninteresting: a rebind would need control of the operator's own zone, and an
+ * attacker holding that already owns `harbor.<domain>` itself. Closing the
+ * window completely means not shelling out to `docker` for the push at all
+ * (doing the upload over the Registry-v2 transport in this file, which does pin
+ * IP + SNI) — a much larger change, tracked separately.
+ *
+ * The probe opens one blob-upload session per attempt and cancels it
+ * (`DELETE`), so it leaves no half-open upload behind.
+ */
+export declare function resolvePushOrigin(opts: ResolvePushOriginOpts): Promise<string | null>;
+/**
+ * Options for {@link requirePushOrigin} — identical to
+ * {@link ResolvePushOriginOpts}; the wrapper differs in what it does with a
+ * failed pin, not in what it needs to attempt one. Named separately so the
+ * fail-closed entry point has its own referenceable contract.
+ */
+export type RequirePushOriginOpts = ResolvePushOriginOpts;
+/**
+ * The pin every push goes through (#2887). Wraps {@link resolvePushOrigin} and
+ * turns its fail-OPEN `null` into a hard failure **when the registry name is
+ * federated** — i.e. when it resolves to more than one origin.
+ *
+ * ## Why the fail-open had to go
+ *
+ * `resolvePushOrigin` returning `null` means "I could not pin this push". Its
+ * callers then pushed at the round-robin name, which is documented as
+ * "exactly today's behaviour" — but on a federated mesh today's behaviour does
+ * not work. Measured on testnet 2026-08-27 against
+ * `harbor.testnet.hsuite.network` (three A records, three INDEPENDENT Harbors,
+ * each signing its own bearer tokens and holding blob-upload sessions on its
+ * own ReadWriteOnce PVC): `Login Succeeded`, then some layers reporting
+ * `Layer already exists` while others sat on `Waiting`, then
+ * `error from registry: unauthorized to access repository: …, action: push`
+ * — on all 6 retries. The identical push aimed at `harbor-sn2.…` succeeded on
+ * the first attempt, then again at sn1 and sn3.
+ *
+ * So the unpinned fall-back is not a degraded push, it is a push that cannot
+ * succeed, and taking it silently costs a full image build plus six retries
+ * before failing with an error message that blames permissions. Refusing up
+ * front — naming the mesh, its origins, and the server-side knob that fixes it
+ * — is strictly better information for the same outcome.
+ *
+ * ## What is still a legitimate no-pin (returns `null`, no throw)
+ *
+ *   - ONE origin. A dev / local / single-VIP registry cannot split a push
+ *     across clusters, so there is nothing to pin and nothing to fail.
+ *   - DNS that cannot enumerate the name at all. `dns.resolve4` (this module's
+ *     resolver) ignores `/etc/hosts` while docker's own resolution does not, so
+ *     an unresolvable name here can still be a perfectly working single-origin
+ *     registry on the developer's machine. Unproven federation is not proven
+ *     federation; we log it and let the push proceed.
+ *
+ * RESIDUAL RISK (accepted, documented): the A-record count is the ONLY signal
+ * we have for "is this mesh federated". A resolver that answers with fewer
+ * records than the mesh really has — a spoofed or on-path answer, or simply a
+ * health-pruned view at query time — makes a three-Harbor mesh look
+ * single-origin, and the push falls back to unpinned. That is not a
+ * credential-disclosure risk (the three validation guards in
+ * {@link resolvePushOrigin} are untouched, and the fall-back still targets the
+ * operator's own round-robin name, resolved independently by docker); the cost
+ * is reinstating the failure mode above — a wasted build and six confusing
+ * retries. Removing it needs a source of mesh cardinality that is not DNS.
+ *
+ * Callers that genuinely want no pin have `--skip-push` (nothing is uploaded,
+ * so there is no upload session to keep on one origin).
+ */
+export declare function requirePushOrigin(opts: RequirePushOriginOpts): Promise<string | null>;
 //# sourceMappingURL=registry-fanout.d.ts.map

package/dist/_lib/registry-fanout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-fanout.d.ts","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAmChC,2GAA2G;AAC3G,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEpF,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgBhF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAA0B,GAClE,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6BhE;AAwHD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FxF;AA8ED,iDAAiD;AACjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+B9B"}
+{"version":3,"file":"registry-fanout.d.ts","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAmChC,2GAA2G;AAC3G,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IAGX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEpF,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAczF;AAED,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgBhF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAA0B,GAClE,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6BhE;AAwHD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FxF;AA8ED,iDAAiD;AACjD,MAAM,MAAM,yBAAyB,GAAG;IACtC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASxB;AAED,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CA2GjB;AAiBD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,mGAAmG;IACnG,WAAW,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwDlC;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+B9B;AAgBD,6CAA6C;AAC7C,MAAM,MAAM,qBAAqB,GAAG;IAClC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoJxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+C3F"}